@colyseus/core 0.18.14 → 0.18.15

package/build/Transport.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/Transport.ts"],
-  "sourcesContent": ["import * as http from 'http';\nimport * as https from 'https';\n\nimport type { Router } from '@colyseus/better-call';\n\nimport { ErrorCode } from '@colyseus/shared-types';\nimport { StateView } from '@colyseus/schema';\nimport type { InputDecoder } from '@colyseus/schema/input';\n\nimport { EventEmitter } from 'events';\nimport { debugAndPrintError } from './Debug.ts';\nimport { getBearerToken, spliceOne } from './utils/Utils.ts';\nimport { ServerError } from './errors/ServerError.ts';\n\nimport type { Room } from './Room.ts';\n\nlet _transport: Transport | undefined;\nexport function setTransport(transport: Transport) { _transport = transport; }\nexport function getTransport() { return _transport; }\n\nexport abstract class Transport {\n    public protocol?: string;\n    /** Self-signed cert SHA-256 hash (byte array), surfaced to clients in the\n     *  matchmake response so a WebTransport client can pin it via\n     *  `serverCertificateHashes`. Set by transports that generate their own cert\n     *  (h3). Undefined for transports using a CA-trusted cert. */\n    public fingerprint?: number[];\n    public server?: http.Server | https.Server;\n\n    public abstract listen(port?: number | string, hostname?: string, backlog?: number, listeningListener?: Function): this;\n    public abstract shutdown(): void;\n\n    public abstract simulateLatency(milliseconds: number): void;\n\n    /**\n     * Returns an Express-compatible application for HTTP route handling.\n     * For uWebSockets transport, this uses the uwebsockets-express module.\n     * This method is called lazily only when an express callback is provided in server options.\n     */\n    public getExpressApp?(): Promise<import('express').Application> | import('express').Application | undefined;\n\n    /**\n     * Binds a router to the transport.\n     * Some transports may have a custom way to bind a router to the transport.\n     * (uWebSocketsTransport)\n     */\n    public bindRouter?(router: Router): void;\n}\n\n/**\n * Intercepts an incoming WebSocket upgrade request, before the handshake.\n *\n * Return a `Response` to answer the request instead of upgrading it. Return\n * nothing to upgrade as usual. The handler may be async, and the handshake waits\n * for it to resolve.\n *\n * `context` is the same shape `onAuth()` receives, read-only here: mutating it\n * does not carry over to `onAuth()`.\n *\n * Not supported by `H3Transport`: WebTransport has no upgrade handshake.\n *\n * @example\n * ```typescript\n * new uWebSocketsTransport({\n *   beforeUpgrade: async (request, context) => {\n *     if (await isBanned(context.ip)) {\n *       return new Response(null, { status: 403 });\n *     }\n *   }\n * });\n * ```\n */\nexport type BeforeUpgradeHandler = (\n  request: Request,\n  context: Readonly<AuthContext>,\n) => Response | void | Promise<Response | void>;\n\n/**\n * Invokes a `beforeUpgrade` handler, resolving with the `Response` to send\n * instead of upgrading, or `undefined` to proceed with the upgrade.\n *\n * Every transport goes through here, so a handler written against one keeps\n * working on the others. Never rejects: uWebSockets.js aborts the process on an\n * upgrade handler that yields without responding, and on the other transports a\n * raw socket left behind leaks a connection.\n *\n * @internal\n */\nexport async function runBeforeUpgrade(\n  handler: BeforeUpgradeHandler,\n  url: string, // path, optionally including the query string\n  context: AuthContext,\n): Promise<Response | undefined> {\n  let request: Request;\n\n  try {\n    const host = context.headers.get('host') || 'localhost';\n    request = new Request(`http://${host}${url}`, { headers: context.headers });\n\n  } catch (e: any) {\n    // a `Host` header that isn't a valid authority fails to parse as a URL\n    debugAndPrintError(e);\n    return new Response(null, { status: 400 });\n  }\n\n  try {\n    // `||`, not `??`: a handler that returns nothing is typed `void`, which `??` doesn't strip\n    return (await handler(request, context)) || undefined;\n\n  } catch (e: any) {\n    debugAndPrintError(e);\n    return new Response(null, { status: 500 });\n  }\n}\n\n/** Headers as the transport has them: uWebSockets.js and Node give a plain record. */\ntype RawHeaders = Headers | Record<string, string | undefined>;\n\nconst readHeader = (headers: RawHeaders, name: string) =>\n  (headers instanceof Headers) ? headers.get(name) : headers[name];\n\n/**\n * Builds the context passed to `beforeUpgrade` and `onAuth`.\n *\n * Every transport goes through here, so the context is identical everywhere,\n * down to how the client address is resolved. `headers` is materialized on\n * first read: a connection nobody inspects pays nothing for the conversion.\n *\n * @internal\n */\nexport function createAuthContext(options: {\n  headers: RawHeaders,\n  token?: string | null,\n  remoteAddress?: string,\n  req?: any,\n}): AuthContext {\n  const source = options.headers;\n  let headers: Headers | undefined;\n\n  return {\n    token: options.token ?? getBearerToken(readHeader(source, 'authorization')),\n    ip: resolveClientIp(source, options.remoteAddress),\n    req: options.req,\n    get headers() {\n      return headers ??= (source instanceof Headers)\n        ? source\n        : new Headers(source as Record<string, string>);\n    },\n  };\n}\n\n/**\n * A single address, resolved the same way on every transport: `x-forwarded-for`\n * carries the whole proxy chain, and only its first entry is the client.\n */\nfunction resolveClientIp(headers: RawHeaders, remoteAddress?: string): string | undefined {\n  // an empty header counts as absent\n  const firstHop = (name: string) => readHeader(headers, name)?.split(',')[0].trim() || undefined;\n\n  return (\n    firstHop('x-real-ip') ??\n    firstHop('x-forwarded-for') ??\n    firstHop('x-client-ip') ??\n    (remoteAddress || undefined)\n  );\n}\n\nexport type AuthContext = {\n  token?: string,\n  /** Undefined when no proxy header carries it and the transport has no peer address. */\n  ip: string | undefined;\n  headers: Headers,\n  /** Only set on the HTTP matchmaking request, where it is the `Request` itself. */\n  req?: any;\n};\n\nexport interface ISendOptions {\n  afterNextPatch?: boolean;\n}\n\nexport const ClientState = {\n  JOINING: 0,\n  JOINED: 1,\n  RECONNECTING: 2,\n  RECONNECTED: 3,\n  LEAVING: 4,\n  CLOSED: 5\n} as const;\nexport type ClientState = (typeof ClientState)[keyof typeof ClientState];\n\n// Helper types to extract properties from the Client type parameter\ntype ExtractClientUserData<T> = T extends { userData: infer U } ? U : T;\ntype ExtractClientAuth<T> = T extends { auth: infer A } ? A : any;\ntype ExtractClientMessages<T> = T extends { messages: infer M } ? M : any;\n\n// Helper type to make message required when the message type demands it\nexport type MessageArgs<M, Options> =\n  unknown extends M ? [message?: M, options?: Options] :  // Handle 'any' type (backwards compatibility)\n  [M] extends [never] ? [message?: M, options?: Options] :\n  [M] extends [void] ? [message?: M, options?: Options] :\n  [M] extends [undefined] ? [message?: M, options?: Options] :\n  undefined extends M ? [message?: M, options?: Options] :\n  [message: M, options?: Options];\n\n/**\n * The client instance from the server-side is responsible for the transport layer between the server and the client.\n * It should not be confused with the Client from the client-side SDK, as they have completely different purposes!\n * You operate on client instances from `this.clients`, `Room#onJoin()`, `Room#onLeave()` and `Room#onMessage()`.\n *\n * - This is the raw WebSocket connection coming from the `ws` package. There are more methods available which aren't\n *  encouraged to use along with Colyseus.\n */\nexport interface Client<T extends { userData?: any, auth?: any, messages?: Record<string | number, any> } = any> {\n  '~messages': ExtractClientMessages<T>;\n\n  ref: EventEmitter;\n\n  /**\n   * Unique id per session.\n   */\n  sessionId: string;\n\n  /**\n   * Connection state\n   */\n  state: ClientState;\n\n  /**\n   * Optional: when using `@view()` decorator in your state properties, this will be the view instance for this client.\n   */\n  view?: StateView;\n\n  /**\n   * User-defined data can be attached to the Client instance through this variable.\n   * - Can be used to store custom data about the client's connection. userData is not synchronized with the client,\n   * and should be used only to keep player-specific with its connection.\n   */\n  userData?: ExtractClientUserData<T>;\n\n  /**\n   * auth data provided by your `onAuth`\n   */\n  auth?: ExtractClientAuth<T>;\n\n  /**\n   * Reconnection token used to re-join the room after onLeave + allowReconnection().\n   *\n   * IMPORTANT:\n   *    This is not the full reconnection token the client provides for the server.\n   *    The format provided by .reconnect() from the client-side must follow: \"${roomId}:${reconnectionToken}\"\n   */\n  reconnectionToken: string;\n\n  // TODO: move these to ClientPrivate\n  raw(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n  enqueueRaw(data: Uint8Array | Buffer, options?: ISendOptions): void;\n\n  /**\n   * Send raw bytes over the transport's UNRELIABLE channel \u2014 no delivery,\n   * ordering, or duplication guarantee. Used for `@unreliable` state patches.\n   *\n   * Absent on transports with no datagram channel (every WebSocket transport).\n   * Its presence IS the capability check \u2014 callers feature-detect rather than\n   * reading a separate flag, and skip clients that can't receive.\n   */\n  rawUnreliable?(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n\n  /**\n   * Send a type of message to the client. Messages are encoded with MsgPack and can hold any\n   * JSON-serializable data structure.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param message Message payload. (automatically encoded with msgpack.)\n   * @param options\n   */\n  send<K extends keyof this['~messages']>(\n    type: K,\n    ...args: MessageArgs<this['~messages'][K], ISendOptions>\n  ): void;\n\n  /**\n   * Send raw bytes to this specific client.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param bytes Raw byte array payload\n   * @param options\n   */\n  sendBytes(type: string | number, bytes: Buffer | Uint8Array, options?: ISendOptions): void;\n\n  /**\n   * Disconnect this client from the room.\n   *\n   * @param code Custom close code. Default value is 1000.\n   * @param data\n   * @see [Leave room](https://docs.colyseus.io/room#leave-room)\n   */\n  leave(code?: number, data?: string): void;\n\n  /**\n   * @deprecated Use .leave() instead.\n   */\n  close(code?: number, data?: string): void;\n\n  /**\n   * Triggers `onError` with specified code to the client-side.\n   *\n   * @param code\n   * @param message\n   */\n  error(code: number, message?: string): void;\n}\n\n/**\n * Private properties of the Client instance.\n * Only accessible internally by the framework, should not be encouraged/auto-completed for the user.\n *\n * TODO: refactor this.\n * @private\n */\nexport interface ClientPrivate {\n  readyState: number; // TODO: remove readyState on version 1.0.0. Use only \"state\" instead.\n  _enqueuedMessages?: any[];\n  _joinedAt: number; // \"elapsedTime\" when the client joined the room.\n\n  /**\n   * Used for rate limiting via maxMessagesPerSecond.\n   */\n  _numMessagesLastSecond?: number;\n  _lastMessageTime?: number;\n\n  /**\n   * Per-client input Schema instance, allocated on join when the Room\n   * declares `input`. Mutated in-place by {@link _inputDecoder} on each\n   * incoming ROOM_INPUT_* packet.\n   *\n   * Typed loosely (`any`) so duplicate `@colyseus/schema` installs don't\n   * trigger type-identity errors against user-defined input classes.\n   */\n  _input?: any;\n  _inputDecoder?: InputDecoder;\n\n  /**\n   * Per-client buffer of cloned input snapshots, allocated on join when\n   * `Room.inputOptions.bufferMaxSize > 0`. Populated on each decoded frame.\n   */\n  _inputBuffer?: import('./input/InputBuffer.ts').InputBufferImpl;\n\n  /**\n   * Cached per-client accessor returned by `room.input(sessionId)`. Built\n   * once at join (when the Room called `defineInput()`), so the public API\n   * call is a Map lookup + property read with no per-call allocation.\n   */\n  _inputAccessor?: import('./input/types.ts').InputAccessor;\n\n  /**\n   * Used for rate limiting ROOM_INPUT_* packets via maxInputsPerSecond,\n   * independent of maxMessagesPerSecond.\n   */\n  _numInputsLastSecond?: number;\n  _lastInputTime?: number;\n\n  /**\n   * `performance.now()` recorded when the most recent ROOM_INPUT_* packet\n   * from this client was received. Receive-side diagnostic only \u2014 NOT on the\n   * wire: the {@link ProtocolModifier.TIMED} state prefix acks the seq of the\n   * last input CONSUMED into the state (the input buffer's `ackSeq`).\n   *\n   * `0` until the client has sent its first input.\n   */\n  _lastInputReceivedAt?: number;\n\n  /**\n   * Monotonic count of *reliable* inputs successfully received from this\n   * client. Receive-time counter \u2014 it LEADS the state by inputs still\n   * buffered; what the TIMED prefix acks is the CONSUMED seq (the input\n   * buffer's `ackSeq`), not this. Stays at the default `0` until the client\n   * sends its first reliable input.\n   *\n   * Only ROOM_INPUT_RELIABLE bumps this \u2014 unreliable's redundant-ring\n   * pattern would double-count.\n   */\n  _receivedInputCount?: number;\n\n  /**\n   * Running baseline for the DELTA-CODED lag-comp stamp on ROOM_INPUT_RELIABLE\n   * frames (the {@link ProtocolModifier.TIMED} prefix). Each frame carries only\n   * the signed change from the previous stamp; this accumulates them back into\n   * the absolute timeline value. Zeroed on (re)connect alongside the SDK's own\n   * baseline so the first delta after a reset is absolute. `0` until allocated.\n   */\n  _reckonBaseline?: number;\n\n  /**\n   * @internal Per-client raw frames staged to ride out right AFTER this client's\n   * next state patch \u2014 per-client `afterNextPatch` messages. Lazily allocated.\n   * Pushed by {@link enqueueClientRaw} (the `afterNextPatch` path), flushed as\n   * standalone frames after the patch by {@link Room._flushPendingClientFrames}.\n   * Room-level `broadcast` `afterNextPatch` uses the Room's own queue instead, not\n   * this buffer.\n   */\n  _pendingFrames?: Uint8Array[];\n\n  /**\n   * @internal Back-reference to the Room's \"clients with staged frames\" list,\n   * shared by reference at join. {@link enqueueClientRaw} pushes the client here\n   * on its first staged frame of a cycle, so the after-patch flush iterates just\n   * those clients rather than scanning every client.\n   */\n  _pendingFrameClients?: Array<Client & ClientPrivate>;\n}\n\n/**\n * The framework-level send path shared by every transport's `enqueueRaw` \u2014 the\n * single source of truth so each transport implements only the wire-level `raw`.\n * Routes a raw frame by where it should go:\n *\n *  - `afterNextPatch` \u2192 stage onto the per-client {@link ClientPrivate._pendingFrames}\n *    buffer, sent as a standalone frame right AFTER the next state patch; a\n *    no-allocation push into a reused array. The client announces itself to the\n *    Room's {@link ClientPrivate._pendingFrameClients} list on its first staged\n *    frame of a cycle.\n *  - before JOIN \u2192 buffer in `_enqueuedMessages` until the JOIN_ROOM handshake flushes.\n *  - otherwise \u2192 send now via the transport's `raw`.\n *\n * @internal\n */\nexport function enqueueClientRaw(\n  client: Client & ClientPrivate,\n  data: Uint8Array | Buffer,\n  options?: ISendOptions,\n): void {\n  if (options?.afterNextPatch) {\n    let frames = client._pendingFrames;\n    if (frames === undefined) { frames = client._pendingFrames = []; }\n    if (frames.length === 0) { client._pendingFrameClients?.push(client); } // first frame this cycle\n    frames.push(data);\n    return;\n  }\n  if (client.state !== ClientState.JOINED) {\n    // During `onJoin` / `onReconnect` the client can't register onMessage\n    // handlers yet \u2014 buffer until JOIN_ROOM has been sent.\n    client._enqueuedMessages?.push(data);\n    return;\n  }\n  client.raw(data, options);\n}\n\nexport class ClientArray<C extends Client = Client> extends Array<C> {\n  /**\n   * Secondary index for O(1) lookup by sessionId. Kept in sync by the\n   * mutating methods overridden below. Direct index assignment\n   * (`arr[i] = client`) and `arr.length = 0` bypass this index \u2014 use\n   * `push` / `splice` / `delete` / `pop` / `shift` / `unshift` instead.\n   */\n  private _byId: Map<string, C> = new Map();\n\n  /** The client for `sessionId`, or `undefined` \u2014 O(1). The canonical per-session\n   *  lookup (mirrors `room.inputs.get(sessionId)`). */\n  public get(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  /** @deprecated Use {@link get}. */\n  public getById(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  public delete(client: C): boolean {\n    const removed = spliceOne(this, this.indexOf(client));\n    if (removed) this._byId.delete(client.sessionId);\n    return removed;\n  }\n\n  public push(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.push(...items);\n  }\n\n  public pop(): C | undefined {\n    const removed = super.pop();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public shift(): C | undefined {\n    const removed = super.shift();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public unshift(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.unshift(...items);\n  }\n\n  public splice(start: number, deleteCount?: number, ...items: C[]): C[] {\n    const removed = (deleteCount === undefined)\n      ? super.splice(start)\n      : super.splice(start, deleteCount, ...items);\n    for (let i = 0; i < removed.length; i++) this._byId.delete(removed[i].sessionId);\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return removed;\n  }\n}\n\n/**\n * Shared internal method to connect a Client into a Room.\n * Validates seat reservation and joins the client to the room.\n *\n * @remarks\n * **\u26A0\uFE0F This is an internal API and not intended for end-user use.**\n *\n * @internal\n */\nexport async function connectClientToRoom(\n  room: Room | undefined,\n  client: Client & ClientPrivate,\n  authContext: AuthContext,\n  connectionOptions: {\n    reconnectionToken?: string;\n    skipHandshake?: boolean;\n  },\n): Promise<void> {\n  if (!room || !room.hasReservedSeat(client.sessionId, connectionOptions.reconnectionToken)) {\n    throw new ServerError(ErrorCode.MATCHMAKE_EXPIRED, 'seat reservation expired.');\n  }\n\n  await room['_onJoin'](client, authContext, connectionOptions);\n}"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAAsB;AACtB,YAAuB;AAIvB,0BAA0B;AAC1B,oBAA0B;AAG1B,oBAA6B;AAC7B,mBAAmC;AACnC,mBAA0C;AAC1C,yBAA4B;AAI5B,IAAI;AACG,SAAS,aAAa,WAAsB;AAAE,eAAa;AAAW;AACtE,SAAS,eAAe;AAAE,SAAO;AAAY;AAE7C,IAAe,YAAf,MAAyB;AA2BhC;AAyCA,eAAsB,iBACpB,SACA,KACA,SAC+B;AAC/B,MAAI;AAEJ,MAAI;AACF,UAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,KAAK;AAC5C,cAAU,IAAI,QAAQ,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAAA,EAE5E,SAAS,GAAQ;AAEf,yCAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AAEA,MAAI;AAEF,WAAQ,MAAM,QAAQ,SAAS,OAAO,KAAM;AAAA,EAE9C,SAAS,GAAQ;AACf,yCAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACF;AAKA,IAAM,aAAa,CAAC,SAAqB,SACtC,mBAAmB,UAAW,QAAQ,IAAI,IAAI,IAAI,QAAQ,IAAI;AAW1D,SAAS,kBAAkB,SAKlB;AACd,QAAM,SAAS,QAAQ;AACvB,MAAI;AAEJ,SAAO;AAAA,IACL,OAAO,QAAQ,aAAS,6BAAe,WAAW,QAAQ,eAAe,CAAC;AAAA,IAC1E,IAAI,gBAAgB,QAAQ,QAAQ,aAAa;AAAA,IACjD,KAAK,QAAQ;AAAA,IACb,IAAI,UAAU;AACZ,aAAO,YAAa,kBAAkB,UAClC,SACA,IAAI,QAAQ,MAAgC;AAAA,IAClD;AAAA,EACF;AACF;AAMA,SAAS,gBAAgB,SAAqB,eAA4C;AAExF,QAAM,WAAW,CAAC,SAAiB,WAAW,SAAS,IAAI,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK;AAEtF,SACE,SAAS,WAAW,KACpB,SAAS,iBAAiB,KAC1B,SAAS,aAAa,MACrB,iBAAiB;AAEtB;AAeO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AACV;AA+OO,SAAS,iBACd,QACA,MACA,SACM;AACN,MAAI,SAAS,gBAAgB;AAC3B,QAAI,SAAS,OAAO;AACpB,QAAI,WAAW,QAAW;AAAE,eAAS,OAAO,iBAAiB,CAAC;AAAA,IAAG;AACjE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,sBAAsB,KAAK,MAAM;AAAA,IAAG;AACtE,WAAO,KAAK,IAAI;AAChB;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ;AAGvC,WAAO,mBAAmB,KAAK,IAAI;AACnC;AAAA,EACF;AACA,SAAO,IAAI,MAAM,OAAO;AAC1B;AAEO,IAAM,cAAN,cAAqD,MAAS;AAAA,EAA9D;AAAA;AAOL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,QAAwB,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA,EAIjC,IAAI,WAAkC;AAC3C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA;AAAA,EAGO,QAAQ,WAAkC;AAC/C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA,EAEO,OAAO,QAAoB;AAChC,UAAM,cAAU,wBAAU,MAAM,KAAK,QAAQ,MAAM,CAAC;AACpD,QAAI,QAAS,MAAK,MAAM,OAAO,OAAO,SAAS;AAC/C,WAAO;AAAA,EACT;AAAA,EAEO,QAAQ,OAAoB;AACjC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,KAAK,GAAG,KAAK;AAAA,EAC5B;AAAA,EAEO,MAAqB;AAC1B,UAAM,UAAU,MAAM,IAAI;AAC1B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,QAAuB;AAC5B,UAAM,UAAU,MAAM,MAAM;AAC5B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,WAAW,OAAoB;AACpC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,QAAQ,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEO,OAAO,OAAe,gBAAyB,OAAiB;AACrE,UAAM,UAAW,gBAAgB,SAC7B,MAAM,OAAO,KAAK,IAClB,MAAM,OAAO,OAAO,aAAa,GAAG,KAAK;AAC7C,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,IAAK,MAAK,MAAM,OAAO,QAAQ,CAAC,EAAE,SAAS;AAC/E,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,oBACpB,MACA,QACA,aACA,mBAIe;AACf,MAAI,CAAC,QAAQ,CAAC,KAAK,gBAAgB,OAAO,WAAW,kBAAkB,iBAAiB,GAAG;AACzF,UAAM,IAAI,+BAAY,8BAAU,mBAAmB,2BAA2B;AAAA,EAChF;AAEA,QAAM,KAAK,SAAS,EAAE,QAAQ,aAAa,iBAAiB;AAC9D;",
+  "sourcesContent": ["import * as http from 'http';\nimport * as https from 'https';\n\nimport type { Router } from '@colyseus/better-call';\n\nimport { ErrorCode } from '@colyseus/shared-types';\nimport { StateView } from '@colyseus/schema';\nimport type { InputDecoder } from '@colyseus/schema/input';\n\nimport { EventEmitter } from 'events';\nimport { debugAndPrintError } from './Debug.ts';\nimport { getBearerToken, spliceOne } from './utils/Utils.ts';\nimport { ServerError } from './errors/ServerError.ts';\n\nimport type { Room } from './Room.ts';\n\nlet _transport: Transport | undefined;\nexport function setTransport(transport: Transport) { _transport = transport; }\nexport function getTransport() { return _transport; }\n\nexport abstract class Transport {\n    public protocol?: string;\n    /** Self-signed cert SHA-256 hash (byte array), surfaced to clients in the\n     *  matchmake response so a WebTransport client can pin it via\n     *  `serverCertificateHashes`. Set by transports that generate their own cert\n     *  (h3). Undefined for transports using a CA-trusted cert. */\n    public fingerprint?: number[];\n    public server?: http.Server | https.Server;\n\n    public abstract listen(port?: number | string, hostname?: string, backlog?: number, listeningListener?: Function): this;\n    public abstract shutdown(): void;\n\n    public abstract simulateLatency(milliseconds: number): void;\n\n    /**\n     * Returns an Express-compatible application for HTTP route handling.\n     * For uWebSockets transport, this uses the uwebsockets-express module.\n     * This method is called lazily only when an express callback is provided in server options.\n     */\n    public getExpressApp?(): Promise<import('express').Application> | import('express').Application | undefined;\n\n    /**\n     * Binds a router to the transport.\n     * Some transports may have a custom way to bind a router to the transport.\n     * (uWebSocketsTransport)\n     */\n    public bindRouter?(router: Router): void;\n}\n\n/**\n * Intercepts an incoming WebSocket upgrade request, before the handshake.\n *\n * Return a `Response` to answer the request instead of upgrading it. Return\n * nothing to upgrade as usual. The handler may be async, and the handshake waits\n * for it to resolve.\n *\n * `context` is the same shape `onAuth()` receives, read-only here: mutating it\n * does not carry over to `onAuth()`.\n *\n * Not supported by `H3Transport`: WebTransport has no upgrade handshake.\n *\n * @example\n * ```typescript\n * new uWebSocketsTransport({\n *   beforeUpgrade: async (request, context) => {\n *     if (await isBanned(context.ip)) {\n *       return new Response(null, { status: 403 });\n *     }\n *   }\n * });\n * ```\n */\nexport type BeforeUpgradeHandler = (\n  request: Request,\n  context: Readonly<AuthContext>,\n) => Response | void | Promise<Response | void>;\n\n/**\n * Invokes a `beforeUpgrade` handler, resolving with the `Response` to send\n * instead of upgrading, or `undefined` to proceed with the upgrade.\n *\n * Every transport goes through here, so a handler written against one keeps\n * working on the others. Never rejects: uWebSockets.js aborts the process on an\n * upgrade handler that yields without responding, and on the other transports a\n * raw socket left behind leaks a connection.\n *\n * @internal\n */\nexport async function runBeforeUpgrade(\n  handler: BeforeUpgradeHandler,\n  url: string, // path, optionally including the query string\n  context: AuthContext,\n): Promise<Response | undefined> {\n  let request: Request;\n\n  try {\n    const host = context.headers.get('host') || 'localhost';\n    request = new Request(`http://${host}${url}`, { headers: context.headers });\n\n  } catch (e: any) {\n    // a `Host` header that isn't a valid authority fails to parse as a URL\n    debugAndPrintError(e);\n    return new Response(null, { status: 400 });\n  }\n\n  try {\n    // `||`, not `??`: a handler that returns nothing is typed `void`, which `??` doesn't strip\n    return (await handler(request, context)) || undefined;\n\n  } catch (e: any) {\n    debugAndPrintError(e);\n    return new Response(null, { status: 500 });\n  }\n}\n\n/** Headers as the transport has them: uWebSockets.js and Node give a plain record. */\ntype RawHeaders = Headers | Record<string, string | undefined>;\n\nconst readHeader = (headers: RawHeaders, name: string) =>\n  (headers instanceof Headers) ? headers.get(name) : headers[name];\n\n/**\n * Builds the context passed to `beforeUpgrade` and `onAuth`.\n *\n * Every transport goes through here, so the context is identical everywhere,\n * down to how the client address is resolved. `headers` is materialized on\n * first read: a connection nobody inspects pays nothing for the conversion.\n *\n * @internal\n */\nexport function createAuthContext(options: {\n  headers: RawHeaders,\n  token?: string | null,\n  remoteAddress?: string,\n  req?: any,\n}): AuthContext {\n  const source = options.headers;\n  let headers: Headers | undefined;\n\n  return {\n    token: options.token ?? getBearerToken(readHeader(source, 'authorization')),\n    ip: resolveClientIp(source, options.remoteAddress),\n    req: options.req,\n    get headers() {\n      return headers ??= (source instanceof Headers)\n        ? source\n        : new Headers(source as Record<string, string>);\n    },\n  };\n}\n\n/**\n * A single address, resolved the same way on every transport: `x-forwarded-for`\n * carries the whole proxy chain, and only its first entry is the client.\n */\nfunction resolveClientIp(headers: RawHeaders, remoteAddress?: string): string | undefined {\n  // an empty header counts as absent\n  const firstHop = (name: string) => readHeader(headers, name)?.split(',')[0].trim() || undefined;\n\n  return (\n    firstHop('x-real-ip') ??\n    firstHop('x-forwarded-for') ??\n    firstHop('x-client-ip') ??\n    (remoteAddress || undefined)\n  );\n}\n\nexport type AuthContext = {\n  token?: string,\n  /** Undefined when no proxy header carries it and the transport has no peer address. */\n  ip: string | undefined;\n  headers: Headers,\n  /** Only set on the HTTP matchmaking request, where it is the `Request` itself. */\n  req?: any;\n};\n\nexport interface ISendOptions {\n  afterNextPatch?: boolean;\n}\n\nexport const ClientState = {\n  JOINING: 0,\n  JOINED: 1,\n  RECONNECTING: 2,\n  RECONNECTED: 3,\n  LEAVING: 4,\n  CLOSED: 5\n} as const;\nexport type ClientState = (typeof ClientState)[keyof typeof ClientState];\n\n// Helper types to extract properties from the Client type parameter\ntype ExtractClientUserData<T> = T extends { userData: infer U } ? U : T;\ntype ExtractClientAuth<T> = T extends { auth: infer A } ? A : any;\ntype ExtractClientMessages<T> = T extends { messages: infer M } ? M : any;\n\n// Helper type to make message required when the message type demands it\nexport type MessageArgs<M, Options> =\n  unknown extends M ? [message?: M, options?: Options] :  // Handle 'any' type (backwards compatibility)\n  [M] extends [never] ? [message?: M, options?: Options] :\n  [M] extends [void] ? [message?: M, options?: Options] :\n  [M] extends [undefined] ? [message?: M, options?: Options] :\n  undefined extends M ? [message?: M, options?: Options] :\n  [message: M, options?: Options];\n\n/**\n * The client instance from the server-side is responsible for the transport layer between the server and the client.\n * It should not be confused with the Client from the client-side SDK, as they have completely different purposes!\n * You operate on client instances from `this.clients`, `Room#onJoin()`, `Room#onLeave()` and `Room#onMessage()`.\n *\n * - This is the raw WebSocket connection coming from the `ws` package. There are more methods available which aren't\n *  encouraged to use along with Colyseus.\n */\nexport interface Client<T extends { userData?: any, auth?: any, messages?: Record<string | number, any> } = any> {\n  '~messages': ExtractClientMessages<T>;\n\n  ref: EventEmitter;\n\n  /**\n   * Unique id per session.\n   */\n  sessionId: string;\n\n  /**\n   * Connection state\n   */\n  state: ClientState;\n\n  /**\n   * Optional: when using `@view()` decorator in your state properties, this will be the view instance for this client.\n   */\n  view?: StateView;\n\n  /**\n   * User-defined data can be attached to the Client instance through this variable.\n   * - Can be used to store custom data about the client's connection. userData is not synchronized with the client,\n   * and should be used only to keep player-specific with its connection.\n   */\n  userData?: ExtractClientUserData<T>;\n\n  /**\n   * auth data provided by your `onAuth`\n   */\n  auth?: ExtractClientAuth<T>;\n\n  /**\n   * Reconnection token used to re-join the room after onLeave + allowReconnection().\n   *\n   * IMPORTANT:\n   *    This is not the full reconnection token the client provides for the server.\n   *    The format provided by .reconnect() from the client-side must follow: \"${roomId}:${reconnectionToken}\"\n   */\n  reconnectionToken: string;\n\n  // TODO: move these to ClientPrivate\n  raw(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n  enqueueRaw(data: Uint8Array | Buffer, options?: ISendOptions): void;\n\n  /**\n   * Send raw bytes over the transport's UNRELIABLE channel \u2014 no delivery,\n   * ordering, or duplication guarantee. Used for `@unreliable` state patches.\n   *\n   * Absent on transports with no datagram channel (every WebSocket transport).\n   * Its presence IS the capability check \u2014 callers feature-detect rather than\n   * reading a separate flag, and skip clients that can't receive.\n   */\n  rawUnreliable?(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n\n  /**\n   * Send a type of message to the client. Messages are encoded with MsgPack and can hold any\n   * JSON-serializable data structure.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param message Message payload. (automatically encoded with msgpack.)\n   * @param options\n   */\n  send<K extends keyof this['~messages']>(\n    type: K,\n    ...args: MessageArgs<this['~messages'][K], ISendOptions>\n  ): void;\n\n  /**\n   * Send raw bytes to this specific client.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param bytes Raw byte array payload\n   * @param options\n   */\n  sendBytes(type: string | number, bytes: Buffer | Uint8Array, options?: ISendOptions): void;\n\n  /**\n   * Disconnect this client from the room.\n   *\n   * @param code Custom close code. Default value is 1000.\n   * @param data\n   * @see [Leave room](https://docs.colyseus.io/room#leave-room)\n   */\n  leave(code?: number, data?: string): void;\n\n  /**\n   * @deprecated Use .leave() instead.\n   */\n  close(code?: number, data?: string): void;\n\n  /**\n   * Triggers `onError` with specified code to the client-side.\n   *\n   * @param code\n   * @param message\n   */\n  error(code: number, message?: string): void;\n}\n\n/**\n * Private properties of the Client instance.\n * Only accessible internally by the framework, should not be encouraged/auto-completed for the user.\n *\n * TODO: refactor this.\n * @private\n */\nexport interface ClientPrivate {\n  readyState: number; // TODO: remove readyState on version 1.0.0. Use only \"state\" instead.\n  _enqueuedMessages?: any[];\n  _joinedAt: number; // \"elapsedTime\" when the client joined the room.\n\n  /**\n   * Rate limiting via maxMessagesPerSecond: frames seen so far, and the\n   * moment the count goes back to zero.\n   */\n  _numMessagesLastSecond?: number;\n  _messageCountResetsAt?: number;\n\n  /**\n   * Time of the most recent inbound frame. Moves on every frame \u2014 this is\n   * the one to read for \"how long has this client been quiet?\" (see\n   * IdleKickPlugin). The rate-limit counter above only resets once a second.\n   */\n  _lastMessageTime?: number;\n\n  /**\n   * Per-client input Schema instance, allocated on join when the Room\n   * declares `input`. Mutated in-place by {@link _inputDecoder} on each\n   * incoming ROOM_INPUT_* packet.\n   *\n   * Typed loosely (`any`) so duplicate `@colyseus/schema` installs don't\n   * trigger type-identity errors against user-defined input classes.\n   */\n  _input?: any;\n  _inputDecoder?: InputDecoder;\n\n  /**\n   * Per-client buffer of cloned input snapshots, allocated on join when\n   * `Room.inputOptions.bufferMaxSize > 0`. Populated on each decoded frame.\n   */\n  _inputBuffer?: import('./input/InputBuffer.ts').InputBufferImpl;\n\n  /**\n   * Cached per-client accessor returned by `room.input(sessionId)`. Built\n   * once at join (when the Room called `defineInput()`), so the public API\n   * call is a Map lookup + property read with no per-call allocation.\n   */\n  _inputAccessor?: import('./input/types.ts').InputAccessor;\n\n  /**\n   * Used for rate limiting ROOM_INPUT_* packets via maxInputsPerSecond,\n   * independent of maxMessagesPerSecond.\n   */\n  _numInputsLastSecond?: number;\n  _lastInputTime?: number;\n\n  /**\n   * `performance.now()` recorded when the most recent ROOM_INPUT_* packet\n   * from this client was received. Receive-side diagnostic only \u2014 NOT on the\n   * wire: the {@link ProtocolModifier.TIMED} state prefix acks the seq of the\n   * last input CONSUMED into the state (the input buffer's `ackSeq`).\n   *\n   * `0` until the client has sent its first input.\n   */\n  _lastInputReceivedAt?: number;\n\n  /**\n   * Monotonic count of *reliable* inputs successfully received from this\n   * client. Receive-time counter \u2014 it LEADS the state by inputs still\n   * buffered; what the TIMED prefix acks is the CONSUMED seq (the input\n   * buffer's `ackSeq`), not this. Stays at the default `0` until the client\n   * sends its first reliable input.\n   *\n   * Only ROOM_INPUT_RELIABLE bumps this \u2014 unreliable's redundant-ring\n   * pattern would double-count.\n   */\n  _receivedInputCount?: number;\n\n  /**\n   * Running baseline for the DELTA-CODED lag-comp stamp on ROOM_INPUT_RELIABLE\n   * frames (the {@link ProtocolModifier.TIMED} prefix). Each frame carries only\n   * the signed change from the previous stamp; this accumulates them back into\n   * the absolute timeline value. Zeroed on (re)connect alongside the SDK's own\n   * baseline so the first delta after a reset is absolute. `0` until allocated.\n   */\n  _reckonBaseline?: number;\n\n  /**\n   * @internal Per-client raw frames staged to ride out right AFTER this client's\n   * next state patch \u2014 per-client `afterNextPatch` messages. Lazily allocated.\n   * Pushed by {@link enqueueClientRaw} (the `afterNextPatch` path), flushed as\n   * standalone frames after the patch by {@link Room._flushPendingClientFrames}.\n   * Room-level `broadcast` `afterNextPatch` uses the Room's own queue instead, not\n   * this buffer.\n   */\n  _pendingFrames?: Uint8Array[];\n\n  /**\n   * @internal Back-reference to the Room's \"clients with staged frames\" list,\n   * shared by reference at join. {@link enqueueClientRaw} pushes the client here\n   * on its first staged frame of a cycle, so the after-patch flush iterates just\n   * those clients rather than scanning every client.\n   */\n  _pendingFrameClients?: Array<Client & ClientPrivate>;\n}\n\n/**\n * The framework-level send path shared by every transport's `enqueueRaw` \u2014 the\n * single source of truth so each transport implements only the wire-level `raw`.\n * Routes a raw frame by where it should go:\n *\n *  - `afterNextPatch` \u2192 stage onto the per-client {@link ClientPrivate._pendingFrames}\n *    buffer, sent as a standalone frame right AFTER the next state patch; a\n *    no-allocation push into a reused array. The client announces itself to the\n *    Room's {@link ClientPrivate._pendingFrameClients} list on its first staged\n *    frame of a cycle.\n *  - before JOIN \u2192 buffer in `_enqueuedMessages` until the JOIN_ROOM handshake flushes.\n *  - otherwise \u2192 send now via the transport's `raw`.\n *\n * @internal\n */\nexport function enqueueClientRaw(\n  client: Client & ClientPrivate,\n  data: Uint8Array | Buffer,\n  options?: ISendOptions,\n): void {\n  if (options?.afterNextPatch) {\n    let frames = client._pendingFrames;\n    if (frames === undefined) { frames = client._pendingFrames = []; }\n    if (frames.length === 0) { client._pendingFrameClients?.push(client); } // first frame this cycle\n    frames.push(data);\n    return;\n  }\n  if (client.state !== ClientState.JOINED) {\n    // During `onJoin` / `onReconnect` the client can't register onMessage\n    // handlers yet \u2014 buffer until JOIN_ROOM has been sent.\n    client._enqueuedMessages?.push(data);\n    return;\n  }\n  client.raw(data, options);\n}\n\nexport class ClientArray<C extends Client = Client> extends Array<C> {\n  /**\n   * Secondary index for O(1) lookup by sessionId. Kept in sync by the\n   * mutating methods overridden below. Direct index assignment\n   * (`arr[i] = client`) and `arr.length = 0` bypass this index \u2014 use\n   * `push` / `splice` / `delete` / `pop` / `shift` / `unshift` instead.\n   */\n  private _byId: Map<string, C> = new Map();\n\n  /** The client for `sessionId`, or `undefined` \u2014 O(1). The canonical per-session\n   *  lookup (mirrors `room.inputs.get(sessionId)`). */\n  public get(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  /** @deprecated Use {@link get}. */\n  public getById(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  public delete(client: C): boolean {\n    const removed = spliceOne(this, this.indexOf(client));\n    if (removed) this._byId.delete(client.sessionId);\n    return removed;\n  }\n\n  public push(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.push(...items);\n  }\n\n  public pop(): C | undefined {\n    const removed = super.pop();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public shift(): C | undefined {\n    const removed = super.shift();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public unshift(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.unshift(...items);\n  }\n\n  public splice(start: number, deleteCount?: number, ...items: C[]): C[] {\n    const removed = (deleteCount === undefined)\n      ? super.splice(start)\n      : super.splice(start, deleteCount, ...items);\n    for (let i = 0; i < removed.length; i++) this._byId.delete(removed[i].sessionId);\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return removed;\n  }\n}\n\n/**\n * Shared internal method to connect a Client into a Room.\n * Validates seat reservation and joins the client to the room.\n *\n * @remarks\n * **\u26A0\uFE0F This is an internal API and not intended for end-user use.**\n *\n * @internal\n */\nexport async function connectClientToRoom(\n  room: Room | undefined,\n  client: Client & ClientPrivate,\n  authContext: AuthContext,\n  connectionOptions: {\n    reconnectionToken?: string;\n    skipHandshake?: boolean;\n  },\n): Promise<void> {\n  if (!room || !room.hasReservedSeat(client.sessionId, connectionOptions.reconnectionToken)) {\n    throw new ServerError(ErrorCode.MATCHMAKE_EXPIRED, 'seat reservation expired.');\n  }\n\n  await room['_onJoin'](client, authContext, connectionOptions);\n}"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAAsB;AACtB,YAAuB;AAIvB,0BAA0B;AAC1B,oBAA0B;AAG1B,oBAA6B;AAC7B,mBAAmC;AACnC,mBAA0C;AAC1C,yBAA4B;AAI5B,IAAI;AACG,SAAS,aAAa,WAAsB;AAAE,eAAa;AAAW;AACtE,SAAS,eAAe;AAAE,SAAO;AAAY;AAE7C,IAAe,YAAf,MAAyB;AA2BhC;AAyCA,eAAsB,iBACpB,SACA,KACA,SAC+B;AAC/B,MAAI;AAEJ,MAAI;AACF,UAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,KAAK;AAC5C,cAAU,IAAI,QAAQ,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAAA,EAE5E,SAAS,GAAQ;AAEf,yCAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AAEA,MAAI;AAEF,WAAQ,MAAM,QAAQ,SAAS,OAAO,KAAM;AAAA,EAE9C,SAAS,GAAQ;AACf,yCAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACF;AAKA,IAAM,aAAa,CAAC,SAAqB,SACtC,mBAAmB,UAAW,QAAQ,IAAI,IAAI,IAAI,QAAQ,IAAI;AAW1D,SAAS,kBAAkB,SAKlB;AACd,QAAM,SAAS,QAAQ;AACvB,MAAI;AAEJ,SAAO;AAAA,IACL,OAAO,QAAQ,aAAS,6BAAe,WAAW,QAAQ,eAAe,CAAC;AAAA,IAC1E,IAAI,gBAAgB,QAAQ,QAAQ,aAAa;AAAA,IACjD,KAAK,QAAQ;AAAA,IACb,IAAI,UAAU;AACZ,aAAO,YAAa,kBAAkB,UAClC,SACA,IAAI,QAAQ,MAAgC;AAAA,IAClD;AAAA,EACF;AACF;AAMA,SAAS,gBAAgB,SAAqB,eAA4C;AAExF,QAAM,WAAW,CAAC,SAAiB,WAAW,SAAS,IAAI,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK;AAEtF,SACE,SAAS,WAAW,KACpB,SAAS,iBAAiB,KAC1B,SAAS,aAAa,MACrB,iBAAiB;AAEtB;AAeO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AACV;AAuPO,SAAS,iBACd,QACA,MACA,SACM;AACN,MAAI,SAAS,gBAAgB;AAC3B,QAAI,SAAS,OAAO;AACpB,QAAI,WAAW,QAAW;AAAE,eAAS,OAAO,iBAAiB,CAAC;AAAA,IAAG;AACjE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,sBAAsB,KAAK,MAAM;AAAA,IAAG;AACtE,WAAO,KAAK,IAAI;AAChB;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ;AAGvC,WAAO,mBAAmB,KAAK,IAAI;AACnC;AAAA,EACF;AACA,SAAO,IAAI,MAAM,OAAO;AAC1B;AAEO,IAAM,cAAN,cAAqD,MAAS;AAAA,EAA9D;AAAA;AAOL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,QAAwB,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA,EAIjC,IAAI,WAAkC;AAC3C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA;AAAA,EAGO,QAAQ,WAAkC;AAC/C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA,EAEO,OAAO,QAAoB;AAChC,UAAM,cAAU,wBAAU,MAAM,KAAK,QAAQ,MAAM,CAAC;AACpD,QAAI,QAAS,MAAK,MAAM,OAAO,OAAO,SAAS;AAC/C,WAAO;AAAA,EACT;AAAA,EAEO,QAAQ,OAAoB;AACjC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,KAAK,GAAG,KAAK;AAAA,EAC5B;AAAA,EAEO,MAAqB;AAC1B,UAAM,UAAU,MAAM,IAAI;AAC1B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,QAAuB;AAC5B,UAAM,UAAU,MAAM,MAAM;AAC5B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,WAAW,OAAoB;AACpC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,QAAQ,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEO,OAAO,OAAe,gBAAyB,OAAiB;AACrE,UAAM,UAAW,gBAAgB,SAC7B,MAAM,OAAO,KAAK,IAClB,MAAM,OAAO,OAAO,aAAa,GAAG,KAAK;AAC7C,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,IAAK,MAAK,MAAM,OAAO,QAAQ,CAAC,EAAE,SAAS;AAC/E,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,oBACpB,MACA,QACA,aACA,mBAIe;AACf,MAAI,CAAC,QAAQ,CAAC,KAAK,gBAAgB,OAAO,WAAW,kBAAkB,iBAAiB,GAAG;AACzF,UAAM,IAAI,+BAAY,8BAAU,mBAAmB,2BAA2B;AAAA,EAChF;AAEA,QAAM,KAAK,SAAS,EAAE,QAAQ,aAAa,iBAAiB;AAC9D;",
   "names": []
 }

package/build/Transport.d.ts

@@ -229,9 +229,16 @@ export interface ClientPrivate {
     _enqueuedMessages?: any[];
     _joinedAt: number;
     /**
-     * Used for rate limiting via maxMessagesPerSecond.
+     * Rate limiting via maxMessagesPerSecond: frames seen so far, and the
+     * moment the count goes back to zero.
      */
     _numMessagesLastSecond?: number;
+    _messageCountResetsAt?: number;
+    /**
+     * Time of the most recent inbound frame. Moves on every frame — this is
+     * the one to read for "how long has this client been quiet?" (see
+     * IdleKickPlugin). The rate-limit counter above only resets once a second.
+     */
     _lastMessageTime?: number;
     /**
      * Per-client input Schema instance, allocated on join when the Room

package/build/Transport.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/Transport.ts"],
-  "sourcesContent": ["import * as http from 'http';\nimport * as https from 'https';\n\nimport type { Router } from '@colyseus/better-call';\n\nimport { ErrorCode } from '@colyseus/shared-types';\nimport { StateView } from '@colyseus/schema';\nimport type { InputDecoder } from '@colyseus/schema/input';\n\nimport { EventEmitter } from 'events';\nimport { debugAndPrintError } from './Debug.ts';\nimport { getBearerToken, spliceOne } from './utils/Utils.ts';\nimport { ServerError } from './errors/ServerError.ts';\n\nimport type { Room } from './Room.ts';\n\nlet _transport: Transport | undefined;\nexport function setTransport(transport: Transport) { _transport = transport; }\nexport function getTransport() { return _transport; }\n\nexport abstract class Transport {\n    public protocol?: string;\n    /** Self-signed cert SHA-256 hash (byte array), surfaced to clients in the\n     *  matchmake response so a WebTransport client can pin it via\n     *  `serverCertificateHashes`. Set by transports that generate their own cert\n     *  (h3). Undefined for transports using a CA-trusted cert. */\n    public fingerprint?: number[];\n    public server?: http.Server | https.Server;\n\n    public abstract listen(port?: number | string, hostname?: string, backlog?: number, listeningListener?: Function): this;\n    public abstract shutdown(): void;\n\n    public abstract simulateLatency(milliseconds: number): void;\n\n    /**\n     * Returns an Express-compatible application for HTTP route handling.\n     * For uWebSockets transport, this uses the uwebsockets-express module.\n     * This method is called lazily only when an express callback is provided in server options.\n     */\n    public getExpressApp?(): Promise<import('express').Application> | import('express').Application | undefined;\n\n    /**\n     * Binds a router to the transport.\n     * Some transports may have a custom way to bind a router to the transport.\n     * (uWebSocketsTransport)\n     */\n    public bindRouter?(router: Router): void;\n}\n\n/**\n * Intercepts an incoming WebSocket upgrade request, before the handshake.\n *\n * Return a `Response` to answer the request instead of upgrading it. Return\n * nothing to upgrade as usual. The handler may be async, and the handshake waits\n * for it to resolve.\n *\n * `context` is the same shape `onAuth()` receives, read-only here: mutating it\n * does not carry over to `onAuth()`.\n *\n * Not supported by `H3Transport`: WebTransport has no upgrade handshake.\n *\n * @example\n * ```typescript\n * new uWebSocketsTransport({\n *   beforeUpgrade: async (request, context) => {\n *     if (await isBanned(context.ip)) {\n *       return new Response(null, { status: 403 });\n *     }\n *   }\n * });\n * ```\n */\nexport type BeforeUpgradeHandler = (\n  request: Request,\n  context: Readonly<AuthContext>,\n) => Response | void | Promise<Response | void>;\n\n/**\n * Invokes a `beforeUpgrade` handler, resolving with the `Response` to send\n * instead of upgrading, or `undefined` to proceed with the upgrade.\n *\n * Every transport goes through here, so a handler written against one keeps\n * working on the others. Never rejects: uWebSockets.js aborts the process on an\n * upgrade handler that yields without responding, and on the other transports a\n * raw socket left behind leaks a connection.\n *\n * @internal\n */\nexport async function runBeforeUpgrade(\n  handler: BeforeUpgradeHandler,\n  url: string, // path, optionally including the query string\n  context: AuthContext,\n): Promise<Response | undefined> {\n  let request: Request;\n\n  try {\n    const host = context.headers.get('host') || 'localhost';\n    request = new Request(`http://${host}${url}`, { headers: context.headers });\n\n  } catch (e: any) {\n    // a `Host` header that isn't a valid authority fails to parse as a URL\n    debugAndPrintError(e);\n    return new Response(null, { status: 400 });\n  }\n\n  try {\n    // `||`, not `??`: a handler that returns nothing is typed `void`, which `??` doesn't strip\n    return (await handler(request, context)) || undefined;\n\n  } catch (e: any) {\n    debugAndPrintError(e);\n    return new Response(null, { status: 500 });\n  }\n}\n\n/** Headers as the transport has them: uWebSockets.js and Node give a plain record. */\ntype RawHeaders = Headers | Record<string, string | undefined>;\n\nconst readHeader = (headers: RawHeaders, name: string) =>\n  (headers instanceof Headers) ? headers.get(name) : headers[name];\n\n/**\n * Builds the context passed to `beforeUpgrade` and `onAuth`.\n *\n * Every transport goes through here, so the context is identical everywhere,\n * down to how the client address is resolved. `headers` is materialized on\n * first read: a connection nobody inspects pays nothing for the conversion.\n *\n * @internal\n */\nexport function createAuthContext(options: {\n  headers: RawHeaders,\n  token?: string | null,\n  remoteAddress?: string,\n  req?: any,\n}): AuthContext {\n  const source = options.headers;\n  let headers: Headers | undefined;\n\n  return {\n    token: options.token ?? getBearerToken(readHeader(source, 'authorization')),\n    ip: resolveClientIp(source, options.remoteAddress),\n    req: options.req,\n    get headers() {\n      return headers ??= (source instanceof Headers)\n        ? source\n        : new Headers(source as Record<string, string>);\n    },\n  };\n}\n\n/**\n * A single address, resolved the same way on every transport: `x-forwarded-for`\n * carries the whole proxy chain, and only its first entry is the client.\n */\nfunction resolveClientIp(headers: RawHeaders, remoteAddress?: string): string | undefined {\n  // an empty header counts as absent\n  const firstHop = (name: string) => readHeader(headers, name)?.split(',')[0].trim() || undefined;\n\n  return (\n    firstHop('x-real-ip') ??\n    firstHop('x-forwarded-for') ??\n    firstHop('x-client-ip') ??\n    (remoteAddress || undefined)\n  );\n}\n\nexport type AuthContext = {\n  token?: string,\n  /** Undefined when no proxy header carries it and the transport has no peer address. */\n  ip: string | undefined;\n  headers: Headers,\n  /** Only set on the HTTP matchmaking request, where it is the `Request` itself. */\n  req?: any;\n};\n\nexport interface ISendOptions {\n  afterNextPatch?: boolean;\n}\n\nexport const ClientState = {\n  JOINING: 0,\n  JOINED: 1,\n  RECONNECTING: 2,\n  RECONNECTED: 3,\n  LEAVING: 4,\n  CLOSED: 5\n} as const;\nexport type ClientState = (typeof ClientState)[keyof typeof ClientState];\n\n// Helper types to extract properties from the Client type parameter\ntype ExtractClientUserData<T> = T extends { userData: infer U } ? U : T;\ntype ExtractClientAuth<T> = T extends { auth: infer A } ? A : any;\ntype ExtractClientMessages<T> = T extends { messages: infer M } ? M : any;\n\n// Helper type to make message required when the message type demands it\nexport type MessageArgs<M, Options> =\n  unknown extends M ? [message?: M, options?: Options] :  // Handle 'any' type (backwards compatibility)\n  [M] extends [never] ? [message?: M, options?: Options] :\n  [M] extends [void] ? [message?: M, options?: Options] :\n  [M] extends [undefined] ? [message?: M, options?: Options] :\n  undefined extends M ? [message?: M, options?: Options] :\n  [message: M, options?: Options];\n\n/**\n * The client instance from the server-side is responsible for the transport layer between the server and the client.\n * It should not be confused with the Client from the client-side SDK, as they have completely different purposes!\n * You operate on client instances from `this.clients`, `Room#onJoin()`, `Room#onLeave()` and `Room#onMessage()`.\n *\n * - This is the raw WebSocket connection coming from the `ws` package. There are more methods available which aren't\n *  encouraged to use along with Colyseus.\n */\nexport interface Client<T extends { userData?: any, auth?: any, messages?: Record<string | number, any> } = any> {\n  '~messages': ExtractClientMessages<T>;\n\n  ref: EventEmitter;\n\n  /**\n   * Unique id per session.\n   */\n  sessionId: string;\n\n  /**\n   * Connection state\n   */\n  state: ClientState;\n\n  /**\n   * Optional: when using `@view()` decorator in your state properties, this will be the view instance for this client.\n   */\n  view?: StateView;\n\n  /**\n   * User-defined data can be attached to the Client instance through this variable.\n   * - Can be used to store custom data about the client's connection. userData is not synchronized with the client,\n   * and should be used only to keep player-specific with its connection.\n   */\n  userData?: ExtractClientUserData<T>;\n\n  /**\n   * auth data provided by your `onAuth`\n   */\n  auth?: ExtractClientAuth<T>;\n\n  /**\n   * Reconnection token used to re-join the room after onLeave + allowReconnection().\n   *\n   * IMPORTANT:\n   *    This is not the full reconnection token the client provides for the server.\n   *    The format provided by .reconnect() from the client-side must follow: \"${roomId}:${reconnectionToken}\"\n   */\n  reconnectionToken: string;\n\n  // TODO: move these to ClientPrivate\n  raw(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n  enqueueRaw(data: Uint8Array | Buffer, options?: ISendOptions): void;\n\n  /**\n   * Send raw bytes over the transport's UNRELIABLE channel \u2014 no delivery,\n   * ordering, or duplication guarantee. Used for `@unreliable` state patches.\n   *\n   * Absent on transports with no datagram channel (every WebSocket transport).\n   * Its presence IS the capability check \u2014 callers feature-detect rather than\n   * reading a separate flag, and skip clients that can't receive.\n   */\n  rawUnreliable?(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n\n  /**\n   * Send a type of message to the client. Messages are encoded with MsgPack and can hold any\n   * JSON-serializable data structure.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param message Message payload. (automatically encoded with msgpack.)\n   * @param options\n   */\n  send<K extends keyof this['~messages']>(\n    type: K,\n    ...args: MessageArgs<this['~messages'][K], ISendOptions>\n  ): void;\n\n  /**\n   * Send raw bytes to this specific client.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param bytes Raw byte array payload\n   * @param options\n   */\n  sendBytes(type: string | number, bytes: Buffer | Uint8Array, options?: ISendOptions): void;\n\n  /**\n   * Disconnect this client from the room.\n   *\n   * @param code Custom close code. Default value is 1000.\n   * @param data\n   * @see [Leave room](https://docs.colyseus.io/room#leave-room)\n   */\n  leave(code?: number, data?: string): void;\n\n  /**\n   * @deprecated Use .leave() instead.\n   */\n  close(code?: number, data?: string): void;\n\n  /**\n   * Triggers `onError` with specified code to the client-side.\n   *\n   * @param code\n   * @param message\n   */\n  error(code: number, message?: string): void;\n}\n\n/**\n * Private properties of the Client instance.\n * Only accessible internally by the framework, should not be encouraged/auto-completed for the user.\n *\n * TODO: refactor this.\n * @private\n */\nexport interface ClientPrivate {\n  readyState: number; // TODO: remove readyState on version 1.0.0. Use only \"state\" instead.\n  _enqueuedMessages?: any[];\n  _joinedAt: number; // \"elapsedTime\" when the client joined the room.\n\n  /**\n   * Used for rate limiting via maxMessagesPerSecond.\n   */\n  _numMessagesLastSecond?: number;\n  _lastMessageTime?: number;\n\n  /**\n   * Per-client input Schema instance, allocated on join when the Room\n   * declares `input`. Mutated in-place by {@link _inputDecoder} on each\n   * incoming ROOM_INPUT_* packet.\n   *\n   * Typed loosely (`any`) so duplicate `@colyseus/schema` installs don't\n   * trigger type-identity errors against user-defined input classes.\n   */\n  _input?: any;\n  _inputDecoder?: InputDecoder;\n\n  /**\n   * Per-client buffer of cloned input snapshots, allocated on join when\n   * `Room.inputOptions.bufferMaxSize > 0`. Populated on each decoded frame.\n   */\n  _inputBuffer?: import('./input/InputBuffer.ts').InputBufferImpl;\n\n  /**\n   * Cached per-client accessor returned by `room.input(sessionId)`. Built\n   * once at join (when the Room called `defineInput()`), so the public API\n   * call is a Map lookup + property read with no per-call allocation.\n   */\n  _inputAccessor?: import('./input/types.ts').InputAccessor;\n\n  /**\n   * Used for rate limiting ROOM_INPUT_* packets via maxInputsPerSecond,\n   * independent of maxMessagesPerSecond.\n   */\n  _numInputsLastSecond?: number;\n  _lastInputTime?: number;\n\n  /**\n   * `performance.now()` recorded when the most recent ROOM_INPUT_* packet\n   * from this client was received. Receive-side diagnostic only \u2014 NOT on the\n   * wire: the {@link ProtocolModifier.TIMED} state prefix acks the seq of the\n   * last input CONSUMED into the state (the input buffer's `ackSeq`).\n   *\n   * `0` until the client has sent its first input.\n   */\n  _lastInputReceivedAt?: number;\n\n  /**\n   * Monotonic count of *reliable* inputs successfully received from this\n   * client. Receive-time counter \u2014 it LEADS the state by inputs still\n   * buffered; what the TIMED prefix acks is the CONSUMED seq (the input\n   * buffer's `ackSeq`), not this. Stays at the default `0` until the client\n   * sends its first reliable input.\n   *\n   * Only ROOM_INPUT_RELIABLE bumps this \u2014 unreliable's redundant-ring\n   * pattern would double-count.\n   */\n  _receivedInputCount?: number;\n\n  /**\n   * Running baseline for the DELTA-CODED lag-comp stamp on ROOM_INPUT_RELIABLE\n   * frames (the {@link ProtocolModifier.TIMED} prefix). Each frame carries only\n   * the signed change from the previous stamp; this accumulates them back into\n   * the absolute timeline value. Zeroed on (re)connect alongside the SDK's own\n   * baseline so the first delta after a reset is absolute. `0` until allocated.\n   */\n  _reckonBaseline?: number;\n\n  /**\n   * @internal Per-client raw frames staged to ride out right AFTER this client's\n   * next state patch \u2014 per-client `afterNextPatch` messages. Lazily allocated.\n   * Pushed by {@link enqueueClientRaw} (the `afterNextPatch` path), flushed as\n   * standalone frames after the patch by {@link Room._flushPendingClientFrames}.\n   * Room-level `broadcast` `afterNextPatch` uses the Room's own queue instead, not\n   * this buffer.\n   */\n  _pendingFrames?: Uint8Array[];\n\n  /**\n   * @internal Back-reference to the Room's \"clients with staged frames\" list,\n   * shared by reference at join. {@link enqueueClientRaw} pushes the client here\n   * on its first staged frame of a cycle, so the after-patch flush iterates just\n   * those clients rather than scanning every client.\n   */\n  _pendingFrameClients?: Array<Client & ClientPrivate>;\n}\n\n/**\n * The framework-level send path shared by every transport's `enqueueRaw` \u2014 the\n * single source of truth so each transport implements only the wire-level `raw`.\n * Routes a raw frame by where it should go:\n *\n *  - `afterNextPatch` \u2192 stage onto the per-client {@link ClientPrivate._pendingFrames}\n *    buffer, sent as a standalone frame right AFTER the next state patch; a\n *    no-allocation push into a reused array. The client announces itself to the\n *    Room's {@link ClientPrivate._pendingFrameClients} list on its first staged\n *    frame of a cycle.\n *  - before JOIN \u2192 buffer in `_enqueuedMessages` until the JOIN_ROOM handshake flushes.\n *  - otherwise \u2192 send now via the transport's `raw`.\n *\n * @internal\n */\nexport function enqueueClientRaw(\n  client: Client & ClientPrivate,\n  data: Uint8Array | Buffer,\n  options?: ISendOptions,\n): void {\n  if (options?.afterNextPatch) {\n    let frames = client._pendingFrames;\n    if (frames === undefined) { frames = client._pendingFrames = []; }\n    if (frames.length === 0) { client._pendingFrameClients?.push(client); } // first frame this cycle\n    frames.push(data);\n    return;\n  }\n  if (client.state !== ClientState.JOINED) {\n    // During `onJoin` / `onReconnect` the client can't register onMessage\n    // handlers yet \u2014 buffer until JOIN_ROOM has been sent.\n    client._enqueuedMessages?.push(data);\n    return;\n  }\n  client.raw(data, options);\n}\n\nexport class ClientArray<C extends Client = Client> extends Array<C> {\n  /**\n   * Secondary index for O(1) lookup by sessionId. Kept in sync by the\n   * mutating methods overridden below. Direct index assignment\n   * (`arr[i] = client`) and `arr.length = 0` bypass this index \u2014 use\n   * `push` / `splice` / `delete` / `pop` / `shift` / `unshift` instead.\n   */\n  private _byId: Map<string, C> = new Map();\n\n  /** The client for `sessionId`, or `undefined` \u2014 O(1). The canonical per-session\n   *  lookup (mirrors `room.inputs.get(sessionId)`). */\n  public get(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  /** @deprecated Use {@link get}. */\n  public getById(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  public delete(client: C): boolean {\n    const removed = spliceOne(this, this.indexOf(client));\n    if (removed) this._byId.delete(client.sessionId);\n    return removed;\n  }\n\n  public push(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.push(...items);\n  }\n\n  public pop(): C | undefined {\n    const removed = super.pop();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public shift(): C | undefined {\n    const removed = super.shift();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public unshift(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.unshift(...items);\n  }\n\n  public splice(start: number, deleteCount?: number, ...items: C[]): C[] {\n    const removed = (deleteCount === undefined)\n      ? super.splice(start)\n      : super.splice(start, deleteCount, ...items);\n    for (let i = 0; i < removed.length; i++) this._byId.delete(removed[i].sessionId);\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return removed;\n  }\n}\n\n/**\n * Shared internal method to connect a Client into a Room.\n * Validates seat reservation and joins the client to the room.\n *\n * @remarks\n * **\u26A0\uFE0F This is an internal API and not intended for end-user use.**\n *\n * @internal\n */\nexport async function connectClientToRoom(\n  room: Room | undefined,\n  client: Client & ClientPrivate,\n  authContext: AuthContext,\n  connectionOptions: {\n    reconnectionToken?: string;\n    skipHandshake?: boolean;\n  },\n): Promise<void> {\n  if (!room || !room.hasReservedSeat(client.sessionId, connectionOptions.reconnectionToken)) {\n    throw new ServerError(ErrorCode.MATCHMAKE_EXPIRED, 'seat reservation expired.');\n  }\n\n  await room['_onJoin'](client, authContext, connectionOptions);\n}"],
-  "mappings": ";AAAA,OAAsB;AACtB,OAAuB;AAIvB,SAAS,iBAAiB;AAC1B,OAA0B;AAG1B,OAA6B;AAC7B,SAAS,0BAA0B;AACnC,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,mBAAmB;AAI5B,IAAI;AACG,SAAS,aAAa,WAAsB;AAAE,eAAa;AAAW;AACtE,SAAS,eAAe;AAAE,SAAO;AAAY;AAE7C,IAAe,YAAf,MAAyB;AA2BhC;AAyCA,eAAsB,iBACpB,SACA,KACA,SAC+B;AAC/B,MAAI;AAEJ,MAAI;AACF,UAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,KAAK;AAC5C,cAAU,IAAI,QAAQ,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAAA,EAE5E,SAAS,GAAQ;AAEf,uBAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AAEA,MAAI;AAEF,WAAQ,MAAM,QAAQ,SAAS,OAAO,KAAM;AAAA,EAE9C,SAAS,GAAQ;AACf,uBAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACF;AAKA,IAAM,aAAa,CAAC,SAAqB,SACtC,mBAAmB,UAAW,QAAQ,IAAI,IAAI,IAAI,QAAQ,IAAI;AAW1D,SAAS,kBAAkB,SAKlB;AACd,QAAM,SAAS,QAAQ;AACvB,MAAI;AAEJ,SAAO;AAAA,IACL,OAAO,QAAQ,SAAS,eAAe,WAAW,QAAQ,eAAe,CAAC;AAAA,IAC1E,IAAI,gBAAgB,QAAQ,QAAQ,aAAa;AAAA,IACjD,KAAK,QAAQ;AAAA,IACb,IAAI,UAAU;AACZ,aAAO,YAAa,kBAAkB,UAClC,SACA,IAAI,QAAQ,MAAgC;AAAA,IAClD;AAAA,EACF;AACF;AAMA,SAAS,gBAAgB,SAAqB,eAA4C;AAExF,QAAM,WAAW,CAAC,SAAiB,WAAW,SAAS,IAAI,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK;AAEtF,SACE,SAAS,WAAW,KACpB,SAAS,iBAAiB,KAC1B,SAAS,aAAa,MACrB,iBAAiB;AAEtB;AAeO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AACV;AA+OO,SAAS,iBACd,QACA,MACA,SACM;AACN,MAAI,SAAS,gBAAgB;AAC3B,QAAI,SAAS,OAAO;AACpB,QAAI,WAAW,QAAW;AAAE,eAAS,OAAO,iBAAiB,CAAC;AAAA,IAAG;AACjE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,sBAAsB,KAAK,MAAM;AAAA,IAAG;AACtE,WAAO,KAAK,IAAI;AAChB;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ;AAGvC,WAAO,mBAAmB,KAAK,IAAI;AACnC;AAAA,EACF;AACA,SAAO,IAAI,MAAM,OAAO;AAC1B;AAEO,IAAM,cAAN,cAAqD,MAAS;AAAA,EAA9D;AAAA;AAOL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,QAAwB,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA,EAIjC,IAAI,WAAkC;AAC3C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA;AAAA,EAGO,QAAQ,WAAkC;AAC/C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA,EAEO,OAAO,QAAoB;AAChC,UAAM,UAAU,UAAU,MAAM,KAAK,QAAQ,MAAM,CAAC;AACpD,QAAI,QAAS,MAAK,MAAM,OAAO,OAAO,SAAS;AAC/C,WAAO;AAAA,EACT;AAAA,EAEO,QAAQ,OAAoB;AACjC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,KAAK,GAAG,KAAK;AAAA,EAC5B;AAAA,EAEO,MAAqB;AAC1B,UAAM,UAAU,MAAM,IAAI;AAC1B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,QAAuB;AAC5B,UAAM,UAAU,MAAM,MAAM;AAC5B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,WAAW,OAAoB;AACpC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,QAAQ,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEO,OAAO,OAAe,gBAAyB,OAAiB;AACrE,UAAM,UAAW,gBAAgB,SAC7B,MAAM,OAAO,KAAK,IAClB,MAAM,OAAO,OAAO,aAAa,GAAG,KAAK;AAC7C,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,IAAK,MAAK,MAAM,OAAO,QAAQ,CAAC,EAAE,SAAS;AAC/E,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,oBACpB,MACA,QACA,aACA,mBAIe;AACf,MAAI,CAAC,QAAQ,CAAC,KAAK,gBAAgB,OAAO,WAAW,kBAAkB,iBAAiB,GAAG;AACzF,UAAM,IAAI,YAAY,UAAU,mBAAmB,2BAA2B;AAAA,EAChF;AAEA,QAAM,KAAK,SAAS,EAAE,QAAQ,aAAa,iBAAiB;AAC9D;",
+  "sourcesContent": ["import * as http from 'http';\nimport * as https from 'https';\n\nimport type { Router } from '@colyseus/better-call';\n\nimport { ErrorCode } from '@colyseus/shared-types';\nimport { StateView } from '@colyseus/schema';\nimport type { InputDecoder } from '@colyseus/schema/input';\n\nimport { EventEmitter } from 'events';\nimport { debugAndPrintError } from './Debug.ts';\nimport { getBearerToken, spliceOne } from './utils/Utils.ts';\nimport { ServerError } from './errors/ServerError.ts';\n\nimport type { Room } from './Room.ts';\n\nlet _transport: Transport | undefined;\nexport function setTransport(transport: Transport) { _transport = transport; }\nexport function getTransport() { return _transport; }\n\nexport abstract class Transport {\n    public protocol?: string;\n    /** Self-signed cert SHA-256 hash (byte array), surfaced to clients in the\n     *  matchmake response so a WebTransport client can pin it via\n     *  `serverCertificateHashes`. Set by transports that generate their own cert\n     *  (h3). Undefined for transports using a CA-trusted cert. */\n    public fingerprint?: number[];\n    public server?: http.Server | https.Server;\n\n    public abstract listen(port?: number | string, hostname?: string, backlog?: number, listeningListener?: Function): this;\n    public abstract shutdown(): void;\n\n    public abstract simulateLatency(milliseconds: number): void;\n\n    /**\n     * Returns an Express-compatible application for HTTP route handling.\n     * For uWebSockets transport, this uses the uwebsockets-express module.\n     * This method is called lazily only when an express callback is provided in server options.\n     */\n    public getExpressApp?(): Promise<import('express').Application> | import('express').Application | undefined;\n\n    /**\n     * Binds a router to the transport.\n     * Some transports may have a custom way to bind a router to the transport.\n     * (uWebSocketsTransport)\n     */\n    public bindRouter?(router: Router): void;\n}\n\n/**\n * Intercepts an incoming WebSocket upgrade request, before the handshake.\n *\n * Return a `Response` to answer the request instead of upgrading it. Return\n * nothing to upgrade as usual. The handler may be async, and the handshake waits\n * for it to resolve.\n *\n * `context` is the same shape `onAuth()` receives, read-only here: mutating it\n * does not carry over to `onAuth()`.\n *\n * Not supported by `H3Transport`: WebTransport has no upgrade handshake.\n *\n * @example\n * ```typescript\n * new uWebSocketsTransport({\n *   beforeUpgrade: async (request, context) => {\n *     if (await isBanned(context.ip)) {\n *       return new Response(null, { status: 403 });\n *     }\n *   }\n * });\n * ```\n */\nexport type BeforeUpgradeHandler = (\n  request: Request,\n  context: Readonly<AuthContext>,\n) => Response | void | Promise<Response | void>;\n\n/**\n * Invokes a `beforeUpgrade` handler, resolving with the `Response` to send\n * instead of upgrading, or `undefined` to proceed with the upgrade.\n *\n * Every transport goes through here, so a handler written against one keeps\n * working on the others. Never rejects: uWebSockets.js aborts the process on an\n * upgrade handler that yields without responding, and on the other transports a\n * raw socket left behind leaks a connection.\n *\n * @internal\n */\nexport async function runBeforeUpgrade(\n  handler: BeforeUpgradeHandler,\n  url: string, // path, optionally including the query string\n  context: AuthContext,\n): Promise<Response | undefined> {\n  let request: Request;\n\n  try {\n    const host = context.headers.get('host') || 'localhost';\n    request = new Request(`http://${host}${url}`, { headers: context.headers });\n\n  } catch (e: any) {\n    // a `Host` header that isn't a valid authority fails to parse as a URL\n    debugAndPrintError(e);\n    return new Response(null, { status: 400 });\n  }\n\n  try {\n    // `||`, not `??`: a handler that returns nothing is typed `void`, which `??` doesn't strip\n    return (await handler(request, context)) || undefined;\n\n  } catch (e: any) {\n    debugAndPrintError(e);\n    return new Response(null, { status: 500 });\n  }\n}\n\n/** Headers as the transport has them: uWebSockets.js and Node give a plain record. */\ntype RawHeaders = Headers | Record<string, string | undefined>;\n\nconst readHeader = (headers: RawHeaders, name: string) =>\n  (headers instanceof Headers) ? headers.get(name) : headers[name];\n\n/**\n * Builds the context passed to `beforeUpgrade` and `onAuth`.\n *\n * Every transport goes through here, so the context is identical everywhere,\n * down to how the client address is resolved. `headers` is materialized on\n * first read: a connection nobody inspects pays nothing for the conversion.\n *\n * @internal\n */\nexport function createAuthContext(options: {\n  headers: RawHeaders,\n  token?: string | null,\n  remoteAddress?: string,\n  req?: any,\n}): AuthContext {\n  const source = options.headers;\n  let headers: Headers | undefined;\n\n  return {\n    token: options.token ?? getBearerToken(readHeader(source, 'authorization')),\n    ip: resolveClientIp(source, options.remoteAddress),\n    req: options.req,\n    get headers() {\n      return headers ??= (source instanceof Headers)\n        ? source\n        : new Headers(source as Record<string, string>);\n    },\n  };\n}\n\n/**\n * A single address, resolved the same way on every transport: `x-forwarded-for`\n * carries the whole proxy chain, and only its first entry is the client.\n */\nfunction resolveClientIp(headers: RawHeaders, remoteAddress?: string): string | undefined {\n  // an empty header counts as absent\n  const firstHop = (name: string) => readHeader(headers, name)?.split(',')[0].trim() || undefined;\n\n  return (\n    firstHop('x-real-ip') ??\n    firstHop('x-forwarded-for') ??\n    firstHop('x-client-ip') ??\n    (remoteAddress || undefined)\n  );\n}\n\nexport type AuthContext = {\n  token?: string,\n  /** Undefined when no proxy header carries it and the transport has no peer address. */\n  ip: string | undefined;\n  headers: Headers,\n  /** Only set on the HTTP matchmaking request, where it is the `Request` itself. */\n  req?: any;\n};\n\nexport interface ISendOptions {\n  afterNextPatch?: boolean;\n}\n\nexport const ClientState = {\n  JOINING: 0,\n  JOINED: 1,\n  RECONNECTING: 2,\n  RECONNECTED: 3,\n  LEAVING: 4,\n  CLOSED: 5\n} as const;\nexport type ClientState = (typeof ClientState)[keyof typeof ClientState];\n\n// Helper types to extract properties from the Client type parameter\ntype ExtractClientUserData<T> = T extends { userData: infer U } ? U : T;\ntype ExtractClientAuth<T> = T extends { auth: infer A } ? A : any;\ntype ExtractClientMessages<T> = T extends { messages: infer M } ? M : any;\n\n// Helper type to make message required when the message type demands it\nexport type MessageArgs<M, Options> =\n  unknown extends M ? [message?: M, options?: Options] :  // Handle 'any' type (backwards compatibility)\n  [M] extends [never] ? [message?: M, options?: Options] :\n  [M] extends [void] ? [message?: M, options?: Options] :\n  [M] extends [undefined] ? [message?: M, options?: Options] :\n  undefined extends M ? [message?: M, options?: Options] :\n  [message: M, options?: Options];\n\n/**\n * The client instance from the server-side is responsible for the transport layer between the server and the client.\n * It should not be confused with the Client from the client-side SDK, as they have completely different purposes!\n * You operate on client instances from `this.clients`, `Room#onJoin()`, `Room#onLeave()` and `Room#onMessage()`.\n *\n * - This is the raw WebSocket connection coming from the `ws` package. There are more methods available which aren't\n *  encouraged to use along with Colyseus.\n */\nexport interface Client<T extends { userData?: any, auth?: any, messages?: Record<string | number, any> } = any> {\n  '~messages': ExtractClientMessages<T>;\n\n  ref: EventEmitter;\n\n  /**\n   * Unique id per session.\n   */\n  sessionId: string;\n\n  /**\n   * Connection state\n   */\n  state: ClientState;\n\n  /**\n   * Optional: when using `@view()` decorator in your state properties, this will be the view instance for this client.\n   */\n  view?: StateView;\n\n  /**\n   * User-defined data can be attached to the Client instance through this variable.\n   * - Can be used to store custom data about the client's connection. userData is not synchronized with the client,\n   * and should be used only to keep player-specific with its connection.\n   */\n  userData?: ExtractClientUserData<T>;\n\n  /**\n   * auth data provided by your `onAuth`\n   */\n  auth?: ExtractClientAuth<T>;\n\n  /**\n   * Reconnection token used to re-join the room after onLeave + allowReconnection().\n   *\n   * IMPORTANT:\n   *    This is not the full reconnection token the client provides for the server.\n   *    The format provided by .reconnect() from the client-side must follow: \"${roomId}:${reconnectionToken}\"\n   */\n  reconnectionToken: string;\n\n  // TODO: move these to ClientPrivate\n  raw(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n  enqueueRaw(data: Uint8Array | Buffer, options?: ISendOptions): void;\n\n  /**\n   * Send raw bytes over the transport's UNRELIABLE channel \u2014 no delivery,\n   * ordering, or duplication guarantee. Used for `@unreliable` state patches.\n   *\n   * Absent on transports with no datagram channel (every WebSocket transport).\n   * Its presence IS the capability check \u2014 callers feature-detect rather than\n   * reading a separate flag, and skip clients that can't receive.\n   */\n  rawUnreliable?(data: Uint8Array | Buffer, options?: ISendOptions, cb?: (err?: Error) => void): void;\n\n  /**\n   * Send a type of message to the client. Messages are encoded with MsgPack and can hold any\n   * JSON-serializable data structure.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param message Message payload. (automatically encoded with msgpack.)\n   * @param options\n   */\n  send<K extends keyof this['~messages']>(\n    type: K,\n    ...args: MessageArgs<this['~messages'][K], ISendOptions>\n  ): void;\n\n  /**\n   * Send raw bytes to this specific client.\n   *\n   * @param type String or Number identifier the client SDK will use to receive this message\n   * @param bytes Raw byte array payload\n   * @param options\n   */\n  sendBytes(type: string | number, bytes: Buffer | Uint8Array, options?: ISendOptions): void;\n\n  /**\n   * Disconnect this client from the room.\n   *\n   * @param code Custom close code. Default value is 1000.\n   * @param data\n   * @see [Leave room](https://docs.colyseus.io/room#leave-room)\n   */\n  leave(code?: number, data?: string): void;\n\n  /**\n   * @deprecated Use .leave() instead.\n   */\n  close(code?: number, data?: string): void;\n\n  /**\n   * Triggers `onError` with specified code to the client-side.\n   *\n   * @param code\n   * @param message\n   */\n  error(code: number, message?: string): void;\n}\n\n/**\n * Private properties of the Client instance.\n * Only accessible internally by the framework, should not be encouraged/auto-completed for the user.\n *\n * TODO: refactor this.\n * @private\n */\nexport interface ClientPrivate {\n  readyState: number; // TODO: remove readyState on version 1.0.0. Use only \"state\" instead.\n  _enqueuedMessages?: any[];\n  _joinedAt: number; // \"elapsedTime\" when the client joined the room.\n\n  /**\n   * Rate limiting via maxMessagesPerSecond: frames seen so far, and the\n   * moment the count goes back to zero.\n   */\n  _numMessagesLastSecond?: number;\n  _messageCountResetsAt?: number;\n\n  /**\n   * Time of the most recent inbound frame. Moves on every frame \u2014 this is\n   * the one to read for \"how long has this client been quiet?\" (see\n   * IdleKickPlugin). The rate-limit counter above only resets once a second.\n   */\n  _lastMessageTime?: number;\n\n  /**\n   * Per-client input Schema instance, allocated on join when the Room\n   * declares `input`. Mutated in-place by {@link _inputDecoder} on each\n   * incoming ROOM_INPUT_* packet.\n   *\n   * Typed loosely (`any`) so duplicate `@colyseus/schema` installs don't\n   * trigger type-identity errors against user-defined input classes.\n   */\n  _input?: any;\n  _inputDecoder?: InputDecoder;\n\n  /**\n   * Per-client buffer of cloned input snapshots, allocated on join when\n   * `Room.inputOptions.bufferMaxSize > 0`. Populated on each decoded frame.\n   */\n  _inputBuffer?: import('./input/InputBuffer.ts').InputBufferImpl;\n\n  /**\n   * Cached per-client accessor returned by `room.input(sessionId)`. Built\n   * once at join (when the Room called `defineInput()`), so the public API\n   * call is a Map lookup + property read with no per-call allocation.\n   */\n  _inputAccessor?: import('./input/types.ts').InputAccessor;\n\n  /**\n   * Used for rate limiting ROOM_INPUT_* packets via maxInputsPerSecond,\n   * independent of maxMessagesPerSecond.\n   */\n  _numInputsLastSecond?: number;\n  _lastInputTime?: number;\n\n  /**\n   * `performance.now()` recorded when the most recent ROOM_INPUT_* packet\n   * from this client was received. Receive-side diagnostic only \u2014 NOT on the\n   * wire: the {@link ProtocolModifier.TIMED} state prefix acks the seq of the\n   * last input CONSUMED into the state (the input buffer's `ackSeq`).\n   *\n   * `0` until the client has sent its first input.\n   */\n  _lastInputReceivedAt?: number;\n\n  /**\n   * Monotonic count of *reliable* inputs successfully received from this\n   * client. Receive-time counter \u2014 it LEADS the state by inputs still\n   * buffered; what the TIMED prefix acks is the CONSUMED seq (the input\n   * buffer's `ackSeq`), not this. Stays at the default `0` until the client\n   * sends its first reliable input.\n   *\n   * Only ROOM_INPUT_RELIABLE bumps this \u2014 unreliable's redundant-ring\n   * pattern would double-count.\n   */\n  _receivedInputCount?: number;\n\n  /**\n   * Running baseline for the DELTA-CODED lag-comp stamp on ROOM_INPUT_RELIABLE\n   * frames (the {@link ProtocolModifier.TIMED} prefix). Each frame carries only\n   * the signed change from the previous stamp; this accumulates them back into\n   * the absolute timeline value. Zeroed on (re)connect alongside the SDK's own\n   * baseline so the first delta after a reset is absolute. `0` until allocated.\n   */\n  _reckonBaseline?: number;\n\n  /**\n   * @internal Per-client raw frames staged to ride out right AFTER this client's\n   * next state patch \u2014 per-client `afterNextPatch` messages. Lazily allocated.\n   * Pushed by {@link enqueueClientRaw} (the `afterNextPatch` path), flushed as\n   * standalone frames after the patch by {@link Room._flushPendingClientFrames}.\n   * Room-level `broadcast` `afterNextPatch` uses the Room's own queue instead, not\n   * this buffer.\n   */\n  _pendingFrames?: Uint8Array[];\n\n  /**\n   * @internal Back-reference to the Room's \"clients with staged frames\" list,\n   * shared by reference at join. {@link enqueueClientRaw} pushes the client here\n   * on its first staged frame of a cycle, so the after-patch flush iterates just\n   * those clients rather than scanning every client.\n   */\n  _pendingFrameClients?: Array<Client & ClientPrivate>;\n}\n\n/**\n * The framework-level send path shared by every transport's `enqueueRaw` \u2014 the\n * single source of truth so each transport implements only the wire-level `raw`.\n * Routes a raw frame by where it should go:\n *\n *  - `afterNextPatch` \u2192 stage onto the per-client {@link ClientPrivate._pendingFrames}\n *    buffer, sent as a standalone frame right AFTER the next state patch; a\n *    no-allocation push into a reused array. The client announces itself to the\n *    Room's {@link ClientPrivate._pendingFrameClients} list on its first staged\n *    frame of a cycle.\n *  - before JOIN \u2192 buffer in `_enqueuedMessages` until the JOIN_ROOM handshake flushes.\n *  - otherwise \u2192 send now via the transport's `raw`.\n *\n * @internal\n */\nexport function enqueueClientRaw(\n  client: Client & ClientPrivate,\n  data: Uint8Array | Buffer,\n  options?: ISendOptions,\n): void {\n  if (options?.afterNextPatch) {\n    let frames = client._pendingFrames;\n    if (frames === undefined) { frames = client._pendingFrames = []; }\n    if (frames.length === 0) { client._pendingFrameClients?.push(client); } // first frame this cycle\n    frames.push(data);\n    return;\n  }\n  if (client.state !== ClientState.JOINED) {\n    // During `onJoin` / `onReconnect` the client can't register onMessage\n    // handlers yet \u2014 buffer until JOIN_ROOM has been sent.\n    client._enqueuedMessages?.push(data);\n    return;\n  }\n  client.raw(data, options);\n}\n\nexport class ClientArray<C extends Client = Client> extends Array<C> {\n  /**\n   * Secondary index for O(1) lookup by sessionId. Kept in sync by the\n   * mutating methods overridden below. Direct index assignment\n   * (`arr[i] = client`) and `arr.length = 0` bypass this index \u2014 use\n   * `push` / `splice` / `delete` / `pop` / `shift` / `unshift` instead.\n   */\n  private _byId: Map<string, C> = new Map();\n\n  /** The client for `sessionId`, or `undefined` \u2014 O(1). The canonical per-session\n   *  lookup (mirrors `room.inputs.get(sessionId)`). */\n  public get(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  /** @deprecated Use {@link get}. */\n  public getById(sessionId: string): C | undefined {\n    return this._byId.get(sessionId);\n  }\n\n  public delete(client: C): boolean {\n    const removed = spliceOne(this, this.indexOf(client));\n    if (removed) this._byId.delete(client.sessionId);\n    return removed;\n  }\n\n  public push(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.push(...items);\n  }\n\n  public pop(): C | undefined {\n    const removed = super.pop();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public shift(): C | undefined {\n    const removed = super.shift();\n    if (removed !== undefined) this._byId.delete(removed.sessionId);\n    return removed;\n  }\n\n  public unshift(...items: C[]): number {\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return super.unshift(...items);\n  }\n\n  public splice(start: number, deleteCount?: number, ...items: C[]): C[] {\n    const removed = (deleteCount === undefined)\n      ? super.splice(start)\n      : super.splice(start, deleteCount, ...items);\n    for (let i = 0; i < removed.length; i++) this._byId.delete(removed[i].sessionId);\n    for (let i = 0; i < items.length; i++) this._byId.set(items[i].sessionId, items[i]);\n    return removed;\n  }\n}\n\n/**\n * Shared internal method to connect a Client into a Room.\n * Validates seat reservation and joins the client to the room.\n *\n * @remarks\n * **\u26A0\uFE0F This is an internal API and not intended for end-user use.**\n *\n * @internal\n */\nexport async function connectClientToRoom(\n  room: Room | undefined,\n  client: Client & ClientPrivate,\n  authContext: AuthContext,\n  connectionOptions: {\n    reconnectionToken?: string;\n    skipHandshake?: boolean;\n  },\n): Promise<void> {\n  if (!room || !room.hasReservedSeat(client.sessionId, connectionOptions.reconnectionToken)) {\n    throw new ServerError(ErrorCode.MATCHMAKE_EXPIRED, 'seat reservation expired.');\n  }\n\n  await room['_onJoin'](client, authContext, connectionOptions);\n}"],
+  "mappings": ";AAAA,OAAsB;AACtB,OAAuB;AAIvB,SAAS,iBAAiB;AAC1B,OAA0B;AAG1B,OAA6B;AAC7B,SAAS,0BAA0B;AACnC,SAAS,gBAAgB,iBAAiB;AAC1C,SAAS,mBAAmB;AAI5B,IAAI;AACG,SAAS,aAAa,WAAsB;AAAE,eAAa;AAAW;AACtE,SAAS,eAAe;AAAE,SAAO;AAAY;AAE7C,IAAe,YAAf,MAAyB;AA2BhC;AAyCA,eAAsB,iBACpB,SACA,KACA,SAC+B;AAC/B,MAAI;AAEJ,MAAI;AACF,UAAM,OAAO,QAAQ,QAAQ,IAAI,MAAM,KAAK;AAC5C,cAAU,IAAI,QAAQ,UAAU,IAAI,GAAG,GAAG,IAAI,EAAE,SAAS,QAAQ,QAAQ,CAAC;AAAA,EAE5E,SAAS,GAAQ;AAEf,uBAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AAEA,MAAI;AAEF,WAAQ,MAAM,QAAQ,SAAS,OAAO,KAAM;AAAA,EAE9C,SAAS,GAAQ;AACf,uBAAmB,CAAC;AACpB,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C;AACF;AAKA,IAAM,aAAa,CAAC,SAAqB,SACtC,mBAAmB,UAAW,QAAQ,IAAI,IAAI,IAAI,QAAQ,IAAI;AAW1D,SAAS,kBAAkB,SAKlB;AACd,QAAM,SAAS,QAAQ;AACvB,MAAI;AAEJ,SAAO;AAAA,IACL,OAAO,QAAQ,SAAS,eAAe,WAAW,QAAQ,eAAe,CAAC;AAAA,IAC1E,IAAI,gBAAgB,QAAQ,QAAQ,aAAa;AAAA,IACjD,KAAK,QAAQ;AAAA,IACb,IAAI,UAAU;AACZ,aAAO,YAAa,kBAAkB,UAClC,SACA,IAAI,QAAQ,MAAgC;AAAA,IAClD;AAAA,EACF;AACF;AAMA,SAAS,gBAAgB,SAAqB,eAA4C;AAExF,QAAM,WAAW,CAAC,SAAiB,WAAW,SAAS,IAAI,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,KAAK;AAEtF,SACE,SAAS,WAAW,KACpB,SAAS,iBAAiB,KAC1B,SAAS,aAAa,MACrB,iBAAiB;AAEtB;AAeO,IAAM,cAAc;AAAA,EACzB,SAAS;AAAA,EACT,QAAQ;AAAA,EACR,cAAc;AAAA,EACd,aAAa;AAAA,EACb,SAAS;AAAA,EACT,QAAQ;AACV;AAuPO,SAAS,iBACd,QACA,MACA,SACM;AACN,MAAI,SAAS,gBAAgB;AAC3B,QAAI,SAAS,OAAO;AACpB,QAAI,WAAW,QAAW;AAAE,eAAS,OAAO,iBAAiB,CAAC;AAAA,IAAG;AACjE,QAAI,OAAO,WAAW,GAAG;AAAE,aAAO,sBAAsB,KAAK,MAAM;AAAA,IAAG;AACtE,WAAO,KAAK,IAAI;AAChB;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,QAAQ;AAGvC,WAAO,mBAAmB,KAAK,IAAI;AACnC;AAAA,EACF;AACA,SAAO,IAAI,MAAM,OAAO;AAC1B;AAEO,IAAM,cAAN,cAAqD,MAAS;AAAA,EAA9D;AAAA;AAOL;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,SAAQ,QAAwB,oBAAI,IAAI;AAAA;AAAA;AAAA;AAAA,EAIjC,IAAI,WAAkC;AAC3C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA;AAAA,EAGO,QAAQ,WAAkC;AAC/C,WAAO,KAAK,MAAM,IAAI,SAAS;AAAA,EACjC;AAAA,EAEO,OAAO,QAAoB;AAChC,UAAM,UAAU,UAAU,MAAM,KAAK,QAAQ,MAAM,CAAC;AACpD,QAAI,QAAS,MAAK,MAAM,OAAO,OAAO,SAAS;AAC/C,WAAO;AAAA,EACT;AAAA,EAEO,QAAQ,OAAoB;AACjC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,KAAK,GAAG,KAAK;AAAA,EAC5B;AAAA,EAEO,MAAqB;AAC1B,UAAM,UAAU,MAAM,IAAI;AAC1B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,QAAuB;AAC5B,UAAM,UAAU,MAAM,MAAM;AAC5B,QAAI,YAAY,OAAW,MAAK,MAAM,OAAO,QAAQ,SAAS;AAC9D,WAAO;AAAA,EACT;AAAA,EAEO,WAAW,OAAoB;AACpC,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO,MAAM,QAAQ,GAAG,KAAK;AAAA,EAC/B;AAAA,EAEO,OAAO,OAAe,gBAAyB,OAAiB;AACrE,UAAM,UAAW,gBAAgB,SAC7B,MAAM,OAAO,KAAK,IAClB,MAAM,OAAO,OAAO,aAAa,GAAG,KAAK;AAC7C,aAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,IAAK,MAAK,MAAM,OAAO,QAAQ,CAAC,EAAE,SAAS;AAC/E,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,IAAK,MAAK,MAAM,IAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,CAAC;AAClF,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,oBACpB,MACA,QACA,aACA,mBAIe;AACf,MAAI,CAAC,QAAQ,CAAC,KAAK,gBAAgB,OAAO,WAAW,kBAAkB,iBAAiB,GAAG;AACzF,UAAM,IAAI,YAAY,UAAU,mBAAmB,2BAA2B;AAAA,EAChF;AAEA,QAAM,KAAK,SAAS,EAAE,QAAQ,aAAa,iBAAiB;AAC9D;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@colyseus/core",
-  "version": "0.18.14",
+  "version": "0.18.15",
   "description": "Multiplayer Framework for Node.js.",
   "type": "module",
   "input": "./src/index.ts",
@@ -52,8 +52,8 @@
     "msgpackr": "^2.0.1",
     "nanoid": "^3.3.11",
     "@colyseus/better-call": "^1.3.1",
-    "@colyseus/shared-types": "^0.18.2",
-    "@colyseus/greeting-banner": "^4.0.2"
+    "@colyseus/greeting-banner": "^4.0.2",
+    "@colyseus/shared-types": "^0.18.2"
   },
   "devDependencies": {
     "@colyseus/schema": "^5.0.8",
@@ -68,8 +68,8 @@
     "@pm2/io": "^6.1.0",
     "express": "^4.16.0 || ^5.0.0",
     "zod": "^4.1.12",
-    "@colyseus/better-call": "^1.3.1",
     "@colyseus/auth": "^0.18.2",
+    "@colyseus/better-call": "^1.3.1",
     "@colyseus/ws-transport": "^0.18.2"
   },
   "peerDependenciesMeta": {

package/src/Room.ts

@@ -2236,10 +2236,13 @@ export class Room<T extends RoomOptions = RoomOptions> {
       return;
     }
 
+    const now = this.clock.currentTime;
+    client._lastMessageTime = now;
+
     // reset message count every second
-    if (this.clock.currentTime - (client._lastMessageTime ?? 0) >= 1000) {
+    if (now >= (client._messageCountResetsAt ?? 0)) {
       client._numMessagesLastSecond = 0;
-      client._lastMessageTime = this.clock.currentTime;
+      client._messageCountResetsAt = now + 1000;
     } else if ((client._numMessagesLastSecond = (client._numMessagesLastSecond ?? 0) + 1) > this.maxMessagesPerSecond) {
       // drop client if it sends more messages than the maximum allowed per second
       debugMatchMaking('dropping client - sessionId: \'%s\' (roomId: %s), too many messages per second', client.sessionId, this.roomId);

package/src/Transport.ts

@@ -323,9 +323,17 @@ export interface ClientPrivate {
   _joinedAt: number; // "elapsedTime" when the client joined the room.
 
   /**
-   * Used for rate limiting via maxMessagesPerSecond.
+   * Rate limiting via maxMessagesPerSecond: frames seen so far, and the
+   * moment the count goes back to zero.
    */
   _numMessagesLastSecond?: number;
+  _messageCountResetsAt?: number;
+
+  /**
+   * Time of the most recent inbound frame. Moves on every frame — this is
+   * the one to read for "how long has this client been quiet?" (see
+   * IdleKickPlugin). The rate-limit counter above only resets once a second.
+   */
   _lastMessageTime?: number;
 
   /**