OptionalauditOptionalcompactCompact the persisted log every N updates (default 1000).
OptionalcountersInternal: metric counters injected by the manager.
OptionalidleIdle timeout before a room is unloaded (default 60s).
OptionalmaxSoft cap on simultaneous rooms (default 1024).
OptionalratePer-peer rate-limit knobs. Applied per connection. Service accounts (e.g. MCP agents) typically get a tighter budget than humans.
OptionalverifyOptional per-message verifier. For plain sync write-frames the cheap
expiry + role + rate-limit + payload-size gate (preCheckWriteFrame) runs
FIRST, so a non-writer / expired / rate-limited / oversized frame is
rejected before the verifier parses it (avoids Y.Doc-parse
amplification). Signed-envelope frames (e.g. the anti-replay
protector's 0xff-tagged frames) aren't recognised as sync
write-frames by that first peek, so the verifier runs first for them
and sees every signed frame — but if the verifier unwraps the envelope
and returns payload, handleMessage re-runs preCheckWriteFrame on
THAT payload before dispatch. The unwrapped frame is a real write frame
the outer peek never saw, so it must still clear expiry / role /
rate-limit / size before it reaches the doc. Returning { ok: false }
audits as reject with reason.
Audit sink for connect/update/awareness events (default = no-op).