@genex-ai/multiplayer 0.10.1 → 0.10.2

package/README.md

@@ -34,6 +34,13 @@ across reconnects. Never log it.
 
 Different `room` ids are **fully isolated** — players in game A never see game B.
 
+`connect()` joins immediately. Use it for one ongoing drop-in world. If the game has a
+Play/Online/Local/Bots menu, call it only after the online click and call `room.leave()` when the
+player returns to the offline menu. Immediate connect + spawn is valid only when loading the game
+already means joining the always-online world; do not put a fake Play screen in front of a player
+who is already present. Use `matchmake()` below for fresh bounded sessions with queue/quorum/fair
+start/backfill behavior.
+
 ---
 
 ## `me` — publish your own state
@@ -101,7 +108,11 @@ room.objects.snap('ball', { x: 0, y: 1, z: 0, q: [0, 0, 0, 1] });
 ```
 
 Keep object state **flat** (top-level numbers + a 4-number quaternion) so it smooths, same as a
-player. `state` is smoothed; `stateRaw` is the raw latest (hit-tests). `objects.ids()` lists them.
+player. `state` is render-only and smoothed; `stateRaw` is the raw latest for every gameplay read
+(hit-tests, reach, pickups, physics adoption, discrete values). `objects.ids()` lists them.
+`objects.set()` and `objects.snap()` are owner-only: SDK 0.10.2+ ignores an unowned call and warns
+once per object/operation. Await `claimConfirmed()` and check `accepted` before an irreversible
+write; legacy `claim(); set()` remains valid because `claim()` is optimistic locally.
 
 The relay enforces a short minimum ownership hold to prevent contact thrash. A current-owner
 reassert is a true no-op: it does not extend that hold. Legacy `claim()` remains optimistic for

package/dist/index.d.ts

@@ -34,8 +34,9 @@ type PlayerView<TState> = {
     name: string;
     /** Transport is live now. False while this reserved seat is inside reconnect grace. */
     connected: boolean;
-    /** State to render — for remote players this is **auto-smoothed** (interpolated);
-     * for yourself it's live. Numeric fields are lerped; everything else snaps. */
+    /** RENDER ONLY — for remote players this is **auto-smoothed** (interpolated) and delayed;
+     * for yourself it's live. Numeric fields are lerped; everything else snaps. Use `stateRaw`
+     * for every gameplay read (hits, reach, pickups, flags, physics adoption). */
     state: TState;
     /** The latest raw snapshot (never smoothed/delayed) — use for hit-tests / logic. */
     stateRaw: TState;
@@ -49,8 +50,8 @@ type ObjectView<TState> = {
     owner: string | undefined;
     /** True if you own it (so you should simulate + `objects.set` it). */
     isMine: boolean;
-    /** State to render — **auto-smoothed** like a remote player when someone else owns it;
-     * live (your last `set`) when it's yours. */
+    /** RENDER ONLY — **auto-smoothed** and delayed like a remote player when someone else owns it;
+     * live (your last `set`) when it's yours. Use `stateRaw` for every gameplay read. */
     state: TState;
     /** The latest raw snapshot (never smoothed/delayed) — for hit-tests / logic. */
     stateRaw: TState;

package/dist/index.js

@@ -208,6 +208,7 @@ function attachSession(client, initialRoom) {
   const objEpochs = /* @__PURE__ */ new Map();
   const objRaw = /* @__PURE__ */ new Map();
   const localObjState = /* @__PURE__ */ new Map();
+  const warnedUnownedWrites = /* @__PURE__ */ new Set();
   const pendingBridge = /* @__PURE__ */ new Map();
   let hostId;
   let objectControlVersion = 0;
@@ -215,6 +216,17 @@ function attachSession(client, initialRoom) {
   const pendingControls = /* @__PURE__ */ new Map();
   const testSkew = typeof globalThis !== "undefined" && globalThis.__GENEX_MP_TEST_SKEW__ || 0;
   const now = testSkew ? () => nowMs() + testSkew : nowMs;
+  const rejectUnownedWrite = (operation, id) => {
+    if (objOwners.get(id) === room.sessionId) return false;
+    const warningKey = `${operation}:${id}`;
+    if (!warnedUnownedWrites.has(warningKey)) {
+      warnedUnownedWrites.add(warningKey);
+      console.warn(
+        `[multiplayer] objects.${operation}('${id}') ignored because this session does not own the object \u2014 await objects.claimConfirmed('${id}') and check accepted before publishing`
+      );
+    }
+    return true;
+  };
   const pushSnap = (id, state, sendTime) => {
     const arrival = now();
     const t = sendTime ?? arrival;
@@ -801,12 +813,14 @@ function attachSession(client, initialRoom) {
       },
       set(id, state) {
         const key = String(id);
+        if (rejectUnownedWrite("set", key)) return;
         const clean = sanitizeFinite(state);
         if (objOwners.get(key) === room.sessionId) localObjState.set(key, clean);
         send0("obj", { id: key, d: clean, t: now() });
       },
       snap(id, state) {
         const key = String(id);
+        if (rejectUnownedWrite("snap", key)) return;
         const clean = sanitizeFinite(state);
         if (objOwners.get(key) === room.sessionId) localObjState.set(key, clean);
         send0(OBJECT_SNAP_MSG, { id: key, d: clean, t: now() });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@genex-ai/multiplayer",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "The multiplayer client wrapper + shared room schema for genex.",
   "type": "module",
   "main": "./dist/index.js",