Mall World is a 3D multiplayer hangout that runs in a browser tab. You spawn as a guest into a dream-logic shopping mall — neon storefronts, a fountain full of galaxy, a food court that goes on further than it should — and wander it alongside whoever else is currently awake. It is a game about drifting somewhere pleasant with strangers, occasionally interrupted by something much worse.

How it plays

• Movement is the whole toy. WASD and jump are the floor; the ceiling is skiing — hold space in the air and friction and damping go to zero, so momentum is sacred and the marble becomes a downhill course. Right-mouse runs on the ground and fires a jetpack in the air, with thrust tuned so it never claws back speed you already earned.
• NPCs you can actually talk to — Officer Wick, Madame Reverie, PORTER, ZOLTAR the fortune teller, a vending machine with opinions, and a mall cat.
• Nightmares. The server periodically turns the mall against everyone in it — postprocessing shifts, monsters spawn, and the pleasant part is over for a while.
• Abilities and destructibles — a shield and a charge-and-release "Dream Buster", both drawing from a shared Lucid meter that doubles as ammo for everything. World objects can be flagged breakable and respawn on a timer.

How it's built

One language end to end. The client is React 19 with React Three Fiber, drei and Rapier (WASM physics) on Three.js, bundled by Vite. The server is a single Node process running Fastify for HTTP and Colyseus for the websocket layer, backed by better-sqlite3 — one file, forward-only migrations, no external services.

The architectural rule that keeps it honest: the server owns all game truth. Positions, meters, coins, items, quest flags, dialogue, projectiles, monsters and damage are all resolved on a 20 Hz authoritative tick; the client is a renderer that predicts locally for feel and sends small intent messages. Anything both sides need — Colyseus schemas, the Zod world format, the item catalog, HP curves — lives in a shared workspace package that is the single arbiter when the two disagree. State deltas are held under 4 KB per tick at sixteen players.

Worlds are data, not code: one Zod-validated JSON document carries the layout (buildings, objects, lights, NPCs, spawn points, teleports) and the gameplay knobs (movement tuning, meters, nightmare cadence), so a designer retunes the game in the in-browser editor without a deploy. Auth is passkey-first via SimpleWebAuthn, but no account is required to play — guests spawn as a procedurally-generated glowing blob, and user-imported VRM avatars are validated and size-clamped on the way in.

Where it's going

The engine is deliberately content-free where it can be, because the roadmap is federation: one codebase deployed as sovereign servers, each with its own database, moderation and economy, plus "Dimensions" — fully isolated game variants inside a single server. USWest, the instance shown here, is the first of those.