@colyseus/core 0.18.3 → 0.18.5

package/build/router/default_routes.cjs

@@ -1,3 +1,4 @@
+const __cjsImportMetaUrl = require('node:url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -35,8 +36,8 @@ __export(default_routes_exports, {
 });
 module.exports = __toCommonJS(default_routes_exports);
 var import_better_call = require("@colyseus/better-call");
+var import_index = require("./index.cjs");
 var matchMaker = __toESM(require("../MatchMaker.cjs"), 1);
-var import_Utils = require("../utils/Utils.cjs");
 var import_Transport = require("../Transport.cjs");
 var postMatchmakeMethod = (0, import_better_call.createEndpoint)("/matchmake/:method/:roomName", { method: "POST" }, async (ctx) => {
   if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {
@@ -51,12 +52,7 @@ var postMatchmakeMethod = (0, import_better_call.createEndpoint)("/matchmake/:me
       method,
       roomName,
       clientOptions,
-      {
-        token: (0, import_Utils.getBearerToken)(ctx.request.headers.get("authorization")),
-        headers: ctx.request.headers,
-        ip: requestHeaders.get("x-forwarded-for") ?? requestHeaders.get("x-client-ip") ?? requestHeaders.get("x-real-ip"),
-        req: ctx.request
-      }
+      (0, import_Transport.createAuthContext)({ headers: requestHeaders, req: ctx.request })
     );
     const transport = (0, import_Transport.getTransport)();
     if (transport.protocol !== void 0) {
@@ -81,7 +77,7 @@ var postMatchmakeMethod = (0, import_better_call.createEndpoint)("/matchmake/:me
   }
 });
 function getDefaultRouter() {
-  return (0, import_better_call.createRouter)({ postMatchmakeMethod }, { openapi: { disabled: true } });
+  return (0, import_index.createRouter)({ postMatchmakeMethod }, { openapi: { disabled: true } });
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/build/router/default_routes.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/default_routes.ts"],
-  "sourcesContent": ["import { createEndpoint, createRouter } from \"@colyseus/better-call\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { getBearerToken } from \"../utils/Utils.ts\";\nimport { getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      {\n        token: getBearerToken(ctx.request.headers.get('authorization')),\n        headers: ctx.request.headers,\n        ip: requestHeaders.get('x-forwarded-for') ?? requestHeaders.get('x-client-ip') ?? requestHeaders.get('x-real-ip'),\n        req: ctx.request as any,\n      },\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n    // WebTransport (h3): client pins the self-signed cert via serverCertificateHashes.\n    if (transport.fingerprint !== undefined) {\n      response.fingerprint = transport.fingerprint;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  // no public docs page \u2014 the docs surface is playground's gated /__apidocs\n  return createRouter({ postMatchmakeMethod }, { openapi: { disabled: true } });\n}"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA6C;AAC7C,iBAA4B;AAC5B,mBAA+B;AAC/B,uBAA6B;AAEtB,IAAM,0BAAsB,mCAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAO,6BAAe,IAAI,QAAQ,QAAQ,IAAI,eAAe,CAAC;AAAA,QAC9D,SAAS,IAAI,QAAQ;AAAA,QACrB,IAAI,eAAe,IAAI,iBAAiB,KAAK,eAAe,IAAI,aAAa,KAAK,eAAe,IAAI,WAAW;AAAA,QAChH,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAMA,UAAM,gBAAY,+BAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,QAAI,UAAU,gBAAgB,QAAW;AACvC,eAAS,cAAc,UAAU;AAAA,IACnC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AAEjC,aAAO,iCAAa,EAAE,oBAAoB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC9E;",
+  "sourcesContent": ["import { createEndpoint } from \"@colyseus/better-call\";\nimport { createRouter } from \"./index.ts\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { createAuthContext, getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      createAuthContext({ headers: requestHeaders, req: ctx.request }),\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n    // WebTransport (h3): client pins the self-signed cert via serverCertificateHashes.\n    if (transport.fingerprint !== undefined) {\n      response.fingerprint = transport.fingerprint;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  // no public docs page \u2014 the docs surface is playground's gated /__apidocs\n  return createRouter({ postMatchmakeMethod }, { openapi: { disabled: true } });\n}"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAA+B;AAC/B,mBAA6B;AAC7B,iBAA4B;AAC5B,uBAAgD;AAEzC,IAAM,0BAAsB,mCAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,UACA,oCAAkB,EAAE,SAAS,gBAAgB,KAAK,IAAI,QAAQ,CAAC;AAAA,IACjE;AAMA,UAAM,gBAAY,+BAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,QAAI,UAAU,gBAAgB,QAAW;AACvC,eAAS,cAAc,UAAU;AAAA,IACnC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AAEjC,aAAO,2BAAa,EAAE,oBAAoB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC9E;",
   "names": []
 }

package/build/router/default_routes.mjs

@@ -1,8 +1,8 @@
 // packages/core/src/router/default_routes.ts
-import { createEndpoint, createRouter } from "@colyseus/better-call";
+import { createEndpoint } from "@colyseus/better-call";
+import { createRouter } from "./index.mjs";
 import * as matchMaker from "../MatchMaker.mjs";
-import { getBearerToken } from "../utils/Utils.mjs";
-import { getTransport } from "../Transport.mjs";
+import { createAuthContext, getTransport } from "../Transport.mjs";
 var postMatchmakeMethod = createEndpoint("/matchmake/:method/:roomName", { method: "POST" }, async (ctx) => {
   if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {
     throw ctx.error(503);
@@ -16,12 +16,7 @@ var postMatchmakeMethod = createEndpoint("/matchmake/:method/:roomName", { metho
       method,
       roomName,
       clientOptions,
-      {
-        token: getBearerToken(ctx.request.headers.get("authorization")),
-        headers: ctx.request.headers,
-        ip: requestHeaders.get("x-forwarded-for") ?? requestHeaders.get("x-client-ip") ?? requestHeaders.get("x-real-ip"),
-        req: ctx.request
-      }
+      createAuthContext({ headers: requestHeaders, req: ctx.request })
     );
     const transport = getTransport();
     if (transport.protocol !== void 0) {

package/build/router/default_routes.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/default_routes.ts"],
-  "sourcesContent": ["import { createEndpoint, createRouter } from \"@colyseus/better-call\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { getBearerToken } from \"../utils/Utils.ts\";\nimport { getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      {\n        token: getBearerToken(ctx.request.headers.get('authorization')),\n        headers: ctx.request.headers,\n        ip: requestHeaders.get('x-forwarded-for') ?? requestHeaders.get('x-client-ip') ?? requestHeaders.get('x-real-ip'),\n        req: ctx.request as any,\n      },\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n    // WebTransport (h3): client pins the self-signed cert via serverCertificateHashes.\n    if (transport.fingerprint !== undefined) {\n      response.fingerprint = transport.fingerprint;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  // no public docs page \u2014 the docs surface is playground's gated /__apidocs\n  return createRouter({ postMatchmakeMethod }, { openapi: { disabled: true } });\n}"],
-  "mappings": ";AAAA,SAAS,gBAAgB,oBAAoB;AAC7C,YAAY,gBAAgB;AAC5B,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAEtB,IAAM,sBAAsB,eAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,QACE,OAAO,eAAe,IAAI,QAAQ,QAAQ,IAAI,eAAe,CAAC;AAAA,QAC9D,SAAS,IAAI,QAAQ;AAAA,QACrB,IAAI,eAAe,IAAI,iBAAiB,KAAK,eAAe,IAAI,aAAa,KAAK,eAAe,IAAI,WAAW;AAAA,QAChH,KAAK,IAAI;AAAA,MACX;AAAA,IACF;AAMA,UAAM,YAAY,aAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,QAAI,UAAU,gBAAgB,QAAW;AACvC,eAAS,cAAc,UAAU;AAAA,IACnC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AAEjC,SAAO,aAAa,EAAE,oBAAoB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC9E;",
+  "sourcesContent": ["import { createEndpoint } from \"@colyseus/better-call\";\nimport { createRouter } from \"./index.ts\";\nimport * as matchMaker from \"../MatchMaker.ts\";\nimport { createAuthContext, getTransport } from \"../Transport.ts\";\n\nexport const postMatchmakeMethod = createEndpoint(\"/matchmake/:method/:roomName\", { method: \"POST\" }, async (ctx) => {\n  // do not accept matchmaking requests if already shutting down\n  if (matchMaker.state === matchMaker.MatchMakerState.SHUTTING_DOWN) {\n    throw ctx.error(503);\n  }\n\n  const requestHeaders = ctx.request.headers;\n\n  const method = ctx.params.method;\n  const roomName = ctx.params.roomName;\n\n  try {\n    const clientOptions = ctx.body;\n    const response = await matchMaker.controller.invokeMethod(\n      method,\n      roomName,\n      clientOptions,\n      createAuthContext({ headers: requestHeaders, req: ctx.request }),\n    );\n\n    //\n    // TODO: refactor here.\n    // expose protocol, if available.\n    //\n    const transport = getTransport();\n    if (transport.protocol !== undefined) {\n      response.protocol = transport.protocol;\n    }\n    // WebTransport (h3): client pins the self-signed cert via serverCertificateHashes.\n    if (transport.fingerprint !== undefined) {\n      response.fingerprint = transport.fingerprint;\n    }\n\n    const json = JSON.stringify(response);\n\n    return new Response(json, {\n      headers: {\n        'content-type': 'application/json',\n        //\n        // Set content length manually to avoid \"chunked\" transfer-encoding header\n        // See https://github.com/haxetink/tink_http/issues/27\n        //\n        'content-length': json.length.toString(),\n      },\n    }) as any;\n\n  } catch (e: any) {\n    throw ctx.error(e.code, { code: e.code, error: e.message, });\n  }\n\n});\n\nexport function getDefaultRouter() {\n  // no public docs page \u2014 the docs surface is playground's gated /__apidocs\n  return createRouter({ postMatchmakeMethod }, { openapi: { disabled: true } });\n}"],
+  "mappings": ";AAAA,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAC7B,YAAY,gBAAgB;AAC5B,SAAS,mBAAmB,oBAAoB;AAEzC,IAAM,sBAAsB,eAAe,gCAAgC,EAAE,QAAQ,OAAO,GAAG,OAAO,QAAQ;AAEnH,MAAe,qBAAqB,2BAAgB,eAAe;AACjE,UAAM,IAAI,MAAM,GAAG;AAAA,EACrB;AAEA,QAAM,iBAAiB,IAAI,QAAQ;AAEnC,QAAM,SAAS,IAAI,OAAO;AAC1B,QAAM,WAAW,IAAI,OAAO;AAE5B,MAAI;AACF,UAAM,gBAAgB,IAAI;AAC1B,UAAM,WAAW,MAAiB,sBAAW;AAAA,MAC3C;AAAA,MACA;AAAA,MACA;AAAA,MACA,kBAAkB,EAAE,SAAS,gBAAgB,KAAK,IAAI,QAAQ,CAAC;AAAA,IACjE;AAMA,UAAM,YAAY,aAAa;AAC/B,QAAI,UAAU,aAAa,QAAW;AACpC,eAAS,WAAW,UAAU;AAAA,IAChC;AAEA,QAAI,UAAU,gBAAgB,QAAW;AACvC,eAAS,cAAc,UAAU;AAAA,IACnC;AAEA,UAAM,OAAO,KAAK,UAAU,QAAQ;AAEpC,WAAO,IAAI,SAAS,MAAM;AAAA,MACxB,SAAS;AAAA,QACP,gBAAgB;AAAA;AAAA;AAAA;AAAA;AAAA,QAKhB,kBAAkB,KAAK,OAAO,SAAS;AAAA,MACzC;AAAA,IACF,CAAC;AAAA,EAEH,SAAS,GAAQ;AACf,UAAM,IAAI,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,QAAS,CAAC;AAAA,EAC7D;AAEF,CAAC;AAEM,SAAS,mBAAmB;AAEjC,SAAO,aAAa,EAAE,oBAAoB,GAAG,EAAE,SAAS,EAAE,UAAU,KAAK,EAAE,CAAC;AAC9E;",
   "names": []
 }

package/build/router/index.cjs

@@ -1,3 +1,4 @@
+const __cjsImportMetaUrl = require('node:url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -114,11 +115,16 @@ function expressRouterStack(expressApp) {
   }
 }
 function createRouter(endpoints, config = {}) {
+  const onError = config?.onError;
   return (0, import_better_call.createRouter)({ ...endpoints }, {
     // better-call's /api/reference page dumps the full API surface
     // unauthenticated — opt back in by passing `openapi` explicitly.
     openapi: { disabled: true },
-    ...config
+    ...config,
+    // Otherwise a malformed body is a 500 plus a stack trace on stderr: log
+    // noise any anonymous client can trigger at will. Matched on the message
+    // because `onError` receives no request context to test against.
+    onError: async (error) => error instanceof SyntaxError && error.message.includes("JSON") ? Response.json({ error: "malformed request body" }, { status: 400 }) : await onError?.(error)
   });
 }
 function basicAuth(opts) {

package/build/router/index.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/index.ts"],
-  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export every type reachable from an inferred type below \u2014 consumers\n  // depend on @colyseus/core, not @colyseus/better-call, and cannot name it\n  // under pnpm's isolated node_modules (TS2742/TS2883).\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n  type StandardSchemaV1,\n  type MiddlewareOptions,\n  type MiddlewareInputContext,\n  type CookieOptions,\n  type CookiePrefixOptions,\n  type Status,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && hasExpressRootRoute(expressApp)) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\n/**\n * Whether the express app already handles the root route, in which case\n * Colyseus must not register its own default \"/\" endpoint over it.\n */\nfunction hasExpressRootRoute(expressApp: express.Application) {\n  return expressRouterStack(expressApp).some((layer: any) =>\n    layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\n/**\n * The app's router stack, or an empty stack if it has no routes yet.\n *\n * express v5 exposes the router as `app.router`; v4 exposes it as `app._router`\n * and only creates it once the first route/middleware is registered.\n */\nfunction expressRouterStack(expressApp: express.Application): any[] {\n  const app = expressApp as any;\n\n  if (app?._router?.stack) {\n    return app._router.stack;\n  }\n\n  try {\n    return app?.router?.stack ?? [];\n  } catch (e) {\n    return []; // express v4 throws on `app.router` \u2014 no routes registered\n  }\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  return createBetterCallRouter({ ...endpoints }, {\n    // better-call's /api/reference page dumps the full API surface\n    // unauthenticated \u2014 opt back in by passing `openapi` explicitly.\n    openapi: { disabled: true },\n    ...config,\n  });\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,yBAA4C;AAC5C,yBAAkJ;AAClJ,kBAAuD;AACvD,uBAA0B;AAC1B,wBAA2B;AAC3B,qBAAgB;AAEhB,IAAAA,sBAqBO;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,gBAAY,mCAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,oBAAoB,UAAU;AAAA,IAG7C,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,gBAAY,mCAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,eAAAC,QAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,YAAQ,wBAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,mBAAO,yBAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,eAAO,2BAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,6BAAW;AAAA,MACd,GAAG,6BAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAMA,SAAS,oBAAoB,YAAiC;AAC5D,SAAO,mBAAmB,UAAU,EAAE,KAAK,CAAC,UAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtE;AAQA,SAAS,mBAAmB,YAAwC;AAClE,QAAM,MAAM;AAEZ,MAAI,KAAK,SAAS,OAAO;AACvB,WAAO,IAAI,QAAQ;AAAA,EACrB;AAEA,MAAI;AACF,WAAO,KAAK,QAAQ,SAAS,CAAC;AAAA,EAChC,SAAS,GAAG;AACV,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,aAAO,mBAAAC,cAAuB,EAAE,GAAG,UAAU,GAAG;AAAA;AAAA;AAAA,IAG9C,SAAS,EAAE,UAAU,KAAK;AAAA,IAC1B,GAAG;AAAA,EACL,CAAC;AACH;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,aAAO,qCAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,4BAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,aAAO;AAAA,QACL,+BAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,QACtC,+BAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,kBAAc,2BAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,sBAAkB,2BAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
+  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export every type reachable from an inferred type below \u2014 consumers\n  // depend on @colyseus/core, not @colyseus/better-call, and cannot name it\n  // under pnpm's isolated node_modules (TS2742/TS2883).\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n  type StandardSchemaV1,\n  type MiddlewareOptions,\n  type MiddlewareInputContext,\n  type CookieOptions,\n  type CookiePrefixOptions,\n  type Status,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && hasExpressRootRoute(expressApp)) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\n/**\n * Whether the express app already handles the root route, in which case\n * Colyseus must not register its own default \"/\" endpoint over it.\n */\nfunction hasExpressRootRoute(expressApp: express.Application) {\n  return expressRouterStack(expressApp).some((layer: any) =>\n    layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\n/**\n * The app's router stack, or an empty stack if it has no routes yet.\n *\n * express v5 exposes the router as `app.router`; v4 exposes it as `app._router`\n * and only creates it once the first route/middleware is registered.\n */\nfunction expressRouterStack(expressApp: express.Application): any[] {\n  const app = expressApp as any;\n\n  if (app?._router?.stack) {\n    return app._router.stack;\n  }\n\n  try {\n    return app?.router?.stack ?? [];\n  } catch (e) {\n    return []; // express v4 throws on `app.router` \u2014 no routes registered\n  }\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  const onError = config?.onError;\n  return createBetterCallRouter({ ...endpoints }, {\n    // better-call's /api/reference page dumps the full API surface\n    // unauthenticated \u2014 opt back in by passing `openapi` explicitly.\n    openapi: { disabled: true },\n    ...config,\n    // Otherwise a malformed body is a 500 plus a stack trace on stderr: log\n    // noise any anonymous client can trigger at will. Matched on the message\n    // because `onError` receives no request context to test against.\n    onError: async (error: unknown) => (error instanceof SyntaxError && error.message.includes('JSON'))\n      ? Response.json({ error: 'malformed request body' }, { status: 400 })\n      : await onError?.(error),\n  });\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAEA,yBAA4C;AAC5C,yBAAkJ;AAClJ,kBAAuD;AACvD,uBAA0B;AAC1B,wBAA2B;AAC3B,qBAAgB;AAEhB,IAAAA,sBAqBO;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,gBAAY,mCAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,oBAAoB,UAAU;AAAA,IAG7C,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,gBAAY,mCAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,eAAAC,QAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,YAAQ,wBAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,mBAAO,yBAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,eAAO,2BAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,6BAAW;AAAA,MACd,GAAG,6BAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAMA,SAAS,oBAAoB,YAAiC;AAC5D,SAAO,mBAAmB,UAAU,EAAE,KAAK,CAAC,UAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtE;AAQA,SAAS,mBAAmB,YAAwC;AAClE,QAAM,MAAM;AAEZ,MAAI,KAAK,SAAS,OAAO;AACvB,WAAO,IAAI,QAAQ;AAAA,EACrB;AAEA,MAAI;AACF,WAAO,KAAK,QAAQ,SAAS,CAAC;AAAA,EAChC,SAAS,GAAG;AACV,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,QAAM,UAAU,QAAQ;AACxB,aAAO,mBAAAC,cAAuB,EAAE,GAAG,UAAU,GAAG;AAAA;AAAA;AAAA,IAG9C,SAAS,EAAE,UAAU,KAAK;AAAA,IAC1B,GAAG;AAAA;AAAA;AAAA;AAAA,IAIH,SAAS,OAAO,UAAoB,iBAAiB,eAAe,MAAM,QAAQ,SAAS,MAAM,IAC7F,SAAS,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC,IAClE,MAAM,UAAU,KAAK;AAAA,EAC3B,CAAC;AACH;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,aAAO,qCAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,4BAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,aAAO;AAAA,QACL,+BAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,QACtC,+BAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,kBAAc,2BAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,sBAAkB,2BAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
   "names": ["import_better_call", "pkg", "createBetterCallRouter"]
 }

package/build/router/index.mjs

@@ -77,11 +77,16 @@ function expressRouterStack(expressApp) {
   }
 }
 function createRouter(endpoints, config = {}) {
+  const onError = config?.onError;
   return createBetterCallRouter({ ...endpoints }, {
     // better-call's /api/reference page dumps the full API surface
     // unauthenticated — opt back in by passing `openapi` explicitly.
     openapi: { disabled: true },
-    ...config
+    ...config,
+    // Otherwise a malformed body is a 500 plus a stack trace on stderr: log
+    // noise any anonymous client can trigger at will. Matched on the message
+    // because `onError` receives no request context to test against.
+    onError: async (error) => error instanceof SyntaxError && error.message.includes("JSON") ? Response.json({ error: "malformed request body" }, { status: 400 }) : await onError?.(error)
   });
 }
 function basicAuth(opts) {

package/build/router/index.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/index.ts"],
-  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export every type reachable from an inferred type below \u2014 consumers\n  // depend on @colyseus/core, not @colyseus/better-call, and cannot name it\n  // under pnpm's isolated node_modules (TS2742/TS2883).\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n  type StandardSchemaV1,\n  type MiddlewareOptions,\n  type MiddlewareInputContext,\n  type CookieOptions,\n  type CookiePrefixOptions,\n  type Status,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && hasExpressRootRoute(expressApp)) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\n/**\n * Whether the express app already handles the root route, in which case\n * Colyseus must not register its own default \"/\" endpoint over it.\n */\nfunction hasExpressRootRoute(expressApp: express.Application) {\n  return expressRouterStack(expressApp).some((layer: any) =>\n    layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\n/**\n * The app's router stack, or an empty stack if it has no routes yet.\n *\n * express v5 exposes the router as `app.router`; v4 exposes it as `app._router`\n * and only creates it once the first route/middleware is registered.\n */\nfunction expressRouterStack(expressApp: express.Application): any[] {\n  const app = expressApp as any;\n\n  if (app?._router?.stack) {\n    return app._router.stack;\n  }\n\n  try {\n    return app?.router?.stack ?? [];\n  } catch (e) {\n    return []; // express v4 throws on `app.router` \u2014 no routes registered\n  }\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  return createBetterCallRouter({ ...endpoints }, {\n    // better-call's /api/reference page dumps the full API surface\n    // unauthenticated \u2014 opt back in by passing `openapi` explicitly.\n    openapi: { disabled: true },\n    ...config,\n  });\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
-  "mappings": ";AAEA,SAAS,YAAY,uBAAuB;AAC5C,SAAwD,gBAAgB,wBAAwB,gBAAgB,kBAAkB,gBAAgB;AAClJ,SAAS,eAAe,YAAY,mBAAmB;AACvD,OAA0B;AAC1B,SAAS,kBAAkB;AAC3B,OAAO,SAAS,qBAAqB,KAAK,EAAE,MAAM,OAAO;AAEzD;AAAA,EACE,kBAAAA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,OAkBK;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,YAAY,eAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,oBAAoB,UAAU;AAAA,IAG7C,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,YAAY,eAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,IAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,QAAQ,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,eAAO,YAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,WAAO,cAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,WAAW;AAAA,MACd,GAAG,WAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAMA,SAAS,oBAAoB,YAAiC;AAC5D,SAAO,mBAAmB,UAAU,EAAE,KAAK,CAAC,UAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtE;AAQA,SAAS,mBAAmB,YAAwC;AAClE,QAAM,MAAM;AAEZ,MAAI,KAAK,SAAS,OAAO;AACvB,WAAO,IAAI,QAAQ;AAAA,EACrB;AAEA,MAAI;AACF,WAAO,KAAK,QAAQ,SAAS,CAAC;AAAA,EAChC,SAAS,GAAG;AACV,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,SAAO,uBAAuB,EAAE,GAAG,UAAU,GAAG;AAAA;AAAA;AAAA,IAG9C,SAAS,EAAE,UAAU,KAAK;AAAA,IAC1B,GAAG;AAAA,EACL,CAAC;AACH;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,SAAO,iBAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,SAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,SAAO;AAAA,IACL,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,IACtC,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,cAAc,cAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,kBAAkB,cAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
+  "sourcesContent": ["import type express from \"express\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\nimport { createHash, timingSafeEqual } from \"node:crypto\";\nimport { type Endpoint, type Router, type RouterConfig, createRouter as createBetterCallRouter, createEndpoint, createMiddleware, APIError } from \"@colyseus/better-call\";\nimport { toNodeHandler, getRequest, setResponse } from \"@colyseus/better-call/node\";\nimport { Transport } from \"../Transport.ts\";\nimport { controller } from \"../matchmaker/controller.ts\";\nimport pkg from \"../../package.json\" with { type: \"json\" };\n\nexport {\n  createEndpoint,\n  createMiddleware,\n  createInternalContext,\n\n  // Re-export every type reachable from an inferred type below \u2014 consumers\n  // depend on @colyseus/core, not @colyseus/better-call, and cannot name it\n  // under pnpm's isolated node_modules (TS2742/TS2883).\n  type Router,\n  type RouterConfig,\n  type Endpoint,\n  type EndpointHandler,\n  type EndpointOptions,\n  type EndpointContext,\n  type StrictEndpoint,\n  type StandardSchemaV1,\n  type MiddlewareOptions,\n  type MiddlewareInputContext,\n  type CookieOptions,\n  type CookiePrefixOptions,\n  type Status,\n} from \"@colyseus/better-call\";\n\nexport { toNodeHandler };\n\nexport function bindRouterToTransport(transport: Transport, router: Router, useExpress: boolean) {\n  // add default \"/__healthcheck\" endpoint\n  router.addEndpoint(createEndpoint(\"/__healthcheck\", { method: \"GET\" }, async (ctx) => {\n    return new Response(\"OK\", { status: 200 });\n  }));\n\n  const server = transport.server;\n\n  // check if the server is bound to an express app\n  const expressApp: express.Application = (useExpress)\n    ? transport.getExpressApp() as express.Application\n    // fallback searching for express app in server listeners\n    : server?.listeners('request').find((listener: Function) => listener.name === \"app\" && listener['mountpath'] === '/') as express.Application;\n\n  // add default \"/\" route, if not provided.\n  const hasRootRoute = (\n    // check if express app has a root route\n    (expressApp && hasExpressRootRoute(expressApp)) ||\n\n    // check if router has a root route\n    Object.values(router.endpoints).some(endpoint => endpoint.path === \"/\")\n  );\n\n  if (!hasRootRoute) {\n    router.addEndpoint(createEndpoint(\"/\", { method: \"GET\" }, async (ctx) => {\n      return new Response(`Colyseus ${pkg.version}`, { status: 200 });\n    }));\n  }\n\n  // use custom bindRouter method if provided\n  if (!server && transport.bindRouter) {\n    transport.bindRouter(router);\n    return;\n  }\n\n  // which route handler to use\n  // (router + fallback to express, or just router)\n  let next: any;\n\n  if (expressApp) {\n    server.removeListener('request', expressApp);\n\n    next = async (req: IncomingMessage, res: ServerResponse) => {\n      // check if the route is defined in the router\n      // if so, use the router handler, otherwise fallback to express\n      if (router.findRoute(req.method, req.url.split('?')[0]) !== undefined) {\n        const protocol = req.headers[\"x-forwarded-proto\"] || ((req.socket as any).encrypted ? \"https\" : \"http\");\n        const base = `${protocol}://${req.headers[\":authority\"] || req.headers.host}`;\n        const response = await router.handler(getRequest({ base, request: req }));\n        return setResponse(res, response);\n\n      } else {\n        return expressApp['handle'](req, res);\n      }\n    };\n\n  } else {\n    next = toNodeHandler(router.handler);\n  }\n\n  // handle cors headers for all requests by default\n  server.prependListener('request', (req: IncomingMessage, res: ServerResponse) => {\n    const corsHeaders = {\n      ...controller.DEFAULT_CORS_HEADERS,\n      ...controller.getCorsHeaders(new Headers(req.headers as any)),\n    };\n\n    if (req.method === \"OPTIONS\") {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    Object.entries(corsHeaders).forEach(([key, value]) => {\n      res.setHeader(key, value);\n    });\n\n    next(req, res);\n  });\n}\n\n/**\n * Whether the express app already handles the root route, in which case\n * Colyseus must not register its own default \"/\" endpoint over it.\n */\nfunction hasExpressRootRoute(expressApp: express.Application) {\n  return expressRouterStack(expressApp).some((layer: any) =>\n    layer.match('/') && !['query', 'expressInit'].includes(layer.name));\n}\n\n/**\n * The app's router stack, or an empty stack if it has no routes yet.\n *\n * express v5 exposes the router as `app.router`; v4 exposes it as `app._router`\n * and only creates it once the first route/middleware is registered.\n */\nfunction expressRouterStack(expressApp: express.Application): any[] {\n  const app = expressApp as any;\n\n  if (app?._router?.stack) {\n    return app._router.stack;\n  }\n\n  try {\n    return app?.router?.stack ?? [];\n  } catch (e) {\n    return []; // express v4 throws on `app.router` \u2014 no routes registered\n  }\n}\n\nexport function createRouter<\n  E extends Record<string, Endpoint>,\n  Config extends RouterConfig\n>(endpoints: E, config: Config = {} as Config) {\n  const onError = config?.onError;\n  return createBetterCallRouter({ ...endpoints }, {\n    // better-call's /api/reference page dumps the full API surface\n    // unauthenticated \u2014 opt back in by passing `openapi` explicitly.\n    openapi: { disabled: true },\n    ...config,\n    // Otherwise a malformed body is a 500 plus a stack trace on stderr: log\n    // noise any anonymous client can trigger at will. Matched on the message\n    // because `onError` receives no request context to test against.\n    onError: async (error: unknown) => (error instanceof SyntaxError && error.message.includes('JSON'))\n      ? Response.json({ error: 'malformed request body' }, { status: 400 })\n      : await onError?.(error),\n  });\n}\n\nexport interface BasicAuthOptions {\n  /** username \u2192 password. The common static case. */\n  users?: Record<string, string>;\n  /** Custom validator (e.g. DB-backed). Takes precedence over `users`. */\n  validate?: (username: string, password: string) => boolean | Promise<boolean>;\n  /** Realm shown in the browser prompt. Default 'Restricted'. */\n  realm?: string;\n}\n\n/**\n * HTTP Basic Auth middleware. Drop into any endpoint's `use:` slot to gate\n * it behind a browser credentials prompt:\n *\n *   playground({ use: [basicAuth({ users: { admin: 's3cret' } })] })\n */\nexport function basicAuth(opts: BasicAuthOptions) {\n  const { users, validate } = opts;\n  if (!users && !validate) {\n    throw new Error('[basicAuth] provide `users` or `validate`');\n  }\n  // Realm is interpolated into a header \u2014 strip `\"` so it can't break out.\n  const challenge = `Basic realm=\"${(opts.realm ?? 'Restricted').replace(/\"/g, '')}\", charset=\"UTF-8\"`;\n\n  return createMiddleware(async (ctx) => {\n    const creds = parseBasicHeader(ctx.getHeader('authorization'));\n    const ok = !!creds && (validate\n      ? await validate(creds.username, creds.password)\n      : staticCheck(users!, creds.username, creds.password));\n    if (!ok) {\n      throw new APIError(401, { message: 'authentication required' }, { 'WWW-Authenticate': challenge });\n    }\n  });\n}\n\nfunction parseBasicHeader(header: string | null | undefined) {\n  if (!header) { return null; }\n  const sep = header.indexOf(' ');\n  if (sep < 0 || header.slice(0, sep).toLowerCase() !== 'basic') { return null; }\n  let decoded: string;\n  try { decoded = Buffer.from(header.slice(sep + 1), 'base64').toString('utf8'); } catch { return null; }\n  const colon = decoded.indexOf(':');\n  if (colon < 0) { return null; }\n  return { username: decoded.slice(0, colon), password: decoded.slice(colon + 1) };\n}\n\nfunction staticCheck(users: Record<string, string>, username: string, password: string): boolean {\n  const expected = Object.prototype.hasOwnProperty.call(users, username) ? users[username] : undefined;\n  // Compare even for an unknown user so reject timing doesn't reveal which\n  // usernames exist.\n  return safeEqual(password, expected ?? '\\0') && expected !== undefined;\n}\n\n// Hash both sides first: equalizes length (timingSafeEqual throws on a\n// length mismatch, which would itself leak the secret's length).\nfunction safeEqual(a: string, b: string): boolean {\n  return timingSafeEqual(\n    createHash('sha256').update(a).digest(),\n    createHash('sha256').update(b).digest(),\n  );\n}\n\n// ---------------------------------------------------------------------------\n// dualModeEndpoints \u2014 shared express-compat layer for @colyseus/admin,\n// @colyseus/monitor, @colyseus/playground. Builds the two local routers\n// (specific = no catch-all, full = everything) and the matching node\n// handlers, then packages the express middleware so the return value works\n// both as `{...spread}` into createRouter AND as `app.use(\"/\", x)` middleware.\n// ---------------------------------------------------------------------------\n\nexport type ExpressMiddleware = (\n  req: IncomingMessage,\n  res: ServerResponse,\n  next: (err?: any) => void,\n) => void;\n\nexport type NodeHandler = (req: IncomingMessage, res: ServerResponse) => Promise<void>;\n\nexport interface DualModeHelpers {\n  specificRouter: Router;\n  specificHandler: NodeHandler;\n  fullRouter: Router;\n  fullHandler: NodeHandler;\n}\n\nexport function dualModeEndpoints<E extends Record<string, Endpoint>>(\n  endpoints: E,\n  opts: {\n    /** Key in `endpoints` whose path is a catch-all. Excluded from `specificRouter` so it doesn't eat fall-through decisions. */\n    catchAllKey?: keyof E;\n    /** Build the express middleware given the pre-built routers + node handlers. */\n    buildMiddleware: (helpers: DualModeHelpers) => ExpressMiddleware;\n  },\n): ExpressMiddleware & E {\n  const fullRouter = createRouter(endpoints);\n  const fullHandler = toNodeHandler(fullRouter.handler) as NodeHandler;\n\n  const specificEndpoints = opts.catchAllKey\n    ? Object.fromEntries(\n        Object.entries(endpoints).filter(([k]) => k !== opts.catchAllKey),\n      ) as Partial<E>\n    : endpoints;\n  const specificRouter = createRouter(specificEndpoints as E);\n  const specificHandler = toNodeHandler(specificRouter.handler) as NodeHandler;\n\n  const middleware = opts.buildMiddleware({\n    specificRouter, specificHandler, fullRouter, fullHandler,\n  });\n  return Object.assign(middleware, endpoints) as ExpressMiddleware & E;\n}\n"],
+  "mappings": ";AAEA,SAAS,YAAY,uBAAuB;AAC5C,SAAwD,gBAAgB,wBAAwB,gBAAgB,kBAAkB,gBAAgB;AAClJ,SAAS,eAAe,YAAY,mBAAmB;AACvD,OAA0B;AAC1B,SAAS,kBAAkB;AAC3B,OAAO,SAAS,qBAAqB,KAAK,EAAE,MAAM,OAAO;AAEzD;AAAA,EACE,kBAAAA;AAAA,EACA,oBAAAC;AAAA,EACA;AAAA,OAkBK;AAIA,SAAS,sBAAsB,WAAsB,QAAgB,YAAqB;AAE/F,SAAO,YAAY,eAAe,kBAAkB,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACpF,WAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3C,CAAC,CAAC;AAEF,QAAM,SAAS,UAAU;AAGzB,QAAM,aAAmC,aACrC,UAAU,cAAc,IAExB,QAAQ,UAAU,SAAS,EAAE,KAAK,CAAC,aAAuB,SAAS,SAAS,SAAS,SAAS,WAAW,MAAM,GAAG;AAGtH,QAAM;AAAA;AAAA,IAEH,cAAc,oBAAoB,UAAU;AAAA,IAG7C,OAAO,OAAO,OAAO,SAAS,EAAE,KAAK,cAAY,SAAS,SAAS,GAAG;AAAA;AAGxE,MAAI,CAAC,cAAc;AACjB,WAAO,YAAY,eAAe,KAAK,EAAE,QAAQ,MAAM,GAAG,OAAO,QAAQ;AACvE,aAAO,IAAI,SAAS,YAAY,IAAI,OAAO,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,IAChE,CAAC,CAAC;AAAA,EACJ;AAGA,MAAI,CAAC,UAAU,UAAU,YAAY;AACnC,cAAU,WAAW,MAAM;AAC3B;AAAA,EACF;AAIA,MAAI;AAEJ,MAAI,YAAY;AACd,WAAO,eAAe,WAAW,UAAU;AAE3C,WAAO,OAAO,KAAsB,QAAwB;AAG1D,UAAI,OAAO,UAAU,IAAI,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,CAAC,MAAM,QAAW;AACrE,cAAM,WAAW,IAAI,QAAQ,mBAAmB,MAAO,IAAI,OAAe,YAAY,UAAU;AAChG,cAAM,OAAO,GAAG,QAAQ,MAAM,IAAI,QAAQ,YAAY,KAAK,IAAI,QAAQ,IAAI;AAC3E,cAAM,WAAW,MAAM,OAAO,QAAQ,WAAW,EAAE,MAAM,SAAS,IAAI,CAAC,CAAC;AACxE,eAAO,YAAY,KAAK,QAAQ;AAAA,MAElC,OAAO;AACL,eAAO,WAAW,QAAQ,EAAE,KAAK,GAAG;AAAA,MACtC;AAAA,IACF;AAAA,EAEF,OAAO;AACL,WAAO,cAAc,OAAO,OAAO;AAAA,EACrC;AAGA,SAAO,gBAAgB,WAAW,CAAC,KAAsB,QAAwB;AAC/E,UAAM,cAAc;AAAA,MAClB,GAAG,WAAW;AAAA,MACd,GAAG,WAAW,eAAe,IAAI,QAAQ,IAAI,OAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,WAAO,QAAQ,WAAW,EAAE,QAAQ,CAAC,CAAC,KAAK,KAAK,MAAM;AACpD,UAAI,UAAU,KAAK,KAAK;AAAA,IAC1B,CAAC;AAED,SAAK,KAAK,GAAG;AAAA,EACf,CAAC;AACH;AAMA,SAAS,oBAAoB,YAAiC;AAC5D,SAAO,mBAAmB,UAAU,EAAE,KAAK,CAAC,UAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,SAAS,aAAa,EAAE,SAAS,MAAM,IAAI,CAAC;AACtE;AAQA,SAAS,mBAAmB,YAAwC;AAClE,QAAM,MAAM;AAEZ,MAAI,KAAK,SAAS,OAAO;AACvB,WAAO,IAAI,QAAQ;AAAA,EACrB;AAEA,MAAI;AACF,WAAO,KAAK,QAAQ,SAAS,CAAC;AAAA,EAChC,SAAS,GAAG;AACV,WAAO,CAAC;AAAA,EACV;AACF;AAEO,SAAS,aAGd,WAAc,SAAiB,CAAC,GAAa;AAC7C,QAAM,UAAU,QAAQ;AACxB,SAAO,uBAAuB,EAAE,GAAG,UAAU,GAAG;AAAA;AAAA;AAAA,IAG9C,SAAS,EAAE,UAAU,KAAK;AAAA,IAC1B,GAAG;AAAA;AAAA;AAAA;AAAA,IAIH,SAAS,OAAO,UAAoB,iBAAiB,eAAe,MAAM,QAAQ,SAAS,MAAM,IAC7F,SAAS,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC,IAClE,MAAM,UAAU,KAAK;AAAA,EAC3B,CAAC;AACH;AAiBO,SAAS,UAAU,MAAwB;AAChD,QAAM,EAAE,OAAO,SAAS,IAAI;AAC5B,MAAI,CAAC,SAAS,CAAC,UAAU;AACvB,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AAEA,QAAM,YAAY,iBAAiB,KAAK,SAAS,cAAc,QAAQ,MAAM,EAAE,CAAC;AAEhF,SAAO,iBAAiB,OAAO,QAAQ;AACrC,UAAM,QAAQ,iBAAiB,IAAI,UAAU,eAAe,CAAC;AAC7D,UAAM,KAAK,CAAC,CAAC,UAAU,WACnB,MAAM,SAAS,MAAM,UAAU,MAAM,QAAQ,IAC7C,YAAY,OAAQ,MAAM,UAAU,MAAM,QAAQ;AACtD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,SAAS,KAAK,EAAE,SAAS,0BAA0B,GAAG,EAAE,oBAAoB,UAAU,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,QAAmC;AAC3D,MAAI,CAAC,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5B,QAAM,MAAM,OAAO,QAAQ,GAAG;AAC9B,MAAI,MAAM,KAAK,OAAO,MAAM,GAAG,GAAG,EAAE,YAAY,MAAM,SAAS;AAAE,WAAO;AAAA,EAAM;AAC9E,MAAI;AACJ,MAAI;AAAE,cAAU,OAAO,KAAK,OAAO,MAAM,MAAM,CAAC,GAAG,QAAQ,EAAE,SAAS,MAAM;AAAA,EAAG,QAAQ;AAAE,WAAO;AAAA,EAAM;AACtG,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAI,QAAQ,GAAG;AAAE,WAAO;AAAA,EAAM;AAC9B,SAAO,EAAE,UAAU,QAAQ,MAAM,GAAG,KAAK,GAAG,UAAU,QAAQ,MAAM,QAAQ,CAAC,EAAE;AACjF;AAEA,SAAS,YAAY,OAA+B,UAAkB,UAA2B;AAC/F,QAAM,WAAW,OAAO,UAAU,eAAe,KAAK,OAAO,QAAQ,IAAI,MAAM,QAAQ,IAAI;AAG3F,SAAO,UAAU,UAAU,YAAY,IAAI,KAAK,aAAa;AAC/D;AAIA,SAAS,UAAU,GAAW,GAAoB;AAChD,SAAO;AAAA,IACL,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,IACtC,WAAW,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO;AAAA,EACxC;AACF;AAyBO,SAAS,kBACd,WACA,MAMuB;AACvB,QAAM,aAAa,aAAa,SAAS;AACzC,QAAM,cAAc,cAAc,WAAW,OAAO;AAEpD,QAAM,oBAAoB,KAAK,cAC3B,OAAO;AAAA,IACL,OAAO,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,KAAK,WAAW;AAAA,EAClE,IACA;AACJ,QAAM,iBAAiB,aAAa,iBAAsB;AAC1D,QAAM,kBAAkB,cAAc,eAAe,OAAO;AAE5D,QAAM,aAAa,KAAK,gBAAgB;AAAA,IACtC;AAAA,IAAgB;AAAA,IAAiB;AAAA,IAAY;AAAA,EAC/C,CAAC;AACD,SAAO,OAAO,OAAO,YAAY,SAAS;AAC5C;",
   "names": ["createEndpoint", "createMiddleware"]
 }

package/build/router/node.cjs

@@ -1,3 +1,4 @@
+const __cjsImportMetaUrl = require('node:url').pathToFileURL(__filename).href;
 "use strict";
 var __create = Object.create;
 var __defProp = Object.defineProperty;
@@ -38,13 +39,25 @@ var import_url = require("url");
 var matchMaker = __toESM(require("../MatchMaker.cjs"), 1);
 var import_node = require("@colyseus/better-call/node");
 var import_default_routes = require("./default_routes.cjs");
+var MAX_BODY_SIZE = 1024 * 1024;
+var badRequest = (status, message) => Object.assign(new Error(message), { status });
 function readBody(req) {
   return new Promise((resolve, reject) => {
     let data = "";
     req.on("data", (chunk) => {
       data += chunk.toString();
+      if (data.length > MAX_BODY_SIZE) {
+        reject(badRequest(413, "request body too large"));
+        req.destroy();
+      }
+    });
+    req.on("end", () => {
+      try {
+        resolve(data ? JSON.parse(data) : {});
+      } catch {
+        reject(badRequest(400, "malformed JSON body"));
+      }
     });
-    req.on("end", () => resolve(data ? JSON.parse(data) : {}));
     req.on("error", reject);
   });
 }
@@ -112,10 +125,18 @@ function createNodeMatchmakingMiddleware() {
       return;
     }
     const [, method, roomName] = match;
+    let body;
+    try {
+      body = await readBody(req);
+    } catch (e) {
+      res.writeHead(e.status ?? 400, { ...corsHeaders, "content-type": "application/json" });
+      res.end(JSON.stringify({ error: e.message }));
+      return;
+    }
     try {
       const response = await (0, import_default_routes.postMatchmakeMethod)({
         params: { method, roomName },
-        body: await readBody(req),
+        body,
         headers: req.headers,
         request: { headers },
         asResponse: true

package/build/router/node.cjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/node.ts"],
-  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n    });\n    req.on('end', () => resolve(data ? JSON.parse(data) : {}));\n    req.on('error', reject);\n  });\n}\n\n/**\n * Buffer incoming request bodies and expose them as `req.body` before the\n * server's existing \"request\" listeners run.\n *\n * Needed when the HTTP server is consumed via `export default` (e.g. on Vercel)\n * rather than `listen()`: the matchmaking router reads the body from `req.body`\n * when present, otherwise from a lazy request stream that does not drain in that\n * mode \u2014 which would stall matchmaking POSTs.\n */\nexport function prereadRequestBodies(server: http.Server) {\n  type WithBody = http.IncomingMessage & { body?: unknown };\n  const listeners = server.listeners('request') as Array<(req: http.IncomingMessage, res: http.ServerResponse) => void>;\n  const run = (req: http.IncomingMessage, res: http.ServerResponse) => {\n    for (const listener of listeners) { listener.call(server, req, res); }\n  };\n\n  server.removeAllListeners('request');\n  server.on('request', (req: WithBody, res) => {\n    const method = req.method ?? 'GET';\n    const needsBody =\n      method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS' &&\n      req.body === undefined &&\n      Number(req.headers['content-length']) > 0;\n\n    if (!needsBody) {\n      run(req, res);\n      return;\n    }\n\n    const chunks: Buffer[] = [];\n    req.on('data', (chunk: Buffer) => chunks.push(chunk));\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString('utf8');\n      if ((req.headers['content-type'] || '').includes('application/json')) {\n        try { req.body = JSON.parse(raw || '{}'); } catch { req.body = raw; }\n      } else {\n        req.body = raw;\n      }\n      run(req, res);\n    });\n    req.on('error', () => run(req, res));\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body: await readBody(req),\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,iBAAoB;AACpB,iBAA4B;AAC5B,kBAA4B;AAC5B,4BAAoC;AAEpC,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AAAA,IACzB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;AACzD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAWO,SAAS,qBAAqB,QAAqB;AAExD,QAAM,YAAY,OAAO,UAAU,SAAS;AAC5C,QAAM,MAAM,CAAC,KAA2B,QAA6B;AACnE,eAAW,YAAY,WAAW;AAAE,eAAS,KAAK,QAAQ,KAAK,GAAG;AAAA,IAAG;AAAA,EACvE;AAEA,SAAO,mBAAmB,SAAS;AACnC,SAAO,GAAG,WAAW,CAAC,KAAe,QAAQ;AAC3C,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,YACJ,WAAW,SAAS,WAAW,UAAU,WAAW,aACpD,IAAI,SAAS,UACb,OAAO,IAAI,QAAQ,gBAAgB,CAAC,IAAI;AAE1C,QAAI,CAAC,WAAW;AACd,UAAI,KAAK,GAAG;AACZ;AAAA,IACF;AAEA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,WAAK,IAAI,QAAQ,cAAc,KAAK,IAAI,SAAS,kBAAkB,GAAG;AACpE,YAAI;AAAE,cAAI,OAAO,KAAK,MAAM,OAAO,IAAI;AAAA,QAAG,QAAQ;AAAE,cAAI,OAAO;AAAA,QAAK;AAAA,MACtE,OAAO;AACL,YAAI,OAAO;AAAA,MACb;AACA,UAAI,KAAK,GAAG;AAAA,IACd,CAAC;AACD,QAAI,GAAG,SAAS,MAAM,IAAI,KAAK,GAAG,CAAC;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,eAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACF,YAAM,WAAW,UAAM,2CAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B,MAAM,MAAM,SAAS,GAAG;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,gBAAM,yBAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\n/** Matchmaking options are small \u2014 the cap only stops unbounded buffering. */\nconst MAX_BODY_SIZE = 1024 * 1024;\n\nconst badRequest = (status: number, message: string) =>\n  Object.assign(new Error(message), { status });\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n      if (data.length > MAX_BODY_SIZE) {\n        reject(badRequest(413, 'request body too large'));\n        req.destroy();\n      }\n    });\n    // JSON.parse throws on a later tick \u2014 uncaught here it kills the process.\n    req.on('end', () => {\n      try { resolve(data ? JSON.parse(data) : {}); }\n      catch { reject(badRequest(400, 'malformed JSON body')); }\n    });\n    req.on('error', reject);\n  });\n}\n\n/**\n * Buffer incoming request bodies and expose them as `req.body` before the\n * server's existing \"request\" listeners run.\n *\n * Needed when the HTTP server is consumed via `export default` (e.g. on Vercel)\n * rather than `listen()`: the matchmaking router reads the body from `req.body`\n * when present, otherwise from a lazy request stream that does not drain in that\n * mode \u2014 which would stall matchmaking POSTs.\n */\nexport function prereadRequestBodies(server: http.Server) {\n  type WithBody = http.IncomingMessage & { body?: unknown };\n  const listeners = server.listeners('request') as Array<(req: http.IncomingMessage, res: http.ServerResponse) => void>;\n  const run = (req: http.IncomingMessage, res: http.ServerResponse) => {\n    for (const listener of listeners) { listener.call(server, req, res); }\n  };\n\n  server.removeAllListeners('request');\n  server.on('request', (req: WithBody, res) => {\n    const method = req.method ?? 'GET';\n    const needsBody =\n      method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS' &&\n      req.body === undefined &&\n      Number(req.headers['content-length']) > 0;\n\n    if (!needsBody) {\n      run(req, res);\n      return;\n    }\n\n    const chunks: Buffer[] = [];\n    req.on('data', (chunk: Buffer) => chunks.push(chunk));\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString('utf8');\n      if ((req.headers['content-type'] || '').includes('application/json')) {\n        try { req.body = JSON.parse(raw || '{}'); } catch { req.body = raw; }\n      } else {\n        req.body = raw;\n      }\n      run(req, res);\n    });\n    req.on('error', () => run(req, res));\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    let body: any;\n    try {\n      body = await readBody(req);\n    } catch (e: any) {\n      // answer here \u2014 next() would report a misleading 404 for a bad body\n      res.writeHead(e.status ?? 400, { ...corsHeaders, 'content-type': 'application/json' });\n      res.end(JSON.stringify({ error: e.message }));\n      return;\n    }\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body,\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUA,iBAAoB;AACpB,iBAA4B;AAC5B,kBAA4B;AAC5B,4BAAoC;AAGpC,IAAM,gBAAgB,OAAO;AAE7B,IAAM,aAAa,CAAC,QAAgB,YAClC,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,OAAO,CAAC;AAE9C,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AACvB,UAAI,KAAK,SAAS,eAAe;AAC/B,eAAO,WAAW,KAAK,wBAAwB,CAAC;AAChD,YAAI,QAAQ;AAAA,MACd;AAAA,IACF,CAAC;AAED,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AAAE,gBAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC;AAAA,MAAG,QACvC;AAAE,eAAO,WAAW,KAAK,qBAAqB,CAAC;AAAA,MAAG;AAAA,IAC1D,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAWO,SAAS,qBAAqB,QAAqB;AAExD,QAAM,YAAY,OAAO,UAAU,SAAS;AAC5C,QAAM,MAAM,CAAC,KAA2B,QAA6B;AACnE,eAAW,YAAY,WAAW;AAAE,eAAS,KAAK,QAAQ,KAAK,GAAG;AAAA,IAAG;AAAA,EACvE;AAEA,SAAO,mBAAmB,SAAS;AACnC,SAAO,GAAG,WAAW,CAAC,KAAe,QAAQ;AAC3C,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,YACJ,WAAW,SAAS,WAAW,UAAU,WAAW,aACpD,IAAI,SAAS,UACb,OAAO,IAAI,QAAQ,gBAAgB,CAAC,IAAI;AAE1C,QAAI,CAAC,WAAW;AACd,UAAI,KAAK,GAAG;AACZ;AAAA,IACF;AAEA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,WAAK,IAAI,QAAQ,cAAc,KAAK,IAAI,SAAS,kBAAkB,GAAG;AACpE,YAAI;AAAE,cAAI,OAAO,KAAK,MAAM,OAAO,IAAI;AAAA,QAAG,QAAQ;AAAE,cAAI,OAAO;AAAA,QAAK;AAAA,MACtE,OAAO;AACL,YAAI,OAAO;AAAA,MACb;AACA,UAAI,KAAK,GAAG;AAAA,IACd,CAAC;AACD,QAAI,GAAG,SAAS,MAAM,IAAI,KAAK,GAAG,CAAC;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,eAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS,GAAG;AAAA,IAC3B,SAAS,GAAQ;AAEf,UAAI,UAAU,EAAE,UAAU,KAAK,EAAE,GAAG,aAAa,gBAAgB,mBAAmB,CAAC;AACrF,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5C;AAAA,IACF;AAEA,QAAI;AACF,YAAM,WAAW,UAAM,2CAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B;AAAA,QACA,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,gBAAM,yBAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
   "names": []
 }

package/build/router/node.mjs

@@ -3,13 +3,25 @@ import { URL } from "url";
 import * as matchMaker from "../MatchMaker.mjs";
 import { setResponse } from "@colyseus/better-call/node";
 import { postMatchmakeMethod } from "./default_routes.mjs";
+var MAX_BODY_SIZE = 1024 * 1024;
+var badRequest = (status, message) => Object.assign(new Error(message), { status });
 function readBody(req) {
   return new Promise((resolve, reject) => {
     let data = "";
     req.on("data", (chunk) => {
       data += chunk.toString();
+      if (data.length > MAX_BODY_SIZE) {
+        reject(badRequest(413, "request body too large"));
+        req.destroy();
+      }
+    });
+    req.on("end", () => {
+      try {
+        resolve(data ? JSON.parse(data) : {});
+      } catch {
+        reject(badRequest(400, "malformed JSON body"));
+      }
     });
-    req.on("end", () => resolve(data ? JSON.parse(data) : {}));
     req.on("error", reject);
   });
 }
@@ -77,10 +89,18 @@ function createNodeMatchmakingMiddleware() {
       return;
     }
     const [, method, roomName] = match;
+    let body;
+    try {
+      body = await readBody(req);
+    } catch (e) {
+      res.writeHead(e.status ?? 400, { ...corsHeaders, "content-type": "application/json" });
+      res.end(JSON.stringify({ error: e.message }));
+      return;
+    }
     try {
       const response = await postMatchmakeMethod({
         params: { method, roomName },
-        body: await readBody(req),
+        body,
         headers: req.headers,
         request: { headers },
         asResponse: true

package/build/router/node.mjs.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/router/node.ts"],
-  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n    });\n    req.on('end', () => resolve(data ? JSON.parse(data) : {}));\n    req.on('error', reject);\n  });\n}\n\n/**\n * Buffer incoming request bodies and expose them as `req.body` before the\n * server's existing \"request\" listeners run.\n *\n * Needed when the HTTP server is consumed via `export default` (e.g. on Vercel)\n * rather than `listen()`: the matchmaking router reads the body from `req.body`\n * when present, otherwise from a lazy request stream that does not drain in that\n * mode \u2014 which would stall matchmaking POSTs.\n */\nexport function prereadRequestBodies(server: http.Server) {\n  type WithBody = http.IncomingMessage & { body?: unknown };\n  const listeners = server.listeners('request') as Array<(req: http.IncomingMessage, res: http.ServerResponse) => void>;\n  const run = (req: http.IncomingMessage, res: http.ServerResponse) => {\n    for (const listener of listeners) { listener.call(server, req, res); }\n  };\n\n  server.removeAllListeners('request');\n  server.on('request', (req: WithBody, res) => {\n    const method = req.method ?? 'GET';\n    const needsBody =\n      method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS' &&\n      req.body === undefined &&\n      Number(req.headers['content-length']) > 0;\n\n    if (!needsBody) {\n      run(req, res);\n      return;\n    }\n\n    const chunks: Buffer[] = [];\n    req.on('data', (chunk: Buffer) => chunks.push(chunk));\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString('utf8');\n      if ((req.headers['content-type'] || '').includes('application/json')) {\n        try { req.body = JSON.parse(raw || '{}'); } catch { req.body = raw; }\n      } else {\n        req.body = raw;\n      }\n      run(req, res);\n    });\n    req.on('error', () => run(req, res));\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body: await readBody(req),\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
-  "mappings": ";AAUA,SAAS,WAAW;AACpB,YAAY,gBAAgB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AAEpC,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AAAA,IACzB,CAAC;AACD,QAAI,GAAG,OAAO,MAAM,QAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC;AACzD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAWO,SAAS,qBAAqB,QAAqB;AAExD,QAAM,YAAY,OAAO,UAAU,SAAS;AAC5C,QAAM,MAAM,CAAC,KAA2B,QAA6B;AACnE,eAAW,YAAY,WAAW;AAAE,eAAS,KAAK,QAAQ,KAAK,GAAG;AAAA,IAAG;AAAA,EACvE;AAEA,SAAO,mBAAmB,SAAS;AACnC,SAAO,GAAG,WAAW,CAAC,KAAe,QAAQ;AAC3C,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,YACJ,WAAW,SAAS,WAAW,UAAU,WAAW,aACpD,IAAI,SAAS,UACb,OAAO,IAAI,QAAQ,gBAAgB,CAAC,IAAI;AAE1C,QAAI,CAAC,WAAW;AACd,UAAI,KAAK,GAAG;AACZ;AAAA,IACF;AAEA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,WAAK,IAAI,QAAQ,cAAc,KAAK,IAAI,SAAS,kBAAkB,GAAG;AACpE,YAAI;AAAE,cAAI,OAAO,KAAK,MAAM,OAAO,IAAI;AAAA,QAAG,QAAQ;AAAE,cAAI,OAAO;AAAA,QAAK;AAAA,MACtE,OAAO;AACL,YAAI,OAAO;AAAA,MACb;AACA,UAAI,KAAK,GAAG;AAAA,IACd,CAAC;AACD,QAAI,GAAG,SAAS,MAAM,IAAI,KAAK,GAAG,CAAC;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACF,YAAM,WAAW,MAAM,oBAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B,MAAM,MAAM,SAAS,GAAG;AAAA,QACxB,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,YAAM,YAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Raw Node.js adapter for Colyseus matchmaking routes used by `colyseus/vite`.\n *\n * This file exists specifically so the Vite plugin can share Vite's dev HTTP\n * server while still exposing the Colyseus `/matchmake/*` endpoints.\n *\n * Keep the matchmaking behavior itself in `router/default_routes.ts` and use\n * this file only as the thin raw Node/Express adapter around it.\n */\nimport type http from 'http';\nimport { URL } from 'url';\nimport * as matchMaker from '../MatchMaker.ts';\nimport { setResponse } from '@colyseus/better-call/node';\nimport { postMatchmakeMethod } from './default_routes.ts';\n\n/** Matchmaking options are small \u2014 the cap only stops unbounded buffering. */\nconst MAX_BODY_SIZE = 1024 * 1024;\n\nconst badRequest = (status: number, message: string) =>\n  Object.assign(new Error(message), { status });\n\nfunction readBody(req: http.IncomingMessage): Promise<any> {\n  return new Promise((resolve, reject) => {\n    let data = '';\n\n    req.on('data', (chunk: Buffer | string) => {\n      data += chunk.toString();\n      if (data.length > MAX_BODY_SIZE) {\n        reject(badRequest(413, 'request body too large'));\n        req.destroy();\n      }\n    });\n    // JSON.parse throws on a later tick \u2014 uncaught here it kills the process.\n    req.on('end', () => {\n      try { resolve(data ? JSON.parse(data) : {}); }\n      catch { reject(badRequest(400, 'malformed JSON body')); }\n    });\n    req.on('error', reject);\n  });\n}\n\n/**\n * Buffer incoming request bodies and expose them as `req.body` before the\n * server's existing \"request\" listeners run.\n *\n * Needed when the HTTP server is consumed via `export default` (e.g. on Vercel)\n * rather than `listen()`: the matchmaking router reads the body from `req.body`\n * when present, otherwise from a lazy request stream that does not drain in that\n * mode \u2014 which would stall matchmaking POSTs.\n */\nexport function prereadRequestBodies(server: http.Server) {\n  type WithBody = http.IncomingMessage & { body?: unknown };\n  const listeners = server.listeners('request') as Array<(req: http.IncomingMessage, res: http.ServerResponse) => void>;\n  const run = (req: http.IncomingMessage, res: http.ServerResponse) => {\n    for (const listener of listeners) { listener.call(server, req, res); }\n  };\n\n  server.removeAllListeners('request');\n  server.on('request', (req: WithBody, res) => {\n    const method = req.method ?? 'GET';\n    const needsBody =\n      method !== 'GET' && method !== 'HEAD' && method !== 'OPTIONS' &&\n      req.body === undefined &&\n      Number(req.headers['content-length']) > 0;\n\n    if (!needsBody) {\n      run(req, res);\n      return;\n    }\n\n    const chunks: Buffer[] = [];\n    req.on('data', (chunk: Buffer) => chunks.push(chunk));\n    req.on('end', () => {\n      const raw = Buffer.concat(chunks).toString('utf8');\n      if ((req.headers['content-type'] || '').includes('application/json')) {\n        try { req.body = JSON.parse(raw || '{}'); } catch { req.body = raw; }\n      } else {\n        req.body = raw;\n      }\n      run(req, res);\n    });\n    req.on('error', () => run(req, res));\n  });\n}\n\nfunction getCorsHeaders(req: http.IncomingMessage, headers?: Headers): Record<string, string> {\n  return {\n    ...matchMaker.controller.DEFAULT_CORS_HEADERS,\n    ...matchMaker.controller.getCorsHeaders(headers),\n  };\n}\n\nexport function createNodeMatchmakingMiddleware() {\n  return async (\n    req: http.IncomingMessage,\n    res: http.ServerResponse,\n    next: () => void,\n  ) => {\n    const url = new URL(req.url || '/', 'http://localhost');\n    const isMatchmakeRoute = url.pathname.startsWith(`/${matchMaker.controller.matchmakeRoute}/`);\n\n    if (!isMatchmakeRoute) {\n      next();\n      return;\n    }\n\n    const headers = new Headers(req.headers as Record<string, string>);\n    const corsHeaders = getCorsHeaders(req, headers);\n\n    if (req.method === 'OPTIONS') {\n      res.writeHead(204, corsHeaders);\n      res.end();\n      return;\n    }\n\n    if (req.method !== 'POST') {\n      next();\n      return;\n    }\n\n    const match = url.pathname.match(/^\\/matchmake\\/(\\w+)\\/(.+)/);\n    if (!match) {\n      next();\n      return;\n    }\n\n    const [, method, roomName] = match;\n\n    let body: any;\n    try {\n      body = await readBody(req);\n    } catch (e: any) {\n      // answer here \u2014 next() would report a misleading 404 for a bad body\n      res.writeHead(e.status ?? 400, { ...corsHeaders, 'content-type': 'application/json' });\n      res.end(JSON.stringify({ error: e.message }));\n      return;\n    }\n\n    try {\n      const response = await postMatchmakeMethod({\n        params: { method, roomName },\n        body,\n        headers: req.headers as Record<string, string>,\n        request: { headers } as any,\n        asResponse: true,\n      });\n\n      await setResponse(res, response);\n\n    } catch {\n      // Endpoint-level failures are returned as Response when `asResponse` is true.\n      // Any thrown error here is unexpected, so let the next middleware decide.\n      next();\n    }\n  };\n}\n"],
+  "mappings": ";AAUA,SAAS,WAAW;AACpB,YAAY,gBAAgB;AAC5B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AAGpC,IAAM,gBAAgB,OAAO;AAE7B,IAAM,aAAa,CAAC,QAAgB,YAClC,OAAO,OAAO,IAAI,MAAM,OAAO,GAAG,EAAE,OAAO,CAAC;AAE9C,SAAS,SAAS,KAAyC;AACzD,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,QAAI,OAAO;AAEX,QAAI,GAAG,QAAQ,CAAC,UAA2B;AACzC,cAAQ,MAAM,SAAS;AACvB,UAAI,KAAK,SAAS,eAAe;AAC/B,eAAO,WAAW,KAAK,wBAAwB,CAAC;AAChD,YAAI,QAAQ;AAAA,MACd;AAAA,IACF,CAAC;AAED,QAAI,GAAG,OAAO,MAAM;AAClB,UAAI;AAAE,gBAAQ,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC;AAAA,MAAG,QACvC;AAAE,eAAO,WAAW,KAAK,qBAAqB,CAAC;AAAA,MAAG;AAAA,IAC1D,CAAC;AACD,QAAI,GAAG,SAAS,MAAM;AAAA,EACxB,CAAC;AACH;AAWO,SAAS,qBAAqB,QAAqB;AAExD,QAAM,YAAY,OAAO,UAAU,SAAS;AAC5C,QAAM,MAAM,CAAC,KAA2B,QAA6B;AACnE,eAAW,YAAY,WAAW;AAAE,eAAS,KAAK,QAAQ,KAAK,GAAG;AAAA,IAAG;AAAA,EACvE;AAEA,SAAO,mBAAmB,SAAS;AACnC,SAAO,GAAG,WAAW,CAAC,KAAe,QAAQ;AAC3C,UAAM,SAAS,IAAI,UAAU;AAC7B,UAAM,YACJ,WAAW,SAAS,WAAW,UAAU,WAAW,aACpD,IAAI,SAAS,UACb,OAAO,IAAI,QAAQ,gBAAgB,CAAC,IAAI;AAE1C,QAAI,CAAC,WAAW;AACd,UAAI,KAAK,GAAG;AACZ;AAAA,IACF;AAEA,UAAM,SAAmB,CAAC;AAC1B,QAAI,GAAG,QAAQ,CAAC,UAAkB,OAAO,KAAK,KAAK,CAAC;AACpD,QAAI,GAAG,OAAO,MAAM;AAClB,YAAM,MAAM,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM;AACjD,WAAK,IAAI,QAAQ,cAAc,KAAK,IAAI,SAAS,kBAAkB,GAAG;AACpE,YAAI;AAAE,cAAI,OAAO,KAAK,MAAM,OAAO,IAAI;AAAA,QAAG,QAAQ;AAAE,cAAI,OAAO;AAAA,QAAK;AAAA,MACtE,OAAO;AACL,YAAI,OAAO;AAAA,MACb;AACA,UAAI,KAAK,GAAG;AAAA,IACd,CAAC;AACD,QAAI,GAAG,SAAS,MAAM,IAAI,KAAK,GAAG,CAAC;AAAA,EACrC,CAAC;AACH;AAEA,SAAS,eAAe,KAA2B,SAA2C;AAC5F,SAAO;AAAA,IACL,GAAc,sBAAW;AAAA,IACzB,GAAc,sBAAW,eAAe,OAAO;AAAA,EACjD;AACF;AAEO,SAAS,kCAAkC;AAChD,SAAO,OACL,KACA,KACA,SACG;AACH,UAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;AACtD,UAAM,mBAAmB,IAAI,SAAS,WAAW,IAAe,sBAAW,cAAc,GAAG;AAE5F,QAAI,CAAC,kBAAkB;AACrB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,UAAU,IAAI,QAAQ,IAAI,OAAiC;AACjE,UAAM,cAAc,eAAe,KAAK,OAAO;AAE/C,QAAI,IAAI,WAAW,WAAW;AAC5B,UAAI,UAAU,KAAK,WAAW;AAC9B,UAAI,IAAI;AACR;AAAA,IACF;AAEA,QAAI,IAAI,WAAW,QAAQ;AACzB,WAAK;AACL;AAAA,IACF;AAEA,UAAM,QAAQ,IAAI,SAAS,MAAM,2BAA2B;AAC5D,QAAI,CAAC,OAAO;AACV,WAAK;AACL;AAAA,IACF;AAEA,UAAM,CAAC,EAAE,QAAQ,QAAQ,IAAI;AAE7B,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,SAAS,GAAG;AAAA,IAC3B,SAAS,GAAQ;AAEf,UAAI,UAAU,EAAE,UAAU,KAAK,EAAE,GAAG,aAAa,gBAAgB,mBAAmB,CAAC;AACrF,UAAI,IAAI,KAAK,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;AAC5C;AAAA,IACF;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,oBAAoB;AAAA,QACzC,QAAQ,EAAE,QAAQ,SAAS;AAAA,QAC3B;AAAA,QACA,SAAS,IAAI;AAAA,QACb,SAAS,EAAE,QAAQ;AAAA,QACnB,YAAY;AAAA,MACd,CAAC;AAED,YAAM,YAAY,KAAK,QAAQ;AAAA,IAEjC,QAAQ;AAGN,WAAK;AAAA,IACP;AAAA,EACF;AACF;",
   "names": []
 }

package/build/serializer/NoneSerializer.cjs

@@ -1,3 +1,4 @@
+const __cjsImportMetaUrl = require('node:url').pathToFileURL(__filename).href;
 "use strict";
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

package/build/serializer/NoneSerializer.cjs.map

@@ -2,6 +2,6 @@
   "version": 3,
   "sources": ["../../src/serializer/NoneSerializer.ts"],
   "sourcesContent": ["import type { Client } from '../Transport.ts';\nimport type { PatchTimingContext, Serializer } from './Serializer.ts';\n\nexport class NoneSerializer<T= any> implements Serializer<T> {\n  public id: string = 'none';\n\n  public reset(data: any) {}\n\n  public getFullState(_client?: Client, _timing?: PatchTimingContext) {\n    return null;\n  }\n\n  public applyPatches(_clients: Client[], _state: T, _timing?: PatchTimingContext): boolean {\n    return false;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAGO,IAAM,iBAAN,MAAsD;AAAA,EAAtD;AACL,SAAO,KAAa;AAAA;AAAA,EAEb,MAAM,MAAW;AAAA,EAAC;AAAA,EAElB,aAAa,SAAkB,SAA8B;AAClE,WAAO;AAAA,EACT;AAAA,EAEO,aAAa,UAAoB,QAAW,SAAuC;AACxF,WAAO;AAAA,EACT;AACF;",
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAGO,IAAM,iBAAN,MAAsD;AAAA,EAAtD;AACL,SAAO,KAAa;AAAA;AAAA,EAEb,MAAM,MAAW;AAAA,EAAC;AAAA,EAElB,aAAa,SAAkB,SAA8B;AAClE,WAAO;AAAA,EACT;AAAA,EAEO,aAAa,UAAoB,QAAW,SAAuC;AACxF,WAAO;AAAA,EACT;AACF;",
   "names": []
 }