@signe/room 2.10.0 → 3.0.1

package/dist/index.js

@@ -1,13 +1,6 @@
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __decorateClass = (decorators, target, key, kind) => {
-  var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
-  for (var i = decorators.length - 1, decorator; i >= 0; i--)
-    if (decorator = decorators[i])
-      result = (kind ? decorator(target, key, result) : decorator(result)) || result;
-  if (kind && result) __defProp(target, key, result);
-  return result;
-};
+import {
+  __decorateClass
+} from "./chunk-EUXUH3YW.js";
 
 // src/decorators.ts
 function Action(name, bodyValidation) {
@@ -90,16 +83,38 @@ var Storage = class {
     this.memory = /* @__PURE__ */ new Map();
   }
   async put(key, value) {
-    this.memory.set(key, value);
+    if (typeof key === "string") {
+      this.memory.set(key, value);
+      return;
+    }
+    for (const [entryKey, entryValue] of Object.entries(key)) {
+      this.memory.set(entryKey, entryValue);
+    }
   }
   async get(key) {
     return this.memory.get(key);
   }
   async delete(key) {
-    this.memory.delete(key);
+    if (Array.isArray(key)) {
+      let deleted = 0;
+      for (const entryKey of key) {
+        if (this.memory.delete(entryKey)) {
+          deleted += 1;
+        }
+      }
+      return deleted;
+    }
+    return this.memory.delete(key);
   }
-  async list() {
-    return this.memory;
+  async list(options) {
+    if (!options?.prefix) {
+      return this.memory;
+    }
+    return new Map(
+      Array.from(this.memory.entries()).filter(
+        ([key]) => String(key).startsWith(options.prefix)
+      )
+    );
   }
 };
 
@@ -438,6 +453,14 @@ var Message = z.object({
   action: z.string(),
   value: z.any()
 });
+var STATE_PREFIX = "state:";
+var SESSION_PREFIX = "session:";
+var SESSION_PUBLIC_PREFIX = "session-public:";
+var TRANSFER_PREFIX = "transfer:";
+var INTERNAL_PREFIX = "$room:";
+var SESSION_GC_LAST_RUN_KEY = `${INTERNAL_PREFIX}session-gc:last-run`;
+var TRANSFER_GC_LAST_RUN_KEY = `${INTERNAL_PREFIX}transfer-gc:last-run`;
+var DEFAULT_TRANSFER_EXPIRY_MS = 5 * 60 * 1e3;
 var Server = class {
   /**
    * @constructor
@@ -470,6 +493,187 @@ var Server = class {
   get roomStorage() {
     return this.room.storage;
   }
+  stateKey(path) {
+    return `${STATE_PREFIX}${path}`;
+  }
+  sessionKey(privateId) {
+    return `${SESSION_PREFIX}${privateId}`;
+  }
+  sessionPublicKey(publicId) {
+    return `${SESSION_PUBLIC_PREFIX}${publicId}`;
+  }
+  transferKey(token) {
+    return `${TRANSFER_PREFIX}${token}`;
+  }
+  isInternalStorageKey(key) {
+    return key.startsWith(STATE_PREFIX) || key.startsWith(SESSION_PREFIX) || key.startsWith(SESSION_PUBLIC_PREFIX) || key.startsWith(TRANSFER_PREFIX) || key.startsWith(INTERNAL_PREFIX);
+  }
+  async listStorage(prefix) {
+    if (!prefix) {
+      return this.room.storage.list();
+    }
+    return this.room.storage.list({ prefix });
+  }
+  async loadStatePath(path) {
+    return this.room.storage.get(this.stateKey(path));
+  }
+  async saveStatePath(path, value) {
+    await this.room.storage.put(this.stateKey(path), value);
+  }
+  async putStorageEntries(entries) {
+    const keys = Object.keys(entries);
+    if (keys.length === 0) return;
+    if (keys.length === 1) {
+      const key = keys[0];
+      await this.room.storage.put(key, entries[key]);
+      return;
+    }
+    await this.room.storage.put(entries);
+  }
+  async deleteStorageKeys(keys) {
+    const uniqueKeys = Array.from(new Set(keys));
+    if (uniqueKeys.length === 0) return;
+    if (uniqueKeys.length === 1) {
+      await this.room.storage.delete(uniqueKeys[0]);
+      return;
+    }
+    await this.room.storage.delete(uniqueKeys);
+  }
+  async deleteStatePath(path) {
+    const stateKey = this.stateKey(path);
+    const descendantEntries = await this.listStorage(`${stateKey}.`);
+    await this.deleteStorageKeys([
+      ...Array.from(descendantEntries.keys()),
+      stateKey
+    ]);
+    await this.saveStatePath(path, DELETE_TOKEN);
+  }
+  containsDeleteToken(value) {
+    if (value === DELETE_TOKEN) {
+      return true;
+    }
+    if (!value || typeof value !== "object") {
+      return false;
+    }
+    if (Array.isArray(value)) {
+      return value.some((item) => this.containsDeleteToken(item));
+    }
+    return Object.values(value).some((item) => this.containsDeleteToken(item));
+  }
+  async compactStateStorage(instance) {
+    const entries = await this.listStorage(STATE_PREFIX);
+    const keys = Array.from(entries.keys());
+    if (keys.length === 0) {
+      return;
+    }
+    const snapshot = createStatesSnapshotDeep(instance);
+    await this.deleteStorageKeys(keys);
+    await this.saveStatePath(".", snapshot);
+    const metrics = instance.$storageMetrics;
+    if (metrics) {
+      metrics.stateCompactions += 1;
+      metrics.stateCompactionDeletes += keys.length;
+    }
+  }
+  createUserFromClassType(classType, ...args) {
+    if (!classType) {
+      return void 0;
+    }
+    return isClass(classType) ? new classType() : classType(...args);
+  }
+  async restoreUsersStorageSnapshot(instance, snapshot, options) {
+    if (!snapshot || typeof snapshot !== "object" || Array.isArray(snapshot)) {
+      return snapshot;
+    }
+    const restoreUser = instance["onUserStorageRestore"];
+    if (typeof restoreUser !== "function") {
+      return snapshot;
+    }
+    const signal2 = this.getUsersProperty(instance);
+    const usersPropName = this.getUsersPropName(instance);
+    if (!signal2 || !usersPropName) {
+      return snapshot;
+    }
+    const usersSnapshot = snapshot[usersPropName];
+    if (!usersSnapshot || typeof usersSnapshot !== "object" || Array.isArray(usersSnapshot)) {
+      return snapshot;
+    }
+    const { classType } = signal2.options || {};
+    let nextSnapshot = snapshot;
+    let nextUsersSnapshot = usersSnapshot;
+    for (const [publicId, userSnapshot] of Object.entries(usersSnapshot)) {
+      const user = this.createUserFromClassType(classType, publicId);
+      const restoredUserSnapshot = await awaitReturn(
+        restoreUser.call(instance, {
+          userSnapshot,
+          user,
+          publicId,
+          usersPropName,
+          room: this.room,
+          server: this,
+          legacy: options.legacy
+        })
+      );
+      if (restoredUserSnapshot !== void 0 && restoredUserSnapshot !== userSnapshot) {
+        if (nextSnapshot === snapshot) {
+          nextSnapshot = { ...snapshot };
+        }
+        if (nextUsersSnapshot === usersSnapshot) {
+          nextUsersSnapshot = { ...usersSnapshot };
+          nextSnapshot[usersPropName] = nextUsersSnapshot;
+        }
+        nextUsersSnapshot[publicId] = restoredUserSnapshot;
+      }
+    }
+    return nextSnapshot;
+  }
+  async restoreStorageSnapshot(instance, snapshot, options) {
+    const restoreSnapshot = instance["onStorageRestore"];
+    let restoredSnapshot = snapshot;
+    if (typeof restoreSnapshot === "function") {
+      const result = await awaitReturn(
+        restoreSnapshot.call(instance, {
+          snapshot,
+          room: this.room,
+          server: this,
+          legacy: options.legacy
+        })
+      );
+      if (result !== void 0) {
+        restoredSnapshot = result;
+      }
+    }
+    return this.restoreUsersStorageSnapshot(instance, restoredSnapshot, options);
+  }
+  createStorageMetrics() {
+    return {
+      loadMs: 0,
+      loadStateKeys: 0,
+      loadLegacyKeys: 0,
+      stateCompactions: 0,
+      stateCompactionDeletes: 0,
+      persistFlushes: 0,
+      persistWrites: 0,
+      persistDeletes: 0,
+      persistLastFlushMs: 0,
+      sessionGcRuns: 0,
+      sessionGcScanned: 0,
+      sessionGcExpired: 0,
+      sessionIndexRepairs: 0,
+      transferGcRuns: 0,
+      transferGcScanned: 0,
+      transferGcExpired: 0
+    };
+  }
+  getTransferExpiryTime(subRoom) {
+    return subRoom?.transferExpiryTime ?? subRoom?.constructor?.prototype?.transferExpiryTime ?? subRoom?.constructor?.transferExpiryTime ?? DEFAULT_TRANSFER_EXPIRY_MS;
+  }
+  getPrivateId(conn) {
+    return conn.state?.privateId || conn.sessionId || conn.id;
+  }
+  hasActiveSessionConnection(privateId) {
+    return Array.from(this.room.getConnections()).some((conn) => this.getPrivateId(conn) === privateId);
+  }
   async send(conn, obj, subRoom) {
     obj = structuredClone(obj);
     if (subRoom.interceptorPacket) {
@@ -511,33 +715,44 @@ var Server = class {
   async garbageCollector(options) {
     const subRoom = await this.getSubRoom();
     if (!subRoom) return;
+    const SESSION_EXPIRY_TIME = Number(options.sessionExpiryTime);
+    if (!Number.isFinite(SESSION_EXPIRY_TIME)) {
+      return;
+    }
     const activeConnections = [...this.room.getConnections()];
-    const activePrivateIds = new Set(activeConnections.map((conn) => conn.id));
+    const activePrivateIds = new Set(activeConnections.map((conn) => this.getPrivateId(conn)));
     try {
-      const sessions = await this.room.storage.list();
+      const sessions = await this.listStorage(SESSION_PREFIX);
       const users = this.getUsersProperty(subRoom);
       const usersPropName = this.getUsersPropName(subRoom);
+      const metrics = subRoom.$storageMetrics;
+      if (metrics) {
+        metrics.sessionGcRuns += 1;
+        metrics.sessionGcScanned += sessions.size;
+      }
       const validPublicIds = /* @__PURE__ */ new Set();
       const expiredPublicIds = /* @__PURE__ */ new Set();
-      const SESSION_EXPIRY_TIME = options.sessionExpiryTime;
       const now = Date.now();
       for (const [key, session] of sessions) {
-        if (!key.startsWith("session:")) continue;
-        const privateId = key.replace("session:", "");
+        if (!key.startsWith(SESSION_PREFIX)) continue;
+        const privateId = key.slice(SESSION_PREFIX.length);
         const typedSession = session;
-        if (!activePrivateIds.has(privateId) && !typedSession.connected && now - typedSession.created > SESSION_EXPIRY_TIME) {
+        if (!activePrivateIds.has(privateId) && !typedSession.connected && typedSession.disconnectedAt !== void 0 && now - typedSession.disconnectedAt >= SESSION_EXPIRY_TIME) {
           await this.deleteSession(privateId);
           expiredPublicIds.add(typedSession.publicId);
+          if (metrics) {
+            metrics.sessionGcExpired += 1;
+          }
         } else if (typedSession && typedSession.publicId) {
           validPublicIds.add(typedSession.publicId);
         }
       }
+      await this.repairSessionPublicIndexes(sessions, metrics);
       if (users && usersPropName) {
         const currentUsers = users();
         for (const publicId in currentUsers) {
           if (expiredPublicIds.has(publicId) && !validPublicIds.has(publicId)) {
             delete currentUsers[publicId];
-            await this.room.storage.delete(`${usersPropName}.${publicId}`);
           }
         }
       }
@@ -545,6 +760,145 @@ var Server = class {
       console.error("Error in garbage collector:", error);
     }
   }
+  scheduleSessionGarbageCollector(sessionExpiryTime, privateId) {
+    const normalizedSessionExpiryTime = Number(sessionExpiryTime);
+    if (!Number.isFinite(normalizedSessionExpiryTime) || normalizedSessionExpiryTime < 0) {
+      return;
+    }
+    setTimeout(() => {
+      if (privateId) {
+        void this.expireDisconnectedSession(privateId, normalizedSessionExpiryTime);
+        return;
+      }
+      void this.garbageCollector({ sessionExpiryTime: normalizedSessionExpiryTime });
+    }, normalizedSessionExpiryTime);
+  }
+  getSessionExpiryTime(subRoom) {
+    return subRoom?.sessionExpiryTime ?? subRoom?.constructor?.prototype?.sessionExpiryTime ?? subRoom?.constructor?.sessionExpiryTime;
+  }
+  async shouldRunSessionGarbageCollector(sessionExpiryTime) {
+    const normalizedSessionExpiryTime = Number(sessionExpiryTime);
+    if (!Number.isFinite(normalizedSessionExpiryTime) || normalizedSessionExpiryTime < 0) {
+      return false;
+    }
+    const now = Date.now();
+    const lastRun = await this.room.storage.get(SESSION_GC_LAST_RUN_KEY);
+    if (lastRun && now - lastRun < normalizedSessionExpiryTime) {
+      return false;
+    }
+    await this.room.storage.put(SESSION_GC_LAST_RUN_KEY, now);
+    return true;
+  }
+  async shouldRunInterval(key, interval) {
+    const normalizedInterval = Number(interval);
+    if (!Number.isFinite(normalizedInterval) || normalizedInterval < 0) {
+      return false;
+    }
+    const now = Date.now();
+    const lastRun = await this.room.storage.get(key);
+    if (lastRun && now - lastRun < normalizedInterval) {
+      return false;
+    }
+    await this.room.storage.put(key, now);
+    return true;
+  }
+  async repairSessionPublicIndexes(sessions, metrics) {
+    const sessionEntries = sessions ?? await this.listStorage(SESSION_PREFIX);
+    const expected = /* @__PURE__ */ new Map();
+    for (const [key, session] of sessionEntries) {
+      if (!session?.publicId) continue;
+      const privateId = key.slice(SESSION_PREFIX.length);
+      const privateIds = expected.get(session.publicId) ?? [];
+      privateIds.push(privateId);
+      expected.set(session.publicId, privateIds);
+    }
+    const publicIndexes = await this.listStorage(SESSION_PUBLIC_PREFIX);
+    const writes = {};
+    const deletes = [];
+    let repairs = 0;
+    for (const [publicId, privateIds] of expected) {
+      privateIds.sort();
+      const key = this.sessionPublicKey(publicId);
+      const existing = publicIndexes.get(key) ?? [];
+      const normalizedExisting = Array.isArray(existing) ? [...existing].sort() : [];
+      if (JSON.stringify(normalizedExisting) !== JSON.stringify(privateIds)) {
+        writes[key] = privateIds;
+        repairs += 1;
+      }
+    }
+    for (const [key] of publicIndexes) {
+      const publicId = key.slice(SESSION_PUBLIC_PREFIX.length);
+      if (!expected.has(publicId)) {
+        deletes.push(key);
+        repairs += 1;
+      }
+    }
+    await Promise.all([
+      this.putStorageEntries(writes),
+      this.deleteStorageKeys(deletes)
+    ]);
+    if (metrics) {
+      metrics.sessionIndexRepairs += repairs;
+    }
+  }
+  isTransferExpired(transfer, transferExpiryTime) {
+    if (!transfer) return true;
+    if (!Number.isFinite(transferExpiryTime) || transferExpiryTime < 0) {
+      return false;
+    }
+    const created = Number(transfer.created);
+    if (!Number.isFinite(created)) {
+      return false;
+    }
+    return Date.now() - created >= transferExpiryTime;
+  }
+  async cleanupExpiredTransfers(transferExpiryTime, metrics) {
+    if (!Number.isFinite(transferExpiryTime) || transferExpiryTime < 0) {
+      return;
+    }
+    const transfers = await this.listStorage(TRANSFER_PREFIX);
+    const expiredKeys = [];
+    for (const [key, transfer] of transfers) {
+      if (this.isTransferExpired(transfer, transferExpiryTime)) {
+        expiredKeys.push(key);
+      }
+    }
+    await this.deleteStorageKeys(expiredKeys);
+    if (metrics) {
+      metrics.transferGcRuns += 1;
+      metrics.transferGcScanned += transfers.size;
+      metrics.transferGcExpired += expiredKeys.length;
+    }
+  }
+  async expireDisconnectedSession(privateId, sessionExpiryTime) {
+    const session = await this.getSession(privateId);
+    if (!session || session.connected || session.disconnectedAt === void 0) {
+      return;
+    }
+    if (this.hasActiveSessionConnection(privateId)) {
+      return;
+    }
+    const elapsed = Date.now() - session.disconnectedAt;
+    if (elapsed < sessionExpiryTime) {
+      setTimeout(() => {
+        void this.expireDisconnectedSession(privateId, sessionExpiryTime);
+      }, sessionExpiryTime - elapsed);
+      return;
+    }
+    await this.deleteSession(privateId);
+    const privateIds = await this.getSessionPrivateIds(session.publicId);
+    for (const otherPrivateId of privateIds) {
+      const otherSession = await this.getSession(otherPrivateId);
+      if (otherSession?.publicId === session.publicId) {
+        return;
+      }
+    }
+    const subRoom = await this.getSubRoom();
+    const users = this.getUsersProperty(subRoom);
+    if (users?.()[session.publicId]) {
+      delete users()[session.publicId];
+    }
+  }
   /**
    * @method createRoom
    * @private
@@ -576,21 +930,67 @@ var Server = class {
       return null;
     }
     const loadMemory = async () => {
-      const root = await this.room.storage.get(".");
-      const memory = await this.room.storage.list();
+      const startedAt = Date.now();
+      const metrics = instance.$storageMetrics;
+      const root = await this.loadStatePath(".");
+      const memory = await this.listStorage(STATE_PREFIX);
+      metrics.loadStateKeys = memory.size;
       const tmpObject = root || {};
-      for (let [key, value] of memory) {
-        if (key.startsWith("session:")) {
-          continue;
-        }
-        if (key == ".") {
+      for (let [storageKey, value] of memory) {
+        const key = storageKey.slice(STATE_PREFIX.length);
+        if (key === ".") {
           continue;
         }
         dset2(tmpObject, key, value);
       }
-      load(instance, tmpObject, true);
+      if (root === void 0 && memory.size === 0) {
+        const legacyRoot = await this.room.storage.get(".");
+        const legacyMemory = await this.room.storage.list();
+        const legacyObject = legacyRoot || {};
+        const migratedEntries = [];
+        const legacyDeleteKeys = [];
+        if (legacyRoot !== void 0) {
+          migratedEntries.push([".", legacyRoot]);
+          legacyDeleteKeys.push(".");
+        }
+        for (let [key, value] of legacyMemory) {
+          if (key === "." || this.isInternalStorageKey(key)) {
+            continue;
+          }
+          dset2(legacyObject, key, value);
+          migratedEntries.push([key, value]);
+          legacyDeleteKeys.push(key);
+        }
+        metrics.loadLegacyKeys = migratedEntries.length;
+        await this.putStorageEntries(
+          Object.fromEntries(
+            migratedEntries.map(([path, value]) => [this.stateKey(path), value])
+          )
+        );
+        if (legacyDeleteKeys.length > 0) {
+          await this.deleteStorageKeys(legacyDeleteKeys);
+        }
+        const restoredLegacyObject = await this.restoreStorageSnapshot(instance, legacyObject, {
+          legacy: true
+        });
+        load(instance, restoredLegacyObject, true);
+        if (this.containsDeleteToken(restoredLegacyObject)) {
+          await this.compactStateStorage(instance);
+        }
+        metrics.loadMs = Date.now() - startedAt;
+        return;
+      }
+      const restoredObject = await this.restoreStorageSnapshot(instance, tmpObject, {
+        legacy: false
+      });
+      load(instance, restoredObject, true);
+      if (this.containsDeleteToken(restoredObject)) {
+        await this.compactStateStorage(instance);
+      }
+      metrics.loadMs = Date.now() - startedAt;
     };
     instance.$memoryAll = {};
+    instance.$storageMetrics = this.createStorageMetrics();
     instance.$autoSync = instance["autoSync"] !== false;
     instance.$pendingSync = /* @__PURE__ */ new Map();
     instance.$pendingInitialSync = /* @__PURE__ */ new Map();
@@ -644,16 +1044,9 @@ var Server = class {
         console.error(`[sessionTransfer] User with publicId ${publicId} not found.`);
         return null;
       }
-      const sessions = await this.room.storage.list();
-      let userSession = null;
-      let privateId = null;
-      for (const [key, session] of sessions) {
-        if (key.startsWith("session:") && session.publicId === publicId) {
-          userSession = session;
-          privateId = key.replace("session:", "");
-          break;
-        }
-      }
+      const sessionEntry = await this.getSessionEntryByPublicId(publicId);
+      const userSession = sessionEntry?.session;
+      const privateId = sessionEntry?.privateId ?? null;
       if (!userSession || !privateId) {
         console.error(`[sessionTransfer] Session for publicId ${publicId} not found.`);
         return null;
@@ -714,25 +1107,98 @@ var Server = class {
       );
       values.clear();
     };
-    const persistCb = async (values) => {
-      if (initPersist) {
-        values.clear();
-        return;
-      }
+    const flushPersist = async (values) => {
+      const startedAt = Date.now();
+      const stateWrites = {};
+      const deleteTasks = [];
+      let hasDeletes = false;
       for (let [path, value] of values) {
         const _instance = path == "." ? instance : getByPath(instance, path);
-        const itemValue = createStatesSnapshot(_instance);
         if (value == DELETE_TOKEN) {
-          await this.room.storage.delete(path);
+          hasDeletes = true;
+          deleteTasks.push(this.deleteStatePath(path));
         } else {
-          await this.room.storage.put(path, itemValue);
+          const itemValue = _instance?.$snapshot ? createStatesSnapshot(_instance) : value;
+          stateWrites[this.stateKey(path)] = itemValue;
         }
       }
+      await Promise.all([
+        this.putStorageEntries(stateWrites),
+        ...deleteTasks
+      ]);
+      if (hasDeletes) {
+        await this.compactStateStorage(instance);
+      }
+      const metrics = instance.$storageMetrics;
+      if (metrics) {
+        metrics.persistFlushes += 1;
+        metrics.persistWrites += Object.keys(stateWrites).length;
+        metrics.persistDeletes += deleteTasks.length;
+        metrics.persistLastFlushMs = Date.now() - startedAt;
+      }
+    };
+    let persistQueue = Promise.resolve();
+    const persistCb = async (values) => {
+      if (initPersist) {
+        values.clear();
+        return;
+      }
+      const valuesSnapshot = new Map(values);
       values.clear();
+      persistQueue = persistQueue.then(
+        () => flushPersist(valuesSnapshot),
+        () => flushPersist(valuesSnapshot)
+      );
+      await persistQueue;
+    };
+    const debouncePersist = (wait) => {
+      let timeout = null;
+      let flushing = false;
+      const pending = /* @__PURE__ */ new Map();
+      const schedule = () => {
+        if (timeout) {
+          clearTimeout(timeout);
+        }
+        timeout = setTimeout(() => {
+          void flush();
+        }, wait);
+      };
+      const flush = async () => {
+        timeout = null;
+        if (flushing) {
+          schedule();
+          return;
+        }
+        const values = new Map(pending);
+        pending.clear();
+        if (!values.size) {
+          return;
+        }
+        flushing = true;
+        try {
+          await persistCb(values);
+        } finally {
+          flushing = false;
+          if (pending.size) {
+            schedule();
+          }
+        }
+      };
+      return (values) => {
+        if (initPersist) {
+          values.clear();
+          return;
+        }
+        for (const [path, value] of values) {
+          pending.set(path, value);
+        }
+        values.clear();
+        schedule();
+      };
     };
     syncClass(instance, {
       onSync: instance["throttleSync"] ? throttle(syncCb, instance["throttleSync"]) : syncCb,
-      onPersist: instance["throttleStorage"] ? throttle(persistCb, instance["throttleStorage"]) : persistCb
+      onPersist: instance["throttleStorage"] ? debouncePersist(instance["throttleStorage"]) : persistCb
     });
     await loadMemory();
     initPersist = false;
@@ -839,24 +1305,93 @@ var Server = class {
   async getSession(privateId) {
     if (!privateId) return null;
     try {
-      const session = await this.room.storage.get(`session:${privateId}`);
+      const session = await this.room.storage.get(this.sessionKey(privateId));
       return session;
     } catch (e) {
       return null;
     }
   }
+  async getSessionPrivateIds(publicId) {
+    if (!publicId) return [];
+    const privateIds = await this.room.storage.get(this.sessionPublicKey(publicId));
+    return Array.isArray(privateIds) ? privateIds : [];
+  }
+  async saveSessionPrivateIds(publicId, privateIds) {
+    const key = this.sessionPublicKey(publicId);
+    if (privateIds.length === 0) {
+      await this.room.storage.delete(key);
+      return;
+    }
+    await this.room.storage.put(key, privateIds);
+  }
+  async addSessionToPublicIndex(privateId, publicId) {
+    const privateIds = await this.getSessionPrivateIds(publicId);
+    if (privateIds.includes(privateId)) {
+      return;
+    }
+    await this.saveSessionPrivateIds(publicId, [...privateIds, privateId]);
+  }
+  async removeSessionFromPublicIndex(privateId, publicId) {
+    const privateIds = await this.getSessionPrivateIds(publicId);
+    await this.saveSessionPrivateIds(
+      publicId,
+      privateIds.filter((id2) => id2 !== privateId)
+    );
+  }
+  async getSessionEntryByPublicId(publicId) {
+    const indexedPrivateIds = await this.getSessionPrivateIds(publicId);
+    const stalePrivateIds = [];
+    for (const privateId of indexedPrivateIds) {
+      const session = await this.getSession(privateId);
+      if (session?.publicId === publicId) {
+        return { privateId, session };
+      }
+      stalePrivateIds.push(privateId);
+    }
+    if (stalePrivateIds.length) {
+      await this.saveSessionPrivateIds(
+        publicId,
+        indexedPrivateIds.filter((id2) => !stalePrivateIds.includes(id2))
+      );
+    }
+    const sessions = await this.listStorage(SESSION_PREFIX);
+    for (const [key, session] of sessions) {
+      const privateId = key.slice(SESSION_PREFIX.length);
+      if (session?.publicId) {
+        await this.addSessionToPublicIndex(privateId, session.publicId);
+      }
+      if (session?.publicId === publicId) {
+        return { privateId, session };
+      }
+    }
+    return null;
+  }
   async saveSession(privateId, data) {
+    const existingSession = await this.getSession(privateId);
     const sessionData = {
       ...data,
       created: data.created || Date.now(),
       connected: data.connected !== void 0 ? data.connected : true
     };
-    await this.room.storage.put(`session:${privateId}`, sessionData);
+    await this.room.storage.put(this.sessionKey(privateId), sessionData);
+    if (existingSession?.publicId && existingSession.publicId !== sessionData.publicId) {
+      await this.removeSessionFromPublicIndex(privateId, existingSession.publicId);
+    }
+    await this.addSessionToPublicIndex(privateId, sessionData.publicId);
   }
   async updateSessionConnection(privateId, connected) {
     const session = await this.getSession(privateId);
     if (session) {
-      await this.saveSession(privateId, { ...session, connected });
+      const nextSession = { ...session, connected };
+      if (connected) {
+        delete nextSession.disconnectedAt;
+      } else {
+        nextSession.disconnectedAt = Date.now();
+      }
+      if (!await this.getSession(privateId)) {
+        return;
+      }
+      await this.saveSession(privateId, nextSession);
     }
   }
   /**
@@ -871,7 +1406,11 @@ var Server = class {
    * ```
    */
   async deleteSession(privateId) {
-    await this.room.storage.delete(`session:${privateId}`);
+    const session = await this.getSession(privateId);
+    await this.room.storage.delete(this.sessionKey(privateId));
+    if (session?.publicId) {
+      await this.removeSessionFromPublicIndex(privateId, session.publicId);
+    }
   }
   async onConnectClient(conn, ctx) {
     const subRoom = await this.getSubRoom({
@@ -881,8 +1420,17 @@ var Server = class {
       conn.close();
       return;
     }
-    const sessionExpiryTime = subRoom.constructor.sessionExpiryTime;
-    await this.garbageCollector({ sessionExpiryTime });
+    const sessionExpiryTime = this.getSessionExpiryTime(subRoom);
+    if (await this.shouldRunSessionGarbageCollector(sessionExpiryTime)) {
+      await this.garbageCollector({ sessionExpiryTime });
+    }
+    const transferExpiryTime = this.getTransferExpiryTime(subRoom);
+    if (await this.shouldRunInterval(TRANSFER_GC_LAST_RUN_KEY, transferExpiryTime)) {
+      await this.cleanupExpiredTransfers(
+        transferExpiryTime,
+        subRoom.$storageMetrics
+      );
+    }
     const roomGuards = subRoom.constructor["_roomGuards"] || [];
     for (const guard of roomGuards) {
       const isAuthorized = await guard(conn, ctx, this.room);
@@ -898,12 +1446,18 @@ var Server = class {
     }
     let transferData = null;
     if (transferToken) {
-      transferData = await this.room.storage.get(`transfer:${transferToken}`);
+      const transferKey = this.transferKey(transferToken);
+      transferData = await this.room.storage.get(transferKey);
       if (transferData) {
-        await this.room.storage.delete(`transfer:${transferToken}`);
+        if (this.isTransferExpired(transferData, transferExpiryTime)) {
+          transferData = null;
+        }
+        await this.room.storage.delete(transferKey);
       }
     }
-    const existingSession = await this.getSession(conn.id);
+    const requestedPrivateId = this.getPrivateId(conn);
+    const privateId = transferData?.privateId || requestedPrivateId;
+    const existingSession = await this.getSession(privateId);
     const publicId = existingSession?.publicId || transferData?.publicId || generateShortUUID2();
     let user = null;
     const signal2 = this.getUsersProperty(subRoom);
@@ -914,27 +1468,27 @@ var Server = class {
         if (transferData?.restored && signal2()[publicId]) {
           user = signal2()[publicId];
         } else {
-          user = isClass(classType) ? new classType() : classType(conn, ctx);
+          user = this.createUserFromClassType(classType, conn, ctx);
           signal2()[publicId] = user;
           const snapshot = createStatesSnapshotDeep(user);
-          this.room.storage.put(`${usersPropName}.${publicId}`, snapshot);
+          await this.saveStatePath(`${usersPropName}.${publicId}`, snapshot);
         }
       } else {
         user = signal2()[existingSession.publicId];
       }
       if (!existingSession) {
-        const sessionPrivateId = transferData?.privateId || conn.id;
-        await this.saveSession(sessionPrivateId, {
+        await this.saveSession(privateId, {
           publicId
         });
       } else {
-        await this.updateSessionConnection(conn.id, true);
+        await this.updateSessionConnection(privateId, true);
       }
     }
     this.updateUserConnectionStatus(user, true);
     conn.setState({
       ...conn.state,
-      publicId
+      publicId,
+      privateId
     });
     await awaitReturn(subRoom["onJoin"]?.(user, conn, ctx));
     if (subRoom.$autoSync) {
@@ -967,11 +1521,19 @@ var Server = class {
    */
   async onConnect(conn, ctx) {
     if (ctx.request?.headers.has("x-shard-id")) {
+      if (!this.isAuthorizedShardRequest(ctx.request)) {
+        conn.close();
+        return;
+      }
       this.onConnectShard(conn, ctx);
     } else {
       await this.onConnectClient(conn, ctx);
     }
   }
+  isAuthorizedShardRequest(req) {
+    const shardSecret = this.room.env.SHARD_SECRET;
+    return typeof shardSecret === "string" && shardSecret.length > 0 && req?.headers.get("x-access-shard") === shardSecret;
+  }
   /**
    * @method onConnectShard
    * @private
@@ -982,9 +1544,11 @@ var Server = class {
    */
   onConnectShard(conn, ctx) {
     const shardId = ctx.request?.headers.get("x-shard-id") || "unknown-shard";
+    const worldId = ctx.request?.headers.get("x-shard-world-id") || "world-default";
     conn.setState({
       shard: true,
       shardId,
+      worldId,
       clients: /* @__PURE__ */ new Map()
       // Track clients connected through this shard
     });
@@ -1254,11 +1818,15 @@ var Server = class {
     if (!conn.state) {
       return;
     }
-    const privateId = conn.id;
+    const privateId = this.getPrivateId(conn);
     const { publicId } = conn.state;
     const user = signal2?.()[publicId];
     if (!user) return;
+    if (this.hasActiveSessionConnection(privateId)) {
+      return;
+    }
     await this.updateSessionConnection(privateId, false);
+    this.scheduleSessionGarbageCollector(this.getSessionExpiryTime(subRoom), privateId);
     const connectionUpdated = this.updateUserConnectionStatus(user, false);
     await awaitReturn(subRoom["onLeave"]?.(user, conn));
     if (!connectionUpdated) {
@@ -1293,6 +1861,9 @@ var Server = class {
       return res.status(200).send({});
     }
     if (isFromShard) {
+      if (!this.isAuthorizedShardRequest(req)) {
+        return res.unauthorized("Invalid shard credentials");
+      }
       return this.handleShardRequest(req, res, shardId);
     }
     return this.handleDirectRequest(req, res);
@@ -1329,7 +1900,7 @@ var Server = class {
         const usersPropName = this.getUsersPropName(subRoom);
         if (signal2 && usersPropName) {
           const { classType } = signal2.options;
-          const user = isClass(classType) ? new classType() : classType();
+          const user = this.createUserFromClassType(classType);
           const hydratedSnapshot = await awaitReturn(
             subRoom["onSessionRestore"]?.({
               userSnapshot,
@@ -1342,14 +1913,15 @@ var Server = class {
           ) ?? userSnapshot;
           signal2()[publicId] = user;
           load(user, hydratedSnapshot, true);
-          await this.room.storage.put(`${usersPropName}.${publicId}`, userSnapshot);
+          await this.saveStatePath(`${usersPropName}.${publicId}`, userSnapshot);
         }
       }
       const transferToken = generateShortUUID2();
-      await this.room.storage.put(`transfer:${transferToken}`, {
+      await this.room.storage.put(this.transferKey(transferToken), {
         privateId,
         publicId,
-        restored: true
+        restored: true,
+        created: Date.now()
       });
       return res.success({ transferToken });
     } catch (error) {
@@ -1553,17 +2125,33 @@ var Server = class {
 
 // src/shard.ts
 var Shard = class {
-  constructor(room) {
+  constructor(room, options = {}) {
     this.room = room;
     this.connectionMap = /* @__PURE__ */ new Map();
     this.worldUrl = null;
-    this.worldId = "default";
     this.lastReportedConnections = 0;
     this.statsInterval = 3e4;
     this.statsIntervalId = null;
+    this.worldUrl = options.worldUrl ?? null;
+    this.worldId = options.worldId ?? this.getWorldIdFromShardId(room.id) ?? this.getEnvString("WORLD_ID") ?? this.getEnvString("SIGNE_WORLD_ID") ?? "world-default";
+    this.statsInterval = options.statsInterval ?? this.statsInterval;
+  }
+  getPrivateId(conn) {
+    return conn.sessionId || conn.id;
+  }
+  getEnvString(key) {
+    const value = this.room.env?.[key];
+    return typeof value === "string" && value.length > 0 ? value : void 0;
+  }
+  getRoomIdFromShardId(shardId) {
+    return shardId.split(":")[0];
+  }
+  getWorldIdFromShardId(shardId) {
+    const parts = shardId.split(":");
+    return parts.length >= 3 ? parts[1] : void 0;
   }
   async onStart() {
-    const roomId = this.room.id.split(":")[0];
+    const roomId = this.getRoomIdFromShardId(this.room.id);
     const roomStub = this.room.context.parties.main.get(roomId);
     if (!roomStub) {
       console.warn("No room room stub found in main party context");
@@ -1572,17 +2160,30 @@ var Shard = class {
     this.mainServerStub = roomStub;
     this.ws = await roomStub.socket({
       headers: {
-        "x-shard-id": this.room.id
+        "x-shard-id": this.room.id,
+        "x-shard-world-id": this.worldId,
+        "x-access-shard": this.room.env.SHARD_SECRET
       }
     });
     this.ws.addEventListener("message", (event) => {
       try {
         const message = JSON.parse(event.data);
+        if (message.type === "shard.closeClient" && message.privateId) {
+          const clientConnections = this.connectionMap.get(message.privateId);
+          if (clientConnections?.size) {
+            for (const clientConn of [...clientConnections]) {
+              clientConn.close();
+            }
+          }
+          return;
+        }
         if (message.targetClientId) {
-          const clientConn = this.connectionMap.get(message.targetClientId);
-          if (clientConn) {
+          const clientConnections = this.connectionMap.get(message.targetClientId);
+          if (clientConnections?.size) {
             delete message.targetClientId;
-            clientConn.send(message.data);
+            for (const clientConn of clientConnections) {
+              clientConn.send(message.data);
+            }
           }
         } else {
           this.room.broadcast(event.data);
@@ -1591,21 +2192,22 @@ var Shard = class {
         console.error("Error processing message from main server:", error);
       }
     });
-    await this.updateWorldStats();
+    await this.updateWorldStats(true);
     this.startPeriodicStatsUpdates();
   }
   startPeriodicStatsUpdates() {
-    if (!this.worldUrl) {
+    if (this.statsInterval <= 0 || !this.room.context.parties.world) {
       return;
     }
     if (this.statsIntervalId) {
       clearInterval(this.statsIntervalId);
     }
     this.statsIntervalId = setInterval(() => {
-      this.updateWorldStats().catch((error) => {
+      this.updateWorldStats(true).catch((error) => {
         console.error("Error in periodic stats update:", error);
       });
     }, this.statsInterval);
+    this.statsIntervalId?.unref?.();
   }
   stopPeriodicStatsUpdates() {
     if (this.statsIntervalId) {
@@ -1614,7 +2216,10 @@ var Shard = class {
     }
   }
   onConnect(conn, ctx) {
-    this.connectionMap.set(conn.id, conn);
+    const privateId = this.getPrivateId(conn);
+    const connections = this.connectionMap.get(privateId) ?? /* @__PURE__ */ new Set();
+    connections.add(conn);
+    this.connectionMap.set(privateId, connections);
     const headers = {};
     if (ctx.request?.headers) {
       ctx.request.headers.forEach((value, key) => {
@@ -1628,7 +2233,7 @@ var Shard = class {
     } : null;
     this.ws.send(JSON.stringify({
       type: "shard.clientConnected",
-      privateId: conn.id,
+      privateId,
       requestInfo
     }));
     this.updateWorldStats();
@@ -1638,7 +2243,7 @@ var Shard = class {
       const parsedMessage = typeof message === "string" ? JSON.parse(message) : message;
       const wrappedMessage = JSON.stringify({
         type: "shard.clientMessage",
-        privateId: sender.id,
+        privateId: this.getPrivateId(sender),
         publicId: sender.state?.publicId,
         payload: parsedMessage
       });
@@ -1648,21 +2253,35 @@ var Shard = class {
     }
   }
   onClose(conn) {
-    this.connectionMap.delete(conn.id);
+    const privateId = this.getPrivateId(conn);
+    const connections = this.connectionMap.get(privateId);
+    connections?.delete(conn);
+    if (connections?.size) {
+      this.updateWorldStats();
+      return;
+    }
+    this.connectionMap.delete(privateId);
     this.ws.send(JSON.stringify({
       type: "shard.clientDisconnected",
-      privateId: conn.id,
+      privateId,
       publicId: conn.state?.publicId
     }));
     this.updateWorldStats();
   }
-  async updateWorldStats() {
-    const currentConnections = this.connectionMap.size;
-    if (currentConnections === this.lastReportedConnections) {
+  async updateWorldStats(force = false) {
+    const currentConnections = Array.from(this.connectionMap.values()).reduce((total, connections) => total + connections.size, 0);
+    if (!force && currentConnections === this.lastReportedConnections) {
       return true;
     }
     try {
-      const worldRoom = this.room.context.parties.world.get("world-default");
+      const worldParty = this.room.context.parties.world;
+      if (!worldParty) {
+        return false;
+      }
+      const worldRoom = worldParty.get(this.worldId);
+      if (!worldRoom?.fetch) {
+        return false;
+      }
       const response2 = await worldRoom.fetch("/update-shard", {
         method: "POST",
         headers: {
@@ -1671,6 +2290,7 @@ var Shard = class {
         },
         body: JSON.stringify({
           shardId: this.room.id,
+          worldId: this.worldId,
           connections: currentConnections
         })
       });
@@ -1710,7 +2330,9 @@ var Shard = class {
         headers.set(key, value);
       });
       headers.set("x-shard-id", this.room.id);
+      headers.set("x-shard-world-id", this.worldId);
       headers.set("x-forwarded-by-shard", "true");
+      headers.set("x-access-shard", this.room.env.SHARD_SECRET);
       const clientIp = req.headers.get("x-forwarded-for") || "unknown";
       if (clientIp) {
         headers.set("x-original-client-ip", clientIp);
@@ -1720,7 +2342,7 @@ var Shard = class {
         headers,
         body
       };
-      const response2 = await this.mainServerStub.fetch(path, requestInit);
+      const response2 = await this.mainServerStub.fetch(path + url.search, requestInit);
       return response2;
     } catch (error) {
       return response(500, { error: "Error forwarding request" });
@@ -1732,7 +2354,7 @@ var Shard = class {
    * @description Executed periodically, used to perform maintenance tasks
    */
   async onAlarm() {
-    await this.updateWorldStats();
+    await this.updateWorldStats(true);
   }
 };
 
@@ -1744,7 +2366,7 @@ async function testRoom(Room2, options = {}) {
     return server2;
   };
   const isShard = options.shard || false;
-  const io = new ServerIo(Room2.path, isShard ? {
+  const io = new ServerIo(options.id ?? Room2.path, isShard ? {
     parties: {
       game: createServer,
       ...options.parties || {}
@@ -1788,7 +2410,7 @@ async function testRoom(Room2, options = {}) {
       return client;
     },
     getServerUser: async (client, prop = "users") => {
-      const privateId = client.conn.id;
+      const privateId = client.conn.sessionId || client.conn.id;
       const session = await server.getSession(privateId);
       return server.subRoom[prop]()[session?.publicId];
     }
@@ -1808,11 +2430,11 @@ function tick(ms = 0) {
 
 // src/mock.ts
 var MockPartyClient = class {
-  constructor(server, id2) {
+  constructor(server, sessionId) {
     this.server = server;
     this.events = /* @__PURE__ */ new Map();
-    this.id = id2 || generateShortUUID();
-    this.conn = new MockConnection(this);
+    this.id = generateShortUUID();
+    this.conn = new MockConnection(this, sessionId || this.id);
   }
   addEventListener(event, cb) {
     if (!this.events.has(event)) {
@@ -1848,8 +2470,8 @@ var MockLobby = class {
     this.server = server;
     this.lobbyId = lobbyId;
   }
-  socket(_init) {
-    return new MockPartyClient(this.server);
+  socket(init) {
+    return new MockPartyClient(this.server, init?.id);
   }
   async connection(idOrOptions, maybeOptions) {
     const id2 = typeof idOrOptions === "string" ? idOrOptions : idOrOptions?.id;
@@ -1925,7 +2547,13 @@ var MockPartyRoom = class {
     });
   }
   getConnection(id2) {
-    return this.clients.get(id2);
+    let connection;
+    for (const client of this.clients.values()) {
+      if (client.conn.id === id2 || client.conn.sessionId === id2) {
+        connection = client.conn;
+      }
+    }
+    return connection;
   }
   getConnections() {
     return Array.from(this.clients.values()).map((client) => client.conn);
@@ -1933,13 +2561,25 @@ var MockPartyRoom = class {
   clear() {
     this.clients.clear();
   }
+  deleteConnection(id2, connection) {
+    if (connection) {
+      this.clients.delete(connection.id);
+      return;
+    }
+    for (const [connectionKey, client] of this.clients) {
+      if (client.conn.id === id2 || client.conn.sessionId === id2) {
+        this.clients.delete(connectionKey);
+      }
+    }
+  }
 };
 var MockConnection = class {
-  constructor(client) {
+  constructor(client, sessionId) {
     this.client = client;
     this.state = {};
     this.server = client.server;
     this.id = client.id;
+    this.sessionId = sessionId;
   }
   setState(value) {
     this.state = value;
@@ -1948,6 +2588,7 @@ var MockConnection = class {
     this.client._trigger("message", data);
   }
   close() {
+    this.server.room.deleteConnection?.(this.id, this);
     this.server.onClose(this);
   }
 };
@@ -2127,7 +2768,7 @@ var guardManageWorld = async (_, req, room) => {
     return true;
   }
   const url = new URL(req.url);
-  const token = req.headers.get("Authorization") ?? url.searchParams.get("world-auth-token");
+  const token = getAuthToken(req, url);
   if (!token) {
     return false;
   }
@@ -2137,11 +2778,28 @@ var guardManageWorld = async (_, req, room) => {
     if (!payload) {
       return false;
     }
+    if (!canAccessWorld(payload, room.id)) {
+      return false;
+    }
   } catch (error) {
     return false;
   }
   return true;
 };
+function getAuthToken(req, url) {
+  const authorization = req.headers.get("Authorization");
+  if (authorization?.startsWith("Bearer ")) {
+    return authorization.slice("Bearer ".length).trim();
+  }
+  return authorization ?? url.searchParams.get("world-auth-token");
+}
+function canAccessWorld(payload, worldId) {
+  const worlds = payload.worlds;
+  if (!Array.isArray(worlds)) {
+    return false;
+  }
+  return worlds.some((world) => world === "*" || world === worldId);
+}
 
 // src/world.ts
 var MAX_PLAYERS_PER_SHARD = 75;
@@ -2156,10 +2814,13 @@ var RoomConfigSchema = z2.object({
 var RegisterShardSchema = z2.object({
   shardId: z2.string(),
   roomId: z2.string(),
+  worldId: z2.string().optional(),
   url: z2.string().url(),
   maxConnections: z2.number().int().positive()
 });
 var UpdateShardStatsSchema = z2.object({
+  shardId: z2.string(),
+  worldId: z2.string().optional(),
   connections: z2.number().int().min(0),
   status: z2.enum(["active", "maintenance", "draining"]).optional()
 });
@@ -2205,6 +2866,7 @@ __decorateClass([
 var ShardInfo = class {
   constructor() {
     this.roomId = signal("");
+    this.worldId = signal("");
     this.url = signal("");
     this.currentConnections = signal(0);
     this.maxConnections = signal(MAX_PLAYERS_PER_SHARD);
@@ -2218,6 +2880,9 @@ __decorateClass([
 __decorateClass([
   sync()
 ], ShardInfo.prototype, "roomId", 2);
+__decorateClass([
+  sync()
+], ShardInfo.prototype, "worldId", 2);
 __decorateClass([
   sync()
 ], ShardInfo.prototype, "url", 2);
@@ -2251,6 +2916,7 @@ var WorldRoom = class {
     if (!SHARD_SECRET) {
       throw new Error("SHARD_SECRET env variable is not set");
     }
+    this.scheduleInactiveShardCleanup();
   }
   async onJoin(user, conn, ctx) {
     const canConnect = await guardManageWorld(user, ctx.request, this.room);
@@ -2266,6 +2932,13 @@ var WorldRoom = class {
     return obj;
   }
   // Helper methods
+  getWorldId() {
+    return this.room.id;
+  }
+  scheduleInactiveShardCleanup() {
+    const timeoutId = setTimeout(() => this.cleanupInactiveShards(), 6e4);
+    timeoutId?.unref?.();
+  }
   cleanupInactiveShards() {
     const now = Date.now();
     const timeout = 5 * 60 * 1e3;
@@ -2277,10 +2950,25 @@ var WorldRoom = class {
         hasChanges = true;
       }
     });
-    setTimeout(() => this.cleanupInactiveShards(), 6e4);
+    this.scheduleInactiveShardCleanup();
+  }
+  removeShard(shardId) {
+    delete this.shards()[shardId];
   }
-  async registerRoom(req) {
-    const roomConfig = await req.json();
+  shouldCompleteDrain(shard) {
+    return shard.status() === "draining" && shard.currentConnections() === 0;
+  }
+  async registerRoom(req, res) {
+    const parseResult = RoomConfigSchema.safeParse(await req.json());
+    if (!parseResult.success) {
+      return res?.badRequest("Invalid room configuration", {
+        details: parseResult.error
+      });
+    }
+    const roomConfig = parseResult.data;
+    if (roomConfig.maxShards !== void 0 && roomConfig.minShards > roomConfig.maxShards) {
+      return res?.badRequest("minShards cannot be greater than maxShards");
+    }
     const roomId = roomConfig.name;
     if (!this.rooms()[roomId]) {
       const newRoom = new RoomConfig();
@@ -2305,22 +2993,41 @@ var WorldRoom = class {
       room.minShards.set(roomConfig.minShards);
       room.maxShards.set(roomConfig.maxShards);
     }
+    await this.ensureMinShards(roomId);
   }
   async updateShardStats(req, res) {
-    const body = await req.json();
+    const parseResult = UpdateShardStatsSchema.safeParse(await req.json());
+    if (!parseResult.success) {
+      return res.badRequest("Invalid shard stats", {
+        details: parseResult.error
+      });
+    }
+    const body = parseResult.data;
     const { shardId, connections, status } = body;
     const shard = this.shards()[shardId];
     if (!shard) {
       return res.notFound(`Shard ${shardId} not found`);
     }
+    if (body.worldId && body.worldId !== this.getWorldId()) {
+      return res.badRequest(`Shard ${shardId} belongs to world ${body.worldId}, not ${this.getWorldId()}`);
+    }
     shard.currentConnections.set(connections);
     if (status) {
       shard.status.set(status);
     }
     shard.lastHeartbeat.set(Date.now());
+    if (this.shouldCompleteDrain(shard)) {
+      this.removeShard(shard.id);
+    }
   }
   async scaleRoom(req, res) {
-    const data = await req.json();
+    const parseResult = ScaleRoomSchema.safeParse(await req.json());
+    if (!parseResult.success) {
+      return res.badRequest("Invalid scale room request", {
+        details: parseResult.error
+      });
+    }
+    const data = parseResult.data;
     const { targetShardCount, shardTemplate, roomId } = data;
     const room = this.rooms()[roomId];
     if (!room) {
@@ -2335,16 +3042,16 @@ var WorldRoom = class {
       });
     }
     if (targetShardCount < previousShardCount) {
-      const shardsToRemove = [...roomShards].sort((a, b) => {
+      const shardsToDrain = [...roomShards].sort((a, b) => {
         if (a.status() === "draining" && b.status() !== "draining") return -1;
         if (a.status() !== "draining" && b.status() === "draining") return 1;
         return a.currentConnections() - b.currentConnections();
       }).slice(0, previousShardCount - targetShardCount);
-      const shardsToKeep = roomShards.filter(
-        (shard) => !shardsToRemove.some((s) => s.id === shard.id)
-      );
-      for (const shard of shardsToRemove) {
-        delete this.shards()[shard.id];
+      for (const shard of shardsToDrain) {
+        shard.status.set("draining");
+        if (this.shouldCompleteDrain(shard)) {
+          this.removeShard(shard.id);
+        }
       }
       return;
     }
@@ -2431,8 +3138,20 @@ var WorldRoom = class {
         return { error: `No shards available for room ${roomId}` };
       }
     }
-    const activeShards = roomShards.filter((shard) => shard && shard.status() === "active");
+    let activeShards = this.getAvailableShards(roomShards);
     if (activeShards.length === 0) {
+      if (autoCreate && this.canCreateShard(room, roomShards.length)) {
+        const newShard = await this.createShard(roomId);
+        if (newShard) {
+          return {
+            shardId: newShard.id,
+            url: newShard.url()
+          };
+        }
+      }
+      if (roomShards.some((shard) => shard.status() === "active")) {
+        return { error: `No shard capacity available for room ${roomId}` };
+      }
       return { error: `No active shards available for room ${roomId}` };
     }
     const balancingStrategy = room.balancingStrategy();
@@ -2460,6 +3179,14 @@ var WorldRoom = class {
       url: selectedShard.url()
     };
   }
+  getAvailableShards(shards) {
+    return shards.filter(
+      (shard) => shard && shard.status() === "active" && shard.currentConnections() < shard.maxConnections()
+    );
+  }
+  canCreateShard(room, currentShardCount) {
+    return room.maxShards() === void 0 || currentShardCount < room.maxShards();
+  }
   // Private methods
   async createShard(roomId, urlTemplate, maxConnections) {
     const room = this.rooms()[roomId];
@@ -2467,13 +3194,15 @@ var WorldRoom = class {
       console.error(`Cannot create shard for non-existent room: ${roomId}`);
       return null;
     }
-    const shardId = `${roomId}:${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
+    const worldId = this.getWorldId();
+    const shardId = `${roomId}:${worldId}:${Date.now()}-${Math.floor(Math.random() * 1e4)}`;
     const template = urlTemplate || this.defaultShardUrlTemplate();
     const url = template.replace("{shardId}", shardId).replace("{roomId}", roomId);
     const max = maxConnections || room.maxPlayersPerShard();
     const newShard = new ShardInfo();
     newShard.id = shardId;
     newShard.roomId.set(roomId);
+    newShard.worldId.set(worldId);
     newShard.url.set(url);
     newShard.maxConnections.set(max);
     newShard.currentConnections.set(0);
@@ -2482,6 +3211,20 @@ var WorldRoom = class {
     this.shards()[shardId] = newShard;
     return newShard;
   }
+  async ensureMinShards(roomId) {
+    const room = this.rooms()[roomId];
+    if (!room) {
+      return;
+    }
+    const currentShardCount = Object.values(this.shards()).filter((shard) => shard.roomId() === roomId).length;
+    const targetShardCount = room.minShards();
+    if (currentShardCount >= targetShardCount) {
+      return;
+    }
+    for (let i = currentShardCount; i < targetShardCount; i++) {
+      await this.createShard(roomId);
+    }
+  }
 };
 __decorateClass([
   sync(RoomConfig)
@@ -2532,13 +3275,16 @@ WorldRoom = __decorateClass([
 ], WorldRoom);
 
 // src/session.guard.ts
+function getPrivateId(sender) {
+  return sender.sessionId || sender.id;
+}
 function createRequireSessionGuard(storage) {
   return async (sender, value) => {
     if (!sender || !sender.id) {
       return false;
     }
     try {
-      const session = await storage.get(`session:${sender.id}`);
+      const session = await storage.get(`session:${getPrivateId(sender)}`);
       if (!session) {
         return false;
       }
@@ -2558,7 +3304,7 @@ var requireSession = async (sender, value, room) => {
     return false;
   }
   try {
-    const session = await room.storage.get(`session:${sender.id}`);
+    const session = await room.storage.get(`session:${getPrivateId(sender)}`);
     if (!session) {
       return false;
     }