@irtio/client 0.5.1 → 0.6.0

package/dist/index.js

@@ -7,7 +7,10 @@ import {
   SMOOTHING_HALF_LIFE_MS,
   SMOOTHING_SNAP_UNITS,
   emptyPredictionStats
-} from "./chunk-7UTJ7RSF.js";
+} from "./chunk-6J6PKFUS.js";
+
+// src/index.ts
+import { EMPTY_PROFILE as EMPTY_PROFILE2 } from "@irtio/protocol";
 
 // src/endpoint.ts
 var DEFAULT_REGION = "eu";
@@ -112,10 +115,391 @@ function linkForUrl(wsUrl, roomId) {
   }
 }
 
+// src/identity.ts
+var ACCOUNT_STORAGE_KEY = "irtio.account";
+function identityStorageKey(project) {
+  return `irtio.identity.${project}`;
+}
+var DEFAULT_CONTROL_URL = "https://irt.io";
+function browserStorage() {
+  try {
+    const ls = globalThis.localStorage;
+    if (!ls) return void 0;
+    ls.getItem("irtio.identity.probe");
+    return ls;
+  } catch {
+    return void 0;
+  }
+}
+var IdentityError = class extends Error {
+  constructor(code, message, retryAfterMs) {
+    super(message);
+    this.code = code;
+    this.retryAfterMs = retryAfterMs;
+  }
+  code;
+  name = "IdentityError";
+  /**
+   * How long the control plane asked us to wait, in milliseconds, when it said so. Only ever set
+   * on `E_IDENTITY_RATE_LIMITED`: a rate limit is a wait, not an outage, and a game that cannot
+   * tell the two apart drops to its offline path forever over a sixty-second backoff (bug #36).
+   */
+  retryAfterMs;
+};
+var E_IDENTITY_RATE_LIMITED = "E_IDENTITY_RATE_LIMITED";
+var MAX_IDENTITY_RETRY_WAIT_MS = 6e4;
+function retryAfterMsFrom(res, body) {
+  const header = res.headers?.get?.("retry-after");
+  const fromHeader = header === null || header === void 0 ? Number.NaN : Number(header);
+  if (Number.isFinite(fromHeader) && fromHeader >= 0) return fromHeader * 1e3;
+  const fromBody = typeof body?.retryAfter === "number" ? body.retryAfter : Number.NaN;
+  if (Number.isFinite(fromBody) && fromBody >= 0) return fromBody * 1e3;
+  return 6e4;
+}
+var sleep = (ms) => new Promise((resolve) => {
+  setTimeout(resolve, ms);
+});
+var Identity = class {
+  project;
+  controlUrl;
+  fetchImpl;
+  storage;
+  token;
+  accountId;
+  cached;
+  inFlight;
+  constructor(options) {
+    this.project = options.project;
+    this.controlUrl = (options.controlUrl ?? DEFAULT_CONTROL_URL).replace(/\/+$/, "");
+    this.fetchImpl = options.fetch ?? fetch;
+    this.storage = options.storage === null ? void 0 : options.storage ?? browserStorage() ?? void 0;
+    this.token = this.load();
+  }
+  /**
+   * Reads the stored credential, adopting a pre-D61 per-project one if that is all there is.
+   *
+   * Adoption is a rename and nothing more: migration 020 gave every pre-D61 identity an account
+   * whose id is the identity's own id, so the credential that was this player on this project is
+   * already this player's account credential everywhere. Moving it to the origin-wide key is what
+   * makes the same person on the same browser one player across the games on that origin.
+   *
+   * The old key is removed after a successful adoption. If the write fails (a storage that reads
+   * but will not write), the old value is used anyway and adoption is retried next time, which is
+   * the same degrade-quietly rule the rest of this module follows.
+   */
+  load() {
+    try {
+      const current = this.storage?.getItem(ACCOUNT_STORAGE_KEY);
+      if (typeof current === "string" && current !== "") return current;
+    } catch {
+      return void 0;
+    }
+    let legacy;
+    try {
+      legacy = this.storage?.getItem(identityStorageKey(this.project));
+    } catch {
+      return void 0;
+    }
+    if (typeof legacy !== "string" || legacy === "") return void 0;
+    try {
+      this.storage?.setItem(ACCOUNT_STORAGE_KEY, legacy);
+      this.storage?.removeItem(identityStorageKey(this.project));
+    } catch {
+    }
+    return legacy;
+  }
+  /** The stored identity token, or `undefined` before the first mint. Never sent to a room. */
+  get stored() {
+    return this.token;
+  }
+  /** The player id the room will see, once an assertion has been fetched. */
+  get playerId() {
+    return this.cached?.playerId;
+  }
+  /**
+   * Mints an identity if this browser has none, and returns the token.
+   *
+   * A mint refused with 429 is retried ONCE, after the window the control plane named, as long as
+   * that window is short enough to wait out (`MAX_IDENTITY_RETRY_WAIT_MS`). Everything else — and
+   * a second refusal — throws, and a rate limit throws `E_IDENTITY_RATE_LIMITED` with
+   * `retryAfterMs` rather than the unreachable-control-plane code, so a game can tell "wait" from
+   * "gone" (bug #36).
+   */
+  async ensure() {
+    if (this.token !== void 0) return this.token;
+    try {
+      return await this.mint();
+    } catch (err) {
+      if (!(err instanceof IdentityError) || err.code !== E_IDENTITY_RATE_LIMITED) throw err;
+      const wait = err.retryAfterMs ?? 6e4;
+      if (wait > MAX_IDENTITY_RETRY_WAIT_MS) throw err;
+      await sleep(wait);
+      return await this.mint();
+    }
+  }
+  async mint() {
+    const res = await this.post("/v1/identity", { project: this.project });
+    const body = await res.json();
+    if (typeof body.identity !== "string") {
+      throw new IdentityError("E_IDENTITY_MINT_FAILED", "the control plane returned no identity");
+    }
+    this.token = body.identity;
+    this.accountId = typeof body.account === "string" ? body.account : void 0;
+    try {
+      this.storage?.setItem(ACCOUNT_STORAGE_KEY, body.identity);
+    } catch {
+    }
+    return body.identity;
+  }
+  /**
+   * A currently-valid assertion for this project, exchanging one if the cached one is gone or
+   * within thirty seconds of expiry.
+   *
+   * The margin is what keeps a long reconnect from presenting a token that expires mid-handshake.
+   * Concurrent callers share one exchange, so a burst of reconnects is one HTTP request.
+   */
+  async assertion(now = Date.now()) {
+    const cached = this.cached;
+    if (cached && cached.expiresAtMs - 3e4 > now) return cached.assertion;
+    if (this.inFlight) return this.inFlight;
+    this.inFlight = this.exchange().finally(() => {
+      this.inFlight = void 0;
+    });
+    return this.inFlight;
+  }
+  async exchange() {
+    const identity = await this.ensure();
+    let res;
+    try {
+      res = await this.post("/v1/identity/assertion", { identity, project: this.project });
+    } catch (err) {
+      if (err instanceof IdentityError && err.code === "E_IDENTITY_INVALID") {
+        this.forget();
+        const fresh = await this.ensure();
+        res = await this.post("/v1/identity/assertion", { identity: fresh, project: this.project });
+      } else {
+        throw err;
+      }
+    }
+    const body = await res.json();
+    if (typeof body.assertion !== "string" || typeof body.playerId !== "string") {
+      throw new IdentityError(
+        "E_IDENTITY_EXCHANGE_FAILED",
+        "the control plane returned no assertion"
+      );
+    }
+    const ttl = typeof body.expiresInMs === "number" ? body.expiresInMs : 6e4;
+    this.cached = {
+      assertion: body.assertion,
+      playerId: body.playerId,
+      expiresAtMs: Date.now() + ttl
+    };
+    return body.assertion;
+  }
+  /** Drops the stored identity. The next `ensure()` mints a new player. */
+  forget() {
+    this.token = void 0;
+    this.accountId = void 0;
+    this.cached = void 0;
+    try {
+      this.storage?.removeItem(ACCOUNT_STORAGE_KEY);
+    } catch {
+    }
+  }
+  // -------------------------------------------------------------------------
+  // D61: linking a second device, and managing the ones already on the account
+  //
+  // Every call below presents the stored device credential in the `x-irt-identity` header, to the
+  // control plane, over HTTPS, and to nothing else. That is the same rule the module's header
+  // states about the credential generally, and these methods are the reason it needs restating:
+  // they are the first surface other than the exchange that the credential is sent to at all.
+  // -------------------------------------------------------------------------
+  /**
+   * Asks the control plane for a link code to read out on another device.
+   *
+   * The code is short and typable because a person carries it between two screens. Show it, do
+   * not store it, and let it expire: a code left on a screen for the ten minutes it lives is the
+   * one thing about this that a player controls.
+   */
+  async linkCode() {
+    const res = await this.accountFetch("POST", "/v1/account/link-code", {});
+    const body = await res.json();
+    if (typeof body.code !== "string") {
+      throw new IdentityError("E_LINK_CODE_FAILED", "the control plane returned no link code");
+    }
+    return {
+      code: body.code,
+      expiresInMs: typeof body.expiresInMs === "number" ? body.expiresInMs : 10 * 6e4
+    };
+  }
+  /**
+   * Redeems a code read off another device, and **replaces** this browser's credential with a new
+   * one on that code's account.
+   *
+   * Two things happen in that order and both matter. The new credential is stored first, so a
+   * failure between the two leaves the player linked rather than credential-less. Then whatever
+   * this browser used to be is retired on the account it is leaving.
+   *
+   * **That retirement deletes the old account when this was its only device**, rather than
+   * revoking the credential and walking away. Revoking the last device leaves an account nothing
+   * can ever authenticate as, whose board rows and saved games are then unreachable by the player
+   * and undeletable by anyone. An account with other devices only loses this one.
+   *
+   * So this call can destroy the progress held on THIS browser. Warn the player first; the docs
+   * page has wording for it. The retirement is best-effort: if it fails the link still stands,
+   * because failing a link that already worked is the worse direction.
+   */
+  async redeemLinkCode(code) {
+    const previous = this.token;
+    let previousDeviceId;
+    let previousWasOnlyDevice = false;
+    if (previous !== void 0) {
+      try {
+        const before = await this.devices();
+        previousDeviceId = before.self;
+        previousWasOnlyDevice = before.devices.length === 1;
+      } catch {
+        previousDeviceId = void 0;
+      }
+    }
+    const res = await this.post("/v1/account/link", { code }, `?project=${enc(this.project)}`);
+    const body = await res.json();
+    if (typeof body.identity !== "string" || typeof body.account !== "string") {
+      throw new IdentityError("E_LINK_FAILED", "the control plane returned no linked identity");
+    }
+    this.token = body.identity;
+    this.accountId = body.account;
+    this.cached = void 0;
+    try {
+      this.storage?.setItem(ACCOUNT_STORAGE_KEY, body.identity);
+    } catch {
+    }
+    if (previous !== void 0 && previousDeviceId !== void 0) {
+      try {
+        const url = previousWasOnlyDevice ? `${this.controlUrl}/v1/account?project=${enc(this.project)}` : `${this.controlUrl}/v1/account/devices/${enc(previousDeviceId)}?project=${enc(this.project)}`;
+        await this.fetchImpl(url, {
+          method: "DELETE",
+          headers: { "x-irt-identity": previous }
+        });
+      } catch {
+      }
+    }
+    return { account: body.account };
+  }
+  /** The devices on this account: ids and timestamps, plus which one this browser is. */
+  async devices() {
+    const res = await this.accountFetch("GET", "/v1/account/devices");
+    const body = await res.json();
+    if (typeof body.account !== "string" || !Array.isArray(body.devices)) {
+      throw new IdentityError("E_ACCOUNT_READ_FAILED", "the control plane returned no device list");
+    }
+    this.accountId = body.account;
+    return {
+      account: body.account,
+      self: typeof body.self === "string" ? body.self : "",
+      devices: body.devices
+    };
+  }
+  /**
+   * Revokes one device on this account. Revoking the device this browser IS leaves this instance
+   * holding a credential the control plane no longer knows, so it forgets it: the next `ensure()`
+   * mints a fresh player rather than looping on a refused exchange.
+   */
+  async revokeDevice(deviceId) {
+    let self;
+    try {
+      self = (await this.devices()).self;
+    } catch {
+      self = void 0;
+    }
+    await this.accountFetch("DELETE", `/v1/account/devices/${enc(deviceId)}`);
+    if (self !== void 0 && self === deviceId) this.forget();
+  }
+  /**
+   * Deletes this account and everything keyed on it, in every project it played, and forgets the
+   * credential. There is no undo and the control plane does not keep a copy.
+   */
+  async deleteAccount() {
+    await this.accountFetch("DELETE", "/v1/account");
+    this.forget();
+  }
+  /** The account id, once anything has told us what it is. Opaque; never parse it. */
+  get account() {
+    return this.accountId;
+  }
+  /** One authenticated account-route call: credential in the header, project in the query. */
+  async accountFetch(method, path, body) {
+    const identity = await this.ensure();
+    const url = `${this.controlUrl}${path}?project=${enc(this.project)}`;
+    let res;
+    try {
+      res = await this.fetchImpl(url, {
+        method,
+        headers: {
+          "content-type": "application/json",
+          // The credential goes here and nowhere else. Not in the URL: a query string reaches
+          // access logs, `Referer` headers and browser history, and this one is long-lived.
+          "x-irt-identity": identity
+        },
+        ...body === void 0 ? {} : { body: JSON.stringify(body) }
+      });
+    } catch (err) {
+      throw new IdentityError(
+        "E_IDENTITY_UNREACHABLE",
+        `cannot reach the control plane at ${this.controlUrl}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (res.ok) return res;
+    throw await errorFrom(res);
+  }
+  async post(path, body, query = "") {
+    let res;
+    try {
+      res = await this.fetchImpl(`${this.controlUrl}${path}${query}`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body)
+      });
+    } catch (err) {
+      throw new IdentityError(
+        "E_IDENTITY_UNREACHABLE",
+        `cannot reach the control plane at ${this.controlUrl}: ${err instanceof Error ? err.message : String(err)}`
+      );
+    }
+    if (res.ok) return res;
+    throw await errorFrom(res);
+  }
+};
+function enc(value) {
+  return encodeURIComponent(value);
+}
+async function errorFrom(res) {
+  const text = await res.text().catch(() => "");
+  let code = `E_HTTP_${res.status}`;
+  let message = text || `request failed with status ${res.status}`;
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+    if (typeof parsed.code === "string") code = parsed.code;
+    if (typeof parsed.message === "string") message = parsed.message;
+  } catch {
+  }
+  if (res.status === 429) {
+    const retryAfterMs = retryAfterMsFrom(res, parsed);
+    return new IdentityError(
+      E_IDENTITY_RATE_LIMITED,
+      `${message} (rate limited; retry in ${Math.round(retryAfterMs / 1e3)}s)`,
+      retryAfterMs
+    );
+  }
+  return new IdentityError(code, message);
+}
+
 // src/session.ts
 import {
   FrameType,
   PROTOCOL_VERSION,
+  ProfileLedger,
   RELAY_HASH8,
   decodeCall,
   decodeErrorPayload,
@@ -134,21 +518,26 @@ import {
   formatError,
   readCorrectAppliedTick,
   readCorrectClientTick,
+  readSchemaPayload,
   relaySchema,
   rpcTable,
   withBuiltins
 } from "@irtio/protocol";
+import { EMPTY_PROFILE, diffProfiles, scaleProfile } from "@irtio/protocol";
 import {
   ByteReader,
   decodeDelta,
   decodeDeltaFrom,
   decodeFields,
-  encodeFields
+  encodeFields,
+  schemaFromCanonical
 } from "@irtio/schema";
 
 // src/render.ts
 var NUMERIC = /* @__PURE__ */ new Set(["u8", "u16", "u32", "i32", "f32", "f64"]);
 var INTEGER = /* @__PURE__ */ new Set(["u8", "u16", "u32", "i32"]);
+var BASE_DRIFT_MS_PER_S = 2;
+var SAME_T_EPSILON = 0.01;
 function cloneRecord(value) {
   const out = {};
   for (const [k, v] of Object.entries(value)) {
@@ -176,29 +565,61 @@ function lerpRecord(desc, a, b, alpha) {
   return out;
 }
 var RenderStore = class {
-  constructor(ext, store, meOf, now, delayMs) {
+  constructor(ext, store, meOf, now, delayMs, intervalMs) {
     this.ext = ext;
     this.store = store;
     this.meOf = meOf;
     this.now = now;
     this.delayMs = delayMs;
+    this.intervalMs = intervalMs;
     for (const c of ext.collections) this.descs.set(c.name, c);
-    this.view = this.buildView();
+    this.view = {};
+    this.buildViewInto(this.view);
   }
   ext;
   store;
   meOf;
   now;
   delayMs;
+  intervalMs;
   /** collection → id → buffered keyframes. Only interpolating entity collections have entries. */
   buffers = /* @__PURE__ */ new Map();
   descs = /* @__PURE__ */ new Map();
+  /** Live collection facades by name, so a D50 swap can retarget rather than replace them. */
+  facades = /* @__PURE__ */ new Map();
   /** The object handed out as `room.render`; identity survives a resync. */
   view;
   /** Render reads that ran past the newest delta and held it (buffer starvation, D20). */
   starved = 0;
   /** D22 part 2: set when the session predicts physics bodies; render reads consult it first. */
   predictor;
+  /**
+   * The offset between the server's tick clock and this client's `now()`: a frame for tick `n`
+   * is stamped `base + n × intervalMs`. Undefined until the first delta of a connection.
+   */
+  base;
+  /** `now()` at the last `base` move; bounds how far the upward drift correction may go. */
+  baseAt = 0;
+  /**
+   * D50: rebuild against `newExt`, keeping `view`'s identity and every collection facade behind
+   * it, exactly as `ClientStore.swapSchema` does.
+   *
+   * Every interpolation buffer is dropped. A keyframe is a plain record whose fields were laid
+   * out by the old descriptor, and `lerpRecord` walks `desc.fields` — interpolating an old
+   * keyframe against a new one under the new field list is precisely the silent misread this
+   * whole part exists to avoid. `seedSnapshot`, called moments later off the resync WELCOME,
+   * re-seeds one keyframe per entity, which is the same state the buffers would have started
+   * from on a reconnect.
+   */
+  swapSchema(newExt) {
+    this.ext = newExt;
+    this.descs.clear();
+    for (const c of newExt.collections) this.descs.set(c.name, c);
+    this.buffers.clear();
+    this.starved = 0;
+    this.base = void 0;
+    this.buildViewInto(this.view);
+  }
   // -- ingest ---------------------------------------------------------------
   /**
    * Seeds one keyframe per existing entity from a `WELCOME` snapshot, backdated by the delay so
@@ -207,6 +628,7 @@ var RenderStore = class {
    */
   seedSnapshot() {
     this.buffers.clear();
+    this.base = void 0;
     const t = this.now() - this.delayMs();
     for (const c of this.ext.collections) {
       if (c.kind !== "entity" || !c.interpolate) continue;
@@ -219,9 +641,39 @@ var RenderStore = class {
       }
     }
   }
-  /** Buffers every entity a `DELTA` touched, stamped with its arrival time. Call after apply. */
+  /**
+   * Maps `tick` onto the client clock, or returns `undefined` when the tick interval is unknown
+   * and the caller must fall back to arrival stamping.
+   *
+   * The offset is the minimum of `now() − tick × intervalMs` over the connection: the least
+   * delayed delta seen so far is the best evidence of where the server's tick clock sits, and
+   * every later delta is that plus its own queueing delay. So a better sample is taken
+   * immediately, a worse one only bleeds in at drift speed, and a discontinuity larger than the
+   * render window (hibernation wake, a backgrounded tab's clock jump, a tick stall) is a new
+   * clock rather than a late frame and snaps.
+   */
+  stampFor(tick) {
+    const interval = this.intervalMs();
+    if (!(interval > 0)) return void 0;
+    const now = this.now();
+    const cand = now - tick * interval;
+    if (this.base === void 0 || cand < this.base || Math.abs(cand - this.base) > this.snapMs()) {
+      this.base = cand;
+    } else {
+      this.base = Math.min(cand, this.base + (now - this.baseAt) * (BASE_DRIFT_MS_PER_S / 1e3));
+    }
+    this.baseAt = now;
+    return Math.min(this.base + tick * interval, now);
+  }
+  snapMs() {
+    return Math.max(250, 4 * this.delayMs());
+  }
+  /**
+   * Buffers every entity a `DELTA` touched, stamped on the server's tick clock so delivery
+   * burstiness cannot modulate the drawn velocity. Call after apply.
+   */
   recordDelta(delta) {
-    const t = this.now();
+    const t = this.stampFor(delta.tick) ?? this.now();
     for (const dc of delta.collections) {
       const desc = this.descs.get(dc.name);
       if (!desc || desc.kind !== "entity" || !desc.interpolate) continue;
@@ -236,10 +688,26 @@ var RenderStore = class {
         if (value === void 0) continue;
         const buffer = this.bufferFor(dc.name, op.id);
         buffer.removedAt = void 0;
-        buffer.frames.push({ t, value: cloneRecord(value) });
+        this.pushFrame(buffer, t, cloneRecord(value));
       }
     }
   }
+  /**
+   * Appends one keyframe, keeping `frames` strictly ascending in `t` — `prune` and the lerp both
+   * depend on it. Two constraints meet here: the hybrid spatial encode sends two DELTA frames for
+   * a single tick, whose tick-derived stamps are equal, so the second one replaces rather than
+   * appends; and an offset that just snapped backwards must not stamp behind what is buffered.
+   */
+  pushFrame(buffer, t, value) {
+    const newest = buffer.frames[buffer.frames.length - 1];
+    if (newest && t <= newest.t) {
+      if (t >= newest.t - SAME_T_EPSILON)
+        buffer.frames[buffer.frames.length - 1] = { t: newest.t, value };
+      else buffer.frames.push({ t: newest.t + SAME_T_EPSILON, value });
+      return;
+    }
+    buffer.frames.push({ t, value });
+  }
   bufferFor(collection, id) {
     let byId = this.buffers.get(collection);
     if (!byId) {
@@ -270,7 +738,7 @@ var RenderStore = class {
         if (value !== void 0) return this.predictor.read(desc, id, { ...value });
       }
     }
-    if (!desc.serverOwned && coll.has(id) && coll.ownerOf(id) === this.meOf()) {
+    if (!desc.serverOwned && (!desc.physics || this.predictor) && coll.has(id) && coll.ownerOf(id) === this.meOf()) {
       return this.store.instance(desc, id);
     }
     if (!desc.interpolate) return this.store.instance(desc, id);
@@ -292,14 +760,17 @@ var RenderStore = class {
       if (renderT > a.t) this.starved++;
       return cloneRecord(a.value);
     }
-    const alpha = (renderT - a.t) / (b.t - a.t);
+    const span = b.t - a.t;
+    const alpha = span > 0 ? (renderT - a.t) / span : 1;
     return lerpRecord(desc, a.value, b.value, Math.min(1, Math.max(0, alpha)));
   }
   /** Is `collection[id]` visible at the render clock? */
   has(desc, id) {
     const coll = this.store.plain[desc.name];
     if (this.predictor && desc.physics && this.predictor.has(desc.name, id)) return coll.has(id);
-    if (!desc.serverOwned && coll.has(id) && coll.ownerOf(id) === this.meOf()) return true;
+    if (!desc.serverOwned && (!desc.physics || this.predictor) && coll.has(id) && coll.ownerOf(id) === this.meOf()) {
+      return true;
+    }
     if (!desc.interpolate) return coll.has(id);
     const buffer = this.buffers.get(desc.name)?.get(id);
     if (!buffer || buffer.frames.length === 0) return coll.has(id);
@@ -345,20 +816,39 @@ var RenderStore = class {
     if (byId && byId.size === 0) this.buffers.delete(collection);
   }
   // -- view -----------------------------------------------------------------
-  buildView() {
-    const view = {};
+  /** See `ClientStore.buildViewInto`: same contract, same reasons, one object reused forever. */
+  buildViewInto(view) {
+    const names = /* @__PURE__ */ new Set();
     for (const c of this.ext.collections) {
+      names.add(c.name);
       if (c.kind === "entity") {
-        const facade = withRenderIndexSugar(new RenderCollectionImpl(this, c));
-        Object.defineProperty(view, c.name, { get: () => facade, enumerable: true });
+        const existing = this.facades.get(c.name);
+        if (existing) {
+          existing.retarget(c);
+          continue;
+        }
+        const impl = new RenderCollectionImpl(this, c);
+        this.facades.set(c.name, impl);
+        const facade = withRenderIndexSugar(impl);
+        Object.defineProperty(view, c.name, {
+          get: () => facade,
+          enumerable: true,
+          configurable: true
+        });
       } else {
         Object.defineProperty(view, c.name, {
           get: () => this.store.view[c.name],
-          enumerable: true
+          enumerable: true,
+          configurable: true
         });
       }
     }
-    return view;
+    for (const name of Object.keys(view)) {
+      if (!names.has(name)) {
+        delete view[name];
+        this.facades.delete(name);
+      }
+    }
   }
 };
 var RenderCollectionImpl = class {
@@ -368,6 +858,10 @@ var RenderCollectionImpl = class {
   }
   render;
   desc;
+  /** D50: point this facade at the same collection in a rebuilt schema. */
+  retarget(desc) {
+    this.desc = desc;
+  }
   get(id) {
     return this.render.get(this.desc, id);
   }
@@ -497,6 +991,7 @@ var webSocketTransport = {
 };
 
 // src/session.ts
+var PROFILE_WINDOW_MS = 1e3;
 var DEFAULT_WRITE_INTERVAL_MS = 50;
 var PING_INTERVAL_MS = 2e3;
 var RTT_ALPHA = 0.3;
@@ -513,9 +1008,11 @@ function nameOfCode(code) {
     return "E_INTERNAL";
   }
 }
+var INTERNAL_SESSION = /* @__PURE__ */ Symbol("irtio.session");
 var Session = class {
   constructor(options) {
     this.options = options;
+    this.schema = options.schema;
     this.ext = options.schema ? withBuiltins(options.schema) : relaySchema;
     this.rpcSchema = options.schema ?? relaySchema;
     this.transport = options.transport ?? webSocketTransport;
@@ -524,52 +1021,91 @@ var Session = class {
     this.impls = new Map(Object.entries(options.rpc ?? {}));
     this.roomId = options.roomId;
     this.role = options.role ?? "";
+    this.ledger = options.profile === true ? new ProfileLedger(this.ext, this.rpcSchema) : void 0;
     this.store = new ClientStore(this.ext, () => this.me);
     this.render = new RenderStore(
       this.ext,
       this.store,
       () => this.me,
       () => this.scheduler.now(),
-      () => this.interpDelayMs
+      () => this.interpDelayMs,
+      () => this.tickIntervalMs
     );
     const hasPhysics = this.ext.collections.some(
       (c) => c.physics !== void 0
     );
-    if (options.physics && hasPhysics) {
-      const physics = options.physics;
+    const attach = (predictor) => {
+      if (this.left) return;
+      this.predictor = predictor;
+      this.render.attachPredictor(predictor);
+      if (this.joined) {
+        predictor.reset();
+        void predictor.start();
+      }
+    };
+    const physics = options.physics;
+    const physics2d = options.physics2d;
+    if (physics && hasPhysics) {
       this.predictionRequested = true;
-      void import("./physics-H2VDQLAU.js").then(({ PhysicsPredictor }) => {
+      void import("./physics-S5LHL3HK.js").then(({ PhysicsPredictor }) => {
         if (this.left) return;
-        const predictor = new PhysicsPredictor(
-          this.ext,
-          this.store,
-          physics,
-          () => this.me,
-          () => this.rtt,
-          () => this.tickIntervalMs
+        attach(
+          new PhysicsPredictor(
+            this.ext,
+            this.store,
+            physics,
+            () => this.me,
+            () => this.rtt,
+            () => this.tickIntervalMs
+          )
+        );
+      });
+    } else if (physics2d && hasPhysics) {
+      this.predictionRequested = true;
+      void import("./physics2d-ZV2IRRRZ.js").then(({ Physics2dPredictor }) => {
+        if (this.left) return;
+        attach(
+          new Physics2dPredictor(
+            this.ext,
+            this.store,
+            physics2d,
+            () => this.me,
+            () => this.rtt,
+            () => this.tickIntervalMs
+          )
         );
-        this.predictor = predictor;
-        this.render.attachPredictor(predictor);
-        if (this.joined) {
-          predictor.reset();
-          void predictor.start();
-        }
       });
     }
   }
   options;
+  /**
+   * D50: not `readonly`. `swapSchema` replaces it when an additive deploy hands this session a
+   * new descriptor mid-flight. Everything that decodes a frame reads it through `this`, so the
+   * single assignment below is what actually moves the session onto the new schema.
+   */
   ext;
   store;
   render;
-  /** `true` when the join passed `physics` and the schema has body-backed collections. */
+  /** `true` when the join passed an engine option and the schema has body-backed collections. */
   predictionRequested = false;
   /**
-   * Present once `./physics.js` has loaded (dynamic import — the predictor code, like the
-   * engine, costs a non-physics game zero bytes). Reads fall back to interpolation until then.
+   * Present once the engine's adapter module has loaded — `./physics.js` for `physics`,
+   * `./physics2d.js` for `physics2d`, each behind a dynamic import, so the predictor code and its
+   * engine cost a non-physics game (or the other engine's game) zero bytes. Reads fall back to
+   * interpolation until then.
    */
   predictor;
-  /** The schema the `CALL`/`REPLY` rpc id space indexes into. */
+  /** The schema the `CALL`/`REPLY` rpc id space indexes into. D50: swappable, see `swapSchema`. */
   rpcSchema;
+  /**
+   * The BUILDER schema this session is currently on: `options.schema` at construction, then
+   * whatever a `SCHEMA` frame replaced it with. Read instead of `options.schema` everywhere, so a
+   * swapped session announces its *current* hash when it reconnects rather than the one it was
+   * born with — otherwise a resume after a swap would be refused as a mismatch.
+   */
+  schema;
+  /** D50: how many times this session has swapped schema. Test seam and a diagnostic. */
+  schemaSwaps = 0;
   transport;
   scheduler;
   writeIntervalMs;
@@ -587,7 +1123,10 @@ var Session = class {
    */
   writeTick = 0;
   /** The room's tick interval from `WELCOME`, or 0 when unknown (relay / pre-week-8 server). */
+  /** Milliseconds per tick, derived from the rate in `WELCOME`. 0 when the room has no tick. */
   tickIntervalMs = 0;
+  /** The room's client cap from `WELCOME`, or 0 when unknown (relay / pre-this-field server). */
+  maxClients = 0;
   rtt = 0;
   status = "connecting";
   socket;
@@ -612,6 +1151,20 @@ var Session = class {
   pending = /* @__PURE__ */ new Map();
   listeners = /* @__PURE__ */ new Map();
   messageListeners = /* @__PURE__ */ new Set();
+  /**
+   * D51: voice signaling listeners, kept in their own set rather than sharing `messageListeners`.
+   *
+   * The isolation clause has a client half as well as a server half. The supervisor guarantees that
+   * a room handler never observes `{ kind: 'voice' }`; this set is what guarantees the same for a
+   * *game*, which holds the other end of the same socket and whose `room.onMessage` would otherwise
+   * receive every transport parameter and DTLS fingerprint in the call. Splitting the sets makes
+   * the property structural — there is no `!== 'voice'` filter to forget somewhere in the fan-out,
+   * and no ordering between two callbacks to get wrong.
+   *
+   * Nothing on the public `Room` type can reach this set. `joinVoice` gets at it through
+   * `INTERNAL_SESSION`, the same route the D50 tests use for the session itself.
+   */
+  voiceListeners = /* @__PURE__ */ new Set();
   cancelFlush;
   cancelPing;
   cancelRetry;
@@ -680,6 +1233,19 @@ var Session = class {
   }
   async sendHello(socket) {
     let token;
+    let assertion;
+    const suppliedAssertion = this.options.assertion;
+    if (suppliedAssertion !== void 0) {
+      try {
+        assertion = await suppliedAssertion();
+      } catch (err) {
+        this.transportFailed(
+          err instanceof Error ? err : new Error(`identity provider failed: ${String(err)}`)
+        );
+        return;
+      }
+      if (this.socket !== socket || !this.socketOpen || this.left) return;
+    }
     const supplied = this.options.token;
     if (supplied !== void 0) {
       try {
@@ -692,15 +1258,20 @@ var Session = class {
       }
       if (this.socket !== socket || !this.socketOpen || this.left) return;
     }
-    const hash8 = this.options.schema ? this.options.schema.hash8 : RELAY_HASH8;
+    const hash8 = this.schema ? this.schema.hash8 : RELAY_HASH8;
     const hello = encodeHello({
       protocolVersion: PROTOCOL_VERSION,
-      credential: token !== void 0 ? { kind: "jwt", key: this.options.key, token } : { kind: "key", key: this.options.key },
+      credential: assertion !== void 0 ? { kind: "assertion", key: this.options.key, token: assertion } : token !== void 0 ? { kind: "jwt", key: this.options.key, token } : { kind: "key", key: this.options.key },
       roomId: this.roomId,
       schemaHash8: hash8,
       ...this.resumeToken !== void 0 ? { resumeToken: this.resumeToken } : {},
       ...this.options.role !== void 0 ? { role: this.options.role } : {},
-      ...this.options.name !== void 0 ? { name: this.options.name } : {}
+      ...this.options.name !== void 0 ? { name: this.options.name } : {},
+      // D50: this client can rebuild its codec from a SCHEMA frame. Announced unconditionally for
+      // a schema'd session — there is nothing to opt out of, the server still decides, and a
+      // server that predates the bit ignores it (it reads the mask it knows and stops).
+      // A relay session has no schema to swap, so it does not ask.
+      ...this.schema !== void 0 ? { schemaSwap: true } : {}
     });
     this.send(FrameType.HELLO, hello);
   }
@@ -765,10 +1336,43 @@ var Session = class {
   // -------------------------------------------------------------------------
   // Frames
   // -------------------------------------------------------------------------
+  /**
+   * D65: the session's bandwidth ledger, present only when the join asked for one. A second
+   * consumer of the same seam `onFrame` uses (the bots' observer is the first), so the two
+   * compose rather than compete.
+   */
+  ledger;
+  /** D65: the rolling window `room.profile.perSecond()` reads, advanced on the session clock. */
+  profileWindow;
+  /**
+   * D65: bytes per second over a rolling window of about a second, measured on the scheduler's
+   * clock rather than `Date.now()` so a test with a fake clock gets a deterministic answer.
+   *
+   * The window advances only when somebody reads it: a reader at 1 Hz (the overlay) gets a
+   * one-second window, and a reader that never calls costs nothing. A read sooner than a second
+   * after the last one is extrapolated from the partial window rather than returning zeros.
+   */
+  profilePerSecond() {
+    const ledger = this.ledger;
+    if (!ledger) return EMPTY_PROFILE;
+    const now = this.scheduler.now();
+    const snap = ledger.snapshot();
+    const previous = this.profileWindow;
+    if (!previous) {
+      this.profileWindow = { at: now, snap };
+      return EMPTY_PROFILE;
+    }
+    const elapsed = now - previous.at;
+    if (elapsed <= 0) return EMPTY_PROFILE;
+    const window = diffProfiles(previous.snap, snap);
+    if (elapsed >= PROFILE_WINDOW_MS) this.profileWindow = { at: now, snap };
+    return scaleProfile(window, elapsed / PROFILE_WINDOW_MS);
+  }
   send(type, payload) {
     if (!this.socketOpen || !this.socket) return;
     const frame = encodeFrame(type, payload);
     this.options.onFrame?.("out", type, frame);
+    this.ledger?.attribute("out", frame, { spatialChurn: true });
     this.socket.send(frame);
   }
   onFrame(bytes) {
@@ -783,6 +1387,7 @@ var Session = class {
       return;
     }
     this.options.onFrame?.("in", type, bytes);
+    this.ledger?.attribute("in", bytes, { spatialChurn: true });
     try {
       switch (type) {
         case FrameType.WELCOME:
@@ -806,6 +1411,9 @@ var Session = class {
         case FrameType.REPLY:
           this.onReply(payload);
           return;
+        case FrameType.SCHEMA:
+          this.onSchema(payload);
+          return;
         default:
           if (type === FrameType.MSG) this.onMsg(payload);
           return;
@@ -822,6 +1430,72 @@ var Session = class {
       fatal: false
     });
   }
+  /**
+   * D50: a `SCHEMA` frame landed. The server sends one during an additive `migrate` deploy, after
+   * the old worker has stopped sending and before the resync WELCOME, so this session can stay
+   * open across a deploy instead of being closed with `E_SCHEMA_MISMATCH`.
+   *
+   * A decode failure here is reported as a non-fatal error and the swap is abandoned. That leaves
+   * the session on the old schema with a resync WELCOME about to arrive under the new one, which
+   * it will fail to decode — noisy, but noisy is the correct failure: the alternative is decoding
+   * it anyway under the wrong descriptor, and a misdecode is silent.
+   */
+  onSchema(payload) {
+    const canonical = readSchemaPayload(payload);
+    this.swapSchema(canonical);
+  }
+  /**
+   * The one entry point for a mid-session schema change. Internal: not part of the public client
+   * API this release, and not called from anywhere but `onSchema`.
+   *
+   * **What is rebuilt.** Every schema-derived handle in the client, top down:
+   *
+   *  - `schema` / `ext` / `rpcSchema` here, which is what every `decodeDelta`, `encodeDelta`,
+   *    `decodeSnapshot` and rpc-id lookup reads through;
+   *  - `descsByName`, the correction path's collection index, invalidated so it re-derives;
+   *  - `ClientStore`: `ext`, its descriptor map, `plain`, `tracked`, and the per-collection
+   *    facades behind `room.state` — retargeted, not replaced;
+   *  - `RenderStore`: the same, plus every interpolation buffer;
+   *  - `PhysicsPredictor`, when one exists: its predicted-collection list and its live bodies.
+   *
+   * **What is dropped, and why** (part 4 plan §1.3). Everything below is state that was laid out
+   * by the old descriptors and has no correct reading under the new ones. The resync WELCOME
+   * arriving immediately after re-establishes all of it, which is what makes dropping cheap:
+   *
+   *  - the authoritative state (`plain`) and its tracked proxy tree — re-seeded by `loadSnapshot`;
+   *  - flushed-but-unjudged writes, the evicted-tick watermark and the baseline intents — a
+   *    resync already discards these (see `ClientStore.loadSnapshot`), and their field names are
+   *    indexed against descriptors that no longer exist;
+   *  - every render interpolation keyframe — `lerpRecord` walks `desc.fields`, so mixing a
+   *    pre-swap keyframe with a post-swap one is a silent misread. `seedSnapshot` re-seeds from
+   *    the WELCOME;
+   *  - every predicted body and its pose ring — `PhysicsPredictor.reset()`'s existing job.
+   *
+   * **What is deliberately NOT dropped: in-flight calls** (§1.2, the default rule). A `PendingCall`
+   * captured its `returns` descriptor at the moment it was issued, and the REPLY it is waiting for
+   * was produced by a room that had those params in hand. So a call issued before the swap keeps
+   * decoding its reply under the schema it was issued with, and resolves normally afterwards. This
+   * costs nothing to implement — the descriptor is already captured per call rather than looked up
+   * at reply time — and it is the honest semantics: the call did happen, under the old contract.
+   *
+   * The narrow case this leaves is a REPLY whose *shape* changed additively between the two
+   * schemas. Decoding it under the old `returns` reads the fields the caller asked for and stops,
+   * which is exactly what an appended field means. A breaking change to an RPC never reaches here:
+   * it classifies breaking and the session is closed instead.
+   */
+  swapSchema(canonical) {
+    const next = schemaFromCanonical(canonical);
+    if (this.schema && next.hash === this.schema.hash) return;
+    this.schema = next;
+    this.ext = withBuiltins(next);
+    this.rpcSchema = next;
+    this.descsByName = void 0;
+    this.store.swapSchema(this.ext);
+    this.render.swapSchema(this.ext);
+    this.ledger?.swapSchema(this.ext, this.rpcSchema);
+    this.predictor?.swapSchema(this.ext);
+    this.schemaSwaps++;
+  }
   onWelcome(payload) {
     const welcome = decodeWelcome(payload);
     const pending = this.store.capturePendingWrites();
@@ -829,11 +1503,13 @@ var Session = class {
     this.role = welcome.role;
     this.tick = welcome.tick;
     this.resumeToken = welcome.resumeToken;
-    this.tickIntervalMs = welcome.tickIntervalMs;
+    this.tickIntervalMs = welcome.tickRate > 0 ? 1e3 / welcome.tickRate : 0;
+    this.maxClients = welcome.maxClients;
     if (welcome.roomId !== "") this.roomId = welcome.roomId;
     this.store.loadSnapshot(welcome.snapshot);
     this.store.applyPendingWrites(pending);
     this.render.seedSnapshot();
+    this.emit("clients", this.clients);
     if (this.predictor) {
       this.predictor.reset();
       void this.predictor.start();
@@ -859,6 +1535,9 @@ var Session = class {
       this.predictor.noteAuthority(delta.tick);
       this.predictor.frame(this.scheduler.now());
     }
+    if (delta.collections.some((dc) => dc.name === "clients")) {
+      this.emit("clients", this.clients);
+    }
   }
   onCorrect(payload) {
     const r = new ByteReader(payload);
@@ -897,6 +1576,9 @@ var Session = class {
       this.predictor.noteAuthority(delta.tick);
       this.predictor.frame(this.scheduler.now());
     }
+    if (delta.collections.some((dc) => dc.name === "clients")) {
+      this.emit("clients", this.clients);
+    }
   }
   descsByName;
   descOfCollection(name) {
@@ -942,12 +1624,17 @@ var Session = class {
     const pong = decodePong(payload);
     const sample = Math.max(1, (this.scheduler.now() >>> 0) - pong.t >>> 0);
     this.rtt = this.rtt === 0 ? sample : Math.max(1, Math.round(this.rtt + (sample - this.rtt) * RTT_ALPHA));
+    this.emit("rtt", this.rtt);
     if (pong.serverTick > this.tick) this.tick = pong.serverTick;
   }
   onMsg(payload) {
     const msg = decodeMsg(payload);
-    const from = msg.target.kind === "client" ? msg.target.clientId : "server";
     const bytes = msg.payload.slice();
+    if (msg.target.kind === "voice") {
+      for (const cb of [...this.voiceListeners]) cb(bytes);
+      return;
+    }
+    const from = msg.target.kind === "client" ? msg.target.clientId : "server";
     for (const cb of [...this.messageListeners]) cb(from, bytes);
   }
   // -------------------------------------------------------------------------
@@ -1145,6 +1832,25 @@ var Session = class {
       this.messageListeners.delete(cb);
     };
   }
+  /**
+   * D51: write one voice signaling message. Internal — reached only through `INTERNAL_SESSION`,
+   * so it is not on the `Room` type and a game cannot call it.
+   *
+   * This deliberately does NOT go through `message()`. `MessageTarget` has no voice member on
+   * purpose (that is the third of the three isolation mechanisms), and widening it so that this
+   * method could share the mapping would delete the mechanism to save four lines. Building the
+   * `MsgTarget` here keeps `{ kind: 'voice' }` unrepresentable from anywhere a game can reach.
+   */
+  sendVoice(bytes) {
+    this.send(FrameType.MSG, encodeMsg({ target: { kind: "voice" }, payload: bytes }));
+  }
+  /** D51: subscribe to voice signaling replies. Internal, for the same reason as `sendVoice`. */
+  onVoice(cb) {
+    this.voiceListeners.add(cb);
+    return () => {
+      this.voiceListeners.delete(cb);
+    };
+  }
   get clients() {
     const coll = this.store.plain.clients;
     if (!coll) return [];
@@ -1187,6 +1893,458 @@ function resolveKey(explicit, schema, url) {
   );
 }
 
+// src/match.ts
+var MatchError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+  name = "MatchError";
+};
+async function findMatch(project, options = {}) {
+  const controlUrl = (options.controlUrl ?? DEFAULT_CONTROL_URL).replace(/\/+$/, "");
+  const fetchImpl = options.fetch ?? fetch;
+  let res;
+  try {
+    res = await fetchImpl(`${controlUrl}/match`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({
+        project,
+        ...options.queue !== void 0 ? { queue: options.queue } : {},
+        ...options.party !== void 0 ? { party: options.party } : {},
+        ...options.identity !== void 0 ? { identity: options.identity } : {},
+        ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {}
+      })
+    });
+  } catch (err) {
+    throw new MatchError(
+      "E_MATCH_UNREACHABLE",
+      `cannot reach the matchmaker at ${controlUrl}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const text = await res.text().catch(() => "");
+  let body = {};
+  try {
+    body = JSON.parse(text);
+  } catch {
+  }
+  if (!res.ok) {
+    throw new MatchError(
+      typeof body.code === "string" ? body.code : `E_HTTP_${res.status}`,
+      typeof body.message === "string" ? body.message : `match failed with status ${res.status}`
+    );
+  }
+  if (body.status === "timeout") {
+    throw new MatchError(
+      "E_NO_MATCH",
+      `no match in the ${String(body.queue)} queue: ${String(body.waiting)} of ${String(
+        body.size
+      )} players were waiting. Try again, or bring a friend.`
+    );
+  }
+  if (body.status !== "matched" || typeof body.room !== "string") {
+    throw new MatchError("E_MATCH_MALFORMED", "the matchmaker answered something unexpected");
+  }
+  return {
+    room: body.room,
+    queue: typeof body.queue === "string" ? body.queue : "default",
+    seat: typeof body.seat === "number" ? body.seat : 0,
+    size: typeof body.size === "number" ? body.size : 0,
+    backfill: body.backfill === true
+  };
+}
+async function createParty(project, options) {
+  const controlUrl = (options.controlUrl ?? DEFAULT_CONTROL_URL).replace(/\/+$/, "");
+  const fetchImpl = options.fetch ?? fetch;
+  let res;
+  try {
+    res = await fetchImpl(`${controlUrl}/match/party`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ project, size: options.size })
+    });
+  } catch (err) {
+    throw new MatchError(
+      "E_MATCH_UNREACHABLE",
+      `cannot reach the matchmaker at ${controlUrl}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const text = await res.text().catch(() => "");
+  let body = {};
+  try {
+    body = JSON.parse(text);
+  } catch {
+  }
+  if (!res.ok) {
+    throw new MatchError(
+      typeof body.code === "string" ? body.code : `E_HTTP_${res.status}`,
+      typeof body.message === "string" ? body.message : `party failed with status ${res.status}`
+    );
+  }
+  if (typeof body.party !== "string") {
+    throw new MatchError("E_MATCH_MALFORMED", "the matchmaker answered something unexpected");
+  }
+  return {
+    party: body.party,
+    expiresInMs: typeof body.expiresInMs === "number" ? body.expiresInMs : 0
+  };
+}
+async function matchRoom(schema, options = {}) {
+  const project = schema.project;
+  const key = options.key ?? (typeof project === "string" ? project : void 0);
+  if (key === void 0 || key === "") {
+    throw new MatchError(
+      "E_MATCH_NO_PROJECT",
+      "matchRoom needs a project key: build your schema with `irtio` so it carries one, or pass { key }"
+    );
+  }
+  const identity = options.identity === true ? new Identity({
+    project: key,
+    controlUrl: options.controlUrl,
+    fetch: options.fetch
+  }) : void 0;
+  const ticket = await findMatch(key, {
+    ...options.queue !== void 0 ? { queue: options.queue } : {},
+    ...options.party !== void 0 ? { party: options.party } : {},
+    ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
+    ...options.controlUrl !== void 0 ? { controlUrl: options.controlUrl } : {},
+    ...options.fetch !== void 0 ? { fetch: options.fetch } : {},
+    ...identity !== void 0 ? { identity: await identity.ensure() } : {}
+  });
+  try {
+    return await joinRoom(schema, { ...options, room: ticket.room });
+  } catch (err) {
+    if (!ticket.backfill || !isRoomFull(err)) throw err;
+    const second = await findMatch(key, {
+      ...options.queue !== void 0 ? { queue: options.queue } : {},
+      ...options.party !== void 0 ? { party: options.party } : {},
+      ...options.timeoutMs !== void 0 ? { timeoutMs: options.timeoutMs } : {},
+      ...options.controlUrl !== void 0 ? { controlUrl: options.controlUrl } : {},
+      ...options.fetch !== void 0 ? { fetch: options.fetch } : {},
+      ...identity !== void 0 ? { identity: await identity.ensure() } : {}
+    });
+    return joinRoom(schema, { ...options, room: second.room });
+  }
+}
+function isRoomFull(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return message.startsWith("E_ROOM_FULL");
+}
+
+// src/voice.ts
+import {
+  decodeVoiceMessage,
+  encodeVoiceMessage
+} from "@irtio/protocol";
+var INTERNAL_VOICE_TRACKS = /* @__PURE__ */ Symbol.for("irtio.voice.tracks");
+function browserFactory() {
+  return {
+    createDevice: async () => {
+      const mod = await import("mediasoup-client");
+      return new mod.Device();
+    },
+    getMicTrack: async () => {
+      const media = globalThis.navigator?.mediaDevices;
+      if (!media?.getUserMedia) {
+        throw new Error("irtio voice: getUserMedia is unavailable (needs a secure context)");
+      }
+      const stream = await media.getUserMedia({
+        audio: { echoCancellation: true, noiseSuppression: true, autoGainControl: true },
+        video: false
+      });
+      const track = stream.getAudioTracks()[0];
+      if (!track) throw new Error("irtio voice: no audio track from getUserMedia");
+      return track;
+    },
+    attach: (peerId, track) => {
+      const doc = globalThis.document;
+      if (!doc) {
+        return {
+          detach: () => track.stop(),
+          setVolume: () => void 0,
+          setMuted: () => void 0
+        };
+      }
+      const el = doc.createElement("audio");
+      el.autoplay = true;
+      el.setAttribute("playsinline", "");
+      el.dataset.irtioVoicePeer = peerId;
+      el.style.display = "none";
+      el.srcObject = new MediaStream([track]);
+      doc.body.appendChild(el);
+      return {
+        detach: () => {
+          el.srcObject = null;
+          el.remove();
+          track.stop();
+        },
+        setVolume: (volume) => {
+          el.volume = volume;
+        },
+        setMuted: (muted) => {
+          el.muted = muted;
+        }
+      };
+    }
+  };
+}
+function asPlayback(result) {
+  return typeof result === "function" ? { detach: result, setVolume: () => void 0, setMuted: () => void 0 } : result;
+}
+async function joinVoice(room, options = {}) {
+  const internals = {
+    ...browserFactory(),
+    ...options.__transportFactory
+  };
+  const session = room[INTERNAL_SESSION];
+  if (!session) {
+    throw new Error("irtio voice: joinVoice needs a Room from joinRoom()");
+  }
+  if (options.positional === true) {
+    console.warn(
+      "irtio voice: positional audio is not in this release; joinVoice({ positional: true }) produces ordinary flat audio. The option is accepted so calling code keeps working."
+    );
+  }
+  const listeners = /* @__PURE__ */ new Map();
+  const emit = (event, value) => {
+    for (const cb of [...listeners.get(event) ?? []]) cb(value);
+  };
+  let changeQueued = false;
+  const changed = () => {
+    if (changeQueued || closed) return;
+    changeQueued = true;
+    queueMicrotask(() => {
+      changeQueued = false;
+      if (!closed) emit("peers-changed", void 0);
+    });
+  };
+  const waiters = [];
+  const peers = /* @__PURE__ */ new Map();
+  const playbacks = /* @__PURE__ */ new Map();
+  const localPrefs = /* @__PURE__ */ new Map();
+  const prefsFor = (peerId) => {
+    let p = localPrefs.get(peerId);
+    if (!p) {
+      p = { mutedLocally: false, volume: 1 };
+      localPrefs.set(peerId, p);
+    }
+    return p;
+  };
+  const consumed = /* @__PURE__ */ new Set();
+  let closed = false;
+  let muted = false;
+  let device;
+  let sendTransport;
+  let recvTransport;
+  let micTrack;
+  let producer;
+  const signal = (m) => session.sendVoice(encodeVoiceMessage(m));
+  function expect(match) {
+    return new Promise((resolve, reject) => {
+      waiters.push({ match, resolve, reject });
+    });
+  }
+  const unsubscribe = session.onVoice((bytes) => {
+    const m = decodeVoiceMessage(bytes);
+    if (!m) return;
+    if (m.t === "error") {
+      const err = new Error(`irtio voice: ${m.code} ${m.message}`);
+      for (const w of waiters.splice(0)) w.reject(err);
+      emit("error", { code: m.code, message: m.message });
+      return;
+    }
+    for (let i = 0; i < waiters.length; i++) {
+      const w = waiters[i];
+      if (w.match(m)) {
+        waiters.splice(i, 1);
+        w.resolve(m);
+        return;
+      }
+    }
+    switch (m.t) {
+      case "peer-joined": {
+        const known = peers.has(m.peer.peerId);
+        peers.set(m.peer.peerId, {
+          muted: m.peer.muted,
+          ...m.peer.producerId !== void 0 ? { producerId: m.peer.producerId } : {}
+        });
+        if (!known) emit("peer-joined", m.peer.peerId);
+        changed();
+        if (m.peer.producerId !== void 0) void consumePeer(m.peer.producerId);
+        return;
+      }
+      case "peer-left": {
+        peers.delete(m.peerId);
+        playbacks.get(m.peerId)?.playback.detach();
+        playbacks.delete(m.peerId);
+        emit("peer-left", m.peerId);
+        changed();
+        return;
+      }
+      case "peer-muted": {
+        const p = peers.get(m.peerId);
+        if (p) p.muted = m.muted;
+        emit("peer-muted", { peerId: m.peerId, muted: m.muted });
+        changed();
+        return;
+      }
+      default:
+        return;
+    }
+  });
+  async function consumePeer(producerId) {
+    if (closed || consumed.has(producerId) || !recvTransport || !device) return;
+    consumed.add(producerId);
+    try {
+      signal({ t: "consume", producerId, rtpCapabilities: device.rtpCapabilities });
+      const reply = await expect(
+        (m) => m.t === "consumed" && m.producerId === producerId
+      );
+      if (closed) return;
+      const consumer = await recvTransport.consume({
+        id: reply.consumerId,
+        producerId: reply.producerId,
+        kind: "audio",
+        rtpParameters: reply.rtpParameters
+      });
+      const peerId = reply.peerId || producerId;
+      playbacks.get(peerId)?.playback.detach();
+      const playback = asPlayback(internals.attach(peerId, consumer.track));
+      playbacks.set(peerId, { playback, track: consumer.track });
+      const prefs = prefsFor(peerId);
+      playback.setVolume(prefs.volume);
+      playback.setMuted(prefs.mutedLocally);
+      signal({ t: "resume", consumerId: reply.consumerId });
+      changed();
+    } catch (err) {
+      consumed.delete(producerId);
+      emit("error", {
+        code: "E_VOICE_CONSUME",
+        message: err instanceof Error ? err.message : String(err)
+      });
+    }
+  }
+  async function teardown() {
+    if (closed) return;
+    closed = true;
+    for (const w of waiters.splice(0)) w.reject(new Error("irtio voice: left the call"));
+    for (const p of playbacks.values()) p.playback.detach();
+    playbacks.clear();
+    peers.clear();
+    producer?.close();
+    micTrack?.stop();
+    sendTransport?.close();
+    recvTransport?.close();
+    unsubscribe();
+  }
+  try {
+    micTrack = await internals.getMicTrack();
+    device = await internals.createDevice();
+    signal({ t: "join", rtpCapabilities: {} });
+    const joined = await expect(
+      (m) => m.t === "joined"
+    );
+    await device.load({ routerRtpCapabilities: joined.routerRtpCapabilities });
+    sendTransport = device.createSendTransport(joined.sendTransport);
+    recvTransport = device.createRecvTransport(joined.recvTransport);
+    for (const t of [sendTransport, recvTransport]) {
+      const transport = t;
+      transport.on("connect", ({ dtlsParameters }, callback, errback) => {
+        signal({ t: "connect", transportId: transport.id, dtlsParameters });
+        expect((m) => m.t === "connected" && m.transportId === transport.id).then(
+          () => callback(),
+          (e) => errback(e)
+        );
+      });
+    }
+    sendTransport.on("produce", ({ rtpParameters }, callback, errback) => {
+      signal({
+        t: "produce",
+        transportId: sendTransport.id,
+        kind: "audio",
+        rtpParameters
+      });
+      expect((m) => m.t === "produced").then(
+        (m) => callback({ id: m.producerId }),
+        (e) => errback(e)
+      );
+    });
+    producer = await sendTransport.produce({ track: micTrack });
+    for (const peer of joined.peers) {
+      peers.set(peer.peerId, {
+        muted: peer.muted,
+        ...peer.producerId !== void 0 ? { producerId: peer.producerId } : {}
+      });
+      if (peer.producerId !== void 0) void consumePeer(peer.producerId);
+    }
+    changed();
+  } catch (err) {
+    await teardown();
+    throw err instanceof Error ? err : new Error(String(err));
+  }
+  const handle = {
+    mute(next) {
+      if (closed || next === muted) return;
+      muted = next;
+      signal({ t: "mute", muted: next });
+      changed();
+    },
+    setPeerVolume(peerId, volume) {
+      if (closed) return;
+      const v = Number.isFinite(volume) ? Math.min(1, Math.max(0, volume)) : 1;
+      const prefs = prefsFor(peerId);
+      if (prefs.volume === v) return;
+      prefs.volume = v;
+      playbacks.get(peerId)?.playback.setVolume(v);
+      changed();
+    },
+    mutePeer(peerId, mutedLocally) {
+      if (closed) return;
+      const prefs = prefsFor(peerId);
+      if (prefs.mutedLocally === mutedLocally) return;
+      prefs.mutedLocally = mutedLocally;
+      playbacks.get(peerId)?.playback.setMuted(mutedLocally);
+      changed();
+    },
+    peerState(peerId) {
+      const peer = peers.get(peerId);
+      if (!peer) return void 0;
+      const prefs = prefsFor(peerId);
+      return { muted: peer.muted, mutedLocally: prefs.mutedLocally, volume: prefs.volume };
+    },
+    get muted() {
+      return muted;
+    },
+    get peers() {
+      return [...peers.keys()];
+    },
+    async leave() {
+      if (closed) return;
+      signal({ t: "leave" });
+      await teardown();
+    },
+    on(event, cb) {
+      let set = listeners.get(event);
+      if (!set) {
+        set = /* @__PURE__ */ new Set();
+        listeners.set(event, set);
+      }
+      set.add(cb);
+      return () => {
+        set.delete(cb);
+      };
+    }
+  };
+  const tracks = {
+    peerTrack: (peerId) => playbacks.get(peerId)?.track,
+    micTrack: () => micTrack
+  };
+  Object.defineProperty(handle, INTERNAL_VOICE_TRACKS, { value: tracks, enumerable: false });
+  return handle;
+}
+
 // src/index.ts
 function callProxy(session) {
   const cache = /* @__PURE__ */ new Map();
@@ -1203,11 +2361,22 @@ function callProxy(session) {
   });
 }
 async function joinRoom(schema, options = {}) {
+  if (options.physics !== void 0 && options.physics2d !== void 0) {
+    throw new Error(
+      "irtio: joinRoom was given both { physics } and { physics2d }. A room runs one engine and the client predicts with that one, so pass the option matching the engine your room config declares."
+    );
+  }
   const url = resolveUrl(options.url, options.region);
   const key = resolveKey(options.key, schema, url);
   const explicitRoom = options.room !== void 0;
   const fromLocation = !explicitRoom && currentLocation() !== void 0;
   const roomId = explicitRoom ? roomIdFrom(options.room ?? "") : fromLocation ? roomIdFromLocation() : "";
+  const identity = options.identity === true ? new Identity({ project: key, controlUrl: options.controlUrl }) : options.identity instanceof Identity ? options.identity : void 0;
+  if (identity !== void 0 && options.token !== void 0) {
+    throw new Error(
+      "irtio: joinRoom was given both { token } and { identity }. A join asserts one identity \u2014 pass your own JWT, or the platform identity, not both."
+    );
+  }
   const session = new Session({
     schema,
     url,
@@ -1217,13 +2386,16 @@ async function joinRoom(schema, options = {}) {
     role: options.role,
     name: options.name,
     token: options.token,
+    ...identity !== void 0 ? { assertion: () => identity.assertion() } : {},
     rpc: options.rpc,
     writeIntervalMs: options.writeIntervalMs,
     interpDelayMs: options.interpDelayMs,
     physics: options.physics,
+    physics2d: options.physics2d,
     transport: options.transport,
     scheduler: options.scheduler,
     onFrame: options.onFrame,
+    profile: options.profile,
     onStatus: options.onStatus
   });
   await session.start();
@@ -1244,6 +2416,9 @@ function makeRoom(session) {
     get tick() {
       return session.tick;
     },
+    get maxClients() {
+      return session.maxClients;
+    },
     get status() {
       return session.status;
     },
@@ -1259,6 +2434,12 @@ function makeRoom(session) {
     get clients() {
       return session.clients;
     },
+    ...session.ledger ? {
+      profile: {
+        total: () => session.ledger?.snapshot() ?? EMPTY_PROFILE2,
+        perSecond: () => session.profilePerSecond()
+      }
+    } : {},
     ...session.predictionRequested ? {
       prediction: {
         get active() {
@@ -1278,6 +2459,7 @@ function makeRoom(session) {
     flush: () => session.flush(),
     leave: () => session.leave()
   };
+  Object.defineProperty(room, INTERNAL_SESSION, { value: session, enumerable: false });
   return room;
 }
 async function joinRelay(options = {}) {
@@ -1306,6 +2488,9 @@ async function joinRelay(options = {}) {
     get id() {
       return session.roomId;
     },
+    get maxClients() {
+      return session.maxClients;
+    },
     get link() {
       return session.link;
     },
@@ -1325,13 +2510,21 @@ async function joinRelay(options = {}) {
   };
 }
 export {
+  ACCOUNT_STORAGE_KEY,
   CALL_TIMEOUT_MS,
   ClientStore,
+  DEFAULT_CONTROL_URL,
   DEFAULT_REGION,
   DEFAULT_WRITE_INTERVAL_MS,
   DEV_PORT,
   E_CONNECT_FAILED,
+  E_IDENTITY_RATE_LIMITED,
+  INTERNAL_VOICE_TRACKS,
+  Identity,
+  IdentityError,
+  MAX_IDENTITY_RETRY_WAIT_MS,
   MAX_PREDICTED_BODIES,
+  MatchError,
   PING_INTERVAL_MS,
   PREDICTION_EPSILON,
   REGION_RE,
@@ -1339,10 +2532,15 @@ export {
   SMOOTHING_HALF_LIFE_MS,
   SMOOTHING_SNAP_UNITS,
   Session,
+  createParty,
   defaultScheduler,
+  findMatch,
+  identityStorageKey,
   joinRelay,
   joinRoom,
+  joinVoice,
   linkForUrl,
+  matchRoom,
   resolveUrl,
   roomIdFrom,
   webSocketTransport