@fluxstack/live 0.1.0 → 0.3.0

package/dist/index.js

@@ -1,4 +1,4 @@
-import { randomBytes, createCipheriv, createDecipheriv, createHmac } from 'crypto';
+import { randomBytes, createHmac, createCipheriv, createDecipheriv, scryptSync } from 'crypto';
 import { gzipSync, gunzipSync } from 'zlib';
 import { EventEmitter } from 'events';
 
@@ -12,6 +12,7 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 // src/rooms/RoomEventBus.ts
 function createTypedRoomEventBus() {
   const subscriptions = /* @__PURE__ */ new Map();
+  const componentIndex = /* @__PURE__ */ new Map();
   const getKey = (roomType, roomId, event) => `${roomType}:${roomId}:${event}`;
   const getRoomKey = (roomType, roomId) => `${roomType}:${roomId}`;
   return {
@@ -28,6 +29,10 @@ function createTypedRoomEventBus() {
         componentId
       };
       subscriptions.get(key).add(subscription);
+      if (!componentIndex.has(componentId)) {
+        componentIndex.set(componentId, /* @__PURE__ */ new Set());
+      }
+      componentIndex.get(componentId).add(key);
       return () => {
         subscriptions.get(key)?.delete(subscription);
         if (subscriptions.get(key)?.size === 0) {
@@ -52,8 +57,12 @@ function createTypedRoomEventBus() {
       return notified;
     },
     unsubscribeAll(componentId) {
+      const keys = componentIndex.get(componentId);
+      if (!keys) return 0;
       let removed = 0;
-      for (const [key, subs] of subscriptions) {
+      for (const key of keys) {
+        const subs = subscriptions.get(key);
+        if (!subs) continue;
         for (const sub of subs) {
           if (sub.componentId === componentId) {
             subs.delete(sub);
@@ -64,6 +73,7 @@ function createTypedRoomEventBus() {
           subscriptions.delete(key);
         }
       }
+      componentIndex.delete(componentId);
       return removed;
     },
     clearRoom(roomType, roomId) {
@@ -71,7 +81,13 @@ function createTypedRoomEventBus() {
       let removed = 0;
       for (const key of subscriptions.keys()) {
         if (key.startsWith(prefix)) {
-          removed += subscriptions.get(key)?.size ?? 0;
+          const subs = subscriptions.get(key);
+          if (subs) {
+            for (const sub of subs) {
+              componentIndex.get(sub.componentId)?.delete(key);
+            }
+            removed += subs.size;
+          }
           subscriptions.delete(key);
         }
       }
@@ -96,6 +112,8 @@ function createTypedRoomEventBus() {
 }
 var RoomEventBus = class {
   subscriptions = /* @__PURE__ */ new Map();
+  /** Reverse index: componentId -> Set of subscription keys for O(1) unsubscribeAll */
+  componentIndex = /* @__PURE__ */ new Map();
   getKey(roomType, roomId, event) {
     return `${roomType}:${roomId}:${event}`;
   }
@@ -106,6 +124,10 @@ var RoomEventBus = class {
     }
     const subscription = { roomType, roomId, event, handler, componentId };
     this.subscriptions.get(key).add(subscription);
+    if (!this.componentIndex.has(componentId)) {
+      this.componentIndex.set(componentId, /* @__PURE__ */ new Set());
+    }
+    this.componentIndex.get(componentId).add(key);
     return () => {
       this.subscriptions.get(key)?.delete(subscription);
       if (this.subscriptions.get(key)?.size === 0) {
@@ -130,8 +152,12 @@ var RoomEventBus = class {
     return notified;
   }
   unsubscribeAll(componentId) {
+    const keys = this.componentIndex.get(componentId);
+    if (!keys) return 0;
     let removed = 0;
-    for (const [key, subs] of this.subscriptions) {
+    for (const key of keys) {
+      const subs = this.subscriptions.get(key);
+      if (!subs) continue;
       for (const sub of subs) {
         if (sub.componentId === componentId) {
           subs.delete(sub);
@@ -142,6 +168,7 @@ var RoomEventBus = class {
         this.subscriptions.delete(key);
       }
     }
+    this.componentIndex.delete(componentId);
     return removed;
   }
   clearRoom(roomType, roomId) {
@@ -149,7 +176,13 @@ var RoomEventBus = class {
     let removed = 0;
     for (const key of this.subscriptions.keys()) {
       if (key.startsWith(prefix)) {
-        removed += this.subscriptions.get(key)?.size ?? 0;
+        const subs = this.subscriptions.get(key);
+        if (subs) {
+          for (const sub of subs) {
+            this.componentIndex.get(sub.componentId)?.delete(key);
+          }
+          removed += subs.size;
+        }
         this.subscriptions.delete(key);
       }
     }
@@ -172,6 +205,143 @@ var RoomEventBus = class {
   }
 };
 
+// src/protocol/constants.ts
+var PROTOCOL_VERSION = 1;
+var DEFAULT_WS_PATH = "/api/live/ws";
+var DEFAULT_CHUNK_SIZE = 64 * 1024;
+var DEFAULT_RATE_LIMIT_MAX_TOKENS = 100;
+var DEFAULT_RATE_LIMIT_REFILL_RATE = 50;
+var MAX_MESSAGE_SIZE = 100 * 1024 * 1024;
+var MAX_ROOM_STATE_SIZE = 10 * 1024 * 1024;
+var MAX_ROOMS_PER_CONNECTION = 50;
+var ROOM_NAME_REGEX = /^[a-zA-Z0-9_:.-]{1,64}$/;
+var MAX_QUEUE_SIZE = 1e3;
+
+// src/transport/WsSendBatcher.ts
+var wsQueues = /* @__PURE__ */ new WeakMap();
+var scheduledFlushes = /* @__PURE__ */ new WeakSet();
+var pendingWs = [];
+var globalFlushScheduled = false;
+function scheduleWs(ws) {
+  if (!scheduledFlushes.has(ws)) {
+    scheduledFlushes.add(ws);
+    pendingWs.push(ws);
+    if (!globalFlushScheduled) {
+      globalFlushScheduled = true;
+      queueMicrotask(flushAll);
+    }
+  }
+}
+function queueWsMessage(ws, message) {
+  if (!ws || ws.readyState !== 1) return;
+  let queue = wsQueues.get(ws);
+  if (!queue) {
+    queue = [];
+    wsQueues.set(ws, queue);
+  }
+  if (queue.length >= MAX_QUEUE_SIZE) {
+    queue.shift();
+  }
+  queue.push(message);
+  scheduleWs(ws);
+}
+function queuePreSerialized(ws, serialized) {
+  if (!ws || ws.readyState !== 1) return;
+  let queue = wsQueues.get(ws);
+  if (!queue) {
+    queue = [];
+    wsQueues.set(ws, queue);
+  }
+  if (queue.length >= MAX_QUEUE_SIZE) {
+    queue.shift();
+  }
+  queue.push(serialized);
+  scheduleWs(ws);
+}
+function flushAll() {
+  globalFlushScheduled = false;
+  const connections = pendingWs;
+  pendingWs = [];
+  for (const ws of connections) {
+    scheduledFlushes.delete(ws);
+    const queue = wsQueues.get(ws);
+    if (!queue || queue.length === 0) continue;
+    wsQueues.set(ws, []);
+    if (ws.readyState !== 1) continue;
+    try {
+      if (queue.length === 1) {
+        const item = queue[0];
+        if (typeof item === "string") {
+          ws.send(item);
+        } else {
+          ws.send(JSON.stringify(item));
+        }
+      } else {
+        const objects = [];
+        const preSerialized = [];
+        for (const item of queue) {
+          if (typeof item === "string") {
+            preSerialized.push(item);
+          } else {
+            objects.push(item);
+          }
+        }
+        if (objects.length === 0) {
+          ws.send("[" + preSerialized.join(",") + "]");
+        } else if (preSerialized.length === 0) {
+          const deduped = deduplicateDeltas(objects);
+          ws.send(JSON.stringify(deduped));
+        } else {
+          const deduped = deduplicateDeltas(objects);
+          let result = "[";
+          for (let i = 0; i < deduped.length; i++) {
+            if (i > 0) result += ",";
+            result += JSON.stringify(deduped[i]);
+          }
+          for (const ps of preSerialized) {
+            result += "," + ps;
+          }
+          result += "]";
+          ws.send(result);
+        }
+      }
+    } catch {
+    }
+  }
+}
+function deduplicateDeltas(messages) {
+  const deltaIndices = /* @__PURE__ */ new Map();
+  const result = [];
+  for (const msg of messages) {
+    if (msg.type === "STATE_DELTA" && msg.componentId && msg.payload?.delta) {
+      const existing = deltaIndices.get(msg.componentId);
+      if (existing !== void 0) {
+        const target = result[existing];
+        target.payload = {
+          delta: { ...target.payload.delta, ...msg.payload.delta }
+        };
+        target.timestamp = msg.timestamp;
+      } else {
+        deltaIndices.set(msg.componentId, result.length);
+        result.push({ ...msg, payload: { delta: { ...msg.payload.delta } } });
+      }
+    } else {
+      result.push(msg);
+    }
+  }
+  return result;
+}
+function sendBinaryImmediate(ws, data) {
+  if (ws && ws.readyState === 1) {
+    ws.send(data);
+  }
+}
+function sendImmediate(ws, data) {
+  if (ws && ws.readyState === 1) {
+    ws.send(data);
+  }
+}
+
 // src/debug/LiveLogger.ts
 var componentConfigs = /* @__PURE__ */ new Map();
 var globalConfigParsed = false;
@@ -209,22 +379,7 @@ function shouldLog(componentId, category) {
   if (cfg === true) return true;
   return cfg.includes(category);
 }
-var _debugger = null;
-function _setLoggerDebugger(dbg) {
-  _debugger = dbg;
-}
-function emitToDebugger(category, level, componentId, message, args) {
-  if (!_debugger?.enabled) return;
-  const data = { category, level, message };
-  if (args.length === 1 && typeof args[0] === "object" && args[0] !== null) {
-    data.details = args[0];
-  } else if (args.length > 0) {
-    data.details = args;
-  }
-  _debugger.emit("LOG", componentId, null, data);
-}
 function liveLog(category, componentId, message, ...args) {
-  emitToDebugger(category, "info", componentId, message, args);
   if (shouldLog(componentId, category)) {
     if (args.length > 0) {
       console.log(message, ...args);
@@ -234,7 +389,6 @@ function liveLog(category, componentId, message, ...args) {
   }
 }
 function liveWarn(category, componentId, message, ...args) {
-  emitToDebugger(category, "warn", componentId, message, args);
   if (shouldLog(componentId, category)) {
     if (args.length > 0) {
       console.warn(message, ...args);
@@ -244,51 +398,482 @@ function liveWarn(category, componentId, message, ...args) {
   }
 }
 
-// src/protocol/constants.ts
-var PROTOCOL_VERSION = 1;
-var DEFAULT_WS_PATH = "/api/live/ws";
-var DEFAULT_CHUNK_SIZE = 64 * 1024;
-var DEFAULT_RATE_LIMIT_MAX_TOKENS = 100;
-var DEFAULT_RATE_LIMIT_REFILL_RATE = 50;
-var MAX_ROOM_STATE_SIZE = 10 * 1024 * 1024;
+// src/utils/deepDiff.ts
+function isPlainObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) && Object.getPrototypeOf(v) === Object.prototype;
+}
+function computeDeepDiff(prev, next, depth = 0, maxDepth = 3, seen) {
+  if (depth > maxDepth) return prev === next ? null : next;
+  if (!seen) seen = /* @__PURE__ */ new Set();
+  if (seen.has(next)) return prev === next ? null : next;
+  seen.add(next);
+  let result = null;
+  for (const key of Object.keys(next)) {
+    const oldVal = prev[key];
+    const newVal = next[key];
+    if (oldVal === newVal) continue;
+    if (isPlainObject(oldVal) && isPlainObject(newVal)) {
+      const nested = computeDeepDiff(oldVal, newVal, depth + 1, maxDepth, seen);
+      if (nested !== null) {
+        result ??= {};
+        result[key] = nested;
+      }
+    } else {
+      result ??= {};
+      result[key] = newVal;
+    }
+  }
+  return result;
+}
+function deepAssign(target, source, seen) {
+  if (!seen) seen = /* @__PURE__ */ new Set();
+  if (seen.has(source)) return;
+  seen.add(source);
+  for (const key of Object.keys(source)) {
+    if (isPlainObject(target[key]) && isPlainObject(source[key])) {
+      deepAssign(target[key], source[key], seen);
+    } else {
+      target[key] = source[key];
+    }
+  }
+}
+
+// src/rooms/RoomCodec.ts
+var BINARY_ROOM_EVENT = 2;
+var BINARY_ROOM_STATE = 3;
+var encoder = new TextEncoder();
+var decoder = new TextDecoder();
+function msgpackEncode(value) {
+  const parts = [];
+  encode(value, parts);
+  let totalLen = 0;
+  for (const p of parts) totalLen += p.length;
+  const result = new Uint8Array(totalLen);
+  let offset = 0;
+  for (const p of parts) {
+    result.set(p, offset);
+    offset += p.length;
+  }
+  return result;
+}
+function encode(value, parts) {
+  if (value === null || value === void 0) {
+    parts.push(new Uint8Array([192]));
+    return;
+  }
+  if (typeof value === "boolean") {
+    parts.push(new Uint8Array([value ? 195 : 194]));
+    return;
+  }
+  if (typeof value === "number") {
+    if (Number.isInteger(value)) {
+      encodeInt(value, parts);
+    } else {
+      const buf = new Uint8Array(9);
+      buf[0] = 203;
+      new DataView(buf.buffer).setFloat64(1, value, false);
+      parts.push(buf);
+    }
+    return;
+  }
+  if (typeof value === "string") {
+    const encoded = encoder.encode(value);
+    const len = encoded.length;
+    if (len < 32) {
+      parts.push(new Uint8Array([160 | len]));
+    } else if (len < 256) {
+      parts.push(new Uint8Array([217, len]));
+    } else if (len < 65536) {
+      parts.push(new Uint8Array([218, len >> 8, len & 255]));
+    } else {
+      parts.push(new Uint8Array([219, len >> 24 & 255, len >> 16 & 255, len >> 8 & 255, len & 255]));
+    }
+    parts.push(encoded);
+    return;
+  }
+  if (value instanceof Uint8Array) {
+    const len = value.length;
+    if (len < 256) {
+      parts.push(new Uint8Array([196, len]));
+    } else if (len < 65536) {
+      parts.push(new Uint8Array([197, len >> 8, len & 255]));
+    } else {
+      parts.push(new Uint8Array([198, len >> 24 & 255, len >> 16 & 255, len >> 8 & 255, len & 255]));
+    }
+    parts.push(value);
+    return;
+  }
+  if (Array.isArray(value)) {
+    const len = value.length;
+    if (len < 16) {
+      parts.push(new Uint8Array([144 | len]));
+    } else if (len < 65536) {
+      parts.push(new Uint8Array([220, len >> 8, len & 255]));
+    } else {
+      parts.push(new Uint8Array([221, len >> 24 & 255, len >> 16 & 255, len >> 8 & 255, len & 255]));
+    }
+    for (const item of value) {
+      encode(item, parts);
+    }
+    return;
+  }
+  if (typeof value === "object") {
+    const keys = Object.keys(value);
+    const len = keys.length;
+    if (len < 16) {
+      parts.push(new Uint8Array([128 | len]));
+    } else if (len < 65536) {
+      parts.push(new Uint8Array([222, len >> 8, len & 255]));
+    } else {
+      parts.push(new Uint8Array([223, len >> 24 & 255, len >> 16 & 255, len >> 8 & 255, len & 255]));
+    }
+    for (const key of keys) {
+      encode(key, parts);
+      encode(value[key], parts);
+    }
+    return;
+  }
+  parts.push(new Uint8Array([192]));
+}
+function encodeInt(value, parts) {
+  if (value >= 0) {
+    if (value < 128) {
+      parts.push(new Uint8Array([value]));
+    } else if (value < 256) {
+      parts.push(new Uint8Array([204, value]));
+    } else if (value < 65536) {
+      parts.push(new Uint8Array([205, value >> 8, value & 255]));
+    } else if (value < 4294967296) {
+      parts.push(new Uint8Array([206, value >> 24 & 255, value >> 16 & 255, value >> 8 & 255, value & 255]));
+    } else {
+      const buf = new Uint8Array(9);
+      buf[0] = 203;
+      new DataView(buf.buffer).setFloat64(1, value, false);
+      parts.push(buf);
+    }
+  } else {
+    if (value >= -32) {
+      parts.push(new Uint8Array([value & 255]));
+    } else if (value >= -128) {
+      parts.push(new Uint8Array([208, value & 255]));
+    } else if (value >= -32768) {
+      const buf = new Uint8Array(3);
+      buf[0] = 209;
+      new DataView(buf.buffer).setInt16(1, value, false);
+      parts.push(buf);
+    } else if (value >= -2147483648) {
+      const buf = new Uint8Array(5);
+      buf[0] = 210;
+      new DataView(buf.buffer).setInt32(1, value, false);
+      parts.push(buf);
+    } else {
+      const buf = new Uint8Array(9);
+      buf[0] = 203;
+      new DataView(buf.buffer).setFloat64(1, value, false);
+      parts.push(buf);
+    }
+  }
+}
+function msgpackDecode(buf) {
+  const result = decodeAt(buf, 0);
+  return result.value;
+}
+function decodeAt(buf, offset) {
+  if (offset >= buf.length) return { value: null, offset };
+  const byte = buf[offset];
+  const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+  if (byte < 128) return { value: byte, offset: offset + 1 };
+  if (byte >= 128 && byte <= 143) return decodeMap(buf, offset + 1, byte & 15);
+  if (byte >= 144 && byte <= 159) return decodeArray(buf, offset + 1, byte & 15);
+  if (byte >= 160 && byte <= 191) {
+    const len = byte & 31;
+    const str = decoder.decode(buf.subarray(offset + 1, offset + 1 + len));
+    return { value: str, offset: offset + 1 + len };
+  }
+  if (byte >= 224) return { value: byte - 256, offset: offset + 1 };
+  switch (byte) {
+    // nil
+    case 192:
+      return { value: null, offset: offset + 1 };
+    // false
+    case 194:
+      return { value: false, offset: offset + 1 };
+    // true
+    case 195:
+      return { value: true, offset: offset + 1 };
+    // bin 8
+    case 196: {
+      const len = buf[offset + 1];
+      return { value: buf.slice(offset + 2, offset + 2 + len), offset: offset + 2 + len };
+    }
+    // bin 16
+    case 197: {
+      const len = view.getUint16(offset + 1, false);
+      return { value: buf.slice(offset + 3, offset + 3 + len), offset: offset + 3 + len };
+    }
+    // bin 32
+    case 198: {
+      const len = view.getUint32(offset + 1, false);
+      return { value: buf.slice(offset + 5, offset + 5 + len), offset: offset + 5 + len };
+    }
+    // float 64
+    case 203:
+      return { value: view.getFloat64(offset + 1, false), offset: offset + 9 };
+    // uint 8
+    case 204:
+      return { value: buf[offset + 1], offset: offset + 2 };
+    // uint 16
+    case 205:
+      return { value: view.getUint16(offset + 1, false), offset: offset + 3 };
+    // uint 32
+    case 206:
+      return { value: view.getUint32(offset + 1, false), offset: offset + 5 };
+    // int 8
+    case 208:
+      return { value: view.getInt8(offset + 1), offset: offset + 2 };
+    // int 16
+    case 209:
+      return { value: view.getInt16(offset + 1, false), offset: offset + 3 };
+    // int 32
+    case 210:
+      return { value: view.getInt32(offset + 1, false), offset: offset + 5 };
+    // str 8
+    case 217: {
+      const len = buf[offset + 1];
+      return { value: decoder.decode(buf.subarray(offset + 2, offset + 2 + len)), offset: offset + 2 + len };
+    }
+    // str 16
+    case 218: {
+      const len = view.getUint16(offset + 1, false);
+      return { value: decoder.decode(buf.subarray(offset + 3, offset + 3 + len)), offset: offset + 3 + len };
+    }
+    // str 32
+    case 219: {
+      const len = view.getUint32(offset + 1, false);
+      return { value: decoder.decode(buf.subarray(offset + 5, offset + 5 + len)), offset: offset + 5 + len };
+    }
+    // array 16
+    case 220:
+      return decodeArray(buf, offset + 3, view.getUint16(offset + 1, false));
+    // array 32
+    case 221:
+      return decodeArray(buf, offset + 5, view.getUint32(offset + 1, false));
+    // map 16
+    case 222:
+      return decodeMap(buf, offset + 3, view.getUint16(offset + 1, false));
+    // map 32
+    case 223:
+      return decodeMap(buf, offset + 5, view.getUint32(offset + 1, false));
+  }
+  return { value: null, offset: offset + 1 };
+}
+function decodeArray(buf, offset, count) {
+  const arr = new Array(count);
+  for (let i = 0; i < count; i++) {
+    const result = decodeAt(buf, offset);
+    arr[i] = result.value;
+    offset = result.offset;
+  }
+  return { value: arr, offset };
+}
+function decodeMap(buf, offset, count) {
+  const obj = {};
+  for (let i = 0; i < count; i++) {
+    const keyResult = decodeAt(buf, offset);
+    offset = keyResult.offset;
+    const valResult = decodeAt(buf, offset);
+    offset = valResult.offset;
+    obj[String(keyResult.value)] = valResult.value;
+  }
+  return { value: obj, offset };
+}
+var msgpackCodec = {
+  encode: msgpackEncode,
+  decode: msgpackDecode
+};
+var jsonCodec = {
+  encode(data) {
+    return encoder.encode(JSON.stringify(data));
+  },
+  decode(buf) {
+    return JSON.parse(decoder.decode(buf));
+  }
+};
+function resolveCodec(option) {
+  if (!option || option === "msgpack") return msgpackCodec;
+  if (option === "json") return jsonCodec;
+  return option;
+}
+var textEncoder = encoder;
+function buildRoomFrame(frameType, componentId, roomId, event, payload) {
+  const compIdBytes = textEncoder.encode(componentId);
+  const roomIdBytes = textEncoder.encode(roomId);
+  const eventBytes = textEncoder.encode(event);
+  const totalLen = 1 + 1 + compIdBytes.length + 1 + roomIdBytes.length + 2 + eventBytes.length + payload.length;
+  const frame = new Uint8Array(totalLen);
+  let offset = 0;
+  frame[offset++] = frameType;
+  frame[offset++] = compIdBytes.length;
+  frame.set(compIdBytes, offset);
+  offset += compIdBytes.length;
+  frame[offset++] = roomIdBytes.length;
+  frame.set(roomIdBytes, offset);
+  offset += roomIdBytes.length;
+  frame[offset++] = eventBytes.length >> 8 & 255;
+  frame[offset++] = eventBytes.length & 255;
+  frame.set(eventBytes, offset);
+  offset += eventBytes.length;
+  frame.set(payload, offset);
+  return frame;
+}
+function buildRoomFrameTail(roomId, event, payload) {
+  const roomIdBytes = textEncoder.encode(roomId);
+  const eventBytes = textEncoder.encode(event);
+  const tailLen = 1 + roomIdBytes.length + 2 + eventBytes.length + payload.length;
+  const tail = new Uint8Array(tailLen);
+  let offset = 0;
+  tail[offset++] = roomIdBytes.length;
+  tail.set(roomIdBytes, offset);
+  offset += roomIdBytes.length;
+  tail[offset++] = eventBytes.length >> 8 & 255;
+  tail[offset++] = eventBytes.length & 255;
+  tail.set(eventBytes, offset);
+  offset += eventBytes.length;
+  tail.set(payload, offset);
+  return tail;
+}
+function prependMemberHeader(frameType, componentId, tail) {
+  const compIdBytes = textEncoder.encode(componentId);
+  const frame = new Uint8Array(1 + 1 + compIdBytes.length + tail.length);
+  frame[0] = frameType;
+  frame[1] = compIdBytes.length;
+  frame.set(compIdBytes, 2);
+  frame.set(tail, 2 + compIdBytes.length);
+  return frame;
+}
+function parseRoomFrame(buf) {
+  if (buf.length < 6) return null;
+  let offset = 0;
+  const frameType = buf[offset++];
+  const compIdLen = buf[offset++];
+  if (offset + compIdLen > buf.length) return null;
+  const componentId = decoder.decode(buf.subarray(offset, offset + compIdLen));
+  offset += compIdLen;
+  const roomIdLen = buf[offset++];
+  if (offset + roomIdLen > buf.length) return null;
+  const roomId = decoder.decode(buf.subarray(offset, offset + roomIdLen));
+  offset += roomIdLen;
+  if (offset + 2 > buf.length) return null;
+  const eventLen = buf[offset] << 8 | buf[offset + 1];
+  offset += 2;
+  if (offset + eventLen > buf.length) return null;
+  const event = decoder.decode(buf.subarray(offset, offset + eventLen));
+  offset += eventLen;
+  const payload = buf.subarray(offset);
+  return { frameType, componentId, roomId, event, payload };
+}
 
 // src/rooms/LiveRoomManager.ts
 var LiveRoomManager = class {
-  // componentId -> roomIds
-  constructor(roomEvents) {
+  /**
+   * @param roomEvents - Local server-side event bus
+   * @param pubsub - Optional cross-instance pub/sub adapter (e.g. Redis).
+   *                 When provided, room events/state/membership are propagated
+   *                 to other server instances in the background.
+   */
+  constructor(roomEvents, pubsub) {
     this.roomEvents = roomEvents;
+    this.pubsub = pubsub;
   }
   rooms = /* @__PURE__ */ new Map();
   componentRooms = /* @__PURE__ */ new Map();
+  // componentId -> roomIds
+  /** Room registry for LiveRoom class lookup. Set by LiveServer. */
+  roomRegistry;
   /**
-   * Component joins a room
+   * Component joins a room.
+   * @param options.deepDiff - Enable/disable deep diff for this room's state. Default: true
+   * @param joinContext - Optional context for LiveRoom lifecycle hooks (userId, payload)
    */
-  joinRoom(componentId, roomId, ws, initialState) {
-    if (!roomId || !/^[a-zA-Z0-9_:.-]{1,64}$/.test(roomId)) {
+  joinRoom(componentId, roomId, ws, initialState, options, joinContext) {
+    if (!roomId || !ROOM_NAME_REGEX.test(roomId)) {
       throw new Error("Invalid room name. Must be 1-64 alphanumeric characters, hyphens, underscores, dots, or colons.");
     }
-    if (!this.rooms.has(roomId)) {
-      this.rooms.set(roomId, {
-        id: roomId,
-        state: initialState || {},
-        members: /* @__PURE__ */ new Map(),
-        createdAt: Date.now(),
-        lastActivity: Date.now()
-      });
+    const now = Date.now();
+    let room = this.rooms.get(roomId);
+    let isNewRoom = false;
+    if (!room) {
+      isNewRoom = true;
+      const roomClass = this.roomRegistry?.resolveFromId(roomId);
+      if (roomClass) {
+        const instance = new roomClass(roomId, this);
+        const opts = roomClass.$options ?? {};
+        room = {
+          id: roomId,
+          state: instance.state,
+          members: /* @__PURE__ */ new Map(),
+          createdAt: now,
+          lastActivity: now,
+          deepDiff: opts.deepDiff ?? true,
+          deepDiffDepth: opts.deepDiffDepth ?? 3,
+          serverOnlyState: true,
+          // LiveRoom-backed rooms are always server-only
+          instance,
+          codec: resolveCodec(opts.codec)
+        };
+      } else {
+        room = {
+          id: roomId,
+          state: initialState || {},
+          members: /* @__PURE__ */ new Map(),
+          createdAt: now,
+          lastActivity: now,
+          deepDiff: options?.deepDiff ?? true,
+          deepDiffDepth: options?.deepDiffDepth ?? 3,
+          serverOnlyState: options?.serverOnlyState ?? false,
+          codec: null
+        };
+      }
+      this.rooms.set(roomId, room);
       liveLog("rooms", componentId, `Room '${roomId}' created`);
     }
-    const room = this.rooms.get(roomId);
+    if (room.instance) {
+      const ctor = room.instance.constructor;
+      const maxMembers = ctor.$options?.maxMembers;
+      if (maxMembers && room.members.size >= maxMembers) {
+        return { rejected: true, reason: "Room is full" };
+      }
+    }
+    if (room.instance) {
+      const result = room.instance.onJoin({
+        componentId,
+        userId: joinContext?.userId,
+        payload: joinContext?.payload
+      });
+      if (result === false) {
+        if (isNewRoom) {
+          this.rooms.delete(roomId);
+        }
+        return { rejected: true, reason: "Join rejected by room" };
+      }
+    }
+    if (isNewRoom && room.instance) {
+      room.instance.onCreate();
+    }
     room.members.set(componentId, {
       componentId,
       ws,
-      joinedAt: Date.now()
+      joinedAt: now
     });
-    room.lastActivity = Date.now();
-    if (!this.componentRooms.has(componentId)) {
-      this.componentRooms.set(componentId, /* @__PURE__ */ new Set());
-    }
-    this.componentRooms.get(componentId).add(roomId);
-    liveLog("rooms", componentId, `Component '${componentId}' joined room '${roomId}' (${room.members.size} members)`);
+    room.lastActivity = now;
+    let compRooms = this.componentRooms.get(componentId);
+    if (!compRooms) {
+      compRooms = /* @__PURE__ */ new Set();
+      this.componentRooms.set(componentId, compRooms);
+    }
+    compRooms.add(roomId);
+    const memberCount = room.members.size;
+    liveLog("rooms", componentId, `Component '${componentId}' joined room '${roomId}' (${memberCount} members)`);
     this.broadcastToRoom(roomId, {
       type: "ROOM_SYSTEM",
       componentId,
@@ -296,22 +881,33 @@ var LiveRoomManager = class {
       event: "$sub:join",
       data: {
         subscriberId: componentId,
-        count: room.members.size
+        count: memberCount
       },
-      timestamp: Date.now()
+      timestamp: now
     }, componentId);
+    this.pubsub?.publishMembership(roomId, "join", componentId)?.catch(() => {
+    });
     return { state: room.state };
   }
   /**
    * Component leaves a room
+   * @param leaveReason - Why the component is leaving. Default: 'leave'
    */
-  leaveRoom(componentId, roomId) {
+  leaveRoom(componentId, roomId, leaveReason = "leave") {
     const room = this.rooms.get(roomId);
     if (!room) return;
+    if (room.instance) {
+      room.instance.onLeave({
+        componentId,
+        reason: leaveReason
+      });
+    }
     room.members.delete(componentId);
-    room.lastActivity = Date.now();
+    const now = Date.now();
+    room.lastActivity = now;
     this.componentRooms.get(componentId)?.delete(roomId);
-    liveLog("rooms", componentId, `Component '${componentId}' left room '${roomId}' (${room.members.size} members)`);
+    const memberCount = room.members.size;
+    liveLog("rooms", componentId, `Component '${componentId}' left room '${roomId}' (${memberCount} members)`);
     this.broadcastToRoom(roomId, {
       type: "ROOM_SYSTEM",
       componentId,
@@ -319,14 +915,20 @@ var LiveRoomManager = class {
       event: "$sub:leave",
       data: {
         subscriberId: componentId,
-        count: room.members.size
+        count: memberCount
       },
-      timestamp: Date.now()
+      timestamp: now
     });
-    if (room.members.size === 0) {
+    this.pubsub?.publishMembership(roomId, "leave", componentId)?.catch(() => {
+    });
+    if (memberCount === 0) {
       setTimeout(() => {
         const currentRoom = this.rooms.get(roomId);
         if (currentRoom && currentRoom.members.size === 0) {
+          if (currentRoom.instance) {
+            const result = currentRoom.instance.onDestroy();
+            if (result === false) return;
+          }
           this.rooms.delete(roomId);
           liveLog("rooms", null, `Room '${roomId}' destroyed (empty)`);
         }
@@ -334,53 +936,143 @@ var LiveRoomManager = class {
     }
   }
   /**
-   * Component disconnects - leave all rooms
+   * Component disconnects - leave all rooms.
+   * Batches removals: calls onLeave hooks, removes member from all rooms,
+   * then sends leave notifications in bulk.
    */
   cleanupComponent(componentId) {
-    const rooms = this.componentRooms.get(componentId);
-    if (!rooms) return;
-    for (const roomId of rooms) {
-      this.leaveRoom(componentId, roomId);
+    const roomIds = this.componentRooms.get(componentId);
+    if (!roomIds || roomIds.size === 0) return;
+    const now = Date.now();
+    const notifications = [];
+    for (const roomId of roomIds) {
+      const room = this.rooms.get(roomId);
+      if (!room) continue;
+      if (room.instance) {
+        room.instance.onLeave({
+          componentId,
+          reason: "disconnect"
+        });
+      }
+      room.members.delete(componentId);
+      room.lastActivity = now;
+      const memberCount = room.members.size;
+      if (memberCount > 0) {
+        notifications.push({ roomId, count: memberCount });
+      } else {
+        setTimeout(() => {
+          const currentRoom = this.rooms.get(roomId);
+          if (currentRoom && currentRoom.members.size === 0) {
+            if (currentRoom.instance) {
+              const result = currentRoom.instance.onDestroy();
+              if (result === false) return;
+            }
+            this.rooms.delete(roomId);
+            liveLog("rooms", null, `Room '${roomId}' destroyed (empty)`);
+          }
+        }, 5 * 60 * 1e3);
+      }
+    }
+    for (const { roomId, count } of notifications) {
+      this.broadcastToRoom(roomId, {
+        type: "ROOM_SYSTEM",
+        componentId,
+        roomId,
+        event: "$sub:leave",
+        data: {
+          subscriberId: componentId,
+          count
+        },
+        timestamp: now
+      });
     }
     this.componentRooms.delete(componentId);
   }
   /**
-   * Emit event to all members in a room
+   * Emit event to all members in a room.
+   * For LiveRoom-backed rooms, calls onEvent() hook before broadcasting.
    */
   emitToRoom(roomId, event, data, excludeComponentId) {
     const room = this.rooms.get(roomId);
     if (!room) return 0;
-    room.lastActivity = Date.now();
+    const now = Date.now();
+    room.lastActivity = now;
+    if (room.instance) {
+      room.instance.onEvent(event, data, {
+        componentId: excludeComponentId ?? ""
+      });
+    }
     this.roomEvents.emit("room", roomId, event, data, excludeComponentId);
+    this.pubsub?.publish(roomId, event, data)?.catch(() => {
+    });
     return this.broadcastToRoom(roomId, {
       type: "ROOM_EVENT",
       componentId: "",
       roomId,
       event,
       data,
-      timestamp: Date.now()
+      timestamp: now
     }, excludeComponentId);
   }
   /**
-   * Update room state
+   * Update room state.
+   * When deepDiff is enabled (default), deep-diffs plain objects to send only changed fields.
+   * When disabled, uses shallow diff (reference equality) like classic behavior.
    */
   setRoomState(roomId, updates, excludeComponentId) {
     const room = this.rooms.get(roomId);
     if (!room) return;
-    const newState = { ...room.state, ...updates };
-    const stateSize = Buffer.byteLength(JSON.stringify(newState), "utf8");
-    if (stateSize > MAX_ROOM_STATE_SIZE) {
-      throw new Error("Room state exceeds maximum size limit");
+    let actualChanges;
+    if (room.deepDiff) {
+      const diff = computeDeepDiff(
+        room.state,
+        updates,
+        0,
+        room.deepDiffDepth
+      );
+      if (diff === null) return;
+      actualChanges = diff;
+      deepAssign(room.state, actualChanges);
+    } else {
+      actualChanges = {};
+      let hasChanges = false;
+      for (const key of Object.keys(updates)) {
+        if (room.state[key] !== updates[key]) {
+          actualChanges[key] = updates[key];
+          hasChanges = true;
+        }
+      }
+      if (!hasChanges) return;
+      Object.assign(room.state, actualChanges);
+    }
+    if (room.stateSize === void 0) {
+      const fullJson = JSON.stringify(room.state);
+      room.stateSize = fullJson.length;
+      if (room.stateSize > MAX_ROOM_STATE_SIZE) {
+        throw new Error("Room state exceeds maximum size limit");
+      }
+    } else {
+      const deltaSize = JSON.stringify(actualChanges).length;
+      room.stateSize += deltaSize;
+      if (room.stateSize > MAX_ROOM_STATE_SIZE) {
+        const precise = JSON.stringify(room.state).length;
+        room.stateSize = precise;
+        if (precise > MAX_ROOM_STATE_SIZE) {
+          throw new Error("Room state exceeds maximum size limit");
+        }
+      }
     }
-    room.state = newState;
-    room.lastActivity = Date.now();
+    const now = Date.now();
+    room.lastActivity = now;
+    this.pubsub?.publishStateChange(roomId, actualChanges)?.catch(() => {
+    });
     this.broadcastToRoom(roomId, {
       type: "ROOM_STATE",
       componentId: "",
       roomId,
       event: "$state:update",
-      data: { state: updates },
-      timestamp: Date.now()
+      data: { state: actualChanges },
+      timestamp: now
     }, excludeComponentId);
   }
   /**
@@ -390,24 +1082,40 @@ var LiveRoomManager = class {
     return this.rooms.get(roomId)?.state || {};
   }
   /**
-   * Broadcast to all members in a room
+   * Broadcast to all members in a room.
+   *
+   * When the room has a binary codec (LiveRoom-backed), builds a binary frame
+   * once (encode payload + frame tail), then prepends per-member componentId header.
+   *
+   * When no codec (legacy rooms), uses JSON with serialize-once optimization:
+   * builds the JSON string template once, then inserts each member's componentId.
    */
   broadcastToRoom(roomId, message, excludeComponentId) {
     const room = this.rooms.get(roomId);
-    if (!room) return 0;
+    if (!room || room.members.size === 0) return 0;
     let sent = 0;
-    for (const [componentId, member] of room.members) {
-      if (excludeComponentId && componentId === excludeComponentId) continue;
-      try {
-        if (member.ws && member.ws.readyState === 1) {
-          member.ws.send(JSON.stringify({
-            ...message,
-            componentId
-          }));
-          sent++;
-        }
-      } catch (error) {
-        console.error(`Failed to send to ${componentId}:`, error);
+    if (room.codec) {
+      const frameType = message.type === "ROOM_EVENT" || message.type === "ROOM_SYSTEM" ? BINARY_ROOM_EVENT : BINARY_ROOM_STATE;
+      const event = message.event ?? "";
+      const payload = room.codec.encode(message.data);
+      const tail = buildRoomFrameTail(roomId, event, payload);
+      for (const [memberComponentId, member] of room.members) {
+        if (memberComponentId === excludeComponentId) continue;
+        if (member.ws.readyState !== 1) continue;
+        const frame = prependMemberHeader(frameType, memberComponentId, tail);
+        sendBinaryImmediate(member.ws, frame);
+        sent++;
+      }
+    } else {
+      const { componentId: _, ...rest } = message;
+      const jsonBody = JSON.stringify(rest);
+      const prefix = '{"componentId":"';
+      const suffix = '",' + jsonBody.slice(1);
+      for (const [memberComponentId, member] of room.members) {
+        if (memberComponentId === excludeComponentId) continue;
+        if (member.ws.readyState !== 1) continue;
+        queuePreSerialized(member.ws, prefix + memberComponentId + suffix);
+        sent++;
       }
     }
     return sent;
@@ -418,12 +1126,31 @@ var LiveRoomManager = class {
   isInRoom(componentId, roomId) {
     return this.rooms.get(roomId)?.members.has(componentId) ?? false;
   }
+  /**
+   * Check if room state is server-only (no client writes)
+   */
+  isServerOnlyState(roomId) {
+    return this.rooms.get(roomId)?.serverOnlyState ?? false;
+  }
   /**
    * Get rooms for a component
    */
   getComponentRooms(componentId) {
     return Array.from(this.componentRooms.get(componentId) || []);
   }
+  /**
+   * Get member count for a room
+   */
+  getMemberCount(roomId) {
+    return this.rooms.get(roomId)?.members.size ?? 0;
+  }
+  /**
+   * Get the LiveRoom instance for a room (if backed by a typed room class).
+   * Used by ComponentRoomProxy to expose custom methods.
+   */
+  getRoomInstance(roomId) {
+    return this.rooms.get(roomId)?.instance;
+  }
   /**
    * Get statistics
    */
@@ -443,329 +1170,59 @@ var LiveRoomManager = class {
   }
 };
 
-// src/debug/LiveDebugger.ts
-var MAX_EVENTS = 500;
-var MAX_STATE_SIZE = 5e4;
-var LiveDebugger = class {
-  events = [];
-  componentSnapshots = /* @__PURE__ */ new Map();
-  debugClients = /* @__PURE__ */ new Set();
-  _enabled = false;
-  startTime = Date.now();
-  eventCounter = 0;
-  constructor(enabled = false) {
-    this._enabled = enabled;
-  }
-  get enabled() {
-    return this._enabled;
-  }
-  set enabled(value) {
-    this._enabled = value;
-  }
-  // ===== Event Emission =====
-  emit(type, componentId, componentName, data = {}) {
-    if (!this._enabled) return;
-    const event = {
-      id: `dbg-${++this.eventCounter}`,
-      timestamp: Date.now(),
-      type,
-      componentId,
-      componentName,
-      data: this.sanitizeData(data)
-    };
-    this.events.push(event);
-    if (this.events.length > MAX_EVENTS) {
-      this.events.shift();
-    }
-    if (componentId) {
-      this.updateSnapshot(event);
-    }
-    this.broadcastEvent(event);
+// src/auth/LiveAuthContext.ts
+var AuthenticatedContext = class {
+  authenticated = true;
+  user;
+  token;
+  authenticatedAt;
+  constructor(user, token) {
+    this.user = user;
+    this.token = token;
+    this.authenticatedAt = Date.now();
   }
-  // ===== Component Tracking =====
-  trackComponentMount(componentId, componentName, initialState, room, debugLabel) {
-    if (!this._enabled) return;
-    const snapshot = {
-      componentId,
-      componentName,
-      debugLabel,
-      state: this.sanitizeState(initialState),
-      rooms: room ? [room] : [],
-      mountedAt: Date.now(),
-      lastActivity: Date.now(),
-      actionCount: 0,
-      stateChangeCount: 0,
-      errorCount: 0
-    };
-    this.componentSnapshots.set(componentId, snapshot);
-    this.emit("COMPONENT_MOUNT", componentId, componentName, {
-      initialState: snapshot.state,
-      room: room ?? null,
-      debugLabel: debugLabel ?? null
-    });
+  hasRole(role) {
+    return this.user.roles?.includes(role) ?? false;
   }
-  trackComponentUnmount(componentId) {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    const componentName = snapshot?.componentName ?? null;
-    this.emit("COMPONENT_UNMOUNT", componentId, componentName, {
-      lifetime: snapshot ? Date.now() - snapshot.mountedAt : 0,
-      totalActions: snapshot?.actionCount ?? 0,
-      totalStateChanges: snapshot?.stateChangeCount ?? 0,
-      totalErrors: snapshot?.errorCount ?? 0
-    });
-    this.componentSnapshots.delete(componentId);
-  }
-  trackStateChange(componentId, delta, fullState, source = "setState") {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    if (snapshot) {
-      snapshot.state = this.sanitizeState(fullState);
-      snapshot.stateChangeCount++;
-      snapshot.lastActivity = Date.now();
-    }
-    this.emit("STATE_CHANGE", componentId, snapshot?.componentName ?? null, {
-      delta,
-      fullState: this.sanitizeState(fullState),
-      source
-    });
+  hasAnyRole(roles) {
+    if (!this.user.roles?.length) return false;
+    return roles.some((role) => this.user.roles.includes(role));
   }
-  trackActionCall(componentId, action, payload) {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    if (snapshot) {
-      snapshot.actionCount++;
-      snapshot.lastActivity = Date.now();
-    }
-    this.emit("ACTION_CALL", componentId, snapshot?.componentName ?? null, {
-      action,
-      payload: this.sanitizeData({ payload }).payload
-    });
+  hasAllRoles(roles) {
+    if (!this.user.roles?.length) return roles.length === 0;
+    return roles.every((role) => this.user.roles.includes(role));
   }
-  trackActionResult(componentId, action, result, duration) {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    this.emit("ACTION_RESULT", componentId, snapshot?.componentName ?? null, {
-      action,
-      result: this.sanitizeData({ result }).result,
-      duration
-    });
+  hasPermission(permission) {
+    return this.user.permissions?.includes(permission) ?? false;
   }
-  trackActionError(componentId, action, error, duration) {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    if (snapshot) {
-      snapshot.errorCount++;
-    }
-    this.emit("ACTION_ERROR", componentId, snapshot?.componentName ?? null, {
-      action,
-      error,
-      duration
-    });
+  hasAllPermissions(permissions) {
+    if (!this.user.permissions?.length) return permissions.length === 0;
+    return permissions.every((perm) => this.user.permissions.includes(perm));
   }
-  trackRoomJoin(componentId, roomId) {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    if (snapshot && !snapshot.rooms.includes(roomId)) {
-      snapshot.rooms.push(roomId);
-    }
-    this.emit("ROOM_JOIN", componentId, snapshot?.componentName ?? null, { roomId });
+  hasAnyPermission(permissions) {
+    if (!this.user.permissions?.length) return false;
+    return permissions.some((perm) => this.user.permissions.includes(perm));
   }
-  trackRoomLeave(componentId, roomId) {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    if (snapshot) {
-      snapshot.rooms = snapshot.rooms.filter((r) => r !== roomId);
-    }
-    this.emit("ROOM_LEAVE", componentId, snapshot?.componentName ?? null, { roomId });
+};
+var AnonymousContext = class {
+  authenticated = false;
+  user = void 0;
+  token = void 0;
+  authenticatedAt = void 0;
+  hasRole() {
+    return false;
   }
-  trackRoomEmit(componentId, roomId, event, data) {
-    if (!this._enabled) return;
-    const snapshot = this.componentSnapshots.get(componentId);
-    this.emit("ROOM_EMIT", componentId, snapshot?.componentName ?? null, {
-      roomId,
-      event,
-      data: this.sanitizeData({ data }).data
-    });
+  hasAnyRole() {
+    return false;
   }
-  trackConnection(connectionId) {
-    if (!this._enabled) return;
-    this.emit("WS_CONNECT", null, null, { connectionId });
+  hasAllRoles() {
+    return false;
   }
-  trackDisconnection(connectionId, componentCount) {
-    if (!this._enabled) return;
-    this.emit("WS_DISCONNECT", null, null, { connectionId, componentCount });
+  hasPermission() {
+    return false;
   }
-  trackError(componentId, error, context) {
-    if (!this._enabled) return;
-    const snapshot = componentId ? this.componentSnapshots.get(componentId) : null;
-    if (snapshot) {
-      snapshot.errorCount++;
-    }
-    this.emit("ERROR", componentId, snapshot?.componentName ?? null, {
-      error,
-      ...context
-    });
-  }
-  // ===== Debug Client Management =====
-  registerDebugClient(ws) {
-    if (!this._enabled) {
-      const disabled = {
-        type: "DEBUG_DISABLED",
-        enabled: false,
-        timestamp: Date.now()
-      };
-      ws.send(JSON.stringify(disabled));
-      ws.close();
-      return;
-    }
-    this.debugClients.add(ws);
-    const welcome = {
-      type: "DEBUG_WELCOME",
-      enabled: true,
-      snapshot: this.getSnapshot(),
-      timestamp: Date.now()
-    };
-    ws.send(JSON.stringify(welcome));
-    for (const event of this.events.slice(-100)) {
-      const msg = {
-        type: "DEBUG_EVENT",
-        event,
-        timestamp: Date.now()
-      };
-      ws.send(JSON.stringify(msg));
-    }
-  }
-  unregisterDebugClient(ws) {
-    this.debugClients.delete(ws);
-  }
-  // ===== Snapshot =====
-  getSnapshot() {
-    return {
-      components: Array.from(this.componentSnapshots.values()),
-      connections: this.debugClients.size,
-      uptime: Date.now() - this.startTime,
-      totalEvents: this.eventCounter
-    };
-  }
-  getComponentState(componentId) {
-    return this.componentSnapshots.get(componentId) ?? null;
-  }
-  getEvents(filter) {
-    let filtered = this.events;
-    if (filter?.componentId) {
-      filtered = filtered.filter((e) => e.componentId === filter.componentId);
-    }
-    if (filter?.type) {
-      filtered = filtered.filter((e) => e.type === filter.type);
-    }
-    const limit = filter?.limit ?? 100;
-    return filtered.slice(-limit);
-  }
-  clearEvents() {
-    this.events = [];
-  }
-  // ===== Internal =====
-  broadcastEvent(event) {
-    if (this.debugClients.size === 0) return;
-    const msg = {
-      type: "DEBUG_EVENT",
-      event,
-      timestamp: Date.now()
-    };
-    const json = JSON.stringify(msg);
-    for (const client of this.debugClients) {
-      try {
-        client.send(json);
-      } catch {
-        this.debugClients.delete(client);
-      }
-    }
-  }
-  sanitizeData(data) {
-    try {
-      const json = JSON.stringify(data);
-      if (json.length > MAX_STATE_SIZE) {
-        return { _truncated: true, _size: json.length, _preview: json.slice(0, 500) + "..." };
-      }
-      return JSON.parse(json);
-    } catch {
-      return { _serialization_error: true };
-    }
-  }
-  sanitizeState(state) {
-    try {
-      const json = JSON.stringify(state);
-      if (json.length > MAX_STATE_SIZE) {
-        return { _truncated: true, _size: json.length };
-      }
-      return JSON.parse(json);
-    } catch {
-      return { _serialization_error: true };
-    }
-  }
-  updateSnapshot(event) {
-    if (!event.componentId) return;
-    const snapshot = this.componentSnapshots.get(event.componentId);
-    if (snapshot) {
-      snapshot.lastActivity = event.timestamp;
-    }
-  }
-};
-
-// src/auth/LiveAuthContext.ts
-var AuthenticatedContext = class {
-  authenticated = true;
-  user;
-  token;
-  authenticatedAt;
-  constructor(user, token) {
-    this.user = user;
-    this.token = token;
-    this.authenticatedAt = Date.now();
-  }
-  hasRole(role) {
-    return this.user.roles?.includes(role) ?? false;
-  }
-  hasAnyRole(roles) {
-    if (!this.user.roles?.length) return false;
-    return roles.some((role) => this.user.roles.includes(role));
-  }
-  hasAllRoles(roles) {
-    if (!this.user.roles?.length) return roles.length === 0;
-    return roles.every((role) => this.user.roles.includes(role));
-  }
-  hasPermission(permission) {
-    return this.user.permissions?.includes(permission) ?? false;
-  }
-  hasAllPermissions(permissions) {
-    if (!this.user.permissions?.length) return permissions.length === 0;
-    return permissions.every((perm) => this.user.permissions.includes(perm));
-  }
-  hasAnyPermission(permissions) {
-    if (!this.user.permissions?.length) return false;
-    return permissions.some((perm) => this.user.permissions.includes(perm));
-  }
-};
-var AnonymousContext = class {
-  authenticated = false;
-  user = void 0;
-  token = void 0;
-  authenticatedAt = void 0;
-  hasRole() {
-    return false;
-  }
-  hasAnyRole() {
-    return false;
-  }
-  hasAllRoles() {
-    return false;
-  }
-  hasPermission() {
-    return false;
-  }
-  hasAllPermissions() {
-    return false;
+  hasAllPermissions() {
+    return false;
   }
   hasAnyPermission() {
     return false;
@@ -853,15 +1310,21 @@ var LiveAuthManager = class {
         providersToTry.push(provider);
       }
     }
+    const errors = [];
     for (const provider of providersToTry) {
       try {
         const context = await provider.authenticate(credentials);
         if (context && context.authenticated) {
           return context;
         }
-      } catch {
+      } catch (error) {
+        console.warn(`[Auth] Provider '${provider.name}' threw during authentication:`, error.message);
+        errors.push({ provider: provider.name, error });
       }
     }
+    if (errors.length > 0) {
+      console.warn(`[Auth] All ${providersToTry.length} provider(s) failed. Errors: ${errors.map((e) => `${e.provider}: ${e.error.message}`).join("; ")}`);
+    }
     return ANONYMOUS_CONTEXT;
   }
   /**
@@ -959,10 +1422,13 @@ var StateSignatureManager = class {
   secret;
   previousSecrets = [];
   rotationTimer;
-  usedNonces = /* @__PURE__ */ new Set();
-  nonceCleanupTimer;
   stateBackups = /* @__PURE__ */ new Map();
   config;
+  encryptionSalt;
+  cachedEncryptionKey = null;
+  /** Replay detection: nonce → timestamp when it was first seen. Cleaned every 60s. */
+  usedNonces = /* @__PURE__ */ new Map();
+  nonceCleanupTimer;
   constructor(config = {}) {
     const defaultSecret = typeof process !== "undefined" ? process.env?.LIVE_STATE_SECRET : void 0;
     this.config = {
@@ -972,23 +1438,65 @@ var StateSignatureManager = class {
       compressionEnabled: config.compressionEnabled ?? true,
       encryptionEnabled: config.encryptionEnabled ?? false,
       nonceEnabled: config.nonceEnabled ?? false,
-      maxStateAge: config.maxStateAge ?? 7 * 24 * 60 * 60 * 1e3,
+      maxStateAge: config.maxStateAge ?? 30 * 60 * 1e3,
       backupEnabled: config.backupEnabled ?? true,
-      maxBackups: config.maxBackups ?? 3
+      maxBackups: config.maxBackups ?? 3,
+      nonceTTL: config.nonceTTL ?? 5 * 60 * 1e3
     };
     if (!this.config.secret) {
       this.config.secret = randomBytes(32).toString("hex");
       liveWarn("state", null, "No LIVE_STATE_SECRET provided. Using random key (state will not persist across restarts).");
     }
     this.secret = Buffer.from(this.config.secret, "utf-8");
+    this.encryptionSalt = randomBytes(16);
     if (this.config.rotationEnabled) {
       this.setupKeyRotation();
     }
     if (this.config.nonceEnabled) {
-      this.nonceCleanupTimer = setInterval(() => this.cleanupNonces(), 60 * 60 * 1e3);
+      this.nonceCleanupTimer = setInterval(() => this.cleanupNonces(), this.config.nonceTTL + 10 * 1e3);
+    }
+  }
+  /**
+   * Generate a hybrid nonce: `timestamp:random:HMAC(timestamp:random, secret)`
+   * Self-validating via HMAC, unique via random bytes, replay-tracked via Map.
+   */
+  generateNonce() {
+    const ts = Date.now().toString();
+    const rand = randomBytes(8).toString("hex");
+    const payload = `${ts}:${rand}`;
+    const mac = createHmac("sha256", this.secret).update(payload).digest("hex").slice(0, 16);
+    return `${ts}:${rand}:${mac}`;
+  }
+  /**
+   * Validate a hybrid nonce: check format, HMAC, and TTL.
+   */
+  validateNonce(nonce) {
+    const parts = nonce.split(":");
+    if (parts.length !== 3) return { valid: false, error: "Malformed nonce" };
+    const [ts, rand, mac] = parts;
+    const timestamp = Number(ts);
+    if (isNaN(timestamp)) return { valid: false, error: "Malformed nonce timestamp" };
+    const age = Date.now() - timestamp;
+    if (age > this.config.nonceTTL) {
+      return { valid: false, error: "Nonce expired" };
+    }
+    if (age < -3e4) {
+      return { valid: false, error: "Nonce timestamp in the future" };
+    }
+    const payload = `${ts}:${rand}`;
+    const expectedMac = createHmac("sha256", this.secret).update(payload).digest("hex").slice(0, 16);
+    if (this.timingSafeEqual(mac, expectedMac)) {
+      return { valid: true };
+    }
+    for (const prevSecret of this.previousSecrets) {
+      const prevMac = createHmac("sha256", prevSecret).update(payload).digest("hex").slice(0, 16);
+      if (this.timingSafeEqual(mac, prevMac)) {
+        return { valid: true };
+      }
     }
+    return { valid: false, error: "Invalid nonce signature" };
   }
-  async signState(componentId, state, version, options) {
+  signState(componentId, state, version, options) {
     let dataStr = JSON.stringify(state);
     let compressed = false;
     let encrypted = false;
@@ -1009,7 +1517,7 @@ var StateSignatureManager = class {
       dataStr = iv.toString("base64") + ":" + encryptedData;
       encrypted = true;
     }
-    const nonce = this.config.nonceEnabled ? randomBytes(16).toString("hex") : void 0;
+    const nonce = this.config.nonceEnabled ? this.generateNonce() : void 0;
     const signedState = {
       data: dataStr,
       signature: "",
@@ -1026,26 +1534,34 @@ var StateSignatureManager = class {
     }
     return signedState;
   }
-  async validateState(signedState) {
+  validateState(signedState, options) {
     try {
       const age = Date.now() - signedState.timestamp;
       if (age > this.config.maxStateAge) {
         return { valid: false, error: "State expired" };
       }
-      if (signedState.nonce && this.config.nonceEnabled) {
+      if (signedState.nonce && this.config.nonceEnabled && !options?.skipNonce) {
+        const nonceResult = this.validateNonce(signedState.nonce);
+        if (!nonceResult.valid) {
+          return { valid: false, error: nonceResult.error };
+        }
         if (this.usedNonces.has(signedState.nonce)) {
-          return { valid: false, error: "Nonce already used (replay attempt)" };
+          return { valid: false, error: "Nonce already used" };
         }
       }
       const expectedSig = this.computeSignature(signedState);
       if (this.timingSafeEqual(signedState.signature, expectedSig)) {
-        if (signedState.nonce) this.usedNonces.add(signedState.nonce);
+        if (signedState.nonce && this.config.nonceEnabled) {
+          this.usedNonces.set(signedState.nonce, Date.now());
+        }
         return { valid: true };
       }
       for (const prevSecret of this.previousSecrets) {
         const prevSig = this.computeSignatureWithKey(signedState, prevSecret);
         if (this.timingSafeEqual(signedState.signature, prevSig)) {
-          if (signedState.nonce) this.usedNonces.add(signedState.nonce);
+          if (signedState.nonce && this.config.nonceEnabled) {
+            this.usedNonces.set(signedState.nonce, Date.now());
+          }
           return { valid: true };
         }
       }
@@ -1054,7 +1570,7 @@ var StateSignatureManager = class {
       return { valid: false, error: error.message };
     }
   }
-  async extractData(signedState) {
+  extractData(signedState) {
     let dataStr = signedState.data;
     if (signedState.encrypted) {
       const [ivB64, encryptedData] = dataStr.split(":");
@@ -1107,7 +1623,9 @@ var StateSignatureManager = class {
     }
   }
   deriveEncryptionKey() {
-    return createHmac("sha256", this.secret).update("encryption-key-derivation").digest();
+    if (this.cachedEncryptionKey) return this.cachedEncryptionKey;
+    this.cachedEncryptionKey = scryptSync(this.secret, this.encryptionSalt, 32);
+    return this.cachedEncryptionKey;
   }
   setupKeyRotation() {
     this.rotationTimer = setInterval(() => {
@@ -1116,12 +1634,15 @@ var StateSignatureManager = class {
         this.previousSecrets.pop();
       }
       this.secret = randomBytes(32);
+      this.cachedEncryptionKey = null;
       liveLog("state", null, "Key rotation completed");
     }, this.config.rotationInterval);
   }
+  /** Remove nonces older than nonceTTL + 10s from the replay detection map. */
   cleanupNonces() {
-    if (this.usedNonces.size > 1e5) {
-      this.usedNonces.clear();
+    const cutoff = Date.now() - (this.config.nonceTTL + 10 * 1e3);
+    for (const [nonce, ts] of this.usedNonces) {
+      if (ts < cutoff) this.usedNonces.delete(nonce);
     }
   }
   shutdown() {
@@ -1542,6 +2063,8 @@ var WebSocketConnectionManager = class extends EventEmitter {
   connections = /* @__PURE__ */ new Map();
   connectionMetrics = /* @__PURE__ */ new Map();
   connectionPools = /* @__PURE__ */ new Map();
+  /** Reverse index: connectionId -> Set of poolIds for O(1) cleanup */
+  connectionPoolIndex = /* @__PURE__ */ new Map();
   messageQueues = /* @__PURE__ */ new Map();
   healthCheckTimer;
   heartbeatTimer;
@@ -1596,6 +2119,10 @@ var WebSocketConnectionManager = class extends EventEmitter {
       this.connectionPools.set(poolId, /* @__PURE__ */ new Set());
     }
     this.connectionPools.get(poolId).add(connectionId);
+    if (!this.connectionPoolIndex.has(connectionId)) {
+      this.connectionPoolIndex.set(connectionId, /* @__PURE__ */ new Set());
+    }
+    this.connectionPoolIndex.get(connectionId).add(poolId);
   }
   removeFromPool(connectionId, poolId) {
     const pool = this.connectionPools.get(poolId);
@@ -1603,15 +2130,22 @@ var WebSocketConnectionManager = class extends EventEmitter {
       pool.delete(connectionId);
       if (pool.size === 0) this.connectionPools.delete(poolId);
     }
+    this.connectionPoolIndex.get(connectionId)?.delete(poolId);
   }
   cleanupConnection(connectionId) {
     this.connections.delete(connectionId);
     this.connectionMetrics.delete(connectionId);
     this.messageQueues.delete(connectionId);
-    for (const [poolId, pool] of this.connectionPools) {
-      if (pool.has(connectionId)) {
-        this.removeFromPool(connectionId, poolId);
+    const poolIds = this.connectionPoolIndex.get(connectionId);
+    if (poolIds) {
+      for (const poolId of poolIds) {
+        const pool = this.connectionPools.get(poolId);
+        if (pool) {
+          pool.delete(connectionId);
+          if (pool.size === 0) this.connectionPools.delete(poolId);
+        }
       }
+      this.connectionPoolIndex.delete(connectionId);
     }
   }
   getConnectionMetrics(connectionId) {
@@ -1693,6 +2227,7 @@ var WebSocketConnectionManager = class extends EventEmitter {
     this.connections.clear();
     this.connectionMetrics.clear();
     this.connectionPools.clear();
+    this.connectionPoolIndex.clear();
     this.messageQueues.clear();
   }
 };
@@ -1707,116 +2242,39 @@ function getLiveComponentContext() {
   return _ctx;
 }
 
-// src/component/LiveComponent.ts
-var EMIT_OVERRIDE_KEY = /* @__PURE__ */ Symbol.for("fluxstack:emitOverride");
-var _liveDebugger = null;
-function _setLiveDebugger(dbg) {
-  _liveDebugger = dbg;
-}
-var LiveComponent = class _LiveComponent {
-  /** Component name for registry lookup - must be defined in subclasses */
-  static componentName;
-  /** Default state - must be defined in subclasses */
-  static defaultState;
-  /**
-   * Per-component logging control. Silent by default.
-   *
-   * @example
-   * static logging = true                           // all categories
-   * static logging = ['lifecycle', 'messages']      // specific categories
-   */
-  static logging;
-  /**
-   * Component-level auth configuration.
-   */
-  static auth;
-  /**
-   * Per-action auth configuration.
-   */
-  static actionAuth;
-  /**
-   * Data that survives HMR reloads.
-   */
-  static persistent;
-  /**
-   * When true, only ONE server-side instance exists for this component.
-   * All clients share the same state.
-   */
-  static singleton;
-  id;
+// src/component/managers/ComponentStateManager.ts
+var _forbiddenSetCache = /* @__PURE__ */ new WeakMap();
+var ComponentStateManager = class {
   _state;
-  state;
-  // Proxy wrapper
-  ws;
-  room;
-  userId;
-  broadcastToRoom = () => {
-  };
-  // Server-only private state (NEVER sent to client)
-  _privateState = {};
-  // Auth context (injected by registry during mount)
-  _authContext = ANONYMOUS_CONTEXT;
-  // Room event subscriptions (cleaned up on destroy)
-  roomEventUnsubscribers = [];
-  joinedRooms = /* @__PURE__ */ new Set();
-  // Room type for typed events (override in subclass)
-  roomType = "default";
-  // Cached room handles
-  roomHandles = /* @__PURE__ */ new Map();
-  // Guard against infinite recursion in onStateChange
+  _proxyState;
   _inStateChange = false;
-  // Singleton emit override
-  [EMIT_OVERRIDE_KEY] = null;
-  constructor(initialState, ws, options) {
-    this.id = this.generateId();
-    const ctor = this.constructor;
-    this._state = { ...ctor.defaultState, ...initialState };
-    this.state = this.createStateProxy(this._state);
-    this.ws = ws;
-    this.room = options?.room;
-    this.userId = options?.userId;
-    if (this.room) {
-      this.joinedRooms.add(this.room);
-      const ctx = getLiveComponentContext();
-      ctx.roomManager.joinRoom(this.id, this.room, this.ws);
-    }
-    this.createDirectStateAccessors();
-  }
-  // Create getters/setters for each state property directly on `this`
-  createDirectStateAccessors() {
-    const forbidden = /* @__PURE__ */ new Set([
-      ...Object.keys(this),
-      ...Object.getOwnPropertyNames(Object.getPrototypeOf(this)),
-      "state",
-      "_state",
-      "ws",
-      "id",
-      "room",
-      "userId",
-      "broadcastToRoom",
-      "$private",
-      "_privateState",
-      "$room",
-      "$rooms",
-      "roomType",
-      "roomHandles",
-      "joinedRooms",
-      "roomEventUnsubscribers"
-    ]);
-    for (const key of Object.keys(this._state)) {
-      if (!forbidden.has(key)) {
-        Object.defineProperty(this, key, {
-          get: () => this._state[key],
-          set: (value) => {
-            this.state[key] = value;
-          },
-          enumerable: true,
-          configurable: true
-        });
-      }
-    }
+  _idBytes = null;
+  _deepDiff;
+  _deepDiffDepth;
+  componentId;
+  ws;
+  emitFn;
+  onStateChangeFn;
+  constructor(opts) {
+    this.componentId = opts.componentId;
+    this.ws = opts.ws;
+    this.emitFn = opts.emitFn;
+    this.onStateChangeFn = opts.onStateChangeFn;
+    this._deepDiff = opts.deepDiff ?? false;
+    this._deepDiffDepth = opts.deepDiffDepth ?? 3;
+    this._state = this._deepDiff ? structuredClone(opts.initialState) : opts.initialState;
+    this._proxyState = this.createStateProxy(this._state);
+  }
+  get rawState() {
+    return this._state;
+  }
+  get proxyState() {
+    return this._proxyState;
+  }
+  /** Guard flag — prevents infinite recursion in onStateChange */
+  get inStateChange() {
+    return this._inStateChange;
   }
-  // Create a Proxy that auto-emits STATE_DELTA on any mutation
   createStateProxy(state) {
     const self = this;
     return new Proxy(state, {
@@ -1825,23 +2283,17 @@ var LiveComponent = class _LiveComponent {
         if (oldValue !== value) {
           target[prop] = value;
           const changes = { [prop]: value };
-          self.emit("STATE_DELTA", { delta: changes });
+          self.emitFn("STATE_DELTA", { delta: changes });
           if (!self._inStateChange) {
             self._inStateChange = true;
             try {
-              self.onStateChange(changes);
+              self.onStateChangeFn(changes);
             } catch (err) {
-              console.error(`[${self.id}] onStateChange error:`, err?.message || err);
+              console.error(`[${self.componentId}] onStateChange error:`, err?.message || err);
             } finally {
               self._inStateChange = false;
             }
           }
-          _liveDebugger?.trackStateChange(
-            self.id,
-            changes,
-            target,
-            "proxy"
-          );
         }
         return true;
       },
@@ -1850,76 +2302,459 @@ var LiveComponent = class _LiveComponent {
       }
     });
   }
-  // ========================================
-  // $private - Server-Only State
-  // ========================================
-  get $private() {
-    return this._privateState;
+  setState(updates) {
+    const newUpdates = typeof updates === "function" ? updates(this._state) : updates;
+    let actualChanges;
+    let hasChanges;
+    if (this._deepDiff) {
+      const diff = computeDeepDiff(
+        this._state,
+        newUpdates,
+        0,
+        this._deepDiffDepth
+      );
+      if (diff === null) return;
+      actualChanges = diff;
+      hasChanges = true;
+    } else {
+      actualChanges = {};
+      hasChanges = false;
+      for (const key of Object.keys(newUpdates)) {
+        if (this._state[key] !== newUpdates[key]) {
+          actualChanges[key] = newUpdates[key];
+          hasChanges = true;
+        }
+      }
+    }
+    if (!hasChanges) return;
+    if (this._deepDiff) {
+      deepAssign(this._state, actualChanges);
+    } else {
+      Object.assign(this._state, actualChanges);
+    }
+    this.emitFn("STATE_DELTA", { delta: actualChanges });
+    if (!this._inStateChange) {
+      this._inStateChange = true;
+      try {
+        this.onStateChangeFn(actualChanges);
+      } catch (err) {
+        console.error(`[${this.componentId}] onStateChange error:`, err?.message || err);
+      } finally {
+        this._inStateChange = false;
+      }
+    }
   }
-  // ========================================
-  // $room - Unified Room System
-  // ========================================
-  get $room() {
-    const self = this;
-    const ctx = getLiveComponentContext();
-    const createHandle = (roomId) => {
-      if (this.roomHandles.has(roomId)) {
-        return this.roomHandles.get(roomId);
+  sendBinaryDelta(delta, encoder2) {
+    const actualChanges = {};
+    let hasChanges = false;
+    for (const key of Object.keys(delta)) {
+      if (this._state[key] !== delta[key]) {
+        actualChanges[key] = delta[key];
+        hasChanges = true;
       }
-      const handle = {
-        get id() {
-          return roomId;
-        },
-        get state() {
-          return ctx.roomManager.getRoomState(roomId);
-        },
-        join: (initialState) => {
-          if (self.joinedRooms.has(roomId)) return;
-          self.joinedRooms.add(roomId);
-          ctx.roomManager.joinRoom(self.id, roomId, self.ws, initialState);
-          try {
-            self.onRoomJoin(roomId);
-          } catch (err) {
-            console.error(`[${self.id}] onRoomJoin error:`, err?.message || err);
-          }
-        },
-        leave: () => {
-          if (!self.joinedRooms.has(roomId)) return;
-          self.joinedRooms.delete(roomId);
-          ctx.roomManager.leaveRoom(self.id, roomId);
-          try {
-            self.onRoomLeave(roomId);
-          } catch (err) {
-            console.error(`[${self.id}] onRoomLeave error:`, err?.message || err);
-          }
-        },
-        emit: (event, data) => {
-          return ctx.roomManager.emitToRoom(roomId, event, data, self.id);
-        },
-        on: (event, handler) => {
-          const unsubscribe = ctx.roomEvents.on(
-            "room",
-            roomId,
-            event,
-            self.id,
-            handler
-          );
-          self.roomEventUnsubscribers.push(unsubscribe);
-          return unsubscribe;
-        },
-        setState: (updates) => {
-          ctx.roomManager.setRoomState(roomId, updates, self.id);
-        }
-      };
-      this.roomHandles.set(roomId, handle);
-      return handle;
-    };
-    const proxyFn = ((roomId) => createHandle(roomId));
-    const defaultHandle = this.room ? createHandle(this.room) : null;
-    Object.defineProperties(proxyFn, {
-      id: { get: () => self.room },
-      state: { get: () => defaultHandle?.state ?? {} },
-      join: {
+    }
+    if (!hasChanges) return;
+    Object.assign(this._state, actualChanges);
+    const payload = encoder2(actualChanges);
+    if (!this._idBytes) {
+      this._idBytes = new TextEncoder().encode(this.componentId);
+    }
+    const idBytes = this._idBytes;
+    const frame = new Uint8Array(1 + 1 + idBytes.length + payload.length);
+    frame[0] = 1;
+    frame[1] = idBytes.length;
+    frame.set(idBytes, 2);
+    frame.set(payload, 2 + idBytes.length);
+    if (this.ws && this.ws.readyState === 1) {
+      this.ws.send(frame);
+    }
+  }
+  setValue(payload) {
+    const { key, value } = payload;
+    const update = { [key]: value };
+    this.setState(update);
+    return { success: true, key, value };
+  }
+  getSerializableState() {
+    return this._proxyState;
+  }
+  /**
+   * Create getters/setters for each state property directly on `target`.
+   * This allows `this.count` instead of `this.state.count` in subclasses.
+   */
+  applyDirectAccessors(target, constructorFn) {
+    let forbidden = _forbiddenSetCache.get(constructorFn);
+    if (!forbidden) {
+      forbidden = /* @__PURE__ */ new Set([
+        ...Object.keys(target),
+        ...Object.getOwnPropertyNames(Object.getPrototypeOf(target)),
+        "state",
+        "_state",
+        "ws",
+        "id",
+        "room",
+        "userId",
+        "broadcastToRoom",
+        "$private",
+        "_privateState",
+        "$room",
+        "$rooms",
+        "roomType",
+        "roomHandles",
+        "joinedRooms",
+        "roomEventUnsubscribers",
+        // Internal manager fields
+        "_stateManager",
+        "_roomProxyManager",
+        "_actionSecurity",
+        "_messaging"
+      ]);
+      _forbiddenSetCache.set(constructorFn, forbidden);
+    }
+    for (const key of Object.keys(this._state)) {
+      if (!forbidden.has(key)) {
+        Object.defineProperty(target, key, {
+          get: () => this._state[key],
+          set: (value) => {
+            this._proxyState[key] = value;
+          },
+          enumerable: true,
+          configurable: true
+        });
+      }
+    }
+  }
+  /** Release cached resources */
+  cleanup() {
+    this._idBytes = null;
+  }
+};
+
+// src/component/managers/ComponentMessaging.ts
+var EMIT_OVERRIDE_KEY = /* @__PURE__ */ Symbol.for("fluxstack:emitOverride");
+var ComponentMessaging = class {
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  emit(type, payload) {
+    const override = this.ctx.getEmitOverride();
+    if (override) {
+      override(type, payload);
+      return;
+    }
+    const message = {
+      type,
+      componentId: this.ctx.componentId,
+      payload,
+      timestamp: Date.now(),
+      userId: this.ctx.getUserId(),
+      room: this.ctx.getRoom()
+    };
+    if (this.ctx.ws) {
+      queueWsMessage(this.ctx.ws, message);
+    }
+  }
+  broadcast(type, payload, excludeCurrentUser = false) {
+    const room = this.ctx.getRoom();
+    if (!room) {
+      liveWarn("rooms", this.ctx.componentId, `[${this.ctx.componentId}] Cannot broadcast '${type}' - no room set`);
+      return;
+    }
+    const message = {
+      type,
+      payload,
+      room,
+      excludeUser: excludeCurrentUser ? this.ctx.getUserId() : void 0
+    };
+    liveLog("rooms", this.ctx.componentId, `[${this.ctx.componentId}] Broadcasting '${type}' to room '${room}'`);
+    this.ctx.getBroadcastToRoom()(message);
+  }
+};
+
+// src/component/managers/ActionSecurityManager.ts
+var BLOCKED_ACTIONS = /* @__PURE__ */ new Set([
+  "constructor",
+  "destroy",
+  "executeAction",
+  "getSerializableState",
+  "onMount",
+  "onDestroy",
+  "onConnect",
+  "onDisconnect",
+  "onStateChange",
+  "onRoomJoin",
+  "onRoomLeave",
+  "onRehydrate",
+  "onAction",
+  "onClientJoin",
+  "onClientLeave",
+  "setState",
+  "sendBinaryDelta",
+  "emit",
+  "broadcast",
+  "broadcastToRoom",
+  "createStateProxy",
+  "createDirectStateAccessors",
+  "generateId",
+  "setAuthContext",
+  "_resetAuthContext",
+  "$auth",
+  "$private",
+  "_privateState",
+  "$persistent",
+  "_inStateChange",
+  "$room",
+  "$rooms",
+  "subscribeToRoom",
+  "unsubscribeFromRoom",
+  "emitRoomEvent",
+  "onRoomEvent",
+  "emitRoomEventWithState"
+]);
+var ActionSecurityManager = class {
+  _actionCalls = /* @__PURE__ */ new Map();
+  async validateAndExecute(action, payload, ctx) {
+    const { component, componentClass, componentId } = ctx;
+    try {
+      if (BLOCKED_ACTIONS.has(action)) {
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      if (action.startsWith("_") || action.startsWith("#")) {
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      const publicActions = componentClass.publicActions;
+      if (!publicActions) {
+        console.warn(`[SECURITY] Component '${componentClass.componentName || componentClass.name}' has no publicActions defined. All remote actions are blocked.`);
+        throw new Error(`Action '${action}' is not callable - component has no publicActions defined`);
+      }
+      if (!publicActions.includes(action)) {
+        const methodExists = typeof component[action] === "function";
+        if (methodExists) {
+          const name = componentClass.componentName || componentClass.name;
+          throw new Error(
+            `Action '${action}' exists on '${name}' but is not listed in publicActions. Add it to: static publicActions = [..., '${action}']`
+          );
+        }
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      const method = component[action];
+      if (typeof method !== "function") {
+        throw new Error(`Action '${action}' not found on component`);
+      }
+      if (Object.prototype.hasOwnProperty.call(Object.prototype, action)) {
+        throw new Error(`Action '${action}' is not callable`);
+      }
+      const rateLimit = componentClass.actionRateLimit;
+      if (rateLimit) {
+        const now = Date.now();
+        const key = rateLimit.perAction ? action : "*";
+        let entry = this._actionCalls.get(key);
+        if (!entry || now - entry.windowStart >= rateLimit.windowMs) {
+          entry = { count: 0, windowStart: now };
+          this._actionCalls.set(key, entry);
+        }
+        entry.count++;
+        if (entry.count > rateLimit.maxCalls) {
+          throw new Error(`Action rate limit exceeded (max ${rateLimit.maxCalls} calls per ${rateLimit.windowMs}ms)`);
+        }
+      }
+      const schemas = componentClass.actionSchemas;
+      if (schemas && schemas[action]) {
+        const result2 = schemas[action].safeParse(payload);
+        if (!result2.success) {
+          const errorMsg = result2.error?.message || result2.error?.issues?.map((i) => i.message).join(", ") || "Invalid payload";
+          throw new Error(`Action '${action}' payload validation failed: ${errorMsg}`);
+        }
+        payload = result2.data ?? payload;
+      }
+      let hookResult;
+      try {
+        hookResult = await component.onAction(action, payload);
+      } catch (hookError) {
+        ctx.emitFn("ERROR", {
+          action,
+          error: `Action '${action}' failed pre-validation`
+        });
+        throw hookError;
+      }
+      if (hookResult === false) {
+        throw new Error(`Action '${action}' was cancelled`);
+      }
+      const result = await method.call(component, payload);
+      return result;
+    } catch (error) {
+      if (!error.message?.includes("was cancelled") && !error.message?.includes("pre-validation")) {
+        ctx.emitFn("ERROR", {
+          action,
+          error: error.message
+        });
+      }
+      throw error;
+    }
+  }
+};
+
+// src/component/managers/ComponentRoomProxy.ts
+var RESERVED_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "state",
+  "join",
+  "leave",
+  "emit",
+  "on",
+  "setState",
+  // Function internals (proxy wraps a function)
+  "call",
+  "apply",
+  "bind",
+  "prototype",
+  "length",
+  "name",
+  "arguments",
+  "caller",
+  // Symbol keys
+  Symbol.toPrimitive,
+  Symbol.toStringTag,
+  Symbol.hasInstance
+]);
+var TYPED_RESERVED_KEYS = /* @__PURE__ */ new Set([
+  "id",
+  "state",
+  "meta",
+  "join",
+  "leave",
+  "emit",
+  "on",
+  "setState",
+  "memberCount",
+  // Proxy internals
+  "then",
+  "toJSON",
+  "valueOf",
+  "toString",
+  Symbol.toPrimitive,
+  Symbol.toStringTag,
+  Symbol.hasInstance
+]);
+function wrapWithStateProxy(target, getState, setState) {
+  return new Proxy(target, {
+    get(obj, prop, receiver) {
+      if (RESERVED_KEYS.has(prop) || typeof prop === "symbol") {
+        return Reflect.get(obj, prop, receiver);
+      }
+      const desc = Object.getOwnPropertyDescriptor(obj, prop);
+      if (desc) return Reflect.get(obj, prop, receiver);
+      if (prop in obj) return Reflect.get(obj, prop, receiver);
+      const st = getState();
+      return st?.[prop];
+    },
+    set(_obj, prop, value) {
+      if (typeof prop === "symbol") return false;
+      setState({ [prop]: value });
+      return true;
+    }
+  });
+}
+var ComponentRoomProxy = class {
+  roomEventUnsubscribers = [];
+  joinedRooms = /* @__PURE__ */ new Set();
+  roomHandles = /* @__PURE__ */ new Map();
+  _roomProxy = null;
+  _roomsCache = null;
+  _cachedCtx = null;
+  roomType = "default";
+  room;
+  componentId;
+  ws;
+  getCtx;
+  setStateFn;
+  _deepDiff;
+  _deepDiffDepth;
+  _serverOnlyState;
+  constructor(rctx) {
+    this.componentId = rctx.componentId;
+    this.ws = rctx.ws;
+    this.room = rctx.defaultRoom;
+    this.getCtx = rctx.getCtx;
+    this.setStateFn = rctx.setStateFn;
+    this._deepDiff = rctx.deepDiff ?? true;
+    this._deepDiffDepth = rctx.deepDiffDepth;
+    this._serverOnlyState = rctx.serverOnlyState ?? false;
+    if (this.room) {
+      this.joinedRooms.add(this.room);
+      this.ctx.roomManager.joinRoom(this.componentId, this.room, this.ws, void 0, { deepDiff: this._deepDiff, deepDiffDepth: this._deepDiffDepth, serverOnlyState: this._serverOnlyState });
+    }
+  }
+  /** Lazy context resolution — cached after first access */
+  get ctx() {
+    if (!this._cachedCtx) {
+      this._cachedCtx = this.getCtx();
+    }
+    return this._cachedCtx;
+  }
+  get $room() {
+    if (this._roomProxy) return this._roomProxy;
+    const self = this;
+    const createHandle = (roomId) => {
+      if (this.roomHandles.has(roomId)) {
+        return this.roomHandles.get(roomId);
+      }
+      const handle = {
+        get id() {
+          return roomId;
+        },
+        get state() {
+          return self.ctx.roomManager.getRoomState(roomId);
+        },
+        join: (initialState) => {
+          if (self.joinedRooms.has(roomId)) return;
+          self.joinedRooms.add(roomId);
+          self._roomsCache = null;
+          self.ctx.roomManager.joinRoom(self.componentId, roomId, self.ws, initialState, { deepDiff: self._deepDiff, deepDiffDepth: self._deepDiffDepth, serverOnlyState: self._serverOnlyState });
+        },
+        leave: () => {
+          if (!self.joinedRooms.has(roomId)) return;
+          self.joinedRooms.delete(roomId);
+          self._roomsCache = null;
+          self.ctx.roomManager.leaveRoom(self.componentId, roomId);
+        },
+        emit: (event, data) => {
+          return self.ctx.roomManager.emitToRoom(roomId, event, data, self.componentId);
+        },
+        on: (event, handler) => {
+          const unsubscribe = self.ctx.roomEvents.on(
+            "room",
+            roomId,
+            event,
+            self.componentId,
+            handler
+          );
+          self.roomEventUnsubscribers.push(unsubscribe);
+          return unsubscribe;
+        },
+        setState: (updates) => {
+          self.ctx.roomManager.setRoomState(roomId, updates, self.componentId);
+        }
+      };
+      const proxied = wrapWithStateProxy(
+        handle,
+        () => self.ctx.roomManager.getRoomState(roomId),
+        (updates) => self.ctx.roomManager.setRoomState(roomId, updates, self.componentId)
+      );
+      this.roomHandles.set(roomId, proxied);
+      return proxied;
+    };
+    const proxyFn = ((roomIdOrClass, instanceId) => {
+      if (typeof roomIdOrClass === "function" && instanceId !== void 0) {
+        return self.$typedRoom(roomIdOrClass, instanceId);
+      }
+      return createHandle(roomIdOrClass);
+    });
+    const defaultHandle = this.room ? createHandle(this.room) : null;
+    Object.defineProperties(proxyFn, {
+      id: { get: () => self.room },
+      state: { get: () => defaultHandle?.state ?? {} },
+      join: {
         value: (initialState) => {
           if (!defaultHandle) throw new Error("No default room set");
           defaultHandle.join(initialState);
@@ -1950,13 +2785,317 @@ var LiveComponent = class _LiveComponent {
         }
       }
     });
-    return proxyFn;
+    const defaultRoom = this.room;
+    const wrapped = defaultRoom ? wrapWithStateProxy(
+      proxyFn,
+      () => self.ctx.roomManager.getRoomState(defaultRoom),
+      (updates) => self.ctx.roomManager.setRoomState(defaultRoom, updates, self.componentId)
+    ) : proxyFn;
+    this._roomProxy = wrapped;
+    return wrapped;
+  }
+  /**
+   * Get a typed room handle backed by a LiveRoom class.
+   *
+   * Usage: `this.$room(ChatRoom, 'lobby')` → typed handle with custom methods
+   *
+   * The returned handle exposes:
+   * - `.id`, `.state`, `.meta`, `.memberCount` — framework properties
+   * - `.join(payload?)`, `.leave()`, `.emit()`, `.on()`, `.setState()` — framework API
+   * - Any custom method defined on the LiveRoom subclass (e.g. `.addMessage()`, `.ban()`)
+   *
+   * The compound room ID is `${roomClass.roomName}:${instanceId}`.
+   */
+  $typedRoom(roomClass, instanceId) {
+    const roomId = `${roomClass.roomName}:${instanceId}`;
+    const self = this;
+    const cached = this.roomHandles.get(roomId);
+    if (cached) return cached;
+    const handle = {
+      get id() {
+        return roomId;
+      },
+      get state() {
+        const instance = self.ctx.roomManager.getRoomInstance?.(roomId);
+        return instance ? instance.state : self.ctx.roomManager.getRoomState(roomId);
+      },
+      get meta() {
+        const instance = self.ctx.roomManager.getRoomInstance?.(roomId);
+        if (!instance) throw new Error(`Room '${roomId}' not found or not backed by a LiveRoom class`);
+        return instance.meta;
+      },
+      get memberCount() {
+        return self.ctx.roomManager.getMemberCount?.(roomId) ?? 0;
+      },
+      join: (payload) => {
+        if (self.joinedRooms.has(roomId)) return {};
+        const result = self.ctx.roomManager.joinRoom(
+          self.componentId,
+          roomId,
+          self.ws,
+          void 0,
+          void 0,
+          { userId: void 0, payload }
+        );
+        if ("rejected" in result && result.rejected) {
+          return result;
+        }
+        self.joinedRooms.add(roomId);
+        self._roomsCache = null;
+        sendImmediate(self.ws, JSON.stringify({
+          type: "ROOM_JOINED",
+          componentId: self.componentId,
+          roomId,
+          event: "$room:joined",
+          data: { state: result.state },
+          timestamp: Date.now()
+        }));
+        return {};
+      },
+      leave: () => {
+        if (!self.joinedRooms.has(roomId)) return;
+        self.joinedRooms.delete(roomId);
+        self._roomsCache = null;
+        self.ctx.roomManager.leaveRoom(self.componentId, roomId, "leave");
+      },
+      emit: ((event, data) => {
+        return self.ctx.roomManager.emitToRoom(roomId, event, data, self.componentId);
+      }),
+      on: (event, handler) => {
+        const unsubscribe = self.ctx.roomEvents.on(
+          "room",
+          roomId,
+          event,
+          self.componentId,
+          handler
+        );
+        self.roomEventUnsubscribers.push(unsubscribe);
+        return unsubscribe;
+      },
+      setState: (updates) => {
+        self.ctx.roomManager.setRoomState(roomId, updates, self.componentId);
+      }
+    };
+    const proxied = new Proxy(handle, {
+      get(obj, prop, receiver) {
+        if (TYPED_RESERVED_KEYS.has(prop) || typeof prop === "symbol") {
+          return Reflect.get(obj, prop, receiver);
+        }
+        if (prop in obj) return Reflect.get(obj, prop, receiver);
+        const instance = self.ctx.roomManager.getRoomInstance?.(roomId);
+        if (instance && prop in instance) {
+          const val = instance[prop];
+          return typeof val === "function" ? val.bind(instance) : val;
+        }
+        return void 0;
+      }
+    });
+    this.roomHandles.set(roomId, proxied);
+    return proxied;
+  }
+  get $rooms() {
+    if (this._roomsCache) return this._roomsCache;
+    this._roomsCache = Array.from(this.joinedRooms);
+    return this._roomsCache;
+  }
+  getJoinedRooms() {
+    return this.joinedRooms;
+  }
+  emitRoomEvent(event, data, notifySelf = false) {
+    if (!this.room) {
+      liveWarn("rooms", this.componentId, `[${this.componentId}] Cannot emit room event '${event}' - no room set`);
+      return 0;
+    }
+    const excludeId = notifySelf ? void 0 : this.componentId;
+    const notified = this.ctx.roomEvents.emit(this.roomType, this.room, event, data, excludeId);
+    liveLog("rooms", this.componentId, `[${this.componentId}] Room event '${event}' -> ${notified} components`);
+    return notified;
+  }
+  onRoomEvent(event, handler) {
+    if (!this.room) {
+      liveWarn("rooms", this.componentId, `[${this.componentId}] Cannot subscribe to room event '${event}' - no room set`);
+      return;
+    }
+    const unsubscribe = this.ctx.roomEvents.on(
+      this.roomType,
+      this.room,
+      event,
+      this.componentId,
+      handler
+    );
+    this.roomEventUnsubscribers.push(unsubscribe);
+    liveLog("rooms", this.componentId, `[${this.componentId}] Subscribed to room event '${event}'`);
+  }
+  emitRoomEventWithState(event, data, stateUpdates) {
+    this.setStateFn(stateUpdates);
+    return this.emitRoomEvent(event, data, false);
+  }
+  subscribeToRoom(roomId) {
+    this.room = roomId;
+  }
+  unsubscribeFromRoom() {
+    this.room = void 0;
+  }
+  destroy() {
+    for (const unsubscribe of this.roomEventUnsubscribers) {
+      unsubscribe();
+    }
+    this.roomEventUnsubscribers = [];
+    if (this.joinedRooms.size > 0 && this._cachedCtx) {
+      for (const roomId of this.joinedRooms) {
+        this._cachedCtx.roomManager.leaveRoom(this.componentId, roomId);
+      }
+    }
+    this.joinedRooms.clear();
+    this.roomHandles.clear();
+    this._roomProxy = null;
+    this._roomsCache = null;
+  }
+};
+
+// src/component/LiveComponent.ts
+var LiveComponent = class {
+  /** Component name for registry lookup - must be defined in subclasses */
+  static componentName;
+  /** Default state - must be defined in subclasses */
+  static defaultState;
+  /**
+   * Per-component logging control. Silent by default.
+   *
+   * @example
+   * static logging = true                           // all categories
+   * static logging = ['lifecycle', 'messages']      // specific categories
+   */
+  static logging;
+  /**
+   * Component-level auth configuration.
+   */
+  static auth;
+  /**
+   * Per-action auth configuration.
+   */
+  static actionAuth;
+  /**
+   * Zod schemas for action payload validation.
+   * When defined, payloads are validated before the action method is called.
+   *
+   * @example
+   * static actionSchemas = {
+   *   sendMessage: z.object({ text: z.string().max(500) }),
+   *   updatePosition: z.object({ x: z.number(), y: z.number() }),
+   * }
+   */
+  static actionSchemas;
+  /**
+   * Rate limit for action execution.
+   * Prevents clients from spamming expensive operations.
+   *
+   * @example
+   * static actionRateLimit = { maxCalls: 10, windowMs: 1000, perAction: true }
+   */
+  static actionRateLimit;
+  /**
+   * Data that survives HMR reloads.
+   */
+  static persistent;
+  /**
+   * When true, only ONE server-side instance exists for this component.
+   * All clients share the same state.
+   */
+  static singleton;
+  /**
+   * Component behavior options.
+   *
+   * @example
+   * static $options = { deepDiff: true }
+   */
+  static $options;
+  id;
+  state;
+  // Proxy wrapper (getter delegates to _stateManager)
+  ws;
+  room;
+  userId;
+  broadcastToRoom = () => {
+  };
+  // Server-only private state (NEVER sent to client)
+  _privateState = {};
+  // Auth context (injected by registry during mount, immutable after first set)
+  _authContext = ANONYMOUS_CONTEXT;
+  _authContextSet = false;
+  // Room type for typed events (override in subclass)
+  roomType = "default";
+  // Singleton emit override
+  [EMIT_OVERRIDE_KEY] = null;
+  // ===== Internal Managers (composition) =====
+  _stateManager;
+  _messaging;
+  _actionSecurity;
+  _roomProxyManager;
+  static publicActions;
+  constructor(initialState, ws, options) {
+    this.id = this.generateId();
+    const ctor = this.constructor;
+    this.ws = ws;
+    this.room = options?.room;
+    this.userId = options?.userId;
+    this._messaging = new ComponentMessaging({
+      componentId: this.id,
+      ws: this.ws,
+      getUserId: () => this.userId,
+      getRoom: () => this.room,
+      getBroadcastToRoom: () => this.broadcastToRoom,
+      getEmitOverride: () => this[EMIT_OVERRIDE_KEY]
+    });
+    this._stateManager = new ComponentStateManager({
+      componentId: this.id,
+      initialState: { ...ctor.defaultState, ...initialState },
+      ws: this.ws,
+      emitFn: (type, payload) => this._messaging.emit(type, payload),
+      onStateChangeFn: (changes) => this.onStateChange(changes),
+      deepDiff: ctor.$options?.deepDiff ?? false,
+      deepDiffDepth: ctor.$options?.deepDiffDepth
+    });
+    this.state = this._stateManager.proxyState;
+    this._actionSecurity = new ActionSecurityManager();
+    this._roomProxyManager = new ComponentRoomProxy({
+      componentId: this.id,
+      ws: this.ws,
+      defaultRoom: this.room,
+      getCtx: () => getLiveComponentContext(),
+      setStateFn: (updates) => this.setState(updates),
+      deepDiff: ctor.$options?.roomDeepDiff,
+      deepDiffDepth: ctor.$options?.deepDiffDepth,
+      serverOnlyState: ctor.$options?.serverOnlyRoomState
+    });
+    this._stateManager.applyDirectAccessors(this, this.constructor);
+  }
+  // ========================================
+  // $private - Server-Only State
+  // ========================================
+  get $private() {
+    return this._privateState;
+  }
+  // ========================================
+  // $room - Unified Room System
+  // ========================================
+  /**
+   * Unified room accessor.
+   *
+   * Usage:
+   * - `this.$room` — default room handle (legacy)
+   * - `this.$room('roomId')` — untyped room handle (legacy)
+   * - `this.$room(ChatRoom, 'lobby')` — typed handle with custom methods
+   */
+  get $room() {
+    return this._roomProxyManager.$room;
   }
   /**
-   * List of room IDs this component is participating in
+   * List of room IDs this component is participating in.
+   * Cached — invalidated on join/leave.
    */
   get $rooms() {
-    return Array.from(this.joinedRooms);
+    return this._roomProxyManager.$rooms;
   }
   // ========================================
   // $auth - Authentication Context
@@ -1964,13 +3103,22 @@ var LiveComponent = class _LiveComponent {
   get $auth() {
     return this._authContext;
   }
-  /** @internal */
+  /** @internal - Immutable after first set to prevent privilege escalation */
   setAuthContext(context) {
+    if (this._authContextSet) {
+      throw new Error("Auth context is immutable after initial set");
+    }
     this._authContext = context;
+    this._authContextSet = true;
     if (context.authenticated && context.user?.id && !this.userId) {
       this.userId = context.user.id;
     }
   }
+  /** @internal - Reset auth context (for registry use in reconnection) */
+  _resetAuthContext() {
+    this._authContextSet = false;
+    this._authContext = ANONYMOUS_CONTEXT;
+  }
   // ========================================
   // $persistent - HMR-Safe State
   // ========================================
@@ -2006,224 +3154,64 @@ var LiveComponent = class _LiveComponent {
   }
   onClientJoin(connectionId, connectionCount) {
   }
-  onClientLeave(connectionId, connectionCount) {
-  }
-  // ========================================
-  // State Management
-  // ========================================
-  setState(updates) {
-    const newUpdates = typeof updates === "function" ? updates(this._state) : updates;
-    const actualChanges = {};
-    let hasChanges = false;
-    for (const key of Object.keys(newUpdates)) {
-      if (this._state[key] !== newUpdates[key]) {
-        actualChanges[key] = newUpdates[key];
-        hasChanges = true;
-      }
-    }
-    if (!hasChanges) return;
-    Object.assign(this._state, actualChanges);
-    this.emit("STATE_DELTA", { delta: actualChanges });
-    if (!this._inStateChange) {
-      this._inStateChange = true;
-      try {
-        this.onStateChange(actualChanges);
-      } catch (err) {
-        console.error(`[${this.id}] onStateChange error:`, err?.message || err);
-      } finally {
-        this._inStateChange = false;
-      }
-    }
-    _liveDebugger?.trackStateChange(
-      this.id,
-      actualChanges,
-      this._state,
-      "setState"
-    );
-  }
-  async setValue(payload) {
-    const { key, value } = payload;
-    const update = { [key]: value };
-    this.setState(update);
-    return { success: true, key, value };
-  }
-  // ========================================
-  // Action Security
-  // ========================================
-  static publicActions;
-  static BLOCKED_ACTIONS = /* @__PURE__ */ new Set([
-    "constructor",
-    "destroy",
-    "executeAction",
-    "getSerializableState",
-    "onMount",
-    "onDestroy",
-    "onConnect",
-    "onDisconnect",
-    "onStateChange",
-    "onRoomJoin",
-    "onRoomLeave",
-    "onRehydrate",
-    "onAction",
-    "onClientJoin",
-    "onClientLeave",
-    "setState",
-    "emit",
-    "broadcast",
-    "broadcastToRoom",
-    "createStateProxy",
-    "createDirectStateAccessors",
-    "generateId",
-    "setAuthContext",
-    "$auth",
-    "$private",
-    "_privateState",
-    "$persistent",
-    "_inStateChange",
-    "$room",
-    "$rooms",
-    "subscribeToRoom",
-    "unsubscribeFromRoom",
-    "emitRoomEvent",
-    "onRoomEvent",
-    "emitRoomEventWithState"
-  ]);
-  async executeAction(action, payload) {
-    const actionStart = Date.now();
-    try {
-      if (_LiveComponent.BLOCKED_ACTIONS.has(action)) {
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      if (action.startsWith("_") || action.startsWith("#")) {
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      const componentClass = this.constructor;
-      const publicActions = componentClass.publicActions;
-      if (!publicActions) {
-        console.warn(`[SECURITY] Component '${componentClass.componentName || componentClass.name}' has no publicActions defined. All remote actions are blocked.`);
-        throw new Error(`Action '${action}' is not callable - component has no publicActions defined`);
-      }
-      if (!publicActions.includes(action)) {
-        const methodExists = typeof this[action] === "function";
-        if (methodExists) {
-          const name = componentClass.componentName || componentClass.name;
-          throw new Error(
-            `Action '${action}' exists on '${name}' but is not listed in publicActions. Add it to: static publicActions = [..., '${action}']`
-          );
-        }
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      const method = this[action];
-      if (typeof method !== "function") {
-        throw new Error(`Action '${action}' not found on component`);
-      }
-      if (Object.prototype.hasOwnProperty.call(Object.prototype, action)) {
-        throw new Error(`Action '${action}' is not callable`);
-      }
-      _liveDebugger?.trackActionCall(this.id, action, payload);
-      let hookResult;
-      try {
-        hookResult = await this.onAction(action, payload);
-      } catch (hookError) {
-        _liveDebugger?.trackActionError(this.id, action, hookError.message, Date.now() - actionStart);
-        this.emit("ERROR", {
-          action,
-          error: `Action '${action}' failed pre-validation`
-        });
-        throw hookError;
-      }
-      if (hookResult === false) {
-        _liveDebugger?.trackActionError(this.id, action, "Action cancelled", Date.now() - actionStart);
-        throw new Error(`Action '${action}' was cancelled`);
-      }
-      const result = await method.call(this, payload);
-      _liveDebugger?.trackActionResult(this.id, action, result, Date.now() - actionStart);
-      return result;
-    } catch (error) {
-      if (!error.message?.includes("was cancelled") && !error.message?.includes("pre-validation")) {
-        _liveDebugger?.trackActionError(this.id, action, error.message, Date.now() - actionStart);
-        this.emit("ERROR", {
-          action,
-          error: error.message
-        });
-      }
-      throw error;
-    }
+  onClientLeave(connectionId, connectionCount) {
   }
   // ========================================
-  // Messaging
+  // State Management (delegates to _stateManager)
   // ========================================
-  emit(type, payload) {
-    const override = this[EMIT_OVERRIDE_KEY];
-    if (override) {
-      override(type, payload);
-      return;
-    }
-    const message = {
-      type,
+  setState(updates) {
+    this._stateManager.setState(updates);
+  }
+  /**
+   * Send a binary-encoded state delta directly over WebSocket.
+   * Updates internal state (same as setState) then sends the encoder's output
+   * as a binary frame: [0x01][idLen:u8][id_bytes:utf8][payload_bytes].
+   * Bypasses the JSON batcher — ideal for high-frequency updates.
+   */
+  sendBinaryDelta(delta, encoder2) {
+    this._stateManager.sendBinaryDelta(delta, encoder2);
+  }
+  setValue(payload) {
+    return this._stateManager.setValue(payload);
+  }
+  // ========================================
+  // Action Execution (delegates to _actionSecurity)
+  // ========================================
+  async executeAction(action, payload) {
+    return this._actionSecurity.validateAndExecute(action, payload, {
+      component: this,
+      componentClass: this.constructor,
       componentId: this.id,
-      payload,
-      timestamp: Date.now(),
-      userId: this.userId,
-      room: this.room
-    };
-    if (this.ws && this.ws.send) {
-      this.ws.send(JSON.stringify(message));
-    }
+      emitFn: (type, p) => this.emit(type, p)
+    });
+  }
+  // ========================================
+  // Messaging (delegates to _messaging)
+  // ========================================
+  emit(type, payload) {
+    this._messaging.emit(type, payload);
   }
   broadcast(type, payload, excludeCurrentUser = false) {
-    if (!this.room) {
-      liveWarn("rooms", this.id, `[${this.id}] Cannot broadcast '${type}' - no room set`);
-      return;
-    }
-    const message = {
-      type,
-      payload,
-      room: this.room,
-      excludeUser: excludeCurrentUser ? this.userId : void 0
-    };
-    liveLog("rooms", this.id, `[${this.id}] Broadcasting '${type}' to room '${this.room}'`);
-    this.broadcastToRoom(message);
+    this._messaging.broadcast(type, payload, excludeCurrentUser);
   }
   // ========================================
-  // Room Events - Internal Server Events
+  // Room Events (delegates to _roomProxyManager)
   // ========================================
   emitRoomEvent(event, data, notifySelf = false) {
-    if (!this.room) {
-      liveWarn("rooms", this.id, `[${this.id}] Cannot emit room event '${event}' - no room set`);
-      return 0;
-    }
-    const ctx = getLiveComponentContext();
-    const excludeId = notifySelf ? void 0 : this.id;
-    const notified = ctx.roomEvents.emit(this.roomType, this.room, event, data, excludeId);
-    liveLog("rooms", this.id, `[${this.id}] Room event '${event}' -> ${notified} components`);
-    _liveDebugger?.trackRoomEmit(this.id, this.room, event, data);
-    return notified;
+    return this._roomProxyManager.emitRoomEvent(event, data, notifySelf);
   }
   onRoomEvent(event, handler) {
-    if (!this.room) {
-      liveWarn("rooms", this.id, `[${this.id}] Cannot subscribe to room event '${event}' - no room set`);
-      return;
-    }
-    const ctx = getLiveComponentContext();
-    const unsubscribe = ctx.roomEvents.on(
-      this.roomType,
-      this.room,
-      event,
-      this.id,
-      handler
-    );
-    this.roomEventUnsubscribers.push(unsubscribe);
-    liveLog("rooms", this.id, `[${this.id}] Subscribed to room event '${event}'`);
+    this._roomProxyManager.onRoomEvent(event, handler);
   }
   emitRoomEventWithState(event, data, stateUpdates) {
-    this.setState(stateUpdates);
-    return this.emitRoomEvent(event, data, false);
+    return this._roomProxyManager.emitRoomEventWithState(event, data, stateUpdates);
   }
-  async subscribeToRoom(roomId) {
+  subscribeToRoom(roomId) {
+    this._roomProxyManager.subscribeToRoom(roomId);
     this.room = roomId;
   }
-  async unsubscribeFromRoom() {
+  unsubscribeFromRoom() {
+    this._roomProxyManager.unsubscribeFromRoom();
     this.room = void 0;
   }
   // ========================================
@@ -2238,21 +3226,13 @@ var LiveComponent = class _LiveComponent {
     } catch (err) {
       console.error(`[${this.id}] onDestroy error:`, err?.message || err);
     }
-    for (const unsubscribe of this.roomEventUnsubscribers) {
-      unsubscribe();
-    }
-    this.roomEventUnsubscribers = [];
-    const ctx = getLiveComponentContext();
-    for (const roomId of this.joinedRooms) {
-      ctx.roomManager.leaveRoom(this.id, roomId);
-    }
-    this.joinedRooms.clear();
-    this.roomHandles.clear();
+    this._roomProxyManager.destroy();
+    this._stateManager.cleanup();
     this._privateState = {};
-    this.unsubscribeFromRoom();
+    this.room = void 0;
   }
   getSerializableState() {
-    return this.state;
+    return this._stateManager.getSerializableState();
   }
 };
 
@@ -2266,17 +3246,80 @@ var ComponentRegistry = class {
   autoDiscoveredComponents = /* @__PURE__ */ new Map();
   healthCheckInterval;
   singletons = /* @__PURE__ */ new Map();
+  remoteSingletons = /* @__PURE__ */ new Map();
+  cluster;
   authManager;
-  debugger;
   stateSignature;
   performanceMonitor;
   constructor(deps) {
     this.authManager = deps.authManager;
-    this.debugger = deps.debugger;
     this.stateSignature = deps.stateSignature;
     this.performanceMonitor = deps.performanceMonitor;
-    _setLiveDebugger(deps.debugger);
+    this.cluster = deps.cluster;
     this.setupHealthMonitoring();
+    this.setupClusterHandlers();
+  }
+  /** Set up handlers for incoming cluster messages (deltas, forwarded actions). */
+  setupClusterHandlers() {
+    if (!this.cluster) return;
+    this.cluster.onDelta((componentId, componentName, delta, sourceInstanceId) => {
+      const remote = this.remoteSingletons.get(componentName);
+      if (!remote || remote.componentId !== componentId) return;
+      if (delta && remote.lastState) {
+        Object.assign(remote.lastState, delta);
+      }
+      const message = JSON.stringify({
+        type: "STATE_DELTA",
+        componentId,
+        payload: { delta },
+        timestamp: Date.now()
+      });
+      const dead = [];
+      for (const [connId, ws] of remote.connections) {
+        if (ws.readyState === 1) {
+          try {
+            ws.send(message);
+          } catch {
+            dead.push(connId);
+          }
+        } else {
+          dead.push(connId);
+        }
+      }
+      for (const connId of dead) remote.connections.delete(connId);
+    });
+    this.cluster.onOwnershipLost((componentName) => {
+      const singleton = this.singletons.get(componentName);
+      if (!singleton) return;
+      this.cluster.saveSingletonState(componentName, singleton.instance.getSerializableState()).catch(() => {
+      });
+      const errorMsg = JSON.stringify({
+        type: "ERROR",
+        componentId: singleton.instance.id,
+        payload: { error: "OWNERSHIP_LOST: singleton moved to another server" },
+        timestamp: Date.now()
+      });
+      for (const [, ws] of singleton.connections) {
+        try {
+          ws.send(errorMsg);
+        } catch {
+        }
+      }
+      this.cleanupComponent(singleton.instance.id);
+      this.singletons.delete(componentName);
+    });
+    this.cluster.onActionForward(async (request) => {
+      try {
+        const stillOwner = await this.cluster.verifySingletonOwnership(request.componentName);
+        if (!stillOwner) {
+          return { success: false, error: "OWNERSHIP_LOST: this instance no longer owns the singleton", requestId: request.requestId };
+        }
+        const result = await this.executeAction(request.componentId, request.action, request.payload);
+        return { success: true, result, requestId: request.requestId };
+      } catch (error) {
+        return { success: false, error: error.message, requestId: request.requestId };
+      }
+    });
   }
   setupHealthMonitoring() {
     this.healthCheckInterval = setInterval(() => this.performHealthChecks(), 3e4);
@@ -2360,6 +3403,7 @@ var ComponentRegistry = class {
       const authResult = this.authManager.authorizeComponent(authContext, componentAuth);
       if (!authResult.allowed) throw new Error(`AUTH_DENIED: ${authResult.reason}`);
       const isSingleton = ComponentClass.singleton === true;
+      let clusterSingletonId = null;
       if (isSingleton) {
         const existing = this.singletons.get(componentName);
         if (existing) {
@@ -2367,11 +3411,11 @@ var ComponentRegistry = class {
           existing.connections.set(connId, ws);
           this.ensureWsData(ws, options?.userId);
           ws.data.components.set(existing.instance.id, existing.instance);
-          const signedState2 = await this.stateSignature.signState(existing.instance.id, {
+          const signedState2 = this.stateSignature.signState(existing.instance.id, {
             ...existing.instance.getSerializableState(),
             __componentName: componentName
           }, 1, { compress: true, backup: true });
-          ws.send(JSON.stringify({
+          sendImmediate(ws, JSON.stringify({
             type: "STATE_UPDATE",
             componentId: existing.instance.id,
             payload: { state: existing.instance.getSerializableState(), signedState: signedState2 },
@@ -2383,9 +3427,57 @@ var ComponentRegistry = class {
           }
           return { componentId: existing.instance.id, initialState: existing.instance.getSerializableState(), signedState: signedState2 };
         }
+        const existingRemote = this.remoteSingletons.get(componentName);
+        if (existingRemote) {
+          const connId = ws.data?.connectionId || `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+          this.ensureWsData(ws, options?.userId);
+          existingRemote.connections.set(connId, ws);
+          sendImmediate(ws, JSON.stringify({
+            type: "STATE_UPDATE",
+            componentId: existingRemote.componentId,
+            payload: { state: existingRemote.lastState },
+            timestamp: Date.now()
+          }));
+          return { componentId: existingRemote.componentId, initialState: existingRemote.lastState, signedState: null };
+        }
+        if (this.cluster) {
+          clusterSingletonId = `live-${crypto.randomUUID()}`;
+          const claim = await this.cluster.claimSingleton(componentName, clusterSingletonId);
+          if (!claim.claimed) {
+            clusterSingletonId = null;
+            const owner = await this.cluster.getSingletonOwner(componentName);
+            if (owner) {
+              const stored = await this.cluster.loadState(owner.componentId);
+              const connId = ws.data?.connectionId || `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+              this.ensureWsData(ws, options?.userId);
+              const remote = {
+                componentName,
+                componentId: owner.componentId,
+                ownerInstanceId: owner.instanceId,
+                lastState: stored?.state || {},
+                connections: /* @__PURE__ */ new Map([[connId, ws]])
+              };
+              this.remoteSingletons.set(componentName, remote);
+              sendImmediate(ws, JSON.stringify({
+                type: "STATE_UPDATE",
+                componentId: owner.componentId,
+                payload: { state: remote.lastState },
+                timestamp: Date.now()
+              }));
+              return { componentId: owner.componentId, initialState: remote.lastState, signedState: null };
+            }
+          }
+          if (claim.recoveredState) {
+            props = { ...props, ...claim.recoveredState };
+          }
+        }
       }
       const component = new ComponentClass({ ...initialState, ...props }, ws, options);
       component.setAuthContext(authContext);
+      if (clusterSingletonId) {
+        ;
+        component.id = clusterSingletonId;
+      }
       component.broadcastToRoom = (message) => {
         this.broadcastToRoom(message, component.id);
       };
@@ -2401,6 +3493,13 @@ var ComponentRegistry = class {
         const connections = /* @__PURE__ */ new Map();
         connections.set(connId, ws);
         this.singletons.set(componentName, { instance: component, connections });
+        if (this.cluster) {
+          this.cluster.saveState(component.id, componentName, component.getSerializableState()).catch(() => {
+          });
+          this.cluster.saveSingletonState(componentName, component.getSerializableState()).catch(() => {
+          });
+        }
+        ;
         component[EMIT_OVERRIDE_KEY] = (type, payload) => {
           const message = {
             type,
@@ -2423,6 +3522,14 @@ var ComponentRegistry = class {
             }
             for (const cId of dead) singleton.connections.delete(cId);
           }
+          if (this.cluster && type === "STATE_DELTA" && payload?.delta) {
+            this.cluster.publishDelta(component.id, componentName, payload.delta).catch(() => {
+            });
+            this.cluster.saveState(component.id, componentName, component.getSerializableState()).catch(() => {
+            });
+            this.cluster.saveSingletonState(componentName, component.getSerializableState()).catch(() => {
+            });
+          }
         };
         try {
           component.onClientJoin(connId, 1);
@@ -2435,7 +3542,7 @@ var ComponentRegistry = class {
       registerComponentLogging(component.id, ComponentClass.logging);
       this.performanceMonitor.initializeComponent(component.id, componentName);
       this.performanceMonitor.recordRenderTime(component.id, renderTime);
-      const signedState = await this.stateSignature.signState(component.id, {
+      const signedState = this.stateSignature.signState(component.id, {
         ...component.getSerializableState(),
         __componentName: componentName
       }, 1, { compress: true, backup: true });
@@ -2453,13 +3560,6 @@ var ComponentRegistry = class {
         ;
         component.emit("ERROR", { action: "onMount", error: `Mount initialization failed: ${err?.message || err}` });
       }
-      this.debugger.trackComponentMount(
-        component.id,
-        componentName,
-        component.getSerializableState(),
-        options?.room,
-        options?.debugLabel
-      );
       return { componentId: component.id, initialState: component.getSerializableState(), signedState };
     } catch (error) {
       console.error(`Failed to mount component ${componentName}:`, error);
@@ -2468,7 +3568,7 @@ var ComponentRegistry = class {
   }
   async rehydrateComponent(componentId, componentName, signedState, ws, options) {
     try {
-      const validation = await this.stateSignature.validateState(signedState);
+      const validation = this.stateSignature.validateState(signedState, { skipNonce: true });
       if (!validation.valid) return { success: false, error: validation.error || "Invalid state signature" };
       const definition = this.definitions.get(componentName);
       let ComponentClass = null;
@@ -2491,8 +3591,8 @@ var ComponentRegistry = class {
       const componentAuth = ComponentClass.auth;
       const authResult = this.authManager.authorizeComponent(authContext, componentAuth);
       if (!authResult.allowed) return { success: false, error: `AUTH_DENIED: ${authResult.reason}` };
-      const clientState = await this.stateSignature.extractData(signedState);
-      if (clientState.__componentName && clientState.__componentName !== componentName) {
+      const clientState = this.stateSignature.extractData(signedState);
+      if (!clientState.__componentName || clientState.__componentName !== componentName) {
         return { success: false, error: "Component class mismatch - state tampering detected" };
       }
       const { __componentName, ...cleanState } = clientState;
@@ -2505,7 +3605,7 @@ var ComponentRegistry = class {
       this.ensureWsData(ws, options?.userId);
       ws.data.components.set(component.id, component);
       registerComponentLogging(component.id, ComponentClass.logging);
-      const newSignedState = await this.stateSignature.signState(
+      const newSignedState = this.stateSignature.signState(
         component.id,
         { ...component.getSerializableState(), __componentName: componentName },
         signedState.version + 1
@@ -2554,20 +3654,39 @@ var ComponentRegistry = class {
       if (singleton.instance.id !== componentId) continue;
       if (connId) singleton.connections.delete(connId);
       if (singleton.connections.size === 0) {
+        const finalState = singleton.instance.getSerializableState();
         try {
           singleton.instance.onDisconnect();
         } catch {
         }
         this.cleanupComponent(componentId);
         this.singletons.delete(name);
+        if (this.cluster) {
+          this.cluster.saveSingletonState(name, finalState).then(() => this.cluster.releaseSingleton(name)).then(() => this.cluster.deleteState(componentId)).catch(() => {
+          });
+        }
+      }
+      return true;
+    }
+    for (const [name, remote] of this.remoteSingletons) {
+      if (remote.componentId !== componentId) continue;
+      if (connId) remote.connections.delete(connId);
+      if (remote.connections.size === 0) {
+        this.remoteSingletons.delete(name);
       }
       return true;
     }
     return false;
   }
-  async unmountComponent(componentId, ws) {
+  unmountComponent(componentId, ws) {
     const component = this.components.get(componentId);
-    if (!component) return;
+    if (!component) {
+      if (ws) {
+        const connId = ws.data?.connectionId;
+        this.removeSingletonConnection(componentId, connId, "unmount");
+      }
+      return;
+    }
     if (ws) {
       const connId = ws.data?.connectionId;
       ws.data?.components?.delete(componentId);
@@ -2583,7 +3702,6 @@ var ComponentRegistry = class {
     } else {
       if (this.removeSingletonConnection(componentId, void 0, "unmount")) return;
     }
-    this.debugger.trackComponentUnmount(componentId);
     component.destroy?.();
     this.unsubscribeFromAllRooms(componentId);
     this.components.delete(componentId);
@@ -2596,6 +3714,13 @@ var ComponentRegistry = class {
     }
     return null;
   }
+  /** Find a remote singleton entry by componentId. */
+  findRemoteSingleton(componentId) {
+    for (const [, entry] of this.remoteSingletons) {
+      if (entry.componentId === componentId) return entry;
+    }
+    return null;
+  }
   async executeAction(componentId, action, payload) {
     const component = this.components.get(componentId);
     if (!component) throw new Error(`COMPONENT_REHYDRATION_REQUIRED:${componentId}`);
@@ -2646,7 +3771,7 @@ var ComponentRegistry = class {
       const component = this.components.get(componentId);
       if (message.excludeUser && component?.userId === message.excludeUser) continue;
       const ws = this.wsConnections.get(componentId);
-      if (ws && ws.send) ws.send(JSON.stringify(broadcastMessage));
+      if (ws) queueWsMessage(ws, broadcastMessage);
     }
   }
   async handleMessage(ws, message) {
@@ -2661,9 +3786,26 @@ var ComponentRegistry = class {
           });
           return { success: true, result: mountResult };
         case "COMPONENT_UNMOUNT":
-          await this.unmountComponent(message.componentId, ws);
+          this.unmountComponent(message.componentId, ws);
           return { success: true };
-        case "CALL_ACTION":
+        case "CALL_ACTION": {
+          const remoteSingleton = this.findRemoteSingleton(message.componentId);
+          if (remoteSingleton && this.cluster) {
+            const requestId = `req-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+            const request = {
+              sourceInstanceId: this.cluster.instanceId,
+              targetInstanceId: remoteSingleton.ownerInstanceId,
+              componentId: remoteSingleton.componentId,
+              componentName: remoteSingleton.componentName,
+              action: message.action,
+              payload: message.payload,
+              requestId
+            };
+            const response = await this.cluster.forwardAction(request);
+            if (!response.success) throw new Error(response.error || "Remote action failed");
+            if (message.expectResponse) return { success: true, result: response.result };
+            return null;
+          }
           this.recordComponentMetrics(message.componentId, void 0, message.action);
           const actionStart = Date.now();
           try {
@@ -2675,6 +3817,7 @@ var ComponentRegistry = class {
             this.performanceMonitor.recordActionTime(message.componentId, message.action, Date.now() - actionStart, error);
             throw error;
           }
+        }
         case "PROPERTY_UPDATE":
           this.updateProperty(message.componentId, message.property, message.payload.value);
           return { success: true };
@@ -2702,6 +3845,14 @@ var ComponentRegistry = class {
         this.cleanupComponent(componentId);
       }
     }
+    if (connId) {
+      for (const [name, remote] of this.remoteSingletons) {
+        remote.connections.delete(connId);
+        if (remote.connections.size === 0) {
+          this.remoteSingletons.delete(name);
+        }
+      }
+    }
     ws.data.components.clear();
   }
   getStats() {
@@ -2713,6 +3864,9 @@ var ComponentRegistry = class {
       singletons: Object.fromEntries(
         Array.from(this.singletons.entries()).map(([name, s]) => [name, { componentId: s.instance.id, connections: s.connections.size }])
       ),
+      remoteSingletons: Object.fromEntries(
+        Array.from(this.remoteSingletons.entries()).map(([name, r]) => [name, { componentId: r.componentId, ownerInstanceId: r.ownerInstanceId, connections: r.connections.size }])
+      ),
       roomDetails: Object.fromEntries(
         Array.from(this.rooms.entries()).map(([roomId, components]) => [roomId, components.size])
       )
@@ -2770,7 +3924,7 @@ var ComponentRegistry = class {
       metadata.healthStatus = metadata.metrics.errorCount > 5 ? "unhealthy" : "degraded";
     }
   }
-  async performHealthChecks() {
+  performHealthChecks() {
     for (const [componentId, metadata] of this.metadata) {
       if (!this.components.get(componentId)) continue;
       if (metadata.metrics.errorCount > 10) metadata.healthStatus = "unhealthy";
@@ -2796,6 +3950,7 @@ var ComponentRegistry = class {
   cleanup() {
     if (this.healthCheckInterval) clearInterval(this.healthCheckInterval);
     this.singletons.clear();
+    this.remoteSingletons.clear();
     for (const [componentId] of this.components) this.cleanupComponent(componentId);
   }
 };
@@ -2874,12 +4029,165 @@ function decodeBinaryChunk(raw) {
   return { header, data };
 }
 
+// src/security/sanitize.ts
+var DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var MAX_DEPTH = 10;
+function sanitizePayload(value, depth = 0) {
+  if (depth > MAX_DEPTH) return value;
+  if (Array.isArray(value)) {
+    return value.map((item) => sanitizePayload(item, depth + 1));
+  }
+  if (value !== null && typeof value === "object") {
+    const clean = {};
+    for (const key of Object.keys(value)) {
+      if (DANGEROUS_KEYS.has(key)) continue;
+      clean[key] = sanitizePayload(value[key], depth + 1);
+    }
+    return clean;
+  }
+  return value;
+}
+
+// src/rooms/LiveRoom.ts
+var LiveRoom = class {
+  /** Unique room type name. Used as prefix in compound room IDs (e.g. "chat:lobby"). */
+  static roomName;
+  /** Initial public state template. Cloned per room instance. */
+  static defaultState = {};
+  /** Initial private metadata template. Cloned per room instance. */
+  static defaultMeta = {};
+  /** Room-level options */
+  static $options;
+  /** The unique room instance identifier (e.g. "chat:lobby") */
+  id;
+  /** Public state — synced to all connected clients via setState(). */
+  state;
+  /** Private metadata — NEVER leaves the server. Mutate directly. */
+  meta;
+  /** @internal Reference to the room manager for broadcasting */
+  _manager;
+  constructor(id, manager) {
+    const ctor = this.constructor;
+    this.id = id;
+    this._manager = manager;
+    this.state = structuredClone(ctor.defaultState ?? {});
+    this.meta = structuredClone(ctor.defaultMeta ?? {});
+  }
+  // ===== Framework Methods =====
+  /**
+   * Update public state and broadcast changes to all room members.
+   * Uses deep diff by default — only changed fields are sent over the wire.
+   */
+  setState(updates) {
+    this._manager.setRoomState(this.id, updates);
+  }
+  /**
+   * Emit a typed event to all members in this room.
+   * @returns Number of members notified
+   */
+  emit(event, data) {
+    return this._manager.emitToRoom(this.id, event, data);
+  }
+  /** Get current member count */
+  get memberCount() {
+    return this._manager.getMemberCount?.(this.id) ?? 0;
+  }
+  // ===== Lifecycle Hooks (override in subclass) =====
+  /**
+   * Called when a component attempts to join this room.
+   * Return false to reject the join.
+   */
+  onJoin(_ctx2) {
+  }
+  /**
+   * Called after a component leaves this room.
+   */
+  onLeave(_ctx2) {
+  }
+  /**
+   * Called when an event is emitted to this room.
+   * Can intercept/validate events before broadcasting.
+   */
+  onEvent(_event, _data, _ctx2) {
+  }
+  /**
+   * Called once when the room is first created (first member joins).
+   */
+  onCreate() {
+  }
+  /**
+   * Called when the last member leaves and the room is about to be destroyed.
+   * Return false to keep the room alive (e.g., persist state).
+   */
+  onDestroy() {
+  }
+};
+
+// src/rooms/RoomRegistry.ts
+var RoomRegistry = class {
+  rooms = /* @__PURE__ */ new Map();
+  /**
+   * Register a LiveRoom subclass.
+   * @throws If the class doesn't define a static roomName
+   */
+  register(roomClass) {
+    const name = roomClass.roomName;
+    if (!name) {
+      throw new Error("LiveRoom subclass must define static roomName");
+    }
+    if (this.rooms.has(name)) {
+      throw new Error(`LiveRoom '${name}' is already registered`);
+    }
+    this.rooms.set(name, roomClass);
+  }
+  /**
+   * Get a registered room class by name.
+   */
+  get(name) {
+    return this.rooms.get(name);
+  }
+  /**
+   * Check if a room class is registered.
+   */
+  has(name) {
+    return this.rooms.has(name);
+  }
+  /**
+   * Resolve a compound room ID (e.g. "chat:lobby") to its registered class.
+   * Returns undefined if the prefix doesn't match any registered room.
+   */
+  resolveFromId(roomId) {
+    const colonIdx = roomId.indexOf(":");
+    if (colonIdx === -1) return void 0;
+    const prefix = roomId.substring(0, colonIdx);
+    return this.rooms.get(prefix);
+  }
+  /**
+   * Get all registered room names.
+   */
+  getRegisteredNames() {
+    return Array.from(this.rooms.keys());
+  }
+  /**
+   * Check if a value is a LiveRoom subclass.
+   */
+  static isLiveRoomClass(cls) {
+    if (typeof cls !== "function" || !cls.prototype) return false;
+    if (typeof cls.roomName !== "string") return false;
+    let proto = Object.getPrototypeOf(cls.prototype);
+    while (proto) {
+      if (proto.constructor === LiveRoom) return true;
+      proto = Object.getPrototypeOf(proto);
+    }
+    return false;
+  }
+};
+
 // src/server/LiveServer.ts
 var LiveServer = class {
   // Public singletons (accessible for transport adapters & advanced usage)
   roomEvents;
   roomManager;
-  debugger;
   authManager;
   stateSignature;
   performanceMonitor;
@@ -2887,31 +4195,36 @@ var LiveServer = class {
   connectionManager;
   registry;
   rateLimiter;
+  roomRegistry;
   transport;
   options;
   constructor(options) {
     this.options = options;
     this.transport = options.transport;
     this.roomEvents = new RoomEventBus();
-    this.roomManager = new LiveRoomManager(this.roomEvents);
-    this.debugger = new LiveDebugger(options.debug ?? false);
+    this.roomManager = new LiveRoomManager(this.roomEvents, options.roomPubSub);
     this.authManager = new LiveAuthManager();
     this.stateSignature = new StateSignatureManager(options.stateSignature);
     this.performanceMonitor = new PerformanceMonitor(options.performance);
     this.fileUploadManager = new FileUploadManager(options.fileUpload);
     this.connectionManager = new WebSocketConnectionManager(options.connection);
     this.rateLimiter = new RateLimiterRegistry(options.rateLimitMaxTokens, options.rateLimitRefillRate);
+    this.roomRegistry = new RoomRegistry();
+    this.roomManager.roomRegistry = this.roomRegistry;
+    if (options.rooms) {
+      for (const roomClass of options.rooms) {
+        this.roomRegistry.register(roomClass);
+      }
+    }
     this.registry = new ComponentRegistry({
       authManager: this.authManager,
-      debugger: this.debugger,
       stateSignature: this.stateSignature,
-      performanceMonitor: this.performanceMonitor
+      performanceMonitor: this.performanceMonitor,
+      cluster: options.cluster
     });
-    _setLoggerDebugger(this.debugger);
     setLiveComponentContext({
       roomEvents: this.roomEvents,
-      roomManager: this.roomManager,
-      debugger: this.debugger
+      roomManager: this.roomManager
     });
   }
   /**
@@ -2921,6 +4234,14 @@ var LiveServer = class {
     this.authManager.register(provider);
     return this;
   }
+  /**
+   * Register a LiveRoom class.
+   * Can be called before start() to register room types dynamically.
+   */
+  useRoom(roomClass) {
+    this.roomRegistry.register(roomClass);
+    return this;
+  }
   /**
    * Start the LiveServer: register WS + HTTP handlers on the transport.
    */
@@ -2940,10 +4261,13 @@ var LiveServer = class {
       const prefix = this.options.httpPrefix ?? "/api/live";
       await this.transport.registerHttpRoutes(this.buildHttpRoutes(prefix));
     }
+    if (this.options.cluster) {
+      await this.options.cluster.start();
+    }
     if (this.transport.start) {
       await this.transport.start();
     }
-    liveLog("lifecycle", null, `LiveServer started (ws: ${wsConfig.path})`);
+    liveLog("lifecycle", null, `LiveServer started (ws: ${wsConfig.path}${this.options.cluster ? ", cluster: enabled" : ""})`);
   }
   /**
    * Graceful shutdown.
@@ -2953,21 +4277,31 @@ var LiveServer = class {
     this.connectionManager.shutdown();
     this.fileUploadManager.shutdown();
     this.stateSignature.shutdown();
+    if (this.options.cluster) await this.options.cluster.shutdown();
     if (this.transport.shutdown) await this.transport.shutdown();
     liveLog("lifecycle", null, "LiveServer shut down");
   }
   // ===== WebSocket Handlers =====
   handleOpen(ws) {
+    const origin = ws.data?.origin;
+    const allowedOrigins = this.options.allowedOrigins;
+    if (allowedOrigins && allowedOrigins.length > 0) {
+      if (!origin || !allowedOrigins.includes(origin)) {
+        liveLog("websocket", null, `Connection rejected: origin '${origin || "none"}' not in allowedOrigins`);
+        ws.close(4003, "Origin not allowed");
+        return;
+      }
+    }
     const connectionId = `ws-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
     ws.data = {
       connectionId,
       components: /* @__PURE__ */ new Map(),
       subscriptions: /* @__PURE__ */ new Set(),
-      connectedAt: /* @__PURE__ */ new Date()
+      connectedAt: /* @__PURE__ */ new Date(),
+      origin
     };
     this.connectionManager.registerConnection(ws, connectionId);
-    this.debugger.trackConnection(connectionId);
-    ws.send(JSON.stringify({
+    sendImmediate(ws, JSON.stringify({
       type: "CONNECTION_ESTABLISHED",
       connectionId,
       timestamp: Date.now()
@@ -2979,7 +4313,7 @@ var LiveServer = class {
     if (connectionId) {
       const limiter = this.rateLimiter.get(connectionId);
       if (!limiter.tryConsume()) {
-        ws.send(JSON.stringify({ type: "ERROR", error: "Rate limit exceeded", timestamp: Date.now() }));
+        sendImmediate(ws, JSON.stringify({ type: "ERROR", error: "Rate limit exceeded", timestamp: Date.now() }));
         return;
       }
     }
@@ -2989,26 +4323,33 @@ var LiveServer = class {
         if (header.type === "FILE_UPLOAD_CHUNK") {
           const chunkMessage = { ...header, data: "" };
           const progress = await this.fileUploadManager.receiveChunk(chunkMessage, data);
-          if (progress) ws.send(JSON.stringify(progress));
+          if (progress) sendImmediate(ws, JSON.stringify(progress));
         }
       } catch (error) {
-        ws.send(JSON.stringify({ type: "ERROR", error: error.message, timestamp: Date.now() }));
+        sendImmediate(ws, JSON.stringify({ type: "ERROR", error: error.message, timestamp: Date.now() }));
       }
       return;
     }
+    const str = typeof rawMessage === "string" ? rawMessage : new TextDecoder().decode(rawMessage);
+    if (str.length > MAX_MESSAGE_SIZE) {
+      sendImmediate(ws, JSON.stringify({ type: "ERROR", error: "Message too large", timestamp: Date.now() }));
+      return;
+    }
     let message;
     try {
-      const str = typeof rawMessage === "string" ? rawMessage : new TextDecoder().decode(rawMessage);
       message = JSON.parse(str);
     } catch {
-      ws.send(JSON.stringify({ type: "ERROR", error: "Invalid JSON", timestamp: Date.now() }));
+      sendImmediate(ws, JSON.stringify({ type: "ERROR", error: "Invalid JSON", timestamp: Date.now() }));
       return;
     }
+    if (message.payload) {
+      message.payload = sanitizePayload(message.payload);
+    }
     try {
       if (message.type === "AUTH") {
         const authContext = await this.authManager.authenticate(message.payload || {});
         if (ws.data) ws.data.authContext = authContext;
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "AUTH_RESPONSE",
           success: authContext.authenticated,
           payload: authContext.authenticated ? { userId: authContext.user?.id } : { error: "Authentication failed" },
@@ -3022,7 +4363,7 @@ var LiveServer = class {
       }
       if (message.type === "FILE_UPLOAD_START") {
         const result2 = await this.fileUploadManager.startUpload(message, ws.data?.userId);
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "FILE_UPLOAD_START_RESPONSE",
           componentId: message.componentId,
           uploadId: message.payload?.uploadId,
@@ -3035,12 +4376,12 @@ var LiveServer = class {
       }
       if (message.type === "FILE_UPLOAD_CHUNK") {
         const progress = await this.fileUploadManager.receiveChunk(message);
-        if (progress) ws.send(JSON.stringify(progress));
+        if (progress) sendImmediate(ws, JSON.stringify(progress));
         return;
       }
       if (message.type === "FILE_UPLOAD_COMPLETE") {
         const result2 = await this.fileUploadManager.completeUpload(message);
-        ws.send(JSON.stringify(result2));
+        sendImmediate(ws, JSON.stringify(result2));
         return;
       }
       if (message.type === "COMPONENT_REHYDRATE") {
@@ -3051,7 +4392,7 @@ var LiveServer = class {
           ws,
           { room: message.payload.room, userId: message.userId }
         );
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "COMPONENT_REHYDRATED",
           componentId: message.componentId,
           success: result2.success,
@@ -3075,10 +4416,10 @@ var LiveServer = class {
           responseId: message.responseId,
           timestamp: Date.now()
         };
-        ws.send(JSON.stringify(response));
+        sendImmediate(ws, JSON.stringify(response));
       }
     } catch (error) {
-      ws.send(JSON.stringify({
+      sendImmediate(ws, JSON.stringify({
         type: "ERROR",
         componentId: message.componentId,
         error: error.message,
@@ -3096,7 +4437,6 @@ var LiveServer = class {
       this.connectionManager.cleanupConnection(connectionId);
       this.rateLimiter.remove(connectionId);
     }
-    this.debugger.trackDisconnection(connectionId || "", componentCount);
     liveLog("websocket", null, `Connection closed: ${connectionId} (${componentCount} components)`);
   }
   handleError(ws, error) {
@@ -3108,8 +4448,58 @@ var LiveServer = class {
     const roomId = message.roomId || message.payload?.roomId;
     switch (message.type) {
       case "ROOM_JOIN": {
+        if (this.roomRegistry.resolveFromId(roomId)) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: "Room requires server-side join via component action",
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
+        const connRooms = ws.data?.rooms;
+        if (connRooms && connRooms.size >= MAX_ROOMS_PER_CONNECTION) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: "Room limit exceeded",
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
+        if (this.authManager.hasProviders()) {
+          const authContext = ws.data?.authContext;
+          const authResult = await this.authManager.authorizeRoom(
+            authContext || ANONYMOUS_CONTEXT,
+            roomId
+          );
+          if (!authResult.allowed) {
+            sendImmediate(ws, JSON.stringify({
+              type: "ERROR",
+              componentId,
+              error: authResult.reason || "Room access denied",
+              requestId: message.requestId,
+              timestamp: Date.now()
+            }));
+            break;
+          }
+        }
         const result = this.roomManager.joinRoom(componentId, roomId, ws, message.payload?.initialState);
-        ws.send(JSON.stringify({
+        if ("rejected" in result && result.rejected) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: result.reason,
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
+        if (!ws.data.rooms) ws.data.rooms = /* @__PURE__ */ new Set();
+        ws.data.rooms.add(roomId);
+        sendImmediate(ws, JSON.stringify({
           type: "ROOM_JOINED",
           componentId,
           payload: { roomId, state: result.state },
@@ -3120,7 +4510,8 @@ var LiveServer = class {
       }
       case "ROOM_LEAVE":
         this.roomManager.leaveRoom(componentId, roomId);
-        ws.send(JSON.stringify({
+        ws.data?.rooms?.delete(roomId);
+        sendImmediate(ws, JSON.stringify({
           type: "ROOM_LEFT",
           componentId,
           payload: { roomId },
@@ -3128,15 +4519,57 @@ var LiveServer = class {
           timestamp: Date.now()
         }));
         break;
-      case "ROOM_EMIT":
+      case "ROOM_EMIT": {
+        if (!this.roomManager.isInRoom(componentId, roomId)) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: "Not a member of this room",
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
         this.roomManager.emitToRoom(roomId, message.payload?.event, message.payload?.data, componentId);
         break;
-      case "ROOM_STATE_SET":
+      }
+      case "ROOM_STATE_SET": {
+        if (!this.roomManager.isInRoom(componentId, roomId)) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: "Not a member of this room",
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
+        if (this.roomManager.isServerOnlyState(roomId)) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: "Room state is server-only",
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
         this.roomManager.setRoomState(roomId, message.payload?.state, componentId);
         break;
+      }
       case "ROOM_STATE_GET": {
+        if (!this.roomManager.isInRoom(componentId, roomId)) {
+          sendImmediate(ws, JSON.stringify({
+            type: "ERROR",
+            componentId,
+            error: "Not a member of this room",
+            requestId: message.requestId,
+            timestamp: Date.now()
+          }));
+          break;
+        }
         const state = this.roomManager.getRoomState(roomId);
-        ws.send(JSON.stringify({
+        sendImmediate(ws, JSON.stringify({
           type: "ROOM_STATE",
           componentId,
           payload: { roomId, state },
@@ -3153,7 +4586,7 @@ var LiveServer = class {
       {
         method: "GET",
         path: `${prefix}/stats`,
-        handler: async () => ({
+        handler: () => ({
           body: {
             components: this.registry.getStats(),
             rooms: this.roomManager.getStats(),
@@ -3167,7 +4600,7 @@ var LiveServer = class {
       {
         method: "GET",
         path: `${prefix}/components`,
-        handler: async () => ({
+        handler: () => ({
           body: { names: this.registry.getRegisteredComponentNames() }
         }),
         metadata: { summary: "List registered component names", tags: ["live"] }
@@ -3175,7 +4608,7 @@ var LiveServer = class {
       {
         method: "POST",
         path: `${prefix}/rooms/:roomId/messages`,
-        handler: async (req) => {
+        handler: (req) => {
           const roomId = req.params.roomId;
           this.roomManager.emitToRoom(roomId, "message:new", req.body);
           return { body: { success: true, roomId } };
@@ -3185,7 +4618,7 @@ var LiveServer = class {
       {
         method: "POST",
         path: `${prefix}/rooms/:roomId/emit`,
-        handler: async (req) => {
+        handler: (req) => {
           const roomId = req.params.roomId;
           const { event, data } = req.body;
           this.roomManager.emitToRoom(roomId, event, data);
@@ -3329,6 +4762,66 @@ var RoomStateManager = class {
   }
 };
 
-export { ANONYMOUS_CONTEXT, AnonymousContext, AuthenticatedContext, ComponentRegistry, ConnectionRateLimiter, DEFAULT_CHUNK_SIZE, DEFAULT_WS_PATH, FileUploadManager, LiveAuthManager, LiveComponent, LiveDebugger, LiveRoomManager, LiveServer, PROTOCOL_VERSION, PerformanceMonitor, RateLimiterRegistry, RoomEventBus, RoomStateManager, StateSignatureManager, WebSocketConnectionManager, createTypedRoomEventBus, createTypedRoomState, decodeBinaryChunk, encodeBinaryChunk, getLiveComponentContext, liveLog, liveWarn, registerComponentLogging, setLiveComponentContext, unregisterComponentLogging };
+// src/rooms/InMemoryRoomAdapter.ts
+var InMemoryRoomAdapter = class {
+  rooms = /* @__PURE__ */ new Map();
+  // ===== IRoomStorageAdapter =====
+  async getOrCreateRoom(roomId, initialState) {
+    const existing = this.rooms.get(roomId);
+    if (existing) {
+      return { state: existing.state, created: false };
+    }
+    const now = Date.now();
+    const data = {
+      state: initialState ?? {},
+      createdAt: now,
+      lastUpdate: now
+    };
+    this.rooms.set(roomId, data);
+    return { state: data.state, created: true };
+  }
+  async getState(roomId) {
+    return this.rooms.get(roomId)?.state ?? {};
+  }
+  async updateState(roomId, updates) {
+    const room = this.rooms.get(roomId);
+    if (room) {
+      Object.assign(room.state, updates);
+      room.lastUpdate = Date.now();
+    }
+  }
+  async hasRoom(roomId) {
+    return this.rooms.has(roomId);
+  }
+  async deleteRoom(roomId) {
+    return this.rooms.delete(roomId);
+  }
+  async getStats() {
+    const rooms = {};
+    for (const [id, data] of this.rooms) {
+      rooms[id] = {
+        createdAt: data.createdAt,
+        lastUpdate: data.lastUpdate,
+        stateKeys: Object.keys(data.state)
+      };
+    }
+    return { totalRooms: this.rooms.size, rooms };
+  }
+  // ===== IRoomPubSubAdapter =====
+  // No-ops for single-instance: all events are already propagated locally
+  // by RoomEventBus and LiveRoomManager's broadcastToRoom().
+  async publish(_roomId, _event, _data) {
+  }
+  async subscribe(_roomId, _handler) {
+    return () => {
+    };
+  }
+  async publishMembership(_roomId, _action, _componentId) {
+  }
+  async publishStateChange(_roomId, _updates) {
+  }
+};
+
+export { ANONYMOUS_CONTEXT, AnonymousContext, AuthenticatedContext, BINARY_ROOM_EVENT, BINARY_ROOM_STATE, ComponentRegistry, ConnectionRateLimiter, DEFAULT_CHUNK_SIZE, DEFAULT_WS_PATH, EMIT_OVERRIDE_KEY, FileUploadManager, InMemoryRoomAdapter, LiveAuthManager, LiveComponent, LiveRoom, LiveRoomManager, LiveServer, PROTOCOL_VERSION, PerformanceMonitor, RateLimiterRegistry, RoomEventBus, RoomRegistry, RoomStateManager, StateSignatureManager, WebSocketConnectionManager, buildRoomFrame, buildRoomFrameTail, createTypedRoomEventBus, createTypedRoomState, decodeBinaryChunk, encodeBinaryChunk, getLiveComponentContext, jsonCodec, liveLog, liveWarn, msgpackCodec, parseRoomFrame, prependMemberHeader, queueWsMessage, registerComponentLogging, resolveCodec, sendBinaryImmediate, sendImmediate, setLiveComponentContext, unregisterComponentLogging };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map