crowdypy 0.30.0.dev1__tar.gz → 0.31.0.dev1__tar.gz

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/MIGRATION.md

@@ -3,6 +3,24 @@
 CrowdyPy is pre-1.0. Within a minor line, patch releases keep source compatibility; each
 new minor may change the API. Read the section for every minor you skip.
 
+## 0.31.0
+
+Vendors CrowdyCPP 0.83.0 (the Unreal team's hardening, A1 to A6). Nothing new is needed on the tier.
+
+- **MessagePack maps with an array, map, binary or extension key fail to decode** (a kit actor state
+  or a mod's reply): a key nested in keys was escaped again at every level, so about 130 bytes asked
+  for gigabytes and froze or crashed the decoding thread. Number, boolean and nil keys still become
+  their JSON text.
+- **A NaN or an infinity in a decoded value is written as `null` in place** when the native core
+  serialises it, instead of turning the whole value into `null`.
+- **Unchanged keyframes of more than 8 actors no longer count as gameplay input** for
+  `idle_release_guard_ms`, so a genuine idle release ends a session whose host keeps many actors'
+  keyframes going.
+- **A legacy `COMMAND_RECONNECT` (22) is paced** (`client.udp.connect(legacy_reconnect_window_ms=...)`,
+  30 s): one per assignment, each at least a window after the last honoured one, the window
+  doubling to 10 minutes; the rest are dropped and counted in
+  `stats()["legacy_reconnects_suppressed"]`. `0` honours every verified one, as before.
+
 ## 0.30.0
 
 CrowdyJS 18.30.0 and CrowdyCPP 0.82.0 (the ChunkStore rework). Box reads and `since` need ck-api

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: crowdypy
-Version: 0.30.0.dev1
+Version: 0.31.0.dev1
 Summary: Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core
 Keywords: crowded-kingdoms,multiplayer,replication,graphql,sdk,udp
 Author: Crowded Kingdoms
@@ -51,6 +51,8 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
+**v0.31.0: hardening from CrowdyCPP 0.83.0.** MessagePack keys that are containers are refused (a nested key blew up memory), a NaN serialises as `null` in place, unchanged keyframes of many actors are not gameplay input, and a legacy reconnect command is paced (`legacy_reconnect_window_ms`). See [MIGRATION.md](MIGRATION.md).
+
 **v0.30.0: the ChunkStore rework.** `ensure_around` reads only what is missing, as boxes, paged; `set_voxel` is paced and returns an edit id, and an edit the server refuses or never echoes is undone (`on_edit_refused`); a replaced chunk is read again and a reconnect catches up; realtime edits are no longer written back. CrowdyJS 18.30.0 and CrowdyCPP 0.82.0. See [MIGRATION.md](MIGRATION.md).
 
 **v0.29.0: reconnect commands verify, bound control frames, and `chunk_changed`.** A server's `COMMAND_RECONNECT` verifies again; against replication servers v0.45.0 the reconnect and release frames carry a per-assignment nonce under their HMAC, so one captured earlier is refused (`stats()["stale_bound_control"]`); `chunk_changed` reports a chunk a hub's or mod's `world.set_chunk` replaced. CrowdyJS 18.29.0 and CrowdyCPP 0.81.0. See [MIGRATION.md](MIGRATION.md).

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/README.md

@@ -11,6 +11,8 @@ CrowdyPy follows the [CrowdyJS](https://github.com/CrowdedKingdoms/CrowdyJS) API
 client, bound with [nanobind](https://github.com/wjakob/nanobind) and shipped inside the
 wheel. Python never touches a datagram.
 
+**v0.31.0: hardening from CrowdyCPP 0.83.0.** MessagePack keys that are containers are refused (a nested key blew up memory), a NaN serialises as `null` in place, unchanged keyframes of many actors are not gameplay input, and a legacy reconnect command is paced (`legacy_reconnect_window_ms`). See [MIGRATION.md](MIGRATION.md).
+
 **v0.30.0: the ChunkStore rework.** `ensure_around` reads only what is missing, as boxes, paged; `set_voxel` is paced and returns an edit id, and an edit the server refuses or never echoes is undone (`on_edit_refused`); a replaced chunk is read again and a reconnect catches up; realtime edits are no longer written back. CrowdyJS 18.30.0 and CrowdyCPP 0.82.0. See [MIGRATION.md](MIGRATION.md).
 
 **v0.29.0: reconnect commands verify, bound control frames, and `chunk_changed`.** A server's `COMMAND_RECONNECT` verifies again; against replication servers v0.45.0 the reconnect and release frames carry a per-assignment nonce under their HMAC, so one captured earlier is refused (`stats()["stale_bound_control"]`); `chunk_changed` reports a chunk a hub's or mod's `world.set_chunk` replaced. CrowdyJS 18.29.0 and CrowdyCPP 0.81.0. See [MIGRATION.md](MIGRATION.md).

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/docs/compatibility.md

@@ -5,7 +5,7 @@ are in `pyproject.toml` (`[project].version`, `[tool.crowdypy.crowdyjs]`,
 `[tool.crowdypy.crowdycpp]`); `tests/unit/test_release_versions.py` refuses this page when
 its version disagrees.
 
-- CrowdyPy `0.30.0`
+- CrowdyPy `0.31.0`
 - API surface: CrowdyJS (the pinned version and commit in `pyproject.toml`); the generated
   `docs/parity-matrix.md` lists every covered method, every native equivalent and every
   browser exclusion with its reason. The gate is strict: there are no portable gaps, and a

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/docs/e2e-coverage.md

@@ -73,6 +73,7 @@ suites.
 | 2026-10-31 | dev tier (ck-api v2.60.0), app `96701660793088`; managed players in app `107209219611648` | `crowdypy 0.23.0.dev1` from PyPI (installed into a clean Python 3.12 with uv) | the teen safety scenarios that register no one (the Minecraft challenge refused; the managed adult; the managed 12-year-old and the blocked country refused): 3 passed |
 | 2026-11-03 | dev tier (ck-api v2.61.0, players from 13), app `96701660793088`, the `harness` provisioning token with `CROWDY_E2E_EMAIL=crowdy-e2e-py@test.invalid`; the existing player and the managed players of the 13+ test org (app `107209219611648`) | 0.24.0 (branch `feat/13plus-v2.61`: CrowdyJS `dev/v18.25.0`, vendoring CrowdyCPP `dev/v0.76.0`) | the teen safety suite only, two registrations in all and none under 13: the sign-up with an age (its account deleted), the DE sign-up refused, the Minecraft challenge, the existing accounts (`hasSafetyModerator` as the org admin and `None` as the outsider, its own sessions, every row's `regionCode`) and the managed players (UA-09 and UA without a region refused, UA-30 admitted): 5 passed. The two-player scenarios failed at their setup: dev now asks an org admin for the developer documents, and the CK org admin behind `CROWDY_E2E_OWNER_EMAIL` has not accepted them, so its `grant` is refused ("Accept the current developer terms (recordDeveloperConsents) before creating or administering an organization"); they were not rerun with another owner, which would have registered two more players |
 | 2026-11-11 | dev tier (ck-api v2.65.0, the email gate), app `96701660793088`, the `harness` provisioning token with `CROWDY_E2E_EMAIL=crowdy-e2e-py@test.invalid` | 0.26.0 (branch `feat/email-confirmation-required`: CrowdyJS `dev/v18.27.0`, vendoring CrowdyCPP `dev/v0.78.0`) | identity, replication and teen safety suites: 12 passed, 2 skipped (the teen safety suite's existing player and managed players, not configured). Accounts the provisioning token makes are not asked to confirm their email, so every mint went through |
+| 2026-11-12 | dev tier (ck-api v2.68.1, replication servers v0.45.0), app `96701660793088`, the `harness` provisioning token with `CROWDY_E2E_EMAIL=crowdy-e2e-py@test.invalid` | 0.30.0 (`dev` at `60de17f`, vendoring CrowdyCPP `dev/v0.82.0`: the ChunkStore rework) | world and replication suites: 4 passed |
 
 ## Not covered here
 

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/docs/parity-matrix.md

@@ -5,7 +5,7 @@ Generated by `tools/parity/parity.py`; do not edit by hand. Classifications live
 ## Target
 
 - CrowdyJS: `18.30.0` at `4840d76029ffb15a6de6232dab9336f2e9ab6514`
-- CrowdyCPP (native core): `0.82.0` at `c6875412bcea97120b4540b80d9b34504c29acf9`
+- CrowdyCPP (native core): `0.83.0` at `73eb66cdf1c435bc67e405b9a5bd606740209df2`
 - schema.gql identical to CrowdyJS's: yes
 - Gate mode: strict portable parity (every portable gap is release-blocking)
 

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/native/replication.hpp

@@ -396,6 +396,7 @@ struct ConnectionOptions {
   std::int64_t advertiseIntervalMs = 15 * 1000;
   std::int64_t watchdogSilenceMs = 0;
   std::int64_t idleReleaseGuardMs = 60 * 1000;
+  std::int64_t legacyReconnectWindowMs = 30 * 1000;
   std::size_t ringCapacity = 4096;
   int socketRecvBufferBytes = 1 << 20;
   int socketSendBufferBytes = 1 << 20;
@@ -432,6 +433,7 @@ class PyConnection {
     config.advertiseIntervalMs = options.advertiseIntervalMs;
     config.watchdogSilenceMs = options.watchdogSilenceMs;
     config.idleReleaseGuardMs = options.idleReleaseGuardMs;
+    config.legacyReconnectWindowMs = options.legacyReconnectWindowMs;
     config.ringCapacity = options.ringCapacity;
     config.socketRecvBufferBytes = options.socketRecvBufferBytes;
     config.socketSendBufferBytes = options.socketSendBufferBytes;
@@ -739,6 +741,7 @@ class PyConnection {
     d["reconnects"] = s.reconnects;
     d["idle_releases_after_input"] = s.idleReleasesAfterInput;
     d["stale_bound_control"] = s.staleBoundControl;
+    d["legacy_reconnects_suppressed"] = s.legacyReconnectsSuppressed;
     d["last_server_epoch_ms"] = s.lastServerEpochMs;
     nb::dict sentByType;
     nb::dict receivedByType;

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/native/replication_binding.cpp

@@ -232,7 +232,7 @@ void register_replication(nb::module_& m) {
              bool advertiseCapabilities, std::int64_t advertiseIntervalMs,
              std::int64_t watchdogSilenceMs, std::size_t ringCapacity, int recvBuffer,
              int sendBuffer, bool bundleSends, int bundleWindowMs, std::int64_t providerTimeoutMs,
-             std::int64_t idleReleaseGuardMs) {
+             std::int64_t idleReleaseGuardMs, std::int64_t legacyReconnectWindowMs) {
             ConnectionOptions o;
             o.appId = appId;
             o.manualPump = manualPump;
@@ -249,6 +249,7 @@ void register_replication(nb::module_& m) {
             o.bundleSends = bundleSends;
             o.bundleWindowMs = bundleWindowMs;
             o.idleReleaseGuardMs = idleReleaseGuardMs;
+            o.legacyReconnectWindowMs = legacyReconnectWindowMs;
             new (self) PyConnection(o, token, gameTokenId, expiresAtMs, providerTimeoutMs);
           },
           nb::arg("app_id"), nb::arg("token"), nb::arg("game_token_id"),
@@ -260,7 +261,8 @@ void register_replication(nb::module_& m) {
           nb::arg("socket_recv_buffer_bytes") = 1 << 20,
           nb::arg("socket_send_buffer_bytes") = 1 << 20, nb::arg("bundle_sends") = true,
           nb::arg("bundle_window_ms") = 1, nb::arg("provider_timeout_ms") = 30000,
-          nb::arg("idle_release_guard_ms") = 60 * 1000)
+          nb::arg("idle_release_guard_ms") = 60 * 1000,
+          nb::arg("legacy_reconnect_window_ms") = 30 * 1000)
       .def_prop_ro("bridge", &PyConnection::bridge, nb::rv_policy::reference_internal)
       .def("connect", &PyConnection::connect)
       .def("disconnect", &PyConnection::disconnect)

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "scikit_build_core.build"
 
 [project]
 name = "crowdypy"
-version = "0.30.0.dev1"
+version = "0.31.0.dev1"
 description = "Official Python SDK for Crowded Kingdoms: typed GraphQL clients and a native UDP replication core"
 readme = "README.md"
 license = "MIT AND Apache-2.0"
@@ -123,10 +123,10 @@ version = "18.30.0"
 commit = "4840d76029ffb15a6de6232dab9336f2e9ab6514"
 
 [tool.crowdypy.crowdycpp]
-version = "0.82.0"
-tag = "dev/v0.82.0"
-commit = "c6875412bcea97120b4540b80d9b34504c29acf9"
-tree-sha256 = "44dca0b0bd34d575808e5bf7a1ca6944ce779a790b9187894761541623a0f3ec"
+version = "0.83.0"
+tag = "dev/v0.83.0"
+commit = "73eb66cdf1c435bc67e405b9a5bd606740209df2"
+tree-sha256 = "fc2d2a460cdc403a9a389e99fa6c402c95c87df05529bbe08167bb5bf20cdffd"
 
 # schema.gql and operations/ are CrowdyJS's, copied from the commit pinned above by
 # scripts/schema_sync.py, which records these hashes and re-derives them in CI.

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/src/crowdypy/_version.py

@@ -1,3 +1,3 @@
 """The CrowdyPy release this source tree builds."""
 
-__version__ = "0.30.0"
+__version__ = "0.31.0"

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/tests/unit/test_replication.py

@@ -351,6 +351,52 @@ def test_an_idle_release_right_after_input_reassigns(server: FakeServer) -> None
         assert guardless.assigned == 1
 
 
+def command_reconnect(key: str = TOKEN) -> bytes:
+    prefix = bytes([MessageType.COMMAND_RECONNECT])
+    return prefix + hmac.new(key.encode("latin-1"), prefix, hashlib.sha256).digest()
+
+
+def test_a_legacy_reconnect_is_paced(server: FakeServer) -> None:
+    # CrowdyCPP 0.83.0: a legacy 22 signs fixed bytes, so a captured one verifies for the token's
+    # life. One is honoured, and another moments later is dropped and counted.
+    provider = Provider(server)
+    with ReplicationConnection(provider, token(), app_id=7, **QUIET) as connection:
+        for honoured in (True, False):
+            # A reassignment finishes before the next send: it goes out on the new socket.
+            wait_for_state(connection, ConnState.CONNECTED)
+            connection.send_heartbeat((0, 0, 0), ME)
+            connection.flush_sends()
+            server.recv()  # the server learns where this assignment's socket is
+            before = provider.assigned
+            server.send(command_reconnect())
+            deadline = time.monotonic() + 2
+            while time.monotonic() < deadline:
+                connection.wait(0.05)
+                connection.poll()
+                if honoured and provider.assigned > before:
+                    break
+                if not honoured and connection.stats()["legacy_reconnects_suppressed"] == 1:
+                    break
+            assert provider.assigned == (before + 1 if honoured else before)
+        assert connection.stats()["legacy_reconnects_suppressed"] == 1
+
+    unpaced = Provider(server)
+    with ReplicationConnection(
+        unpaced, token(), app_id=7, legacy_reconnect_window_ms=0, **QUIET
+    ) as connection:
+        for n in (2, 3):
+            wait_for_state(connection, ConnState.CONNECTED)
+            connection.send_heartbeat((0, 0, 0), ME)
+            connection.flush_sends()
+            server.recv()
+            server.send(command_reconnect())
+            deadline = time.monotonic() + 2
+            while unpaced.assigned < n and time.monotonic() < deadline:
+                connection.wait(0.05)
+                connection.poll()
+            assert unpaced.assigned == n
+
+
 def test_a_release_that_does_not_verify_is_ignored(server: FakeServer) -> None:
     provider = Provider(server)
     with ReplicationConnection(provider, token(), app_id=7, **QUIET) as connection:

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/uv.lock

@@ -103,7 +103,7 @@ wheels = [
 
 [[package]]
 name = "crowdypy"
-version = "0.30.0"
+version = "0.31.0"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/CMakeLists.txt

@@ -1,5 +1,5 @@
 cmake_minimum_required(VERSION 3.22)
-project(CrowdyCPP VERSION 0.82.0 LANGUAGES C CXX)
+project(CrowdyCPP VERSION 0.83.0 LANGUAGES C CXX)
 
 set(CMAKE_CXX_STANDARD 20)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/PROVENANCE.md

@@ -5,4 +5,4 @@ pins under `[tool.crowdypy.crowdycpp]`. It is written by
 `scripts/vendor_crowdycpp.py` and checked in CI by re-deriving it from that commit.
 Do not edit it: change CrowdyCPP, release it on the same tier, and re-vendor.
 
-Vendored from `dev/v0.82.0` (`c6875412bcea97120b4540b80d9b34504c29acf9`).
+Vendored from `dev/v0.83.0` (`73eb66cdf1c435bc67e405b9a5bd606740209df2`).

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/include/crowdy/domains/world_data.hpp

@@ -331,6 +331,40 @@ class VoxelsAPI : public DomainBase {
     listByDistanceAsync(area.toInput(appId), std::move(cb));
   }
 
+  /// listInRegion() selecting only what rebuilds a cell: each chunk's `coordinates`, and each
+  /// edit's `location`, `voxelType` and `state` (operation ListVoxelUpdatesByDistanceCells).
+  /// The log keeps one row per position, the latest write, so a chunk's answer is bounded by
+  /// the positions ever edited in it, not by its history.
+  graphql::Json listInRegionCells(std::string_view appId, const ChunkRegion& area) const {
+    graphql::JVal vars;
+    vars["input"] = area.toInput(appId);
+    return execUnwrap(gen::voxels::kListVoxelUpdatesByDistanceCellsDocument, vars);
+  }
+
+  void listInRegionCellsAsync(std::string_view appId, const ChunkRegion& area,
+                              graphql::GraphQLCallback cb) const {
+    graphql::JVal vars;
+    vars["input"] = area.toInput(appId);
+    execUnwrapAsync(gen::voxels::kListVoxelUpdatesByDistanceCellsDocument, vars, {},
+                    std::move(cb));
+  }
+
+  /// listInRegionCells() with each edit's `createdAt`, the server time of its latest write,
+  /// for a reader that orders edits by time (operation ListVoxelUpdatesByDistanceCellsTimed).
+  graphql::Json listInRegionCellsTimed(std::string_view appId, const ChunkRegion& area) const {
+    graphql::JVal vars;
+    vars["input"] = area.toInput(appId);
+    return execUnwrap(gen::voxels::kListVoxelUpdatesByDistanceCellsTimedDocument, vars);
+  }
+
+  void listInRegionCellsTimedAsync(std::string_view appId, const ChunkRegion& area,
+                                   graphql::GraphQLCallback cb) const {
+    graphql::JVal vars;
+    vars["input"] = area.toInput(appId);
+    execUnwrapAsync(gen::voxels::kListVoxelUpdatesByDistanceCellsTimedDocument, vars, {},
+                    std::move(cb));
+  }
+
   /// Durable single-voxel update (requires update_voxel_data permission).
   graphql::Json update(const graphql::JVal& input) const {
     graphql::JVal vars;

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/include/crowdy/generated/enums.hpp

@@ -3,7 +3,7 @@
 // Inputs: operations/**/*.graphql and schema.gql (synced from the published
 // SDL at https://docs.crowdedkingdoms.com/schema/game-api.graphql).
 // schema.gql sha256: 13094c2757b41d50c8aee996009a00d0995ef597bd792c778c25585576a45f33
-// operations sha256: 004cb5807f8f859a8c07e2cf75930521350d242fdca088393b463aa5c300c05f
+// operations sha256: eca7de01bfc5d967afbf6c230b6596a9ae42bf9a584ac1021c9f6e9399873f1c
 
 #pragma once
 

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/include/crowdy/generated/operations.hpp

@@ -3,7 +3,7 @@
 // Inputs: operations/**/*.graphql and schema.gql (synced from the published
 // SDL at https://docs.crowdedkingdoms.com/schema/game-api.graphql).
 // schema.gql sha256: 13094c2757b41d50c8aee996009a00d0995ef597bd792c778c25585576a45f33
-// operations sha256: 004cb5807f8f859a8c07e2cf75930521350d242fdca088393b463aa5c300c05f
+// operations sha256: eca7de01bfc5d967afbf6c230b6596a9ae42bf9a584ac1021c9f6e9399873f1c
 
 #pragma once
 
@@ -11053,6 +11053,102 @@ inline constexpr std::string_view kListVoxelUpdatesByDistanceIsolatedDocument =
 })gql";
 inline constexpr std::string_view kListVoxelUpdatesByDistanceOperationName = "ListVoxelUpdatesByDistance";
 
+/// voxels/ListVoxelUpdatesByDistanceCells.graphql
+inline constexpr std::string_view kListVoxelUpdatesByDistanceCellsDocument = R"gql(query ListVoxelUpdatesByDistanceCells($input: ListVoxelUpdatesByDistanceInput!) {
+  listVoxelUpdatesByDistance(input: $input) {
+    limit
+    skip
+    chunks {
+      coordinates {
+        x
+        y
+        z
+      }
+      voxels {
+        location {
+          x
+          y
+          z
+        }
+        voxelType
+        state
+      }
+    }
+  }
+})gql";
+inline constexpr std::string_view kListVoxelUpdatesByDistanceCellsIsolatedDocument = R"gql(query ListVoxelUpdatesByDistanceCells($input: ListVoxelUpdatesByDistanceInput!) {
+  listVoxelUpdatesByDistance(input: $input) {
+    limit
+    skip
+    chunks {
+      coordinates {
+        x
+        y
+        z
+      }
+      voxels {
+        location {
+          x
+          y
+          z
+        }
+        voxelType
+        state
+      }
+    }
+  }
+})gql";
+inline constexpr std::string_view kListVoxelUpdatesByDistanceCellsOperationName = "ListVoxelUpdatesByDistanceCells";
+
+/// voxels/ListVoxelUpdatesByDistanceCellsTimed.graphql
+inline constexpr std::string_view kListVoxelUpdatesByDistanceCellsTimedDocument = R"gql(query ListVoxelUpdatesByDistanceCellsTimed($input: ListVoxelUpdatesByDistanceInput!) {
+  listVoxelUpdatesByDistance(input: $input) {
+    limit
+    skip
+    chunks {
+      coordinates {
+        x
+        y
+        z
+      }
+      voxels {
+        location {
+          x
+          y
+          z
+        }
+        voxelType
+        state
+        createdAt
+      }
+    }
+  }
+})gql";
+inline constexpr std::string_view kListVoxelUpdatesByDistanceCellsTimedIsolatedDocument = R"gql(query ListVoxelUpdatesByDistanceCellsTimed($input: ListVoxelUpdatesByDistanceInput!) {
+  listVoxelUpdatesByDistance(input: $input) {
+    limit
+    skip
+    chunks {
+      coordinates {
+        x
+        y
+        z
+      }
+      voxels {
+        location {
+          x
+          y
+          z
+        }
+        voxelType
+        state
+        createdAt
+      }
+    }
+  }
+})gql";
+inline constexpr std::string_view kListVoxelUpdatesByDistanceCellsTimedOperationName = "ListVoxelUpdatesByDistanceCellsTimed";
+
 /// voxels/ListVoxels.graphql
 inline constexpr std::string_view kListVoxelsDocument = R"gql(query ListVoxels($input: ListVoxelsInput!) {
   listVoxels(input: $input) {
@@ -11335,6 +11431,8 @@ inline constexpr std::string_view kVoxelUpdateHistoryConnectionOperationName = "
 
 inline constexpr std::string_view documentFor(std::string_view operationName) {
   if (operationName == "ListVoxelUpdatesByDistance") return kListVoxelUpdatesByDistanceIsolatedDocument;
+  if (operationName == "ListVoxelUpdatesByDistanceCells") return kListVoxelUpdatesByDistanceCellsIsolatedDocument;
+  if (operationName == "ListVoxelUpdatesByDistanceCellsTimed") return kListVoxelUpdatesByDistanceCellsTimedIsolatedDocument;
   if (operationName == "ListVoxels") return kListVoxelsIsolatedDocument;
   if (operationName == "RollbackVoxelUpdates") return kRollbackVoxelUpdatesIsolatedDocument;
   if (operationName == "UpdateVoxel") return kUpdateVoxelIsolatedDocument;

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/include/crowdy/graphql/json.hpp

@@ -10,6 +10,8 @@
 #include <variant>
 #include <vector>
 
+#include "crowdy/core/result.hpp"
+
 /// JSON support for the GraphQL layer (never used on the UDP path).
 ///
 /// Two shapes:
@@ -66,7 +68,8 @@ class JVal {
   /// JVal::array(...).
   JVal& operator[](std::nullptr_t) = delete;
 
-  /// Serialize to a compact JSON string (RFC 8259 escaping).
+  /// Serialize to a compact JSON string (RFC 8259 escaping). NaN and infinity are written
+  /// as `null`, as JSON.stringify writes them.
   std::string dump() const;
 
  private:
@@ -122,8 +125,13 @@ class Json {
   /// int64. Integer JSON numbers are converted losslessly.
   std::string asBigIntString(std::string_view fallback = {}) const;
 
-  /// Serialize this value back to a JSON string.
+  /// Serialize this value back to a JSON string. NaN and infinity are written as `null` in
+  /// place, so the rest of the value survives. A value that still cannot be written (a
+  /// string that is not valid UTF-8, which fromMsgpack can produce) comes back as "null":
+  /// use tryDump() to tell that apart from a null value.
   std::string dump() const;
+  /// dump(), reporting a value it cannot write as Errc::Malformed instead of "null".
+  Result<std::string> tryDump() const;
 
   /// This value as MessagePack, the payload format of ck-exec calls: integers
   /// keep their exact width and sign, objects become maps with string keys. A
@@ -132,9 +140,11 @@ class Json {
   /// the calling thread's stack.
   std::string toMsgpack() const;
   /// Parse one MessagePack value into a document. Binary becomes a base64
-  /// string and extension types null; nesting deeper than 64 is refused.
+  /// string and extension types null; nesting deeper than 64 is refused. A map
+  /// key must be a string, a number, a boolean or nil (the last three become
+  /// their JSON text); an array, map, binary or extension key is refused.
   /// Returns a null Json (ok() == false) on malformed, truncated or trailing
-  /// input.
+  /// input, or on a refused key.
   static Json fromMsgpack(std::string_view bytes);
 
   /// Iterate object members / array elements, in order, one step each: linear in

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/include/crowdy/replication/connection.hpp

@@ -5,6 +5,7 @@
 #include <memory>
 #include <mutex>
 #include <thread>
+#include <unordered_map>
 
 #include "crowdy/core/clock.hpp"
 #include "crowdy/core/crypto.hpp"
@@ -301,6 +302,10 @@ class Connection {
     /// Bound control frames (44, 45) carrying another assignment's nonce, dropped: a
     /// frame captured earlier and sent again.
     std::uint64_t staleBoundControl = 0;
+    /// Verified legacy COMMAND_RECONNECTs (22) dropped because one was honoured too
+    /// recently (0.83.0): a 22 signs fixed bytes, so a captured one verifies for the
+    /// game token's life, and each honoured one moves the player to another server.
+    std::uint64_t legacyReconnectsSuppressed = 0;
     std::int64_t lastServerEpochMs = 0;
     /// Messages sent, by wire opcode (actor/voxel/audio/text/event/channel/
     /// heartbeat requests).
@@ -422,16 +427,29 @@ class Connection {
 
   /// Monotonic ms of the last send that counts as gameplay input (0: none yet).
   std::atomic<std::int64_t> lastGameplayMs_{0};
-  /// The last actor-update payload hash per actor this session, so a keyframe that
-  /// repeats an unchanged state is not input. A lookup that misses counts as a change.
-  struct ActorStateHash {
-    core::ActorUuid uuid{};
-    std::uint64_t hash = 0;
-    bool used = false;
+  /// The last actor-update payload hash per actor this assignment, so a keyframe that
+  /// repeats an unchanged state is not input. An actor's first update is a change. Past
+  /// kMaxTrackedActors actors, an untracked actor's keyframe counts as unchanged, so a host
+  /// keeping a large world's keyframes going still looks idle when it is.
+  struct ActorUuidHasher {
+    std::size_t operator()(const core::ActorUuid& u) const noexcept {
+      std::uint64_t h = 1469598103934665603ULL;
+      for (char c : u) h = (h ^ static_cast<std::uint8_t>(c)) * 1099511628211ULL;
+      return static_cast<std::size_t>(h);
+    }
   };
-  std::array<ActorStateHash, 8> actorStateHashes_{};
-  std::size_t actorStateNext_ = 0;
+  static constexpr std::size_t kMaxTrackedActors = 4096;
+  std::unordered_map<core::ActorUuid, std::uint64_t, ActorUuidHasher> actorStateHashes_;
   std::mutex actorStateMutex_;
+
+  /// Config::legacyReconnectWindowMs: a legacy COMMAND_RECONNECT (22) is honoured once per
+  /// assignment, and each honoured one must follow the last by the current window. Touched
+  /// only on the receive path and in doAssign().
+  static constexpr std::int64_t kLegacyReconnectWindowMaxMs = 600'000;
+  std::int64_t lastLegacyReconnectMs_ = 0;
+  std::int64_t legacyReconnectWindowMs_ = 0;
+  bool legacyReconnectHonoured_ = false;
+  bool honourLegacyReconnect();
   void noteGameplaySend(wire::MessageType type, const SpatialSend& p);
   bool actorStateChanged(const SpatialSend& p);
   bool idleReleaseFollowsInput() const;

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/include/crowdy/replication/types.hpp

@@ -105,6 +105,14 @@ struct Config {
   /// release final.
   std::int64_t idleReleaseGuardMs = 60 * 1000;
 
+  /// A verified legacy COMMAND_RECONNECT (22) reassigns at most once per assignment, and
+  /// only this long after the last one it honoured; the window doubles with each honoured
+  /// one up to 10 minutes, and goes back to this after 10 minutes without one. A 22 signs
+  /// fixed bytes, so one captured earlier verifies again for the game token's life; the
+  /// rest are dropped and count in Stats::legacyReconnectsSuppressed. The bound form (44)
+  /// is not limited. 0 honours every verified 22, as before 0.83.0.
+  std::int64_t legacyReconnectWindowMs = 30 * 1000;
+
   /// Capacity (events) of the net->game notification ring.
   std::size_t ringCapacity = 4096;
 

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crowdycpp-maintainer-tools",
-  "version": "0.82.0",
+  "version": "0.83.0",
   "private": true,
   "type": "module",
   "description": "Offline parity and schema maintenance tools for CrowdyCPP",

{crowdypy-0.30.0.dev1 → crowdypy-0.31.0.dev1}/vendor/CrowdyCPP/src/graphql/json.cpp

@@ -94,6 +94,10 @@ void JVal::dumpTo(std::string& out) const {
     void operator()(bool b) { out += b ? "true" : "false"; }
     void operator()(std::int64_t i) { out += std::to_string(i); }
     void operator()(double d) {
+      if (!std::isfinite(d)) {
+        out += "null";  // as JSON.stringify writes NaN and infinity
+        return;
+      }
       char buf[32];
       std::snprintf(buf, sizeof(buf), "%.17g", d);
       out += buf;
@@ -243,9 +247,14 @@ std::string Json::asBigIntString(std::string_view fallback) const {
 }
 
 std::string Json::dump() const {
-  if (!val_) return "null";
-  char* s = yyjson_val_write(val(val_), 0, nullptr);
-  if (!s) return "null";
+  auto out = tryDump();
+  return out.ok() ? std::move(out.value()) : std::string("null");
+}
+
+Result<std::string> Json::tryDump() const {
+  if (!val_) return std::string("null");
+  char* s = yyjson_val_write(val(val_), YYJSON_WRITE_INF_AND_NAN_AS_NULL, nullptr);
+  if (!s) return Errc::Malformed;
   std::string out(s);
   free(s);
   return out;
@@ -438,15 +447,34 @@ struct Unpacker {
     }
     return a;
   }
+  // A map key must be a scalar. A container key written as text is escaped again at every
+  // level it is nested in another key, so 130 bytes nested 60 deep asked for gigabytes.
+  static bool scalarKey(std::uint8_t t) {
+    if ((t & 0xf0) == 0x80 || (t & 0xf0) == 0x90) return false;  // fixmap, fixarray
+    switch (t) {
+      case 0xc4: case 0xc5: case 0xc6:                                // bin
+      case 0xc7: case 0xc8: case 0xc9:                                // ext
+      case 0xd4: case 0xd5: case 0xd6: case 0xd7: case 0xd8:          // fixext
+      case 0xdc: case 0xdd: case 0xde: case 0xdf:                     // array, map
+        return false;
+      default:
+        return true;
+    }
+  }
   yyjson_mut_val* map(std::size_t n, int depth) {
     yyjson_mut_val* o = yyjson_mut_obj(doc);
     for (std::size_t i = 0; i < n && ok; ++i) {
+      if (!need(1)) break;
+      if (!scalarKey(*p)) {
+        ok = false;
+        break;
+      }
       yyjson_mut_val* k = value(depth + 1);
       yyjson_mut_val* v = value(depth + 1);
       if (!ok || !k || !v) break;
       if (!yyjson_mut_is_str(k)) {
-        // A non-string key keeps its value as text, as JSON has only string keys.
-        char* text = yyjson_mut_val_write(k, 0, nullptr);
+        // A number, boolean or nil key keeps its value as text, as JSON has only string keys.
+        char* text = yyjson_mut_val_write(k, YYJSON_WRITE_INF_AND_NAN_AS_NULL, nullptr);
         k = yyjson_mut_strcpy(doc, text ? text : "null");
         free(text);
       }