@irtio/runtime 4.5.1 → 4.7.0

package/dist/{chunk-VIN2SPZT.js → chunk-NSUQKWYO.js}

@@ -3,7 +3,7 @@ import {
   parseHibernationBlob,
   sameSchemaHash,
   writeHibernationBlob
-} from "./chunk-23TKVLTX.js";
+} from "./chunk-RLY4VAMM.js";
 
 // src/migrate.ts
 import { PRESENCE_COLLECTION, withBuiltins } from "@irtio/protocol";

package/dist/{chunk-23TKVLTX.js → chunk-RLY4VAMM.js}

@@ -222,6 +222,95 @@ function deepEqual(a, b) {
   return true;
 }
 
+// src/core/body-guard.ts
+var MAX_BODY_RESETS = 3;
+function allFinite(values) {
+  for (const v of values) if (!Number.isFinite(v)) return false;
+  return true;
+}
+function describeNonFinite(entries) {
+  const bad = [];
+  for (const [name, v] of Object.entries(entries)) {
+    if (Number.isFinite(v)) continue;
+    bad.push(`${name}=${v}`);
+    if (bad.length === 4) break;
+  }
+  return bad.length > 0 ? bad.join(", ") : "non-finite";
+}
+var VELOCITY_CHANNELS = /* @__PURE__ */ new Set(["vx", "vy", "vz", "wx", "wy", "wz"]);
+function zeroVelocityFields(desc, record) {
+  for (const [channel, field] of desc.physics?.channels ?? []) {
+    if (VELOCITY_CHANNELS.has(channel) && record[field] !== 0) record[field] = 0;
+  }
+}
+var NUMERIC_KINDS = /* @__PURE__ */ new Set(["f32", "f64", "i32", "u8", "u16", "u32"]);
+var NonFiniteGuard = class {
+  constructor(core) {
+    this.core = core;
+  }
+  core;
+  /** Resets so far, by body key (`collection\0id`). */
+  resets = /* @__PURE__ */ new Map();
+  /**
+   * Records one non-finite body and says what the engine should do with it. Also does the part
+   * that is the same on every engine: the log line, the room event, and the owner's intents.
+   */
+  note(desc, id, key, detail) {
+    const count = (this.resets.get(key) ?? 0) + 1;
+    this.resets.set(key, count);
+    const name = desc.name;
+    const skip = count >= MAX_BODY_RESETS;
+    if (skip) {
+      this.core.log(
+        "error",
+        `irtio: physics body ${name}[${id}] went non-finite (${detail}); body skipped after ${MAX_BODY_RESETS} resets, room.physics.skip('${name}', '${id}', false) re-enables it`
+      );
+    } else {
+      this.core.log(
+        "warn",
+        `irtio: physics body ${name}[${id}] went non-finite (${detail}); reset to its last synced pose with zero velocity`
+      );
+    }
+    this.attribute(desc, id, detail);
+    if (skip) this.resets.delete(key);
+    return skip ? "skip" : "reset";
+  }
+  /**
+   * Names the owner, zeroes its intents, and tells it why. The zeroing goes through the tracked
+   * record, so it is an ordinary server write to a client-owned field, which the server-wins pass
+   * turns into a `CORRECT` for the owner.
+   */
+  attribute(desc, id, detail) {
+    const core = this.core;
+    const owner = plainEntity(core.plain, desc.name).ownerOf(id);
+    const client = owner !== void 0 && core.clients.has(owner) ? owner : void 0;
+    core.recordEvent("error", client, `${desc.name}[${id}] non-finite: ${detail}`);
+    if (client === void 0) return;
+    const intents = desc.physics?.intents ?? [];
+    const record = core.anyState[desc.name].get(id);
+    if (record) {
+      for (const f of desc.fields) {
+        if (!intents.includes(f.name) || !NUMERIC_KINDS.has(f.type.kind)) continue;
+        if (record[f.name] !== 0) record[f.name] = 0;
+      }
+    }
+    refuseByName(core, client, "E_WRITE_REJECTED", {
+      reason: `${desc.name}[${id}] went non-finite (${detail}); its intents were zeroed and the body reset. Clamp intents in validate`
+    });
+  }
+  /** Drops the counts of bodies whose row is gone. */
+  prune(live) {
+    for (const key of [...this.resets.keys()]) if (!live.has(key)) this.resets.delete(key);
+  }
+  /** Drops one body's count, when its row was replaced and the body rebuilt. */
+  forget(key) {
+    this.resets.delete(key);
+  }
+  clear() {
+    this.resets.clear();
+  }
+};
+
 // src/core/physics.ts
 var engine;
 var loading;
@@ -466,6 +555,10 @@ var PhysicsRuntime = class {
    */
   skippedKeys = /* @__PURE__ */ new Set();
   // ---- end M7 planned feature 3 (b) ----
+  /** bugs #116: what `sync()` does with a body that went non-finite. See `core/body-guard.ts`. */
+  nonFinite;
+  /** The mapped channel values of the body `sync()` is on, reused so the good path allocates nothing. */
+  nextScratch = [];
   // ---- M7 planned feature 3 (a): physics-only unsynced bodies ----
   /**
    * Bodies with no schema row: rope anchors, dead-reckoned proxies, one-off sensors. Keyed by the
@@ -480,6 +573,7 @@ var PhysicsRuntime = class {
     this.core = core;
     this.config = config;
     this.rapier = rapier;
+    this.nonFinite = new NonFiniteGuard(core);
     this.collections = core.ext.collections.filter(
       (c) => c.physics !== void 0
     );
@@ -522,6 +616,7 @@ var PhysicsRuntime = class {
   }
   free() {
     this.bodies.clear();
+    this.nonFinite.clear();
     this.unsyncedBodies.clear();
     this.world.free();
   }
@@ -780,6 +875,7 @@ var PhysicsRuntime = class {
           this.bodies.delete(key);
           this.sleepSynced.delete(key);
           this.sourceRecords.delete(key);
+          this.nonFinite.forget(key);
           this.destroyBody(existing);
         }
         if (record !== void 0) this.create(desc, id, record);
@@ -793,6 +889,7 @@ var PhysicsRuntime = class {
       this.destroyBody(body);
     }
     for (const key of [...this.skippedKeys]) if (!live.has(key)) this.skippedKeys.delete(key);
+    this.nonFinite.prune(live);
   }
   // -------------------------------------------------------------------------
   // Step and sync
@@ -829,13 +926,68 @@ var PhysicsRuntime = class {
         const r = body.rotation();
         const v = body.linvel();
         const w = body.angvel();
+        const nexts = this.nextScratch;
+        nexts.length = 0;
         for (const [channel, field] of physics.channels) {
-          const next = (rounders[field] ?? identity)(channelValue(channel, t, r, v, w));
+          nexts.push((rounders[field] ?? identity)(channelValue(channel, t, r, v, w)));
+        }
+        if (!poseFinite(t, r, v, w) || !allFinite(nexts)) {
+          const detail = describeNonFinite({
+            x: t.x,
+            y: t.y,
+            z: t.z,
+            qx: r.x,
+            qy: r.y,
+            qz: r.z,
+            qw: r.w,
+            vx: v.x,
+            vy: v.y,
+            vz: v.z,
+            wx: w.x,
+            wy: w.y,
+            wz: w.z,
+            ...Object.fromEntries(physics.channels.map(([, field], i2) => [field, nexts[i2] ?? 0]))
+          });
+          if (this.nonFinite.note(desc, id, key, detail) === "skip") {
+            this.setSkipped(desc.name, id, true);
+          } else {
+            this.resetBody(desc, body, record);
+          }
+          continue;
+        }
+        let i = 0;
+        for (const [, field] of physics.channels) {
+          const next = nexts[i++];
           if (record[field] !== next) record[field] = next;
         }
       }
     }
   }
+  /**
+   * bugs #116: puts a non-finite body back at its row's pose (the last one `sync()` wrote, always
+   * finite), at rest, with no force left on it. Unmapped channels the engine made non-finite go to
+   * zero, or the identity rotation, since there is nothing better to put them back to.
+   */
+  resetBody(desc, body, record) {
+    const t = body.translation();
+    const r = body.rotation();
+    body.setTranslation(
+      {
+        x: Number.isFinite(t.x) ? t.x : 0,
+        y: Number.isFinite(t.y) ? t.y : 0,
+        z: Number.isFinite(t.z) ? t.z : 0
+      },
+      true
+    );
+    if (!allFinite([r.x, r.y, r.z, r.w])) body.setRotation({ x: 0, y: 0, z: 0, w: 1 }, true);
+    this.applyRecordToBody(desc, body, record);
+    if (!body.isEnabled()) body.setEnabled(true);
+    body.setLinvel({ x: 0, y: 0, z: 0 }, true);
+    body.setAngvel({ x: 0, y: 0, z: 0 }, true);
+    body.resetForces(true);
+    body.resetTorques(true);
+    zeroVelocityFields(desc, record);
+  }
   // -------------------------------------------------------------------------
   // Hibernation
   // -------------------------------------------------------------------------
@@ -856,6 +1008,9 @@ var PhysicsRuntime = class {
     };
   }
 };
+function poseFinite(t, r, v, w) {
+  return Number.isFinite(t.x) && Number.isFinite(t.y) && Number.isFinite(t.z) && Number.isFinite(r.x) && Number.isFinite(r.y) && Number.isFinite(r.z) && Number.isFinite(r.w) && Number.isFinite(v.x) && Number.isFinite(v.y) && Number.isFinite(v.z) && Number.isFinite(w.x) && Number.isFinite(w.y) && Number.isFinite(w.z);
+}
 function identity(v) {
   return v;
 }
@@ -2634,11 +2789,12 @@ var Loop = class {
         failed = failed === void 0 ? "the physics step" : `${failed} and the physics step`;
       }
     }
+    const flushed = this.core.tryRun("flush", () => this.core.flush());
+    if (!flushed.ok) failed = failed === void 0 ? "flush" : `${failed} and flush`;
     if (failed === void 0) this.consecutiveThrows = 0;
     else {
       this.consecutiveThrows++;
       if (this.consecutiveThrows >= CRASH_AFTER_THROWS) {
-        this.core.flush();
         const reason = `${failed} threw ${this.consecutiveThrows} times in a row`;
         this.core.stopped = true;
         this.stop();
@@ -2646,7 +2802,6 @@ var Loop = class {
         return;
       }
     }
-    this.core.flush();
     this.core.captureTimeline();
     const elapsed = Math.max(0, host.now() - started);
     const stats = this.core.stats;
@@ -2669,7 +2824,7 @@ var Loop = class {
   applyEvent(f) {
     this.core.tick++;
     const ok = this.applyFrame(f);
-    this.core.flush();
+    this.core.guard("flush", () => this.core.flush());
     return ok;
   }
   noteActivity() {
@@ -2968,6 +3123,9 @@ var MatterRuntime = class {
   // ---- M7 planned feature 3 (b): per-entity physics skip ----
   /** See `PhysicsRuntime.skippedKeys`: entities whose body the room has switched off. */
   skippedKeys = /* @__PURE__ */ new Set();
+  /** bugs #116: see `PhysicsRuntime.nonFinite`. */
+  nonFinite;
+  nextScratch = [];
   // ---- end M7 planned feature 3 (b) ----
   // ---- M7 planned feature 3 (a): physics-only unsynced bodies ----
   unsyncedBodies = /* @__PURE__ */ new Map();
@@ -2982,6 +3140,7 @@ var MatterRuntime = class {
     if (!config) throw new Error("MatterRuntime: the room config declares no physics");
     this.core = core;
     this.config = config;
+    this.nonFinite = new NonFiniteGuard(core);
     this.matter = matter;
     this.collections = core.ext.collections.filter(
       (c) => c.physics !== void 0
@@ -3036,6 +3195,7 @@ var MatterRuntime = class {
   }
   free() {
     this.bodies.clear();
+    this.nonFinite.clear();
     this.unsyncedBodies.clear();
     this.matter.Engine.clear(this.engine);
   }
@@ -3224,6 +3384,7 @@ var MatterRuntime = class {
           this.bodies.delete(key);
           this.sleepSynced.delete(key);
           this.sourceRecords.delete(key);
+          this.nonFinite.forget(key);
           this.wakeContactsOf(existing.body);
           this.matter.Composite.remove(this.engine.world, [existing.body, ...existing.constraints]);
         }
@@ -3239,6 +3400,7 @@ var MatterRuntime = class {
       this.matter.Composite.remove(this.engine.world, [attached.body, ...attached.constraints]);
     }
     for (const key of [...this.skippedKeys]) if (!live.has(key)) this.skippedKeys.delete(key);
+    this.nonFinite.prune(live);
   }
   // -------------------------------------------------------------------------
   // Step and sync
@@ -3274,13 +3436,48 @@ var MatterRuntime = class {
           vy: body.velocity.y,
           angularVelocity: body.angularVelocity
         };
+        const nexts = this.nextScratch;
+        nexts.length = 0;
         for (const [channel, field] of physics.channels) {
-          const next = (rounders[field] ?? identity2)(channelOf2d(channel, state));
+          nexts.push((rounders[field] ?? identity2)(channelOf2d(channel, state)));
+        }
+        if (!(Number.isFinite(state.x) && Number.isFinite(state.y) && Number.isFinite(state.angle) && Number.isFinite(state.vx) && Number.isFinite(state.vy) && Number.isFinite(state.angularVelocity)) || !allFinite(nexts)) {
+          const detail = describeNonFinite({
+            ...state,
+            ...Object.fromEntries(physics.channels.map(([, field], i2) => [field, nexts[i2] ?? 0]))
+          });
+          if (this.nonFinite.note(desc, id, key, detail) === "skip") {
+            this.setSkipped(desc.name, id, true);
+          } else {
+            this.resetBody(desc, id, key, attached, record);
+          }
+          continue;
+        }
+        let i = 0;
+        for (const [, field] of physics.channels) {
+          const next = nexts[i++];
           if (record[field] !== next) record[field] = next;
         }
       }
     }
   }
+  /**
+   * bugs #116: the matter2d half of `PhysicsRuntime.resetBody`, done as a rebuild rather than a
+   * teleport. matter moves a body by translating its vertices by the difference between the new
+   * position and the old one, and once the old one is not finite that difference is not either:
+   * `Body.setPosition` cannot bring the vertices back. So the body is removed and built again
+   * from its row, whose pose is the last finite one `sync()` wrote, with the row's velocity
+   * fields zeroed first so the new body spawns at rest (and with no force, being new).
+   */
+  resetBody(desc, id, key, attached, record) {
+    zeroVelocityFields(desc, record);
+    this.bodies.delete(key);
+    this.sleepSynced.delete(key);
+    this.sourceRecords.delete(key);
+    this.matter.Composite.remove(this.engine.world, [attached.body, ...attached.constraints]);
+    const plain = plainEntity(this.core.plain, desc.name).get(id);
+    if (plain !== void 0) this.create(desc, id, plain);
+  }
   // -------------------------------------------------------------------------
   // Hibernation
   // -------------------------------------------------------------------------
@@ -3418,6 +3615,9 @@ var Rapier2dRuntime = class {
   /** See `PhysicsRuntime.skippedKeys`: entities whose body the room has switched off. */
   skippedKeys = /* @__PURE__ */ new Set();
   // ---- end M7 planned feature 3 (b) ----
+  /** bugs #116: see `PhysicsRuntime.nonFinite`. */
+  nonFinite;
+  nextScratch = [];
   // ---- M7 planned feature 3 (a): physics-only unsynced bodies ----
   /** See `PhysicsRuntime.unsyncedBodies`: bodies the world steps that no schema row describes. */
   unsyncedBodies = /* @__PURE__ */ new Map();
@@ -3429,6 +3629,7 @@ var Rapier2dRuntime = class {
     this.core = core;
     this.config = config;
     this.rapier = rapier;
+    this.nonFinite = new NonFiniteGuard(core);
     this.collections = core.ext.collections.filter(
       (c) => c.physics !== void 0
     );
@@ -3471,6 +3672,7 @@ var Rapier2dRuntime = class {
   }
   free() {
     this.bodies.clear();
+    this.nonFinite.clear();
     this.unsyncedBodies.clear();
     this.world.free();
   }
@@ -3648,6 +3850,7 @@ var Rapier2dRuntime = class {
           this.bodies.delete(key);
           this.sleepSynced.delete(key);
           this.sourceRecords.delete(key);
+          this.nonFinite.forget(key);
           this.destroyBody(existing);
         }
         if (record !== void 0) this.create(desc, id, record);
@@ -3661,6 +3864,7 @@ var Rapier2dRuntime = class {
       this.destroyBody(body);
     }
     for (const key of [...this.skippedKeys]) if (!live.has(key)) this.skippedKeys.delete(key);
+    this.nonFinite.prune(live);
   }
   // -------------------------------------------------------------------------
   // Step and sync
@@ -3702,13 +3906,47 @@ var Rapier2dRuntime = class {
           vy: v.y,
           angularVelocity: body.angvel()
         };
+        const nexts = this.nextScratch;
+        nexts.length = 0;
         for (const [channel, field] of physics.channels) {
-          const next = (rounders[field] ?? identity3)(channelOf2d2(channel, state));
+          nexts.push((rounders[field] ?? identity3)(channelOf2d2(channel, state)));
+        }
+        if (!(Number.isFinite(state.x) && Number.isFinite(state.y) && Number.isFinite(state.angle) && Number.isFinite(state.vx) && Number.isFinite(state.vy) && Number.isFinite(state.angularVelocity)) || !allFinite(nexts)) {
+          const detail = describeNonFinite({
+            ...state,
+            ...Object.fromEntries(physics.channels.map(([, field], i2) => [field, nexts[i2] ?? 0]))
+          });
+          if (this.nonFinite.note(desc, id, key, detail) === "skip") {
+            this.setSkipped(desc.name, id, true);
+          } else {
+            this.resetBody(desc, body, record);
+          }
+          continue;
+        }
+        let i = 0;
+        for (const [, field] of physics.channels) {
+          const next = nexts[i++];
           if (record[field] !== next) record[field] = next;
         }
       }
     }
   }
+  /** bugs #116: see `PhysicsRuntime.resetBody`. */
+  resetBody(desc, body, record) {
+    const t = body.translation();
+    body.setTranslation(
+      { x: Number.isFinite(t.x) ? t.x : 0, y: Number.isFinite(t.y) ? t.y : 0 },
+      true
+    );
+    if (!Number.isFinite(body.rotation())) body.setRotation(0, true);
+    this.applyRecordToBody(desc, body, record);
+    if (!body.isEnabled()) body.setEnabled(true);
+    body.setLinvel({ x: 0, y: 0 }, true);
+    body.setAngvel(0, true);
+    body.resetForces(true);
+    body.resetTorques(true);
+    zeroVelocityFields(desc, record);
+  }
   // -------------------------------------------------------------------------
   // Hibernation
   // -------------------------------------------------------------------------
@@ -3916,6 +4154,9 @@ var CustomRuntime = class {
   sourceRecords = /* @__PURE__ */ new Map();
   skippedKeys = /* @__PURE__ */ new Set();
   scratch = emptyPose();
+  /** bugs #116: see `PhysicsRuntime.nonFinite`. */
+  nonFinite;
+  nextScratch = [];
   stepper;
   /**
    * M7 pf3 (a): a custom room's unsynced bodies are the stepper's own — it created them, it steps
@@ -3929,6 +4170,7 @@ var CustomRuntime = class {
     if (!config) throw new Error("CustomRuntime: the room config declares no physics");
     this.core = core;
     this.config = config;
+    this.nonFinite = new NonFiniteGuard(core);
     this.collections = core.ext.collections.filter(
       (c) => c.physics !== void 0
     );
@@ -3963,6 +4205,7 @@ var CustomRuntime = class {
     this.bodies.clear();
     this.unsyncedBodies.clear();
     this.sourceRecords.clear();
+    this.nonFinite.clear();
     this.stepper = void 0;
   }
   /** `room.physicsCustom.stepper`. Throws rather than handing back `undefined` half a world. */
@@ -4071,6 +4314,7 @@ var CustomRuntime = class {
           if (source === record) continue;
           this.bodies.delete(key);
           this.sourceRecords.delete(key);
+          this.nonFinite.forget(key);
           this.stepper?.removeBody(existing);
         }
         if (record !== void 0) this.create(desc, id, record);
@@ -4083,6 +4327,7 @@ var CustomRuntime = class {
       this.stepper?.removeBody(body);
     }
     for (const key of [...this.skippedKeys]) if (!live.has(key)) this.skippedKeys.delete(key);
+    this.nonFinite.prune(live);
   }
   // -------------------------------------------------------------------------
   // Step and sync
@@ -4108,20 +4353,60 @@ var CustomRuntime = class {
       const plainColl = plainEntity(this.core.plain, desc.name);
       const rounders = roundersFor4(desc);
       for (const id of plainColl.ids()) {
-        const body = this.bodies.get(bodyKey4(desc.name, id));
+        const key = bodyKey4(desc.name, id);
+        const body = this.bodies.get(key);
         if (body === void 0) continue;
         const record = tracked.get(id);
         if (!record) continue;
         const pose = this.scratch;
         stepper.readPose(body, pose);
+        const nexts = this.nextScratch;
+        nexts.length = 0;
         for (const [channel, field] of physics.channels) {
-          const next = (rounders[field] ?? identity4)(pose[channel]);
+          nexts.push((rounders[field] ?? identity4)(pose[channel]));
+        }
+        if (!poseFinite2(pose) || !allFinite(nexts)) {
+          const detail = describeNonFinite({
+            ...pose,
+            ...Object.fromEntries(physics.channels.map(([, field], i2) => [field, nexts[i2] ?? 0]))
+          });
+          if (this.nonFinite.note(desc, id, key, detail) === "skip") {
+            this.setSkipped(desc.name, id, true);
+          } else {
+            this.resetBody(stepper, desc, body, record);
+          }
+          continue;
+        }
+        let i = 0;
+        for (const [, field] of physics.channels) {
+          const next = nexts[i++];
           if (record[field] !== next) record[field] = next;
         }
       }
     }
   }
+  /**
+   * bugs #116: see `PhysicsRuntime.resetBody`. The pose is built from the row's mapped channels,
+   * with the identity rotation and the origin for unmapped ones and zero for every velocity; a
+   * stepper keeps its own forces, if it has any, where this module cannot see them.
+   */
+  resetBody(stepper, desc, body, record) {
+    const pose = emptyPose();
+    for (const [channel, field] of desc.physics?.channels ?? []) {
+      if (VELOCITY_CHANNELS2.has(channel)) continue;
+      const raw = record[field];
+      if (typeof raw === "number" && Number.isFinite(raw)) pose[channel] = raw;
+    }
+    stepper.writePose(body, pose);
+    zeroVelocityFields(desc, record);
+  }
 };
+var VELOCITY_CHANNELS2 = /* @__PURE__ */ new Set(["vx", "vy", "vz", "wx", "wy", "wz"]);
+var POSE_CHANNELS = Object.keys(emptyPose());
+function poseFinite2(pose) {
+  for (const channel of POSE_CHANNELS) if (!Number.isFinite(pose[channel])) return false;
+  return true;
+}
 function identity4(v) {
   return v;
 }
@@ -7171,7 +7456,9 @@ var RoomCore = class _RoomCore {
   get presence() {
     return this.anyState[PRESENCE_COLLECTION];
   }
-  resolveRole(requested, existing) {
+  /** Issue #123: clients already told that their requested role was ignored. Warn once each. */
+  unverifiedRoleWarned = /* @__PURE__ */ new Set();
+  resolveRole(clientId, requested, existing, verified) {
     const roles = this.definition.schema.roles;
     if (requested === void 0) return existing ?? roles[0] ?? "";
     if (roles.length === 0) {
@@ -7183,6 +7470,17 @@ var RoomCore = class _RoomCore {
       }
       return "";
     }
+    if (!verified && this.definition.schema.clientRoles !== true) {
+      const granted2 = existing ?? roles[0] ?? "";
+      if (requested !== "" && requested !== granted2 && !this.unverifiedRoleWarned.has(clientId)) {
+        this.unverifiedRoleWarned.add(clientId);
+        this.log(
+          "warn",
+          `join: ignored the client-requested role ${JSON.stringify(requested)}; using ${JSON.stringify(granted2)}. Roles come from a JWT role claim or room.setRole; set clientRoles: true in defineSchema to let clients pick`
+        );
+      }
+      return granted2;
+    }
     if (roles.includes(requested)) return requested;
     this.log(
       "warn",
@@ -7225,7 +7523,10 @@ var RoomCore = class _RoomCore {
     const ctx = {
       clientId,
       subject,
-      role: this.resolveRole(options.role, void 0),
+      role: this.resolveRole(clientId, options.role, void 0, options.roleVerified === true),
+      // Issue #123: which credential admitted this join, so a policy can tell anonymous from
+      // verified.
+      auth: options.auth ?? "key",
       name: options.name ?? "",
       tick: this.tick,
       // Bug #133: no `ClientEntry` exists yet, so the flag comes straight from the join options —
@@ -7283,7 +7584,12 @@ var RoomCore = class _RoomCore {
     const existing = this.clients.get(clientId);
     if (this.stopped) {
       this.log("warn", `join(${clientId}) after stop(); ignored`);
-      const role2 = this.resolveRole(options.role, existing?.role);
+      const role2 = this.resolveRole(
+        clientId,
+        options.role,
+        existing?.role,
+        options.roleVerified === true
+      );
       return {
         tick: this.tick,
         role: role2,
@@ -7304,7 +7610,12 @@ var RoomCore = class _RoomCore {
       throw new RoomFullError(maxClients);
     }
     const reconnecting = options.reconnecting === true;
-    const role = this.resolveRole(options.role, existing?.role);
+    const role = this.resolveRole(
+      clientId,
+      options.role,
+      existing?.role,
+      options.roleVerified === true
+    );
     const name = options.name ?? existing?.name ?? "";
     const record = presence.get(clientId);
     if (record) {
@@ -7335,6 +7646,7 @@ var RoomCore = class _RoomCore {
       playerId: options.playerId ?? clientId,
       // M8 lane 5: the narrower fact beside the one above. See `JoinOptions.subject`.
       subject: options.subject,
+      auth: options.auth ?? "key",
       npc: options.npc === true,
       role,
       name,
@@ -7419,6 +7731,7 @@ var RoomCore = class _RoomCore {
     this.rpcTraceRing?.forget(clientId);
     this.loop.dropFramesFor(clientId);
     this.clients.delete(clientId);
+    this.unverifiedRoleWarned.delete(clientId);
     this.stats.bytesOutByClient.delete(clientId);
     this.invalidateClients();
     this.eventFlush();
@@ -7466,6 +7779,9 @@ var RoomCore = class _RoomCore {
     return {
       clientId,
       playerId: entry?.playerId ?? clientId,
+      // Issue #123: read from the seat, so every ctx reports the credential the seat was taken
+      // with.
+      auth: entry?.auth ?? "key",
       role: entry?.role ?? "",
       name: entry?.name ?? "",
       tick: this.tick,

package/dist/{contract-B72MNcCa.d.ts → contract-CcZadpC6.d.ts}

@@ -528,8 +528,25 @@ interface RoomCoreOptions {
     readonly wallNow?: () => number;
 }
 interface JoinOptions {
-    /** Requested role; unknown/missing → `roles[0]` (logged) or `''` when the schema has no roles. */
+    /**
+     * Requested role; unknown/missing → `roles[0]` (logged) or `''` when the schema has no roles.
+     *
+     * Issue #123: honoured only when `roleVerified` is true or the schema set `clientRoles: true`.
+     * Otherwise an unverified request is ignored: a new seat gets `roles[0]` and a rejoining one
+     * keeps the role it already holds.
+     */
     readonly role?: string;
+    /**
+     * Issue #123: `role` was asserted by something the host verified (a JWT `role` claim, a resume
+     * token it signed, a role room code granted, an NPC the room spawned) rather than typed by the
+     * client. Absent means unverified.
+     */
+    readonly roleVerified?: boolean;
+    /**
+     * Issue #123: which credential admitted this join, surfaced as `ctx.auth`. Defaults to `'key'`,
+     * an anonymous project-key join.
+     */
+    readonly auth?: 'key' | 'jwt' | 'assertion';
     readonly name?: string;
     /** A resumed session: presence record kept, `ctx.reconnecting = true`. */
     readonly reconnecting?: boolean;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export { A as AdmissionError, D as DEFAULT_RECORDS_PER_COLLECTION, a as DEFAULT_TIMELINE_MAX_RECORDS, b as DEFAULT_TIMELINE_MAX_TICKS, E as EVENT_RING_SIZE, H as HOST_CALL_TIMEOUT_MS, c as HostCall, d as HostCallResult, J as JoinOptions, e as JoinResult, L as LogLevel, P as PHYSICS_STEP_EMA_ALPHA, R as RELAY_RECORDS_PER_COLLECTION, f as RELAY_STATE_BYTES, g as RELAY_WRITES_PER_SECOND, h as RELAY_WRITE_CAPS, i as RPC_TRACE_SIZE, j as RPC_TRACE_SUMMARY_MAX, k as RoomCoreApi, l as RoomCoreOptions, m as RoomEvent, n as RoomEventKind, o as RoomFullError, p as RoomHost, q as RoomInspection, r as RoomStats, s as RpcOutcome, t as RpcTraceDump, u as RpcTraceEntry, v as RpcTraceRing, S as StampLag, T as TimelineDump, w as TimelineFrame, x as TimelineRecorder, y as TimelineRecorderOptions, W as WriteCaps, z as inspectState, B as summarizeRpcResult } from './contract-B72MNcCa.js';
-export { C as CRASH_AFTER_THROWS, M as MAX_CATCHUP, a as MatterBodyRecord, b as MatterSection, c as Mulberry32, P as PhysicsEngineTag, d as PhysicsSection, R as RoomCore, e as decodeMatterBodies, f as decodeMatterSectionEnvelope, g as decodePhysicsSection, h as decodeRapier2dSectionEnvelope, i as encodeMatterBodies, j as encodeMatterSectionEnvelope, k as encodePhysicsSection, l as encodeRapier2dSectionEnvelope, m as initMatter, n as initPhysics, o as initRapier2d, p as loadedMatter, q as loadedPhysics, r as loadedRapier2d, s as physicsSectionEngine, t as resetMatterForTests, u as resetPhysicsForTests, v as resetRapier2dForTests } from './room-DY5J0VZR.js';
+export { A as AdmissionError, D as DEFAULT_RECORDS_PER_COLLECTION, a as DEFAULT_TIMELINE_MAX_RECORDS, b as DEFAULT_TIMELINE_MAX_TICKS, E as EVENT_RING_SIZE, H as HOST_CALL_TIMEOUT_MS, c as HostCall, d as HostCallResult, J as JoinOptions, e as JoinResult, L as LogLevel, P as PHYSICS_STEP_EMA_ALPHA, R as RELAY_RECORDS_PER_COLLECTION, f as RELAY_STATE_BYTES, g as RELAY_WRITES_PER_SECOND, h as RELAY_WRITE_CAPS, i as RPC_TRACE_SIZE, j as RPC_TRACE_SUMMARY_MAX, k as RoomCoreApi, l as RoomCoreOptions, m as RoomEvent, n as RoomEventKind, o as RoomFullError, p as RoomHost, q as RoomInspection, r as RoomStats, s as RpcOutcome, t as RpcTraceDump, u as RpcTraceEntry, v as RpcTraceRing, S as StampLag, T as TimelineDump, w as TimelineFrame, x as TimelineRecorder, y as TimelineRecorderOptions, W as WriteCaps, z as inspectState, B as summarizeRpcResult } from './contract-CcZadpC6.js';
+export { C as CRASH_AFTER_THROWS, M as MAX_CATCHUP, a as MatterBodyRecord, b as MatterSection, c as Mulberry32, P as PhysicsEngineTag, d as PhysicsSection, R as RoomCore, e as decodeMatterBodies, f as decodeMatterSectionEnvelope, g as decodePhysicsSection, h as decodeRapier2dSectionEnvelope, i as encodeMatterBodies, j as encodeMatterSectionEnvelope, k as encodePhysicsSection, l as encodeRapier2dSectionEnvelope, m as initMatter, n as initPhysics, o as initRapier2d, p as loadedMatter, q as loadedPhysics, r as loadedRapier2d, s as physicsSectionEngine, t as resetMatterForTests, u as resetPhysicsForTests, v as resetRapier2dForTests } from './room-BW2ZSX_k.js';
 import { CollectionDesc, AnySchema, PlainState, DirtySet } from '@irtio/schema';
 import '@irtio/protocol';
 import '@irtio/server';

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   fromMigrationState,
   migrateSnapshot,
   toMigrationState
-} from "./chunk-VIN2SPZT.js";
+} from "./chunk-NSUQKWYO.js";
 import {
   AdmissionError,
   CRASH_AFTER_THROWS,
@@ -59,7 +59,7 @@ import {
   visibleNames,
   visibleTo,
   writeHibernationBlob
-} from "./chunk-23TKVLTX.js";
+} from "./chunk-RLY4VAMM.js";
 export {
   AdmissionError,
   CRASH_AFTER_THROWS,

package/dist/{room-DY5J0VZR.d.ts → room-BW2ZSX_k.d.ts}

@@ -1,7 +1,7 @@
 import { PlatformNotice, AttributeOptions, ProfileSnapshot } from '@irtio/protocol';
 import { DirtySet, AnySchema, PlainState, Tracked, State } from '@irtio/schema';
 import { RoomDefinition, RoomMode, Room, RewindView, Ctx, CustomStepper, CustomPose, MatterModule, MatterEngine, MatterBody, RapierModule, RapierWorld, RapierRigidBody, Rapier2dModule, Rapier2dWorld, Rapier2dRigidBody, ResolvedRoomConfig, LeaveReason } from '@irtio/server';
-import { p as RoomHost, r as RoomStats, u as RpcTraceEntry, L as LogLevel, k as RoomCoreApi, l as RoomCoreOptions, n as RoomEventKind, y as TimelineRecorderOptions, T as TimelineDump, t as RpcTraceDump, q as RoomInspection, J as JoinOptions, e as JoinResult, d as HostCallResult } from './contract-B72MNcCa.js';
+import { p as RoomHost, r as RoomStats, u as RpcTraceEntry, L as LogLevel, k as RoomCoreApi, l as RoomCoreOptions, n as RoomEventKind, y as TimelineRecorderOptions, T as TimelineDump, t as RpcTraceDump, q as RoomInspection, J as JoinOptions, e as JoinResult, d as HostCallResult } from './contract-CcZadpC6.js';
 
 declare class Mulberry32 {
     /** Current internal state (u32). Survives hibernation. */
@@ -37,6 +37,8 @@ interface ClientEntry {
      * data rather than a caveat in a doc.
      */
     readonly subject: string | undefined;
+    /** Issue #123: the credential kind of the first join, kept across reconnects like `subject`. */
+    readonly auth: 'key' | 'jwt' | 'assertion';
     role: string;
     name: string;
     connected: boolean;
@@ -336,6 +338,9 @@ declare class CustomRuntime {
     private readonly sourceRecords;
     private readonly skippedKeys;
     private readonly scratch;
+    /** bugs #116: see `PhysicsRuntime.nonFinite`. */
+    private readonly nonFinite;
+    private readonly nextScratch;
     private stepper;
     /**
      * M7 pf3 (a): a custom room's unsynced bodies are the stepper's own — it created them, it steps
@@ -372,6 +377,12 @@ declare class CustomRuntime {
     step(): void;
     /** Body → schema, through the tracked proxies, `Math.fround`ed for f32 fields as Rapier's is. */
     sync(): void;
+    /**
+     * bugs #116: see `PhysicsRuntime.resetBody`. The pose is built from the row's mapped channels,
+     * with the identity rotation and the origin for unmapped ones and zero for every velocity; a
+     * stepper keeps its own forces, if it has any, where this module cannot see them.
+     */
+    private resetBody;
 }
 
 /**
@@ -640,6 +651,9 @@ declare class MatterRuntime {
     private readonly warnedChannels;
     /** See `PhysicsRuntime.skippedKeys`: entities whose body the room has switched off. */
     private readonly skippedKeys;
+    /** bugs #116: see `PhysicsRuntime.nonFinite`. */
+    private readonly nonFinite;
+    private readonly nextScratch;
     private readonly unsyncedBodies;
     /** Saved unsynced state, consumed as `setup` rebuilds each body under the same key. */
     private restoreUnsynced;
@@ -680,6 +694,15 @@ declare class MatterRuntime {
     reconcile(): void;
     step(): void;
     sync(): void;
+    /**
+     * bugs #116: the matter2d half of `PhysicsRuntime.resetBody`, done as a rebuild rather than a
+     * teleport. matter moves a body by translating its vertices by the difference between the new
+     * position and the old one, and once the old one is not finite that difference is not either:
+     * `Body.setPosition` cannot bring the vertices back. So the body is removed and built again
+     * from its row, whose pose is the last finite one `sync()` wrote, with the row's velocity
+     * fields zeroed first so the new body spawns at rest (and with no force, being new).
+     */
+    private resetBody;
     serialize(): MatterSection;
 }
 
@@ -845,6 +868,10 @@ declare class PhysicsRuntime {
      * why it is spelled as "no body" rather than as "a body that is not stepped".
      */
     private readonly skippedKeys;
+    /** bugs #116: what `sync()` does with a body that went non-finite. See `core/body-guard.ts`. */
+    private readonly nonFinite;
+    /** The mapped channel values of the body `sync()` is on, reused so the good path allocates nothing. */
+    private readonly nextScratch;
     /**
      * Bodies with no schema row: rope anchors, dead-reckoned proxies, one-off sensors. Keyed by the
      * room's own string rather than by `collection\0id`, because there is no collection and no id.
@@ -928,6 +955,12 @@ declare class PhysicsRuntime {
      * carries — and so a field that has not really moved does not re-dirty every tick.
      */
     sync(): void;
+    /**
+     * bugs #116: puts a non-finite body back at its row's pose (the last one `sync()` wrote, always
+     * finite), at rest, with no force left on it. Unmapped channels the engine made non-finite go to
+     * zero, or the identity rotation, since there is nothing better to put them back to.
+     */
+    private resetBody;
     serialize(): PhysicsSection;
 }
 
@@ -1009,6 +1042,9 @@ declare class Rapier2dRuntime {
     private readonly warnedChannels;
     /** See `PhysicsRuntime.skippedKeys`: entities whose body the room has switched off. */
     private readonly skippedKeys;
+    /** bugs #116: see `PhysicsRuntime.nonFinite`. */
+    private readonly nonFinite;
+    private readonly nextScratch;
     /** See `PhysicsRuntime.unsyncedBodies`: bodies the world steps that no schema row describes. */
     private readonly unsyncedBodies;
     readonly unsynced: UnsyncedRegistry;
@@ -1058,6 +1094,8 @@ declare class Rapier2dRuntime {
      * Values are `Math.fround`ed for f32 fields, so room code reads exactly what the wire carries.
      */
     sync(): void;
+    /** bugs #116: see `PhysicsRuntime.resetBody`. */
+    private resetBody;
     /**
      * The same `PhysicsSection` the 3D runtime writes — a real engine snapshot plus the
      * entity↔handle map, whose handles must ride as f64 for the reason spelled out on
@@ -1289,6 +1327,8 @@ declare class RoomCore<S extends AnySchema = AnySchema> implements RoomCoreApi<S
     lastSerializeTimerAt: number | undefined;
     serialize(): Uint8Array;
     private get presence();
+    /** Issue #123: clients already told that their requested role was ignored. Warn once each. */
+    private readonly unverifiedRoleWarned;
     private resolveRole;
     /**
      * Subjects `room.ban` has excluded, and when each stops being excluded. Values are wall-clock

package/dist/test/index.d.ts

@@ -1,8 +1,8 @@
-import { R as RoomCore } from '../room-DY5J0VZR.js';
-export { m as initMatter, n as initPhysics, o as initRapier2d } from '../room-DY5J0VZR.js';
+import { R as RoomCore } from '../room-BW2ZSX_k.js';
+export { m as initMatter, n as initPhysics, o as initRapier2d } from '../room-BW2ZSX_k.js';
 import { ErrorCodeName, FrameType } from '@irtio/protocol';
 import { NpcConfig, LeaveReason, Room, RoomDefinition } from '@irtio/server';
-import { p as RoomHost, L as LogLevel, k as RoomCoreApi, c as HostCall, d as HostCallResult, W as WriteCaps, r as RoomStats } from '../contract-B72MNcCa.js';
+import { p as RoomHost, L as LogLevel, k as RoomCoreApi, c as HostCall, d as HostCallResult, W as WriteCaps, r as RoomStats } from '../contract-CcZadpC6.js';
 import { AnySchema, PlainState, EntityCollection, State } from '@irtio/schema';
 
 /**
@@ -374,6 +374,14 @@ interface JoinSpec {
      * the relay host reads from the store for an identified player, without a store or a socket.
      */
     readonly persisted?: ReadonlyMap<string, Readonly<Record<string, unknown>>>;
+    /**
+     * Issue #123: `JoinOptions.roleVerified`. Defaults to `true` here: this harness stands where the
+     * host stands and its tests are about room behaviour, so `role` is a grant unless a test sets
+     * `false` to exercise the unverified path.
+     */
+    readonly roleVerified?: boolean;
+    /** Issue #123: `JoinOptions.auth`, the credential kind `ctx.auth` reports. Default `'key'`. */
+    readonly auth?: 'key' | 'jwt' | 'assertion';
 }
 interface UntilOptions {
     /** Default 1000. */

package/dist/test/index.js

@@ -6,7 +6,7 @@ import {
   initRapier2d,
   isPerClient,
   visibleNames
-} from "../chunk-23TKVLTX.js";
+} from "../chunk-RLY4VAMM.js";
 
 // src/test/clock.ts
 var FakeClock = class {
@@ -993,8 +993,10 @@ var Harness = class {
       ...spec.subject !== void 0 ? { subject: spec.subject } : {},
       // ---- end M8 lane 5 ----
       // ---- M8 proposal 13 ----
-      ...spec.persisted !== void 0 ? { persisted: spec.persisted } : {}
+      ...spec.persisted !== void 0 ? { persisted: spec.persisted } : {},
       // ---- end M8 proposal 13 ----
+      ...spec.roleVerified !== false ? { roleVerified: true } : {},
+      ...spec.auth !== void 0 ? { auth: spec.auth } : {}
     };
     const client = new FakeClientImpl(this.bridge, id, options);
     this.byId.set(id, client);

package/dist/worker/index.d.ts

@@ -1,4 +1,4 @@
-import { L as LogLevel, t as RpcTraceDump, T as TimelineDump, r as RoomStats, c as HostCall, d as HostCallResult, k as RoomCoreApi, p as RoomHost } from '../contract-B72MNcCa.js';
+import { L as LogLevel, t as RpcTraceDump, T as TimelineDump, r as RoomStats, c as HostCall, d as HostCallResult, k as RoomCoreApi, p as RoomHost } from '../contract-CcZadpC6.js';
 import { ErrorCodeName, ProfileSnapshot, PlatformNotice } from '@irtio/protocol';
 import { NpcConfig, LeaveReason } from '@irtio/server';
 import '@irtio/schema';
@@ -54,6 +54,10 @@ type ToWorker = {
     /** M8 lane 5: the verified subject, absent for a key join. See `JoinOptions.subject` — it is
      *  deliberately narrower than `playerId`, which always has a value. */
     subject?: string;
+    /** Issue #123: `JoinOptions.auth`, the credential kind. Absent means `'key'`. */
+    auth?: 'key' | 'jwt' | 'assertion';
+    /** Issue #123: `JoinOptions.roleVerified`. Absent means the role is a client request. */
+    roleVerified?: boolean;
 } | {
     t: 'leave';
     clientId: string;
@@ -304,10 +308,17 @@ type FromWorker = {
      * what cap it handed out to know how close the room is to it. Absent when the worker's
      * V8 could not be sampled, which the supervisor must report as unread rather than as
      * zero, for the same reason `ticks`/`overruns` are optional.
+     *
+     * bugs.md #146: `externalBytes` is the off-heap half — `ArrayBuffer` backing stores, WASM
+     * memory, `Buffer`s — which neither `usedBytes` nor the old-generation cap above it covers,
+     * and which is therefore the half a room can overshoot its whole budget with while every
+     * number the platform was reading stays small. Optional on the wire because an older worker
+     * does not send it, and because "V8 did not report it" is not "this room holds none".
      */
     heap?: {
         usedBytes: number;
         limitBytes: number;
+        externalBytes?: number;
     };
     /**
      * D56: `true` once any Rapier world in this worker process has stepped, which is the point

package/dist/worker/index.js

@@ -1,6 +1,6 @@
 import {
   migrateSnapshot
-} from "../chunk-VIN2SPZT.js";
+} from "../chunk-NSUQKWYO.js";
 import {
   AdmissionError,
   RoomCore,
@@ -10,7 +10,7 @@ import {
   initRapier2d,
   onFirstRapierStep,
   rapierHasStepped
-} from "../chunk-23TKVLTX.js";
+} from "../chunk-RLY4VAMM.js";
 
 // src/worker/index.ts
 import { getHeapStatistics } from "v8";
@@ -121,7 +121,12 @@ function heapSample() {
     const s = getHeapStatistics();
     if (!Number.isFinite(s.used_heap_size) || !Number.isFinite(s.heap_size_limit)) return void 0;
     if (s.heap_size_limit <= 0) return void 0;
-    return { usedBytes: s.used_heap_size, limitBytes: s.heap_size_limit };
+    const external = s.external_memory;
+    return {
+      usedBytes: s.used_heap_size,
+      limitBytes: s.heap_size_limit,
+      ...typeof external === "number" && Number.isFinite(external) && external >= 0 ? { externalBytes: external } : {}
+    };
   } catch {
     return void 0;
   }
@@ -265,7 +270,10 @@ async function handleMessage(state, host, post, msg) {
             ...msg.npc === true ? { npc: true } : {},
             // M8 lane 5: absent for a key join, and absent is the answer `onAdmit` and `room.ban`
             // both need to be able to see.
-            ...msg.subject !== void 0 ? { subject: msg.subject } : {}
+            ...msg.subject !== void 0 ? { subject: msg.subject } : {},
+            // Issue #123: without these the room would treat every role as a client request.
+            ...msg.auth !== void 0 ? { auth: msg.auth } : {},
+            ...msg.roleVerified === true ? { roleVerified: true } : {}
           };
           const result = core.join(msg.clientId, joinOptions);
           const snapshot = ownBuffer(result.snapshot);
@@ -463,6 +471,15 @@ if (!isMainThread && parentPort) {
       ]
     });
   });
+  process.on("uncaughtException", (err) => {
+    post({
+      t: "log",
+      level: "error",
+      args: ["worker: uncaught exception", err?.stack ?? String(err)]
+    });
+    post({ t: "crashed", reason: `uncaught exception: ${err?.message ?? String(err)}` });
+    process.exit(1);
+  });
   const host = createWorkerHost(post);
   const state = { core: void 0 };
   port.on("message", (msg) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@irtio/runtime",
-  "version": "4.5.1",
+  "version": "4.7.0",
   "description": "irtio room runtime: RoomCore, worker_threads host, in-process test harness",
   "license": "MIT",
   "repository": {
@@ -36,9 +36,9 @@
     "@dimforge/rapier2d-compat": "0.20.0",
     "@dimforge/rapier3d-compat": "0.20.0",
     "matter-js": "0.20.0",
-    "@irtio/protocol": "^4.5.1",
-    "@irtio/schema": "^4.5.1",
-    "@irtio/server": "^4.5.1"
+    "@irtio/protocol": "^4.7.0",
+    "@irtio/server": "^4.7.0",
+    "@irtio/schema": "^4.7.0"
   },
   "devDependencies": {
     "@types/matter-js": "0.20.2"