onelobby 0.1.0 → 0.2.1

package/dist/index.d.ts

@@ -8,7 +8,10 @@ export type { OneLobbyOptions, HostOptions, ListOptions, OneLobbyEvents, JoinDir
 export { DEFAULT_READY_TIMEOUT_MS } from "./onelobby.js";
 export type { AdvancedOptions, SeatStorage } from "./onelobby.js";
 export { Lobby } from "./lobby.js";
-export type { LobbyEvents, LobbyConfig, Peer, Phase } from "./lobby.js";
+export type { LobbyEvents, LobbyConfig, Peer, Phase, RateLimit } from "./lobby.js";
+export { MIN_PEER_TIMEOUT_MS } from "./lobby.js";
+export { closeCodeFor } from "./socket.js";
+export type { LobbySocket, LobbySocketOptions } from "./socket.js";
 export { Lockstep } from "./lockstep.js";
 export type { Frame, DesyncInfo, LockstepEvents } from "./lockstep.js";
 export { Chat, CHAT_MAX_BYTES } from "./chat.js";

package/dist/index.js

@@ -6,6 +6,9 @@
 export { OneLobby, LIB_NAME, LIB_VERSION } from "./onelobby.js";
 export { DEFAULT_READY_TIMEOUT_MS } from "./onelobby.js";
 export { Lobby } from "./lobby.js";
+export { MIN_PEER_TIMEOUT_MS } from "./lobby.js";
+// WebSocket-shaped sockets over a lobby: lobby.asWebSocket() (joiner), lobby.onConnection(conn => ...) (host).
+export { closeCodeFor } from "./socket.js";
 export { Lockstep } from "./lockstep.js";
 export { Chat, CHAT_MAX_BYTES } from "./chat.js";
 export { Voice } from "./voice.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAInC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3D,iHAAiH;AACjH,8GAA8G;AAC9G,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK/C,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAErE,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC","sourcesContent":["/**\n * Public API of `onelobby`: create a `OneLobby`, `host()` / `join(code)` / `list()` lobbies, then use the\n * `Lobby`'s lockstep, raw messages, chat and voice. Lower-level pieces (codec, chunking, migration, jitter buffer,\n * WebRTC/signaling classes, clocks, the gridpaint demo game) live in `onelobby/internals`.\n */\nexport { OneLobby, LIB_NAME, LIB_VERSION } from \"./onelobby.js\";\nexport type { OneLobbyOptions, HostOptions, ListOptions, OneLobbyEvents, JoinDirectOptions } from \"./onelobby.js\";\nexport { DEFAULT_READY_TIMEOUT_MS } from \"./onelobby.js\";\nexport type { AdvancedOptions, SeatStorage } from \"./onelobby.js\";\nexport { Lobby } from \"./lobby.js\";\nexport type { LobbyEvents, LobbyConfig, Peer, Phase } from \"./lobby.js\";\nexport { Lockstep } from \"./lockstep.js\";\nexport type { Frame, DesyncInfo, LockstepEvents } from \"./lockstep.js\";\nexport { Chat, CHAT_MAX_BYTES } from \"./chat.js\";\nexport type { ChatMessage, ChatEvents } from \"./chat.js\";\nexport { Voice } from \"./voice.js\";\nexport type { VoiceEvents, VoiceDeps } from \"./voice.js\";\nexport type { VoiceMode } from \"./voice-core.js\";\nexport type { VoiceCodec, VoiceEncoderHandle, VoiceDecoderHandle, FrameSource, AudioSink, VoiceError } from \"./voice-types.js\";\nexport { webCodecsOpusAvailable } from \"./voice-browser.js\";\nexport { normalizeCode, formatCode } from \"./crockford.js\";\n// Direct IP (docs/direct-ip.md): kit.joinDirect(code); the code is the host's address in disguise. Hosting is in\n// onelobby/direct (Node). webRtcLinkFactoryFor gives Node joiners a WebRTC stack (node-datachannel/polyfill).\nexport { decodeJoinCode, looksLikeJoinCode } from \"./joincode.js\";\nexport type { DecodedJoinCode, JoinCodeError } from \"./joincode.js\";\nexport { webRtcLinkFactoryFor } from \"./webrtc.js\";\nexport { OneLobbyError } from \"./signaling.js\";\nexport type { LobbySummary, LobbyState, PeerInfo } from \"./signaling.js\";\n// Types for the seams in OneLobbyOptions (ChannelName also tags raw messages).\nexport type { PeerLink, LinkFactory, SocketFactory, SocketLike, IceServer, ChannelName } from \"./transport.js\";\nexport type { Clock } from \"./clock.js\";\nexport { describeError, shareUrl, codeFromUrl } from \"./friendly.js\";\nexport type { FriendlyError } from \"./friendly.js\";\n// Pre-rename names, kept for one version so existing games keep working.\nexport { Keepalive, KeepaliveError } from \"./deprecated.js\";\nexport type { KeepaliveOptions, KeepaliveEvents } from \"./deprecated.js\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,+GAA+G;AAC/G,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAInC,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC3D,iHAAiH;AACjH,8GAA8G;AAC9G,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAK/C,OAAO,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAErE,yEAAyE;AACzE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC","sourcesContent":["/**\n * Public API of `onelobby`: create a `OneLobby`, `host()` / `join(code)` / `list()` lobbies, then use the\n * `Lobby`'s lockstep, raw messages, chat and voice. Lower-level pieces (codec, chunking, migration, jitter buffer,\n * WebRTC/signaling classes, clocks, the gridpaint demo game) live in `onelobby/internals`.\n */\nexport { OneLobby, LIB_NAME, LIB_VERSION } from \"./onelobby.js\";\nexport type { OneLobbyOptions, HostOptions, ListOptions, OneLobbyEvents, JoinDirectOptions } from \"./onelobby.js\";\nexport { DEFAULT_READY_TIMEOUT_MS } from \"./onelobby.js\";\nexport type { AdvancedOptions, SeatStorage } from \"./onelobby.js\";\nexport { Lobby } from \"./lobby.js\";\nexport type { LobbyEvents, LobbyConfig, Peer, Phase, RateLimit } from \"./lobby.js\";\nexport { MIN_PEER_TIMEOUT_MS } from \"./lobby.js\";\n// WebSocket-shaped sockets over a lobby: lobby.asWebSocket() (joiner), lobby.onConnection(conn => ...) (host).\nexport { closeCodeFor } from \"./socket.js\";\nexport type { LobbySocket, LobbySocketOptions } from \"./socket.js\";\nexport { Lockstep } from \"./lockstep.js\";\nexport type { Frame, DesyncInfo, LockstepEvents } from \"./lockstep.js\";\nexport { Chat, CHAT_MAX_BYTES } from \"./chat.js\";\nexport type { ChatMessage, ChatEvents } from \"./chat.js\";\nexport { Voice } from \"./voice.js\";\nexport type { VoiceEvents, VoiceDeps } from \"./voice.js\";\nexport type { VoiceMode } from \"./voice-core.js\";\nexport type { VoiceCodec, VoiceEncoderHandle, VoiceDecoderHandle, FrameSource, AudioSink, VoiceError } from \"./voice-types.js\";\nexport { webCodecsOpusAvailable } from \"./voice-browser.js\";\nexport { normalizeCode, formatCode } from \"./crockford.js\";\n// Direct IP (docs/direct-ip.md): kit.joinDirect(code); the code is the host's address in disguise. Hosting is in\n// onelobby/direct (Node). webRtcLinkFactoryFor gives Node joiners a WebRTC stack (node-datachannel/polyfill).\nexport { decodeJoinCode, looksLikeJoinCode } from \"./joincode.js\";\nexport type { DecodedJoinCode, JoinCodeError } from \"./joincode.js\";\nexport { webRtcLinkFactoryFor } from \"./webrtc.js\";\nexport { OneLobbyError } from \"./signaling.js\";\nexport type { LobbySummary, LobbyState, PeerInfo } from \"./signaling.js\";\n// Types for the seams in OneLobbyOptions (ChannelName also tags raw messages).\nexport type { PeerLink, LinkFactory, SocketFactory, SocketLike, IceServer, ChannelName } from \"./transport.js\";\nexport type { Clock } from \"./clock.js\";\nexport { describeError, shareUrl, codeFromUrl } from \"./friendly.js\";\nexport type { FriendlyError } from \"./friendly.js\";\n// Pre-rename names, kept for one version so existing games keep working.\nexport { Keepalive, KeepaliveError } from \"./deprecated.js\";\nexport type { KeepaliveOptions, KeepaliveEvents } from \"./deprecated.js\";\n"]}

package/dist/lobby.d.ts

@@ -6,7 +6,22 @@ import { Lockstep } from "./lockstep.js";
 import { type LobbyState, type PeerInfo, type SignalingClient } from "./signaling.js";
 import type { ChannelName, IceServer, LinkFactory, PeerLink } from "./transport.js";
 import { Voice, type VoiceDeps } from "./voice.js";
+import { type LobbySocket, type LobbySocketOptions } from "./socket.js";
 export type Phase = "lobby" | "in_game";
+/** The close code and reason a host chose with `kick()` / `disconnect()`, passed to the removed player's sockets. */
+export interface CloseInfo {
+    code?: number;
+    reason?: string;
+}
+/** Options for `lobby.kick()`. */
+export interface KickOptions {
+    /** Default true: the player's address cannot rejoin this lobby while it lasts. false = `disconnect()`. */
+    ban?: boolean;
+    /** Close code for the player's `asWebSocket()` onclose: 1000 or 3000-4999. */
+    code?: number;
+    /** Close reason for that onclose, at most 120 characters. */
+    reason?: string;
+}
 export type Peer = PeerInfo;
 export type LobbyEvents = {
     peerJoined: [Peer];
@@ -14,12 +29,14 @@ export type LobbyEvents = {
     peerReady: [Peer];
     /** Joiner: the link to the host is open (the host itself is ready from the start). Also available as `lobby.ready`. */
     ready: [];
-    peerLeft: [Peer, reason: string];
+    /** reason "left", "kicked", "disconnected" (kick with ban false), "timeout", ...; `close` when the host gave one. */
+    peerLeft: [Peer, reason: string, close?: CloseInfo];
     joinRequested: [Peer];
     hostChanged: [hostId: number];
     phase: [Phase];
     message: [from: number, bytes: Uint8Array, channel: ChannelName];
-    sessionEnded: [reason: string];
+    /** `close` is the code and reason the host gave when it removed this player (`kick()` / `disconnect()`). */
+    sessionEnded: [reason: string, close?: CloseInfo];
     /** The signaling server went away. The game continues on the data channels (s.9). */
     serverLost: [];
     metaChanged: [Record<string, string>];
@@ -46,7 +63,25 @@ export interface LobbyConfig {
      * (link, peer_left, a host_changed from the hub as it shuts down, or the signaling socket) ends with "host_left".
      */
     direct?: boolean;
+    /**
+     * Treat a peer as gone after this many ms without hearing anything from it (0 or absent: off, and a silent peer
+     * surfaces only when its link or signaling socket times out, about 30 s). Joiners ping the host every 2 s and the
+     * host answers, so the host drops a silent joiner (`peerLeft`, "timeout") and a joiner handles a silent host as
+     * lost (a direct lobby ends with "host_left"). Values under 6000 are raised to 6000.
+     */
+    peerTimeoutMs?: number;
+    /** Host: per-peer cap on incoming raw messages; the excess is dropped before `message` fires or is relayed. */
+    rateLimit?: RateLimit;
 }
+/** At most `messages` raw messages per peer in any `perMs` window (a fixed window, reset every `perMs`). */
+export interface RateLimit {
+    messages: number;
+    perMs: number;
+}
+/** The smallest `peerTimeoutMs` honoured: three missed pings. */
+export declare const MIN_PEER_TIMEOUT_MS = 6000;
+/** Host: how long a kicked / disconnected peer's link stays open for the hub's notice to reach it first. */
+export declare const KICK_LINGER_MS = 3000;
 /** The name shown for a peer that chose none: "Player N", N = its seat (peer id, join order). */
 export declare function seatName(p: PeerInfo): PeerInfo;
 /** One joined lobby: roster, star of peer links, and the lockstep/chat/voice engines riding on them. */
@@ -96,16 +131,31 @@ export declare class Lobby extends Emitter<LobbyEvents> {
     private isReady;
     private cancelReadyTimer;
     private relayRetry;
+    /** clock.now() of the last frame from each peer (peerTimeoutMs). */
+    private lastHeard;
+    /** Host: links of kicked / disconnected peers, kept open briefly (removePeer `linger`). */
+    private readonly lingering;
+    /** Host: per-peer fixed window for rateLimit. */
+    private rate;
     /**
      * Resolves when this peer can exchange data: immediately for the host, once the link to the host is open for a
      * joiner. Rejects with OneLobbyError("ice_failed") when the joiner cannot reach the host in `readyTimeoutMs`
-     * (or with "closed"/"kicked" when the lobby ends first).
+     * (or with "closed"/"kicked" when the lobby ends first; "closed" also when the host disconnected it).
      */
     readonly ready: Promise<void>;
     constructor(cfg: LobbyConfig);
     get isHost(): boolean;
     get peers(): Peer[];
     peer(peerId: number): Peer | undefined;
+    /** Peers whose link is open and handshake done (host: the ready joiners; joiner: the host once ready). */
+    get connectedPeers(): number[];
+    /**
+     * Joiner: the link to the host as a WebSocket-shaped object (text by default), so WebSocket client code runs
+     * unchanged. It opens when `ready` resolves and closes when the session ends (`host_left` gives code 1001).
+     */
+    asWebSocket(opts?: LobbySocketOptions): LobbySocket;
+    /** Host: `handler(conn)` once per joiner (a WebSocket-shaped connection), the server-side mirror of asWebSocket(). */
+    onConnection(handler: (conn: LobbySocket) => void, opts?: LobbySocketOptions): () => void;
     set snapshotChunkSize(n: number);
     /** Current migration epoch (0 until the first host change). */
     get hostEpoch(): number;
@@ -117,7 +167,18 @@ export declare class Lobby extends Emitter<LobbyEvents> {
     _begin(): void;
     start(): Promise<void>;
     setMeta(meta: Record<string, string>): Promise<void>;
-    kick(peerId: number): Promise<void>;
+    /**
+     * Host: removes a player. By default it is a ban: the hub refuses that player's address for the rest of this lobby
+     * (a new tab or a reload included). `{ ban: false }` is `disconnect()`. `code` / `reason` reach the player's
+     * `asWebSocket()` onclose (and `sessionEnded`'s second argument); without them its socket closes with 4000 "kicked".
+     */
+    kick(peerId: number, opts?: KickOptions): Promise<void>;
+    /**
+     * Host: ends one player's connection without a ban, like a server closing one WebSocket. The player's
+     * `asWebSocket()` gets onclose with `code` (default 1000) and `reason` (default "disconnected"), its lobby ends with
+     * `sessionEnded("disconnected")`, and it may join again (a new tab, a reload). Same as `kick(peerId, { ban: false, code, reason })`.
+     */
+    disconnect(peerId: number, code?: number, reason?: string): Promise<void>;
     approve(peerId: number, ok: boolean): Promise<void>;
     leave(): Promise<void>;
     /** raw mode (and any extra game data): to one peer. */
@@ -150,6 +211,7 @@ export declare class Lobby extends Emitter<LobbyEvents> {
     private onHi;
     private flush;
     private onRaw;
+    private allowRaw;
     private setHost;
     /** The host is gone (link closed, no frames for 3 s, or the server said so): run the s.9 rule. */
     private handleHostLost;
@@ -157,11 +219,19 @@ export declare class Lobby extends Emitter<LobbyEvents> {
     private onHostClaim;
     private onSignaling;
     private onSignal;
+    /**
+     * `linger` (host kick / disconnect): stop using the peer's link at once but leave it open until that peer closes it
+     * or KICK_LINGER_MS pass. The hub tells the peer over its WebSocket; closing the data link first would make it look
+     * like the host vanished (a migration and a 1001 instead of the host's close code).
+     */
     private removePeer;
+    /** Lockstep drops (stalled, desynced): removed without a ban, so the player can come back (a rejoin resyncs). */
     private dropPeer;
     private setPhase;
     private onServerClosed;
     private watchdog;
+    /** peerTimeoutMs: the host drops joiners it has not heard from; a joiner handles a silent host as lost. */
+    private dropSilent;
     private pingHost;
     private teardown;
     /** Total in-flight links (diagnostics and tests). */

package/dist/lobby.js

@@ -6,6 +6,11 @@ import { Lockstep } from "./lockstep.js";
 import { claimWinsWrapped, pickNewHost } from "./migration.js";
 import { OneLobbyError } from "./signaling.js";
 import { Voice } from "./voice.js";
+import { hostConnections, joinerSocket } from "./socket.js";
+/** The smallest `peerTimeoutMs` honoured: three missed pings. */
+export const MIN_PEER_TIMEOUT_MS = 6000;
+/** Host: how long a kicked / disconnected peer's link stays open for the hub's notice to reach it first. */
+export const KICK_LINGER_MS = 3000;
 /** The name shown for a peer that chose none: "Player N", N = its seat (peer id, join order). */
 export function seatName(p) {
     const n = typeof p.name === "string" ? p.name.trim() : "";
@@ -66,10 +71,16 @@ export class Lobby extends Emitter {
     isReady = false;
     cancelReadyTimer = null;
     relayRetry = false;
+    /** clock.now() of the last frame from each peer (peerTimeoutMs). */
+    lastHeard = new Map();
+    /** Host: links of kicked / disconnected peers, kept open briefly (removePeer `linger`). */
+    lingering = new Set();
+    /** Host: per-peer fixed window for rateLimit. */
+    rate = new Map();
     /**
      * Resolves when this peer can exchange data: immediately for the host, once the link to the host is open for a
      * joiner. Rejects with OneLobbyError("ice_failed") when the joiner cannot reach the host in `readyTimeoutMs`
-     * (or with "closed"/"kicked" when the lobby ends first).
+     * (or with "closed"/"kicked" when the lobby ends first; "closed" also when the host disconnected it).
      */
     ready = new Promise((res, rej) => {
         this.markReady = () => {
@@ -145,6 +156,21 @@ export class Lobby extends Emitter {
     peer(peerId) {
         return this.roster.get(peerId);
     }
+    /** Peers whose link is open and handshake done (host: the ready joiners; joiner: the host once ready). */
+    get connectedPeers() {
+        return this.connectedPeerIds();
+    }
+    /**
+     * Joiner: the link to the host as a WebSocket-shaped object (text by default), so WebSocket client code runs
+     * unchanged. It opens when `ready` resolves and closes when the session ends (`host_left` gives code 1001).
+     */
+    asWebSocket(opts) {
+        return joinerSocket(this, opts);
+    }
+    /** Host: `handler(conn)` once per joiner (a WebSocket-shaped connection), the server-side mirror of asWebSocket(). */
+    onConnection(handler, opts) {
+        return hostConnections(this, handler, opts);
+    }
     set snapshotChunkSize(n) {
         this.lockstep.chunkSize = n;
     }
@@ -183,11 +209,37 @@ export class Lobby extends Emitter {
         this.signaling.send({ t: "meta", meta });
         this.emit("metaChanged", this.meta);
     }
-    async kick(peerId) {
+    /**
+     * Host: removes a player. By default it is a ban: the hub refuses that player's address for the rest of this lobby
+     * (a new tab or a reload included). `{ ban: false }` is `disconnect()`. `code` / `reason` reach the player's
+     * `asWebSocket()` onclose (and `sessionEnded`'s second argument); without them its socket closes with 4000 "kicked".
+     */
+    async kick(peerId, opts = {}) {
         if (!this.isHost)
             throw new Error("only the host can kick");
-        this.signaling.send({ t: "kick", peerId });
-        this.removePeer(peerId, "kicked");
+        const { ban = true, code, reason } = opts;
+        if (code !== undefined && !(code === 1000 || (Number.isInteger(code) && code >= 3000 && code <= 4999)))
+            throw new RangeError("close code must be 1000 or 3000-4999");
+        if (reason !== undefined && reason.length > 120)
+            throw new RangeError("close reason must be at most 120 characters");
+        const msg = { t: "kick", peerId };
+        if (!ban)
+            msg.ban = false;
+        if (code !== undefined)
+            msg.closeCode = code;
+        if (reason !== undefined)
+            msg.closeReason = reason;
+        this.signaling.send(msg);
+        const close = code !== undefined || reason !== undefined ? { code, reason } : undefined;
+        this.removePeer(peerId, ban ? "kicked" : "disconnected", close, true);
+    }
+    /**
+     * Host: ends one player's connection without a ban, like a server closing one WebSocket. The player's
+     * `asWebSocket()` gets onclose with `code` (default 1000) and `reason` (default "disconnected"), its lobby ends with
+     * `sessionEnded("disconnected")`, and it may join again (a new tab, a reload). Same as `kick(peerId, { ban: false, code, reason })`.
+     */
+    disconnect(peerId, code, reason) {
+        return this.kick(peerId, { ban: false, code, reason });
     }
     async approve(peerId, ok) {
         if (!this.isHost)
@@ -400,6 +452,8 @@ export class Lobby extends Emitter {
         }
         if (!d)
             return;
+        if (!reassembled)
+            this.lastHeard.set(from, this.cfg.clock.now());
         const { msg, route } = d;
         switch (msg.type) {
             case "hi":
@@ -497,6 +551,8 @@ export class Lobby extends Emitter {
             this.emit("message", route, bytes, channel);
             return;
         }
+        if (!this.allowRaw(from))
+            return;
         if (route === 0 || route === this.localPeerId) {
             this.emit("message", from, bytes, channel);
         }
@@ -509,6 +565,16 @@ export class Lobby extends Emitter {
             this.sendTo(route, { type: "raw", bytes }, from, channel);
         }
     }
+    allowRaw(from) {
+        const lim = this.cfg.rateLimit;
+        if (!lim || !(lim.messages > 0) || !(lim.perMs > 0))
+            return true;
+        const now = this.cfg.clock.now();
+        let w = this.rate.get(from);
+        if (!w || now - w.start >= lim.perMs)
+            this.rate.set(from, (w = { start: now, n: 0 }));
+        return ++w.n <= lim.messages;
+    }
     // ---- migration -------------------------------------------------------------------------------------------------
     setHost(hostId) {
         if (hostId === this.hostPeerId)
@@ -549,6 +615,7 @@ export class Lobby extends Emitter {
         this.markReady();
         this.connected.clear();
         this.hiSentTo.clear();
+        this.lastHeard.clear(); // joiners spoke to the old host; their clocks start when they say hi to us
         this.lockstep.becomeHost();
         this.emit("hostChanged", this.localPeerId);
         if (this.serverUp)
@@ -654,8 +721,15 @@ export class Lobby extends Emitter {
                 void this.onSignal(Number(m.from), m);
                 break;
             case "error":
-                if (m.code === "kicked")
-                    this.teardown("kicked");
+                if (m.code === "kicked") {
+                    const d = (m.data ?? {});
+                    const close = {};
+                    if (typeof d.closeCode === "number")
+                        close.code = d.closeCode;
+                    if (typeof d.closeReason === "string")
+                        close.reason = d.closeReason;
+                    this.teardown(d.ban === false ? "disconnected" : "kicked", close.code !== undefined || close.reason !== undefined ? close : undefined);
+                }
                 else
                     this.reportError(new OneLobbyError(String(m.code), String(m.msg ?? ""), m.data));
                 break;
@@ -676,7 +750,12 @@ export class Lobby extends Emitter {
             payload.ice = s.ice;
         await link.handleSignal(payload);
     }
-    removePeer(peerId, reason) {
+    /**
+     * `linger` (host kick / disconnect): stop using the peer's link at once but leave it open until that peer closes it
+     * or KICK_LINGER_MS pass. The hub tells the peer over its WebSocket; closing the data link first would make it look
+     * like the host vanished (a migration and a 1001 instead of the host's close code).
+     */
+    removePeer(peerId, reason, close, linger = false) {
         const peer = this.roster.get(peerId);
         if (peerId === this.localPeerId) {
             this.teardown(reason === "kicked" ? "kicked" : reason);
@@ -686,26 +765,43 @@ export class Lobby extends Emitter {
             this.roster.delete(peerId);
         const link = this.links.get(peerId);
         if (link && peerId !== this.hostPeerId) {
-            link.onClose = null;
             link.onMessage = null;
-            link.close();
             this.links.delete(peerId);
             this.hiSentTo.delete(link);
+            if (linger) {
+                this.lingering.add(link);
+                const done = () => {
+                    if (!this.lingering.delete(link))
+                        return;
+                    cancel();
+                    link.onClose = null;
+                    link.close();
+                };
+                const cancel = this.cfg.clock.setTimeout(done, KICK_LINGER_MS);
+                link.onClose = done;
+            }
+            else {
+                link.onClose = null;
+                link.close();
+            }
         }
         this.connected.delete(peerId);
         this.outbox.delete(peerId);
+        this.lastHeard.delete(peerId);
+        this.rate.delete(peerId);
         this.lockstep.onPeerLeft(peerId);
         this.chat.onPeerLeft(peerId);
         this.voice.onPeerLeft(peerId);
         if (peer)
-            this.emit("peerLeft", peer, reason);
+            this.emit("peerLeft", peer, reason, close);
         if (peerId === this.hostPeerId && !this.isHost) {
             this.handleHostLost(reason);
         }
     }
+    /** Lockstep drops (stalled, desynced): removed without a ban, so the player can come back (a rejoin resyncs). */
     dropPeer(peerId, reason) {
-        this.signaling.send({ t: "kick", peerId });
-        this.removePeer(peerId, reason);
+        this.signaling.send({ t: "kick", peerId, ban: false, closeReason: reason });
+        this.removePeer(peerId, reason, undefined, true);
     }
     setPhase(p) {
         if (p !== "lobby" && p !== "in_game")
@@ -732,6 +828,11 @@ export class Lobby extends Emitter {
     }
     // ---- housekeeping ----------------------------------------------------------------------------------------------
     watchdog() {
+        if (this.ended)
+            return;
+        const timeout = this.cfg.peerTimeoutMs ?? 0;
+        if (timeout > 0)
+            this.dropSilent(Math.max(timeout, MIN_PEER_TIMEOUT_MS));
         if (this.ended || this.isHost)
             return;
         if (this.mode === "lockstep" && this.lockstep.hostSilent()) {
@@ -740,12 +841,30 @@ export class Lobby extends Emitter {
             this.handleHostLost("timeout");
         }
     }
+    /** peerTimeoutMs: the host drops joiners it has not heard from; a joiner handles a silent host as lost. */
+    dropSilent(timeout) {
+        const now = this.cfg.clock.now();
+        if (this.isHost) {
+            for (const id of [...this.connected]) {
+                const last = this.lastHeard.get(id);
+                if (last !== undefined && now - last > timeout)
+                    this.removePeer(id, "timeout");
+            }
+        }
+        else if (this.isReady) {
+            const last = this.lastHeard.get(this.hostPeerId);
+            if (last !== undefined && now - last > timeout) {
+                this.lastHeard.delete(this.hostPeerId);
+                this.handleHostLost("timeout");
+            }
+        }
+    }
     pingHost() {
         if (this.ended || this.isHost)
             return;
         this.sendTo(this.hostPeerId, { type: "ping", n: ++this.pingN, t: this.cfg.clock.now() >>> 0 }, 0, "fast");
     }
-    teardown(reason) {
+    teardown(reason, close) {
         if (this.ended)
             return;
         this.ended = true;
@@ -758,16 +877,17 @@ export class Lobby extends Emitter {
         this.cancelPing?.();
         this.lockstep.stop();
         this.voice.close();
-        for (const l of this.links.values()) {
+        for (const l of [...this.links.values(), ...this.lingering]) {
             l.onClose = null;
             l.onMessage = null;
             l.close();
         }
         this.links.clear();
+        this.lingering.clear();
         this.signaling.onClose = null;
         this.signaling.onMessage = null;
         this.signaling.close();
-        this.emit("sessionEnded", reason);
+        this.emit("sessionEnded", reason, close);
     }
     /** Total in-flight links (diagnostics and tests). */
     get linkCount() {