Mall World (Game)

Mall World is a 3D multiplayer hangout that runs in a browser tab. You spawn as a guest into a dream-logic shopping mall — neon storefronts, a fountain full of galaxy, a food court that goes on further than it should — and wander it alongside whoever else is currently awake. It is a game about drifting somewhere pleasant with strangers, occasionally interrupted by something much worse.

How it plays

• Movement is the whole toy. WASD and jump are the floor; the ceiling is skiing — hold space in the air and friction and damping go to zero, so momentum is sacred and the marble becomes a downhill course. Right-mouse runs on the ground and fires a jetpack in the air, with thrust tuned so it never claws back speed you already earned.
• NPCs you can actually talk to — Officer Wick, Madame Reverie, PORTER, ZOLTAR the fortune teller, a vending machine with opinions, and a mall cat.
• Nightmares. The server periodically turns the mall against everyone in it — postprocessing shifts, monsters spawn, and the pleasant part is over for a while.
• Abilities and destructibles — a shield and a charge-and-release "Dream Buster", both drawing from a shared Lucid meter that doubles as ammo for everything. World objects can be flagged breakable and respawn on a timer.
• Dreams. Type a phrase into the Dream menu and an AI voxel composer summons it as a 3D object you scale and place in the world, with Lucid as the budget. Known prompts resolve instantly from a shared corpus; novel ones go through a model fallback chain and the same validated preview-and-place flow. Painted and imported voxels stay moderated.
• Progression and loadouts. An account-wide stat sheet (STR, DEX, CON, INT, WIS) composes with worn equipment, buffs and per-world modifiers into server-derived meters, recovery, Buster power and movement — every number auditable from an expandable Dreamer Sheet.
• Impossible spaces. Beyond the main mall there are opt-in worlds where the geometry lies on purpose: a voxel prison that is bigger inside than out, with a forced-perspective key puzzle, and look-only "Thin Glass" windows onto dioramas you can't walk into yet.
• Plays how you want — first- or third-person camera, Budget-to-Ultra quality tiers with auto render scaling, and selectable touch HUD layouts for mobile.

How it's built

One language end to end. The client is React 19 with React Three Fiber, drei and Rapier (WASM physics) on Three.js, bundled by Vite. The server is a single Node process running Fastify for HTTP and Colyseus for the websocket layer, backed by better-sqlite3 — one file, forward-only migrations, no external services.

The architectural rule that keeps it honest: the server owns all game truth. Positions, meters, coins, items, quest flags, dialogue, projectiles, monsters and damage are all resolved on a 20 Hz authoritative tick; the client is a renderer that predicts locally for feel and sends small intent messages. Anything both sides need — Colyseus schemas, the Zod world format, the item catalog, HP curves — lives in a shared workspace package that is the single arbiter when the two disagree. State deltas are held under 4 KB per tick at sixteen players.

Worlds are data, not code: one Zod-validated JSON document carries the layout (buildings, objects, lights, NPCs, spawn points, teleports) and the gameplay knobs (movement tuning, meters, nightmare cadence), so a designer retunes the game in the in-browser editor without a deploy. Auth is passkey-first via SimpleWebAuthn, but no account is required to play — guests spawn as a procedurally-generated glowing blob, and user-imported VRM avatars are validated and size-clamped on the way in.

Federation

The engine is deliberately content-free where it can be, because it ships as sovereign servers: one codebase, portable deploy templates, and each instance with its own database, moderation and economy, plus "Dimensions" — fully isolated game variants inside a single server, each with its own persistent nightfall clock. Servers announce a signed manifest to a hub directory, which surfaces as an in-game Travel menu with live populations. Crossing over uses passports: a 60-second Ed25519 JWT minted by your home server and redeemed by the destination against the origin's public JWKS, with a trust allowlist, replay guard, and only name/avatar carried across — never coins, items or roles. USWest, the instance shown here, is the first of those.