@fluxstack/live 0.1.0 → 0.2.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { randomBytes, createCipheriv, createDecipheriv, createHmac } from 'crypto';
+import { randomBytes, createHmac, createCipheriv, createDecipheriv, scryptSync } from 'crypto';
 import { gzipSync, gunzipSync } from 'zlib';
 import { EventEmitter } from 'events';
 
@@ -12,6 +12,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 // src/rooms/RoomEventBus.ts
 function createTypedRoomEventBus() {
   const subscriptions = /* @__PURE__ */ new Map();
+  const componentIndex = /* @__PURE__ */ new Map();
   const getKey = (roomType, roomId, event) => `${roomType}:${roomId}:${event}`;
   const getRoomKey = (roomType, roomId) => `${roomType}:${roomId}`;
   return {
@@ -28,6 +29,10 @@ function createTypedRoomEventBus() {
         componentId
       };
       subscriptions.get(key).add(subscription);
+      if (!componentIndex.has(componentId)) {
+        componentIndex.set(componentId, /* @__PURE__ */ new Set());
+      }
+      componentIndex.get(componentId).add(key);
       return () => {
         subscriptions.get(key)?.delete(subscription);
         if (subscriptions.get(key)?.size === 0) {
@@ -52,8 +57,12 @@ function createTypedRoomEventBus() {
       return notified;
     },
     unsubscribeAll(componentId) {
+      const keys = componentIndex.get(componentId);
+      if (!keys) return 0;
       let removed = 0;
-      for (const [key, subs] of subscriptions) {
+      for (const key of keys) {
+        const subs = subscriptions.get(key);
+        if (!subs) continue;
         for (const sub of subs) {
           if (sub.componentId === componentId) {
             subs.delete(sub);
@@ -64,6 +73,7 @@ function createTypedRoomEventBus() {
           subscriptions.delete(key);
         }
       }
+      componentIndex.delete(componentId);
       return removed;
     },
     clearRoom(roomType, roomId) {
@@ -71,7 +81,13 @@ function createTypedRoomEventBus() {
       let removed = 0;
       for (const key of subscriptions.keys()) {
         if (key.startsWith(prefix)) {
-          removed += subscriptions.get(key)?.size ?? 0;
+          const subs = subscriptions.get(key);
+          if (subs) {
+            for (const sub of subs) {
+              componentIndex.get(sub.componentId)?.delete(key);
+            }
+            removed += subs.size;
+          }
           subscriptions.delete(key);
         }
       }
@@ -96,6 +112,8 @@ function createTypedRoomEventBus() {
 }
 var RoomEventBus = class {
   subscriptions = /* @__PURE__ */ new Map();
+  /** Reverse index: componentId -> Set of subscription keys for O(1) unsubscribeAll */
+  componentIndex = /* @__PURE__ */ new Map();
   getKey(roomType, roomId, event) {
     return `${roomType}:${roomId}:${event}`;
   }
@@ -106,6 +124,10 @@ var RoomEventBus = class {
     }
     const subscription = { roomType, roomId, event, handler, componentId };
     this.subscriptions.get(key).add(subscription);
+    if (!this.componentIndex.has(componentId)) {
+      this.componentIndex.set(componentId, /* @__PURE__ */ new Set());
+    }
+    this.componentIndex.get(componentId).add(key);
     return () => {
       this.subscriptions.get(key)?.delete(subscription);
       if (this.subscriptions.get(key)?.size === 0) {
@@ -130,8 +152,12 @@ var RoomEventBus = class {
     return notified;
   }
   unsubscribeAll(componentId) {
+    const keys = this.componentIndex.get(componentId);
+    if (!keys) return 0;
     let removed = 0;
-    for (const [key, subs] of this.subscriptions) {
+    for (const key of keys) {
+      const subs = this.subscriptions.get(key);
+      if (!subs) continue;
       for (const sub of subs) {
         if (sub.componentId === componentId) {
           subs.delete(sub);
@@ -142,6 +168,7 @@ var RoomEventBus = class {
         this.subscriptions.delete(key);
       }
     }
+    this.componentIndex.delete(componentId);
     return removed;
   }
   clearRoom(roomType, roomId) {
@@ -149,7 +176,13 @@ var RoomEventBus = class {
     let removed = 0;
     for (const key of this.subscriptions.keys()) {
       if (key.startsWith(prefix)) {
-        removed += this.subscriptions.get(key)?.size ?? 0;
+        const subs = this.subscriptions.get(key);
+        if (subs) {
+          for (const sub of subs) {
+            this.componentIndex.get(sub.componentId)?.delete(key);
+          }
+          removed += subs.size;
+        }
         this.subscriptions.delete(key);
       }
     }
@@ -172,6 +205,138 @@ var RoomEventBus = class {
   }
 };
 
+// src/protocol/constants.ts
+var PROTOCOL_VERSION = 1;
+var DEFAULT_WS_PATH = "/api/live/ws";
+var DEFAULT_CHUNK_SIZE = 64 * 1024;
+var DEFAULT_RATE_LIMIT_MAX_TOKENS = 100;
+var DEFAULT_RATE_LIMIT_REFILL_RATE = 50;
+var MAX_MESSAGE_SIZE = 100 * 1024 * 1024;
+var MAX_ROOM_STATE_SIZE = 10 * 1024 * 1024;
+var MAX_ROOMS_PER_CONNECTION = 50;
+var ROOM_NAME_REGEX = /^[a-zA-Z0-9_:.-]{1,64}$/;
+var MAX_QUEUE_SIZE = 1e3;
+
+// src/transport/WsSendBatcher.ts
+var wsQueues = /* @__PURE__ */ new WeakMap();
+var scheduledFlushes = /* @__PURE__ */ new WeakSet();
+var pendingWs = [];
+var globalFlushScheduled = false;
+function scheduleWs(ws) {
+  if (!scheduledFlushes.has(ws)) {
+    scheduledFlushes.add(ws);
+    pendingWs.push(ws);
+    if (!globalFlushScheduled) {
+      globalFlushScheduled = true;
+      queueMicrotask(flushAll);
+    }
+  }
+}
+function queueWsMessage(ws, message) {
+  if (!ws || ws.readyState !== 1) return;
+  let queue = wsQueues.get(ws);
+  if (!queue) {
+    queue = [];
+    wsQueues.set(ws, queue);
+  }
+  if (queue.length >= MAX_QUEUE_SIZE) {
+    queue.shift();
+  }
+  queue.push(message);
+  scheduleWs(ws);
+}
+function queuePreSerialized(ws, serialized) {
+  if (!ws || ws.readyState !== 1) return;
+  let queue = wsQueues.get(ws);
+  if (!queue) {
+    queue = [];
+    wsQueues.set(ws, queue);
+  }
+  if (queue.length >= MAX_QUEUE_SIZE) {
+    queue.shift();
+  }
+  queue.push(serialized);
+  scheduleWs(ws);
+}
+function flushAll() {
+  globalFlushScheduled = false;
+  const connections = pendingWs;
+  pendingWs = [];
+  for (const ws of connections) {
+    scheduledFlushes.delete(ws);
+    const queue = wsQueues.get(ws);
+    if (!queue || queue.length === 0) continue;
+    wsQueues.set(ws, []);
+    if (ws.readyState !== 1) continue;
+    try {
+      if (queue.length === 1) {
+        const item = queue[0];
+        if (typeof item === "string") {
+          ws.send(item);
+        } else {
+          ws.send(JSON.stringify(item));
+        }
+      } else {
+        const objects = [];
+        const preSerialized = [];
+        for (const item of queue) {
+          if (typeof item === "string") {
+            preSerialized.push(item);
+          } else {
+            objects.push(item);
+          }
+        }
+        if (objects.length === 0) {
+          ws.send("[" + preSerialized.join(",") + "]");
+        } else if (preSerialized.length === 0) {
+          const deduped = deduplicateDeltas(objects);
+          ws.send(JSON.stringify(deduped));
+        } else {
+          const deduped = deduplicateDeltas(objects);
+          let result = "[";
+          for (let i = 0; i < deduped.length; i++) {
+            if (i > 0) result += ",";
+            result += JSON.stringify(deduped[i]);
+          }
+          for (const ps of preSerialized) {
+            result += "," + ps;
+          }
+          result += "]";
+          ws.send(result);
+        }
+      }
+    } catch {
+    }
+  }
+}
+function deduplicateDeltas(messages) {
+  const deltaIndices = /* @__PURE__ */ new Map();
+  const result = [];
+  for (const msg of messages) {
+    if (msg.type === "STATE_DELTA" && msg.componentId && msg.payload?.delta) {
+      const existing = deltaIndices.get(msg.componentId);
+      if (existing !== void 0) {
+        const target = result[existing];
+        target.payload = {
+          delta: { ...target.payload.delta, ...msg.payload.delta }
+        };
+        target.timestamp = msg.timestamp;
+      } else {
+        deltaIndices.set(msg.componentId, result.length);
+        result.push({ ...msg, payload: { delta: { ...msg.payload.delta } } });
+      }
+    } else {
+      result.push(msg);
+    }
+  }
+  return result;
+}
+function sendImmediate(ws, data) {
+  if (ws && ws.readyState === 1) {
+    ws.send(data);
+  }
+}
+
 // src/debug/LiveLogger.ts
 var componentConfigs = /* @__PURE__ */ new Map();
 var globalConfigParsed = false;
@@ -244,19 +409,18 @@ function liveWarn(category, componentId, message, ...args) {
   }
 }
 
-// src/protocol/constants.ts
-var PROTOCOL_VERSION = 1;
-var DEFAULT_WS_PATH = "/api/live/ws";
-var DEFAULT_CHUNK_SIZE = 64 * 1024;
-var DEFAULT_RATE_LIMIT_MAX_TOKENS = 100;
-var DEFAULT_RATE_LIMIT_REFILL_RATE = 50;
-var MAX_ROOM_STATE_SIZE = 10 * 1024 * 1024;
-
 // src/rooms/LiveRoomManager.ts
 var LiveRoomManager = class {
   // componentId -> roomIds
-  constructor(roomEvents) {
+  /**
+   * @param roomEvents - Local server-side event bus
+   * @param pubsub - Optional cross-instance pub/sub adapter (e.g. Redis).
+   *                 When provided, room events/state/membership are propagated
+   *                 to other server instances in the background.
+   */
+  constructor(roomEvents, pubsub) {
     this.roomEvents = roomEvents;
+    this.pubsub = pubsub;
   }
   rooms = /* @__PURE__ */ new Map();
   componentRooms = /* @__PURE__ */ new Map();
@@ -264,31 +428,36 @@ var LiveRoomManager = class {
    * Component joins a room
    */
   joinRoom(componentId, roomId, ws, initialState) {
-    if (!roomId || !/^[a-zA-Z0-9_:.-]{1,64}$/.test(roomId)) {
+    if (!roomId || !ROOM_NAME_REGEX.test(roomId)) {
       throw new Error("Invalid room name. Must be 1-64 alphanumeric characters, hyphens, underscores, dots, or colons.");
     }
-    if (!this.rooms.has(roomId)) {
-      this.rooms.set(roomId, {
+    const now = Date.now();
+    let room = this.rooms.get(roomId);
+    if (!room) {
+      room = {
         id: roomId,
         state: initialState || {},
         members: /* @__PURE__ */ new Map(),
-        createdAt: Date.now(),
-        lastActivity: Date.now()
-      });
+        createdAt: now,
+        lastActivity: now
+      };
+      this.rooms.set(roomId, room);
       liveLog("rooms", componentId, `Room '${roomId}' created`);
     }
-    const room = this.rooms.get(roomId);
     room.members.set(componentId, {
       componentId,
       ws,
-      joinedAt: Date.now()
+      joinedAt: now
     });
-    room.lastActivity = Date.now();
-    if (!this.componentRooms.has(componentId)) {
-      this.componentRooms.set(componentId, /* @__PURE__ */ new Set());
-    }
-    this.componentRooms.get(componentId).add(roomId);
-    liveLog("rooms", componentId, `Component '${componentId}' joined room '${roomId}' (${room.members.size} members)`);
+    room.lastActivity = now;
+    let compRooms = this.componentRooms.get(componentId);
+    if (!compRooms) {
+      compRooms = /* @__PURE__ */ new Set();
+      this.componentRooms.set(componentId, compRooms);
+    }
+    compRooms.add(roomId);
+    const memberCount = room.members.size;
+    liveLog("rooms", componentId, `Component '${componentId}' joined room '${roomId}' (${memberCount} members)`);
     this.broadcastToRoom(roomId, {
       type: "ROOM_SYSTEM",
       componentId,
@@ -296,10 +465,12 @@ var LiveRoomManager = class {
       event: "$sub:join",
       data: {
         subscriberId: componentId,
-        count: room.members.size
+        count: memberCount
       },
-      timestamp: Date.now()
+      timestamp: now
     }, componentId);
+    this.pubsub?.publishMembership(roomId, "join", componentId)?.catch(() => {
+    });
     return { state: room.state };
   }
   /**
@@ -309,9 +480,11 @@ var LiveRoomManager = class {
     const room = this.rooms.get(roomId);
     if (!room) return;
     room.members.delete(componentId);
-    room.lastActivity = Date.now();
+    const now = Date.now();
+    room.lastActivity = now;
     this.componentRooms.get(componentId)?.delete(roomId);
-    liveLog("rooms", componentId, `Component '${componentId}' left room '${roomId}' (${room.members.size} members)`);
+    const memberCount = room.members.size;
+    liveLog("rooms", componentId, `Component '${componentId}' left room '${roomId}' (${memberCount} members)`);
     this.broadcastToRoom(roomId, {
       type: "ROOM_SYSTEM",
       componentId,
@@ -319,11 +492,13 @@ var LiveRoomManager = class {
       event: "$sub:leave",
       data: {
         subscriberId: componentId,
-        count: room.members.size
+        count: memberCount
       },
-      timestamp: Date.now()
+      timestamp: now
     });
-    if (room.members.size === 0) {
+    this.pubsub?.publishMembership(roomId, "leave", componentId)?.catch(() => {
+    });
+    if (memberCount === 0) {
       setTimeout(() => {
         const currentRoom = this.rooms.get(roomId);
         if (currentRoom && currentRoom.members.size === 0) {
@@ -334,13 +509,44 @@ var LiveRoomManager = class {
     }
   }
   /**
-   * Component disconnects - leave all rooms
+   * Component disconnects - leave all rooms.
+   * Batches removals: removes member from all rooms first,
+   * then sends leave notifications in bulk.
    */
   cleanupComponent(componentId) {
-    const rooms = this.componentRooms.get(componentId);
-    if (!rooms) return;
-    for (const roomId of rooms) {
-      this.leaveRoom(componentId, roomId);
+    const roomIds = this.componentRooms.get(componentId);
+    if (!roomIds || roomIds.size === 0) return;
+    const now = Date.now();
+    const notifications = [];
+    for (const roomId of roomIds) {
+      const room = this.rooms.get(roomId);
+      if (!room) continue;
+      room.members.delete(componentId);
+      room.lastActivity = now;
+      const memberCount = room.members.size;
+      if (memberCount > 0) {
+        notifications.push({ roomId, count: memberCount });
+      } else {
+        setTimeout(() => {
+          const currentRoom = this.rooms.get(roomId);
+          if (currentRoom && currentRoom.members.size === 0) {
+            this.rooms.delete(roomId);
+          }
+        }, 5 * 60 * 1e3);
+      }
+    }
+    for (const { roomId, count } of notifications) {
+      this.broadcastToRoom(roomId, {
+        type: "ROOM_SYSTEM",
+        componentId,
+        roomId,
+        event: "$sub:leave",
+        data: {
+          subscriberId: componentId,
+          count
+        },
+        timestamp: now
+      });
     }
     this.componentRooms.delete(componentId);
   }
@@ -350,37 +556,56 @@ var LiveRoomManager = class {
   emitToRoom(roomId, event, data, excludeComponentId) {
     const room = this.rooms.get(roomId);
     if (!room) return 0;
-    room.lastActivity = Date.now();
+    const now = Date.now();
+    room.lastActivity = now;
     this.roomEvents.emit("room", roomId, event, data, excludeComponentId);
+    this.pubsub?.publish(roomId, event, data)?.catch(() => {
+    });
     return this.broadcastToRoom(roomId, {
       type: "ROOM_EVENT",
       componentId: "",
       roomId,
       event,
       data,
-      timestamp: Date.now()
+      timestamp: now
     }, excludeComponentId);
   }
   /**
-   * Update room state
+   * Update room state.
+   * Mutates state in-place with Object.assign to avoid full-object spread.
    */
   setRoomState(roomId, updates, excludeComponentId) {
     const room = this.rooms.get(roomId);
     if (!room) return;
-    const newState = { ...room.state, ...updates };
-    const stateSize = Buffer.byteLength(JSON.stringify(newState), "utf8");
-    if (stateSize > MAX_ROOM_STATE_SIZE) {
-      throw new Error("Room state exceeds maximum size limit");
+    Object.assign(room.state, updates);
+    if (room.stateSize === void 0) {
+      const fullJson = JSON.stringify(room.state);
+      room.stateSize = fullJson.length;
+      if (room.stateSize > MAX_ROOM_STATE_SIZE) {
+        throw new Error("Room state exceeds maximum size limit");
+      }
+    } else {
+      const deltaSize = JSON.stringify(updates).length;
+      room.stateSize += deltaSize;
+      if (room.stateSize > MAX_ROOM_STATE_SIZE) {
+        const precise = JSON.stringify(room.state).length;
+        room.stateSize = precise;
+        if (precise > MAX_ROOM_STATE_SIZE) {
+          throw new Error("Room state exceeds maximum size limit");
+        }
+      }
     }
-    room.state = newState;
-    room.lastActivity = Date.now();
+    const now = Date.now();
+    room.lastActivity = now;
+    this.pubsub?.publishStateChange(roomId, updates)?.catch(() => {
+    });
     this.broadcastToRoom(roomId, {
       type: "ROOM_STATE",
       componentId: "",
       roomId,
       event: "$state:update",
       data: { state: updates },
-      timestamp: Date.now()
+      timestamp: now
     }, excludeComponentId);
   }
   /**
@@ -390,24 +615,28 @@ var LiveRoomManager = class {
     return this.rooms.get(roomId)?.state || {};
   }
   /**
-   * Broadcast to all members in a room
+   * Broadcast to all members in a room.
+   * Serializes the message ONCE and sends the same string to all members.
    */
   broadcastToRoom(roomId, message, excludeComponentId) {
     const room = this.rooms.get(roomId);
-    if (!room) return 0;
+    if (!room || room.members.size === 0) return 0;
+    const serialized = JSON.stringify(message);
     let sent = 0;
-    for (const [componentId, member] of room.members) {
-      if (excludeComponentId && componentId === excludeComponentId) continue;
-      try {
-        if (member.ws && member.ws.readyState === 1) {
-          member.ws.send(JSON.stringify({
-            ...message,
-            componentId
-          }));
+    if (excludeComponentId) {
+      for (const [componentId, member] of room.members) {
+        if (componentId === excludeComponentId) continue;
+        if (member.ws.readyState === 1) {
+          queuePreSerialized(member.ws, serialized);
+          sent++;
+        }
+      }
+    } else {
+      for (const member of room.members.values()) {
+        if (member.ws.readyState === 1) {
+          queuePreSerialized(member.ws, serialized);
           sent++;
         }
-      } catch (error) {
-        console.error(`Failed to send to ${componentId}:`, error);
       }
     }
     return sent;
@@ -853,15 +1082,21 @@ var LiveAuthManager = class {
         providersToTry.push(provider);
       }
     }
+    const errors = [];
     for (const provider of providersToTry) {
       try {
         const context = await provider.authenticate(credentials);
         if (context && context.authenticated) {
           return context;
         }
-      } catch {
+      } catch (error) {
+        console.warn(`[Auth] Provider '${provider.name}' threw during authentication:`, error.message);
+        errors.push({ provider: provider.name, error });
       }
     }
+    if (errors.length > 0) {
+      console.warn(`[Auth] All ${providersToTry.length} provider(s) failed. Errors: ${errors.map((e) => `${e.provider}: ${e.error.message}`).join("; ")}`);
+    }
     return ANONYMOUS_CONTEXT;
   }
   /**
@@ -959,10 +1194,13 @@ var StateSignatureManager = class {
   secret;
   previousSecrets = [];
   rotationTimer;
-  usedNonces = /* @__PURE__ */ new Set();
-  nonceCleanupTimer;
   stateBackups = /* @__PURE__ */ new Map();
   config;
+  encryptionSalt;
+  cachedEncryptionKey = null;
+  /** Replay detection: nonce → timestamp when it was first seen. Cleaned every 60s. */
+  usedNonces = /* @__PURE__ */ new Map();
+  nonceCleanupTimer;
   constructor(config = {}) {
     const defaultSecret = typeof process !== "undefined" ? process.env?.LIVE_STATE_SECRET : void 0;
     this.config = {
@@ -972,23 +1210,65 @@ var StateSignatureManager = class {
       compressionEnabled: config.compressionEnabled ?? true,
       encryptionEnabled: config.encryptionEnabled ?? false,
       nonceEnabled: config.nonceEnabled ?? false,
-      maxStateAge: config.maxStateAge ?? 7 * 24 * 60 * 60 * 1e3,
+      maxStateAge: config.maxStateAge ?? 30 * 60 * 1e3,
       backupEnabled: config.backupEnabled ?? true,
-      maxBackups: config.maxBackups ?? 3
+      maxBackups: config.maxBackups ?? 3,
+      nonceTTL: config.nonceTTL ?? 5 * 60 * 1e3
     };
     if (!this.config.secret) {
       this.config.secret = randomBytes(32).toString("hex");
       liveWarn("state", null, "No LIVE_STATE_SECRET provided. Using random key (state will not persist across restarts).");
     }
     this.secret = Buffer.from(this.config.secret, "utf-8");
+    this.encryptionSalt = randomBytes(16);
     if (this.config.rotationEnabled) {
       this.setupKeyRotation();
     }
     if (this.config.nonceEnabled) {
-      this.nonceCleanupTimer = setInterval(() => this.cleanupNonces(), 60 * 60 * 1e3);
+      this.nonceCleanupTimer = setInterval(() => this.cleanupNonces(), this.config.nonceTTL + 10 * 1e3);
+    }
+  }
+  /**
+   * Generate a hybrid nonce: `timestamp:random:HMAC(timestamp:random, secret)`
+   * Self-validating via HMAC, unique via random bytes, replay-tracked via Map.
+   */
+  generateNonce() {
+    const ts = Date.now().toString();
+    const rand = randomBytes(8).toString("hex");
+    const payload = `${ts}:${rand}`;
+    const mac = createHmac("sha256", this.secret).update(payload).digest("hex").slice(0, 16);
+    return `${ts}:${rand}:${mac}`;
+  }
+  /**
+   * Validate a hybrid nonce: check format, HMAC, and TTL.
+   */
+  validateNonce(nonce) {
+    const parts = nonce.split(":");
+    if (parts.length !== 3) return { valid: false, error: "Malformed nonce" };
+    const [ts, rand, mac] = parts;
+    const timestamp = Number(ts);
+    if (isNaN(timestamp)) return { valid: false, error: "Malformed nonce timestamp" };
+    const age = Date.now() - timestamp;
+    if (age > this.config.nonceTTL) {
+      return { valid: false, error: "Nonce expired" };
+    }
+    if (age < -3e4) {
+      return { valid: false, error: "Nonce timestamp in the future" };
+    }
+    const payload = `${ts}:${rand}`;
+    const expectedMac = createHmac("sha256", this.secret).update(payload).digest("hex").slice(0, 16);
+    if (this.timingSafeEqual(mac, expectedMac)) {
+      return { valid: true };
+    }
+    for (const prevSecret of this.previousSecrets) {
+      const prevMac = createHmac("sha256", prevSecret).update(payload).digest("hex").slice(0, 16);
+      if (this.timingSafeEqual(mac, prevMac)) {
+        return { valid: true };
+      }
     }
+    return { valid: false, error: "Invalid nonce signature" };
   }
-  async signState(componentId, state, version, options) {
+  signState(componentId, state, version, options) {
     let dataStr = JSON.stringify(state);
     let compressed = false;
     let encrypted = false;
@@ -1009,7 +1289,7 @@ var StateSignatureManager = class {
       dataStr = iv.toString("base64") + ":" + encryptedData;
       encrypted = true;
     }
-    const nonce = this.config.nonceEnabled ? randomBytes(16).toString("hex") : void 0;
+    const nonce = this.config.nonceEnabled ? this.generateNonce() : void 0;
     const signedState = {
       data: dataStr,
       signature: "",
@@ -1026,26 +1306,34 @@ var StateSignatureManager = class {
     }
     return signedState;
   }
-  async validateState(signedState) {
+  validateState(signedState, options) {
     try {
       const age = Date.now() - signedState.timestamp;
       if (age > this.config.maxStateAge) {
         return { valid: false, error: "State expired" };
       }
-      if (signedState.nonce && this.config.nonceEnabled) {
+      if (signedState.nonce && this.config.nonceEnabled && !options?.skipNonce) {
+        const nonceResult = this.validateNonce(signedState.nonce);
+        if (!nonceResult.valid) {
+          return { valid: false, error: nonceResult.error };
+        }
         if (this.usedNonces.has(signedState.nonce)) {
-          return { valid: false, error: "Nonce already used (replay attempt)" };
+          return { valid: false, error: "Nonce already used" };
         }
       }
       const expectedSig = this.computeSignature(signedState);
       if (this.timingSafeEqual(signedState.signature, expectedSig)) {
-        if (signedState.nonce) this.usedNonces.add(signedState.nonce);
+        if (signedState.nonce && this.config.nonceEnabled) {
+          this.usedNonces.set(signedState.nonce, Date.now());
+        }
         return { valid: true };
       }
       for (const prevSecret of this.previousSecrets) {
         const prevSig = this.computeSignatureWithKey(signedState, prevSecret);
         if (this.timingSafeEqual(signedState.signature, prevSig)) {
-          if (signedState.nonce) this.usedNonces.add(signedState.nonce);
+          if (signedState.nonce && this.config.nonceEnabled) {
+            this.usedNonces.set(signedState.nonce, Date.now());
+          }
           return { valid: true };
         }
       }
@@ -1054,7 +1342,7 @@ var StateSignatureManager = class {
       return { valid: false, error: error.message };
     }
   }
-  async extractData(signedState) {
+  extractData(signedState) {
     let dataStr = signedState.data;
     if (signedState.encrypted) {
       const [ivB64, encryptedData] = dataStr.split(":");
@@ -1107,7 +1395,9 @@ var StateSignatureManager = class {
     }
   }
   deriveEncryptionKey() {
-    return createHmac("sha256", this.secret).update("encryption-key-derivation").digest();
+    if (this.cachedEncryptionKey) return this.cachedEncryptionKey;
+    this.cachedEncryptionKey = scryptSync(this.secret, this.encryptionSalt, 32);
+    return this.cachedEncryptionKey;
   }
   setupKeyRotation() {
     this.rotationTimer = setInterval(() => {
@@ -1116,12 +1406,15 @@ var StateSignatureManager = class {
         this.previousSecrets.pop();
       }
       this.secret = randomBytes(32);
+      this.cachedEncryptionKey = null;
       liveLog("state", null, "Key rotation completed");
     }, this.config.rotationInterval);
   }
+  /** Remove nonces older than nonceTTL + 10s from the replay detection map. */
   cleanupNonces() {
-    if (this.usedNonces.size > 1e5) {
-      this.usedNonces.clear();
+    const cutoff = Date.now() - (this.config.nonceTTL + 10 * 1e3);
+    for (const [nonce, ts] of this.usedNonces) {
+      if (ts < cutoff) this.usedNonces.delete(nonce);
     }
   }
   shutdown() {
@@ -1542,6 +1835,8 @@ var WebSocketConnectionManager = class extends EventEmitter {
   connections = /* @__PURE__ */ new Map();
   connectionMetrics = /* @__PURE__ */ new Map();
   connectionPools = /* @__PURE__ */ new Map();
+  /** Reverse index: connectionId -> Set of poolIds for O(1) cleanup */
+  connectionPoolIndex = /* @__PURE__ */ new Map();
   messageQueues = /* @__PURE__ */ new Map();
   healthCheckTimer;
   heartbeatTimer;
@@ -1596,6 +1891,10 @@ var WebSocketConnectionManager = class extends EventEmitter {
       this.connectionPools.set(poolId, /* @__PURE__ */ new Set());
     }
     this.connectionPools.get(poolId).add(connectionId);
+    if (!this.connectionPoolIndex.has(connectionId)) {
+      this.connectionPoolIndex.set(connectionId, /* @__PURE__ */ new Set());
+    }
+    this.connectionPoolIndex.get(connectionId).add(poolId);
   }
   removeFromPool(connectionId, poolId) {
     const pool = this.connectionPools.get(poolId);
@@ -1603,15 +1902,22 @@ var WebSocketConnectionManager = class extends EventEmitter {
       pool.delete(connectionId);
       if (pool.size === 0) this.connectionPools.delete(poolId);
     }
+    this.connectionPoolIndex.get(connectionId)?.delete(poolId);
   }
   cleanupConnection(connectionId) {
     this.connections.delete(connectionId);
     this.connectionMetrics.delete(connectionId);
     this.messageQueues.delete(connectionId);
-    for (const [poolId, pool] of this.connectionPools) {
-      if (pool.has(connectionId)) {
-        this.removeFromPool(connectionId, poolId);
+    const poolIds = this.connectionPoolIndex.get(connectionId);
+    if (poolIds) {
+      for (const poolId of poolIds) {
+        const pool = this.connectionPools.get(poolId);
+        if (pool) {
+          pool.delete(connectionId);
+          if (pool.size === 0) this.connectionPools.delete(poolId);
+        }
       }
+      this.connectionPoolIndex.delete(connectionId);
     }
   }
   getConnectionMetrics(connectionId) {
@@ -1693,6 +1999,7 @@ var WebSocketConnectionManager = class extends EventEmitter {
     this.connections.clear();
     this.connectionMetrics.clear();
     this.connectionPools.clear();
+    this.connectionPoolIndex.clear();
     this.messageQueues.clear();
   }
 };
@@ -1707,116 +2014,37 @@ function getLiveComponentContext() {
   return _ctx;
 }
 
-// src/component/LiveComponent.ts
-var EMIT_OVERRIDE_KEY = /* @__PURE__ */ Symbol.for("fluxstack:emitOverride");
-var _liveDebugger = null;
-function _setLiveDebugger(dbg) {
-  _liveDebugger = dbg;
-}
-var LiveComponent = class _LiveComponent {
-  /** Component name for registry lookup - must be defined in subclasses */
-  static componentName;
-  /** Default state - must be defined in subclasses */
-  static defaultState;
-  /**
-   * Per-component logging control. Silent by default.
-   *
-   * @example
-   * static logging = true                           // all categories
-   * static logging = ['lifecycle', 'messages']      // specific categories
-   */
-  static logging;
-  /**
-   * Component-level auth configuration.
-   */
-  static auth;
-  /**
-   * Per-action auth configuration.
-   */
-  static actionAuth;
-  /**
-   * Data that survives HMR reloads.
-   */
-  static persistent;
-  /**
-   * When true, only ONE server-side instance exists for this component.
-   * All clients share the same state.
-   */
-  static singleton;
-  id;
+// src/component/managers/ComponentStateManager.ts
+var _forbiddenSetCache = /* @__PURE__ */ new WeakMap();
+var ComponentStateManager = class {
   _state;
-  state;
-  // Proxy wrapper
-  ws;
-  room;
-  userId;
-  broadcastToRoom = () => {
-  };
-  // Server-only private state (NEVER sent to client)
-  _privateState = {};
-  // Auth context (injected by registry during mount)
-  _authContext = ANONYMOUS_CONTEXT;
-  // Room event subscriptions (cleaned up on destroy)
-  roomEventUnsubscribers = [];
-  joinedRooms = /* @__PURE__ */ new Set();
-  // Room type for typed events (override in subclass)
-  roomType = "default";
-  // Cached room handles
-  roomHandles = /* @__PURE__ */ new Map();
-  // Guard against infinite recursion in onStateChange
+  _proxyState;
   _inStateChange = false;
-  // Singleton emit override
-  [EMIT_OVERRIDE_KEY] = null;
-  constructor(initialState, ws, options) {
-    this.id = this.generateId();
-    const ctor = this.constructor;
-    this._state = { ...ctor.defaultState, ...initialState };
-    this.state = this.createStateProxy(this._state);
-    this.ws = ws;
-    this.room = options?.room;
-    this.userId = options?.userId;
-    if (this.room) {
-      this.joinedRooms.add(this.room);
-      const ctx = getLiveComponentContext();
-      ctx.roomManager.joinRoom(this.id, this.room, this.ws);
-    }
-    this.createDirectStateAccessors();
-  }
-  // Create getters/setters for each state property directly on `this`
-  createDirectStateAccessors() {
-    const forbidden = /* @__PURE__ */ new Set([
-      ...Object.keys(this),
-      ...Object.getOwnPropertyNames(Object.getPrototypeOf(this)),
-      "state",
-      "_state",
-      "ws",
-      "id",
-      "room",
-      "userId",
-      "broadcastToRoom",
-      "$private",
-      "_privateState",
-      "$room",
-      "$rooms",
-      "roomType",
-      "roomHandles",
-      "joinedRooms",
-      "roomEventUnsubscribers"
-    ]);
-    for (const key of Object.keys(this._state)) {
-      if (!forbidden.has(key)) {
-        Object.defineProperty(this, key, {
-          get: () => this._state[key],
-          set: (value) => {
-            this.state[key] = value;
-          },
-          enumerable: true,
-          configurable: true
-        });
-      }
-    }
+  _idBytes = null;
+  componentId;
+  ws;
+  emitFn;
+  onStateChangeFn;
+  _debugger;
+  constructor(opts) {
+    this.componentId = opts.componentId;
+    this.ws = opts.ws;
+    this.emitFn = opts.emitFn;
+    this.onStateChangeFn = opts.onStateChangeFn;
+    this._debugger = opts.debugger ?? null;
+    this._state = opts.initialState;
+    this._proxyState = this.createStateProxy(this._state);
+  }
+  get rawState() {
+    return this._state;
+  }
+  get proxyState() {
+    return this._proxyState;
+  }
+  /** Guard flag — prevents infinite recursion in onStateChange */
+  get inStateChange() {
+    return this._inStateChange;
   }
-  // Create a Proxy that auto-emits STATE_DELTA on any mutation
   createStateProxy(state) {
     const self = this;
     return new Proxy(state, {
@@ -1825,19 +2053,19 @@ var LiveComponent = class _LiveComponent {
         if (oldValue !== value) {
           target[prop] = value;
           const changes = { [prop]: value };
-          self.emit("STATE_DELTA", { delta: changes });
+          self.emitFn("STATE_DELTA", { delta: changes });
           if (!self._inStateChange) {
             self._inStateChange = true;
             try {
-              self.onStateChange(changes);
+              self.onStateChangeFn(changes);
             } catch (err) {
-              console.error(`[${self.id}] onStateChange error:`, err?.message || err);
+              console.error(`[${self.componentId}] onStateChange error:`, err?.message || err);
             } finally {
               self._inStateChange = false;
             }
           }
-          _liveDebugger?.trackStateChange(
-            self.id,
+          self._debugger?.trackStateChange(
+            self.componentId,
             changes,
             target,
             "proxy"
@@ -1850,65 +2078,368 @@ var LiveComponent = class _LiveComponent {
       }
     });
   }
-  // ========================================
-  // $private - Server-Only State
-  // ========================================
-  get $private() {
-    return this._privateState;
+  setState(updates) {
+    const newUpdates = typeof updates === "function" ? updates(this._state) : updates;
+    const actualChanges = {};
+    let hasChanges = false;
+    for (const key of Object.keys(newUpdates)) {
+      if (this._state[key] !== newUpdates[key]) {
+        actualChanges[key] = newUpdates[key];
+        hasChanges = true;
+      }
+    }
+    if (!hasChanges) return;
+    Object.assign(this._state, actualChanges);
+    this.emitFn("STATE_DELTA", { delta: actualChanges });
+    if (!this._inStateChange) {
+      this._inStateChange = true;
+      try {
+        this.onStateChangeFn(actualChanges);
+      } catch (err) {
+        console.error(`[${this.componentId}] onStateChange error:`, err?.message || err);
+      } finally {
+        this._inStateChange = false;
+      }
+    }
+    this._debugger?.trackStateChange(
+      this.componentId,
+      actualChanges,
+      this._state,
+      "setState"
+    );
   }
-  // ========================================
-  // $room - Unified Room System
-  // ========================================
-  get $room() {
-    const self = this;
-    const ctx = getLiveComponentContext();
-    const createHandle = (roomId) => {
-      if (this.roomHandles.has(roomId)) {
-        return this.roomHandles.get(roomId);
+  sendBinaryDelta(delta, encoder) {
+    const actualChanges = {};
+    let hasChanges = false;
+    for (const key of Object.keys(delta)) {
+      if (this._state[key] !== delta[key]) {
+        actualChanges[key] = delta[key];
+        hasChanges = true;
       }
-      const handle = {
-        get id() {
-          return roomId;
-        },
-        get state() {
-          return ctx.roomManager.getRoomState(roomId);
-        },
-        join: (initialState) => {
-          if (self.joinedRooms.has(roomId)) return;
-          self.joinedRooms.add(roomId);
-          ctx.roomManager.joinRoom(self.id, roomId, self.ws, initialState);
-          try {
-            self.onRoomJoin(roomId);
-          } catch (err) {
-            console.error(`[${self.id}] onRoomJoin error:`, err?.message || err);
-          }
-        },
-        leave: () => {
-          if (!self.joinedRooms.has(roomId)) return;
-          self.joinedRooms.delete(roomId);
-          ctx.roomManager.leaveRoom(self.id, roomId);
-          try {
-            self.onRoomLeave(roomId);
-          } catch (err) {
-            console.error(`[${self.id}] onRoomLeave error:`, err?.message || err);
-          }
-        },
-        emit: (event, data) => {
-          return ctx.roomManager.emitToRoom(roomId, event, data, self.id);
-        },
-        on: (event, handler) => {
-          const unsubscribe = ctx.roomEvents.on(
-            "room",
-            roomId,
-            event,
-            self.id,
-            handler
-          );
-          self.roomEventUnsubscribers.push(unsubscribe);
-          return unsubscribe;
+    }
+    if (!hasChanges) return;
+    Object.assign(this._state, actualChanges);
+    const payload = encoder(actualChanges);
+    if (!this._idBytes) {
+      this._idBytes = new TextEncoder().encode(this.componentId);
+    }
+    const idBytes = this._idBytes;
+    const frame = new Uint8Array(1 + 1 + idBytes.length + payload.length);
+    frame[0] = 1;
+    frame[1] = idBytes.length;
+    frame.set(idBytes, 2);
+    frame.set(payload, 2 + idBytes.length);
+    if (this.ws && this.ws.readyState === 1) {
+      this.ws.send(frame);
+    }
+  }
+  setValue(payload) {
+    const { key, value } = payload;
+    const update = { [key]: value };
+    this.setState(update);
+    return { success: true, key, value };
+  }
+  getSerializableState() {
+    return this._proxyState;
+  }
+  /**
+   * Create getters/setters for each state property directly on `target`.
+   * This allows `this.count` instead of `this.state.count` in subclasses.
+   */
+  applyDirectAccessors(target, constructorFn) {
+    let forbidden = _forbiddenSetCache.get(constructorFn);
+    if (!forbidden) {
+      forbidden = /* @__PURE__ */ new Set([
+        ...Object.keys(target),
+        ...Object.getOwnPropertyNames(Object.getPrototypeOf(target)),
+        "state",
+        "_state",
+        "ws",
+        "id",
+        "room",
+        "userId",
+        "broadcastToRoom",
+        "$private",
+        "_privateState",
+        "$room",
+        "$rooms",
+        "roomType",
+        "roomHandles",
+        "joinedRooms",
+        "roomEventUnsubscribers",
+        // Internal manager fields
+        "_stateManager",
+        "_roomProxyManager",
+        "_actionSecurity",
+        "_messaging"
+      ]);
+      _forbiddenSetCache.set(constructorFn, forbidden);
+    }
+    for (const key of Object.keys(this._state)) {
+      if (!forbidden.has(key)) {
+        Object.defineProperty(target, key, {
+          get: () => this._state[key],
+          set: (value) => {
+            this._proxyState[key] = value;
+          },
+          enumerable: true,
+          configurable: true
+        });
+      }
+    }
+  }
+  /** Release cached resources */
+  cleanup() {
+    this._idBytes = null;
+  }
+};
+
+// src/component/managers/ComponentMessaging.ts
+var EMIT_OVERRIDE_KEY = /* @__PURE__ */ Symbol.for("fluxstack:emitOverride");
+var ComponentMessaging = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  emit(type, payload) {
+    const override = this.ctx.getEmitOverride();
+    if (override) {
+      override(type, payload);
+      return;
+    }
+    const message = {
+      type,
+      componentId: this.ctx.componentId,
+      payload,
+      timestamp: Date.now(),
+      userId: this.ctx.getUserId(),
+      room: this.ctx.getRoom()
+    };
+    if (this.ctx.ws) {
+      queueWsMessage(this.ctx.ws, message);
+    }
+  }
+  broadcast(type, payload, excludeCurrentUser = false) {
+    const room = this.ctx.getRoom();
+    if (!room) {
+      liveWarn("rooms", this.ctx.componentId, `[${this.ctx.componentId}] Cannot broadcast '${type}' - no room set`);
+      return;
+    }
+    const message = {
+      type,
+      payload,
+      room,
+      excludeUser: excludeCurrentUser ? this.ctx.getUserId() : void 0
+    };
+    liveLog("rooms", this.ctx.componentId, `[${this.ctx.componentId}] Broadcasting '${type}' to room '${room}'`);
+    this.ctx.getBroadcastToRoom()(message);
+  }
+};
+
+// src/component/managers/ActionSecurityManager.ts
+var BLOCKED_ACTIONS = /* @__PURE__ */ new Set([
+  "constructor",
+  "destroy",
+  "executeAction",
+  "getSerializableState",
+  "onMount",
+  "onDestroy",
+  "onConnect",
+  "onDisconnect",
+  "onStateChange",
+  "onRoomJoin",
+  "onRoomLeave",
+  "onRehydrate",
+  "onAction",
+  "onClientJoin",
+  "onClientLeave",
+  "setState",
+  "sendBinaryDelta",
+  "emit",
+  "broadcast",
+  "broadcastToRoom",
+  "createStateProxy",
+  "createDirectStateAccessors",
+  "generateId",
+  "setAuthContext",
+  "_resetAuthContext",
+  "$auth",
+  "$private",
+  "_privateState",
+  "$persistent",
+  "_inStateChange",
+  "$room",
+  "$rooms",
+  "subscribeToRoom",
+  "unsubscribeFromRoom",
+  "emitRoomEvent",
+  "onRoomEvent",
+  "emitRoomEventWithState"
+]);
+var ActionSecurityManager = class {
+  _actionCalls = /* @__PURE__ */ new Map();
+  async validateAndExecute(action, payload, ctx) {
+    const actionStart = Date.now();
+    const { component, componentClass, componentId } = ctx;
+    try {
+      if (BLOCKED_ACTIONS.has(action)) {
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      if (action.startsWith("_") || action.startsWith("#")) {
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      const publicActions = componentClass.publicActions;
+      if (!publicActions) {
+        console.warn(`[SECURITY] Component '${componentClass.componentName || componentClass.name}' has no publicActions defined. All remote actions are blocked.`);
+        throw new Error(`Action '${action}' is not callable - component has no publicActions defined`);
+      }
+      if (!publicActions.includes(action)) {
+        const methodExists = typeof component[action] === "function";
+        if (methodExists) {
+          const name = componentClass.componentName || componentClass.name;
+          throw new Error(
+            `Action '${action}' exists on '${name}' but is not listed in publicActions. Add it to: static publicActions = [..., '${action}']`
+          );
+        }
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      const method = component[action];
+      if (typeof method !== "function") {
+        throw new Error(`Action '${action}' not found on component`);
+      }
+      if (Object.prototype.hasOwnProperty.call(Object.prototype, action)) {
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      const rateLimit = componentClass.actionRateLimit;
+      if (rateLimit) {
+        const now = Date.now();
+        const key = rateLimit.perAction ? action : "*";
+        let entry = this._actionCalls.get(key);
+        if (!entry || now - entry.windowStart >= rateLimit.windowMs) {
+          entry = { count: 0, windowStart: now };
+          this._actionCalls.set(key, entry);
+        }
+        entry.count++;
+        if (entry.count > rateLimit.maxCalls) {
+          throw new Error(`Action rate limit exceeded (max ${rateLimit.maxCalls} calls per ${rateLimit.windowMs}ms)`);
+        }
+      }
+      const schemas = componentClass.actionSchemas;
+      if (schemas && schemas[action]) {
+        const result2 = schemas[action].safeParse(payload);
+        if (!result2.success) {
+          const errorMsg = result2.error?.message || result2.error?.issues?.map((i) => i.message).join(", ") || "Invalid payload";
+          throw new Error(`Action '${action}' payload validation failed: ${errorMsg}`);
+        }
+        payload = result2.data ?? payload;
+      }
+      ctx.debugger?.trackActionCall(componentId, action, payload);
+      let hookResult;
+      try {
+        hookResult = await component.onAction(action, payload);
+      } catch (hookError) {
+        ctx.debugger?.trackActionError(componentId, action, hookError.message, Date.now() - actionStart);
+        ctx.emitFn("ERROR", {
+          action,
+          error: `Action '${action}' failed pre-validation`
+        });
+        throw hookError;
+      }
+      if (hookResult === false) {
+        ctx.debugger?.trackActionError(componentId, action, "Action cancelled", Date.now() - actionStart);
+        throw new Error(`Action '${action}' was cancelled`);
+      }
+      const result = await method.call(component, payload);
+      ctx.debugger?.trackActionResult(componentId, action, result, Date.now() - actionStart);
+      return result;
+    } catch (error) {
+      if (!error.message?.includes("was cancelled") && !error.message?.includes("pre-validation")) {
+        ctx.debugger?.trackActionError(componentId, action, error.message, Date.now() - actionStart);
+        ctx.emitFn("ERROR", {
+          action,
+          error: error.message
+        });
+      }
+      throw error;
+    }
+  }
+};
+
+// src/component/managers/ComponentRoomProxy.ts
+var ComponentRoomProxy = class {
+  roomEventUnsubscribers = [];
+  joinedRooms = /* @__PURE__ */ new Set();
+  roomHandles = /* @__PURE__ */ new Map();
+  _roomProxy = null;
+  _roomsCache = null;
+  _cachedCtx = null;
+  roomType = "default";
+  room;
+  componentId;
+  ws;
+  getCtx;
+  _debugger;
+  setStateFn;
+  constructor(rctx) {
+    this.componentId = rctx.componentId;
+    this.ws = rctx.ws;
+    this.room = rctx.defaultRoom;
+    this.getCtx = rctx.getCtx;
+    this._debugger = rctx.debugger ?? null;
+    this.setStateFn = rctx.setStateFn;
+    if (this.room) {
+      this.joinedRooms.add(this.room);
+      this.ctx.roomManager.joinRoom(this.componentId, this.room, this.ws);
+    }
+  }
+  /** Lazy context resolution — cached after first access */
+  get ctx() {
+    if (!this._cachedCtx) {
+      this._cachedCtx = this.getCtx();
+    }
+    return this._cachedCtx;
+  }
+  get $room() {
+    if (this._roomProxy) return this._roomProxy;
+    const self = this;
+    const createHandle = (roomId) => {
+      if (this.roomHandles.has(roomId)) {
+        return this.roomHandles.get(roomId);
+      }
+      const handle = {
+        get id() {
+          return roomId;
+        },
+        get state() {
+          return self.ctx.roomManager.getRoomState(roomId);
+        },
+        join: (initialState) => {
+          if (self.joinedRooms.has(roomId)) return;
+          self.joinedRooms.add(roomId);
+          self._roomsCache = null;
+          self.ctx.roomManager.joinRoom(self.componentId, roomId, self.ws, initialState);
+        },
+        leave: () => {
+          if (!self.joinedRooms.has(roomId)) return;
+          self.joinedRooms.delete(roomId);
+          self._roomsCache = null;
+          self.ctx.roomManager.leaveRoom(self.componentId, roomId);
+        },
+        emit: (event, data) => {
+          return self.ctx.roomManager.emitToRoom(roomId, event, data, self.componentId);
+        },
+        on: (event, handler) => {
+          const unsubscribe = self.ctx.roomEvents.on(
+            "room",
+            roomId,
+            event,
+            self.componentId,
+            handler
+          );
+          self.roomEventUnsubscribers.push(unsubscribe);
+          return unsubscribe;
         },
         setState: (updates) => {
-          ctx.roomManager.setRoomState(roomId, updates, self.id);
+          self.ctx.roomManager.setRoomState(roomId, updates, self.componentId);
         }
       };
       this.roomHandles.set(roomId, handle);
@@ -1950,13 +2481,199 @@ var LiveComponent = class _LiveComponent {
         }
       }
     });
+    this._roomProxy = proxyFn;
     return proxyFn;
   }
+  get $rooms() {
+    if (this._roomsCache) return this._roomsCache;
+    this._roomsCache = Array.from(this.joinedRooms);
+    return this._roomsCache;
+  }
+  getJoinedRooms() {
+    return this.joinedRooms;
+  }
+  emitRoomEvent(event, data, notifySelf = false) {
+    if (!this.room) {
+      liveWarn("rooms", this.componentId, `[${this.componentId}] Cannot emit room event '${event}' - no room set`);
+      return 0;
+    }
+    const excludeId = notifySelf ? void 0 : this.componentId;
+    const notified = this.ctx.roomEvents.emit(this.roomType, this.room, event, data, excludeId);
+    liveLog("rooms", this.componentId, `[${this.componentId}] Room event '${event}' -> ${notified} components`);
+    this._debugger?.trackRoomEmit(this.componentId, this.room, event, data);
+    return notified;
+  }
+  onRoomEvent(event, handler) {
+    if (!this.room) {
+      liveWarn("rooms", this.componentId, `[${this.componentId}] Cannot subscribe to room event '${event}' - no room set`);
+      return;
+    }
+    const unsubscribe = this.ctx.roomEvents.on(
+      this.roomType,
+      this.room,
+      event,
+      this.componentId,
+      handler
+    );
+    this.roomEventUnsubscribers.push(unsubscribe);
+    liveLog("rooms", this.componentId, `[${this.componentId}] Subscribed to room event '${event}'`);
+  }
+  emitRoomEventWithState(event, data, stateUpdates) {
+    this.setStateFn(stateUpdates);
+    return this.emitRoomEvent(event, data, false);
+  }
+  subscribeToRoom(roomId) {
+    this.room = roomId;
+  }
+  unsubscribeFromRoom() {
+    this.room = void 0;
+  }
+  destroy() {
+    for (const unsubscribe of this.roomEventUnsubscribers) {
+      unsubscribe();
+    }
+    this.roomEventUnsubscribers = [];
+    if (this.joinedRooms.size > 0 && this._cachedCtx) {
+      for (const roomId of this.joinedRooms) {
+        this._cachedCtx.roomManager.leaveRoom(this.componentId, roomId);
+      }
+    }
+    this.joinedRooms.clear();
+    this.roomHandles.clear();
+    this._roomProxy = null;
+    this._roomsCache = null;
+  }
+};
+
+// src/component/LiveComponent.ts
+var _liveDebugger = null;
+function _setLiveDebugger(dbg) {
+  _liveDebugger = dbg;
+}
+var LiveComponent = class {
+  /** Component name for registry lookup - must be defined in subclasses */
+  static componentName;
+  /** Default state - must be defined in subclasses */
+  static defaultState;
+  /**
+   * Per-component logging control. Silent by default.
+   *
+   * @example
+   * static logging = true                           // all categories
+   * static logging = ['lifecycle', 'messages']      // specific categories
+   */
+  static logging;
+  /**
+   * Component-level auth configuration.
+   */
+  static auth;
+  /**
+   * Per-action auth configuration.
+   */
+  static actionAuth;
   /**
-   * List of room IDs this component is participating in
+   * Zod schemas for action payload validation.
+   * When defined, payloads are validated before the action method is called.
+   *
+   * @example
+   * static actionSchemas = {
+   *   sendMessage: z.object({ text: z.string().max(500) }),
+   *   updatePosition: z.object({ x: z.number(), y: z.number() }),
+   * }
+   */
+  static actionSchemas;
+  /**
+   * Rate limit for action execution.
+   * Prevents clients from spamming expensive operations.
+   *
+   * @example
+   * static actionRateLimit = { maxCalls: 10, windowMs: 1000, perAction: true }
+   */
+  static actionRateLimit;
+  /**
+   * Data that survives HMR reloads.
+   */
+  static persistent;
+  /**
+   * When true, only ONE server-side instance exists for this component.
+   * All clients share the same state.
+   */
+  static singleton;
+  id;
+  state;
+  // Proxy wrapper (getter delegates to _stateManager)
+  ws;
+  room;
+  userId;
+  broadcastToRoom = () => {
+  };
+  // Server-only private state (NEVER sent to client)
+  _privateState = {};
+  // Auth context (injected by registry during mount, immutable after first set)
+  _authContext = ANONYMOUS_CONTEXT;
+  _authContextSet = false;
+  // Room type for typed events (override in subclass)
+  roomType = "default";
+  // Singleton emit override
+  [EMIT_OVERRIDE_KEY] = null;
+  // ===== Internal Managers (composition) =====
+  _stateManager;
+  _messaging;
+  _actionSecurity;
+  _roomProxyManager;
+  static publicActions;
+  constructor(initialState, ws, options) {
+    this.id = this.generateId();
+    const ctor = this.constructor;
+    this.ws = ws;
+    this.room = options?.room;
+    this.userId = options?.userId;
+    this._messaging = new ComponentMessaging({
+      componentId: this.id,
+      ws: this.ws,
+      getUserId: () => this.userId,
+      getRoom: () => this.room,
+      getBroadcastToRoom: () => this.broadcastToRoom,
+      getEmitOverride: () => this[EMIT_OVERRIDE_KEY]
+    });
+    this._stateManager = new ComponentStateManager({
+      componentId: this.id,
+      initialState: { ...ctor.defaultState, ...initialState },
+      ws: this.ws,
+      emitFn: (type, payload) => this._messaging.emit(type, payload),
+      onStateChangeFn: (changes) => this.onStateChange(changes),
+      debugger: _liveDebugger
+    });
+    this.state = this._stateManager.proxyState;
+    this._actionSecurity = new ActionSecurityManager();
+    this._roomProxyManager = new ComponentRoomProxy({
+      componentId: this.id,
+      ws: this.ws,
+      defaultRoom: this.room,
+      getCtx: () => getLiveComponentContext(),
+      debugger: _liveDebugger,
+      setStateFn: (updates) => this.setState(updates)
+    });
+    this._stateManager.applyDirectAccessors(this, this.constructor);
+  }
+  // ========================================
+  // $private - Server-Only State
+  // ========================================
+  get $private() {
+    return this._privateState;
+  }
+  // ========================================
+  // $room - Unified Room System
+  // ========================================
+  get $room() {
+    return this._roomProxyManager.$room;
+  }
+  /**
+   * List of room IDs this component is participating in.
+   * Cached — invalidated on join/leave.
    */
   get $rooms() {
-    return Array.from(this.joinedRooms);
+    return this._roomProxyManager.$rooms;
   }
   // ========================================
   // $auth - Authentication Context
@@ -1964,13 +2681,22 @@ var LiveComponent = class _LiveComponent {
   get $auth() {
     return this._authContext;
   }
-  /** @internal */
+  /** @internal - Immutable after first set to prevent privilege escalation */
   setAuthContext(context) {
+    if (this._authContextSet) {
+      throw new Error("Auth context is immutable after initial set");
+    }
     this._authContext = context;
+    this._authContextSet = true;
     if (context.authenticated && context.user?.id && !this.userId) {
       this.userId = context.user.id;
     }
   }
+  /** @internal - Reset auth context (for registry use in reconnection) */
+  _resetAuthContext() {
+    this._authContextSet = false;
+    this._authContext = ANONYMOUS_CONTEXT;
+  }
   // ========================================
   // $persistent - HMR-Safe State
   // ========================================
@@ -2009,221 +2735,62 @@ var LiveComponent = class _LiveComponent {
   onClientLeave(connectionId, connectionCount) {
   }
   // ========================================
-  // State Management
+  // State Management (delegates to _stateManager)
   // ========================================
   setState(updates) {
-    const newUpdates = typeof updates === "function" ? updates(this._state) : updates;
-    const actualChanges = {};
-    let hasChanges = false;
-    for (const key of Object.keys(newUpdates)) {
-      if (this._state[key] !== newUpdates[key]) {
-        actualChanges[key] = newUpdates[key];
-        hasChanges = true;
-      }
-    }
-    if (!hasChanges) return;
-    Object.assign(this._state, actualChanges);
-    this.emit("STATE_DELTA", { delta: actualChanges });
-    if (!this._inStateChange) {
-      this._inStateChange = true;
-      try {
-        this.onStateChange(actualChanges);
-      } catch (err) {
-        console.error(`[${this.id}] onStateChange error:`, err?.message || err);
-      } finally {
-        this._inStateChange = false;
-      }
-    }
-    _liveDebugger?.trackStateChange(
-      this.id,
-      actualChanges,
-      this._state,
-      "setState"
-    );
+    this._stateManager.setState(updates);
   }
-  async setValue(payload) {
-    const { key, value } = payload;
-    const update = { [key]: value };
-    this.setState(update);
-    return { success: true, key, value };
+  /**
+   * Send a binary-encoded state delta directly over WebSocket.
+   * Updates internal state (same as setState) then sends the encoder's output
+   * as a binary frame: [0x01][idLen:u8][id_bytes:utf8][payload_bytes].
+   * Bypasses the JSON batcher — ideal for high-frequency updates.
+   */
+  sendBinaryDelta(delta, encoder) {
+    this._stateManager.sendBinaryDelta(delta, encoder);
+  }
+  setValue(payload) {
+    return this._stateManager.setValue(payload);
   }
   // ========================================
-  // Action Security
+  // Action Execution (delegates to _actionSecurity)
   // ========================================
-  static publicActions;
-  static BLOCKED_ACTIONS = /* @__PURE__ */ new Set([
-    "constructor",
-    "destroy",
-    "executeAction",
-    "getSerializableState",
-    "onMount",
-    "onDestroy",
-    "onConnect",
-    "onDisconnect",
-    "onStateChange",
-    "onRoomJoin",
-    "onRoomLeave",
-    "onRehydrate",
-    "onAction",
-    "onClientJoin",
-    "onClientLeave",
-    "setState",
-    "emit",
-    "broadcast",
-    "broadcastToRoom",
-    "createStateProxy",
-    "createDirectStateAccessors",
-    "generateId",
-    "setAuthContext",
-    "$auth",
-    "$private",
-    "_privateState",
-    "$persistent",
-    "_inStateChange",
-    "$room",
-    "$rooms",
-    "subscribeToRoom",
-    "unsubscribeFromRoom",
-    "emitRoomEvent",
-    "onRoomEvent",
-    "emitRoomEventWithState"
-  ]);
   async executeAction(action, payload) {
-    const actionStart = Date.now();
-    try {
-      if (_LiveComponent.BLOCKED_ACTIONS.has(action)) {
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      if (action.startsWith("_") || action.startsWith("#")) {
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      const componentClass = this.constructor;
-      const publicActions = componentClass.publicActions;
-      if (!publicActions) {
-        console.warn(`[SECURITY] Component '${componentClass.componentName || componentClass.name}' has no publicActions defined. All remote actions are blocked.`);
-        throw new Error(`Action '${action}' is not callable - component has no publicActions defined`);
-      }
-      if (!publicActions.includes(action)) {
-        const methodExists = typeof this[action] === "function";
-        if (methodExists) {
-          const name = componentClass.componentName || componentClass.name;
-          throw new Error(
-            `Action '${action}' exists on '${name}' but is not listed in publicActions. Add it to: static publicActions = [..., '${action}']`
-          );
-        }
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      const method = this[action];
-      if (typeof method !== "function") {
-        throw new Error(`Action '${action}' not found on component`);
-      }
-      if (Object.prototype.hasOwnProperty.call(Object.prototype, action)) {
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      _liveDebugger?.trackActionCall(this.id, action, payload);
-      let hookResult;
-      try {
-        hookResult = await this.onAction(action, payload);
-      } catch (hookError) {
-        _liveDebugger?.trackActionError(this.id, action, hookError.message, Date.now() - actionStart);
-        this.emit("ERROR", {
-          action,
-          error: `Action '${action}' failed pre-validation`
-        });
-        throw hookError;
-      }
-      if (hookResult === false) {
-        _liveDebugger?.trackActionError(this.id, action, "Action cancelled", Date.now() - actionStart);
-        throw new Error(`Action '${action}' was cancelled`);
-      }
-      const result = await method.call(this, payload);
-      _liveDebugger?.trackActionResult(this.id, action, result, Date.now() - actionStart);
-      return result;
-    } catch (error) {
-      if (!error.message?.includes("was cancelled") && !error.message?.includes("pre-validation")) {
-        _liveDebugger?.trackActionError(this.id, action, error.message, Date.now() - actionStart);
-        this.emit("ERROR", {
-          action,
-          error: error.message
-        });
-      }
-      throw error;
-    }
+    return this._actionSecurity.validateAndExecute(action, payload, {
+      component: this,
+      componentClass: this.constructor,
+      componentId: this.id,
+      emitFn: (type, p) => this.emit(type, p),
+      debugger: _liveDebugger
+    });
   }
   // ========================================
-  // Messaging
+  // Messaging (delegates to _messaging)
   // ========================================
   emit(type, payload) {
-    const override = this[EMIT_OVERRIDE_KEY];
-    if (override) {
-      override(type, payload);
-      return;
-    }
-    const message = {
-      type,
-      componentId: this.id,
-      payload,
-      timestamp: Date.now(),
-      userId: this.userId,
-      room: this.room
-    };
-    if (this.ws && this.ws.send) {
-      this.ws.send(JSON.stringify(message));
-    }
+    this._messaging.emit(type, payload);
   }
   broadcast(type, payload, excludeCurrentUser = false) {
-    if (!this.room) {
-      liveWarn("rooms", this.id, `[${this.id}] Cannot broadcast '${type}' - no room set`);
-      return;
-    }
-    const message = {
-      type,
-      payload,
-      room: this.room,
-      excludeUser: excludeCurrentUser ? this.userId : void 0
-    };
-    liveLog("rooms", this.id, `[${this.id}] Broadcasting '${type}' to room '${this.room}'`);
-    this.broadcastToRoom(message);
+    this._messaging.broadcast(type, payload, excludeCurrentUser);
   }
   // ========================================
-  // Room Events - Internal Server Events
+  // Room Events (delegates to _roomProxyManager)
   // ========================================
   emitRoomEvent(event, data, notifySelf = false) {
-    if (!this.room) {
-      liveWarn("rooms", this.id, `[${this.id}] Cannot emit room event '${event}' - no room set`);
-      return 0;
-    }
-    const ctx = getLiveComponentContext();
-    const excludeId = notifySelf ? void 0 : this.id;
-    const notified = ctx.roomEvents.emit(this.roomType, this.room, event, data, excludeId);
-    liveLog("rooms", this.id, `[${this.id}] Room event '${event}' -> ${notified} components`);
-    _liveDebugger?.trackRoomEmit(this.id, this.room, event, data);
-    return notified;
+    return this._roomProxyManager.emitRoomEvent(event, data, notifySelf);
   }
   onRoomEvent(event, handler) {
-    if (!this.room) {
-      liveWarn("rooms", this.id, `[${this.id}] Cannot subscribe to room event '${event}' - no room set`);
-      return;
-    }
-    const ctx = getLiveComponentContext();
-    const unsubscribe = ctx.roomEvents.on(
-      this.roomType,
-      this.room,
-      event,
-      this.id,
-      handler
-    );
-    this.roomEventUnsubscribers.push(unsubscribe);
-    liveLog("rooms", this.id, `[${this.id}] Subscribed to room event '${event}'`);
+    this._roomProxyManager.onRoomEvent(event, handler);
   }
   emitRoomEventWithState(event, data, stateUpdates) {
-    this.setState(stateUpdates);
-    return this.emitRoomEvent(event, data, false);
+    return this._roomProxyManager.emitRoomEventWithState(event, data, stateUpdates);
   }
-  async subscribeToRoom(roomId) {
+  subscribeToRoom(roomId) {
+    this._roomProxyManager.subscribeToRoom(roomId);
     this.room = roomId;
   }
-  async unsubscribeFromRoom() {
+  unsubscribeFromRoom() {
+    this._roomProxyManager.unsubscribeFromRoom();
     this.room = void 0;
   }
   // ========================================
@@ -2238,21 +2805,13 @@ var LiveComponent = class _LiveComponent {
     } catch (err) {
       console.error(`[${this.id}] onDestroy error:`, err?.message || err);
     }
-    for (const unsubscribe of this.roomEventUnsubscribers) {
-      unsubscribe();
-    }
-    this.roomEventUnsubscribers = [];
-    const ctx = getLiveComponentContext();
-    for (const roomId of this.joinedRooms) {
-      ctx.roomManager.leaveRoom(this.id, roomId);
-    }
-    this.joinedRooms.clear();
-    this.roomHandles.clear();
+    this._roomProxyManager.destroy();
+    this._stateManager.cleanup();
     this._privateState = {};
-    this.unsubscribeFromRoom();
+    this.room = void 0;
   }
   getSerializableState() {
-    return this.state;
+    return this._stateManager.getSerializableState();
   }
 };
 
@@ -2266,6 +2825,8 @@ var ComponentRegistry = class {
   autoDiscoveredComponents = /* @__PURE__ */ new Map();
   healthCheckInterval;
   singletons = /* @__PURE__ */ new Map();
+  remoteSingletons = /* @__PURE__ */ new Map();
+  cluster;
   authManager;
   debugger;
   stateSignature;
@@ -2275,8 +2836,72 @@ var ComponentRegistry = class {
     this.debugger = deps.debugger;
     this.stateSignature = deps.stateSignature;
     this.performanceMonitor = deps.performanceMonitor;
+    this.cluster = deps.cluster;
     _setLiveDebugger(deps.debugger);
     this.setupHealthMonitoring();
+    this.setupClusterHandlers();
+  }
+  /** Set up handlers for incoming cluster messages (deltas, forwarded actions). */
+  setupClusterHandlers() {
+    if (!this.cluster) return;
+    this.cluster.onDelta((componentId, componentName, delta, sourceInstanceId) => {
+      const remote = this.remoteSingletons.get(componentName);
+      if (!remote || remote.componentId !== componentId) return;
+      if (delta && remote.lastState) {
+        Object.assign(remote.lastState, delta);
+      }
+      const message = JSON.stringify({
+        type: "STATE_DELTA",
+        componentId,
+        payload: { delta },
+        timestamp: Date.now()
+      });
+      const dead = [];
+      for (const [connId, ws] of remote.connections) {
+        if (ws.readyState === 1) {
+          try {
+            ws.send(message);
+          } catch {
+            dead.push(connId);
+          }
+        } else {
+          dead.push(connId);
+        }
+      }
+      for (const connId of dead) remote.connections.delete(connId);
+    });
+    this.cluster.onOwnershipLost((componentName) => {
+      const singleton = this.singletons.get(componentName);
+      if (!singleton) return;
+      this.cluster.saveSingletonState(componentName, singleton.instance.getSerializableState()).catch(() => {
+      });
+      const errorMsg = JSON.stringify({
+        type: "ERROR",
+        componentId: singleton.instance.id,
+        payload: { error: "OWNERSHIP_LOST: singleton moved to another server" },
+        timestamp: Date.now()
+      });
+      for (const [, ws] of singleton.connections) {
+        try {
+          ws.send(errorMsg);
+        } catch {
+        }
+      }
+      this.cleanupComponent(singleton.instance.id);
+      this.singletons.delete(componentName);
+    });
+    this.cluster.onActionForward(async (request) => {
+      try {
+        const stillOwner = await this.cluster.verifySingletonOwnership(request.componentName);
+        if (!stillOwner) {
+          return { success: false, error: "OWNERSHIP_LOST: this instance no longer owns the singleton", requestId: request.requestId };
+        }
+        const result = await this.executeAction(request.componentId, request.action, request.payload);
+        return { success: true, result, requestId: request.requestId };
+      } catch (error) {
+        return { success: false, error: error.message, requestId: request.requestId };
+      }
+    });
   }
   setupHealthMonitoring() {
     this.healthCheckInterval = setInterval(() => this.performHealthChecks(), 3e4);
@@ -2360,6 +2985,7 @@ var ComponentRegistry = class {
       const authResult = this.authManager.authorizeComponent(authContext, componentAuth);
       if (!authResult.allowed) throw new Error(`AUTH_DENIED: ${authResult.reason}`);
       const isSingleton = ComponentClass.singleton === true;
+      let clusterSingletonId = null;
       if (isSingleton) {
         const existing = this.singletons.get(componentName);
         if (existing) {
@@ -2367,11 +2993,11 @@ var ComponentRegistry = class {
           existing.connections.set(connId, ws);
           this.ensureWsData(ws, options?.userId);
           ws.data.components.set(existing.instance.id, existing.instance);
-          const signedState2 = await this.stateSignature.signState(existing.instance.id, {
+          const signedState2 = this.stateSignature.signState(existing.instance.id, {
             ...existing.instance.getSerializableState(),
             __componentName: componentName
           }, 1, { compress: true, backup: true });
-          ws.send(JSON.stringify({
+          sendImmediate(ws, JSON.stringify({
             type: "STATE_UPDATE",
             componentId: existing.instance.id,
             payload: { state: existing.instance.getSerializableState(), signedState: signedState2 },
@@ -2383,9 +3009,57 @@ var ComponentRegistry = class {
           }
           return { componentId: existing.instance.id, initialState: existing.instance.getSerializableState(), signedState: signedState2 };
         }
+        const existingRemote = this.remoteSingletons.get(componentName);
+        if (existingRemote) {
+          const connId = ws.data?.connectionId || `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+          this.ensureWsData(ws, options?.userId);
+          existingRemote.connections.set(connId, ws);
+          sendImmediate(ws, JSON.stringify({
+            type: "STATE_UPDATE",
+            componentId: existingRemote.componentId,
+            payload: { state: existingRemote.lastState },
+            timestamp: Date.now()
+          }));
+          return { componentId: existingRemote.componentId, initialState: existingRemote.lastState, signedState: null };
+        }
+        if (this.cluster) {
+          clusterSingletonId = `live-${crypto.randomUUID()}`;
+          const claim = await this.cluster.claimSingleton(componentName, clusterSingletonId);
+          if (!claim.claimed) {
+            clusterSingletonId = null;
+            const owner = await this.cluster.getSingletonOwner(componentName);
+            if (owner) {
+              const stored = await this.cluster.loadState(owner.componentId);
+              const connId = ws.data?.connectionId || `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+              this.ensureWsData(ws, options?.userId);
+              const remote = {
+                componentName,
+                componentId: owner.componentId,
+                ownerInstanceId: owner.instanceId,
+                lastState: stored?.state || {},
+                connections: /* @__PURE__ */ new Map([[connId, ws]])
+              };
+              this.remoteSingletons.set(componentName, remote);
+              sendImmediate(ws, JSON.stringify({
+                type: "STATE_UPDATE",
+                componentId: owner.componentId,
+                payload: { state: remote.lastState },
+                timestamp: Date.now()
+              }));
+              return { componentId: owner.componentId, initialState: remote.lastState, signedState: null };
+            }
+          }
+          if (claim.recoveredState) {
+            props = { ...props, ...claim.recoveredState };
+          }
+        }
       }
       const component = new ComponentClass({ ...initialState, ...props }, ws, options);
       component.setAuthContext(authContext);
+      if (clusterSingletonId) {
+        ;
+        component.id = clusterSingletonId;
+      }
       component.broadcastToRoom = (message) => {
         this.broadcastToRoom(message, component.id);
       };
@@ -2401,6 +3075,13 @@ var ComponentRegistry = class {
         const connections = /* @__PURE__ */ new Map();
         connections.set(connId, ws);
         this.singletons.set(componentName, { instance: component, connections });
+        if (this.cluster) {
+          this.cluster.saveState(component.id, componentName, component.getSerializableState()).catch(() => {
+          });
+          this.cluster.saveSingletonState(componentName, component.getSerializableState()).catch(() => {
+          });
+        }
+        ;
         component[EMIT_OVERRIDE_KEY] = (type, payload) => {
           const message = {
             type,
@@ -2423,6 +3104,14 @@ var ComponentRegistry = class {
             }
             for (const cId of dead) singleton.connections.delete(cId);
           }
+          if (this.cluster && type === "STATE_DELTA" && payload?.delta) {
+            this.cluster.publishDelta(component.id, componentName, payload.delta).catch(() => {
+            });
+            this.cluster.saveState(component.id, componentName, component.getSerializableState()).catch(() => {
+            });
+            this.cluster.saveSingletonState(componentName, component.getSerializableState()).catch(() => {
+            });
+          }
         };
         try {
           component.onClientJoin(connId, 1);
@@ -2435,7 +3124,7 @@ var ComponentRegistry = class {
       registerComponentLogging(component.id, ComponentClass.logging);
       this.performanceMonitor.initializeComponent(component.id, componentName);
       this.performanceMonitor.recordRenderTime(component.id, renderTime);
-      const signedState = await this.stateSignature.signState(component.id, {
+      const signedState = this.stateSignature.signState(component.id, {
         ...component.getSerializableState(),
         __componentName: componentName
       }, 1, { compress: true, backup: true });
@@ -2468,7 +3157,7 @@ var ComponentRegistry = class {
   }
   async rehydrateComponent(componentId, componentName, signedState, ws, options) {
     try {
-      const validation = await this.stateSignature.validateState(signedState);
+      const validation = this.stateSignature.validateState(signedState, { skipNonce: true });
       if (!validation.valid) return { success: false, error: validation.error || "Invalid state signature" };
       const definition = this.definitions.get(componentName);
       let ComponentClass = null;
@@ -2491,8 +3180,8 @@ var ComponentRegistry = class {
       const componentAuth = ComponentClass.auth;
       const authResult = this.authManager.authorizeComponent(authContext, componentAuth);
       if (!authResult.allowed) return { success: false, error: `AUTH_DENIED: ${authResult.reason}` };
-      const clientState = await this.stateSignature.extractData(signedState);
-      if (clientState.__componentName && clientState.__componentName !== componentName) {
+      const clientState = this.stateSignature.extractData(signedState);
+      if (!clientState.__componentName || clientState.__componentName !== componentName) {
         return { success: false, error: "Component class mismatch - state tampering detected" };
       }
       const { __componentName, ...cleanState } = clientState;
@@ -2505,7 +3194,7 @@ var ComponentRegistry = class {
       this.ensureWsData(ws, options?.userId);
       ws.data.components.set(component.id, component);
       registerComponentLogging(component.id, ComponentClass.logging);
-      const newSignedState = await this.stateSignature.signState(
+      const newSignedState = this.stateSignature.signState(
         component.id,
         { ...component.getSerializableState(), __componentName: componentName },
         signedState.version + 1
@@ -2554,20 +3243,39 @@ var ComponentRegistry = class {
       if (singleton.instance.id !== componentId) continue;
       if (connId) singleton.connections.delete(connId);
       if (singleton.connections.size === 0) {
+        const finalState = singleton.instance.getSerializableState();
         try {
           singleton.instance.onDisconnect();
         } catch {
         }
         this.cleanupComponent(componentId);
         this.singletons.delete(name);
+        if (this.cluster) {
+          this.cluster.saveSingletonState(name, finalState).then(() => this.cluster.releaseSingleton(name)).then(() => this.cluster.deleteState(componentId)).catch(() => {
+          });
+        }
+      }
+      return true;
+    }
+    for (const [name, remote] of this.remoteSingletons) {
+      if (remote.componentId !== componentId) continue;
+      if (connId) remote.connections.delete(connId);
+      if (remote.connections.size === 0) {
+        this.remoteSingletons.delete(name);
       }
       return true;
     }
     return false;
   }
-  async unmountComponent(componentId, ws) {
+  unmountComponent(componentId, ws) {
     const component = this.components.get(componentId);
-    if (!component) return;
+    if (!component) {
+      if (ws) {
+        const connId = ws.data?.connectionId;
+        this.removeSingletonConnection(componentId, connId, "unmount");
+      }
+      return;
+    }
     if (ws) {
       const connId = ws.data?.connectionId;
       ws.data?.components?.delete(componentId);
@@ -2596,6 +3304,13 @@ var ComponentRegistry = class {
     }
     return null;
   }
+  /** Find a remote singleton entry by componentId. */
+  findRemoteSingleton(componentId) {
+    for (const [, entry] of this.remoteSingletons) {
+      if (entry.componentId === componentId) return entry;
+    }
+    return null;
+  }
   async executeAction(componentId, action, payload) {
     const component = this.components.get(componentId);
     if (!component) throw new Error(`COMPONENT_REHYDRATION_REQUIRED:${componentId}`);
@@ -2646,7 +3361,7 @@ var ComponentRegistry = class {
       const component = this.components.get(componentId);
       if (message.excludeUser && component?.userId === message.excludeUser) continue;
       const ws = this.wsConnections.get(componentId);
-      if (ws && ws.send) ws.send(JSON.stringify(broadcastMessage));
+      if (ws) queueWsMessage(ws, broadcastMessage);
     }
   }
   async handleMessage(ws, message) {
@@ -2661,9 +3376,26 @@ var ComponentRegistry = class {
           });
           return { success: true, result: mountResult };
         case "COMPONENT_UNMOUNT":
-          await this.unmountComponent(message.componentId, ws);
+          this.unmountComponent(message.componentId, ws);
           return { success: true };
-        case "CALL_ACTION":
+        case "CALL_ACTION": {
+          const remoteSingleton = this.findRemoteSingleton(message.componentId);
+          if (remoteSingleton && this.cluster) {
+            const requestId = `req-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const request = {
+              sourceInstanceId: this.cluster.instanceId,
+              targetInstanceId: remoteSingleton.ownerInstanceId,
+              componentId: remoteSingleton.componentId,
+              componentName: remoteSingleton.componentName,
+              action: message.action,
+              payload: message.payload,
+              requestId
+            };
+            const response = await this.cluster.forwardAction(request);
+            if (!response.success) throw new Error(response.error || "Remote action failed");
+            if (message.expectResponse) return { success: true, result: response.result };
+            return null;
+          }
           this.recordComponentMetrics(message.componentId, void 0, message.action);
           const actionStart = Date.now();
           try {
@@ -2675,6 +3407,7 @@ var ComponentRegistry = class {
             this.performanceMonitor.recordActionTime(message.componentId, message.action, Date.now() - actionStart, error);
             throw error;
           }
+        }
         case "PROPERTY_UPDATE":
           this.updateProperty(message.componentId, message.property, message.payload.value);
           return { success: true };
@@ -2702,6 +3435,14 @@ var ComponentRegistry = class {
         this.cleanupComponent(componentId);
       }
     }
+    if (connId) {
+      for (const [name, remote] of this.remoteSingletons) {
+        remote.connections.delete(connId);
+        if (remote.connections.size === 0) {
+          this.remoteSingletons.delete(name);
+        }
+      }
+    }
     ws.data.components.clear();
   }
   getStats() {
@@ -2713,6 +3454,9 @@ var ComponentRegistry = class {
       singletons: Object.fromEntries(
         Array.from(this.singletons.entries()).map(([name, s]) => [name, { componentId: s.instance.id, connections: s.connections.size }])
       ),
+      remoteSingletons: Object.fromEntries(
+        Array.from(this.remoteSingletons.entries()).map(([name, r]) => [name, { componentId: r.componentId, ownerInstanceId: r.ownerInstanceId, connections: r.connections.size }])
+      ),
       roomDetails: Object.fromEntries(
         Array.from(this.rooms.entries()).map(([roomId, components]) => [roomId, components.size])
       )
@@ -2770,7 +3514,7 @@ var ComponentRegistry = class {
       metadata.healthStatus = metadata.metrics.errorCount > 5 ? "unhealthy" : "degraded";
     }
   }
-  async performHealthChecks() {
+  performHealthChecks() {
     for (const [componentId, metadata] of this.metadata) {
       if (!this.components.get(componentId)) continue;
       if (metadata.metrics.errorCount > 10) metadata.healthStatus = "unhealthy";
@@ -2796,6 +3540,7 @@ var ComponentRegistry = class {
   cleanup() {
     if (this.healthCheckInterval) clearInterval(this.healthCheckInterval);
     this.singletons.clear();
+    this.remoteSingletons.clear();
     for (const [componentId] of this.components) this.cleanupComponent(componentId);
   }
 };
@@ -2874,6 +3619,25 @@ function decodeBinaryChunk(raw) {
   return { header, data };
 }
 
+// src/security/sanitize.ts
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var MAX_DEPTH = 10;
+function sanitizePayload(value, depth = 0) {
+  if (depth > MAX_DEPTH) return value;
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizePayload(item, depth + 1));
+  }
+  if (value !== null && typeof value === "object") {
+    const clean = {};
+    for (const key of Object.keys(value)) {
+      if (DANGEROUS_KEYS.has(key)) continue;
+      clean[key] = sanitizePayload(value[key], depth + 1);
+    }
+    return clean;
+  }
+  return value;
+}
+
 // src/server/LiveServer.ts
 var LiveServer = class {
   // Public singletons (accessible for transport adapters & advanced usage)
@@ -2893,7 +3657,7 @@ var LiveServer = class {
     this.options = options;
     this.transport = options.transport;
     this.roomEvents = new RoomEventBus();
-    this.roomManager = new LiveRoomManager(this.roomEvents);
+    this.roomManager = new LiveRoomManager(this.roomEvents, options.roomPubSub);
     this.debugger = new LiveDebugger(options.debug ?? false);
     this.authManager = new LiveAuthManager();
     this.stateSignature = new StateSignatureManager(options.stateSignature);
@@ -2905,7 +3669,8 @@ var LiveServer = class {
       authManager: this.authManager,
       debugger: this.debugger,
       stateSignature: this.stateSignature,
-      performanceMonitor: this.performanceMonitor
+      performanceMonitor: this.performanceMonitor,
+      cluster: options.cluster
     });
     _setLoggerDebugger(this.debugger);
     setLiveComponentContext({
@@ -2940,10 +3705,13 @@ var LiveServer = class {
       const prefix = this.options.httpPrefix ?? "/api/live";
       await this.transport.registerHttpRoutes(this.buildHttpRoutes(prefix));
     }
+    if (this.options.cluster) {
+      await this.options.cluster.start();
+    }
     if (this.transport.start) {
       await this.transport.start();
     }
-    liveLog("lifecycle", null, `LiveServer started (ws: ${wsConfig.path})`);
+    liveLog("lifecycle", null, `LiveServer started (ws: ${wsConfig.path}${this.options.cluster ? ", cluster: enabled" : ""})`);
   }
   /**
    * Graceful shutdown.
@@ -2953,21 +3721,32 @@ var LiveServer = class {
     this.connectionManager.shutdown();
     this.fileUploadManager.shutdown();
     this.stateSignature.shutdown();
+    if (this.options.cluster) await this.options.cluster.shutdown();
     if (this.transport.shutdown) await this.transport.shutdown();
     liveLog("lifecycle", null, "LiveServer shut down");
   }
   // ===== WebSocket Handlers =====
   handleOpen(ws) {
+    const origin = ws.data?.origin;
+    const allowedOrigins = this.options.allowedOrigins;
+    if (allowedOrigins && allowedOrigins.length > 0) {
+      if (!origin || !allowedOrigins.includes(origin)) {
+        liveLog("websocket", null, `Connection rejected: origin '${origin || "none"}' not in allowedOrigins`);
+        ws.close(4003, "Origin not allowed");
+        return;
+      }
+    }
     const connectionId = `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     ws.data = {
       connectionId,
       components: /* @__PURE__ */ new Map(),
       subscriptions: /* @__PURE__ */ new Set(),
-      connectedAt: /* @__PURE__ */ new Date()
+      connectedAt: /* @__PURE__ */ new Date(),
+      origin
     };
     this.connectionManager.registerConnection(ws, connectionId);
     this.debugger.trackConnection(connectionId);
-    ws.send(JSON.stringify({
+    sendImmediate(ws, JSON.stringify({
       type: "CONNECTION_ESTABLISHED",
       connectionId,
       timestamp: Date.now()
@@ -2979,7 +3758,7 @@ var LiveServer = class {
     if (connectionId) {
       const limiter = this.rateLimiter.get(connectionId);
       if (!limiter.tryConsume()) {
-        ws.send(JSON.stringify({ type: "ERROR", error: "Rate limit exceeded", timestamp: Date.now() }));
+        sendImmediate(ws, JSON.stringify({ type: "ERROR", error: "Rate limit exceeded", timestamp: Date.now() }));
         return;
       }
     }
@@ -2989,26 +3768,33 @@ var LiveServer = class {
         if (header.type === "FILE_UPLOAD_CHUNK") {
           const chunkMessage = { ...header, data: "" };
           const progress = await this.fileUploadManager.receiveChunk(chunkMessage, data);
-          if (progress) ws.send(JSON.stringify(progress));
+          if (progress) sendImmediate(ws, JSON.stringify(progress));
         }
       } catch (error) {
-        ws.send(JSON.stringify({ type: "ERROR", error: error.message, timestamp: Date.now() }));
+        sendImmediate(ws, JSON.stringify({ type: "ERROR", error: error.message, timestamp: Date.now() }));
       }
       return;
     }
+    const str = typeof rawMessage === "string" ? rawMessage : new TextDecoder().decode(rawMessage);
+    if (str.length > MAX_MESSAGE_SIZE) {
+      sendImmediate(ws, JSON.stringify({ type: "ERROR", error: "Message too large", timestamp: Date.now() }));
+      return;
+    }
     let message;
     try {
-      const str = typeof rawMessage === "string" ? rawMessage : new TextDecoder().decode(rawMessage);
       message = JSON.parse(str);
     } catch {
-      ws.send(JSON.stringify({ type: "ERROR", error: "Invalid JSON", timestamp: Date.now() }));
+      sendImmediate(ws, JSON.stringify({ type: "ERROR", error: "Invalid JSON", timestamp: Date.now() }));
       return;
     }
+    if (message.payload) {
+      message.payload = sanitizePayload(message.payload);
+    }
     try {
       if (message.type === "AUTH") {
         const authContext = await this.authManager.authenticate(message.payload || {});
         if (ws.data) ws.data.authContext = authContext;
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "AUTH_RESPONSE",
           success: authContext.authenticated,
           payload: authContext.authenticated ? { userId: authContext.user?.id } : { error: "Authentication failed" },
@@ -3017,12 +3803,12 @@ var LiveServer = class {
         return;
       }
       if (message.type === "ROOM_JOIN" || message.type === "ROOM_LEAVE" || message.type === "ROOM_EMIT" || message.type === "ROOM_STATE_SET" || message.type === "ROOM_STATE_GET") {
-        await this.handleRoomMessage(ws, message);
+        this.handleRoomMessage(ws, message);
         return;
       }
       if (message.type === "FILE_UPLOAD_START") {
         const result2 = await this.fileUploadManager.startUpload(message, ws.data?.userId);
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "FILE_UPLOAD_START_RESPONSE",
           componentId: message.componentId,
           uploadId: message.payload?.uploadId,
@@ -3035,12 +3821,12 @@ var LiveServer = class {
       }
       if (message.type === "FILE_UPLOAD_CHUNK") {
         const progress = await this.fileUploadManager.receiveChunk(message);
-        if (progress) ws.send(JSON.stringify(progress));
+        if (progress) sendImmediate(ws, JSON.stringify(progress));
         return;
       }
       if (message.type === "FILE_UPLOAD_COMPLETE") {
         const result2 = await this.fileUploadManager.completeUpload(message);
-        ws.send(JSON.stringify(result2));
+        sendImmediate(ws, JSON.stringify(result2));
         return;
       }
       if (message.type === "COMPONENT_REHYDRATE") {
@@ -3051,7 +3837,7 @@ var LiveServer = class {
           ws,
           { room: message.payload.room, userId: message.userId }
         );
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "COMPONENT_REHYDRATED",
           componentId: message.componentId,
           success: result2.success,
@@ -3075,10 +3861,10 @@ var LiveServer = class {
           responseId: message.responseId,
           timestamp: Date.now()
         };
-        ws.send(JSON.stringify(response));
+        sendImmediate(ws, JSON.stringify(response));
       }
     } catch (error) {
-      ws.send(JSON.stringify({
+      sendImmediate(ws, JSON.stringify({
         type: "ERROR",
         componentId: message.componentId,
         error: error.message,
@@ -3103,13 +3889,26 @@ var LiveServer = class {
     console.error(`[LiveServer] WebSocket error:`, error.message);
   }
   // ===== Room Message Router =====
-  async handleRoomMessage(ws, message) {
+  handleRoomMessage(ws, message) {
     const { componentId } = message;
     const roomId = message.roomId || message.payload?.roomId;
     switch (message.type) {
       case "ROOM_JOIN": {
+        const connRooms = ws.data?.rooms;
+        if (connRooms && connRooms.size >= MAX_ROOMS_PER_CONNECTION) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: "Room limit exceeded",
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
         const result = this.roomManager.joinRoom(componentId, roomId, ws, message.payload?.initialState);
-        ws.send(JSON.stringify({
+        if (!ws.data.rooms) ws.data.rooms = /* @__PURE__ */ new Set();
+        ws.data.rooms.add(roomId);
+        sendImmediate(ws, JSON.stringify({
           type: "ROOM_JOINED",
           componentId,
           payload: { roomId, state: result.state },
@@ -3120,7 +3919,8 @@ var LiveServer = class {
       }
       case "ROOM_LEAVE":
         this.roomManager.leaveRoom(componentId, roomId);
-        ws.send(JSON.stringify({
+        ws.data?.rooms?.delete(roomId);
+        sendImmediate(ws, JSON.stringify({
           type: "ROOM_LEFT",
           componentId,
           payload: { roomId },
@@ -3136,7 +3936,7 @@ var LiveServer = class {
         break;
       case "ROOM_STATE_GET": {
         const state = this.roomManager.getRoomState(roomId);
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "ROOM_STATE",
           componentId,
           payload: { roomId, state },
@@ -3153,7 +3953,7 @@ var LiveServer = class {
       {
         method: "GET",
         path: `${prefix}/stats`,
-        handler: async () => ({
+        handler: () => ({
           body: {
             components: this.registry.getStats(),
             rooms: this.roomManager.getStats(),
@@ -3167,7 +3967,7 @@ var LiveServer = class {
       {
         method: "GET",
         path: `${prefix}/components`,
-        handler: async () => ({
+        handler: () => ({
           body: { names: this.registry.getRegisteredComponentNames() }
         }),
         metadata: { summary: "List registered component names", tags: ["live"] }
@@ -3175,7 +3975,7 @@ var LiveServer = class {
       {
         method: "POST",
         path: `${prefix}/rooms/:roomId/messages`,
-        handler: async (req) => {
+        handler: (req) => {
           const roomId = req.params.roomId;
           this.roomManager.emitToRoom(roomId, "message:new", req.body);
           return { body: { success: true, roomId } };
@@ -3185,7 +3985,7 @@ var LiveServer = class {
       {
         method: "POST",
         path: `${prefix}/rooms/:roomId/emit`,
-        handler: async (req) => {
+        handler: (req) => {
           const roomId = req.params.roomId;
           const { event, data } = req.body;
           this.roomManager.emitToRoom(roomId, event, data);
@@ -3329,6 +4129,66 @@ var RoomStateManager = class {
   }
 };
 
-export { ANONYMOUS_CONTEXT, AnonymousContext, AuthenticatedContext, ComponentRegistry, ConnectionRateLimiter, DEFAULT_CHUNK_SIZE, DEFAULT_WS_PATH, FileUploadManager, LiveAuthManager, LiveComponent, LiveDebugger, LiveRoomManager, LiveServer, PROTOCOL_VERSION, PerformanceMonitor, RateLimiterRegistry, RoomEventBus, RoomStateManager, StateSignatureManager, WebSocketConnectionManager, createTypedRoomEventBus, createTypedRoomState, decodeBinaryChunk, encodeBinaryChunk, getLiveComponentContext, liveLog, liveWarn, registerComponentLogging, setLiveComponentContext, unregisterComponentLogging };
+// src/rooms/InMemoryRoomAdapter.ts
+var InMemoryRoomAdapter = class {
+  rooms = /* @__PURE__ */ new Map();
+  // ===== IRoomStorageAdapter =====
+  async getOrCreateRoom(roomId, initialState) {
+    const existing = this.rooms.get(roomId);
+    if (existing) {
+      return { state: existing.state, created: false };
+    }
+    const now = Date.now();
+    const data = {
+      state: initialState ?? {},
+      createdAt: now,
+      lastUpdate: now
+    };
+    this.rooms.set(roomId, data);
+    return { state: data.state, created: true };
+  }
+  async getState(roomId) {
+    return this.rooms.get(roomId)?.state ?? {};
+  }
+  async updateState(roomId, updates) {
+    const room = this.rooms.get(roomId);
+    if (room) {
+      Object.assign(room.state, updates);
+      room.lastUpdate = Date.now();
+    }
+  }
+  async hasRoom(roomId) {
+    return this.rooms.has(roomId);
+  }
+  async deleteRoom(roomId) {
+    return this.rooms.delete(roomId);
+  }
+  async getStats() {
+    const rooms = {};
+    for (const [id, data] of this.rooms) {
+      rooms[id] = {
+        createdAt: data.createdAt,
+        lastUpdate: data.lastUpdate,
+        stateKeys: Object.keys(data.state)
+      };
+    }
+    return { totalRooms: this.rooms.size, rooms };
+  }
+  // ===== IRoomPubSubAdapter =====
+  // No-ops for single-instance: all events are already propagated locally
+  // by RoomEventBus and LiveRoomManager's broadcastToRoom().
+  async publish(_roomId, _event, _data) {
+  }
+  async subscribe(_roomId, _handler) {
+    return () => {
+    };
+  }
+  async publishMembership(_roomId, _action, _componentId) {
+  }
+  async publishStateChange(_roomId, _updates) {
+  }
+};
+
+export { ANONYMOUS_CONTEXT, AnonymousContext, AuthenticatedContext, ComponentRegistry, ConnectionRateLimiter, DEFAULT_CHUNK_SIZE, DEFAULT_WS_PATH, EMIT_OVERRIDE_KEY, FileUploadManager, InMemoryRoomAdapter, LiveAuthManager, LiveComponent, LiveDebugger, LiveRoomManager, LiveServer, PROTOCOL_VERSION, PerformanceMonitor, RateLimiterRegistry, RoomEventBus, RoomStateManager, StateSignatureManager, WebSocketConnectionManager, createTypedRoomEventBus, createTypedRoomState, decodeBinaryChunk, encodeBinaryChunk, getLiveComponentContext, liveLog, liveWarn, queueWsMessage, registerComponentLogging, sendImmediate, setLiveComponentContext, unregisterComponentLogging };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map