@irtio/runtime 0.11.0 → 1.0.0

package/dist/{chunk-ACC3SDIO.js → chunk-YWDRE77H.js}

@@ -1,7 +1,7 @@
 import {
   parseHibernationBlob,
   writeHibernationBlob
-} from "./chunk-GYPUNTQN.js";
+} from "./chunk-LT46QFLW.js";
 
 // src/migrate.ts
 import { PRESENCE_COLLECTION, withBuiltins } from "@irtio/protocol";

package/dist/{contract-Hk4SkDtW.d.ts → contract-UEKTud1Z.d.ts}

@@ -1,6 +1,6 @@
 import { AnySchema, PlainState, State, Tracked } from '@irtio/schema';
 import * as _irtio_protocol from '@irtio/protocol';
-import { ErrorCodeName } from '@irtio/protocol';
+import { PlatformNotice, ErrorCodeName } from '@irtio/protocol';
 import { RoomDefinition, Room, LeaveReason, NpcConfig } from '@irtio/server';
 
 /**
@@ -84,7 +84,9 @@ declare class TimelineRecorder {
 
 type RoomEventKind = 'join' | 'leave' | 'write' | 'write-rejected' | 'correct' | 'call' | 'reply' | 'msg' | 'alarm'
 /** D59: a bus event (a published message) or a directed bus send being delivered. */
- | 'bus' | 'error';
+ | 'bus'
+/** M7 D-P2: a platform notice reaching `onPlatformNotice`; the detail is the phase. */
+ | 'notice' | 'error';
 interface RoomEvent {
     readonly tick: number;
     readonly kind: RoomEventKind;
@@ -267,10 +269,42 @@ type HostCall = {
  * number, but that bound lives on the side of the seam the tenant's own code owns.
  *
  * The result's `value` is the minted clip id.
+ *
+ * M6 clip-TTL packet: `expiresAtEpochS` is the unix second this clip should die, computed here
+ * because this is where `replay.ttl` is declared and read. The supervisor clamps it into
+ * `[now + 1m, now + 3650d]` before minting an id from it, so choosing it inside the tenant's
+ * own worker buys a hostile room nothing an honest one cannot declare.
  */
  | {
     readonly kind: 'clip';
     readonly bytes: Uint8Array;
+    readonly expiresAtEpochS: number;
+}
+/**
+ * D81's `record: true`: one numbered chunk of a continuous recording, on its way to storage.
+ *
+ * The chunk is the ring's own evictions, kept — so this call carries bulk bytes for the same
+ * reason `clip` does, is walled on the far side for the same reason, and is the only other host
+ * call that does either.
+ *
+ * `recId` is `undefined` on the first chunk of a recording and the supervisor's reply carries
+ * the id it minted; every chunk after it names that id. The mint is on the supervisor's side
+ * because that is where the entropy and the key algebra live (the `clip` precedent), and the
+ * runtime never invents one — which is also what keeps two rooms recording in one project from
+ * ever sharing a prefix.
+ *
+ * M6 clip-TTL packet: `expiresAtEpochS` is the expiry computed when the recording STARTED, and
+ * every chunk carries that same number for the life of the recording. It only decides anything
+ * on the first chunk — the mint — because every chunk after it is addressed by the `recId` the
+ * mint produced, which is what makes a 40-minute match expire atomically instead of losing its
+ * opening while its ending is still being watched.
+ */
+ | {
+    readonly kind: 'record-chunk';
+    readonly recId: string | undefined;
+    readonly seq: number;
+    readonly bytes: Uint8Array;
+    readonly expiresAtEpochS: number;
 };
 /**
  * What a `HostCall` produced. `value` carries the save id for `save` and the stored string for
@@ -533,6 +567,12 @@ interface RoomCoreApi<S extends AnySchema = AnySchema> {
     fireAlarm(name: string): void;
     /** D59: deliver one published message on a channel this room is subscribed to. */
     deliverBusEvent(channel: string, from: string, payload: string): void;
+    /**
+     * M7 D-P2: deliver a platform notice to `onPlatformNotice` and answer whether the supervisor
+     * should still broadcast it. `false` means the room vetoed; a throw, a missing handler and a
+     * stopped room all answer `true`.
+     */
+    deliverPlatformNotice(notice: PlatformNotice): boolean;
     /** D59: deliver one directed `room.bus.send`. At-least-once, so this may repeat a message. */
     deliverBusMessage(from: string, payload: string): void;
     /**
@@ -543,6 +583,8 @@ interface RoomCoreApi<S extends AnySchema = AnySchema> {
     stateBytes(): number | undefined;
     /** D77: how many records this room is holding for players who have left. */
     holdCount(): number;
+    /** How many `transfer: 'ask'` requests are waiting on an owner's answer. Never survives sleep. */
+    askCount(): number;
 }
 
 export { DEFAULT_RECORDS_PER_COLLECTION as D, EVENT_RING_SIZE as E, HOST_CALL_TIMEOUT_MS as H, type JoinOptions as J, type LogLevel as L, RELAY_RECORDS_PER_COLLECTION as R, type TimelineDump as T, type WriteCaps as W, DEFAULT_TIMELINE_MAX_RECORDS as a, DEFAULT_TIMELINE_MAX_TICKS as b, type HostCall as c, type HostCallResult as d, type JoinResult as e, RELAY_STATE_BYTES as f, RELAY_WRITES_PER_SECOND as g, RELAY_WRITE_CAPS as h, type RoomCoreApi as i, type RoomCoreOptions as j, type RoomEvent as k, type RoomEventKind as l, RoomFullError as m, type RoomHost as n, type RoomInspection as o, type RoomStats as p, type TimelineFrame as q, TimelineRecorder as r, type TimelineRecorderOptions as s, inspectState as t };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { D as DEFAULT_RECORDS_PER_COLLECTION, a as DEFAULT_TIMELINE_MAX_RECORDS, b as DEFAULT_TIMELINE_MAX_TICKS, E as EVENT_RING_SIZE, H as HOST_CALL_TIMEOUT_MS, c as HostCall, d as HostCallResult, J as JoinOptions, e as JoinResult, L as LogLevel, R as RELAY_RECORDS_PER_COLLECTION, f as RELAY_STATE_BYTES, g as RELAY_WRITES_PER_SECOND, h as RELAY_WRITE_CAPS, i as RoomCoreApi, j as RoomCoreOptions, k as RoomEvent, l as RoomEventKind, m as RoomFullError, n as RoomHost, o as RoomInspection, p as RoomStats, T as TimelineDump, q as TimelineFrame, r as TimelineRecorder, s as TimelineRecorderOptions, W as WriteCaps, t as inspectState } from './contract-Hk4SkDtW.js';
-export { C as CRASH_AFTER_THROWS, M as MAX_CATCHUP, a as MatterBodyRecord, b as MatterSection, c as Mulberry32, P as PhysicsEngineTag, d as PhysicsSection, R as RoomCore, e as decodeMatterBodies, f as decodeMatterSectionEnvelope, g as decodePhysicsSection, h as decodeRapier2dSectionEnvelope, i as encodeMatterBodies, j as encodeMatterSectionEnvelope, k as encodePhysicsSection, l as encodeRapier2dSectionEnvelope, m as initMatter, n as initPhysics, o as initRapier2d, p as loadedMatter, q as loadedPhysics, r as loadedRapier2d, s as physicsSectionEngine, t as resetMatterForTests, u as resetPhysicsForTests, v as resetRapier2dForTests } from './room-0FZBGyke.js';
+export { D as DEFAULT_RECORDS_PER_COLLECTION, a as DEFAULT_TIMELINE_MAX_RECORDS, b as DEFAULT_TIMELINE_MAX_TICKS, E as EVENT_RING_SIZE, H as HOST_CALL_TIMEOUT_MS, c as HostCall, d as HostCallResult, J as JoinOptions, e as JoinResult, L as LogLevel, R as RELAY_RECORDS_PER_COLLECTION, f as RELAY_STATE_BYTES, g as RELAY_WRITES_PER_SECOND, h as RELAY_WRITE_CAPS, i as RoomCoreApi, j as RoomCoreOptions, k as RoomEvent, l as RoomEventKind, m as RoomFullError, n as RoomHost, o as RoomInspection, p as RoomStats, T as TimelineDump, q as TimelineFrame, r as TimelineRecorder, s as TimelineRecorderOptions, W as WriteCaps, t as inspectState } from './contract-UEKTud1Z.js';
+export { C as CRASH_AFTER_THROWS, M as MAX_CATCHUP, a as MatterBodyRecord, b as MatterSection, c as Mulberry32, P as PhysicsEngineTag, d as PhysicsSection, R as RoomCore, e as decodeMatterBodies, f as decodeMatterSectionEnvelope, g as decodePhysicsSection, h as decodeRapier2dSectionEnvelope, i as encodeMatterBodies, j as encodeMatterSectionEnvelope, k as encodePhysicsSection, l as encodeRapier2dSectionEnvelope, m as initMatter, n as initPhysics, o as initRapier2d, p as loadedMatter, q as loadedPhysics, r as loadedRapier2d, s as physicsSectionEngine, t as resetMatterForTests, u as resetPhysicsForTests, v as resetRapier2dForTests } from './room-uhj3b-8E.js';
 import { CollectionDesc, AnySchema, PlainState, DirtySet } from '@irtio/schema';
 import '@irtio/protocol';
 import '@irtio/server';

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   fromMigrationState,
   migrateSnapshot,
   toMigrationState
-} from "./chunk-ACC3SDIO.js";
+} from "./chunk-YWDRE77H.js";
 import {
   CRASH_AFTER_THROWS,
   DEFAULT_RECORDS_PER_COLLECTION,
@@ -52,7 +52,7 @@ import {
   visibleNames,
   visibleTo,
   writeHibernationBlob
-} from "./chunk-GYPUNTQN.js";
+} from "./chunk-LT46QFLW.js";
 export {
   CRASH_AFTER_THROWS,
   DEFAULT_RECORDS_PER_COLLECTION,

package/dist/{room-0FZBGyke.d.ts → room-uhj3b-8E.d.ts}

@@ -1,7 +1,7 @@
-import { AttributeOptions, ProfileSnapshot } from '@irtio/protocol';
+import { PlatformNotice, AttributeOptions, ProfileSnapshot } from '@irtio/protocol';
 import { DirtySet, AnySchema, PlainState, Tracked, State } from '@irtio/schema';
 import { RoomDefinition, RoomMode, Room, RewindView, Ctx, MatterModule, MatterEngine, MatterBody, RapierModule, RapierWorld, RapierRigidBody, Rapier2dModule, Rapier2dWorld, Rapier2dRigidBody, ResolvedRoomConfig, LeaveReason } from '@irtio/server';
-import { n as RoomHost, p as RoomStats, L as LogLevel, i as RoomCoreApi, j as RoomCoreOptions, l as RoomEventKind, s as TimelineRecorderOptions, T as TimelineDump, o as RoomInspection, J as JoinOptions, e as JoinResult, d as HostCallResult } from './contract-Hk4SkDtW.js';
+import { n as RoomHost, p as RoomStats, L as LogLevel, i as RoomCoreApi, j as RoomCoreOptions, l as RoomEventKind, s as TimelineRecorderOptions, T as TimelineDump, o as RoomInspection, J as JoinOptions, e as JoinResult, d as HostCallResult } from './contract-UEKTud1Z.js';
 
 declare class Mulberry32 {
     /** Current internal state (u32). Survives hibernation. */
@@ -734,6 +734,26 @@ declare class RoomCore<S extends AnySchema = AnySchema> implements RoomCoreApi<S
     constructor(definition: RoomDefinition<S>, host: RoomHost, options: RoomCoreOptions);
     private subscribeDeclaredChannels;
     private get busConfig();
+    /**
+     * M7 D-P2: the platform notice, and the room's veto.
+     *
+     * Answers whether the supervisor should broadcast. `false` — the veto — comes back for exactly
+     * one input: a handler that ran and returned `false`. Every other path answers `true`, and each
+     * one is a different way of the room having said nothing:
+     *
+     * - **No handler.** A room that never wrote this hook. The design's whole point is that its
+     *   players still hear the warning; a code-less room does not even reach this file.
+     * - **A handler that threw.** `tryRun` and not `guard`, so the throw counts toward the crash
+     *   threshold like any other, and it still does not become a veto. This is the one place the
+     *   convention differs from `onChat`, where a throw refuses, and the reason is the asymmetry of
+     *   the two losses: a chat line nobody sees is small; a save-loss warning nobody sees is the
+     *   feature not existing.
+     * - **A stopped room.** Nobody to ask, and for `closing` nobody left to veto for.
+     *
+     * The handler may also have written state, posted chat or started an end sequence. All of that
+     * is ordinary handler work and is flushed here the way an alarm's is.
+     */
+    deliverPlatformNotice(notice: PlatformNotice): boolean;
     /**
      * D59: one published message arriving on a channel this room is subscribed to.
      *
@@ -881,6 +901,8 @@ declare class RoomCore<S extends AnySchema = AnySchema> implements RoomCoreApi<S
     stateBytes(): number | undefined;
     /** D77: how many records are held for players who have left. */
     holdCount(): number;
+    /** How many `transfer: 'ask'` requests are waiting on an owner's answer right now. */
+    askCount(): number;
     profile(): ProfileSnapshot | undefined;
     private badFrame;
     receive(clientId: string, frame: Uint8Array): void;

package/dist/test/index.d.ts

@@ -1,8 +1,8 @@
-import { R as RoomCore } from '../room-0FZBGyke.js';
-export { m as initMatter, n as initPhysics, o as initRapier2d } from '../room-0FZBGyke.js';
+import { R as RoomCore } from '../room-uhj3b-8E.js';
+export { m as initMatter, n as initPhysics, o as initRapier2d } from '../room-uhj3b-8E.js';
 import { ErrorCodeName, FrameType } from '@irtio/protocol';
 import { NpcConfig, LeaveReason, Room, RoomDefinition } from '@irtio/server';
-import { n as RoomHost, L as LogLevel, i as RoomCoreApi, c as HostCall, d as HostCallResult, W as WriteCaps, p as RoomStats } from '../contract-Hk4SkDtW.js';
+import { n as RoomHost, L as LogLevel, i as RoomCoreApi, c as HostCall, d as HostCallResult, W as WriteCaps, p as RoomStats } from '../contract-UEKTud1Z.js';
 import { AnySchema, PlainState, EntityCollection, State } from '@irtio/schema';
 
 /**
@@ -141,6 +141,12 @@ declare class HarnessHost implements RoomHost {
     /** D81: every clip the room wrote, in order: `clipId` -> the blob it was handed. */
     readonly clips: Map<string, Uint8Array<ArrayBufferLike>>;
     private nextClipId;
+    /** D81: every recording this room wrote: `recId` -> its chunks in the order they were sent. */
+    readonly recordings: Map<string, {
+        seq: number;
+        bytes: Uint8Array;
+    }[]>;
+    private nextRecordingId;
     /**
      * D44: the in-process harness has no supervisor, no sockets and therefore no loopback session
      * to open. Recording the request rather than faking a session is the honest option: a test that

package/dist/test/index.js

@@ -5,7 +5,7 @@ import {
   initPhysics,
   initRapier2d,
   visibleNames
-} from "../chunk-GYPUNTQN.js";
+} from "../chunk-LT46QFLW.js";
 
 // src/test/clock.ts
 var FakeClock = class {
@@ -209,6 +209,18 @@ var HarnessHost = class {
         this.clips.set(clipId, call.bytes);
         return { ok: true, value: clipId };
       }
+      // ---- end M6 lane N ----
+      // ---- M6 record packet ----
+      case "record-chunk": {
+        const recId = call.recId ?? `rec${String(this.nextRecordingId++).padStart(4, "0")}`;
+        let chunks = this.recordings.get(recId);
+        if (!chunks) {
+          chunks = [];
+          this.recordings.set(recId, chunks);
+        }
+        chunks.push({ seq: call.seq, bytes: call.bytes });
+        return { ok: true, value: recId };
+      }
     }
   }
   // ---- M6 lane N: replays ----
@@ -216,6 +228,11 @@ var HarnessHost = class {
   clips = /* @__PURE__ */ new Map();
   nextClipId = 1;
   // ---- end M6 lane N ----
+  // ---- M6 record packet ----
+  /** D81: every recording this room wrote: `recId` -> its chunks in the order they were sent. */
+  recordings = /* @__PURE__ */ new Map();
+  nextRecordingId = 1;
+  // ---- end M6 record packet ----
   // -------------------------------------------------------------------------
   // Week 12: durable alarms (D26)
   // -------------------------------------------------------------------------

package/dist/worker/index.d.ts

@@ -1,5 +1,5 @@
-import { L as LogLevel, T as TimelineDump, p as RoomStats, c as HostCall, d as HostCallResult, i as RoomCoreApi, n as RoomHost } from '../contract-Hk4SkDtW.js';
-import { ErrorCodeName, ProfileSnapshot } from '@irtio/protocol';
+import { L as LogLevel, T as TimelineDump, p as RoomStats, c as HostCall, d as HostCallResult, i as RoomCoreApi, n as RoomHost } from '../contract-UEKTud1Z.js';
+import { ErrorCodeName, ProfileSnapshot, PlatformNotice } from '@irtio/protocol';
 import { NpcConfig, LeaveReason } from '@irtio/server';
 import '@irtio/schema';
 
@@ -132,6 +132,17 @@ type ToWorker = {
     name: string;
     from: string;
     payload: string;
+}
+/**
+ * M7 D-P2: the platform has something to tell this room's players, and the room gets the first
+ * look. Carries a `reqId` because the answer decides whether the supervisor broadcasts, so this
+ * is a request and not a notification — a rare thing on this side of the wire, and the reason is
+ * that a veto only means anything before the frame goes out.
+ */
+ | {
+    t: 'platformNotice';
+    reqId: number;
+    notice: PlatformNotice;
 } | {
     t: 'stop';
 };
@@ -224,6 +235,17 @@ type FromWorker = {
     reqId: number;
     ok: boolean;
 }
+/**
+ * M7 D-P2: the room's answer to a `platformNotice`. `broadcast: false` only when the handler
+ * returned exactly `false`. A handler that threw, a room with no handler, and a room whose core
+ * is not up all answer `true`, because the veto is a room saying "I will tell them myself" and
+ * none of those three said anything.
+ */
+ | {
+    t: 'platformNoticeResult';
+    reqId: number;
+    broadcast: boolean;
+}
 /** D41: the recorded timeline. `dump` absent when nobody armed the recorder. */
  | {
     t: 'timeline';
@@ -368,5 +390,17 @@ interface WorkerState {
  * killing the worker.
  */
 declare function handleMessage(state: WorkerState, host: RoomHost, post: (msg: FromWorker, transfer?: ArrayBuffer[]) => void, msg: ToWorker): Promise<void>;
+/**
+ * Replaces `Math.random` with sfc32 seeded from 16 host-supplied bytes.
+ *
+ * Box day 2 (2026-09-08) measured why this exists: two VMs restored from one golden snapshot
+ * handed their room workers **bit-for-bit identical `Math.random` streams** — V8 seeds a new
+ * isolate's PRNG from process state that a memory snapshot clones, and the kernel's VMGenID
+ * reseed does not reach it. `Math.random` is the only random primitive room code has (the
+ * sandbox refuses `node:crypto`), so an unseeded clone gives two different projects the same
+ * dice. The seed comes from the supervisor's clone-safe entropy mixer via `workerData`, so
+ * every worker — cold boot or restore, same VM or sibling clones — rolls its own.
+ */
+declare function seedMathRandom(seedHex: string): void;
 
-export { type FromWorker, type MigrationChainStep, type ToWorker, type WorkerState, createWorkerHost, handleMessage, transferList };
+export { type FromWorker, type MigrationChainStep, type ToWorker, type WorkerState, createWorkerHost, handleMessage, seedMathRandom, transferList };

package/dist/worker/index.js

@@ -1,6 +1,6 @@
 import {
   migrateSnapshot
-} from "../chunk-ACC3SDIO.js";
+} from "../chunk-YWDRE77H.js";
 import {
   RoomCore,
   RoomFullError,
@@ -9,11 +9,11 @@ import {
   initRapier2d,
   onFirstRapierStep,
   rapierHasStepped
-} from "../chunk-GYPUNTQN.js";
+} from "../chunk-LT46QFLW.js";
 
 // src/worker/index.ts
 import { getHeapStatistics } from "v8";
-import { isMainThread, parentPort } from "worker_threads";
+import { isMainThread, parentPort, workerData } from "worker_threads";
 import { isRoomDefinition } from "@irtio/server";
 
 // src/worker/protocol.ts
@@ -352,6 +352,11 @@ async function handleMessage(state, host, post, msg) {
         state.core?.fireAlarm(msg.name);
         return;
       }
+      case "platformNotice": {
+        const broadcast = state.core?.deliverPlatformNotice(msg.notice) ?? true;
+        post({ t: "platformNoticeResult", reqId: msg.reqId, broadcast });
+        return;
+      }
       case "busEvent": {
         state.core?.deliverBusEvent(msg.channel, msg.from, msg.payload);
         return;
@@ -390,7 +395,32 @@ async function handleMessage(state, host, post, msg) {
     });
   }
 }
+function seedMathRandom(seedHex) {
+  if (!/^[0-9a-f]{32}$/.test(seedHex)) return;
+  const u32 = (i) => Number.parseInt(seedHex.slice(i * 8, i * 8 + 8), 16) >>> 0;
+  let a = u32(0);
+  let b = u32(1);
+  let c = u32(2);
+  let d = u32(3);
+  const sfc32 = () => {
+    a >>>= 0;
+    b >>>= 0;
+    c >>>= 0;
+    d >>>= 0;
+    const t = a + b + d >>> 0;
+    d = d + 1 >>> 0;
+    a = b ^ b >>> 9;
+    b = c + (c << 3) >>> 0;
+    c = (c << 21 | c >>> 11) >>> 0;
+    c = c + t >>> 0;
+    return t / 4294967296;
+  };
+  for (let i = 0; i < 12; i++) sfc32();
+  Math.random = sfc32;
+}
 if (!isMainThread && parentPort) {
+  const seed = workerData?.mathRandomSeed;
+  if (typeof seed === "string") seedMathRandom(seed);
   const port = parentPort;
   const post = (msg, transfer) => {
     port.postMessage(msg, transfer ?? transferList(msg));
@@ -404,5 +434,6 @@ if (!isMainThread && parentPort) {
 export {
   createWorkerHost,
   handleMessage,
+  seedMathRandom,
   transferList
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@irtio/runtime",
-  "version": "0.11.0",
+  "version": "1.0.0",
   "description": "irtio room runtime: RoomCore, worker_threads host, in-process test harness",
   "license": "MIT",
   "publishConfig": {
@@ -31,9 +31,9 @@
     "@dimforge/rapier2d-compat": "0.20.0",
     "@dimforge/rapier3d-compat": "0.20.0",
     "matter-js": "0.20.0",
-    "@irtio/protocol": "0.11.0",
-    "@irtio/schema": "0.11.0",
-    "@irtio/server": "0.11.0"
+    "@irtio/protocol": "1.0.0",
+    "@irtio/schema": "1.0.0",
+    "@irtio/server": "1.0.0"
   },
   "devDependencies": {
     "@types/matter-js": "0.20.2"