@colyseus/core 0.18.0 → 0.18.2

package/build/router/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/index.ts"],
-  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export types needed for declaration emit\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && expressRootRoute(expressApp) !== undefined) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\nfunction expressRootRoute(expressApp: express.Application) {\n  //\n  // express v5 uses `app.router`, express v4 uses `app._router`\n  // check for `app._router` first, then `app.router`\n  //\n  // (express v4 will show a warning if `app.router` is used)\n  //\n  const stack = (expressApp as any)?._router?.stack ?? (expressApp as any)?.router?.stack;\n\n  if (!stack) {\n    return false;\n  }\n\n  return stack.find((layer: any) => layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  return createBetterCallRouter({ ...endpoints }, config);\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
-  "mappings": ";AAEA,SAAS,YAAY,uBAAuB;AAC5C,SAAwD,gBAAgB,wBAAwB,gBAAgB,kBAAkB,gBAAgB;AAClJ,SAAS,eAAe,YAAY,mBAAmB;AACvD,OAA0B;AAC1B,SAAS,kBAAkB;AAC3B,OAAO,SAAS,qBAAqB,KAAK,EAAE,MAAM,OAAO;AAEzD;AAAA,EACE,kBAAAA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,OAUK;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,YAAY,eAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,iBAAiB,UAAU,MAAM;AAAA,IAGhD,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,YAAY,eAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,IAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,QAAQ,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,eAAO,YAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,WAAO,cAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,WAAW;AAAA,MACd,GAAG,WAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAEA,SAAS,iBAAiB,YAAiC;AAOzD,QAAM,QAAS,YAAoB,SAAS,SAAU,YAAoB,QAAQ;AAElF,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,EACT;AAEA,SAAO,MAAM,KAAK,CAAC,UAAe,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtG;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,SAAO,uBAAuB,EAAE,GAAG,UAAU,GAAG,MAAM;AACxD;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,SAAO,iBAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,SAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,SAAO;AAAA,IACL,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,IACtC,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,cAAc,cAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,kBAAkB,cAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
+  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export types needed for declaration emit\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && hasExpressRootRoute(expressApp)) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\n/**\n * Whether the express app already handles the root route, in which case\n * Colyseus must not register its own default \"/\" endpoint over it.\n */\nfunction hasExpressRootRoute(expressApp: express.Application) {\n  return expressRouterStack(expressApp).some((layer: any) =>\n    layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\n/**\n * The app's router stack, or an empty stack if it has no routes yet.\n *\n * express v5 exposes the router as `app.router`; v4 exposes it as `app._router`\n * and only creates it once the first route/middleware is registered.\n */\nfunction expressRouterStack(expressApp: express.Application): any[] {\n  const app = expressApp as any;\n\n  if (app?._router?.stack) {\n    return app._router.stack;\n  }\n\n  try {\n    return app?.router?.stack ?? [];\n  } catch (e) {\n    return []; // express v4 throws on `app.router` \u2014 no routes registered\n  }\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  return createBetterCallRouter({ ...endpoints }, {\n    // better-call's /api/reference page dumps the full API surface\n    // unauthenticated \u2014 opt back in by passing `openapi` explicitly.\n    openapi: { disabled: true },\n    ...config,\n  });\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
+  "mappings": ";AAEA,SAAS,YAAY,uBAAuB;AAC5C,SAAwD,gBAAgB,wBAAwB,gBAAgB,kBAAkB,gBAAgB;AAClJ,SAAS,eAAe,YAAY,mBAAmB;AACvD,OAA0B;AAC1B,SAAS,kBAAkB;AAC3B,OAAO,SAAS,qBAAqB,KAAK,EAAE,MAAM,OAAO;AAEzD;AAAA,EACE,kBAAAA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,OAUK;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,YAAY,eAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,oBAAoB,UAAU;AAAA,IAG7C,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,YAAY,eAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,IAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,QAAQ,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,eAAO,YAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,WAAO,cAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,WAAW;AAAA,MACd,GAAG,WAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAMA,SAAS,oBAAoB,YAAiC;AAC5D,SAAO,mBAAmB,UAAU,EAAE,KAAK,CAAC,UAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtE;AAQA,SAAS,mBAAmB,YAAwC;AAClE,QAAM,MAAM;AAEZ,MAAI,KAAK,SAAS,OAAO;AACvB,WAAO,IAAI,QAAQ;AAAA,EACrB;AAEA,MAAI;AACF,WAAO,KAAK,QAAQ,SAAS,CAAC;AAAA,EAChC,SAAS,GAAG;AACV,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,SAAO,uBAAuB,EAAE,GAAG,UAAU,GAAG;AAAA;AAAA;AAAA,IAG9C,SAAS,EAAE,UAAU,KAAK;AAAA,IAC1B,GAAG;AAAA,EACL,CAAC;AACH;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,SAAO,iBAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,SAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,SAAO;AAAA,IACL,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,IACtC,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,cAAc,cAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,kBAAkB,cAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
   "names": ["createEndpoint", "createMiddleware"]
 }

package/build/router/node.cjs

@@ -30,7 +30,8 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // packages/core/src/router/node.ts
 var node_exports = {};
 __export(node_exports, {
-  createNodeMatchmakingMiddleware: () => createNodeMatchmakingMiddleware
+  createNodeMatchmakingMiddleware: () => createNodeMatchmakingMiddleware,
+  prereadRequestBodies: () => prereadRequestBodies
 });
 module.exports = __toCommonJS(node_exports);
 var import_url = require("url");
@@ -47,6 +48,39 @@ function readBody(req) {
     req.on("error", reject);
   });
 }
+function prereadRequestBodies(server) {
+  const listeners = server.listeners("request");
+  const run = (req, res) => {
+    for (const listener of listeners) {
+      listener.call(server, req, res);
+    }
+  };
+  server.removeAllListeners("request");
+  server.on("request", (req, res) => {
+    const method = req.method ?? "GET";
+    const needsBody = method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && req.body === void 0 && Number(req.headers["content-length"]) > 0;
+    if (!needsBody) {
+      run(req, res);
+      return;
+    }
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      if ((req.headers["content-type"] || "").includes("application/json")) {
+        try {
+          req.body = JSON.parse(raw || "{}");
+        } catch {
+          req.body = raw;
+        }
+      } else {
+        req.body = raw;
+      }
+      run(req, res);
+    });
+    req.on("error", () => run(req, res));
+  });
+}
 function getCorsHeaders(req, headers) {
   return {
     ...matchMaker.controller.DEFAULT_CORS_HEADERS,
@@ -94,5 +128,6 @@ function createNodeMatchmakingMiddleware() {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  createNodeMatchmakingMiddleware
+  createNodeMatchmakingMiddleware,
+  prereadRequestBodies
 });

package/build/router/node.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/node.ts"],
-  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n    });\n    req.on('end', () => resolve(data ? JSON.parse(data) : {}));\n    req.on('error', reject);\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body: await readBody(req),\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,iBAAoB;AACpB,iBAA4B;AAC5B,kBAA4B;AAC5B,4BAAoC;AAEpC,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AAAA,IACzB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;AACzD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,eAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACF,YAAM,WAAW,UAAM,2CAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B,MAAM,MAAM,SAAS,GAAG;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,gBAAM,yBAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n    });\n    req.on('end', () => resolve(data ? JSON.parse(data) : {}));\n    req.on('error', reject);\n  });\n}\n\n/**\n * Buffer incoming request bodies and expose them as `req.body` before the\n * server's existing \"request\" listeners run.\n *\n * Needed when the HTTP server is consumed via `export default` (e.g. on Vercel)\n * rather than `listen()`: the matchmaking router reads the body from `req.body`\n * when present, otherwise from a lazy request stream that does not drain in that\n * mode \u2014 which would stall matchmaking POSTs.\n */\nexport function prereadRequestBodies(server: http.Server) {\n  type WithBody = http.IncomingMessage & { body?: unknown };\n  const listeners = server.listeners('request') as Array<(req: http.IncomingMessage, res: http.ServerResponse) => void>;\n  const run = (req: http.IncomingMessage, res: http.ServerResponse) => {\n    for (const listener of listeners) { listener.call(server, req, res); }\n  };\n\n  server.removeAllListeners('request');\n  server.on('request', (req: WithBody, res) => {\n    const method = req.method ?? 'GET';\n    const needsBody =\n      method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS' &&\n      req.body === undefined &&\n      Number(req.headers['content-length']) > 0;\n\n    if (!needsBody) {\n      run(req, res);\n      return;\n    }\n\n    const chunks: Buffer[] = [];\n    req.on('data', (chunk: Buffer) => chunks.push(chunk));\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString('utf8');\n      if ((req.headers['content-type'] || '').includes('application/json')) {\n        try { req.body = JSON.parse(raw || '{}'); } catch { req.body = raw; }\n      } else {\n        req.body = raw;\n      }\n      run(req, res);\n    });\n    req.on('error', () => run(req, res));\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body: await readBody(req),\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,iBAAoB;AACpB,iBAA4B;AAC5B,kBAA4B;AAC5B,4BAAoC;AAEpC,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AAAA,IACzB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;AACzD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAWO,SAAS,qBAAqB,QAAqB;AAExD,QAAM,YAAY,OAAO,UAAU,SAAS;AAC5C,QAAM,MAAM,CAAC,KAA2B,QAA6B;AACnE,eAAW,YAAY,WAAW;AAAE,eAAS,KAAK,QAAQ,KAAK,GAAG;AAAA,IAAG;AAAA,EACvE;AAEA,SAAO,mBAAmB,SAAS;AACnC,SAAO,GAAG,WAAW,CAAC,KAAe,QAAQ;AAC3C,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,YACJ,WAAW,SAAS,WAAW,UAAU,WAAW,aACpD,IAAI,SAAS,UACb,OAAO,IAAI,QAAQ,gBAAgB,CAAC,IAAI;AAE1C,QAAI,CAAC,WAAW;AACd,UAAI,KAAK,GAAG;AACZ;AAAA,IACF;AAEA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,WAAK,IAAI,QAAQ,cAAc,KAAK,IAAI,SAAS,kBAAkB,GAAG;AACpE,YAAI;AAAE,cAAI,OAAO,KAAK,MAAM,OAAO,IAAI;AAAA,QAAG,QAAQ;AAAE,cAAI,OAAO;AAAA,QAAK;AAAA,MACtE,OAAO;AACL,YAAI,OAAO;AAAA,MACb;AACA,UAAI,KAAK,GAAG;AAAA,IACd,CAAC;AACD,QAAI,GAAG,SAAS,MAAM,IAAI,KAAK,GAAG,CAAC;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,eAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACF,YAAM,WAAW,UAAM,2CAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B,MAAM,MAAM,SAAS,GAAG;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,gBAAM,yBAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
   "names": []
 }

package/build/router/node.d.ts

@@ -8,4 +8,14 @@
  * this file only as the thin raw Node/Express adapter around it.
  */
 import type http from 'http';
+/**
+ * Buffer incoming request bodies and expose them as `req.body` before the
+ * server's existing "request" listeners run.
+ *
+ * Needed when the HTTP server is consumed via `export default` (e.g. on Vercel)
+ * rather than `listen()`: the matchmaking router reads the body from `req.body`
+ * when present, otherwise from a lazy request stream that does not drain in that
+ * mode — which would stall matchmaking POSTs.
+ */
+export declare function prereadRequestBodies(server: http.Server): void;
 export declare function createNodeMatchmakingMiddleware(): (req: http.IncomingMessage, res: http.ServerResponse, next: () => void) => Promise<void>;

package/build/router/node.mjs

@@ -13,6 +13,39 @@ function readBody(req) {
     req.on("error", reject);
   });
 }
+function prereadRequestBodies(server) {
+  const listeners = server.listeners("request");
+  const run = (req, res) => {
+    for (const listener of listeners) {
+      listener.call(server, req, res);
+    }
+  };
+  server.removeAllListeners("request");
+  server.on("request", (req, res) => {
+    const method = req.method ?? "GET";
+    const needsBody = method !== "GET" && method !== "HEAD" && method !== "OPTIONS" && req.body === void 0 && Number(req.headers["content-length"]) > 0;
+    if (!needsBody) {
+      run(req, res);
+      return;
+    }
+    const chunks = [];
+    req.on("data", (chunk) => chunks.push(chunk));
+    req.on("end", () => {
+      const raw = Buffer.concat(chunks).toString("utf8");
+      if ((req.headers["content-type"] || "").includes("application/json")) {
+        try {
+          req.body = JSON.parse(raw || "{}");
+        } catch {
+          req.body = raw;
+        }
+      } else {
+        req.body = raw;
+      }
+      run(req, res);
+    });
+    req.on("error", () => run(req, res));
+  });
+}
 function getCorsHeaders(req, headers) {
   return {
     ...matchMaker.controller.DEFAULT_CORS_HEADERS,
@@ -59,5 +92,6 @@ function createNodeMatchmakingMiddleware() {
   };
 }
 export {
-  createNodeMatchmakingMiddleware
+  createNodeMatchmakingMiddleware,
+  prereadRequestBodies
 };

package/build/router/node.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/node.ts"],
-  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n    });\n    req.on('end', () => resolve(data ? JSON.parse(data) : {}));\n    req.on('error', reject);\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body: await readBody(req),\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
-  "mappings": ";AAUA,SAAS,WAAW;AACpB,YAAY,gBAAgB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AAEpC,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AAAA,IACzB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;AACzD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACF,YAAM,WAAW,MAAM,oBAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B,MAAM,MAAM,SAAS,GAAG;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,YAAM,YAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n    });\n    req.on('end', () => resolve(data ? JSON.parse(data) : {}));\n    req.on('error', reject);\n  });\n}\n\n/**\n * Buffer incoming request bodies and expose them as `req.body` before the\n * server's existing \"request\" listeners run.\n *\n * Needed when the HTTP server is consumed via `export default` (e.g. on Vercel)\n * rather than `listen()`: the matchmaking router reads the body from `req.body`\n * when present, otherwise from a lazy request stream that does not drain in that\n * mode \u2014 which would stall matchmaking POSTs.\n */\nexport function prereadRequestBodies(server: http.Server) {\n  type WithBody = http.IncomingMessage & { body?: unknown };\n  const listeners = server.listeners('request') as Array<(req: http.IncomingMessage, res: http.ServerResponse) => void>;\n  const run = (req: http.IncomingMessage, res: http.ServerResponse) => {\n    for (const listener of listeners) { listener.call(server, req, res); }\n  };\n\n  server.removeAllListeners('request');\n  server.on('request', (req: WithBody, res) => {\n    const method = req.method ?? 'GET';\n    const needsBody =\n      method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS' &&\n      req.body === undefined &&\n      Number(req.headers['content-length']) > 0;\n\n    if (!needsBody) {\n      run(req, res);\n      return;\n    }\n\n    const chunks: Buffer[] = [];\n    req.on('data', (chunk: Buffer) => chunks.push(chunk));\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString('utf8');\n      if ((req.headers['content-type'] || '').includes('application/json')) {\n        try { req.body = JSON.parse(raw || '{}'); } catch { req.body = raw; }\n      } else {\n        req.body = raw;\n      }\n      run(req, res);\n    });\n    req.on('error', () => run(req, res));\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body: await readBody(req),\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
+  "mappings": ";AAUA,SAAS,WAAW;AACpB,YAAY,gBAAgB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AAEpC,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AAAA,IACzB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;AACzD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAWO,SAAS,qBAAqB,QAAqB;AAExD,QAAM,YAAY,OAAO,UAAU,SAAS;AAC5C,QAAM,MAAM,CAAC,KAA2B,QAA6B;AACnE,eAAW,YAAY,WAAW;AAAE,eAAS,KAAK,QAAQ,KAAK,GAAG;AAAA,IAAG;AAAA,EACvE;AAEA,SAAO,mBAAmB,SAAS;AACnC,SAAO,GAAG,WAAW,CAAC,KAAe,QAAQ;AAC3C,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,YACJ,WAAW,SAAS,WAAW,UAAU,WAAW,aACpD,IAAI,SAAS,UACb,OAAO,IAAI,QAAQ,gBAAgB,CAAC,IAAI;AAE1C,QAAI,CAAC,WAAW;AACd,UAAI,KAAK,GAAG;AACZ;AAAA,IACF;AAEA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,WAAK,IAAI,QAAQ,cAAc,KAAK,IAAI,SAAS,kBAAkB,GAAG;AACpE,YAAI;AAAE,cAAI,OAAO,KAAK,MAAM,OAAO,IAAI;AAAA,QAAG,QAAQ;AAAE,cAAI,OAAO;AAAA,QAAK;AAAA,MACtE,OAAO;AACL,YAAI,OAAO;AAAA,MACb;AACA,UAAI,KAAK,GAAG;AAAA,IACd,CAAC;AACD,QAAI,GAAG,SAAS,MAAM,IAAI,KAAK,GAAG,CAAC;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACF,YAAM,WAAW,MAAM,oBAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B,MAAM,MAAM,SAAS,GAAG;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,YAAM,YAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
   "names": []
 }

package/build/serializer/NoneSerializer.cjs

@@ -29,10 +29,10 @@ var NoneSerializer = class {
   }
   reset(data) {
   }
-  getFullState(client) {
+  getFullState(_client, _timing) {
     return null;
   }
-  applyPatches(clients, state) {
+  applyPatches(_clients, _state, _timing) {
     return false;
   }
 };

package/build/serializer/NoneSerializer.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/serializer/NoneSerializer.ts"],
-  "sourcesContent": ["import type { Client } from '../Transport.ts';\nimport type { Serializer } from './Serializer.ts';\n\nexport class NoneSerializer<T= any> implements Serializer<T> {\n  public id: string = 'none';\n\n  public reset(data: any) {}\n\n  public getFullState(client?: Client) {\n    return null;\n  }\n\n  public applyPatches(clients: Client[], state: T): boolean {\n    return false;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAGO,IAAM,iBAAN,MAAsD;AAAA,EAAtD;AACL,SAAO,KAAa;AAAA;AAAA,EAEb,MAAM,MAAW;AAAA,EAAC;AAAA,EAElB,aAAa,QAAiB;AACnC,WAAO;AAAA,EACT;AAAA,EAEO,aAAa,SAAmB,OAAmB;AACxD,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import type { Client } from '../Transport.ts';\nimport type { PatchTimingContext, Serializer } from './Serializer.ts';\n\nexport class NoneSerializer<T= any> implements Serializer<T> {\n  public id: string = 'none';\n\n  public reset(data: any) {}\n\n  public getFullState(_client?: Client, _timing?: PatchTimingContext) {\n    return null;\n  }\n\n  public applyPatches(_clients: Client[], _state: T, _timing?: PatchTimingContext): boolean {\n    return false;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAGO,IAAM,iBAAN,MAAsD;AAAA,EAAtD;AACL,SAAO,KAAa;AAAA;AAAA,EAEb,MAAM,MAAW;AAAA,EAAC;AAAA,EAElB,aAAa,SAAkB,SAA8B;AAClE,WAAO;AAAA,EACT;AAAA,EAEO,aAAa,UAAoB,QAAW,SAAuC;AACxF,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/build/serializer/NoneSerializer.d.ts

@@ -1,8 +1,8 @@
 import type { Client } from '../Transport.ts';
-import type { Serializer } from './Serializer.ts';
+import type { PatchTimingContext, Serializer } from './Serializer.ts';
 export declare class NoneSerializer<T = any> implements Serializer<T> {
     id: string;
     reset(data: any): void;
-    getFullState(client?: Client): any;
-    applyPatches(clients: Client[], state: T): boolean;
+    getFullState(_client?: Client, _timing?: PatchTimingContext): any;
+    applyPatches(_clients: Client[], _state: T, _timing?: PatchTimingContext): boolean;
 }

package/build/serializer/NoneSerializer.mjs

@@ -5,10 +5,10 @@ var NoneSerializer = class {
   }
   reset(data) {
   }
-  getFullState(client) {
+  getFullState(_client, _timing) {
     return null;
   }
-  applyPatches(clients, state) {
+  applyPatches(_clients, _state, _timing) {
     return false;
   }
 };

package/build/serializer/NoneSerializer.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/serializer/NoneSerializer.ts"],
-  "sourcesContent": ["import type { Client } from '../Transport.ts';\nimport type { Serializer } from './Serializer.ts';\n\nexport class NoneSerializer<T= any> implements Serializer<T> {\n  public id: string = 'none';\n\n  public reset(data: any) {}\n\n  public getFullState(client?: Client) {\n    return null;\n  }\n\n  public applyPatches(clients: Client[], state: T): boolean {\n    return false;\n  }\n}\n"],
-  "mappings": ";AAGO,IAAM,iBAAN,MAAsD;AAAA,EAAtD;AACL,SAAO,KAAa;AAAA;AAAA,EAEb,MAAM,MAAW;AAAA,EAAC;AAAA,EAElB,aAAa,QAAiB;AACnC,WAAO;AAAA,EACT;AAAA,EAEO,aAAa,SAAmB,OAAmB;AACxD,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import type { Client } from '../Transport.ts';\nimport type { PatchTimingContext, Serializer } from './Serializer.ts';\n\nexport class NoneSerializer<T= any> implements Serializer<T> {\n  public id: string = 'none';\n\n  public reset(data: any) {}\n\n  public getFullState(_client?: Client, _timing?: PatchTimingContext) {\n    return null;\n  }\n\n  public applyPatches(_clients: Client[], _state: T, _timing?: PatchTimingContext): boolean {\n    return false;\n  }\n}\n"],
+  "mappings": ";AAGO,IAAM,iBAAN,MAAsD;AAAA,EAAtD;AACL,SAAO,KAAa;AAAA;AAAA,EAEb,MAAM,MAAW;AAAA,EAAC;AAAA,EAElB,aAAa,SAAkB,SAA8B;AAClE,WAAO;AAAA,EACT;AAAA,EAEO,aAAa,UAAoB,QAAW,SAAuC;AACxF,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/build/serializer/SchemaSerializer.cjs

@@ -27,6 +27,27 @@ var import_shared_types = require("@colyseus/shared-types");
 var import_Transport = require("../Transport.cjs");
 var import_schema = require("@colyseus/schema");
 var import_Debug = require("../Debug.cjs");
+var TIMED_PREFIX_SIZE = 8;
+function buildTimedFrame(encodedBody, sNow, inputSeq) {
+  const schemaPayload = encodedBody.subarray(1);
+  const out = Buffer.allocUnsafe(1 + TIMED_PREFIX_SIZE + schemaPayload.length);
+  out[0] = encodedBody[0] | import_shared_types.ProtocolModifier.TIMED;
+  const it = { offset: 1 };
+  import_schema.encode.uint32(out, sNow >>> 0, it);
+  import_schema.encode.uint32(out, inputSeq >>> 0, it);
+  out.set(schemaPayload, it.offset);
+  return out;
+}
+function clientProcessedInputSeq(client) {
+  return client._inputBuffer?.ackSeq ?? 0;
+}
+function sendClientFrame(client, encodedBody, timing) {
+  if (timing) {
+    client.raw(buildTimedFrame(encodedBody, timing.sNow, clientProcessedInputSeq(client)));
+  } else {
+    client.raw(encodedBody);
+  }
+}
 var SHARED_VIEW = {};
 var SchemaSerializer = class {
   constructor() {
@@ -46,24 +67,24 @@ var SchemaSerializer = class {
       this.encodedViews = /* @__PURE__ */ new Map();
     }
   }
-  getFullState(client) {
+  getFullState(client, timing) {
     if (this.needFullEncode || this.encoder.root.changes.next !== void 0) {
       this.sharedOffsetCache = { offset: 1 };
       this.fullEncodeCache = this.encoder.encodeAll(this.sharedOffsetCache, this.fullEncodeBuffer);
       this.needFullEncode = false;
     }
-    if (this.hasFilters && client?.view) {
-      return this.encoder.encodeAllView(
-        client.view,
-        this.sharedOffsetCache.offset,
-        { ...this.sharedOffsetCache },
-        this.fullEncodeBuffer
-      );
-    } else {
-      return this.fullEncodeCache;
+    const body = this.hasFilters && client?.view ? this.encoder.encodeAllView(
+      client.view,
+      this.sharedOffsetCache.offset,
+      { ...this.sharedOffsetCache },
+      this.fullEncodeBuffer
+    ) : this.fullEncodeCache;
+    if (timing && client) {
+      return buildTimedFrame(body, timing.sNow, clientProcessedInputSeq(client));
     }
+    return body;
   }
-  applyPatches(clients) {
+  applyPatches(clients, _state, timing) {
     let numClients = clients.length;
     if (numClients === 0) {
       if (this.encoder.hasChanges) {
@@ -82,10 +103,19 @@ var SchemaSerializer = class {
           const sharedOffset = it2.offset;
           this.encoder.sharedBuffer[0] = import_shared_types.Protocol.ROOM_STATE_PATCH;
           clientsWithViewChange.forEach((client) => {
-            client.raw(this.encoder.encodeView(client.view, sharedOffset, it2));
+            const encodedView = this.encoder.encodeView(client.view, sharedOffset, it2);
+            sendClientFrame(client, encodedView, timing);
           });
         }
       }
+      if (timing) {
+        const heartbeatBody = Buffer.from([import_shared_types.Protocol.ROOM_STATE_PATCH]);
+        for (let i = 0; i < clients.length; i++) {
+          const client = clients[i];
+          if (client.state !== import_Transport.ClientState.JOINED) continue;
+          sendClientFrame(client, heartbeatBody, timing);
+        }
+      }
       return false;
     }
     this.needFullEncode = true;
@@ -101,7 +131,7 @@ var SchemaSerializer = class {
         if (client.state !== import_Transport.ClientState.JOINED) {
           continue;
         }
-        client.raw(encodedChanges);
+        sendClientFrame(client, encodedChanges, timing);
       }
     } else {
       const sharedOffset = it.offset;
@@ -116,7 +146,7 @@ var SchemaSerializer = class {
           encodedView = view === SHARED_VIEW ? encodedChanges : this.encoder.encodeView(client.view, sharedOffset, it);
           this.encodedViews.set(view, encodedView);
         }
-        client.raw(encodedView);
+        sendClientFrame(client, encodedView, timing);
       }
       this.encodedViews.clear();
     }

package/build/serializer/SchemaSerializer.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/serializer/SchemaSerializer.ts"],
-  "sourcesContent": ["import { Protocol } from '@colyseus/shared-types';\n\nimport type { Serializer } from './Serializer.ts';\nimport { type Client, ClientState } from '../Transport.ts';\n\nimport { type Iterator, Encoder, dumpChanges, Reflection, Schema, StateView } from '@colyseus/schema';\nimport { debugPatch } from '../Debug.ts';\n\nconst SHARED_VIEW = {};\n\nexport class SchemaSerializer<T extends Schema> implements Serializer<T> {\n  public id = 'schema';\n\n  protected encoder: Encoder<T>;\n  protected hasFilters: boolean = false;\n\n  protected handshakeCache: Uint8Array;\n\n  // flag to avoid re-encoding full state if no changes were made\n  protected needFullEncode: boolean = true;\n\n  // TODO: make this optional. allocating a new buffer for each room may not be always necessary.\n  protected fullEncodeBuffer: Uint8Array = new Uint8Array(Encoder.BUFFER_SIZE);\n  protected fullEncodeCache: Uint8Array;\n  protected sharedOffsetCache: Iterator = { offset: 0 };\n\n  protected encodedViews: Map<StateView | typeof SHARED_VIEW, Uint8Array>;\n\n  public reset(newState: T & Schema) {\n    this.encoder = new Encoder(newState);\n    this.hasFilters = this.encoder.context.hasFilters;\n\n    // cache ROOM_STATE byte as part of the encoded buffer\n    this.fullEncodeBuffer[0] = Protocol.ROOM_STATE;\n\n    if (this.hasFilters) {\n      this.encodedViews = new Map();\n    }\n  }\n\n  public getFullState(client?: Client) {\n    if (this.needFullEncode || this.encoder.root.changes.next !== undefined) {\n      this.sharedOffsetCache = { offset: 1 };\n      this.fullEncodeCache = this.encoder.encodeAll(this.sharedOffsetCache, this.fullEncodeBuffer);\n      this.needFullEncode = false;\n    }\n\n    if (this.hasFilters && client?.view) {\n      return this.encoder.encodeAllView(\n        client.view,\n        this.sharedOffsetCache.offset,\n        { ...this.sharedOffsetCache },\n        this.fullEncodeBuffer\n      );\n\n    } else {\n      return this.fullEncodeCache;\n    }\n  }\n\n  public applyPatches(clients: Client[]) {\n    let numClients = clients.length;\n\n    if (numClients === 0) {\n      if (this.encoder.hasChanges) {\n        // if there are changes but no clients, we need to encode full state on next patch\n        this.needFullEncode = true;\n      }\n      // skip patching and clear changes\n      this.encoder.discardChanges();\n      return false;\n    }\n\n    if (!this.encoder.hasChanges) {\n\n      // check if views have changes (manual add() or remove() items)\n      if (this.hasFilters) {\n        //\n        // FIXME: refactor this to avoid duplicating code.\n        //\n        // it's probably better to have 2 different 'applyPatches' methods.\n        // (one for handling state with filters, and another for handling state without filters)\n        //\n        const clientsWithViewChange = clients.filter((client) => {\n          return client.state === ClientState.JOINED && client.view?.changes.size > 0\n        });\n\n        if (clientsWithViewChange.length > 0) {\n          const it: Iterator = { offset: 1 };\n\n          const sharedOffset = it.offset;\n          this.encoder.sharedBuffer[0] = Protocol.ROOM_STATE_PATCH;\n\n          clientsWithViewChange.forEach((client) => {\n            client.raw(this.encoder.encodeView(client.view, sharedOffset, it));\n          });\n        }\n      }\n\n      // skip patching state if:\n      // - no clients are connected\n      // - no changes were made\n      // - no \"filtered changes\" were made when using filters\n      return false;\n    }\n\n    this.needFullEncode = true;\n\n    // dump changes for patch debugging\n    if (debugPatch.enabled) {\n      (debugPatch as any).dumpChanges = dumpChanges(this.encoder.state);\n    }\n\n    // get patch bytes\n    const it: Iterator = { offset: 1 };\n    this.encoder.sharedBuffer[0] = Protocol.ROOM_STATE_PATCH;\n\n    // encode changes once, for all clients\n    const encodedChanges = this.encoder.encode(it);\n\n    if (!this.hasFilters) {\n      while (numClients--) {\n        const client = clients[numClients];\n\n        //\n        // FIXME: avoid this check for each client\n        //\n        if (client.state !== ClientState.JOINED) {\n          continue;\n        }\n\n        client.raw(encodedChanges);\n      }\n\n    } else {\n      // cache shared offset\n      const sharedOffset = it.offset;\n\n      // encode state multiple times, for each client\n      while (numClients--) {\n        const client = clients[numClients];\n\n        //\n        // FIXME: avoid this check for each client\n        //\n        if (client.state !== ClientState.JOINED) {\n          continue;\n        }\n\n        const view = client.view || SHARED_VIEW;\n\n        let encodedView = this.encodedViews.get(view);\n\n        // allow to pass the same encoded view for multiple clients\n        if (encodedView === undefined) {\n          encodedView = (view === SHARED_VIEW)\n            ? encodedChanges\n            : this.encoder.encodeView(client.view, sharedOffset, it);\n          this.encodedViews.set(view, encodedView);\n        }\n\n        client.raw(encodedView);\n      }\n\n      // clear views\n      this.encodedViews.clear();\n    }\n\n    // discard changes after sending\n    this.encoder.discardChanges();\n\n    // debug patches\n    if (debugPatch.enabled) {\n      debugPatch(\n        '%d bytes sent to %d clients, %j',\n        encodedChanges.length,\n        clients.length,\n        (debugPatch as any).dumpChanges,\n      );\n    }\n\n    return true;\n  }\n\n  public handshake() {\n    /**\n     * Cache handshake to avoid encoding it for each client joining\n     */\n    if (!this.handshakeCache) {\n      //\n      // TODO: re-use handshake buffer for all rooms of same type (?)\n      //\n      this.handshakeCache = (this.encoder.state && Reflection.encode(this.encoder));\n    }\n\n    return this.handshakeCache;\n  }\n\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAAyB;AAGzB,uBAAyC;AAEzC,oBAAmF;AACnF,mBAA2B;AAE3B,IAAM,cAAc,CAAC;AAEd,IAAM,mBAAN,MAAkE;AAAA,EAAlE;AACL,SAAO,KAAK;AAGZ,SAAU,aAAsB;AAKhC;AAAA,SAAU,iBAA0B;AAGpC;AAAA,SAAU,mBAA+B,IAAI,WAAW,sBAAQ,WAAW;AAE3E,SAAU,oBAA8B,EAAE,QAAQ,EAAE;AAAA;AAAA,EAI7C,MAAM,UAAsB;AACjC,SAAK,UAAU,IAAI,sBAAQ,QAAQ;AACnC,SAAK,aAAa,KAAK,QAAQ,QAAQ;AAGvC,SAAK,iBAAiB,CAAC,IAAI,6BAAS;AAEpC,QAAI,KAAK,YAAY;AACnB,WAAK,eAAe,oBAAI,IAAI;AAAA,IAC9B;AAAA,EACF;AAAA,EAEO,aAAa,QAAiB;AACnC,QAAI,KAAK,kBAAkB,KAAK,QAAQ,KAAK,QAAQ,SAAS,QAAW;AACvE,WAAK,oBAAoB,EAAE,QAAQ,EAAE;AACrC,WAAK,kBAAkB,KAAK,QAAQ,UAAU,KAAK,mBAAmB,KAAK,gBAAgB;AAC3F,WAAK,iBAAiB;AAAA,IACxB;AAEA,QAAI,KAAK,cAAc,QAAQ,MAAM;AACnC,aAAO,KAAK,QAAQ;AAAA,QAClB,OAAO;AAAA,QACP,KAAK,kBAAkB;AAAA,QACvB,EAAE,GAAG,KAAK,kBAAkB;AAAA,QAC5B,KAAK;AAAA,MACP;AAAA,IAEF,OAAO;AACL,aAAO,KAAK;AAAA,IACd;AAAA,EACF;AAAA,EAEO,aAAa,SAAmB;AACrC,QAAI,aAAa,QAAQ;AAEzB,QAAI,eAAe,GAAG;AACpB,UAAI,KAAK,QAAQ,YAAY;AAE3B,aAAK,iBAAiB;AAAA,MACxB;AAEA,WAAK,QAAQ,eAAe;AAC5B,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,KAAK,QAAQ,YAAY;AAG5B,UAAI,KAAK,YAAY;AAOnB,cAAM,wBAAwB,QAAQ,OAAO,CAAC,WAAW;AACvD,iBAAO,OAAO,UAAU,6BAAY,UAAU,OAAO,MAAM,QAAQ,OAAO;AAAA,QAC5E,CAAC;AAED,YAAI,sBAAsB,SAAS,GAAG;AACpC,gBAAMA,MAAe,EAAE,QAAQ,EAAE;AAEjC,gBAAM,eAAeA,IAAG;AACxB,eAAK,QAAQ,aAAa,CAAC,IAAI,6BAAS;AAExC,gCAAsB,QAAQ,CAAC,WAAW;AACxC,mBAAO,IAAI,KAAK,QAAQ,WAAW,OAAO,MAAM,cAAcA,GAAE,CAAC;AAAA,UACnE,CAAC;AAAA,QACH;AAAA,MACF;AAMA,aAAO;AAAA,IACT;AAEA,SAAK,iBAAiB;AAGtB,QAAI,wBAAW,SAAS;AACtB,MAAC,wBAAmB,kBAAc,2BAAY,KAAK,QAAQ,KAAK;AAAA,IAClE;AAGA,UAAM,KAAe,EAAE,QAAQ,EAAE;AACjC,SAAK,QAAQ,aAAa,CAAC,IAAI,6BAAS;AAGxC,UAAM,iBAAiB,KAAK,QAAQ,OAAO,EAAE;AAE7C,QAAI,CAAC,KAAK,YAAY;AACpB,aAAO,cAAc;AACnB,cAAM,SAAS,QAAQ,UAAU;AAKjC,YAAI,OAAO,UAAU,6BAAY,QAAQ;AACvC;AAAA,QACF;AAEA,eAAO,IAAI,cAAc;AAAA,MAC3B;AAAA,IAEF,OAAO;AAEL,YAAM,eAAe,GAAG;AAGxB,aAAO,cAAc;AACnB,cAAM,SAAS,QAAQ,UAAU;AAKjC,YAAI,OAAO,UAAU,6BAAY,QAAQ;AACvC;AAAA,QACF;AAEA,cAAM,OAAO,OAAO,QAAQ;AAE5B,YAAI,cAAc,KAAK,aAAa,IAAI,IAAI;AAG5C,YAAI,gBAAgB,QAAW;AAC7B,wBAAe,SAAS,cACpB,iBACA,KAAK,QAAQ,WAAW,OAAO,MAAM,cAAc,EAAE;AACzD,eAAK,aAAa,IAAI,MAAM,WAAW;AAAA,QACzC;AAEA,eAAO,IAAI,WAAW;AAAA,MACxB;AAGA,WAAK,aAAa,MAAM;AAAA,IAC1B;AAGA,SAAK,QAAQ,eAAe;AAG5B,QAAI,wBAAW,SAAS;AACtB;AAAA,QACE;AAAA,QACA,eAAe;AAAA,QACf,QAAQ;AAAA,QACP,wBAAmB;AAAA,MACtB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEO,YAAY;AAIjB,QAAI,CAAC,KAAK,gBAAgB;AAIxB,WAAK,iBAAkB,KAAK,QAAQ,SAAS,yBAAW,OAAO,KAAK,OAAO;AAAA,IAC7E;AAEA,WAAO,KAAK;AAAA,EACd;AAEF;",
+  "sourcesContent": ["import { Protocol, ProtocolModifier } from '@colyseus/shared-types';\n\nimport type { PatchTimingContext, Serializer } from './Serializer.ts';\nimport { type Client, type ClientPrivate, ClientState } from '../Transport.ts';\n\nimport { type Iterator, encode, Encoder, dumpChanges, Reflection, Schema, StateView } from '@colyseus/schema';\nimport { debugPatch } from '../Debug.ts';\n\n/**\n * Size of the {@link ProtocolModifier.TIMED} prefix that follows the\n * protocol byte:\n *   `[uint32 sNow][uint32 inputSeq]`\n *\n *   - `sNow`     \u2014 server clock as **milliseconds since room start**\n *     (`room.clock.elapsedTime`), NOT raw `performance.now()`. A portable,\n *     language-agnostic integer (C/C#/Lua have no `performance.now()`); the\n *     server's own time-keyed logic uses the SAME `clock.elapsedTime` so the\n *     client's reconstructed `serverNow()` stays in phase. Wraps at u32\n *     (~49.7 days uptime) \u2014 irrelevant per session. Drives the client clock\n *     offset / `serverNow()`.\n *   - `inputSeq` \u2014 seq VALUE of the last input CONSUMED into the authoritative\n *     state (the input buffer's `ackSeq`, i.e. last-PROCESSED input). Reliable:\n *     equals the consumed count (inputs are sequenced implicitly by receive\n *     order). Unreliable: the framework wire seq, so a fully-dropped input\n *     doesn't make the ack lag the client's sent seq by the lost count. This\n *     single number is the canonical reconciliation ack (\"the sequence number\n *     of the last input the server processed\"); the client prunes its\n *     pending-input buffer against it AND derives RTT from its round-trip\n *     (`now \u2212 sendTime(inputSeq)`). No separate received-seq / received-time \u2014\n *     RTT-from-the-processed-ack is round-trip-inclusive, which is the standard.\n */\nconst TIMED_PREFIX_SIZE = 8;\n\n/**\n * Construct a per-recipient TIMED buffer:\n *   `[code|TIMED][sNow][inputSeq][...schema bytes]`\n *\n * `encodedBody` is the shared encoded buffer whose byte 0 already holds the\n * base protocol code (ROOM_STATE or ROOM_STATE_PATCH); bytes 1.. are the\n * schema payload. We construct a fresh per-client Buffer so the transport\n * never sees a buffer that might mutate between queue and send.\n *\n * Uses the schema `encode.*` helpers to keep the wire layout symmetric with\n * the SDK's `decode.*`-driven reader.\n */\nfunction buildTimedFrame(\n  encodedBody: Uint8Array,\n  sNow: number,\n  inputSeq: number,\n): Buffer {\n  const schemaPayload = encodedBody.subarray(1);\n  const out = Buffer.allocUnsafe(1 + TIMED_PREFIX_SIZE + schemaPayload.length);\n  out[0] = encodedBody[0] | ProtocolModifier.TIMED;\n  const it: Iterator = { offset: 1 };\n  encode.uint32(out, sNow >>> 0, it); // ms since room start (clock.elapsedTime)\n  encode.uint32(out, inputSeq >>> 0, it);\n  out.set(schemaPayload, it.offset);\n  return out;\n}\n\n/** Seq VALUE of the last input consumed from the client's buffer \u2014 the\n *  reconciliation ack (and RTT correlation key). Reliable: equals the consumed\n *  count; unreliable: the framework wire seq (so packet loss doesn't skew it).\n *  0 when the room doesn't buffer input. */\nfunction clientProcessedInputSeq(client: Client): number {\n  return (client as Client & ClientPrivate)._inputBuffer?.ackSeq ?? 0;\n}\n\n/**\n * Send a per-recipient patch frame: a TIMED-prefixed buffer when `timing` is set,\n * else the shared `encodedBody` passed straight through (no per-client copy). Any\n * `afterNextPatch` frames staged on `client._pendingFrames` are NOT coalesced here\n * \u2014 they go out standalone right after the patch via `Room._flushPendingClientFrames`.\n */\nfunction sendClientFrame(client: Client, encodedBody: Uint8Array, timing?: PatchTimingContext): void {\n  if (timing) {\n    client.raw(buildTimedFrame(encodedBody, timing.sNow, clientProcessedInputSeq(client)));\n  } else {\n    client.raw(encodedBody);\n  }\n}\n\nconst SHARED_VIEW = {};\n\nexport class SchemaSerializer<T extends Schema> implements Serializer<T> {\n  public id = 'schema';\n\n  protected encoder: Encoder<T>;\n  protected hasFilters: boolean = false;\n\n  protected handshakeCache: Uint8Array;\n\n  // flag to avoid re-encoding full state if no changes were made\n  protected needFullEncode: boolean = true;\n\n  // TODO: make this optional. allocating a new buffer for each room may not be always necessary.\n  protected fullEncodeBuffer: Uint8Array = new Uint8Array(Encoder.BUFFER_SIZE);\n  protected fullEncodeCache: Uint8Array;\n  protected sharedOffsetCache: Iterator = { offset: 0 };\n\n  protected encodedViews: Map<StateView | typeof SHARED_VIEW, Uint8Array>;\n\n  public reset(newState: T & Schema) {\n    this.encoder = new Encoder(newState);\n    this.hasFilters = this.encoder.context.hasFilters;\n\n    // cache ROOM_STATE byte as part of the encoded buffer\n    this.fullEncodeBuffer[0] = Protocol.ROOM_STATE;\n\n    if (this.hasFilters) {\n      this.encodedViews = new Map();\n    }\n  }\n\n  public getFullState(client?: Client, timing?: PatchTimingContext) {\n    if (this.needFullEncode || this.encoder.root.changes.next !== undefined) {\n      this.sharedOffsetCache = { offset: 1 };\n      this.fullEncodeCache = this.encoder.encodeAll(this.sharedOffsetCache, this.fullEncodeBuffer);\n      this.needFullEncode = false;\n    }\n\n    const body = (this.hasFilters && client?.view)\n      ? this.encoder.encodeAllView(\n          client.view,\n          this.sharedOffsetCache.offset,\n          { ...this.sharedOffsetCache },\n          this.fullEncodeBuffer\n        )\n      : this.fullEncodeCache;\n\n    if (timing && client) {\n      return buildTimedFrame(body, timing.sNow, clientProcessedInputSeq(client));\n    }\n    return body;\n  }\n\n  public applyPatches(clients: Client[], _state?: unknown, timing?: PatchTimingContext) {\n    let numClients = clients.length;\n\n    if (numClients === 0) {\n      if (this.encoder.hasChanges) {\n        // if there are changes but no clients, we need to encode full state on next patch\n        this.needFullEncode = true;\n      }\n      // skip patching and clear changes\n      this.encoder.discardChanges();\n      return false;\n    }\n\n    if (!this.encoder.hasChanges) {\n\n      // check if views have changes (manual add() or remove() items)\n      if (this.hasFilters) {\n        //\n        // FIXME: refactor this to avoid duplicating code.\n        //\n        // it's probably better to have 2 different 'applyPatches' methods.\n        // (one for handling state with filters, and another for handling state without filters)\n        //\n        const clientsWithViewChange = clients.filter((client) => {\n          return client.state === ClientState.JOINED && client.view?.changes.size > 0\n        });\n\n        if (clientsWithViewChange.length > 0) {\n          const it: Iterator = { offset: 1 };\n\n          const sharedOffset = it.offset;\n          this.encoder.sharedBuffer[0] = Protocol.ROOM_STATE_PATCH;\n\n          clientsWithViewChange.forEach((client) => {\n            const encodedView = this.encoder.encodeView(client.view, sharedOffset, it);\n            sendClientFrame(client, encodedView, timing);\n          });\n        }\n      }\n\n      // Heartbeat: `defineInput()` rooms still need periodic timing samples\n      // to keep client clock offset / RTT estimates fresh during quiet\n      // ticks. Emit a TIMED-prefixed ROOM_STATE_PATCH with an empty schema\n      // body \u2014 1 byte protocol + 8 bytes prefix.\n      // No-op for rooms without `defineInput()` (timing is undefined).\n      if (timing) {\n        const heartbeatBody = Buffer.from([Protocol.ROOM_STATE_PATCH]);\n        for (let i = 0; i < clients.length; i++) {\n          const client = clients[i];\n          if (client.state !== ClientState.JOINED) continue;\n          sendClientFrame(client, heartbeatBody, timing);\n        }\n      }\n\n      // skip patching state if:\n      // - no clients are connected\n      // - no changes were made\n      // - no \"filtered changes\" were made when using filters\n      return false;\n    }\n\n    this.needFullEncode = true;\n\n    // dump changes for patch debugging\n    if (debugPatch.enabled) {\n      (debugPatch as any).dumpChanges = dumpChanges(this.encoder.state);\n    }\n\n    // get patch bytes\n    const it: Iterator = { offset: 1 };\n    this.encoder.sharedBuffer[0] = Protocol.ROOM_STATE_PATCH;\n\n    // encode changes once, for all clients\n    const encodedChanges = this.encoder.encode(it);\n\n    if (!this.hasFilters) {\n      while (numClients--) {\n        const client = clients[numClients];\n\n        //\n        // FIXME: avoid this check for each client\n        //\n        if (client.state !== ClientState.JOINED) {\n          continue;\n        }\n\n        sendClientFrame(client, encodedChanges, timing);\n      }\n\n    } else {\n      // cache shared offset\n      const sharedOffset = it.offset;\n\n      // encode state multiple times, for each client\n      while (numClients--) {\n        const client = clients[numClients];\n\n        //\n        // FIXME: avoid this check for each client\n        //\n        if (client.state !== ClientState.JOINED) {\n          continue;\n        }\n\n        const view = client.view || SHARED_VIEW;\n\n        let encodedView = this.encodedViews.get(view);\n\n        // allow to pass the same encoded view for multiple clients\n        if (encodedView === undefined) {\n          encodedView = (view === SHARED_VIEW)\n            ? encodedChanges\n            : this.encoder.encodeView(client.view, sharedOffset, it);\n          this.encodedViews.set(view, encodedView);\n        }\n\n        sendClientFrame(client, encodedView, timing);\n      }\n\n      // clear views\n      this.encodedViews.clear();\n    }\n\n    // discard changes after sending\n    this.encoder.discardChanges();\n\n    // debug patches\n    if (debugPatch.enabled) {\n      debugPatch(\n        '%d bytes sent to %d clients, %j',\n        encodedChanges.length,\n        clients.length,\n        (debugPatch as any).dumpChanges,\n      );\n    }\n\n    return true;\n  }\n\n  public handshake() {\n    /**\n     * Cache handshake to avoid encoding it for each client joining\n     */\n    if (!this.handshakeCache) {\n      //\n      // TODO: re-use handshake buffer for all rooms of same type (?)\n      //\n      this.handshakeCache = (this.encoder.state && Reflection.encode(this.encoder));\n    }\n\n    return this.handshakeCache;\n  }\n\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,0BAA2C;AAG3C,uBAA6D;AAE7D,oBAA2F;AAC3F,mBAA2B;AAyB3B,IAAM,oBAAoB;AAc1B,SAAS,gBACP,aACA,MACA,UACQ;AACR,QAAM,gBAAgB,YAAY,SAAS,CAAC;AAC5C,QAAM,MAAM,OAAO,YAAY,IAAI,oBAAoB,cAAc,MAAM;AAC3E,MAAI,CAAC,IAAI,YAAY,CAAC,IAAI,qCAAiB;AAC3C,QAAM,KAAe,EAAE,QAAQ,EAAE;AACjC,uBAAO,OAAO,KAAK,SAAS,GAAG,EAAE;AACjC,uBAAO,OAAO,KAAK,aAAa,GAAG,EAAE;AACrC,MAAI,IAAI,eAAe,GAAG,MAAM;AAChC,SAAO;AACT;AAMA,SAAS,wBAAwB,QAAwB;AACvD,SAAQ,OAAkC,cAAc,UAAU;AACpE;AAQA,SAAS,gBAAgB,QAAgB,aAAyB,QAAmC;AACnG,MAAI,QAAQ;AACV,WAAO,IAAI,gBAAgB,aAAa,OAAO,MAAM,wBAAwB,MAAM,CAAC,CAAC;AAAA,EACvF,OAAO;AACL,WAAO,IAAI,WAAW;AAAA,EACxB;AACF;AAEA,IAAM,cAAc,CAAC;AAEd,IAAM,mBAAN,MAAkE;AAAA,EAAlE;AACL,SAAO,KAAK;AAGZ,SAAU,aAAsB;AAKhC;AAAA,SAAU,iBAA0B;AAGpC;AAAA,SAAU,mBAA+B,IAAI,WAAW,sBAAQ,WAAW;AAE3E,SAAU,oBAA8B,EAAE,QAAQ,EAAE;AAAA;AAAA,EAI7C,MAAM,UAAsB;AACjC,SAAK,UAAU,IAAI,sBAAQ,QAAQ;AACnC,SAAK,aAAa,KAAK,QAAQ,QAAQ;AAGvC,SAAK,iBAAiB,CAAC,IAAI,6BAAS;AAEpC,QAAI,KAAK,YAAY;AACnB,WAAK,eAAe,oBAAI,IAAI;AAAA,IAC9B;AAAA,EACF;AAAA,EAEO,aAAa,QAAiB,QAA6B;AAChE,QAAI,KAAK,kBAAkB,KAAK,QAAQ,KAAK,QAAQ,SAAS,QAAW;AACvE,WAAK,oBAAoB,EAAE,QAAQ,EAAE;AACrC,WAAK,kBAAkB,KAAK,QAAQ,UAAU,KAAK,mBAAmB,KAAK,gBAAgB;AAC3F,WAAK,iBAAiB;AAAA,IACxB;AAEA,UAAM,OAAQ,KAAK,cAAc,QAAQ,OACrC,KAAK,QAAQ;AAAA,MACX,OAAO;AAAA,MACP,KAAK,kBAAkB;AAAA,MACvB,EAAE,GAAG,KAAK,kBAAkB;AAAA,MAC5B,KAAK;AAAA,IACP,IACA,KAAK;AAET,QAAI,UAAU,QAAQ;AACpB,aAAO,gBAAgB,MAAM,OAAO,MAAM,wBAAwB,MAAM,CAAC;AAAA,IAC3E;AACA,WAAO;AAAA,EACT;AAAA,EAEO,aAAa,SAAmB,QAAkB,QAA6B;AACpF,QAAI,aAAa,QAAQ;AAEzB,QAAI,eAAe,GAAG;AACpB,UAAI,KAAK,QAAQ,YAAY;AAE3B,aAAK,iBAAiB;AAAA,MACxB;AAEA,WAAK,QAAQ,eAAe;AAC5B,aAAO;AAAA,IACT;AAEA,QAAI,CAAC,KAAK,QAAQ,YAAY;AAG5B,UAAI,KAAK,YAAY;AAOnB,cAAM,wBAAwB,QAAQ,OAAO,CAAC,WAAW;AACvD,iBAAO,OAAO,UAAU,6BAAY,UAAU,OAAO,MAAM,QAAQ,OAAO;AAAA,QAC5E,CAAC;AAED,YAAI,sBAAsB,SAAS,GAAG;AACpC,gBAAMA,MAAe,EAAE,QAAQ,EAAE;AAEjC,gBAAM,eAAeA,IAAG;AACxB,eAAK,QAAQ,aAAa,CAAC,IAAI,6BAAS;AAExC,gCAAsB,QAAQ,CAAC,WAAW;AACxC,kBAAM,cAAc,KAAK,QAAQ,WAAW,OAAO,MAAM,cAAcA,GAAE;AACzE,4BAAgB,QAAQ,aAAa,MAAM;AAAA,UAC7C,CAAC;AAAA,QACH;AAAA,MACF;AAOA,UAAI,QAAQ;AACV,cAAM,gBAAgB,OAAO,KAAK,CAAC,6BAAS,gBAAgB,CAAC;AAC7D,iBAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,gBAAM,SAAS,QAAQ,CAAC;AACxB,cAAI,OAAO,UAAU,6BAAY,OAAQ;AACzC,0BAAgB,QAAQ,eAAe,MAAM;AAAA,QAC/C;AAAA,MACF;AAMA,aAAO;AAAA,IACT;AAEA,SAAK,iBAAiB;AAGtB,QAAI,wBAAW,SAAS;AACtB,MAAC,wBAAmB,kBAAc,2BAAY,KAAK,QAAQ,KAAK;AAAA,IAClE;AAGA,UAAM,KAAe,EAAE,QAAQ,EAAE;AACjC,SAAK,QAAQ,aAAa,CAAC,IAAI,6BAAS;AAGxC,UAAM,iBAAiB,KAAK,QAAQ,OAAO,EAAE;AAE7C,QAAI,CAAC,KAAK,YAAY;AACpB,aAAO,cAAc;AACnB,cAAM,SAAS,QAAQ,UAAU;AAKjC,YAAI,OAAO,UAAU,6BAAY,QAAQ;AACvC;AAAA,QACF;AAEA,wBAAgB,QAAQ,gBAAgB,MAAM;AAAA,MAChD;AAAA,IAEF,OAAO;AAEL,YAAM,eAAe,GAAG;AAGxB,aAAO,cAAc;AACnB,cAAM,SAAS,QAAQ,UAAU;AAKjC,YAAI,OAAO,UAAU,6BAAY,QAAQ;AACvC;AAAA,QACF;AAEA,cAAM,OAAO,OAAO,QAAQ;AAE5B,YAAI,cAAc,KAAK,aAAa,IAAI,IAAI;AAG5C,YAAI,gBAAgB,QAAW;AAC7B,wBAAe,SAAS,cACpB,iBACA,KAAK,QAAQ,WAAW,OAAO,MAAM,cAAc,EAAE;AACzD,eAAK,aAAa,IAAI,MAAM,WAAW;AAAA,QACzC;AAEA,wBAAgB,QAAQ,aAAa,MAAM;AAAA,MAC7C;AAGA,WAAK,aAAa,MAAM;AAAA,IAC1B;AAGA,SAAK,QAAQ,eAAe;AAG5B,QAAI,wBAAW,SAAS;AACtB;AAAA,QACE;AAAA,QACA,eAAe;AAAA,QACf,QAAQ;AAAA,QACP,wBAAmB;AAAA,MACtB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEO,YAAY;AAIjB,QAAI,CAAC,KAAK,gBAAgB;AAIxB,WAAK,iBAAkB,KAAK,QAAQ,SAAS,yBAAW,OAAO,KAAK,OAAO;AAAA,IAC7E;AAEA,WAAO,KAAK;AAAA,EACd;AAEF;",
   "names": ["it"]
 }

package/build/serializer/SchemaSerializer.d.ts

@@ -1,4 +1,4 @@
-import type { Serializer } from './Serializer.ts';
+import type { PatchTimingContext, Serializer } from './Serializer.ts';
 import { type Client } from '../Transport.ts';
 import { type Iterator, Encoder, Schema, StateView } from '@colyseus/schema';
 declare const SHARED_VIEW: {};
@@ -13,8 +13,8 @@ export declare class SchemaSerializer<T extends Schema> implements Serializer<T>
     protected sharedOffsetCache: Iterator;
     protected encodedViews: Map<StateView | typeof SHARED_VIEW, Uint8Array>;
     reset(newState: T & Schema): void;
-    getFullState(client?: Client): Uint8Array<ArrayBufferLike>;
-    applyPatches(clients: Client[]): boolean;
+    getFullState(client?: Client, timing?: PatchTimingContext): Uint8Array<ArrayBufferLike> | Buffer<ArrayBufferLike>;
+    applyPatches(clients: Client[], _state?: unknown, timing?: PatchTimingContext): boolean;
     handshake(): Uint8Array<ArrayBufferLike>;
 }
 export {};

package/build/serializer/SchemaSerializer.mjs

@@ -1,8 +1,29 @@
 // packages/core/src/serializer/SchemaSerializer.ts
-import { Protocol } from "@colyseus/shared-types";
+import { Protocol, ProtocolModifier } from "@colyseus/shared-types";
 import { ClientState } from "../Transport.mjs";
-import { Encoder, dumpChanges, Reflection } from "@colyseus/schema";
+import { encode, Encoder, dumpChanges, Reflection } from "@colyseus/schema";
 import { debugPatch } from "../Debug.mjs";
+var TIMED_PREFIX_SIZE = 8;
+function buildTimedFrame(encodedBody, sNow, inputSeq) {
+  const schemaPayload = encodedBody.subarray(1);
+  const out = Buffer.allocUnsafe(1 + TIMED_PREFIX_SIZE + schemaPayload.length);
+  out[0] = encodedBody[0] | ProtocolModifier.TIMED;
+  const it = { offset: 1 };
+  encode.uint32(out, sNow >>> 0, it);
+  encode.uint32(out, inputSeq >>> 0, it);
+  out.set(schemaPayload, it.offset);
+  return out;
+}
+function clientProcessedInputSeq(client) {
+  return client._inputBuffer?.ackSeq ?? 0;
+}
+function sendClientFrame(client, encodedBody, timing) {
+  if (timing) {
+    client.raw(buildTimedFrame(encodedBody, timing.sNow, clientProcessedInputSeq(client)));
+  } else {
+    client.raw(encodedBody);
+  }
+}
 var SHARED_VIEW = {};
 var SchemaSerializer = class {
   constructor() {
@@ -22,24 +43,24 @@ var SchemaSerializer = class {
       this.encodedViews = /* @__PURE__ */ new Map();
     }
   }
-  getFullState(client) {
+  getFullState(client, timing) {
     if (this.needFullEncode || this.encoder.root.changes.next !== void 0) {
       this.sharedOffsetCache = { offset: 1 };
       this.fullEncodeCache = this.encoder.encodeAll(this.sharedOffsetCache, this.fullEncodeBuffer);
       this.needFullEncode = false;
     }
-    if (this.hasFilters && client?.view) {
-      return this.encoder.encodeAllView(
-        client.view,
-        this.sharedOffsetCache.offset,
-        { ...this.sharedOffsetCache },
-        this.fullEncodeBuffer
-      );
-    } else {
-      return this.fullEncodeCache;
+    const body = this.hasFilters && client?.view ? this.encoder.encodeAllView(
+      client.view,
+      this.sharedOffsetCache.offset,
+      { ...this.sharedOffsetCache },
+      this.fullEncodeBuffer
+    ) : this.fullEncodeCache;
+    if (timing && client) {
+      return buildTimedFrame(body, timing.sNow, clientProcessedInputSeq(client));
     }
+    return body;
   }
-  applyPatches(clients) {
+  applyPatches(clients, _state, timing) {
     let numClients = clients.length;
     if (numClients === 0) {
       if (this.encoder.hasChanges) {
@@ -58,10 +79,19 @@ var SchemaSerializer = class {
           const sharedOffset = it2.offset;
           this.encoder.sharedBuffer[0] = Protocol.ROOM_STATE_PATCH;
           clientsWithViewChange.forEach((client) => {
-            client.raw(this.encoder.encodeView(client.view, sharedOffset, it2));
+            const encodedView = this.encoder.encodeView(client.view, sharedOffset, it2);
+            sendClientFrame(client, encodedView, timing);
           });
         }
       }
+      if (timing) {
+        const heartbeatBody = Buffer.from([Protocol.ROOM_STATE_PATCH]);
+        for (let i = 0; i < clients.length; i++) {
+          const client = clients[i];
+          if (client.state !== ClientState.JOINED) continue;
+          sendClientFrame(client, heartbeatBody, timing);
+        }
+      }
       return false;
     }
     this.needFullEncode = true;
@@ -77,7 +107,7 @@ var SchemaSerializer = class {
         if (client.state !== ClientState.JOINED) {
           continue;
         }
-        client.raw(encodedChanges);
+        sendClientFrame(client, encodedChanges, timing);
       }
     } else {
       const sharedOffset = it.offset;
@@ -92,7 +122,7 @@ var SchemaSerializer = class {
           encodedView = view === SHARED_VIEW ? encodedChanges : this.encoder.encodeView(client.view, sharedOffset, it);
           this.encodedViews.set(view, encodedView);
         }
-        client.raw(encodedView);
+        sendClientFrame(client, encodedView, timing);
       }
       this.encodedViews.clear();
     }