chore: release packages (#389)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>

README.md

@@ -49,7 +49,12 @@ npm install @esengine/ecs-framework
 | **Timer** | Timer and cooldown systems | No |
 | **Spatial** | Spatial indexing and queries (QuadTree, Grid) | No |
 | **Pathfinding** | A* and navigation mesh pathfinding | No |
-| **Network** | Client/server networking with TSRPC | No |
+| **Procgen** | Procedural generation (noise, random, sampling) | No |
+| **RPC** | High-performance RPC communication framework | No |
+| **Server** | Game server framework with rooms, auth, rate limiting | No |
+| **Network** | Client networking with prediction, AOI, delta compression | No |
+| **Transaction** | Game transaction system with Redis/Memory storage | No |
+| **World Streaming** | Open world chunk loading and streaming | No |
 
 > All framework modules can be used standalone with any rendering engine.
 
@@ -199,7 +204,12 @@ npm install @esengine/fsm                # State machines
 npm install @esengine/timer              # Timers & cooldowns
 npm install @esengine/spatial            # Spatial indexing
 npm install @esengine/pathfinding        # Pathfinding
-npm install @esengine/network            # Networking
+npm install @esengine/procgen            # Procedural generation
+npm install @esengine/rpc                # RPC framework
+npm install @esengine/server             # Game server
+npm install @esengine/network            # Client networking
+npm install @esengine/transaction        # Transaction system
+npm install @esengine/world-streaming    # World streaming
 ```
 
 ### ESEngine Runtime (Optional)
@@ -235,7 +245,11 @@ esengine/
 │   │   ├── spatial/       # Spatial queries
 │   │   ├── pathfinding/   # Pathfinding
 │   │   ├── procgen/       # Procedural generation
-│   │   └── network/       # Networking
+│   │   ├── rpc/           # RPC framework
+│   │   ├── server/        # Game server
+│   │   ├── network/       # Client networking
+│   │   ├── transaction/   # Transaction system
+│   │   └── world-streaming/ # World streaming
 │   │
 │   ├── engine/            # ESEngine runtime
 │   ├── rendering/         # Rendering modules

README_CN.md

@@ -49,7 +49,12 @@ npm install @esengine/ecs-framework
 | **定时器** | 定时器和冷却系统 | 否 |
 | **空间索引** | 空间查询（四叉树、网格） | 否 |
 | **寻路** | A* 和导航网格寻路 | 否 |
-| **网络** | 客户端/服务端网络通信 (TSRPC) | 否 |
+| **程序化生成** | 噪声、随机、采样等生成算法 | 否 |
+| **RPC** | 高性能 RPC 通信框架 | 否 |
+| **服务端** | 游戏服务器框架，支持房间、认证、速率限制 | 否 |
+| **网络** | 客户端网络，支持预测、AOI、增量压缩 | 否 |
+| **事务系统** | 游戏事务系统，支持 Redis/内存存储 | 否 |
+| **世界流送** | 开放世界分块加载和流送 | 否 |
 
 > 所有框架模块都可以独立使用，无需依赖特定渲染引擎。
 
@@ -199,7 +204,12 @@ npm install @esengine/fsm                # 状态机
 npm install @esengine/timer              # 定时器和冷却
 npm install @esengine/spatial            # 空间索引
 npm install @esengine/pathfinding        # 寻路
-npm install @esengine/network            # 网络
+npm install @esengine/procgen            # 程序化生成
+npm install @esengine/rpc                # RPC 框架
+npm install @esengine/server             # 游戏服务器
+npm install @esengine/network            # 客户端网络
+npm install @esengine/transaction        # 事务系统
+npm install @esengine/world-streaming    # 世界流送
 ```
 
 ### ESEngine 运行时（可选）
@@ -235,7 +245,11 @@ esengine/
 │   │   ├── spatial/       # 空间查询
 │   │   ├── pathfinding/   # 寻路
 │   │   ├── procgen/       # 程序化生成
-│   │   └── network/       # 网络
+│   │   ├── rpc/           # RPC 框架
+│   │   ├── server/        # 游戏服务器
+│   │   ├── network/       # 客户端网络
+│   │   ├── transaction/   # 事务系统
+│   │   └── world-streaming/ # 世界流送
 │   │
 │   ├── engine/            # ESEngine 运行时
 │   ├── rendering/         # 渲染模块

docs/astro.config.mjs

@@ -255,6 +255,9 @@ export default defineConfig({
               translations: { en: 'RPC' },
               items: [
                 { label: '概述', slug: 'modules/rpc', translations: { en: 'Overview' } },
+                { label: '服务端', slug: 'modules/rpc/server', translations: { en: 'Server' } },
+                { label: '客户端', slug: 'modules/rpc/client', translations: { en: 'Client' } },
+                { label: '编解码', slug: 'modules/rpc/codec', translations: { en: 'Codec' } },
               ],
             },
             {
@@ -264,10 +267,26 @@ export default defineConfig({
                 { label: '概述', slug: 'modules/network', translations: { en: 'Overview' } },
                 { label: '客户端', slug: 'modules/network/client', translations: { en: 'Client' } },
                 { label: '服务器', slug: 'modules/network/server', translations: { en: 'Server' } },
+                { label: '认证系统', slug: 'modules/network/auth', translations: { en: 'Authentication' } },
+                { label: '速率限制', slug: 'modules/network/rate-limit', translations: { en: 'Rate Limiting' } },
                 { label: '状态同步', slug: 'modules/network/sync', translations: { en: 'State Sync' } },
+                { label: '客户端预测', slug: 'modules/network/prediction', translations: { en: 'Prediction' } },
+                { label: 'AOI 兴趣区域', slug: 'modules/network/aoi', translations: { en: 'AOI' } },
+                { label: '增量压缩', slug: 'modules/network/delta', translations: { en: 'Delta Compression' } },
                 { label: 'API 参考', slug: 'modules/network/api', translations: { en: 'API Reference' } },
               ],
             },
+            {
+              label: '事务系统',
+              translations: { en: 'Transaction' },
+              items: [
+                { label: '概述', slug: 'modules/transaction', translations: { en: 'Overview' } },
+                { label: '核心概念', slug: 'modules/transaction/core', translations: { en: 'Core Concepts' } },
+                { label: '存储层', slug: 'modules/transaction/storage', translations: { en: 'Storage Layer' } },
+                { label: '操作', slug: 'modules/transaction/operations', translations: { en: 'Operations' } },
+                { label: '分布式事务', slug: 'modules/transaction/distributed', translations: { en: 'Distributed' } },
+              ],
+            },
             {
               label: '世界流式加载',
               translations: { en: 'World Streaming' },
@@ -303,6 +322,8 @@ export default defineConfig({
             { label: '@esengine/fsm', link: 'https://github.com/esengine/esengine/blob/master/packages/framework/fsm/CHANGELOG.md', attrs: { target: '_blank' } },
             { label: '@esengine/timer', link: 'https://github.com/esengine/esengine/blob/master/packages/framework/timer/CHANGELOG.md', attrs: { target: '_blank' } },
             { label: '@esengine/network', link: 'https://github.com/esengine/esengine/blob/master/packages/framework/network/CHANGELOG.md', attrs: { target: '_blank' } },
+            { label: '@esengine/transaction', link: 'https://github.com/esengine/esengine/blob/master/packages/framework/transaction/CHANGELOG.md', attrs: { target: '_blank' } },
+            { label: '@esengine/rpc', link: 'https://github.com/esengine/esengine/blob/master/packages/framework/rpc/CHANGELOG.md', attrs: { target: '_blank' } },
             { label: '@esengine/cli', link: 'https://github.com/esengine/esengine/blob/master/packages/tools/cli/CHANGELOG.md', attrs: { target: '_blank' } },
           ],
         },

docs/src/content/docs/en/modules/index.md

@@ -34,6 +34,7 @@ ESEngine provides a rich set of modules that can be imported as needed.
 | Module | Package | Description |
 |--------|---------|-------------|
 | [Network](/en/modules/network/) | `@esengine/network` | Multiplayer game networking |
+| [Transaction](/en/modules/transaction/) | `@esengine/transaction` | Game transactions with distributed support |
 
 ## Installation
 

docs/src/content/docs/en/modules/network/auth.md

@@ -0,0 +1,506 @@
+---
+title: "Authentication"
+description: "Add authentication to your game server with JWT and Session providers"
+---
+
+The `@esengine/server` package includes a pluggable authentication system that supports JWT, session-based auth, and custom providers.
+
+## Installation
+
+Authentication is included in the server package:
+
+```bash
+npm install @esengine/server jsonwebtoken
+```
+
+> Note: `jsonwebtoken` is an optional peer dependency, required only for JWT authentication.
+
+## Quick Start
+
+### JWT Authentication
+
+```typescript
+import { createServer } from '@esengine/server'
+import { withAuth, createJwtAuthProvider, withRoomAuth, requireAuth } from '@esengine/server/auth'
+
+// Create JWT provider
+const jwtProvider = createJwtAuthProvider({
+    secret: process.env.JWT_SECRET!,
+    expiresIn: 3600, // 1 hour
+})
+
+// Wrap server with authentication
+const server = withAuth(await createServer({ port: 3000 }), {
+    provider: jwtProvider,
+    extractCredentials: (req) => {
+        const url = new URL(req.url ?? '', 'http://localhost')
+        return url.searchParams.get('token')
+    },
+})
+
+// Define authenticated room
+class GameRoom extends withRoomAuth(Room, { requireAuth: true }) {
+    onJoin(player) {
+        console.log(`${player.user?.name} joined!`)
+    }
+}
+
+server.define('game', GameRoom)
+await server.start()
+```
+
+## Auth Providers
+
+### JWT Provider
+
+Use JSON Web Tokens for stateless authentication:
+
+```typescript
+import { createJwtAuthProvider } from '@esengine/server/auth'
+
+const jwtProvider = createJwtAuthProvider({
+    // Required: secret key
+    secret: 'your-secret-key',
+
+    // Optional: algorithm (default: HS256)
+    algorithm: 'HS256',
+
+    // Optional: expiration in seconds (default: 3600)
+    expiresIn: 3600,
+
+    // Optional: issuer for validation
+    issuer: 'my-game-server',
+
+    // Optional: audience for validation
+    audience: 'my-game-client',
+
+    // Optional: custom user extraction
+    getUser: async (payload) => {
+        // Fetch user from database
+        return await db.users.findById(payload.sub)
+    },
+})
+
+// Sign a token (for login endpoints)
+const token = jwtProvider.sign({
+    sub: user.id,
+    name: user.name,
+    roles: ['player'],
+})
+
+// Decode without verification (for debugging)
+const payload = jwtProvider.decode(token)
+```
+
+### Session Provider
+
+Use server-side sessions for stateful authentication:
+
+```typescript
+import { createSessionAuthProvider, type ISessionStorage } from '@esengine/server/auth'
+
+// Custom storage implementation
+const storage: ISessionStorage = {
+    async get<T>(key: string): Promise<T | null> {
+        return await redis.get(key)
+    },
+    async set<T>(key: string, value: T): Promise<void> {
+        await redis.set(key, value)
+    },
+    async delete(key: string): Promise<boolean> {
+        return await redis.del(key) > 0
+    },
+}
+
+const sessionProvider = createSessionAuthProvider({
+    storage,
+    sessionTTL: 86400000, // 24 hours in ms
+
+    // Optional: validate user on each request
+    validateUser: (user) => !user.banned,
+})
+
+// Create session (for login endpoints)
+const sessionId = await sessionProvider.createSession(user, {
+    ipAddress: req.ip,
+    userAgent: req.headers['user-agent'],
+})
+
+// Revoke session (for logout)
+await sessionProvider.revoke(sessionId)
+```
+
+## Server Auth Mixin
+
+The `withAuth` function wraps your server to add authentication:
+
+```typescript
+import { withAuth } from '@esengine/server/auth'
+
+const server = withAuth(baseServer, {
+    // Required: auth provider
+    provider: jwtProvider,
+
+    // Required: extract credentials from request
+    extractCredentials: (req) => {
+        // From query string
+        return new URL(req.url, 'http://localhost').searchParams.get('token')
+
+        // Or from headers
+        // return req.headers['authorization']?.replace('Bearer ', '')
+    },
+
+    // Optional: handle auth failure
+    onAuthFailed: (conn, error) => {
+        console.log(`Auth failed: ${error}`)
+    },
+})
+```
+
+### Accessing Auth Context
+
+After authentication, the auth context is available on connections:
+
+```typescript
+import { getAuthContext } from '@esengine/server/auth'
+
+server.onConnect = (conn) => {
+    const auth = getAuthContext(conn)
+
+    if (auth.isAuthenticated) {
+        console.log(`User ${auth.userId} connected`)
+        console.log(`Roles: ${auth.roles}`)
+    }
+}
+```
+
+## Room Auth Mixin
+
+The `withRoomAuth` function adds authentication checks to rooms:
+
+```typescript
+import { withRoomAuth, type AuthPlayer } from '@esengine/server/auth'
+
+interface User {
+    id: string
+    name: string
+    roles: string[]
+}
+
+class GameRoom extends withRoomAuth<User>(Room, {
+    // Require authentication to join
+    requireAuth: true,
+
+    // Optional: require specific roles
+    allowedRoles: ['player', 'premium'],
+
+    // Optional: role check mode ('any' or 'all')
+    roleCheckMode: 'any',
+}) {
+    // player has .auth and .user properties
+    onJoin(player: AuthPlayer<User>) {
+        console.log(`${player.user?.name} joined`)
+        console.log(`Is premium: ${player.auth.hasRole('premium')}`)
+    }
+
+    // Optional: custom auth validation
+    async onAuth(player: AuthPlayer<User>): Promise<boolean> {
+        // Additional validation logic
+        if (player.auth.hasRole('banned')) {
+            return false
+        }
+        return true
+    }
+
+    @onMessage('Chat')
+    handleChat(data: { text: string }, player: AuthPlayer<User>) {
+        this.broadcast('Chat', {
+            from: player.user?.name ?? 'Guest',
+            text: data.text,
+        })
+    }
+}
+```
+
+### AuthPlayer Interface
+
+Players in auth rooms have additional properties:
+
+```typescript
+interface AuthPlayer<TUser> extends Player {
+    // Full auth context
+    readonly auth: IAuthContext<TUser>
+
+    // User info (shortcut for auth.user)
+    readonly user: TUser | null
+}
+```
+
+### Room Auth Helpers
+
+```typescript
+class GameRoom extends withRoomAuth<User>(Room) {
+    someMethod() {
+        // Get player by user ID
+        const player = this.getPlayerByUserId('user-123')
+
+        // Get all players with a role
+        const admins = this.getPlayersByRole('admin')
+
+        // Get player with auth info
+        const authPlayer = this.getAuthPlayer(playerId)
+    }
+}
+```
+
+## Auth Decorators
+
+### @requireAuth
+
+Mark message handlers as requiring authentication:
+
+```typescript
+import { requireAuth, requireRole, onMessage } from '@esengine/server/auth'
+
+class GameRoom extends withRoomAuth(Room) {
+    @requireAuth()
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: AuthPlayer) {
+        // Only authenticated players can trade
+    }
+
+    @requireAuth({ allowGuest: true })
+    @onMessage('Chat')
+    handleChat(data: ChatData, player: AuthPlayer) {
+        // Guests can also chat
+    }
+}
+```
+
+### @requireRole
+
+Require specific roles for message handlers:
+
+```typescript
+class AdminRoom extends withRoomAuth(Room) {
+    @requireRole('admin')
+    @onMessage('Ban')
+    handleBan(data: BanData, player: AuthPlayer) {
+        // Only admins can ban
+    }
+
+    @requireRole(['moderator', 'admin'])
+    @onMessage('Mute')
+    handleMute(data: MuteData, player: AuthPlayer) {
+        // Moderators OR admins can mute
+    }
+
+    @requireRole(['verified', 'premium'], { mode: 'all' })
+    @onMessage('SpecialFeature')
+    handleSpecial(data: any, player: AuthPlayer) {
+        // Requires BOTH verified AND premium roles
+    }
+}
+```
+
+## Auth Context API
+
+The auth context provides various methods for checking authentication state:
+
+```typescript
+interface IAuthContext<TUser> {
+    // Authentication state
+    readonly isAuthenticated: boolean
+    readonly user: TUser | null
+    readonly userId: string | null
+    readonly roles: ReadonlyArray<string>
+    readonly authenticatedAt: number | null
+    readonly expiresAt: number | null
+
+    // Role checking
+    hasRole(role: string): boolean
+    hasAnyRole(roles: string[]): boolean
+    hasAllRoles(roles: string[]): boolean
+}
+```
+
+The `AuthContext` class (implementation) also provides:
+
+```typescript
+class AuthContext<TUser> implements IAuthContext<TUser> {
+    // Set authentication from result
+    setAuthenticated(result: AuthResult<TUser>): void
+
+    // Clear authentication state
+    clear(): void
+}
+```
+
+## Testing
+
+Use the mock auth provider for unit tests:
+
+```typescript
+import { createMockAuthProvider } from '@esengine/server/auth/testing'
+
+// Create mock provider with preset users
+const mockProvider = createMockAuthProvider({
+    users: [
+        { id: '1', name: 'Alice', roles: ['player'] },
+        { id: '2', name: 'Bob', roles: ['admin', 'player'] },
+    ],
+    autoCreate: true, // Create users for unknown tokens
+})
+
+// Use in tests
+const server = withAuth(testServer, {
+    provider: mockProvider,
+    extractCredentials: (req) => req.headers['x-token'],
+})
+
+// Verify with user ID as token
+const result = await mockProvider.verify('1')
+// result.user = { id: '1', name: 'Alice', roles: ['player'] }
+
+// Add/remove users dynamically
+mockProvider.addUser({ id: '3', name: 'Charlie', roles: ['guest'] })
+mockProvider.removeUser('3')
+
+// Revoke tokens
+await mockProvider.revoke('1')
+
+// Reset to initial state
+mockProvider.clear()
+```
+
+## Error Handling
+
+Auth errors include error codes for programmatic handling:
+
+```typescript
+type AuthErrorCode =
+    | 'INVALID_CREDENTIALS'       // Invalid username/password
+    | 'INVALID_TOKEN'             // Token is malformed or invalid
+    | 'EXPIRED_TOKEN'             // Token has expired
+    | 'USER_NOT_FOUND'            // User lookup failed
+    | 'ACCOUNT_DISABLED'          // User account is disabled
+    | 'RATE_LIMITED'              // Too many requests
+    | 'INSUFFICIENT_PERMISSIONS'  // Insufficient permissions
+
+// In your auth failure handler
+const server = withAuth(baseServer, {
+    provider: jwtProvider,
+    extractCredentials,
+    onAuthFailed: (conn, error) => {
+        switch (error.errorCode) {
+            case 'EXPIRED_TOKEN':
+                conn.send('AuthError', { code: 'TOKEN_EXPIRED' })
+                break
+            case 'INVALID_TOKEN':
+                conn.send('AuthError', { code: 'INVALID_TOKEN' })
+                break
+            default:
+                conn.close()
+        }
+    },
+})
+```
+
+## Complete Example
+
+Here's a complete example with JWT authentication:
+
+```typescript
+// server.ts
+import { createServer } from '@esengine/server'
+import {
+    withAuth,
+    withRoomAuth,
+    createJwtAuthProvider,
+    requireAuth,
+    requireRole,
+    type AuthPlayer,
+} from '@esengine/server/auth'
+
+// Types
+interface User {
+    id: string
+    name: string
+    roles: string[]
+}
+
+// JWT Provider
+const jwtProvider = createJwtAuthProvider<User>({
+    secret: process.env.JWT_SECRET!,
+    expiresIn: 3600,
+    getUser: async (payload) => ({
+        id: payload.sub as string,
+        name: payload.name as string,
+        roles: (payload.roles as string[]) ?? [],
+    }),
+})
+
+// Create authenticated server
+const server = withAuth(
+    await createServer({ port: 3000 }),
+    {
+        provider: jwtProvider,
+        extractCredentials: (req) => {
+            return new URL(req.url ?? '', 'http://localhost')
+                .searchParams.get('token')
+        },
+    }
+)
+
+// Game Room with auth
+class GameRoom extends withRoomAuth<User>(Room, {
+    requireAuth: true,
+    allowedRoles: ['player'],
+}) {
+    onCreate() {
+        console.log('Game room created')
+    }
+
+    onJoin(player: AuthPlayer<User>) {
+        console.log(`${player.user?.name} joined!`)
+        this.broadcast('PlayerJoined', {
+            id: player.id,
+            name: player.user?.name,
+        })
+    }
+
+    @requireAuth()
+    @onMessage('Move')
+    handleMove(data: { x: number; y: number }, player: AuthPlayer<User>) {
+        // Handle movement
+    }
+
+    @requireRole('admin')
+    @onMessage('Kick')
+    handleKick(data: { playerId: string }, player: AuthPlayer<User>) {
+        const target = this.getPlayer(data.playerId)
+        if (target) {
+            this.kick(target, 'Kicked by admin')
+        }
+    }
+}
+
+server.define('game', GameRoom)
+await server.start()
+```
+
+## Best Practices
+
+1. **Secure your secrets**: Never hardcode JWT secrets. Use environment variables.
+
+2. **Set reasonable expiration**: Balance security and user experience when setting token TTL.
+
+3. **Validate on critical actions**: Use `@requireAuth` on sensitive message handlers.
+
+4. **Use role-based access**: Implement proper role hierarchy for admin functions.
+
+5. **Handle token refresh**: Implement token refresh logic for long sessions.
+
+6. **Log auth events**: Track login attempts and failures for security monitoring.
+
+7. **Test auth flows**: Use `MockAuthProvider` to test authentication scenarios.

docs/src/content/docs/en/modules/network/rate-limit.md

@@ -0,0 +1,458 @@
+---
+title: "Rate Limiting"
+description: "Protect your game server from abuse with configurable rate limiting"
+---
+
+The `@esengine/server` package includes a pluggable rate limiting system to protect against DDoS attacks, message flooding, and other abuse.
+
+## Installation
+
+Rate limiting is included in the server package:
+
+```bash
+npm install @esengine/server
+```
+
+## Quick Start
+
+```typescript
+import { Room, onMessage } from '@esengine/server'
+import { withRateLimit, rateLimit, noRateLimit } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room, {
+    messagesPerSecond: 10,
+    burstSize: 20,
+    onLimited: (player, type, result) => {
+        player.send('Error', {
+            code: 'RATE_LIMITED',
+            retryAfter: result.retryAfter,
+        })
+    },
+}) {
+    @onMessage('Move')
+    handleMove(data: { x: number; y: number }, player: Player) {
+        // Protected by rate limit (10 msg/s default)
+    }
+
+    @rateLimit({ messagesPerSecond: 1 })
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: Player) {
+        // Stricter limit for trading
+    }
+
+    @noRateLimit()
+    @onMessage('Heartbeat')
+    handleHeartbeat(data: any, player: Player) {
+        // No rate limit for heartbeat
+    }
+}
+```
+
+## Rate Limit Strategies
+
+### Token Bucket (Default)
+
+The token bucket algorithm allows burst traffic while maintaining long-term rate limits. Tokens are added at a fixed rate, and each request consumes tokens.
+
+```typescript
+import { withRateLimit } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room, {
+    strategy: 'token-bucket',
+    messagesPerSecond: 10, // Refill rate
+    burstSize: 20,         // Bucket capacity
+}) { }
+```
+
+**How it works:**
+```
+Config: rate=10/s, burstSize=20
+
+[0s]   Bucket full: 20 tokens
+[0s]   15 messages → allowed, 5 remaining
+[0.5s] Refill 5 tokens → 10 tokens
+[0.5s] 8 messages → allowed, 2 remaining
+[0.6s] Refill 1 token → 3 tokens
+[0.6s] 5 messages → 3 allowed, 2 rejected
+```
+
+**Best for:** Most general use cases, balances burst tolerance with protection.
+
+### Sliding Window
+
+The sliding window algorithm precisely tracks requests within a time window. More accurate than fixed window but uses slightly more memory.
+
+```typescript
+class GameRoom extends withRateLimit(Room, {
+    strategy: 'sliding-window',
+    messagesPerSecond: 10,
+    burstSize: 10,
+}) { }
+```
+
+**Best for:** When you need precise rate limiting without burst tolerance.
+
+### Fixed Window
+
+The fixed window algorithm divides time into fixed intervals and counts requests per interval. Simple and memory-efficient but allows 2x burst at window boundaries.
+
+```typescript
+class GameRoom extends withRateLimit(Room, {
+    strategy: 'fixed-window',
+    messagesPerSecond: 10,
+    burstSize: 10,
+}) { }
+```
+
+**Best for:** Simple scenarios where boundary burst is acceptable.
+
+## Configuration
+
+### Room Configuration
+
+```typescript
+import { withRateLimit } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room, {
+    // Messages allowed per second (default: 10)
+    messagesPerSecond: 10,
+
+    // Burst capacity / bucket size (default: 20)
+    burstSize: 20,
+
+    // Strategy: 'token-bucket' | 'sliding-window' | 'fixed-window'
+    strategy: 'token-bucket',
+
+    // Callback when rate limited
+    onLimited: (player, messageType, result) => {
+        player.send('RateLimited', {
+            type: messageType,
+            retryAfter: result.retryAfter,
+        })
+    },
+
+    // Disconnect on rate limit (default: false)
+    disconnectOnLimit: false,
+
+    // Disconnect after N consecutive limits (0 = never)
+    maxConsecutiveLimits: 10,
+
+    // Custom key function (default: player.id)
+    getKey: (player) => player.id,
+
+    // Cleanup interval in ms (default: 60000)
+    cleanupInterval: 60000,
+}) { }
+```
+
+### Per-Message Configuration
+
+Use decorators to configure rate limits for specific messages:
+
+```typescript
+import { rateLimit, noRateLimit, rateLimitMessage } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room) {
+    // Custom rate limit for this message
+    @rateLimit({ messagesPerSecond: 1, burstSize: 2 })
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: Player) { }
+
+    // This message costs 5 tokens
+    @rateLimit({ cost: 5 })
+    @onMessage('ExpensiveAction')
+    handleExpensive(data: any, player: Player) { }
+
+    // Exempt from rate limiting
+    @noRateLimit()
+    @onMessage('Heartbeat')
+    handleHeartbeat(data: any, player: Player) { }
+
+    // Alternative: specify message type explicitly
+    @rateLimitMessage('SpecialAction', { messagesPerSecond: 2 })
+    @onMessage('SpecialAction')
+    handleSpecial(data: any, player: Player) { }
+}
+```
+
+## Combining with Authentication
+
+Rate limiting works seamlessly with the authentication system:
+
+```typescript
+import { withRoomAuth } from '@esengine/server/auth'
+import { withRateLimit } from '@esengine/server/ratelimit'
+
+// Apply both mixins
+class GameRoom extends withRateLimit(
+    withRoomAuth(Room, { requireAuth: true }),
+    { messagesPerSecond: 10 }
+) {
+    onJoin(player: AuthPlayer) {
+        console.log(`${player.user?.name} joined with rate limit protection`)
+    }
+}
+```
+
+## Rate Limit Result
+
+When a message is rate limited, the callback receives a result object:
+
+```typescript
+interface RateLimitResult {
+    // Whether the request was allowed
+    allowed: boolean
+
+    // Remaining quota
+    remaining: number
+
+    // When the quota resets (timestamp)
+    resetAt: number
+
+    // How long to wait before retrying (ms)
+    retryAfter?: number
+}
+```
+
+## Accessing Rate Limit Context
+
+You can access the rate limit context for any player:
+
+```typescript
+import { getPlayerRateLimitContext } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room) {
+    someMethod(player: Player) {
+        const context = this.getRateLimitContext(player)
+
+        // Check without consuming
+        const status = context?.check()
+        console.log(`Remaining: ${status?.remaining}`)
+
+        // Get consecutive limit count
+        console.log(`Consecutive limits: ${context?.consecutiveLimitCount}`)
+    }
+}
+
+// Or use the standalone function
+const context = getPlayerRateLimitContext(player)
+```
+
+## Custom Strategies
+
+You can use the strategies directly for custom implementations:
+
+```typescript
+import {
+    TokenBucketStrategy,
+    SlidingWindowStrategy,
+    FixedWindowStrategy,
+    createTokenBucketStrategy,
+} from '@esengine/server/ratelimit'
+
+// Create strategy directly
+const strategy = createTokenBucketStrategy({
+    rate: 10,      // tokens per second
+    capacity: 20,  // max tokens
+})
+
+// Check and consume
+const result = strategy.consume('player-123')
+if (result.allowed) {
+    // Process message
+} else {
+    // Rate limited, wait result.retryAfter ms
+}
+
+// Check without consuming
+const status = strategy.getStatus('player-123')
+
+// Reset a key
+strategy.reset('player-123')
+
+// Cleanup expired records
+strategy.cleanup()
+```
+
+## Rate Limit Context
+
+The `RateLimitContext` class manages rate limiting for a single player:
+
+```typescript
+import { RateLimitContext, TokenBucketStrategy } from '@esengine/server/ratelimit'
+
+const strategy = new TokenBucketStrategy({ rate: 10, capacity: 20 })
+const context = new RateLimitContext('player-123', strategy)
+
+// Check without consuming
+context.check()
+
+// Consume quota
+context.consume()
+
+// Consume with cost
+context.consume(undefined, 5)
+
+// Consume for specific message type
+context.consume('Trade')
+
+// Set per-message strategy
+context.setMessageStrategy('Trade', new TokenBucketStrategy({ rate: 1, capacity: 2 }))
+
+// Reset
+context.reset()
+
+// Get consecutive limit count
+console.log(context.consecutiveLimitCount)
+```
+
+## Room Lifecycle Hook
+
+You can override the `onRateLimited` hook for custom handling:
+
+```typescript
+class GameRoom extends withRateLimit(Room) {
+    onRateLimited(player: Player, messageType: string, result: RateLimitResult) {
+        // Log the event
+        console.log(`Player ${player.id} rate limited on ${messageType}`)
+
+        // Send custom error
+        player.send('SystemMessage', {
+            type: 'warning',
+            message: `Slow down! Try again in ${result.retryAfter}ms`,
+        })
+    }
+}
+```
+
+## Best Practices
+
+1. **Start with token bucket**: It's the most flexible algorithm for games.
+
+2. **Set appropriate limits**: Consider your game's mechanics:
+   - Movement messages: Higher limits (20-60/s)
+   - Chat messages: Lower limits (1-5/s)
+   - Trade/purchase: Very low limits (0.5-1/s)
+
+3. **Use burst capacity**: Allow short bursts for responsive gameplay:
+   ```typescript
+   messagesPerSecond: 10,
+   burstSize: 30, // Allow 3s worth of burst
+   ```
+
+4. **Exempt critical messages**: Don't rate limit heartbeats or system messages:
+   ```typescript
+   @noRateLimit()
+   @onMessage('Heartbeat')
+   handleHeartbeat() { }
+   ```
+
+5. **Combine with auth**: Rate limit by user ID for authenticated users:
+   ```typescript
+   getKey: (player) => player.auth?.userId ?? player.id
+   ```
+
+6. **Monitor and adjust**: Log rate limit events to tune your limits:
+   ```typescript
+   onLimited: (player, type, result) => {
+       metrics.increment('rate_limit', { messageType: type })
+   }
+   ```
+
+7. **Graceful degradation**: Send informative errors instead of just disconnecting:
+   ```typescript
+   onLimited: (player, type, result) => {
+       player.send('Error', {
+           code: 'RATE_LIMITED',
+           message: 'Too many requests',
+           retryAfter: result.retryAfter,
+       })
+   }
+   ```
+
+## Complete Example
+
+```typescript
+import { Room, onMessage, type Player } from '@esengine/server'
+import { withRoomAuth, type AuthPlayer } from '@esengine/server/auth'
+import {
+    withRateLimit,
+    rateLimit,
+    noRateLimit,
+    type RateLimitResult,
+} from '@esengine/server/ratelimit'
+
+interface User {
+    id: string
+    name: string
+    premium: boolean
+}
+
+// Combine auth and rate limit
+class GameRoom extends withRateLimit(
+    withRoomAuth<User>(Room, { requireAuth: true }),
+    {
+        messagesPerSecond: 10,
+        burstSize: 30,
+        strategy: 'token-bucket',
+
+        // Use user ID for rate limiting
+        getKey: (player) => (player as AuthPlayer<User>).user?.id ?? player.id,
+
+        // Handle rate limits
+        onLimited: (player, type, result) => {
+            player.send('Error', {
+                code: 'RATE_LIMITED',
+                messageType: type,
+                retryAfter: result.retryAfter,
+            })
+        },
+
+        // Disconnect after 20 consecutive rate limits
+        maxConsecutiveLimits: 20,
+    }
+) {
+    onCreate() {
+        console.log('Room created with auth + rate limit protection')
+    }
+
+    onJoin(player: AuthPlayer<User>) {
+        this.broadcast('PlayerJoined', { name: player.user?.name })
+    }
+
+    // High-frequency movement (default rate limit)
+    @onMessage('Move')
+    handleMove(data: { x: number; y: number }, player: AuthPlayer<User>) {
+        this.broadcast('PlayerMoved', { id: player.id, ...data })
+    }
+
+    // Low-frequency trading (strict limit)
+    @rateLimit({ messagesPerSecond: 0.5, burstSize: 2 })
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: AuthPlayer<User>) {
+        // Process trade...
+    }
+
+    // Chat with moderate limit
+    @rateLimit({ messagesPerSecond: 2, burstSize: 5 })
+    @onMessage('Chat')
+    handleChat(data: { text: string }, player: AuthPlayer<User>) {
+        this.broadcast('Chat', {
+            from: player.user?.name,
+            text: data.text,
+        })
+    }
+
+    // System messages - no limit
+    @noRateLimit()
+    @onMessage('Heartbeat')
+    handleHeartbeat(data: any, player: Player) {
+        player.send('Pong', { time: Date.now() })
+    }
+
+    // Custom rate limit handling
+    onRateLimited(player: Player, messageType: string, result: RateLimitResult) {
+        console.warn(`[RateLimit] Player ${player.id} limited on ${messageType}`)
+    }
+}
+```

docs/src/content/docs/en/modules/transaction/core.md

@@ -0,0 +1,261 @@
+---
+title: "Core Concepts"
+description: "Transaction system core concepts: context, manager, and Saga pattern"
+---
+
+## Transaction State
+
+A transaction can be in the following states:
+
+```typescript
+type TransactionState =
+    | 'pending'     // Waiting to execute
+    | 'executing'   // Executing
+    | 'committed'   // Committed
+    | 'rolledback'  // Rolled back
+    | 'failed'      // Failed
+```
+
+## TransactionContext
+
+The transaction context encapsulates transaction state, operations, and execution logic.
+
+### Creating Transactions
+
+```typescript
+import { TransactionManager } from '@esengine/transaction';
+
+const manager = new TransactionManager();
+
+// Method 1: Manual management with begin()
+const tx = manager.begin({ timeout: 5000 });
+tx.addOperation(op1);
+tx.addOperation(op2);
+const result = await tx.execute();
+
+// Method 2: Automatic management with run()
+const result = await manager.run((tx) => {
+    tx.addOperation(op1);
+    tx.addOperation(op2);
+});
+```
+
+### Chaining Operations
+
+```typescript
+const result = await manager.run((tx) => {
+    tx.addOperation(new CurrencyOperation({ ... }))
+      .addOperation(new InventoryOperation({ ... }))
+      .addOperation(new InventoryOperation({ ... }));
+});
+```
+
+### Context Data
+
+Operations can share data through the context:
+
+```typescript
+class CustomOperation extends BaseOperation<MyData, MyResult> {
+    async execute(ctx: ITransactionContext): Promise<OperationResult<MyResult>> {
+        // Read data set by previous operations
+        const previousResult = ctx.get<number>('previousValue');
+
+        // Set data for subsequent operations
+        ctx.set('myResult', { value: 123 });
+
+        return this.success({ ... });
+    }
+}
+```
+
+## TransactionManager
+
+The transaction manager is responsible for creating, executing, and recovering transactions.
+
+### Configuration Options
+
+```typescript
+interface TransactionManagerConfig {
+    storage?: ITransactionStorage;    // Storage instance
+    defaultTimeout?: number;          // Default timeout (ms)
+    serverId?: string;                // Server ID (for distributed)
+    autoRecover?: boolean;            // Auto-recover pending transactions
+}
+
+const manager = new TransactionManager({
+    storage: new RedisStorage({ client: redis }),
+    defaultTimeout: 10000,
+    serverId: 'server-1',
+    autoRecover: true,
+});
+```
+
+### Distributed Locking
+
+```typescript
+// Acquire lock
+const token = await manager.acquireLock('player:123:inventory', 10000);
+
+if (token) {
+    try {
+        // Perform operations
+        await doSomething();
+    } finally {
+        // Release lock
+        await manager.releaseLock('player:123:inventory', token);
+    }
+}
+
+// Or use withLock for convenience
+await manager.withLock('player:123:inventory', async () => {
+    await doSomething();
+}, 10000);
+```
+
+### Transaction Recovery
+
+Recover pending transactions after server restart:
+
+```typescript
+const manager = new TransactionManager({
+    storage: new RedisStorage({ client: redis }),
+    serverId: 'server-1',
+});
+
+// Recover pending transactions
+const recoveredCount = await manager.recover();
+console.log(`Recovered ${recoveredCount} transactions`);
+```
+
+## Saga Pattern
+
+The transaction system uses the Saga pattern. Each operation must implement `execute` and `compensate` methods:
+
+```typescript
+interface ITransactionOperation<TData, TResult> {
+    readonly name: string;
+    readonly data: TData;
+
+    // Validate preconditions
+    validate(ctx: ITransactionContext): Promise<boolean>;
+
+    // Forward execution
+    execute(ctx: ITransactionContext): Promise<OperationResult<TResult>>;
+
+    // Compensate (rollback)
+    compensate(ctx: ITransactionContext): Promise<void>;
+}
+```
+
+### Execution Flow
+
+```
+Begin Transaction
+    │
+    ▼
+┌─────────────────────┐
+│  validate(op1)      │──fail──► Return failure
+└─────────────────────┘
+    │success
+    ▼
+┌─────────────────────┐
+│  execute(op1)       │──fail──┐
+└─────────────────────┘        │
+    │success                    │
+    ▼                          │
+┌─────────────────────┐        │
+│  validate(op2)      │──fail──┤
+└─────────────────────┘        │
+    │success                    │
+    ▼                          │
+┌─────────────────────┐        │
+│  execute(op2)       │──fail──┤
+└─────────────────────┘        │
+    │success                    ▼
+    ▼                  ┌─────────────────────┐
+Commit Transaction     │  compensate(op1)    │
+                       └─────────────────────┘
+                               │
+                               ▼
+                       Return failure (rolled back)
+```
+
+### Custom Operations
+
+```typescript
+import { BaseOperation, ITransactionContext, OperationResult } from '@esengine/transaction';
+
+interface UpgradeData {
+    playerId: string;
+    itemId: string;
+    targetLevel: number;
+}
+
+interface UpgradeResult {
+    newLevel: number;
+}
+
+class UpgradeOperation extends BaseOperation<UpgradeData, UpgradeResult> {
+    readonly name = 'upgrade';
+
+    private _previousLevel: number = 0;
+
+    async validate(ctx: ITransactionContext): Promise<boolean> {
+        // Validate item exists and can be upgraded
+        const item = await this.getItem(ctx);
+        return item !== null && item.level < this.data.targetLevel;
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult<UpgradeResult>> {
+        const item = await this.getItem(ctx);
+        if (!item) {
+            return this.failure('Item not found', 'ITEM_NOT_FOUND');
+        }
+
+        this._previousLevel = item.level;
+        item.level = this.data.targetLevel;
+        await this.saveItem(ctx, item);
+
+        return this.success({ newLevel: item.level });
+    }
+
+    async compensate(ctx: ITransactionContext): Promise<void> {
+        const item = await this.getItem(ctx);
+        if (item) {
+            item.level = this._previousLevel;
+            await this.saveItem(ctx, item);
+        }
+    }
+
+    private async getItem(ctx: ITransactionContext) {
+        // Get item from storage
+    }
+
+    private async saveItem(ctx: ITransactionContext, item: any) {
+        // Save item to storage
+    }
+}
+```
+
+## Transaction Result
+
+```typescript
+interface TransactionResult<T = unknown> {
+    success: boolean;           // Whether succeeded
+    transactionId: string;      // Transaction ID
+    results: OperationResult[]; // Operation results
+    data?: T;                   // Final data
+    error?: string;             // Error message
+    duration: number;           // Execution time (ms)
+}
+
+const result = await manager.run((tx) => { ... });
+
+console.log(`Transaction ${result.transactionId}`);
+console.log(`Success: ${result.success}`);
+console.log(`Duration: ${result.duration}ms`);
+
+if (!result.success) {
+    console.log(`Error: ${result.error}`);
+}
+```

docs/src/content/docs/en/modules/transaction/distributed.md

@@ -0,0 +1,355 @@
+---
+title: "Distributed Transactions"
+description: "Saga orchestrator and cross-server transaction support"
+---
+
+## Saga Orchestrator
+
+`SagaOrchestrator` is used to orchestrate distributed transactions across servers.
+
+### Basic Usage
+
+```typescript
+import { SagaOrchestrator, RedisStorage } from '@esengine/transaction';
+
+const orchestrator = new SagaOrchestrator({
+    storage: new RedisStorage({ client: redis }),
+    timeout: 30000,
+    serverId: 'orchestrator-1',
+});
+
+const result = await orchestrator.execute([
+    {
+        name: 'deduct_currency',
+        serverId: 'game-server-1',
+        data: { playerId: 'player1', amount: 100 },
+        execute: async (data) => {
+            // Call game server API to deduct currency
+            const response = await gameServerApi.deductCurrency(data);
+            return { success: response.ok };
+        },
+        compensate: async (data) => {
+            // Call game server API to restore currency
+            await gameServerApi.addCurrency(data);
+        },
+    },
+    {
+        name: 'add_item',
+        serverId: 'inventory-server-1',
+        data: { playerId: 'player1', itemId: 'sword' },
+        execute: async (data) => {
+            const response = await inventoryServerApi.addItem(data);
+            return { success: response.ok };
+        },
+        compensate: async (data) => {
+            await inventoryServerApi.removeItem(data);
+        },
+    },
+]);
+
+if (result.success) {
+    console.log('Saga completed successfully');
+} else {
+    console.log('Saga failed:', result.error);
+    console.log('Completed steps:', result.completedSteps);
+    console.log('Failed at:', result.failedStep);
+}
+```
+
+### Configuration Options
+
+```typescript
+interface SagaOrchestratorConfig {
+    storage?: ITransactionStorage;  // Storage instance
+    timeout?: number;               // Timeout in milliseconds
+    serverId?: string;              // Orchestrator server ID
+}
+```
+
+### Saga Step
+
+```typescript
+interface SagaStep<T = unknown> {
+    name: string;                   // Step name
+    serverId?: string;              // Target server ID
+    data: T;                        // Step data
+    execute: (data: T) => Promise<OperationResult>;    // Execute function
+    compensate: (data: T) => Promise<void>;            // Compensate function
+}
+```
+
+### Saga Result
+
+```typescript
+interface SagaResult {
+    success: boolean;       // Whether succeeded
+    sagaId: string;         // Saga ID
+    completedSteps: string[]; // Completed steps
+    failedStep?: string;    // Failed step
+    error?: string;         // Error message
+    duration: number;       // Execution time (ms)
+}
+```
+
+## Execution Flow
+
+```
+Start Saga
+    │
+    ▼
+┌─────────────────────┐
+│  Step 1: execute    │──fail──┐
+└─────────────────────┘        │
+    │success                    │
+    ▼                          │
+┌─────────────────────┐        │
+│  Step 2: execute    │──fail──┤
+└─────────────────────┘        │
+    │success                    │
+    ▼                          │
+┌─────────────────────┐        │
+│  Step 3: execute    │──fail──┤
+└─────────────────────┘        │
+    │success                    ▼
+    ▼                  ┌─────────────────────┐
+Saga Complete          │  Step 2: compensate │
+                       └─────────────────────┘
+                               │
+                               ▼
+                       ┌─────────────────────┐
+                       │  Step 1: compensate │
+                       └─────────────────────┘
+                               │
+                               ▼
+                       Saga Failed (compensated)
+```
+
+## Saga Logs
+
+The orchestrator records detailed execution logs:
+
+```typescript
+interface SagaLog {
+    id: string;                     // Saga ID
+    state: SagaLogState;            // State
+    steps: SagaStepLog[];           // Step logs
+    createdAt: number;              // Creation time
+    updatedAt: number;              // Update time
+    metadata?: Record<string, unknown>;
+}
+
+type SagaLogState =
+    | 'pending'       // Waiting to execute
+    | 'running'       // Executing
+    | 'completed'     // Completed
+    | 'compensating'  // Compensating
+    | 'compensated'   // Compensated
+    | 'failed'        // Failed
+
+interface SagaStepLog {
+    name: string;                   // Step name
+    serverId?: string;              // Server ID
+    state: SagaStepState;           // State
+    startedAt?: number;             // Start time
+    completedAt?: number;           // Completion time
+    error?: string;                 // Error message
+}
+
+type SagaStepState =
+    | 'pending'       // Waiting to execute
+    | 'executing'     // Executing
+    | 'completed'     // Completed
+    | 'compensating'  // Compensating
+    | 'compensated'   // Compensated
+    | 'failed'        // Failed
+```
+
+### Query Saga Logs
+
+```typescript
+const log = await orchestrator.getSagaLog('saga_xxx');
+
+if (log) {
+    console.log('Saga state:', log.state);
+    for (const step of log.steps) {
+        console.log(`  ${step.name}: ${step.state}`);
+    }
+}
+```
+
+## Cross-Server Transaction Examples
+
+### Scenario: Cross-Server Purchase
+
+A player purchases an item on a game server, with currency on an account server and items on an inventory server.
+
+```typescript
+const orchestrator = new SagaOrchestrator({
+    storage: redisStorage,
+    serverId: 'purchase-orchestrator',
+});
+
+async function crossServerPurchase(
+    playerId: string,
+    itemId: string,
+    price: number
+): Promise<SagaResult> {
+    return orchestrator.execute([
+        // Step 1: Deduct balance on account server
+        {
+            name: 'deduct_balance',
+            serverId: 'account-server',
+            data: { playerId, amount: price },
+            execute: async (data) => {
+                const result = await accountService.deduct(data.playerId, data.amount);
+                return { success: result.ok, error: result.error };
+            },
+            compensate: async (data) => {
+                await accountService.refund(data.playerId, data.amount);
+            },
+        },
+
+        // Step 2: Add item on inventory server
+        {
+            name: 'add_item',
+            serverId: 'inventory-server',
+            data: { playerId, itemId },
+            execute: async (data) => {
+                const result = await inventoryService.addItem(data.playerId, data.itemId);
+                return { success: result.ok, error: result.error };
+            },
+            compensate: async (data) => {
+                await inventoryService.removeItem(data.playerId, data.itemId);
+            },
+        },
+
+        // Step 3: Record purchase log
+        {
+            name: 'log_purchase',
+            serverId: 'log-server',
+            data: { playerId, itemId, price, timestamp: Date.now() },
+            execute: async (data) => {
+                await logService.recordPurchase(data);
+                return { success: true };
+            },
+            compensate: async (data) => {
+                await logService.cancelPurchase(data);
+            },
+        },
+    ]);
+}
+```
+
+### Scenario: Cross-Server Trade
+
+Two players on different servers trade with each other.
+
+```typescript
+async function crossServerTrade(
+    playerA: { id: string; server: string; items: string[] },
+    playerB: { id: string; server: string; items: string[] }
+): Promise<SagaResult> {
+    const steps: SagaStep[] = [];
+
+    // Remove items from player A
+    for (const itemId of playerA.items) {
+        steps.push({
+            name: `remove_${playerA.id}_${itemId}`,
+            serverId: playerA.server,
+            data: { playerId: playerA.id, itemId },
+            execute: async (data) => {
+                return await inventoryService.removeItem(data.playerId, data.itemId);
+            },
+            compensate: async (data) => {
+                await inventoryService.addItem(data.playerId, data.itemId);
+            },
+        });
+    }
+
+    // Add items to player B (from A)
+    for (const itemId of playerA.items) {
+        steps.push({
+            name: `add_${playerB.id}_${itemId}`,
+            serverId: playerB.server,
+            data: { playerId: playerB.id, itemId },
+            execute: async (data) => {
+                return await inventoryService.addItem(data.playerId, data.itemId);
+            },
+            compensate: async (data) => {
+                await inventoryService.removeItem(data.playerId, data.itemId);
+            },
+        });
+    }
+
+    // Similarly handle player B's items...
+
+    return orchestrator.execute(steps);
+}
+```
+
+## Recovering Incomplete Sagas
+
+Recover incomplete Sagas after server restart:
+
+```typescript
+const orchestrator = new SagaOrchestrator({
+    storage: redisStorage,
+    serverId: 'my-orchestrator',
+});
+
+// Recover incomplete Sagas (will execute compensation)
+const recoveredCount = await orchestrator.recover();
+console.log(`Recovered ${recoveredCount} sagas`);
+```
+
+## Best Practices
+
+### 1. Idempotency
+
+Ensure all operations are idempotent:
+
+```typescript
+{
+    execute: async (data) => {
+        // Use unique ID to ensure idempotency
+        const result = await service.process(data.requestId, data);
+        return { success: result.ok };
+    },
+    compensate: async (data) => {
+        // Compensation must also be idempotent
+        await service.rollback(data.requestId);
+    },
+}
+```
+
+### 2. Timeout Handling
+
+Set appropriate timeout values:
+
+```typescript
+const orchestrator = new SagaOrchestrator({
+    timeout: 60000,  // Cross-server operations need longer timeout
+});
+```
+
+### 3. Monitoring and Alerts
+
+Log Saga execution results:
+
+```typescript
+const result = await orchestrator.execute(steps);
+
+if (!result.success) {
+    // Send alert
+    alertService.send({
+        type: 'saga_failed',
+        sagaId: result.sagaId,
+        failedStep: result.failedStep,
+        error: result.error,
+    });
+
+    // Log details
+    const log = await orchestrator.getSagaLog(result.sagaId);
+    logger.error('Saga failed', { log });
+}
+```

docs/src/content/docs/en/modules/transaction/index.md

@@ -0,0 +1,238 @@
+---
+title: "Transaction System"
+description: "Game transaction system with distributed support for shop purchases, player trading, and more"
+---
+
+`@esengine/transaction` provides comprehensive game transaction capabilities based on the Saga pattern, supporting shop purchases, player trading, multi-step tasks, and distributed transactions with Redis/MongoDB.
+
+## Overview
+
+The transaction system solves common data consistency problems in games:
+
+| Scenario | Problem | Solution |
+|----------|---------|----------|
+| Shop Purchase | Payment succeeded but item not delivered | Atomic transaction with auto-rollback |
+| Player Trade | One party transferred items but other didn't receive | Saga compensation mechanism |
+| Cross-Server | Data inconsistency across servers | Distributed lock + transaction log |
+
+## Installation
+
+```bash
+npm install @esengine/transaction
+```
+
+Optional dependencies (install based on storage needs):
+```bash
+npm install ioredis   # Redis storage
+npm install mongodb   # MongoDB storage
+```
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                    Transaction Layer                             │
+├─────────────────────────────────────────────────────────────────┤
+│  TransactionManager         - Manages transaction lifecycle      │
+│  TransactionContext         - Encapsulates operations and state  │
+│  SagaOrchestrator           - Distributed Saga orchestrator      │
+├─────────────────────────────────────────────────────────────────┤
+│                    Storage Layer                                 │
+├─────────────────────────────────────────────────────────────────┤
+│  MemoryStorage              - In-memory (dev/test)               │
+│  RedisStorage               - Redis (distributed lock + cache)   │
+│  MongoStorage               - MongoDB (persistent log)           │
+├─────────────────────────────────────────────────────────────────┤
+│                    Operation Layer                               │
+├─────────────────────────────────────────────────────────────────┤
+│  CurrencyOperation          - Currency operations                │
+│  InventoryOperation         - Inventory operations               │
+│  TradeOperation             - Trade operations                   │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## Quick Start
+
+### Basic Usage
+
+```typescript
+import {
+    TransactionManager,
+    MemoryStorage,
+    CurrencyOperation,
+    InventoryOperation,
+} from '@esengine/transaction';
+
+// Create transaction manager
+const manager = new TransactionManager({
+    storage: new MemoryStorage(),
+    defaultTimeout: 10000,
+});
+
+// Execute transaction
+const result = await manager.run((tx) => {
+    // Deduct gold
+    tx.addOperation(new CurrencyOperation({
+        type: 'deduct',
+        playerId: 'player1',
+        currency: 'gold',
+        amount: 100,
+    }));
+
+    // Add item
+    tx.addOperation(new InventoryOperation({
+        type: 'add',
+        playerId: 'player1',
+        itemId: 'sword_001',
+        quantity: 1,
+    }));
+});
+
+if (result.success) {
+    console.log('Purchase successful!');
+} else {
+    console.log('Purchase failed:', result.error);
+}
+```
+
+### Player Trading
+
+```typescript
+import { TradeOperation } from '@esengine/transaction';
+
+const result = await manager.run((tx) => {
+    tx.addOperation(new TradeOperation({
+        tradeId: 'trade_001',
+        partyA: {
+            playerId: 'player1',
+            items: [{ itemId: 'sword', quantity: 1 }],
+        },
+        partyB: {
+            playerId: 'player2',
+            currencies: [{ currency: 'gold', amount: 1000 }],
+        },
+    }));
+}, { timeout: 30000 });
+```
+
+### Using Redis Storage
+
+```typescript
+import Redis from 'ioredis';
+import { TransactionManager, RedisStorage } from '@esengine/transaction';
+
+const redis = new Redis('redis://localhost:6379');
+const storage = new RedisStorage({ client: redis });
+
+const manager = new TransactionManager({ storage });
+```
+
+### Using MongoDB Storage
+
+```typescript
+import { MongoClient } from 'mongodb';
+import { TransactionManager, MongoStorage } from '@esengine/transaction';
+
+const client = new MongoClient('mongodb://localhost:27017');
+await client.connect();
+const db = client.db('game');
+
+const storage = new MongoStorage({ db });
+await storage.ensureIndexes();
+
+const manager = new TransactionManager({ storage });
+```
+
+## Room Integration
+
+```typescript
+import { Room } from '@esengine/server';
+import { withTransactions, CurrencyOperation, RedisStorage } from '@esengine/transaction';
+
+class GameRoom extends withTransactions(Room, {
+    storage: new RedisStorage({ client: redisClient }),
+}) {
+    @onMessage('Buy')
+    async handleBuy(data: { itemId: string }, player: Player) {
+        const result = await this.runTransaction((tx) => {
+            tx.addOperation(new CurrencyOperation({
+                type: 'deduct',
+                playerId: player.id,
+                currency: 'gold',
+                amount: getItemPrice(data.itemId),
+            }));
+        });
+
+        if (result.success) {
+            player.send('buy_success', { itemId: data.itemId });
+        } else {
+            player.send('buy_failed', { error: result.error });
+        }
+    }
+}
+```
+
+## Documentation
+
+- [Core Concepts](/en/modules/transaction/core/) - Transaction context, manager, Saga pattern
+- [Storage Layer](/en/modules/transaction/storage/) - MemoryStorage, RedisStorage, MongoStorage
+- [Operations](/en/modules/transaction/operations/) - Currency, inventory, trade operations
+- [Distributed Transactions](/en/modules/transaction/distributed/) - Saga orchestrator, cross-server transactions
+- [API Reference](/en/modules/transaction/api/) - Complete API documentation
+
+## Service Tokens
+
+For dependency injection:
+
+```typescript
+import {
+    TransactionManagerToken,
+    TransactionStorageToken,
+} from '@esengine/transaction';
+
+const manager = services.get(TransactionManagerToken);
+```
+
+## Best Practices
+
+### 1. Operation Granularity
+
+```typescript
+// ✅ Good: Fine-grained operations, easy to rollback
+tx.addOperation(new CurrencyOperation({ type: 'deduct', ... }));
+tx.addOperation(new InventoryOperation({ type: 'add', ... }));
+
+// ❌ Bad: Coarse-grained operation, hard to partially rollback
+tx.addOperation(new ComplexPurchaseOperation({ ... }));
+```
+
+### 2. Timeout Settings
+
+```typescript
+// Simple operations: short timeout
+await manager.run(tx => { ... }, { timeout: 5000 });
+
+// Complex trades: longer timeout
+await manager.run(tx => { ... }, { timeout: 30000 });
+
+// Cross-server: even longer timeout
+await manager.run(tx => { ... }, { timeout: 60000, distributed: true });
+```
+
+### 3. Error Handling
+
+```typescript
+const result = await manager.run((tx) => { ... });
+
+if (!result.success) {
+    // Log the error
+    logger.error('Transaction failed', {
+        transactionId: result.transactionId,
+        error: result.error,
+        duration: result.duration,
+    });
+
+    // Notify user
+    player.send('error', { message: getErrorMessage(result.error) });
+}
+```

docs/src/content/docs/en/modules/transaction/operations.md

@@ -0,0 +1,313 @@
+---
+title: "Operations"
+description: "Built-in transaction operations: currency, inventory, trade"
+---
+
+## BaseOperation
+
+Base class for all operations, providing a common implementation template.
+
+```typescript
+import { BaseOperation, ITransactionContext, OperationResult } from '@esengine/transaction';
+
+class MyOperation extends BaseOperation<MyData, MyResult> {
+    readonly name = 'myOperation';
+
+    async validate(ctx: ITransactionContext): Promise<boolean> {
+        // Validate preconditions
+        return true;
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult<MyResult>> {
+        // Execute operation
+        return this.success({ result: 'ok' });
+        // or
+        return this.failure('Something went wrong', 'ERROR_CODE');
+    }
+
+    async compensate(ctx: ITransactionContext): Promise<void> {
+        // Rollback operation
+    }
+}
+```
+
+## CurrencyOperation
+
+Handles currency addition and deduction.
+
+### Deduct Currency
+
+```typescript
+import { CurrencyOperation } from '@esengine/transaction';
+
+tx.addOperation(new CurrencyOperation({
+    type: 'deduct',
+    playerId: 'player1',
+    currency: 'gold',
+    amount: 100,
+    reason: 'purchase_item',
+}));
+```
+
+### Add Currency
+
+```typescript
+tx.addOperation(new CurrencyOperation({
+    type: 'add',
+    playerId: 'player1',
+    currency: 'diamond',
+    amount: 50,
+    reason: 'daily_reward',
+}));
+```
+
+### Operation Data
+
+```typescript
+interface CurrencyOperationData {
+    type: 'add' | 'deduct';   // Operation type
+    playerId: string;          // Player ID
+    currency: string;          // Currency type
+    amount: number;            // Amount
+    reason?: string;           // Reason/source
+}
+```
+
+### Operation Result
+
+```typescript
+interface CurrencyOperationResult {
+    beforeBalance: number;     // Balance before operation
+    afterBalance: number;      // Balance after operation
+}
+```
+
+### Custom Data Provider
+
+```typescript
+interface ICurrencyProvider {
+    getBalance(playerId: string, currency: string): Promise<number>;
+    setBalance(playerId: string, currency: string, amount: number): Promise<void>;
+}
+
+class MyCurrencyProvider implements ICurrencyProvider {
+    async getBalance(playerId: string, currency: string): Promise<number> {
+        // Get balance from database
+        return await db.getCurrency(playerId, currency);
+    }
+
+    async setBalance(playerId: string, currency: string, amount: number): Promise<void> {
+        // Save to database
+        await db.setCurrency(playerId, currency, amount);
+    }
+}
+
+// Use custom provider
+const op = new CurrencyOperation({ ... });
+op.setProvider(new MyCurrencyProvider());
+tx.addOperation(op);
+```
+
+## InventoryOperation
+
+Handles item addition, removal, and updates.
+
+### Add Item
+
+```typescript
+import { InventoryOperation } from '@esengine/transaction';
+
+tx.addOperation(new InventoryOperation({
+    type: 'add',
+    playerId: 'player1',
+    itemId: 'sword_001',
+    quantity: 1,
+    properties: { enchant: 'fire' },
+}));
+```
+
+### Remove Item
+
+```typescript
+tx.addOperation(new InventoryOperation({
+    type: 'remove',
+    playerId: 'player1',
+    itemId: 'potion_hp',
+    quantity: 5,
+}));
+```
+
+### Update Item
+
+```typescript
+tx.addOperation(new InventoryOperation({
+    type: 'update',
+    playerId: 'player1',
+    itemId: 'sword_001',
+    quantity: 1,  // Optional, keeps original if not provided
+    properties: { enchant: 'lightning', level: 5 },
+}));
+```
+
+### Operation Data
+
+```typescript
+interface InventoryOperationData {
+    type: 'add' | 'remove' | 'update';  // Operation type
+    playerId: string;                    // Player ID
+    itemId: string;                      // Item ID
+    quantity: number;                    // Quantity
+    properties?: Record<string, unknown>; // Item properties
+    reason?: string;                     // Reason/source
+}
+```
+
+### Operation Result
+
+```typescript
+interface InventoryOperationResult {
+    beforeItem?: ItemData;   // Item before operation
+    afterItem?: ItemData;    // Item after operation
+}
+
+interface ItemData {
+    itemId: string;
+    quantity: number;
+    properties?: Record<string, unknown>;
+}
+```
+
+### Custom Data Provider
+
+```typescript
+interface IInventoryProvider {
+    getItem(playerId: string, itemId: string): Promise<ItemData | null>;
+    setItem(playerId: string, itemId: string, item: ItemData | null): Promise<void>;
+    hasCapacity?(playerId: string, count: number): Promise<boolean>;
+}
+
+class MyInventoryProvider implements IInventoryProvider {
+    async getItem(playerId: string, itemId: string): Promise<ItemData | null> {
+        return await db.getItem(playerId, itemId);
+    }
+
+    async setItem(playerId: string, itemId: string, item: ItemData | null): Promise<void> {
+        if (item) {
+            await db.saveItem(playerId, itemId, item);
+        } else {
+            await db.deleteItem(playerId, itemId);
+        }
+    }
+
+    async hasCapacity(playerId: string, count: number): Promise<boolean> {
+        const current = await db.getItemCount(playerId);
+        const max = await db.getMaxCapacity(playerId);
+        return current + count <= max;
+    }
+}
+```
+
+## TradeOperation
+
+Handles item and currency exchange between players.
+
+### Basic Usage
+
+```typescript
+import { TradeOperation } from '@esengine/transaction';
+
+tx.addOperation(new TradeOperation({
+    tradeId: 'trade_001',
+    partyA: {
+        playerId: 'player1',
+        items: [{ itemId: 'sword', quantity: 1 }],
+        currencies: [{ currency: 'diamond', amount: 10 }],
+    },
+    partyB: {
+        playerId: 'player2',
+        currencies: [{ currency: 'gold', amount: 1000 }],
+    },
+    reason: 'player_trade',
+}));
+```
+
+### Operation Data
+
+```typescript
+interface TradeOperationData {
+    tradeId: string;      // Trade ID
+    partyA: TradeParty;   // Trade initiator
+    partyB: TradeParty;   // Trade receiver
+    reason?: string;      // Reason/note
+}
+
+interface TradeParty {
+    playerId: string;              // Player ID
+    items?: TradeItem[];           // Items to give
+    currencies?: TradeCurrency[];  // Currencies to give
+}
+
+interface TradeItem {
+    itemId: string;
+    quantity: number;
+}
+
+interface TradeCurrency {
+    currency: string;
+    amount: number;
+}
+```
+
+### Execution Flow
+
+TradeOperation internally generates the following sub-operation sequence:
+
+```
+1. Remove partyA's items
+2. Add items to partyB (from partyA)
+3. Deduct partyA's currencies
+4. Add currencies to partyB (from partyA)
+5. Remove partyB's items
+6. Add items to partyA (from partyB)
+7. Deduct partyB's currencies
+8. Add currencies to partyA (from partyB)
+```
+
+If any step fails, all previous operations are rolled back.
+
+### Using Custom Providers
+
+```typescript
+const op = new TradeOperation({ ... });
+op.setProvider({
+    currencyProvider: new MyCurrencyProvider(),
+    inventoryProvider: new MyInventoryProvider(),
+});
+tx.addOperation(op);
+```
+
+## Factory Functions
+
+Each operation class provides a factory function:
+
+```typescript
+import {
+    createCurrencyOperation,
+    createInventoryOperation,
+    createTradeOperation,
+} from '@esengine/transaction';
+
+tx.addOperation(createCurrencyOperation({
+    type: 'deduct',
+    playerId: 'player1',
+    currency: 'gold',
+    amount: 100,
+}));
+
+tx.addOperation(createInventoryOperation({
+    type: 'add',
+    playerId: 'player1',
+    itemId: 'sword',
+    quantity: 1,
+}));
+```

docs/src/content/docs/en/modules/transaction/storage.md

@@ -0,0 +1,234 @@
+---
+title: "Storage Layer"
+description: "Transaction storage interface and implementations: MemoryStorage, RedisStorage, MongoStorage"
+---
+
+## Storage Interface
+
+All storage implementations must implement the `ITransactionStorage` interface:
+
+```typescript
+interface ITransactionStorage {
+    // Lifecycle
+    close?(): Promise<void>;
+
+    // Distributed lock
+    acquireLock(key: string, ttl: number): Promise<string | null>;
+    releaseLock(key: string, token: string): Promise<boolean>;
+
+    // Transaction log
+    saveTransaction(tx: TransactionLog): Promise<void>;
+    getTransaction(id: string): Promise<TransactionLog | null>;
+    updateTransactionState(id: string, state: TransactionState): Promise<void>;
+    updateOperationState(txId: string, opIndex: number, state: string, error?: string): Promise<void>;
+    getPendingTransactions(serverId?: string): Promise<TransactionLog[]>;
+    deleteTransaction(id: string): Promise<void>;
+
+    // Data operations
+    get<T>(key: string): Promise<T | null>;
+    set<T>(key: string, value: T, ttl?: number): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+```
+
+## MemoryStorage
+
+In-memory storage, suitable for development and testing.
+
+```typescript
+import { MemoryStorage } from '@esengine/transaction';
+
+const storage = new MemoryStorage({
+    maxTransactions: 1000,  // Maximum transaction log count
+});
+
+const manager = new TransactionManager({ storage });
+```
+
+### Characteristics
+
+- ✅ No external dependencies
+- ✅ Fast, good for debugging
+- ❌ Data only stored in memory
+- ❌ No true distributed locking
+- ❌ Data lost on restart
+
+### Test Helpers
+
+```typescript
+// Clear all data
+storage.clear();
+
+// Get transaction count
+console.log(storage.transactionCount);
+```
+
+## RedisStorage
+
+Redis storage, suitable for production distributed systems. Uses factory pattern with lazy connection.
+
+```typescript
+import Redis from 'ioredis';
+import { RedisStorage } from '@esengine/transaction';
+
+// Factory pattern: lazy connection, connects on first operation
+const storage = new RedisStorage({
+    factory: () => new Redis('redis://localhost:6379'),
+    prefix: 'tx:',              // Key prefix
+    transactionTTL: 86400,      // Transaction log TTL (seconds)
+});
+
+const manager = new TransactionManager({ storage });
+
+// Close connection when done
+await storage.close();
+
+// Or use await using for automatic cleanup (TypeScript 5.2+)
+await using storage = new RedisStorage({
+    factory: () => new Redis('redis://localhost:6379')
+});
+// Automatically closed when scope ends
+```
+
+### Characteristics
+
+- ✅ High-performance distributed locking
+- ✅ Fast read/write
+- ✅ Supports TTL auto-expiration
+- ✅ Suitable for high concurrency
+- ❌ Requires Redis server
+
+### Distributed Lock Implementation
+
+Uses Redis `SET NX EX` for distributed locking:
+
+```typescript
+// Acquire lock (atomic operation)
+SET tx:lock:player:123 <token> NX EX 10
+
+// Release lock (Lua script for atomicity)
+if redis.call("get", KEYS[1]) == ARGV[1] then
+    return redis.call("del", KEYS[1])
+else
+    return 0
+end
+```
+
+### Key Structure
+
+```
+tx:lock:{key}           - Distributed locks
+tx:tx:{id}              - Transaction logs
+tx:server:{id}:txs      - Server transaction index
+tx:data:{key}           - Business data
+```
+
+## MongoStorage
+
+MongoDB storage, suitable for scenarios requiring persistence and complex queries. Uses factory pattern with lazy connection.
+
+```typescript
+import { MongoClient } from 'mongodb';
+import { MongoStorage } from '@esengine/transaction';
+
+// Factory pattern: lazy connection, connects on first operation
+const storage = new MongoStorage({
+    factory: async () => {
+        const client = new MongoClient('mongodb://localhost:27017');
+        await client.connect();
+        return client;
+    },
+    database: 'game',
+    transactionCollection: 'transactions',  // Transaction log collection
+    dataCollection: 'transaction_data',     // Business data collection
+    lockCollection: 'transaction_locks',    // Lock collection
+});
+
+// Create indexes (run on first startup)
+await storage.ensureIndexes();
+
+const manager = new TransactionManager({ storage });
+
+// Close connection when done
+await storage.close();
+
+// Or use await using for automatic cleanup (TypeScript 5.2+)
+await using storage = new MongoStorage({ ... });
+```
+
+### Characteristics
+
+- ✅ Persistent storage
+- ✅ Supports complex queries
+- ✅ Transaction logs are traceable
+- ✅ Suitable for audit requirements
+- ❌ Slightly lower performance than Redis
+- ❌ Requires MongoDB server
+
+### Index Structure
+
+```javascript
+// transactions collection
+{ state: 1 }
+{ 'metadata.serverId': 1 }
+{ createdAt: 1 }
+
+// transaction_locks collection
+{ expireAt: 1 }  // TTL index
+
+// transaction_data collection
+{ expireAt: 1 }  // TTL index
+```
+
+### Distributed Lock Implementation
+
+Uses MongoDB unique index for distributed locking:
+
+```typescript
+// Acquire lock
+db.transaction_locks.insertOne({
+    _id: 'player:123',
+    token: '<token>',
+    expireAt: new Date(Date.now() + 10000)
+});
+
+// If key exists, check if expired
+db.transaction_locks.updateOne(
+    { _id: 'player:123', expireAt: { $lt: new Date() } },
+    { $set: { token: '<token>', expireAt: new Date(Date.now() + 10000) } }
+);
+```
+
+## Storage Selection Guide
+
+| Scenario | Recommended Storage | Reason |
+|----------|---------------------|--------|
+| Development/Testing | MemoryStorage | No dependencies, fast startup |
+| Single-machine Production | RedisStorage | High performance, simple |
+| Distributed System | RedisStorage | True distributed locking |
+| Audit Required | MongoStorage | Persistent logs |
+| Mixed Requirements | Redis + Mongo | Redis for locks, Mongo for logs |
+
+## Custom Storage
+
+Implement `ITransactionStorage` interface to create custom storage:
+
+```typescript
+import { ITransactionStorage, TransactionLog, TransactionState } from '@esengine/transaction';
+
+class MyCustomStorage implements ITransactionStorage {
+    async acquireLock(key: string, ttl: number): Promise<string | null> {
+        // Implement distributed lock acquisition
+    }
+
+    async releaseLock(key: string, token: string): Promise<boolean> {
+        // Implement distributed lock release
+    }
+
+    async saveTransaction(tx: TransactionLog): Promise<void> {
+        // Save transaction log
+    }
+
+    // ... implement other methods
+}
+```

docs/src/content/docs/modules/index.md

@@ -35,6 +35,7 @@ ESEngine 提供了丰富的功能模块，可以按需引入到你的项目中
 | 模块 | 包名 | 描述 |
 |------|------|------|
 | [网络同步](/modules/network/) | `@esengine/network` | 多人游戏网络同步 |
+| [事务系统](/modules/transaction/) | `@esengine/transaction` | 游戏事务处理，支持分布式事务 |
 
 ## 安装
 

docs/src/content/docs/modules/network/auth.md

@@ -0,0 +1,506 @@
+---
+title: "认证系统"
+description: "使用 JWT 和 Session 提供者为游戏服务器添加认证功能"
+---
+
+`@esengine/server` 包内置了可插拔的认证系统，支持 JWT、会话认证和自定义提供者。
+
+## 安装
+
+认证功能已包含在 server 包中：
+
+```bash
+npm install @esengine/server jsonwebtoken
+```
+
+> 注意：`jsonwebtoken` 是可选的 peer dependency，仅在使用 JWT 认证时需要。
+
+## 快速开始
+
+### JWT 认证
+
+```typescript
+import { createServer } from '@esengine/server'
+import { withAuth, createJwtAuthProvider, withRoomAuth, requireAuth } from '@esengine/server/auth'
+
+// 创建 JWT 提供者
+const jwtProvider = createJwtAuthProvider({
+    secret: process.env.JWT_SECRET!,
+    expiresIn: 3600, // 1 小时
+})
+
+// 用认证包装服务器
+const server = withAuth(await createServer({ port: 3000 }), {
+    provider: jwtProvider,
+    extractCredentials: (req) => {
+        const url = new URL(req.url ?? '', 'http://localhost')
+        return url.searchParams.get('token')
+    },
+})
+
+// 定义需要认证的房间
+class GameRoom extends withRoomAuth(Room, { requireAuth: true }) {
+    onJoin(player) {
+        console.log(`${player.user?.name} 加入了游戏！`)
+    }
+}
+
+server.define('game', GameRoom)
+await server.start()
+```
+
+## 认证提供者
+
+### JWT 提供者
+
+使用 JSON Web Tokens 实现无状态认证：
+
+```typescript
+import { createJwtAuthProvider } from '@esengine/server/auth'
+
+const jwtProvider = createJwtAuthProvider({
+    // 必填：密钥
+    secret: 'your-secret-key',
+
+    // 可选：算法（默认：HS256）
+    algorithm: 'HS256',
+
+    // 可选：过期时间（秒，默认：3600）
+    expiresIn: 3600,
+
+    // 可选：签发者（用于验证）
+    issuer: 'my-game-server',
+
+    // 可选：受众（用于验证）
+    audience: 'my-game-client',
+
+    // 可选：自定义用户提取
+    getUser: async (payload) => {
+        // 从数据库获取用户
+        return await db.users.findById(payload.sub)
+    },
+})
+
+// 签发令牌（用于登录接口）
+const token = jwtProvider.sign({
+    sub: user.id,
+    name: user.name,
+    roles: ['player'],
+})
+
+// 解码但不验证（用于调试）
+const payload = jwtProvider.decode(token)
+```
+
+### Session 提供者
+
+使用服务端会话实现有状态认证：
+
+```typescript
+import { createSessionAuthProvider, type ISessionStorage } from '@esengine/server/auth'
+
+// 自定义存储实现
+const storage: ISessionStorage = {
+    async get<T>(key: string): Promise<T | null> {
+        return await redis.get(key)
+    },
+    async set<T>(key: string, value: T): Promise<void> {
+        await redis.set(key, value)
+    },
+    async delete(key: string): Promise<boolean> {
+        return await redis.del(key) > 0
+    },
+}
+
+const sessionProvider = createSessionAuthProvider({
+    storage,
+    sessionTTL: 86400000, // 24 小时（毫秒）
+
+    // 可选：每次请求时验证用户
+    validateUser: (user) => !user.banned,
+})
+
+// 创建会话（用于登录接口）
+const sessionId = await sessionProvider.createSession(user, {
+    ipAddress: req.ip,
+    userAgent: req.headers['user-agent'],
+})
+
+// 撤销会话（用于登出）
+await sessionProvider.revoke(sessionId)
+```
+
+## 服务器认证 Mixin
+
+`withAuth` 函数用于包装服务器添加认证功能：
+
+```typescript
+import { withAuth } from '@esengine/server/auth'
+
+const server = withAuth(baseServer, {
+    // 必填：认证提供者
+    provider: jwtProvider,
+
+    // 必填：从请求中提取凭证
+    extractCredentials: (req) => {
+        // 从查询字符串获取
+        return new URL(req.url, 'http://localhost').searchParams.get('token')
+
+        // 或从请求头获取
+        // return req.headers['authorization']?.replace('Bearer ', '')
+    },
+
+    // 可选：处理认证失败
+    onAuthFailed: (conn, error) => {
+        console.log(`认证失败: ${error}`)
+    },
+})
+```
+
+### 访问认证上下文
+
+认证后，可以从连接获取认证上下文：
+
+```typescript
+import { getAuthContext } from '@esengine/server/auth'
+
+server.onConnect = (conn) => {
+    const auth = getAuthContext(conn)
+
+    if (auth.isAuthenticated) {
+        console.log(`用户 ${auth.userId} 已连接`)
+        console.log(`角色: ${auth.roles}`)
+    }
+}
+```
+
+## 房间认证 Mixin
+
+`withRoomAuth` 函数为房间添加认证检查：
+
+```typescript
+import { withRoomAuth, type AuthPlayer } from '@esengine/server/auth'
+
+interface User {
+    id: string
+    name: string
+    roles: string[]
+}
+
+class GameRoom extends withRoomAuth<User>(Room, {
+    // 要求认证才能加入
+    requireAuth: true,
+
+    // 可选：要求特定角色
+    allowedRoles: ['player', 'premium'],
+
+    // 可选：角色检查模式（'any' 或 'all'）
+    roleCheckMode: 'any',
+}) {
+    // player 拥有 .auth 和 .user 属性
+    onJoin(player: AuthPlayer<User>) {
+        console.log(`${player.user?.name} 加入了`)
+        console.log(`是否高级会员: ${player.auth.hasRole('premium')}`)
+    }
+
+    // 可选：自定义认证验证
+    async onAuth(player: AuthPlayer<User>): Promise<boolean> {
+        // 额外的验证逻辑
+        if (player.auth.hasRole('banned')) {
+            return false
+        }
+        return true
+    }
+
+    @onMessage('Chat')
+    handleChat(data: { text: string }, player: AuthPlayer<User>) {
+        this.broadcast('Chat', {
+            from: player.user?.name ?? '访客',
+            text: data.text,
+        })
+    }
+}
+```
+
+### AuthPlayer 接口
+
+认证房间中的玩家拥有额外属性：
+
+```typescript
+interface AuthPlayer<TUser> extends Player {
+    // 完整认证上下文
+    readonly auth: IAuthContext<TUser>
+
+    // 用户信息（auth.user 的快捷方式）
+    readonly user: TUser | null
+}
+```
+
+### 房间认证辅助方法
+
+```typescript
+class GameRoom extends withRoomAuth<User>(Room) {
+    someMethod() {
+        // 通过用户 ID 获取玩家
+        const player = this.getPlayerByUserId('user-123')
+
+        // 获取拥有特定角色的所有玩家
+        const admins = this.getPlayersByRole('admin')
+
+        // 获取带认证信息的玩家
+        const authPlayer = this.getAuthPlayer(playerId)
+    }
+}
+```
+
+## 认证装饰器
+
+### @requireAuth
+
+标记消息处理器需要认证：
+
+```typescript
+import { requireAuth, requireRole, onMessage } from '@esengine/server/auth'
+
+class GameRoom extends withRoomAuth(Room) {
+    @requireAuth()
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: AuthPlayer) {
+        // 只有已认证玩家才能交易
+    }
+
+    @requireAuth({ allowGuest: true })
+    @onMessage('Chat')
+    handleChat(data: ChatData, player: AuthPlayer) {
+        // 访客也可以聊天
+    }
+}
+```
+
+### @requireRole
+
+要求特定角色才能访问消息处理器：
+
+```typescript
+class AdminRoom extends withRoomAuth(Room) {
+    @requireRole('admin')
+    @onMessage('Ban')
+    handleBan(data: BanData, player: AuthPlayer) {
+        // 只有管理员才能封禁
+    }
+
+    @requireRole(['moderator', 'admin'])
+    @onMessage('Mute')
+    handleMute(data: MuteData, player: AuthPlayer) {
+        // 版主或管理员可以禁言
+    }
+
+    @requireRole(['verified', 'premium'], { mode: 'all' })
+    @onMessage('SpecialFeature')
+    handleSpecial(data: any, player: AuthPlayer) {
+        // 需要同时拥有 verified 和 premium 角色
+    }
+}
+```
+
+## 认证上下文 API
+
+认证上下文提供多种检查认证状态的方法：
+
+```typescript
+interface IAuthContext<TUser> {
+    // 认证状态
+    readonly isAuthenticated: boolean
+    readonly user: TUser | null
+    readonly userId: string | null
+    readonly roles: ReadonlyArray<string>
+    readonly authenticatedAt: number | null
+    readonly expiresAt: number | null
+
+    // 角色检查
+    hasRole(role: string): boolean
+    hasAnyRole(roles: string[]): boolean
+    hasAllRoles(roles: string[]): boolean
+}
+```
+
+`AuthContext` 类（实现类）还提供：
+
+```typescript
+class AuthContext<TUser> implements IAuthContext<TUser> {
+    // 从认证结果设置认证状态
+    setAuthenticated(result: AuthResult<TUser>): void
+
+    // 清除认证状态
+    clear(): void
+}
+```
+
+## 测试
+
+使用模拟认证提供者进行单元测试：
+
+```typescript
+import { createMockAuthProvider } from '@esengine/server/auth/testing'
+
+// 创建带预设用户的模拟提供者
+const mockProvider = createMockAuthProvider({
+    users: [
+        { id: '1', name: 'Alice', roles: ['player'] },
+        { id: '2', name: 'Bob', roles: ['admin', 'player'] },
+    ],
+    autoCreate: true, // 为未知令牌创建用户
+})
+
+// 在测试中使用
+const server = withAuth(testServer, {
+    provider: mockProvider,
+    extractCredentials: (req) => req.headers['x-token'],
+})
+
+// 使用用户 ID 作为令牌进行验证
+const result = await mockProvider.verify('1')
+// result.user = { id: '1', name: 'Alice', roles: ['player'] }
+
+// 动态添加/移除用户
+mockProvider.addUser({ id: '3', name: 'Charlie', roles: ['guest'] })
+mockProvider.removeUser('3')
+
+// 撤销令牌
+await mockProvider.revoke('1')
+
+// 重置到初始状态
+mockProvider.clear()
+```
+
+## 错误处理
+
+认证错误包含错误码用于程序化处理：
+
+```typescript
+type AuthErrorCode =
+    | 'INVALID_CREDENTIALS'       // 用户名/密码无效
+    | 'INVALID_TOKEN'             // 令牌格式错误或无效
+    | 'EXPIRED_TOKEN'             // 令牌已过期
+    | 'USER_NOT_FOUND'            // 用户查找失败
+    | 'ACCOUNT_DISABLED'          // 用户账号已禁用
+    | 'RATE_LIMITED'              // 请求过于频繁
+    | 'INSUFFICIENT_PERMISSIONS'  // 权限不足
+
+// 在认证失败处理器中
+const server = withAuth(baseServer, {
+    provider: jwtProvider,
+    extractCredentials,
+    onAuthFailed: (conn, error) => {
+        switch (error.errorCode) {
+            case 'EXPIRED_TOKEN':
+                conn.send('AuthError', { code: 'TOKEN_EXPIRED' })
+                break
+            case 'INVALID_TOKEN':
+                conn.send('AuthError', { code: 'INVALID_TOKEN' })
+                break
+            default:
+                conn.close()
+        }
+    },
+})
+```
+
+## 完整示例
+
+以下是使用 JWT 认证的完整示例：
+
+```typescript
+// server.ts
+import { createServer } from '@esengine/server'
+import {
+    withAuth,
+    withRoomAuth,
+    createJwtAuthProvider,
+    requireAuth,
+    requireRole,
+    type AuthPlayer,
+} from '@esengine/server/auth'
+
+// 类型定义
+interface User {
+    id: string
+    name: string
+    roles: string[]
+}
+
+// JWT 提供者
+const jwtProvider = createJwtAuthProvider<User>({
+    secret: process.env.JWT_SECRET!,
+    expiresIn: 3600,
+    getUser: async (payload) => ({
+        id: payload.sub as string,
+        name: payload.name as string,
+        roles: (payload.roles as string[]) ?? [],
+    }),
+})
+
+// 创建带认证的服务器
+const server = withAuth(
+    await createServer({ port: 3000 }),
+    {
+        provider: jwtProvider,
+        extractCredentials: (req) => {
+            return new URL(req.url ?? '', 'http://localhost')
+                .searchParams.get('token')
+        },
+    }
+)
+
+// 带认证的游戏房间
+class GameRoom extends withRoomAuth<User>(Room, {
+    requireAuth: true,
+    allowedRoles: ['player'],
+}) {
+    onCreate() {
+        console.log('游戏房间已创建')
+    }
+
+    onJoin(player: AuthPlayer<User>) {
+        console.log(`${player.user?.name} 加入了！`)
+        this.broadcast('PlayerJoined', {
+            id: player.id,
+            name: player.user?.name,
+        })
+    }
+
+    @requireAuth()
+    @onMessage('Move')
+    handleMove(data: { x: number; y: number }, player: AuthPlayer<User>) {
+        // 处理移动
+    }
+
+    @requireRole('admin')
+    @onMessage('Kick')
+    handleKick(data: { playerId: string }, player: AuthPlayer<User>) {
+        const target = this.getPlayer(data.playerId)
+        if (target) {
+            this.kick(target, '被管理员踢出')
+        }
+    }
+}
+
+server.define('game', GameRoom)
+await server.start()
+```
+
+## 最佳实践
+
+1. **保护密钥安全**：永远不要硬编码 JWT 密钥，使用环境变量。
+
+2. **设置合理的过期时间**：在安全性和用户体验之间平衡令牌 TTL。
+
+3. **在关键操作上验证**：在敏感消息处理器上使用 `@requireAuth`。
+
+4. **使用基于角色的访问控制**：为管理功能实现适当的角色层级。
+
+5. **处理令牌刷新**：为长会话实现令牌刷新逻辑。
+
+6. **记录认证事件**：跟踪登录尝试和失败以进行安全监控。
+
+7. **测试认证流程**：使用 `MockAuthProvider` 测试认证场景。

docs/src/content/docs/modules/network/rate-limit.md

@@ -0,0 +1,458 @@
+---
+title: "速率限制"
+description: "使用可配置的速率限制保护你的游戏服务器免受滥用"
+---
+
+`@esengine/server` 包含可插拔的速率限制系统，用于防止 DDoS 攻击、消息洪水和其他滥用行为。
+
+## 安装
+
+速率限制包含在 server 包中：
+
+```bash
+npm install @esengine/server
+```
+
+## 快速开始
+
+```typescript
+import { Room, onMessage } from '@esengine/server'
+import { withRateLimit, rateLimit, noRateLimit } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room, {
+    messagesPerSecond: 10,
+    burstSize: 20,
+    onLimited: (player, type, result) => {
+        player.send('Error', {
+            code: 'RATE_LIMITED',
+            retryAfter: result.retryAfter,
+        })
+    },
+}) {
+    @onMessage('Move')
+    handleMove(data: { x: number; y: number }, player: Player) {
+        // 受速率限制保护（默认 10 msg/s）
+    }
+
+    @rateLimit({ messagesPerSecond: 1 })
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: Player) {
+        // 交易使用更严格的限制
+    }
+
+    @noRateLimit()
+    @onMessage('Heartbeat')
+    handleHeartbeat(data: any, player: Player) {
+        // 心跳不限制
+    }
+}
+```
+
+## 速率限制策略
+
+### 令牌桶（默认）
+
+令牌桶算法允许突发流量，同时保持长期速率限制。令牌以固定速率添加，每个请求消耗令牌。
+
+```typescript
+import { withRateLimit } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room, {
+    strategy: 'token-bucket',
+    messagesPerSecond: 10, // 补充速率
+    burstSize: 20,         // 桶容量
+}) { }
+```
+
+**工作原理：**
+```
+配置: rate=10/s, burstSize=20
+
+[0s]   桶满: 20 令牌
+[0s]   收到 15 条消息 → 允许，剩余 5
+[0.5s] 补充 5 令牌 → 10 令牌
+[0.5s] 收到 8 条消息 → 允许，剩余 2
+[0.6s] 补充 1 令牌 → 3 令牌
+[0.6s] 收到 5 条消息 → 允许 3，拒绝 2
+```
+
+**最适合：** 大多数通用场景，平衡突发容忍度与保护。
+
+### 滑动窗口
+
+滑动窗口算法精确跟踪时间窗口内的请求。比固定窗口更准确，但内存使用稍多。
+
+```typescript
+class GameRoom extends withRateLimit(Room, {
+    strategy: 'sliding-window',
+    messagesPerSecond: 10,
+    burstSize: 10,
+}) { }
+```
+
+**最适合：** 需要精确限流且不需要突发容忍的场景。
+
+### 固定窗口
+
+固定窗口算法将时间划分为固定间隔，并计算每个间隔内的请求数。简单且内存高效，但在窗口边界允许 2 倍突发。
+
+```typescript
+class GameRoom extends withRateLimit(Room, {
+    strategy: 'fixed-window',
+    messagesPerSecond: 10,
+    burstSize: 10,
+}) { }
+```
+
+**最适合：** 简单场景，可接受边界突发。
+
+## 配置
+
+### 房间配置
+
+```typescript
+import { withRateLimit } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room, {
+    // 每秒允许的消息数（默认: 10）
+    messagesPerSecond: 10,
+
+    // 突发容量 / 桶大小（默认: 20）
+    burstSize: 20,
+
+    // 策略: 'token-bucket' | 'sliding-window' | 'fixed-window'
+    strategy: 'token-bucket',
+
+    // 被限流时的回调
+    onLimited: (player, messageType, result) => {
+        player.send('RateLimited', {
+            type: messageType,
+            retryAfter: result.retryAfter,
+        })
+    },
+
+    // 限流时断开连接（默认: false）
+    disconnectOnLimit: false,
+
+    // 连续 N 次限流后断开（0 = 永不）
+    maxConsecutiveLimits: 10,
+
+    // 自定义键函数（默认: player.id）
+    getKey: (player) => player.id,
+
+    // 清理间隔（毫秒，默认: 60000）
+    cleanupInterval: 60000,
+}) { }
+```
+
+### 单消息配置
+
+使用装饰器为特定消息配置速率限制：
+
+```typescript
+import { rateLimit, noRateLimit, rateLimitMessage } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room) {
+    // 此消息使用自定义速率限制
+    @rateLimit({ messagesPerSecond: 1, burstSize: 2 })
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: Player) { }
+
+    // 此消息消耗 5 个令牌
+    @rateLimit({ cost: 5 })
+    @onMessage('ExpensiveAction')
+    handleExpensive(data: any, player: Player) { }
+
+    // 豁免速率限制
+    @noRateLimit()
+    @onMessage('Heartbeat')
+    handleHeartbeat(data: any, player: Player) { }
+
+    // 替代方案：显式指定消息类型
+    @rateLimitMessage('SpecialAction', { messagesPerSecond: 2 })
+    @onMessage('SpecialAction')
+    handleSpecial(data: any, player: Player) { }
+}
+```
+
+## 与认证系统组合
+
+速率限制可与认证系统无缝配合：
+
+```typescript
+import { withRoomAuth } from '@esengine/server/auth'
+import { withRateLimit } from '@esengine/server/ratelimit'
+
+// 同时应用两个 mixin
+class GameRoom extends withRateLimit(
+    withRoomAuth(Room, { requireAuth: true }),
+    { messagesPerSecond: 10 }
+) {
+    onJoin(player: AuthPlayer) {
+        console.log(`${player.user?.name} 已加入，受速率限制保护`)
+    }
+}
+```
+
+## 速率限制结果
+
+当消息被限流时，回调会收到结果对象：
+
+```typescript
+interface RateLimitResult {
+    // 是否允许请求
+    allowed: boolean
+
+    // 剩余配额
+    remaining: number
+
+    // 配额重置时间（时间戳）
+    resetAt: number
+
+    // 重试等待时间（毫秒）
+    retryAfter?: number
+}
+```
+
+## 访问速率限制上下文
+
+你可以访问任何玩家的速率限制上下文：
+
+```typescript
+import { getPlayerRateLimitContext } from '@esengine/server/ratelimit'
+
+class GameRoom extends withRateLimit(Room) {
+    someMethod(player: Player) {
+        const context = this.getRateLimitContext(player)
+
+        // 检查但不消费
+        const status = context?.check()
+        console.log(`剩余: ${status?.remaining}`)
+
+        // 获取连续限流次数
+        console.log(`连续限流: ${context?.consecutiveLimitCount}`)
+    }
+}
+
+// 或使用独立函数
+const context = getPlayerRateLimitContext(player)
+```
+
+## 自定义策略
+
+你可以直接使用策略进行自定义实现：
+
+```typescript
+import {
+    TokenBucketStrategy,
+    SlidingWindowStrategy,
+    FixedWindowStrategy,
+    createTokenBucketStrategy,
+} from '@esengine/server/ratelimit'
+
+// 直接创建策略
+const strategy = createTokenBucketStrategy({
+    rate: 10,      // 每秒令牌数
+    capacity: 20,  // 最大令牌数
+})
+
+// 检查并消费
+const result = strategy.consume('player-123')
+if (result.allowed) {
+    // 处理消息
+} else {
+    // 被限流，等待 result.retryAfter 毫秒
+}
+
+// 检查但不消费
+const status = strategy.getStatus('player-123')
+
+// 重置某个键
+strategy.reset('player-123')
+
+// 清理过期记录
+strategy.cleanup()
+```
+
+## 速率限制上下文
+
+`RateLimitContext` 类管理单个玩家的速率限制：
+
+```typescript
+import { RateLimitContext, TokenBucketStrategy } from '@esengine/server/ratelimit'
+
+const strategy = new TokenBucketStrategy({ rate: 10, capacity: 20 })
+const context = new RateLimitContext('player-123', strategy)
+
+// 检查但不消费
+context.check()
+
+// 消费配额
+context.consume()
+
+// 带消耗量消费
+context.consume(undefined, 5)
+
+// 为特定消息类型消费
+context.consume('Trade')
+
+// 设置单消息策略
+context.setMessageStrategy('Trade', new TokenBucketStrategy({ rate: 1, capacity: 2 }))
+
+// 重置
+context.reset()
+
+// 获取连续限流次数
+console.log(context.consecutiveLimitCount)
+```
+
+## 房间生命周期钩子
+
+你可以重写 `onRateLimited` 钩子进行自定义处理：
+
+```typescript
+class GameRoom extends withRateLimit(Room) {
+    onRateLimited(player: Player, messageType: string, result: RateLimitResult) {
+        // 记录事件
+        console.log(`玩家 ${player.id} 在 ${messageType} 上被限流`)
+
+        // 发送自定义错误
+        player.send('SystemMessage', {
+            type: 'warning',
+            message: `请慢一点！${result.retryAfter}ms 后重试`,
+        })
+    }
+}
+```
+
+## 最佳实践
+
+1. **从令牌桶开始**：对于游戏来说是最灵活的算法。
+
+2. **设置合适的限制**：考虑你的游戏机制：
+   - 移动消息：较高限制（20-60/s）
+   - 聊天消息：较低限制（1-5/s）
+   - 交易/购买：非常低的限制（0.5-1/s）
+
+3. **使用突发容量**：允许短暂突发以获得响应式体验：
+   ```typescript
+   messagesPerSecond: 10,
+   burstSize: 30, // 允许 3 秒的突发
+   ```
+
+4. **豁免关键消息**：不要限制心跳或系统消息：
+   ```typescript
+   @noRateLimit()
+   @onMessage('Heartbeat')
+   handleHeartbeat() { }
+   ```
+
+5. **与认证结合**：对已认证用户按用户 ID 限流：
+   ```typescript
+   getKey: (player) => player.auth?.userId ?? player.id
+   ```
+
+6. **监控和调整**：记录限流事件以调整限制：
+   ```typescript
+   onLimited: (player, type, result) => {
+       metrics.increment('rate_limit', { messageType: type })
+   }
+   ```
+
+7. **优雅降级**：发送信息性错误而不是直接断开：
+   ```typescript
+   onLimited: (player, type, result) => {
+       player.send('Error', {
+           code: 'RATE_LIMITED',
+           message: '请求过于频繁',
+           retryAfter: result.retryAfter,
+       })
+   }
+   ```
+
+## 完整示例
+
+```typescript
+import { Room, onMessage, type Player } from '@esengine/server'
+import { withRoomAuth, type AuthPlayer } from '@esengine/server/auth'
+import {
+    withRateLimit,
+    rateLimit,
+    noRateLimit,
+    type RateLimitResult,
+} from '@esengine/server/ratelimit'
+
+interface User {
+    id: string
+    name: string
+    premium: boolean
+}
+
+// 组合认证和速率限制
+class GameRoom extends withRateLimit(
+    withRoomAuth<User>(Room, { requireAuth: true }),
+    {
+        messagesPerSecond: 10,
+        burstSize: 30,
+        strategy: 'token-bucket',
+
+        // 使用用户 ID 进行限流
+        getKey: (player) => (player as AuthPlayer<User>).user?.id ?? player.id,
+
+        // 处理限流
+        onLimited: (player, type, result) => {
+            player.send('Error', {
+                code: 'RATE_LIMITED',
+                messageType: type,
+                retryAfter: result.retryAfter,
+            })
+        },
+
+        // 连续 20 次限流后断开
+        maxConsecutiveLimits: 20,
+    }
+) {
+    onCreate() {
+        console.log('房间已创建，具有认证 + 速率限制保护')
+    }
+
+    onJoin(player: AuthPlayer<User>) {
+        this.broadcast('PlayerJoined', { name: player.user?.name })
+    }
+
+    // 高频移动（默认速率限制）
+    @onMessage('Move')
+    handleMove(data: { x: number; y: number }, player: AuthPlayer<User>) {
+        this.broadcast('PlayerMoved', { id: player.id, ...data })
+    }
+
+    // 低频交易（严格限制）
+    @rateLimit({ messagesPerSecond: 0.5, burstSize: 2 })
+    @onMessage('Trade')
+    handleTrade(data: TradeData, player: AuthPlayer<User>) {
+        // 处理交易...
+    }
+
+    // 聊天使用中等限制
+    @rateLimit({ messagesPerSecond: 2, burstSize: 5 })
+    @onMessage('Chat')
+    handleChat(data: { text: string }, player: AuthPlayer<User>) {
+        this.broadcast('Chat', {
+            from: player.user?.name,
+            text: data.text,
+        })
+    }
+
+    // 系统消息 - 不限制
+    @noRateLimit()
+    @onMessage('Heartbeat')
+    handleHeartbeat(data: any, player: Player) {
+        player.send('Pong', { time: Date.now() })
+    }
+
+    // 自定义限流处理
+    onRateLimited(player: Player, messageType: string, result: RateLimitResult) {
+        console.warn(`[限流] 玩家 ${player.id} 在 ${messageType} 上被限流`)
+    }
+}
+```

docs/src/content/docs/modules/transaction/core.md

@@ -0,0 +1,261 @@
+---
+title: "核心概念"
+description: "事务系统的核心概念：事务上下文、事务管理器、Saga 模式"
+---
+
+## 事务状态
+
+事务有以下几种状态：
+
+```typescript
+type TransactionState =
+    | 'pending'     // 等待执行
+    | 'executing'   // 执行中
+    | 'committed'   // 已提交
+    | 'rolledback'  // 已回滚
+    | 'failed'      // 失败
+```
+
+## TransactionContext
+
+事务上下文封装了事务的状态、操作和执行逻辑。
+
+### 创建事务
+
+```typescript
+import { TransactionManager } from '@esengine/transaction';
+
+const manager = new TransactionManager();
+
+// 方式 1：使用 begin() 手动管理
+const tx = manager.begin({ timeout: 5000 });
+tx.addOperation(op1);
+tx.addOperation(op2);
+const result = await tx.execute();
+
+// 方式 2：使用 run() 自动管理
+const result = await manager.run((tx) => {
+    tx.addOperation(op1);
+    tx.addOperation(op2);
+});
+```
+
+### 链式添加操作
+
+```typescript
+const result = await manager.run((tx) => {
+    tx.addOperation(new CurrencyOperation({ ... }))
+      .addOperation(new InventoryOperation({ ... }))
+      .addOperation(new InventoryOperation({ ... }));
+});
+```
+
+### 上下文数据
+
+操作之间可以通过上下文共享数据：
+
+```typescript
+class CustomOperation extends BaseOperation<MyData, MyResult> {
+    async execute(ctx: ITransactionContext): Promise<OperationResult<MyResult>> {
+        // 读取之前操作设置的数据
+        const previousResult = ctx.get<number>('previousValue');
+
+        // 设置数据供后续操作使用
+        ctx.set('myResult', { value: 123 });
+
+        return this.success({ ... });
+    }
+}
+```
+
+## TransactionManager
+
+事务管理器负责创建、执行和恢复事务。
+
+### 配置选项
+
+```typescript
+interface TransactionManagerConfig {
+    storage?: ITransactionStorage;    // 存储实例
+    defaultTimeout?: number;          // 默认超时（毫秒）
+    serverId?: string;                // 服务器 ID（分布式用）
+    autoRecover?: boolean;            // 自动恢复未完成事务
+}
+
+const manager = new TransactionManager({
+    storage: new RedisStorage({ client: redis }),
+    defaultTimeout: 10000,
+    serverId: 'server-1',
+    autoRecover: true,
+});
+```
+
+### 分布式锁
+
+```typescript
+// 获取锁
+const token = await manager.acquireLock('player:123:inventory', 10000);
+
+if (token) {
+    try {
+        // 执行操作
+        await doSomething();
+    } finally {
+        // 释放锁
+        await manager.releaseLock('player:123:inventory', token);
+    }
+}
+
+// 或使用 withLock 简化
+await manager.withLock('player:123:inventory', async () => {
+    await doSomething();
+}, 10000);
+```
+
+### 事务恢复
+
+服务器重启时恢复未完成的事务：
+
+```typescript
+const manager = new TransactionManager({
+    storage: new RedisStorage({ client: redis }),
+    serverId: 'server-1',
+});
+
+// 恢复未完成的事务
+const recoveredCount = await manager.recover();
+console.log(`Recovered ${recoveredCount} transactions`);
+```
+
+## Saga 模式
+
+事务系统采用 Saga 模式，每个操作必须实现 `execute` 和 `compensate` 方法：
+
+```typescript
+interface ITransactionOperation<TData, TResult> {
+    readonly name: string;
+    readonly data: TData;
+
+    // 验证前置条件
+    validate(ctx: ITransactionContext): Promise<boolean>;
+
+    // 正向执行
+    execute(ctx: ITransactionContext): Promise<OperationResult<TResult>>;
+
+    // 补偿操作（回滚）
+    compensate(ctx: ITransactionContext): Promise<void>;
+}
+```
+
+### 执行流程
+
+```
+开始事务
+    │
+    ▼
+┌─────────────────────┐
+│  validate(op1)      │──失败──► 返回失败
+└─────────────────────┘
+    │成功
+    ▼
+┌─────────────────────┐
+│  execute(op1)       │──失败──┐
+└─────────────────────┘        │
+    │成功                       │
+    ▼                          │
+┌─────────────────────┐        │
+│  validate(op2)      │──失败──┤
+└─────────────────────┘        │
+    │成功                       │
+    ▼                          │
+┌─────────────────────┐        │
+│  execute(op2)       │──失败──┤
+└─────────────────────┘        │
+    │成功                       ▼
+    ▼                  ┌─────────────────────┐
+提交事务               │  compensate(op1)    │
+                       └─────────────────────┘
+                               │
+                               ▼
+                       返回失败（已回滚）
+```
+
+### 自定义操作
+
+```typescript
+import { BaseOperation, ITransactionContext, OperationResult } from '@esengine/transaction';
+
+interface UpgradeData {
+    playerId: string;
+    itemId: string;
+    targetLevel: number;
+}
+
+interface UpgradeResult {
+    newLevel: number;
+}
+
+class UpgradeOperation extends BaseOperation<UpgradeData, UpgradeResult> {
+    readonly name = 'upgrade';
+
+    private _previousLevel: number = 0;
+
+    async validate(ctx: ITransactionContext): Promise<boolean> {
+        // 验证物品存在且可升级
+        const item = await this.getItem(ctx);
+        return item !== null && item.level < this.data.targetLevel;
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult<UpgradeResult>> {
+        const item = await this.getItem(ctx);
+        if (!item) {
+            return this.failure('Item not found', 'ITEM_NOT_FOUND');
+        }
+
+        this._previousLevel = item.level;
+        item.level = this.data.targetLevel;
+        await this.saveItem(ctx, item);
+
+        return this.success({ newLevel: item.level });
+    }
+
+    async compensate(ctx: ITransactionContext): Promise<void> {
+        const item = await this.getItem(ctx);
+        if (item) {
+            item.level = this._previousLevel;
+            await this.saveItem(ctx, item);
+        }
+    }
+
+    private async getItem(ctx: ITransactionContext) {
+        // 从存储获取物品
+    }
+
+    private async saveItem(ctx: ITransactionContext, item: any) {
+        // 保存物品到存储
+    }
+}
+```
+
+## 事务结果
+
+```typescript
+interface TransactionResult<T = unknown> {
+    success: boolean;           // 是否成功
+    transactionId: string;      // 事务 ID
+    results: OperationResult[]; // 各操作结果
+    data?: T;                   // 最终数据
+    error?: string;             // 错误信息
+    duration: number;           // 执行时间（毫秒）
+}
+
+const result = await manager.run((tx) => { ... });
+
+console.log(`Transaction ${result.transactionId}`);
+console.log(`Success: ${result.success}`);
+console.log(`Duration: ${result.duration}ms`);
+
+if (!result.success) {
+    console.log(`Error: ${result.error}`);
+}
+```

docs/src/content/docs/modules/transaction/distributed.md

@@ -0,0 +1,355 @@
+---
+title: "分布式事务"
+description: "Saga 编排器和跨服务器事务支持"
+---
+
+## Saga 编排器
+
+`SagaOrchestrator` 用于编排跨服务器的分布式事务。
+
+### 基本用法
+
+```typescript
+import { SagaOrchestrator, RedisStorage } from '@esengine/transaction';
+
+const orchestrator = new SagaOrchestrator({
+    storage: new RedisStorage({ client: redis }),
+    timeout: 30000,
+    serverId: 'orchestrator-1',
+});
+
+const result = await orchestrator.execute([
+    {
+        name: 'deduct_currency',
+        serverId: 'game-server-1',
+        data: { playerId: 'player1', amount: 100 },
+        execute: async (data) => {
+            // 调用游戏服务器 API 扣除货币
+            const response = await gameServerApi.deductCurrency(data);
+            return { success: response.ok };
+        },
+        compensate: async (data) => {
+            // 调用游戏服务器 API 恢复货币
+            await gameServerApi.addCurrency(data);
+        },
+    },
+    {
+        name: 'add_item',
+        serverId: 'inventory-server-1',
+        data: { playerId: 'player1', itemId: 'sword' },
+        execute: async (data) => {
+            const response = await inventoryServerApi.addItem(data);
+            return { success: response.ok };
+        },
+        compensate: async (data) => {
+            await inventoryServerApi.removeItem(data);
+        },
+    },
+]);
+
+if (result.success) {
+    console.log('Saga completed successfully');
+} else {
+    console.log('Saga failed:', result.error);
+    console.log('Completed steps:', result.completedSteps);
+    console.log('Failed at:', result.failedStep);
+}
+```
+
+### 配置选项
+
+```typescript
+interface SagaOrchestratorConfig {
+    storage?: ITransactionStorage;  // 存储实例
+    timeout?: number;               // 超时时间（毫秒）
+    serverId?: string;              // 编排器服务器 ID
+}
+```
+
+### Saga 步骤
+
+```typescript
+interface SagaStep<T = unknown> {
+    name: string;                   // 步骤名称
+    serverId?: string;              // 目标服务器 ID
+    data: T;                        // 步骤数据
+    execute: (data: T) => Promise<OperationResult>;    // 执行函数
+    compensate: (data: T) => Promise<void>;            // 补偿函数
+}
+```
+
+### Saga 结果
+
+```typescript
+interface SagaResult {
+    success: boolean;       // 是否成功
+    sagaId: string;         // Saga ID
+    completedSteps: string[]; // 已完成的步骤
+    failedStep?: string;    // 失败的步骤
+    error?: string;         // 错误信息
+    duration: number;       // 执行时间（毫秒）
+}
+```
+
+## 执行流程
+
+```
+开始 Saga
+    │
+    ▼
+┌─────────────────────┐
+│  Step 1: execute    │──失败──┐
+└─────────────────────┘        │
+    │成功                       │
+    ▼                          │
+┌─────────────────────┐        │
+│  Step 2: execute    │──失败──┤
+└─────────────────────┘        │
+    │成功                       │
+    ▼                          │
+┌─────────────────────┐        │
+│  Step 3: execute    │──失败──┤
+└─────────────────────┘        │
+    │成功                       ▼
+    ▼                  ┌─────────────────────┐
+Saga 完成              │  Step 2: compensate │
+                       └─────────────────────┘
+                               │
+                               ▼
+                       ┌─────────────────────┐
+                       │  Step 1: compensate │
+                       └─────────────────────┘
+                               │
+                               ▼
+                       Saga 失败（已补偿）
+```
+
+## Saga 日志
+
+编排器会记录详细的执行日志：
+
+```typescript
+interface SagaLog {
+    id: string;                     // Saga ID
+    state: SagaLogState;            // 状态
+    steps: SagaStepLog[];           // 步骤日志
+    createdAt: number;              // 创建时间
+    updatedAt: number;              // 更新时间
+    metadata?: Record<string, unknown>;
+}
+
+type SagaLogState =
+    | 'pending'       // 等待执行
+    | 'running'       // 执行中
+    | 'completed'     // 已完成
+    | 'compensating'  // 补偿中
+    | 'compensated'   // 已补偿
+    | 'failed'        // 失败
+
+interface SagaStepLog {
+    name: string;                   // 步骤名称
+    serverId?: string;              // 服务器 ID
+    state: SagaStepState;           // 状态
+    startedAt?: number;             // 开始时间
+    completedAt?: number;           // 完成时间
+    error?: string;                 // 错误信息
+}
+
+type SagaStepState =
+    | 'pending'       // 等待执行
+    | 'executing'     // 执行中
+    | 'completed'     // 已完成
+    | 'compensating'  // 补偿中
+    | 'compensated'   // 已补偿
+    | 'failed'        // 失败
+```
+
+### 查询 Saga 日志
+
+```typescript
+const log = await orchestrator.getSagaLog('saga_xxx');
+
+if (log) {
+    console.log('Saga state:', log.state);
+    for (const step of log.steps) {
+        console.log(`  ${step.name}: ${step.state}`);
+    }
+}
+```
+
+## 跨服务器事务示例
+
+### 场景：跨服购买
+
+玩家在游戏服务器购买物品，货币在账户服务器，物品在背包服务器。
+
+```typescript
+const orchestrator = new SagaOrchestrator({
+    storage: redisStorage,
+    serverId: 'purchase-orchestrator',
+});
+
+async function crossServerPurchase(
+    playerId: string,
+    itemId: string,
+    price: number
+): Promise<SagaResult> {
+    return orchestrator.execute([
+        // 步骤 1：在账户服务器扣款
+        {
+            name: 'deduct_balance',
+            serverId: 'account-server',
+            data: { playerId, amount: price },
+            execute: async (data) => {
+                const result = await accountService.deduct(data.playerId, data.amount);
+                return { success: result.ok, error: result.error };
+            },
+            compensate: async (data) => {
+                await accountService.refund(data.playerId, data.amount);
+            },
+        },
+
+        // 步骤 2：在背包服务器添加物品
+        {
+            name: 'add_item',
+            serverId: 'inventory-server',
+            data: { playerId, itemId },
+            execute: async (data) => {
+                const result = await inventoryService.addItem(data.playerId, data.itemId);
+                return { success: result.ok, error: result.error };
+            },
+            compensate: async (data) => {
+                await inventoryService.removeItem(data.playerId, data.itemId);
+            },
+        },
+
+        // 步骤 3：记录购买日志
+        {
+            name: 'log_purchase',
+            serverId: 'log-server',
+            data: { playerId, itemId, price, timestamp: Date.now() },
+            execute: async (data) => {
+                await logService.recordPurchase(data);
+                return { success: true };
+            },
+            compensate: async (data) => {
+                await logService.cancelPurchase(data);
+            },
+        },
+    ]);
+}
+```
+
+### 场景：跨服交易
+
+两个玩家在不同服务器上进行交易。
+
+```typescript
+async function crossServerTrade(
+    playerA: { id: string; server: string; items: string[] },
+    playerB: { id: string; server: string; items: string[] }
+): Promise<SagaResult> {
+    const steps: SagaStep[] = [];
+
+    // 移除 A 的物品
+    for (const itemId of playerA.items) {
+        steps.push({
+            name: `remove_${playerA.id}_${itemId}`,
+            serverId: playerA.server,
+            data: { playerId: playerA.id, itemId },
+            execute: async (data) => {
+                return await inventoryService.removeItem(data.playerId, data.itemId);
+            },
+            compensate: async (data) => {
+                await inventoryService.addItem(data.playerId, data.itemId);
+            },
+        });
+    }
+
+    // 添加物品到 B
+    for (const itemId of playerA.items) {
+        steps.push({
+            name: `add_${playerB.id}_${itemId}`,
+            serverId: playerB.server,
+            data: { playerId: playerB.id, itemId },
+            execute: async (data) => {
+                return await inventoryService.addItem(data.playerId, data.itemId);
+            },
+            compensate: async (data) => {
+                await inventoryService.removeItem(data.playerId, data.itemId);
+            },
+        });
+    }
+
+    // 类似地处理 B 的物品...
+
+    return orchestrator.execute(steps);
+}
+```
+
+## 恢复未完成的 Saga
+
+服务器重启后恢复未完成的 Saga：
+
+```typescript
+const orchestrator = new SagaOrchestrator({
+    storage: redisStorage,
+    serverId: 'my-orchestrator',
+});
+
+// 恢复未完成的 Saga（会执行补偿）
+const recoveredCount = await orchestrator.recover();
+console.log(`Recovered ${recoveredCount} sagas`);
+```
+
+## 最佳实践
+
+### 1. 幂等性
+
+确保所有操作都是幂等的：
+
+```typescript
+{
+    execute: async (data) => {
+        // 使用唯一 ID 确保幂等
+        const result = await service.process(data.requestId, data);
+        return { success: result.ok };
+    },
+    compensate: async (data) => {
+        // 补偿也要幂等
+        await service.rollback(data.requestId);
+    },
+}
+```
+
+### 2. 超时处理
+
+设置合适的超时时间：
+
+```typescript
+const orchestrator = new SagaOrchestrator({
+    timeout: 60000,  // 跨服务器操作需要更长超时
+});
+```
+
+### 3. 监控和告警
+
+记录 Saga 执行结果：
+
+```typescript
+const result = await orchestrator.execute(steps);
+
+if (!result.success) {
+    // 发送告警
+    alertService.send({
+        type: 'saga_failed',
+        sagaId: result.sagaId,
+        failedStep: result.failedStep,
+        error: result.error,
+    });
+
+    // 记录详细日志
+    const log = await orchestrator.getSagaLog(result.sagaId);
+    logger.error('Saga failed', { log });
+}
+```

docs/src/content/docs/modules/transaction/index.md

@@ -0,0 +1,238 @@
+---
+title: "事务系统 (Transaction)"
+description: "游戏事务处理系统，支持商店购买、玩家交易、分布式事务"
+---
+
+`@esengine/transaction` 提供完整的游戏事务处理能力，基于 Saga 模式实现，支持商店购买、玩家交易、多步骤任务等场景，并提供 Redis/MongoDB 分布式事务支持。
+
+## 概述
+
+事务系统解决游戏中常见的数据一致性问题：
+
+| 场景 | 问题 | 解决方案 |
+|------|------|----------|
+| 商店购买 | 扣款成功但物品未发放 | 原子事务，失败自动回滚 |
+| 玩家交易 | 一方物品转移另一方未收到 | Saga 补偿机制 |
+| 跨服操作 | 多服务器数据不一致 | 分布式锁 + 事务日志 |
+
+## 安装
+
+```bash
+npm install @esengine/transaction
+```
+
+可选依赖（根据存储需求安装）：
+```bash
+npm install ioredis   # Redis 存储
+npm install mongodb   # MongoDB 存储
+```
+
+## 架构
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                    Transaction Layer                             │
+├─────────────────────────────────────────────────────────────────┤
+│  TransactionManager         - 事务管理器，协调事务生命周期        │
+│  TransactionContext         - 事务上下文，封装操作和状态          │
+│  SagaOrchestrator           - 分布式 Saga 编排器                 │
+├─────────────────────────────────────────────────────────────────┤
+│                    Storage Layer                                 │
+├─────────────────────────────────────────────────────────────────┤
+│  MemoryStorage              - 内存存储（开发/测试）               │
+│  RedisStorage               - Redis（分布式锁 + 缓存）            │
+│  MongoStorage               - MongoDB（持久化日志）               │
+├─────────────────────────────────────────────────────────────────┤
+│                    Operation Layer                               │
+├─────────────────────────────────────────────────────────────────┤
+│  CurrencyOperation          - 货币操作                           │
+│  InventoryOperation         - 背包操作                           │
+│  TradeOperation             - 交易操作                           │
+└─────────────────────────────────────────────────────────────────┘
+```
+
+## 快速开始
+
+### 基础用法
+
+```typescript
+import {
+    TransactionManager,
+    MemoryStorage,
+    CurrencyOperation,
+    InventoryOperation,
+} from '@esengine/transaction';
+
+// 创建事务管理器
+const manager = new TransactionManager({
+    storage: new MemoryStorage(),
+    defaultTimeout: 10000,
+});
+
+// 执行事务
+const result = await manager.run((tx) => {
+    // 扣除金币
+    tx.addOperation(new CurrencyOperation({
+        type: 'deduct',
+        playerId: 'player1',
+        currency: 'gold',
+        amount: 100,
+    }));
+
+    // 添加物品
+    tx.addOperation(new InventoryOperation({
+        type: 'add',
+        playerId: 'player1',
+        itemId: 'sword_001',
+        quantity: 1,
+    }));
+});
+
+if (result.success) {
+    console.log('购买成功！');
+} else {
+    console.log('购买失败：', result.error);
+}
+```
+
+### 玩家交易
+
+```typescript
+import { TradeOperation } from '@esengine/transaction';
+
+const result = await manager.run((tx) => {
+    tx.addOperation(new TradeOperation({
+        tradeId: 'trade_001',
+        partyA: {
+            playerId: 'player1',
+            items: [{ itemId: 'sword', quantity: 1 }],
+        },
+        partyB: {
+            playerId: 'player2',
+            currencies: [{ currency: 'gold', amount: 1000 }],
+        },
+    }));
+}, { timeout: 30000 });
+```
+
+### 使用 Redis 存储
+
+```typescript
+import Redis from 'ioredis';
+import { TransactionManager, RedisStorage } from '@esengine/transaction';
+
+const redis = new Redis('redis://localhost:6379');
+const storage = new RedisStorage({ client: redis });
+
+const manager = new TransactionManager({ storage });
+```
+
+### 使用 MongoDB 存储
+
+```typescript
+import { MongoClient } from 'mongodb';
+import { TransactionManager, MongoStorage } from '@esengine/transaction';
+
+const client = new MongoClient('mongodb://localhost:27017');
+await client.connect();
+const db = client.db('game');
+
+const storage = new MongoStorage({ db });
+await storage.ensureIndexes();
+
+const manager = new TransactionManager({ storage });
+```
+
+## 与 Room 集成
+
+```typescript
+import { Room } from '@esengine/server';
+import { withTransactions, CurrencyOperation, RedisStorage } from '@esengine/transaction';
+
+class GameRoom extends withTransactions(Room, {
+    storage: new RedisStorage({ client: redisClient }),
+}) {
+    @onMessage('Buy')
+    async handleBuy(data: { itemId: string }, player: Player) {
+        const result = await this.runTransaction((tx) => {
+            tx.addOperation(new CurrencyOperation({
+                type: 'deduct',
+                playerId: player.id,
+                currency: 'gold',
+                amount: getItemPrice(data.itemId),
+            }));
+        });
+
+        if (result.success) {
+            player.send('buy_success', { itemId: data.itemId });
+        } else {
+            player.send('buy_failed', { error: result.error });
+        }
+    }
+}
+```
+
+## 文档导航
+
+- [核心概念](/modules/transaction/core/) - 事务上下文、管理器、Saga 模式
+- [存储层](/modules/transaction/storage/) - MemoryStorage、RedisStorage、MongoStorage
+- [操作类](/modules/transaction/operations/) - 货币、背包、交易操作
+- [分布式事务](/modules/transaction/distributed/) - Saga 编排器、跨服务器事务
+- [API 参考](/modules/transaction/api/) - 完整 API 文档
+
+## 服务令牌
+
+用于依赖注入：
+
+```typescript
+import {
+    TransactionManagerToken,
+    TransactionStorageToken,
+} from '@esengine/transaction';
+
+const manager = services.get(TransactionManagerToken);
+```
+
+## 最佳实践
+
+### 1. 操作粒度
+
+```typescript
+// ✅ 好：细粒度操作，便于回滚
+tx.addOperation(new CurrencyOperation({ type: 'deduct', ... }));
+tx.addOperation(new InventoryOperation({ type: 'add', ... }));
+
+// ❌ 差：粗粒度操作，难以部分回滚
+tx.addOperation(new ComplexPurchaseOperation({ ... }));
+```
+
+### 2. 超时设置
+
+```typescript
+// 简单操作：短超时
+await manager.run(tx => { ... }, { timeout: 5000 });
+
+// 复杂交易：长超时
+await manager.run(tx => { ... }, { timeout: 30000 });
+
+// 跨服务器：更长超时
+await manager.run(tx => { ... }, { timeout: 60000, distributed: true });
+```
+
+### 3. 错误处理
+
+```typescript
+const result = await manager.run((tx) => { ... });
+
+if (!result.success) {
+    // 记录日志
+    logger.error('Transaction failed', {
+        transactionId: result.transactionId,
+        error: result.error,
+        duration: result.duration,
+    });
+
+    // 通知用户
+    player.send('error', { message: getErrorMessage(result.error) });
+}
+```

docs/src/content/docs/modules/transaction/operations.md

@@ -0,0 +1,313 @@
+---
+title: "操作类"
+description: "内置的事务操作：货币、背包、交易"
+---
+
+## BaseOperation
+
+所有操作类的基类，提供通用的实现模板。
+
+```typescript
+import { BaseOperation, ITransactionContext, OperationResult } from '@esengine/transaction';
+
+class MyOperation extends BaseOperation<MyData, MyResult> {
+    readonly name = 'myOperation';
+
+    async validate(ctx: ITransactionContext): Promise<boolean> {
+        // 验证前置条件
+        return true;
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult<MyResult>> {
+        // 执行操作
+        return this.success({ result: 'ok' });
+        // 或
+        return this.failure('Something went wrong', 'ERROR_CODE');
+    }
+
+    async compensate(ctx: ITransactionContext): Promise<void> {
+        // 回滚操作
+    }
+}
+```
+
+## CurrencyOperation
+
+处理货币的增加和扣除。
+
+### 扣除货币
+
+```typescript
+import { CurrencyOperation } from '@esengine/transaction';
+
+tx.addOperation(new CurrencyOperation({
+    type: 'deduct',
+    playerId: 'player1',
+    currency: 'gold',
+    amount: 100,
+    reason: 'purchase_item',
+}));
+```
+
+### 增加货币
+
+```typescript
+tx.addOperation(new CurrencyOperation({
+    type: 'add',
+    playerId: 'player1',
+    currency: 'diamond',
+    amount: 50,
+    reason: 'daily_reward',
+}));
+```
+
+### 操作数据
+
+```typescript
+interface CurrencyOperationData {
+    type: 'add' | 'deduct';   // 操作类型
+    playerId: string;          // 玩家 ID
+    currency: string;          // 货币类型
+    amount: number;            // 数量
+    reason?: string;           // 原因/来源
+}
+```
+
+### 操作结果
+
+```typescript
+interface CurrencyOperationResult {
+    beforeBalance: number;     // 操作前余额
+    afterBalance: number;      // 操作后余额
+}
+```
+
+### 自定义数据提供者
+
+```typescript
+interface ICurrencyProvider {
+    getBalance(playerId: string, currency: string): Promise<number>;
+    setBalance(playerId: string, currency: string, amount: number): Promise<void>;
+}
+
+class MyCurrencyProvider implements ICurrencyProvider {
+    async getBalance(playerId: string, currency: string): Promise<number> {
+        // 从数据库获取余额
+        return await db.getCurrency(playerId, currency);
+    }
+
+    async setBalance(playerId: string, currency: string, amount: number): Promise<void> {
+        // 保存到数据库
+        await db.setCurrency(playerId, currency, amount);
+    }
+}
+
+// 使用自定义提供者
+const op = new CurrencyOperation({ ... });
+op.setProvider(new MyCurrencyProvider());
+tx.addOperation(op);
+```
+
+## InventoryOperation
+
+处理物品的添加、移除和更新。
+
+### 添加物品
+
+```typescript
+import { InventoryOperation } from '@esengine/transaction';
+
+tx.addOperation(new InventoryOperation({
+    type: 'add',
+    playerId: 'player1',
+    itemId: 'sword_001',
+    quantity: 1,
+    properties: { enchant: 'fire' },
+}));
+```
+
+### 移除物品
+
+```typescript
+tx.addOperation(new InventoryOperation({
+    type: 'remove',
+    playerId: 'player1',
+    itemId: 'potion_hp',
+    quantity: 5,
+}));
+```
+
+### 更新物品
+
+```typescript
+tx.addOperation(new InventoryOperation({
+    type: 'update',
+    playerId: 'player1',
+    itemId: 'sword_001',
+    quantity: 1,  // 可选，不传则保持原数量
+    properties: { enchant: 'lightning', level: 5 },
+}));
+```
+
+### 操作数据
+
+```typescript
+interface InventoryOperationData {
+    type: 'add' | 'remove' | 'update';  // 操作类型
+    playerId: string;                    // 玩家 ID
+    itemId: string;                      // 物品 ID
+    quantity: number;                    // 数量
+    properties?: Record<string, unknown>; // 物品属性
+    reason?: string;                     // 原因/来源
+}
+```
+
+### 操作结果
+
+```typescript
+interface InventoryOperationResult {
+    beforeItem?: ItemData;   // 操作前物品
+    afterItem?: ItemData;    // 操作后物品
+}
+
+interface ItemData {
+    itemId: string;
+    quantity: number;
+    properties?: Record<string, unknown>;
+}
+```
+
+### 自定义数据提供者
+
+```typescript
+interface IInventoryProvider {
+    getItem(playerId: string, itemId: string): Promise<ItemData | null>;
+    setItem(playerId: string, itemId: string, item: ItemData | null): Promise<void>;
+    hasCapacity?(playerId: string, count: number): Promise<boolean>;
+}
+
+class MyInventoryProvider implements IInventoryProvider {
+    async getItem(playerId: string, itemId: string): Promise<ItemData | null> {
+        return await db.getItem(playerId, itemId);
+    }
+
+    async setItem(playerId: string, itemId: string, item: ItemData | null): Promise<void> {
+        if (item) {
+            await db.saveItem(playerId, itemId, item);
+        } else {
+            await db.deleteItem(playerId, itemId);
+        }
+    }
+
+    async hasCapacity(playerId: string, count: number): Promise<boolean> {
+        const current = await db.getItemCount(playerId);
+        const max = await db.getMaxCapacity(playerId);
+        return current + count <= max;
+    }
+}
+```
+
+## TradeOperation
+
+处理玩家之间的物品和货币交换。
+
+### 基本用法
+
+```typescript
+import { TradeOperation } from '@esengine/transaction';
+
+tx.addOperation(new TradeOperation({
+    tradeId: 'trade_001',
+    partyA: {
+        playerId: 'player1',
+        items: [{ itemId: 'sword', quantity: 1 }],
+        currencies: [{ currency: 'diamond', amount: 10 }],
+    },
+    partyB: {
+        playerId: 'player2',
+        currencies: [{ currency: 'gold', amount: 1000 }],
+    },
+    reason: 'player_trade',
+}));
+```
+
+### 操作数据
+
+```typescript
+interface TradeOperationData {
+    tradeId: string;      // 交易 ID
+    partyA: TradeParty;   // 交易发起方
+    partyB: TradeParty;   // 交易接收方
+    reason?: string;      // 原因/备注
+}
+
+interface TradeParty {
+    playerId: string;              // 玩家 ID
+    items?: TradeItem[];           // 给出的物品
+    currencies?: TradeCurrency[];  // 给出的货币
+}
+
+interface TradeItem {
+    itemId: string;
+    quantity: number;
+}
+
+interface TradeCurrency {
+    currency: string;
+    amount: number;
+}
+```
+
+### 执行流程
+
+TradeOperation 内部会生成以下子操作序列：
+
+```
+1. 移除 partyA 的物品
+2. 添加 partyB 的物品（来自 partyA）
+3. 扣除 partyA 的货币
+4. 增加 partyB 的货币（来自 partyA）
+5. 移除 partyB 的物品
+6. 添加 partyA 的物品（来自 partyB）
+7. 扣除 partyB 的货币
+8. 增加 partyA 的货币（来自 partyB）
+```
+
+任何一步失败都会回滚之前的所有操作。
+
+### 使用自定义提供者
+
+```typescript
+const op = new TradeOperation({ ... });
+op.setProvider({
+    currencyProvider: new MyCurrencyProvider(),
+    inventoryProvider: new MyInventoryProvider(),
+});
+tx.addOperation(op);
+```
+
+## 创建工厂函数
+
+每个操作类都提供工厂函数：
+
+```typescript
+import {
+    createCurrencyOperation,
+    createInventoryOperation,
+    createTradeOperation,
+} from '@esengine/transaction';
+
+tx.addOperation(createCurrencyOperation({
+    type: 'deduct',
+    playerId: 'player1',
+    currency: 'gold',
+    amount: 100,
+}));
+
+tx.addOperation(createInventoryOperation({
+    type: 'add',
+    playerId: 'player1',
+    itemId: 'sword',
+    quantity: 1,
+}));
+```

docs/src/content/docs/modules/transaction/storage.md

@@ -0,0 +1,234 @@
+---
+title: "存储层"
+description: "事务存储接口和实现：MemoryStorage、RedisStorage、MongoStorage"
+---
+
+## 存储接口
+
+所有存储实现都需要实现 `ITransactionStorage` 接口：
+
+```typescript
+interface ITransactionStorage {
+    // 生命周期
+    close?(): Promise<void>;
+
+    // 分布式锁
+    acquireLock(key: string, ttl: number): Promise<string | null>;
+    releaseLock(key: string, token: string): Promise<boolean>;
+
+    // 事务日志
+    saveTransaction(tx: TransactionLog): Promise<void>;
+    getTransaction(id: string): Promise<TransactionLog | null>;
+    updateTransactionState(id: string, state: TransactionState): Promise<void>;
+    updateOperationState(txId: string, opIndex: number, state: string, error?: string): Promise<void>;
+    getPendingTransactions(serverId?: string): Promise<TransactionLog[]>;
+    deleteTransaction(id: string): Promise<void>;
+
+    // 数据操作
+    get<T>(key: string): Promise<T | null>;
+    set<T>(key: string, value: T, ttl?: number): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+```
+
+## MemoryStorage
+
+内存存储，适用于开发和测试环境。
+
+```typescript
+import { MemoryStorage } from '@esengine/transaction';
+
+const storage = new MemoryStorage({
+    maxTransactions: 1000,  // 最大事务日志数量
+});
+
+const manager = new TransactionManager({ storage });
+```
+
+### 特点
+
+- ✅ 无需外部依赖
+- ✅ 快速，适合开发调试
+- ❌ 数据仅保存在内存中
+- ❌ 不支持真正的分布式锁
+- ❌ 服务重启后数据丢失
+
+### 测试辅助
+
+```typescript
+// 清空所有数据
+storage.clear();
+
+// 获取事务数量
+console.log(storage.transactionCount);
+```
+
+## RedisStorage
+
+Redis 存储，适用于生产环境的分布式系统。使用工厂模式实现惰性连接。
+
+```typescript
+import Redis from 'ioredis';
+import { RedisStorage } from '@esengine/transaction';
+
+// 工厂模式：惰性连接，首次操作时才创建连接
+const storage = new RedisStorage({
+    factory: () => new Redis('redis://localhost:6379'),
+    prefix: 'tx:',              // 键前缀
+    transactionTTL: 86400,      // 事务日志过期时间（秒）
+});
+
+const manager = new TransactionManager({ storage });
+
+// 使用后关闭连接
+await storage.close();
+
+// 或使用 await using 自动关闭 (TypeScript 5.2+)
+await using storage = new RedisStorage({
+    factory: () => new Redis('redis://localhost:6379')
+});
+// 作用域结束时自动关闭
+```
+
+### 特点
+
+- ✅ 高性能分布式锁
+- ✅ 快速读写
+- ✅ 支持 TTL 自动过期
+- ✅ 适合高并发场景
+- ❌ 需要 Redis 服务器
+
+### 分布式锁实现
+
+使用 Redis `SET NX EX` 实现分布式锁：
+
+```typescript
+// 获取锁（原子操作）
+SET tx:lock:player:123 <token> NX EX 10
+
+// 释放锁（Lua 脚本保证原子性）
+if redis.call("get", KEYS[1]) == ARGV[1] then
+    return redis.call("del", KEYS[1])
+else
+    return 0
+end
+```
+
+### 键结构
+
+```
+tx:lock:{key}           - 分布式锁
+tx:tx:{id}              - 事务日志
+tx:server:{id}:txs      - 服务器事务索引
+tx:data:{key}           - 业务数据
+```
+
+## MongoStorage
+
+MongoDB 存储，适用于需要持久化和复杂查询的场景。使用工厂模式实现惰性连接。
+
+```typescript
+import { MongoClient } from 'mongodb';
+import { MongoStorage } from '@esengine/transaction';
+
+// 工厂模式：惰性连接，首次操作时才创建连接
+const storage = new MongoStorage({
+    factory: async () => {
+        const client = new MongoClient('mongodb://localhost:27017');
+        await client.connect();
+        return client;
+    },
+    database: 'game',
+    transactionCollection: 'transactions',  // 事务日志集合
+    dataCollection: 'transaction_data',     // 业务数据集合
+    lockCollection: 'transaction_locks',    // 锁集合
+});
+
+// 创建索引（首次运行时执行）
+await storage.ensureIndexes();
+
+const manager = new TransactionManager({ storage });
+
+// 使用后关闭连接
+await storage.close();
+
+// 或使用 await using 自动关闭 (TypeScript 5.2+)
+await using storage = new MongoStorage({ ... });
+```
+
+### 特点
+
+- ✅ 持久化存储
+- ✅ 支持复杂查询
+- ✅ 事务日志可追溯
+- ✅ 适合需要审计的场景
+- ❌ 相比 Redis 性能略低
+- ❌ 需要 MongoDB 服务器
+
+### 索引结构
+
+```javascript
+// transactions 集合
+{ state: 1 }
+{ 'metadata.serverId': 1 }
+{ createdAt: 1 }
+
+// transaction_locks 集合
+{ expireAt: 1 }  // TTL 索引
+
+// transaction_data 集合
+{ expireAt: 1 }  // TTL 索引
+```
+
+### 分布式锁实现
+
+使用 MongoDB 唯一索引实现分布式锁：
+
+```typescript
+// 获取锁
+db.transaction_locks.insertOne({
+    _id: 'player:123',
+    token: '<token>',
+    expireAt: new Date(Date.now() + 10000)
+});
+
+// 如果键已存在，检查是否过期
+db.transaction_locks.updateOne(
+    { _id: 'player:123', expireAt: { $lt: new Date() } },
+    { $set: { token: '<token>', expireAt: new Date(Date.now() + 10000) } }
+);
+```
+
+## 存储选择指南
+
+| 场景 | 推荐存储 | 理由 |
+|------|----------|------|
+| 开发/测试 | MemoryStorage | 无依赖，快速启动 |
+| 单机生产 | RedisStorage | 高性能，简单 |
+| 分布式系统 | RedisStorage | 真正的分布式锁 |
+| 需要审计 | MongoStorage | 持久化日志 |
+| 混合需求 | Redis + Mongo | Redis 做锁，Mongo 做日志 |
+
+## 自定义存储
+
+实现 `ITransactionStorage` 接口创建自定义存储：
+
+```typescript
+import { ITransactionStorage, TransactionLog, TransactionState } from '@esengine/transaction';
+
+class MyCustomStorage implements ITransactionStorage {
+    async acquireLock(key: string, ttl: number): Promise<string | null> {
+        // 实现分布式锁获取逻辑
+    }
+
+    async releaseLock(key: string, token: string): Promise<boolean> {
+        // 实现分布式锁释放逻辑
+    }
+
+    async saveTransaction(tx: TransactionLog): Promise<void> {
+        // 保存事务日志
+    }
+
+    // ... 实现其他方法
+}
+```

packages/framework/pathfinding/__tests__/core/AStarPathfinder.test.ts

@@ -0,0 +1,247 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { AStarPathfinder } from '../../src/core/AStarPathfinder';
+import { GridMap } from '../../src/grid/GridMap';
+
+describe('AStarPathfinder', () => {
+    let grid: GridMap;
+    let pathfinder: AStarPathfinder;
+
+    beforeEach(() => {
+        grid = new GridMap(10, 10);
+        pathfinder = new AStarPathfinder(grid);
+    });
+
+    // =========================================================================
+    // Basic Pathfinding
+    // =========================================================================
+
+    describe('basic pathfinding', () => {
+        it('should find path between adjacent nodes', () => {
+            const result = pathfinder.findPath(0, 0, 1, 0);
+            expect(result.found).toBe(true);
+            expect(result.path.length).toBe(2);
+            expect(result.path[0]).toEqual({ x: 0, y: 0 });
+            expect(result.path[1]).toEqual({ x: 1, y: 0 });
+        });
+
+        it('should return start position for same start and end', () => {
+            const result = pathfinder.findPath(5, 5, 5, 5);
+            expect(result.found).toBe(true);
+            expect(result.path.length).toBe(1);
+            expect(result.path[0]).toEqual({ x: 5, y: 5 });
+            expect(result.cost).toBe(0);
+        });
+
+        it('should find diagonal path', () => {
+            const result = pathfinder.findPath(0, 0, 5, 5);
+            expect(result.found).toBe(true);
+            expect(result.path.length).toBeGreaterThan(1);
+            expect(result.path[0]).toEqual({ x: 0, y: 0 });
+            expect(result.path[result.path.length - 1]).toEqual({ x: 5, y: 5 });
+        });
+
+        it('should find path across grid', () => {
+            const result = pathfinder.findPath(0, 0, 9, 9);
+            expect(result.found).toBe(true);
+            expect(result.path[0]).toEqual({ x: 0, y: 0 });
+            expect(result.path[result.path.length - 1]).toEqual({ x: 9, y: 9 });
+        });
+    });
+
+    // =========================================================================
+    // Obstacles
+    // =========================================================================
+
+    describe('obstacles', () => {
+        it('should find path around single obstacle', () => {
+            grid.setWalkable(5, 5, false);
+            const result = pathfinder.findPath(4, 5, 6, 5);
+            expect(result.found).toBe(true);
+            expect(result.path.length).toBeGreaterThan(2);
+        });
+
+        it('should find path around wall', () => {
+            // Create vertical wall
+            for (let y = 2; y <= 7; y++) {
+                grid.setWalkable(5, y, false);
+            }
+
+            const result = pathfinder.findPath(3, 5, 7, 5);
+            expect(result.found).toBe(true);
+            // Path should go around the wall
+            expect(result.path.every(p => p.x !== 5 || p.y < 2 || p.y > 7)).toBe(true);
+        });
+
+        it('should return empty path when blocked', () => {
+            // Block completely around start
+            grid.setWalkable(1, 0, false);
+            grid.setWalkable(0, 1, false);
+            grid.setWalkable(1, 1, false);
+
+            const result = pathfinder.findPath(0, 0, 9, 9);
+            expect(result.found).toBe(false);
+            expect(result.path.length).toBe(0);
+        });
+
+        it('should return empty path when start is blocked', () => {
+            grid.setWalkable(0, 0, false);
+            const result = pathfinder.findPath(0, 0, 5, 5);
+            expect(result.found).toBe(false);
+        });
+
+        it('should return empty path when end is blocked', () => {
+            grid.setWalkable(5, 5, false);
+            const result = pathfinder.findPath(0, 0, 5, 5);
+            expect(result.found).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // Out of Bounds
+    // =========================================================================
+
+    describe('out of bounds', () => {
+        it('should return empty path for out of bounds start', () => {
+            const result = pathfinder.findPath(-1, 0, 5, 5);
+            expect(result.found).toBe(false);
+        });
+
+        it('should return empty path for out of bounds end', () => {
+            const result = pathfinder.findPath(0, 0, 100, 100);
+            expect(result.found).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // Cost Calculation
+    // =========================================================================
+
+    describe('cost calculation', () => {
+        it('should calculate correct cost for straight path', () => {
+            const grid4 = new GridMap(10, 10, { allowDiagonal: false });
+            const pathfinder4 = new AStarPathfinder(grid4);
+
+            const result = pathfinder4.findPath(0, 0, 5, 0);
+            expect(result.found).toBe(true);
+            expect(result.cost).toBe(5);
+        });
+
+        it('should prefer lower cost paths', () => {
+            // Create high cost area
+            for (let y = 0; y < 10; y++) {
+                grid.setCost(5, y, 10);
+            }
+
+            const result = pathfinder.findPath(4, 5, 6, 5);
+            // Should go around the high cost column if possible
+            expect(result.found).toBe(true);
+        });
+    });
+
+    // =========================================================================
+    // Options
+    // =========================================================================
+
+    describe('options', () => {
+        it('should respect maxNodes limit', () => {
+            // Large grid with path
+            const largeGrid = new GridMap(100, 100);
+            const largePF = new AStarPathfinder(largeGrid);
+
+            const result = largePF.findPath(0, 0, 99, 99, { maxNodes: 10 });
+            // Should fail due to node limit
+            expect(result.nodesSearched).toBeLessThanOrEqual(10);
+        });
+
+        it('should use heuristic weight', () => {
+            const result1 = pathfinder.findPath(0, 0, 9, 9, { heuristicWeight: 1.0 });
+            const result2 = pathfinder.findPath(0, 0, 9, 9, { heuristicWeight: 2.0 });
+
+            expect(result1.found).toBe(true);
+            expect(result2.found).toBe(true);
+            // Higher weight may search fewer nodes but may not be optimal
+            expect(result2.nodesSearched).toBeLessThanOrEqual(result1.nodesSearched);
+        });
+    });
+
+    // =========================================================================
+    // Clear
+    // =========================================================================
+
+    describe('clear', () => {
+        it('should allow reuse after clear', () => {
+            const result1 = pathfinder.findPath(0, 0, 5, 5);
+            expect(result1.found).toBe(true);
+
+            pathfinder.clear();
+
+            const result2 = pathfinder.findPath(0, 0, 9, 9);
+            expect(result2.found).toBe(true);
+        });
+    });
+
+    // =========================================================================
+    // Maze
+    // =========================================================================
+
+    describe('maze solving', () => {
+        it('should solve simple maze', () => {
+            const mazeStr = `
+..........
+.########.
+..........
+.########.
+..........
+.########.
+..........
+.########.
+..........
+..........`.trim();
+
+            grid.loadFromString(mazeStr);
+
+            const result = pathfinder.findPath(0, 0, 9, 9);
+            expect(result.found).toBe(true);
+            // Path should not pass through walls
+            for (const point of result.path) {
+                expect(grid.isWalkable(point.x, point.y)).toBe(true);
+            }
+        });
+    });
+
+    // =========================================================================
+    // Path Quality
+    // =========================================================================
+
+    describe('path quality', () => {
+        it('should find shortest path in open area', () => {
+            const result = pathfinder.findPath(0, 0, 3, 0);
+            expect(result.found).toBe(true);
+            // Straight line should be 4 points
+            expect(result.path.length).toBe(4);
+        });
+
+        it('should find optimal diagonal path', () => {
+            const result = pathfinder.findPath(0, 0, 3, 3);
+            expect(result.found).toBe(true);
+            // Pure diagonal should be 4 points
+            expect(result.path.length).toBe(4);
+        });
+    });
+
+    // =========================================================================
+    // Nodes Searched
+    // =========================================================================
+
+    describe('nodesSearched', () => {
+        it('should track nodes searched', () => {
+            const result = pathfinder.findPath(0, 0, 9, 9);
+            expect(result.nodesSearched).toBeGreaterThan(0);
+        });
+
+        it('should search only 1 node for same position', () => {
+            const result = pathfinder.findPath(5, 5, 5, 5);
+            expect(result.nodesSearched).toBe(1);
+        });
+    });
+});

packages/framework/pathfinding/__tests__/core/BinaryHeap.test.ts

@@ -0,0 +1,228 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { BinaryHeap } from '../../src/core/BinaryHeap';
+
+describe('BinaryHeap', () => {
+    let heap: BinaryHeap<number>;
+
+    beforeEach(() => {
+        heap = new BinaryHeap<number>((a, b) => a - b);
+    });
+
+    // =========================================================================
+    // Basic Operations
+    // =========================================================================
+
+    describe('basic operations', () => {
+        it('should start empty', () => {
+            expect(heap.isEmpty).toBe(true);
+            expect(heap.size).toBe(0);
+        });
+
+        it('should push and pop single element', () => {
+            heap.push(5);
+            expect(heap.isEmpty).toBe(false);
+            expect(heap.size).toBe(1);
+            expect(heap.pop()).toBe(5);
+            expect(heap.isEmpty).toBe(true);
+        });
+
+        it('should return undefined when popping empty heap', () => {
+            expect(heap.pop()).toBeUndefined();
+        });
+
+        it('should peek without removing', () => {
+            heap.push(5);
+            expect(heap.peek()).toBe(5);
+            expect(heap.size).toBe(1);
+        });
+
+        it('should return undefined when peeking empty heap', () => {
+            expect(heap.peek()).toBeUndefined();
+        });
+    });
+
+    // =========================================================================
+    // Min-Heap Property
+    // =========================================================================
+
+    describe('min-heap property', () => {
+        it('should always pop minimum element', () => {
+            heap.push(5);
+            heap.push(3);
+            heap.push(7);
+            heap.push(1);
+            heap.push(9);
+
+            expect(heap.pop()).toBe(1);
+            expect(heap.pop()).toBe(3);
+            expect(heap.pop()).toBe(5);
+            expect(heap.pop()).toBe(7);
+            expect(heap.pop()).toBe(9);
+        });
+
+        it('should handle duplicate values', () => {
+            heap.push(3);
+            heap.push(3);
+            heap.push(3);
+
+            expect(heap.pop()).toBe(3);
+            expect(heap.pop()).toBe(3);
+            expect(heap.pop()).toBe(3);
+            expect(heap.isEmpty).toBe(true);
+        });
+
+        it('should handle already sorted input', () => {
+            heap.push(1);
+            heap.push(2);
+            heap.push(3);
+            heap.push(4);
+            heap.push(5);
+
+            expect(heap.pop()).toBe(1);
+            expect(heap.pop()).toBe(2);
+            expect(heap.pop()).toBe(3);
+            expect(heap.pop()).toBe(4);
+            expect(heap.pop()).toBe(5);
+        });
+
+        it('should handle reverse sorted input', () => {
+            heap.push(5);
+            heap.push(4);
+            heap.push(3);
+            heap.push(2);
+            heap.push(1);
+
+            expect(heap.pop()).toBe(1);
+            expect(heap.pop()).toBe(2);
+            expect(heap.pop()).toBe(3);
+            expect(heap.pop()).toBe(4);
+            expect(heap.pop()).toBe(5);
+        });
+    });
+
+    // =========================================================================
+    // Update Operation
+    // =========================================================================
+
+    describe('update operation', () => {
+        it('should update element position after value change', () => {
+            interface Item { value: number }
+            const itemHeap = new BinaryHeap<Item>((a, b) => a.value - b.value);
+
+            const item1 = { value: 5 };
+            const item2 = { value: 3 };
+            const item3 = { value: 7 };
+
+            itemHeap.push(item1);
+            itemHeap.push(item2);
+            itemHeap.push(item3);
+
+            // Change item1 to be smallest
+            item1.value = 1;
+            itemHeap.update(item1);
+
+            expect(itemHeap.pop()).toBe(item1);
+            expect(itemHeap.pop()).toBe(item2);
+            expect(itemHeap.pop()).toBe(item3);
+        });
+
+        it('should handle update of non-existent element gracefully', () => {
+            heap.push(1);
+            heap.push(2);
+            heap.update(999); // Should not throw
+            expect(heap.size).toBe(2);
+        });
+    });
+
+    // =========================================================================
+    // Contains Operation
+    // =========================================================================
+
+    describe('contains operation', () => {
+        it('should check if element exists', () => {
+            heap.push(1);
+            heap.push(2);
+            heap.push(3);
+
+            expect(heap.contains(2)).toBe(true);
+            expect(heap.contains(5)).toBe(false);
+        });
+
+        it('should return false for empty heap', () => {
+            expect(heap.contains(1)).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // Clear Operation
+    // =========================================================================
+
+    describe('clear operation', () => {
+        it('should clear all elements', () => {
+            heap.push(1);
+            heap.push(2);
+            heap.push(3);
+
+            heap.clear();
+
+            expect(heap.isEmpty).toBe(true);
+            expect(heap.size).toBe(0);
+        });
+    });
+
+    // =========================================================================
+    // Custom Comparator
+    // =========================================================================
+
+    describe('custom comparator', () => {
+        it('should work as max-heap with reversed comparator', () => {
+            const maxHeap = new BinaryHeap<number>((a, b) => b - a);
+
+            maxHeap.push(5);
+            maxHeap.push(3);
+            maxHeap.push(7);
+            maxHeap.push(1);
+            maxHeap.push(9);
+
+            expect(maxHeap.pop()).toBe(9);
+            expect(maxHeap.pop()).toBe(7);
+            expect(maxHeap.pop()).toBe(5);
+            expect(maxHeap.pop()).toBe(3);
+            expect(maxHeap.pop()).toBe(1);
+        });
+
+        it('should work with object comparator', () => {
+            interface Task { priority: number; name: string }
+            const taskHeap = new BinaryHeap<Task>((a, b) => a.priority - b.priority);
+
+            taskHeap.push({ priority: 3, name: 'C' });
+            taskHeap.push({ priority: 1, name: 'A' });
+            taskHeap.push({ priority: 2, name: 'B' });
+
+            expect(taskHeap.pop()?.name).toBe('A');
+            expect(taskHeap.pop()?.name).toBe('B');
+            expect(taskHeap.pop()?.name).toBe('C');
+        });
+    });
+
+    // =========================================================================
+    // Large Dataset
+    // =========================================================================
+
+    describe('large dataset', () => {
+        it('should handle 1000 random elements', () => {
+            const elements: number[] = [];
+            for (let i = 0; i < 1000; i++) {
+                const value = Math.floor(Math.random() * 10000);
+                elements.push(value);
+                heap.push(value);
+            }
+
+            elements.sort((a, b) => a - b);
+
+            for (const expected of elements) {
+                expect(heap.pop()).toBe(expected);
+            }
+        });
+    });
+});

packages/framework/pathfinding/__tests__/core/Heuristics.test.ts

@@ -0,0 +1,219 @@
+import { describe, it, expect } from 'vitest';
+import {
+    manhattanDistance,
+    euclideanDistance,
+    chebyshevDistance,
+    octileDistance,
+    createPoint
+} from '../../src/core/IPathfinding';
+
+describe('Heuristic Functions', () => {
+    // =========================================================================
+    // Manhattan Distance
+    // =========================================================================
+
+    describe('manhattanDistance', () => {
+        it('should return 0 for same point', () => {
+            const p = createPoint(5, 5);
+            expect(manhattanDistance(p, p)).toBe(0);
+        });
+
+        it('should calculate horizontal distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(5, 0);
+            expect(manhattanDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate vertical distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(0, 5);
+            expect(manhattanDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate diagonal distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(3, 4);
+            expect(manhattanDistance(a, b)).toBe(7); // |3| + |4| = 7
+        });
+
+        it('should handle negative coordinates', () => {
+            const a = createPoint(-2, -3);
+            const b = createPoint(2, 3);
+            expect(manhattanDistance(a, b)).toBe(10); // |4| + |6| = 10
+        });
+
+        it('should be symmetric', () => {
+            const a = createPoint(1, 2);
+            const b = createPoint(4, 6);
+            expect(manhattanDistance(a, b)).toBe(manhattanDistance(b, a));
+        });
+    });
+
+    // =========================================================================
+    // Euclidean Distance
+    // =========================================================================
+
+    describe('euclideanDistance', () => {
+        it('should return 0 for same point', () => {
+            const p = createPoint(5, 5);
+            expect(euclideanDistance(p, p)).toBe(0);
+        });
+
+        it('should calculate horizontal distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(5, 0);
+            expect(euclideanDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate vertical distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(0, 5);
+            expect(euclideanDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate 3-4-5 triangle', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(3, 4);
+            expect(euclideanDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate diagonal distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(1, 1);
+            expect(euclideanDistance(a, b)).toBeCloseTo(Math.SQRT2, 10);
+        });
+
+        it('should handle negative coordinates', () => {
+            const a = createPoint(-3, -4);
+            const b = createPoint(0, 0);
+            expect(euclideanDistance(a, b)).toBe(5);
+        });
+
+        it('should be symmetric', () => {
+            const a = createPoint(1, 2);
+            const b = createPoint(4, 6);
+            expect(euclideanDistance(a, b)).toBeCloseTo(euclideanDistance(b, a), 10);
+        });
+    });
+
+    // =========================================================================
+    // Chebyshev Distance
+    // =========================================================================
+
+    describe('chebyshevDistance', () => {
+        it('should return 0 for same point', () => {
+            const p = createPoint(5, 5);
+            expect(chebyshevDistance(p, p)).toBe(0);
+        });
+
+        it('should calculate horizontal distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(5, 0);
+            expect(chebyshevDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate vertical distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(0, 5);
+            expect(chebyshevDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate diagonal as max of dx, dy', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(3, 4);
+            expect(chebyshevDistance(a, b)).toBe(4); // max(3, 4) = 4
+        });
+
+        it('should return same value for equal dx and dy', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(5, 5);
+            expect(chebyshevDistance(a, b)).toBe(5);
+        });
+
+        it('should be symmetric', () => {
+            const a = createPoint(1, 2);
+            const b = createPoint(4, 6);
+            expect(chebyshevDistance(a, b)).toBe(chebyshevDistance(b, a));
+        });
+    });
+
+    // =========================================================================
+    // Octile Distance
+    // =========================================================================
+
+    describe('octileDistance', () => {
+        it('should return 0 for same point', () => {
+            const p = createPoint(5, 5);
+            expect(octileDistance(p, p)).toBe(0);
+        });
+
+        it('should calculate horizontal distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(5, 0);
+            expect(octileDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate vertical distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(0, 5);
+            expect(octileDistance(a, b)).toBe(5);
+        });
+
+        it('should calculate pure diagonal distance', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(5, 5);
+            // 5 diagonal moves = 5 * sqrt(2)
+            expect(octileDistance(a, b)).toBeCloseTo(5 * Math.SQRT2, 10);
+        });
+
+        it('should calculate mixed diagonal and straight', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(3, 5);
+            // 3 diagonal + 2 straight = 3*sqrt(2) + 2
+            const expected = 3 * Math.SQRT2 + 2;
+            expect(octileDistance(a, b)).toBeCloseTo(expected, 10);
+        });
+
+        it('should be symmetric', () => {
+            const a = createPoint(1, 2);
+            const b = createPoint(4, 6);
+            expect(octileDistance(a, b)).toBeCloseTo(octileDistance(b, a), 10);
+        });
+
+        it('should be between Manhattan and Euclidean for diagonal', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(3, 4);
+
+            const manhattan = manhattanDistance(a, b);
+            const euclidean = euclideanDistance(a, b);
+            const octile = octileDistance(a, b);
+
+            expect(octile).toBeLessThan(manhattan);
+            expect(octile).toBeGreaterThan(euclidean);
+        });
+    });
+
+    // =========================================================================
+    // createPoint
+    // =========================================================================
+
+    describe('createPoint', () => {
+        it('should create point with correct coordinates', () => {
+            const p = createPoint(3, 4);
+            expect(p.x).toBe(3);
+            expect(p.y).toBe(4);
+        });
+
+        it('should handle negative coordinates', () => {
+            const p = createPoint(-5, -10);
+            expect(p.x).toBe(-5);
+            expect(p.y).toBe(-10);
+        });
+
+        it('should handle decimal coordinates', () => {
+            const p = createPoint(3.5, 4.7);
+            expect(p.x).toBe(3.5);
+            expect(p.y).toBe(4.7);
+        });
+    });
+});

packages/framework/pathfinding/__tests__/grid/GridMap.test.ts

@@ -0,0 +1,346 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { GridMap, GridNode, DIRECTIONS_4, DIRECTIONS_8 } from '../../src/grid/GridMap';
+
+describe('GridMap', () => {
+    let grid: GridMap;
+
+    beforeEach(() => {
+        grid = new GridMap(10, 10);
+    });
+
+    // =========================================================================
+    // Construction
+    // =========================================================================
+
+    describe('construction', () => {
+        it('should create grid with correct dimensions', () => {
+            expect(grid.width).toBe(10);
+            expect(grid.height).toBe(10);
+        });
+
+        it('should have all nodes walkable by default', () => {
+            for (let y = 0; y < 10; y++) {
+                for (let x = 0; x < 10; x++) {
+                    expect(grid.isWalkable(x, y)).toBe(true);
+                }
+            }
+        });
+
+        it('should create small grid', () => {
+            const small = new GridMap(1, 1);
+            expect(small.width).toBe(1);
+            expect(small.height).toBe(1);
+            expect(small.getNodeAt(0, 0)).not.toBeNull();
+        });
+    });
+
+    // =========================================================================
+    // Node Access
+    // =========================================================================
+
+    describe('getNodeAt', () => {
+        it('should return node at valid position', () => {
+            const node = grid.getNodeAt(5, 5);
+            expect(node).not.toBeNull();
+            expect(node?.position.x).toBe(5);
+            expect(node?.position.y).toBe(5);
+        });
+
+        it('should return null for out of bounds', () => {
+            expect(grid.getNodeAt(-1, 0)).toBeNull();
+            expect(grid.getNodeAt(0, -1)).toBeNull();
+            expect(grid.getNodeAt(10, 0)).toBeNull();
+            expect(grid.getNodeAt(0, 10)).toBeNull();
+        });
+
+        it('should return node with correct id', () => {
+            const node = grid.getNodeAt(3, 4);
+            expect(node?.id).toBe('3,4');
+        });
+    });
+
+    // =========================================================================
+    // Walkability
+    // =========================================================================
+
+    describe('walkability', () => {
+        it('should set and get walkability', () => {
+            grid.setWalkable(5, 5, false);
+            expect(grid.isWalkable(5, 5)).toBe(false);
+
+            grid.setWalkable(5, 5, true);
+            expect(grid.isWalkable(5, 5)).toBe(true);
+        });
+
+        it('should return false for out of bounds', () => {
+            expect(grid.isWalkable(-1, 0)).toBe(false);
+            expect(grid.isWalkable(100, 100)).toBe(false);
+        });
+
+        it('should handle setWalkable on invalid position gracefully', () => {
+            grid.setWalkable(-1, -1, false); // Should not throw
+        });
+    });
+
+    // =========================================================================
+    // Cost
+    // =========================================================================
+
+    describe('cost', () => {
+        it('should set and get cost', () => {
+            grid.setCost(5, 5, 2.5);
+            const node = grid.getNodeAt(5, 5);
+            expect(node?.cost).toBe(2.5);
+        });
+
+        it('should default cost to 1', () => {
+            const node = grid.getNodeAt(5, 5);
+            expect(node?.cost).toBe(1);
+        });
+    });
+
+    // =========================================================================
+    // Neighbors (8-direction)
+    // =========================================================================
+
+    describe('getNeighbors (8-direction)', () => {
+        it('should return 8 neighbors for center node', () => {
+            const node = grid.getNodeAt(5, 5)!;
+            const neighbors = grid.getNeighbors(node);
+            expect(neighbors.length).toBe(8);
+        });
+
+        it('should return 3 neighbors for corner', () => {
+            const node = grid.getNodeAt(0, 0)!;
+            const neighbors = grid.getNeighbors(node);
+            expect(neighbors.length).toBe(3);
+        });
+
+        it('should return 5 neighbors for edge', () => {
+            const node = grid.getNodeAt(5, 0)!;
+            const neighbors = grid.getNeighbors(node);
+            expect(neighbors.length).toBe(5);
+        });
+
+        it('should not include blocked neighbors', () => {
+            grid.setWalkable(6, 5, false);
+            const node = grid.getNodeAt(5, 5)!;
+            const neighbors = grid.getNeighbors(node);
+            // 8 - 1 blocked - 2 diagonals (corner cutting) = 5
+            expect(neighbors.length).toBe(5);
+            expect(neighbors.find(n => n.x === 6 && n.y === 5)).toBeUndefined();
+        });
+
+        it('should avoid corner cutting by default', () => {
+            // Block horizontal neighbor
+            grid.setWalkable(6, 5, false);
+            const node = grid.getNodeAt(5, 5)!;
+            const neighbors = grid.getNeighbors(node);
+
+            // Should not include diagonal (6,4) and (6,6) due to corner cutting
+            expect(neighbors.find(n => n.x === 6 && n.y === 4)).toBeUndefined();
+            expect(neighbors.find(n => n.x === 6 && n.y === 6)).toBeUndefined();
+        });
+    });
+
+    // =========================================================================
+    // Neighbors (4-direction)
+    // =========================================================================
+
+    describe('getNeighbors (4-direction)', () => {
+        let grid4: GridMap;
+
+        beforeEach(() => {
+            grid4 = new GridMap(10, 10, { allowDiagonal: false });
+        });
+
+        it('should return 4 neighbors for center node', () => {
+            const node = grid4.getNodeAt(5, 5)!;
+            const neighbors = grid4.getNeighbors(node);
+            expect(neighbors.length).toBe(4);
+        });
+
+        it('should return 2 neighbors for corner', () => {
+            const node = grid4.getNodeAt(0, 0)!;
+            const neighbors = grid4.getNeighbors(node);
+            expect(neighbors.length).toBe(2);
+        });
+
+        it('should return 3 neighbors for edge', () => {
+            const node = grid4.getNodeAt(5, 0)!;
+            const neighbors = grid4.getNeighbors(node);
+            expect(neighbors.length).toBe(3);
+        });
+    });
+
+    // =========================================================================
+    // Movement Cost
+    // =========================================================================
+
+    describe('getMovementCost', () => {
+        it('should return 1 for cardinal movement', () => {
+            const from = grid.getNodeAt(5, 5)!;
+            const to = grid.getNodeAt(6, 5)!;
+            expect(grid.getMovementCost(from, to)).toBe(1);
+        });
+
+        it('should return sqrt(2) for diagonal movement', () => {
+            const from = grid.getNodeAt(5, 5)!;
+            const to = grid.getNodeAt(6, 6)!;
+            expect(grid.getMovementCost(from, to)).toBeCloseTo(Math.SQRT2, 10);
+        });
+
+        it('should factor in destination cost', () => {
+            grid.setCost(6, 5, 2);
+            const from = grid.getNodeAt(5, 5)!;
+            const to = grid.getNodeAt(6, 5)!;
+            expect(grid.getMovementCost(from, to)).toBe(2);
+        });
+    });
+
+    // =========================================================================
+    // Load from Array
+    // =========================================================================
+
+    describe('loadFromArray', () => {
+        it('should load walkability from 2D array', () => {
+            const data = [
+                [0, 0, 1],
+                [0, 1, 0],
+                [1, 0, 0]
+            ];
+            const small = new GridMap(3, 3);
+            small.loadFromArray(data);
+
+            expect(small.isWalkable(0, 0)).toBe(true);
+            expect(small.isWalkable(2, 0)).toBe(false);
+            expect(small.isWalkable(1, 1)).toBe(false);
+            expect(small.isWalkable(0, 2)).toBe(false);
+        });
+
+        it('should handle partial data', () => {
+            const data = [[0, 1]];
+            grid.loadFromArray(data);
+            expect(grid.isWalkable(0, 0)).toBe(true);
+            expect(grid.isWalkable(1, 0)).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // Load from String
+    // =========================================================================
+
+    describe('loadFromString', () => {
+        it('should load walkability from string', () => {
+            const mapStr = `
+..#
+.#.
+#..`.trim();
+
+            const small = new GridMap(3, 3);
+            small.loadFromString(mapStr);
+
+            expect(small.isWalkable(0, 0)).toBe(true);
+            expect(small.isWalkable(2, 0)).toBe(false);
+            expect(small.isWalkable(1, 1)).toBe(false);
+            expect(small.isWalkable(0, 2)).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // toString
+    // =========================================================================
+
+    describe('toString', () => {
+        it('should export grid as string', () => {
+            const small = new GridMap(3, 2);
+            small.setWalkable(1, 0, false);
+
+            const expected = '.#.\n...\n';
+            expect(small.toString()).toBe(expected);
+        });
+    });
+
+    // =========================================================================
+    // Reset
+    // =========================================================================
+
+    describe('reset', () => {
+        it('should reset all nodes to walkable', () => {
+            grid.setWalkable(5, 5, false);
+            grid.setCost(3, 3, 5);
+            grid.reset();
+
+            expect(grid.isWalkable(5, 5)).toBe(true);
+            expect(grid.getNodeAt(3, 3)?.cost).toBe(1);
+        });
+    });
+
+    // =========================================================================
+    // setRectWalkable
+    // =========================================================================
+
+    describe('setRectWalkable', () => {
+        it('should set rectangle region walkability', () => {
+            grid.setRectWalkable(2, 2, 3, 3, false);
+
+            for (let y = 2; y < 5; y++) {
+                for (let x = 2; x < 5; x++) {
+                    expect(grid.isWalkable(x, y)).toBe(false);
+                }
+            }
+
+            // Outside should still be walkable
+            expect(grid.isWalkable(1, 2)).toBe(true);
+            expect(grid.isWalkable(5, 2)).toBe(true);
+        });
+    });
+
+    // =========================================================================
+    // Bounds Checking
+    // =========================================================================
+
+    describe('isInBounds', () => {
+        it('should return true for valid coordinates', () => {
+            expect(grid.isInBounds(0, 0)).toBe(true);
+            expect(grid.isInBounds(9, 9)).toBe(true);
+            expect(grid.isInBounds(5, 5)).toBe(true);
+        });
+
+        it('should return false for invalid coordinates', () => {
+            expect(grid.isInBounds(-1, 0)).toBe(false);
+            expect(grid.isInBounds(0, -1)).toBe(false);
+            expect(grid.isInBounds(10, 0)).toBe(false);
+            expect(grid.isInBounds(0, 10)).toBe(false);
+        });
+    });
+});
+
+describe('GridNode', () => {
+    it('should create node with correct properties', () => {
+        const node = new GridNode(3, 4, true, 2);
+        expect(node.x).toBe(3);
+        expect(node.y).toBe(4);
+        expect(node.walkable).toBe(true);
+        expect(node.cost).toBe(2);
+        expect(node.id).toBe('3,4');
+        expect(node.position.x).toBe(3);
+        expect(node.position.y).toBe(4);
+    });
+
+    it('should default to walkable with cost 1', () => {
+        const node = new GridNode(0, 0);
+        expect(node.walkable).toBe(true);
+        expect(node.cost).toBe(1);
+    });
+});
+
+describe('Direction Constants', () => {
+    it('DIRECTIONS_4 should have 4 cardinal directions', () => {
+        expect(DIRECTIONS_4.length).toBe(4);
+    });
+
+    it('DIRECTIONS_8 should have 8 directions', () => {
+        expect(DIRECTIONS_8.length).toBe(8);
+    });
+});

packages/framework/pathfinding/__tests__/navmesh/NavMesh.test.ts

@@ -0,0 +1,386 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { NavMesh, createNavMesh } from '../../src/navmesh/NavMesh';
+import { createPoint } from '../../src/core/IPathfinding';
+
+describe('NavMesh', () => {
+    let navmesh: NavMesh;
+
+    beforeEach(() => {
+        navmesh = new NavMesh();
+    });
+
+    // =========================================================================
+    // Polygon Management
+    // =========================================================================
+
+    describe('polygon management', () => {
+        it('should add polygon and return id', () => {
+            const id = navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+
+            expect(id).toBe(0);
+            expect(navmesh.polygonCount).toBe(1);
+        });
+
+        it('should add multiple polygons with incremental ids', () => {
+            const id1 = navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(5, 10)
+            ]);
+
+            const id2 = navmesh.addPolygon([
+                createPoint(10, 0),
+                createPoint(20, 0),
+                createPoint(15, 10)
+            ]);
+
+            expect(id1).toBe(0);
+            expect(id2).toBe(1);
+            expect(navmesh.polygonCount).toBe(2);
+        });
+
+        it('should get all polygons', () => {
+            navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(5, 10)
+            ]);
+
+            navmesh.addPolygon([
+                createPoint(10, 0),
+                createPoint(20, 0),
+                createPoint(15, 10)
+            ]);
+
+            const polygons = navmesh.getPolygons();
+            expect(polygons.length).toBe(2);
+        });
+
+        it('should clear all polygons', () => {
+            navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(5, 10)
+            ]);
+
+            navmesh.clear();
+            expect(navmesh.polygonCount).toBe(0);
+        });
+    });
+
+    // =========================================================================
+    // Point in Polygon
+    // =========================================================================
+
+    describe('findPolygonAt', () => {
+        beforeEach(() => {
+            // Square from (0,0) to (10,10)
+            navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+        });
+
+        it('should find polygon containing point', () => {
+            const polygon = navmesh.findPolygonAt(5, 5);
+            expect(polygon).not.toBeNull();
+            expect(polygon?.id).toBe(0);
+        });
+
+        it('should return null for point outside', () => {
+            expect(navmesh.findPolygonAt(-1, 5)).toBeNull();
+            expect(navmesh.findPolygonAt(15, 5)).toBeNull();
+        });
+
+        it('should handle point on edge', () => {
+            const polygon = navmesh.findPolygonAt(0, 5);
+            // Edge behavior may vary, but should not crash
+            expect(polygon === null || polygon.id === 0).toBe(true);
+        });
+    });
+
+    // =========================================================================
+    // Walkability
+    // =========================================================================
+
+    describe('isWalkable', () => {
+        beforeEach(() => {
+            navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+        });
+
+        it('should return true for point in polygon', () => {
+            expect(navmesh.isWalkable(5, 5)).toBe(true);
+        });
+
+        it('should return false for point outside', () => {
+            expect(navmesh.isWalkable(15, 5)).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // Connections
+    // =========================================================================
+
+    describe('connections', () => {
+        it('should manually set connection between polygons', () => {
+            // Two adjacent squares
+            const id1 = navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+
+            const id2 = navmesh.addPolygon([
+                createPoint(10, 0),
+                createPoint(20, 0),
+                createPoint(20, 10),
+                createPoint(10, 10)
+            ]);
+
+            navmesh.setConnection(id1, id2, {
+                left: createPoint(10, 0),
+                right: createPoint(10, 10)
+            });
+
+            const polygons = navmesh.getPolygons();
+            const poly1 = polygons.find(p => p.id === id1);
+
+            expect(poly1?.neighbors).toContain(id2);
+        });
+
+        it('should auto-detect shared edges with build()', () => {
+            // Two adjacent squares sharing edge at x=10
+            navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+
+            navmesh.addPolygon([
+                createPoint(10, 0),
+                createPoint(20, 0),
+                createPoint(20, 10),
+                createPoint(10, 10)
+            ]);
+
+            navmesh.build();
+
+            const polygons = navmesh.getPolygons();
+            expect(polygons[0].neighbors).toContain(1);
+            expect(polygons[1].neighbors).toContain(0);
+        });
+    });
+
+    // =========================================================================
+    // Pathfinding
+    // =========================================================================
+
+    describe('findPath', () => {
+        beforeEach(() => {
+            // Create 3 connected squares
+            navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+
+            navmesh.addPolygon([
+                createPoint(10, 0),
+                createPoint(20, 0),
+                createPoint(20, 10),
+                createPoint(10, 10)
+            ]);
+
+            navmesh.addPolygon([
+                createPoint(20, 0),
+                createPoint(30, 0),
+                createPoint(30, 10),
+                createPoint(20, 10)
+            ]);
+
+            navmesh.build();
+        });
+
+        it('should find path within same polygon', () => {
+            const result = navmesh.findPath(1, 1, 8, 8);
+            expect(result.found).toBe(true);
+            expect(result.path.length).toBe(2);
+            expect(result.path[0]).toEqual(createPoint(1, 1));
+            expect(result.path[1]).toEqual(createPoint(8, 8));
+        });
+
+        it('should find path across polygons', () => {
+            const result = navmesh.findPath(5, 5, 25, 5);
+            expect(result.found).toBe(true);
+            expect(result.path.length).toBeGreaterThanOrEqual(2);
+            expect(result.path[0]).toEqual(createPoint(5, 5));
+            expect(result.path[result.path.length - 1]).toEqual(createPoint(25, 5));
+        });
+
+        it('should return empty path when start is outside', () => {
+            const result = navmesh.findPath(-5, 5, 15, 5);
+            expect(result.found).toBe(false);
+        });
+
+        it('should return empty path when end is outside', () => {
+            const result = navmesh.findPath(5, 5, 50, 5);
+            expect(result.found).toBe(false);
+        });
+
+        it('should calculate path cost', () => {
+            const result = navmesh.findPath(5, 5, 25, 5);
+            expect(result.found).toBe(true);
+            expect(result.cost).toBeGreaterThan(0);
+        });
+
+        it('should track nodes searched', () => {
+            const result = navmesh.findPath(5, 5, 25, 5);
+            expect(result.nodesSearched).toBeGreaterThan(0);
+        });
+    });
+
+    // =========================================================================
+    // IPathfindingMap Interface
+    // =========================================================================
+
+    describe('IPathfindingMap interface', () => {
+        beforeEach(() => {
+            // Two adjacent squares with shared edge at x=10
+            const id1 = navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+
+            const id2 = navmesh.addPolygon([
+                createPoint(10, 0),
+                createPoint(20, 0),
+                createPoint(20, 10),
+                createPoint(10, 10)
+            ]);
+
+            // Manual connection to ensure proper setup
+            navmesh.setConnection(id1, id2, {
+                left: createPoint(10, 0),
+                right: createPoint(10, 10)
+            });
+        });
+
+        it('should return node at position', () => {
+            const node = navmesh.getNodeAt(5, 5);
+            expect(node).not.toBeNull();
+            expect(node?.id).toBe(0);
+        });
+
+        it('should return null for position outside', () => {
+            const node = navmesh.getNodeAt(50, 50);
+            expect(node).toBeNull();
+        });
+
+        it('should get neighbors from polygon directly', () => {
+            // NavMeshNode holds a reference to the original polygon,
+            // so we check via the polygons map which is updated by setConnection
+            const polygons = navmesh.getPolygons();
+            const poly0 = polygons.find(p => p.id === 0);
+            expect(poly0).toBeDefined();
+            expect(poly0!.neighbors).toContain(1);
+        });
+
+        it('should calculate heuristic', () => {
+            const a = createPoint(0, 0);
+            const b = createPoint(3, 4);
+            expect(navmesh.heuristic(a, b)).toBe(5); // Euclidean
+        });
+
+        it('should calculate movement cost', () => {
+            const node1 = navmesh.getNodeAt(5, 5)!;
+            const node2 = navmesh.getNodeAt(15, 5)!;
+            const cost = navmesh.getMovementCost(node1, node2);
+            expect(cost).toBeGreaterThan(0);
+        });
+    });
+
+    // =========================================================================
+    // Complex Scenarios
+    // =========================================================================
+
+    describe('complex scenarios', () => {
+        it('should handle L-shaped navmesh with manual connections', () => {
+            // Horizontal part
+            const id1 = navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(30, 0),
+                createPoint(30, 10),
+                createPoint(0, 10)
+            ]);
+
+            // Vertical part (shares partial edge, needs manual connection)
+            const id2 = navmesh.addPolygon([
+                createPoint(0, 10),
+                createPoint(10, 10),
+                createPoint(10, 30),
+                createPoint(0, 30)
+            ]);
+
+            // Manual connection since edges don't match exactly
+            navmesh.setConnection(id1, id2, {
+                left: createPoint(0, 10),
+                right: createPoint(10, 10)
+            });
+
+            const result = navmesh.findPath(25, 5, 5, 25);
+            expect(result.found).toBe(true);
+        });
+
+        it('should handle disconnected areas', () => {
+            // Area 1
+            navmesh.addPolygon([
+                createPoint(0, 0),
+                createPoint(10, 0),
+                createPoint(10, 10),
+                createPoint(0, 10)
+            ]);
+
+            // Area 2 (disconnected)
+            navmesh.addPolygon([
+                createPoint(50, 50),
+                createPoint(60, 50),
+                createPoint(60, 60),
+                createPoint(50, 60)
+            ]);
+
+            navmesh.build();
+
+            const result = navmesh.findPath(5, 5, 55, 55);
+            expect(result.found).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // Factory Function
+    // =========================================================================
+
+    describe('createNavMesh', () => {
+        it('should create empty navmesh', () => {
+            const nm = createNavMesh();
+            expect(nm).toBeInstanceOf(NavMesh);
+            expect(nm.polygonCount).toBe(0);
+        });
+    });
+});

packages/framework/pathfinding/__tests__/smoothing/PathSmoother.test.ts

@@ -0,0 +1,288 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+    bresenhamLineOfSight,
+    raycastLineOfSight,
+    LineOfSightSmoother,
+    CatmullRomSmoother,
+    CombinedSmoother
+} from '../../src/smoothing/PathSmoother';
+import { GridMap } from '../../src/grid/GridMap';
+import { createPoint, type IPoint } from '../../src/core/IPathfinding';
+
+describe('Line of Sight Functions', () => {
+    let grid: GridMap;
+
+    beforeEach(() => {
+        grid = new GridMap(10, 10);
+    });
+
+    // =========================================================================
+    // bresenhamLineOfSight
+    // =========================================================================
+
+    describe('bresenhamLineOfSight', () => {
+        it('should return true for clear line', () => {
+            expect(bresenhamLineOfSight(0, 0, 5, 5, grid)).toBe(true);
+        });
+
+        it('should return true for same point', () => {
+            expect(bresenhamLineOfSight(5, 5, 5, 5, grid)).toBe(true);
+        });
+
+        it('should return true for horizontal line', () => {
+            expect(bresenhamLineOfSight(0, 5, 9, 5, grid)).toBe(true);
+        });
+
+        it('should return true for vertical line', () => {
+            expect(bresenhamLineOfSight(5, 0, 5, 9, grid)).toBe(true);
+        });
+
+        it('should return false when blocked', () => {
+            grid.setWalkable(5, 5, false);
+            expect(bresenhamLineOfSight(0, 0, 9, 9, grid)).toBe(false);
+        });
+
+        it('should return false when start is blocked', () => {
+            grid.setWalkable(0, 0, false);
+            expect(bresenhamLineOfSight(0, 0, 5, 5, grid)).toBe(false);
+        });
+
+        it('should return false when end is blocked', () => {
+            grid.setWalkable(5, 5, false);
+            expect(bresenhamLineOfSight(0, 0, 5, 5, grid)).toBe(false);
+        });
+
+        it('should detect obstacle in middle', () => {
+            grid.setWalkable(3, 3, false);
+            expect(bresenhamLineOfSight(0, 0, 6, 6, grid)).toBe(false);
+        });
+    });
+
+    // =========================================================================
+    // raycastLineOfSight
+    // =========================================================================
+
+    describe('raycastLineOfSight', () => {
+        it('should return true for clear line', () => {
+            expect(raycastLineOfSight(0, 0, 5, 5, grid)).toBe(true);
+        });
+
+        it('should return true for same point', () => {
+            expect(raycastLineOfSight(5, 5, 5, 5, grid)).toBe(true);
+        });
+
+        it('should return false when blocked', () => {
+            grid.setWalkable(5, 5, false);
+            expect(raycastLineOfSight(0, 0, 9, 9, grid)).toBe(false);
+        });
+
+        it('should work with custom step size', () => {
+            expect(raycastLineOfSight(0, 0, 5, 5, grid, 0.1)).toBe(true);
+            grid.setWalkable(2, 2, false);
+            expect(raycastLineOfSight(0, 0, 5, 5, grid, 0.1)).toBe(false);
+        });
+    });
+});
+
+describe('LineOfSightSmoother', () => {
+    let grid: GridMap;
+    let smoother: LineOfSightSmoother;
+
+    beforeEach(() => {
+        grid = new GridMap(20, 20);
+        smoother = new LineOfSightSmoother();
+    });
+
+    it('should return same path for 2 or fewer points', () => {
+        const path1: IPoint[] = [createPoint(0, 0)];
+        expect(smoother.smooth(path1, grid)).toEqual(path1);
+
+        const path2: IPoint[] = [createPoint(0, 0), createPoint(5, 5)];
+        expect(smoother.smooth(path2, grid)).toEqual(path2);
+    });
+
+    it('should remove unnecessary waypoints on straight line', () => {
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(1, 0),
+            createPoint(2, 0),
+            createPoint(3, 0),
+            createPoint(4, 0),
+            createPoint(5, 0)
+        ];
+
+        const result = smoother.smooth(path, grid);
+        expect(result.length).toBe(2);
+        expect(result[0]).toEqual(createPoint(0, 0));
+        expect(result[1]).toEqual(createPoint(5, 0));
+    });
+
+    it('should remove unnecessary waypoints on diagonal', () => {
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(1, 1),
+            createPoint(2, 2),
+            createPoint(3, 3),
+            createPoint(4, 4),
+            createPoint(5, 5)
+        ];
+
+        const result = smoother.smooth(path, grid);
+        expect(result.length).toBe(2);
+        expect(result[0]).toEqual(createPoint(0, 0));
+        expect(result[1]).toEqual(createPoint(5, 5));
+    });
+
+    it('should keep waypoints around obstacles', () => {
+        // Create obstacle
+        grid.setWalkable(5, 5, false);
+
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(4, 5),
+            createPoint(6, 5),
+            createPoint(10, 10)
+        ];
+
+        const result = smoother.smooth(path, grid);
+        // Should keep at least start, one waypoint near obstacle, and end
+        expect(result.length).toBeGreaterThanOrEqual(3);
+    });
+
+    it('should use custom line of sight function', () => {
+        const customLOS = (x1: number, y1: number, x2: number, y2: number) => {
+            // Always blocked
+            return false;
+        };
+
+        const customSmoother = new LineOfSightSmoother(customLOS);
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(1, 1),
+            createPoint(2, 2)
+        ];
+
+        const result = customSmoother.smooth(path, grid);
+        // Should not simplify because LOS always fails
+        expect(result).toEqual(path);
+    });
+});
+
+describe('CatmullRomSmoother', () => {
+    let grid: GridMap;
+    let smoother: CatmullRomSmoother;
+
+    beforeEach(() => {
+        grid = new GridMap(20, 20);
+        smoother = new CatmullRomSmoother(5, 0.5);
+    });
+
+    it('should return same path for 2 or fewer points', () => {
+        const path1: IPoint[] = [createPoint(0, 0)];
+        expect(smoother.smooth(path1, grid)).toEqual(path1);
+
+        const path2: IPoint[] = [createPoint(0, 0), createPoint(5, 5)];
+        expect(smoother.smooth(path2, grid)).toEqual(path2);
+    });
+
+    it('should add interpolation points', () => {
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(5, 0),
+            createPoint(10, 0)
+        ];
+
+        const result = smoother.smooth(path, grid);
+        // Should have more points due to interpolation
+        expect(result.length).toBeGreaterThan(path.length);
+    });
+
+    it('should preserve start and end points', () => {
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(5, 5),
+            createPoint(10, 0)
+        ];
+
+        const result = smoother.smooth(path, grid);
+        expect(result[0].x).toBeCloseTo(0, 1);
+        expect(result[0].y).toBeCloseTo(0, 1);
+        expect(result[result.length - 1]).toEqual(createPoint(10, 0));
+    });
+
+    it('should create smooth curve', () => {
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(5, 5),
+            createPoint(10, 0)
+        ];
+
+        const result = smoother.smooth(path, grid);
+
+        // Check that middle points are near the original waypoint
+        const middlePoints = result.filter(p =>
+            Math.abs(p.x - 5) < 2 && Math.abs(p.y - 5) < 2
+        );
+        expect(middlePoints.length).toBeGreaterThan(0);
+    });
+
+    it('should work with different segment counts', () => {
+        const smootherLow = new CatmullRomSmoother(2);
+        const smootherHigh = new CatmullRomSmoother(10);
+
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(5, 5),
+            createPoint(10, 0)
+        ];
+
+        const resultLow = smootherLow.smooth(path, grid);
+        const resultHigh = smootherHigh.smooth(path, grid);
+
+        expect(resultHigh.length).toBeGreaterThan(resultLow.length);
+    });
+});
+
+describe('CombinedSmoother', () => {
+    let grid: GridMap;
+    let smoother: CombinedSmoother;
+
+    beforeEach(() => {
+        grid = new GridMap(20, 20);
+        smoother = new CombinedSmoother(5, 0.5);
+    });
+
+    it('should first simplify then curve smooth', () => {
+        // Path with redundant points
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(1, 0),
+            createPoint(2, 0),
+            createPoint(3, 0),
+            createPoint(4, 0),
+            createPoint(5, 0),
+            createPoint(6, 3),
+            createPoint(7, 6),
+            createPoint(8, 6),
+            createPoint(9, 6),
+            createPoint(10, 6)
+        ];
+
+        const result = smoother.smooth(path, grid);
+
+        // Should have smoothed the path
+        expect(result.length).toBeGreaterThan(0);
+        expect(result[0].x).toBeCloseTo(0, 1);
+        expect(result[result.length - 1]).toEqual(createPoint(10, 6));
+    });
+
+    it('should handle simple path', () => {
+        const path: IPoint[] = [
+            createPoint(0, 0),
+            createPoint(10, 10)
+        ];
+
+        const result = smoother.smooth(path, grid);
+        expect(result.length).toBe(2);
+    });
+});

packages/framework/pathfinding/package.json

@@ -20,6 +20,8 @@
         "build": "tsup",
         "build:watch": "tsup --watch",
         "type-check": "tsc --noEmit",
+        "test": "vitest run",
+        "test:watch": "vitest",
         "clean": "rimraf dist"
     },
     "devDependencies": {
@@ -27,7 +29,8 @@
         "@esengine/ecs-framework-math": "workspace:*",
         "@esengine/blueprint": "workspace:*",
         "tsup": "^8.0.0",
-        "typescript": "^5.8.0"
+        "typescript": "^5.8.0",
+        "vitest": "^2.1.9"
     },
     "peerDependencies": {
         "@esengine/ecs-framework": "workspace:*",

packages/framework/pathfinding/vitest.config.ts

@@ -0,0 +1,7 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+    test: {
+        include: ['__tests__/**/*.test.ts'],
+    },
+});

packages/framework/server/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @esengine/server
 
+## 1.3.0
+
+### Minor Changes
+
+- [#388](https://github.com/esengine/esengine/pull/388) [`afdeb00`](https://github.com/esengine/esengine/commit/afdeb00b4df9427e7f03b91558bf95804a837b70) Thanks [@esengine](https://github.com/esengine)! - feat(server): 添加可插拔速率限制系统 | add pluggable rate limiting system
+    - 新增令牌桶策略 (`TokenBucketStrategy`) - 推荐用于一般场景
+    - 新增滑动窗口策略 (`SlidingWindowStrategy`) - 精确跟踪
+    - 新增固定窗口策略 (`FixedWindowStrategy`) - 简单高效
+    - 新增房间速率限制 mixin (`withRateLimit`)
+    - 新增速率限制装饰器 (`@rateLimit`, `@noRateLimit`)
+    - 新增按消息类型限流装饰器 (`@rateLimitMessage`, `@noRateLimitMessage`)
+    - 支持与认证系统组合使用
+    - 导出路径: `@esengine/server/ratelimit`
+
+## 1.2.0
+
+### Minor Changes
+
+- [#386](https://github.com/esengine/esengine/pull/386) [`61a13ba`](https://github.com/esengine/esengine/commit/61a13baca2e1e8fba14e23d439521ec0e6b7ca6e) Thanks [@esengine](https://github.com/esengine)! - feat(server): 添加可插拔认证系统 | add pluggable authentication system
+    - 新增 JWT 认证提供者 (`createJwtAuthProvider`)
+    - 新增 Session 认证提供者 (`createSessionAuthProvider`)
+    - 新增服务器认证 mixin (`withAuth`)
+    - 新增房间认证 mixin (`withRoomAuth`)
+    - 新增认证装饰器 (`@requireAuth`, `@requireRole`)
+    - 新增测试工具 (`MockAuthProvider`)
+    - 导出路径: `@esengine/server/auth`, `@esengine/server/auth/testing`
+
 ## 1.1.4
 
 ### Patch Changes

packages/framework/server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@esengine/server",
-  "version": "1.1.4",
+  "version": "1.3.0",
   "description": "Game server framework for ESEngine with file-based routing",
   "type": "module",
   "main": "./dist/index.js",
@@ -10,6 +10,22 @@
     ".": {
       "import": "./dist/index.js",
       "types": "./dist/index.d.ts"
+    },
+    "./auth": {
+      "import": "./dist/auth/index.js",
+      "types": "./dist/auth/index.d.ts"
+    },
+    "./auth/testing": {
+      "import": "./dist/auth/testing/index.js",
+      "types": "./dist/auth/testing/index.d.ts"
+    },
+    "./ratelimit": {
+      "import": "./dist/ratelimit/index.js",
+      "types": "./dist/ratelimit/index.d.ts"
+    },
+    "./testing": {
+      "import": "./dist/testing/index.js",
+      "types": "./dist/testing/index.d.ts"
     }
   },
   "files": [
@@ -21,20 +37,31 @@
     "build:watch": "tsup --watch",
     "dev": "tsup --watch",
     "type-check": "tsc --noEmit",
-    "clean": "rimraf dist"
+    "clean": "rimraf dist",
+    "test": "vitest run",
+    "test:watch": "vitest"
   },
   "dependencies": {
     "@esengine/rpc": "workspace:*"
   },
   "peerDependencies": {
-    "ws": ">=8.0.0"
+    "ws": ">=8.0.0",
+    "jsonwebtoken": ">=9.0.0"
+  },
+  "peerDependenciesMeta": {
+    "jsonwebtoken": {
+      "optional": true
+    }
   },
   "devDependencies": {
+    "@types/jsonwebtoken": "^9.0.0",
     "@types/node": "^20.0.0",
     "@types/ws": "^8.5.13",
+    "jsonwebtoken": "^9.0.0",
     "rimraf": "^5.0.0",
     "tsup": "^8.0.0",
     "typescript": "^5.7.0",
+    "vitest": "^2.0.0",
     "ws": "^8.18.0"
   },
   "publishConfig": {

packages/framework/server/src/auth/__tests__/MockAuthProvider.test.ts

@@ -0,0 +1,214 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { MockAuthProvider, createMockAuthProvider, type MockUser } from '../testing/MockAuthProvider';
+
+describe('MockAuthProvider', () => {
+    const testUsers: MockUser[] = [
+        { id: '1', name: 'Alice', roles: ['player'] },
+        { id: '2', name: 'Bob', roles: ['admin', 'player'] },
+        { id: '3', name: 'Charlie', roles: ['guest'] }
+    ];
+
+    let provider: MockAuthProvider;
+
+    beforeEach(() => {
+        provider = createMockAuthProvider({
+            users: testUsers
+        });
+    });
+
+    describe('basic properties', () => {
+        it('should have name "mock"', () => {
+            expect(provider.name).toBe('mock');
+        });
+    });
+
+    describe('verify', () => {
+        it('should verify existing user by id (token)', async () => {
+            const result = await provider.verify('1');
+            expect(result.success).toBe(true);
+            expect(result.user?.id).toBe('1');
+            expect(result.user?.name).toBe('Alice');
+        });
+
+        it('should return user roles', async () => {
+            const result = await provider.verify('2');
+            expect(result.success).toBe(true);
+            expect(result.user?.roles).toEqual(['admin', 'player']);
+        });
+
+        it('should fail for unknown user', async () => {
+            const result = await provider.verify('unknown');
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('USER_NOT_FOUND');
+        });
+
+        it('should fail for empty token', async () => {
+            const result = await provider.verify('');
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('INVALID_TOKEN');
+        });
+
+        it('should return expiresAt', async () => {
+            const result = await provider.verify('1');
+            expect(result.expiresAt).toBeTypeOf('number');
+            expect(result.expiresAt).toBeGreaterThan(Date.now());
+        });
+    });
+
+    describe('with defaultUser', () => {
+        it('should return default user for empty token', async () => {
+            const providerWithDefault = createMockAuthProvider({
+                defaultUser: { id: 'default', name: 'Guest' }
+            });
+
+            const result = await providerWithDefault.verify('');
+            expect(result.success).toBe(true);
+            expect(result.user?.id).toBe('default');
+        });
+    });
+
+    describe('with autoCreate', () => {
+        it('should auto create user for unknown token', async () => {
+            const autoProvider = createMockAuthProvider({
+                autoCreate: true
+            });
+
+            const result = await autoProvider.verify('new-user-123');
+            expect(result.success).toBe(true);
+            expect(result.user?.id).toBe('new-user-123');
+            expect(result.user?.name).toBe('User_new-user-123');
+            expect(result.user?.roles).toEqual(['guest']);
+        });
+
+        it('should persist auto-created users', async () => {
+            const autoProvider = createMockAuthProvider({
+                autoCreate: true
+            });
+
+            await autoProvider.verify('auto-1');
+            const user = autoProvider.getUser('auto-1');
+            expect(user).toBeDefined();
+            expect(user?.id).toBe('auto-1');
+        });
+    });
+
+    describe('with validateToken', () => {
+        it('should validate token format', async () => {
+            const validatingProvider = createMockAuthProvider({
+                users: testUsers,
+                validateToken: (token) => token.length >= 1 && !token.includes('invalid')
+            });
+
+            const validResult = await validatingProvider.verify('1');
+            expect(validResult.success).toBe(true);
+
+            const invalidResult = await validatingProvider.verify('invalid-token');
+            expect(invalidResult.success).toBe(false);
+            expect(invalidResult.errorCode).toBe('INVALID_TOKEN');
+        });
+    });
+
+    describe('with delay', () => {
+        it('should add artificial delay', async () => {
+            const delayProvider = createMockAuthProvider({
+                users: testUsers,
+                delay: 50
+            });
+
+            const start = Date.now();
+            await delayProvider.verify('1');
+            const elapsed = Date.now() - start;
+
+            expect(elapsed).toBeGreaterThanOrEqual(45);
+        });
+    });
+
+    describe('refresh', () => {
+        it('should refresh token (returns same result as verify)', async () => {
+            const result = await provider.refresh('1');
+            expect(result.success).toBe(true);
+            expect(result.user?.id).toBe('1');
+        });
+    });
+
+    describe('revoke', () => {
+        it('should revoke token', async () => {
+            const result1 = await provider.verify('1');
+            expect(result1.success).toBe(true);
+
+            const revoked = await provider.revoke('1');
+            expect(revoked).toBe(true);
+
+            const result2 = await provider.verify('1');
+            expect(result2.success).toBe(false);
+            expect(result2.errorCode).toBe('INVALID_TOKEN');
+        });
+    });
+
+    describe('user management', () => {
+        it('should add user', () => {
+            provider.addUser({ id: '4', name: 'Dave', roles: ['tester'] });
+            const user = provider.getUser('4');
+            expect(user?.name).toBe('Dave');
+        });
+
+        it('should remove user', () => {
+            const removed = provider.removeUser('1');
+            expect(removed).toBe(true);
+
+            const user = provider.getUser('1');
+            expect(user).toBeUndefined();
+        });
+
+        it('should return false when removing non-existent user', () => {
+            const removed = provider.removeUser('non-existent');
+            expect(removed).toBe(false);
+        });
+
+        it('should get all users', () => {
+            const users = provider.getUsers();
+            expect(users).toHaveLength(3);
+            expect(users.map(u => u.id)).toContain('1');
+            expect(users.map(u => u.id)).toContain('2');
+            expect(users.map(u => u.id)).toContain('3');
+        });
+    });
+
+    describe('clear', () => {
+        it('should reset to initial state', async () => {
+            provider.addUser({ id: '4', name: 'Dave' });
+            await provider.revoke('1');
+
+            provider.clear();
+
+            const users = provider.getUsers();
+            expect(users).toHaveLength(3);
+
+            const result = await provider.verify('1');
+            expect(result.success).toBe(true);
+        });
+    });
+
+    describe('generateToken', () => {
+        it('should return user id as token', () => {
+            const token = provider.generateToken('user-123');
+            expect(token).toBe('user-123');
+        });
+    });
+});
+
+describe('createMockAuthProvider', () => {
+    it('should create provider with empty config', () => {
+        const provider = createMockAuthProvider();
+        expect(provider.name).toBe('mock');
+    });
+
+    it('should create provider with custom users', () => {
+        const provider = createMockAuthProvider({
+            users: [{ id: 'test', name: 'Test User' }]
+        });
+
+        const user = provider.getUser('test');
+        expect(user?.name).toBe('Test User');
+    });
+});

packages/framework/server/src/auth/__tests__/context.test.ts

@@ -0,0 +1,242 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { AuthContext, createGuestContext, createAuthContext, defaultUserExtractor } from '../context';
+import type { AuthResult } from '../types';
+
+describe('AuthContext', () => {
+    let context: AuthContext<{ id: string; name: string; roles: string[] }>;
+
+    beforeEach(() => {
+        context = new AuthContext();
+    });
+
+    describe('initial state', () => {
+        it('should not be authenticated initially', () => {
+            expect(context.isAuthenticated).toBe(false);
+        });
+
+        it('should have null user initially', () => {
+            expect(context.user).toBeNull();
+        });
+
+        it('should have null userId initially', () => {
+            expect(context.userId).toBeNull();
+        });
+
+        it('should have empty roles initially', () => {
+            expect(context.roles).toEqual([]);
+        });
+
+        it('should have null authenticatedAt initially', () => {
+            expect(context.authenticatedAt).toBeNull();
+        });
+
+        it('should have null expiresAt initially', () => {
+            expect(context.expiresAt).toBeNull();
+        });
+    });
+
+    describe('setAuthenticated', () => {
+        it('should set authenticated state on success', () => {
+            const result: AuthResult<{ id: string; name: string; roles: string[] }> = {
+                success: true,
+                user: { id: '123', name: 'Alice', roles: ['player'] }
+            };
+
+            context.setAuthenticated(result);
+
+            expect(context.isAuthenticated).toBe(true);
+            expect(context.user).toEqual({ id: '123', name: 'Alice', roles: ['player'] });
+            expect(context.userId).toBe('123');
+            expect(context.roles).toEqual(['player']);
+            expect(context.authenticatedAt).toBeTypeOf('number');
+        });
+
+        it('should set expiresAt when provided', () => {
+            const expiresAt = Date.now() + 3600000;
+            const result: AuthResult<{ id: string; name: string; roles: string[] }> = {
+                success: true,
+                user: { id: '123', name: 'Alice', roles: [] },
+                expiresAt
+            };
+
+            context.setAuthenticated(result);
+
+            expect(context.expiresAt).toBe(expiresAt);
+        });
+
+        it('should clear state on failed result', () => {
+            context.setAuthenticated({
+                success: true,
+                user: { id: '123', name: 'Alice', roles: ['player'] }
+            });
+
+            context.setAuthenticated({
+                success: false,
+                error: 'Token expired'
+            });
+
+            expect(context.isAuthenticated).toBe(false);
+            expect(context.user).toBeNull();
+        });
+
+        it('should clear state when success but no user', () => {
+            context.setAuthenticated({
+                success: true
+            });
+
+            expect(context.isAuthenticated).toBe(false);
+        });
+    });
+
+    describe('isAuthenticated with expiry', () => {
+        it('should return false when token is expired', () => {
+            context.setAuthenticated({
+                success: true,
+                user: { id: '123', name: 'Alice', roles: [] },
+                expiresAt: Date.now() - 1000
+            });
+
+            expect(context.isAuthenticated).toBe(false);
+        });
+
+        it('should return true when token is not expired', () => {
+            context.setAuthenticated({
+                success: true,
+                user: { id: '123', name: 'Alice', roles: [] },
+                expiresAt: Date.now() + 3600000
+            });
+
+            expect(context.isAuthenticated).toBe(true);
+        });
+    });
+
+    describe('role checking', () => {
+        beforeEach(() => {
+            context.setAuthenticated({
+                success: true,
+                user: { id: '123', name: 'Alice', roles: ['player', 'premium'] }
+            });
+        });
+
+        it('hasRole should return true for existing role', () => {
+            expect(context.hasRole('player')).toBe(true);
+            expect(context.hasRole('premium')).toBe(true);
+        });
+
+        it('hasRole should return false for non-existing role', () => {
+            expect(context.hasRole('admin')).toBe(false);
+        });
+
+        it('hasAnyRole should return true if any role matches', () => {
+            expect(context.hasAnyRole(['admin', 'player'])).toBe(true);
+            expect(context.hasAnyRole(['guest', 'premium'])).toBe(true);
+        });
+
+        it('hasAnyRole should return false if no role matches', () => {
+            expect(context.hasAnyRole(['admin', 'moderator'])).toBe(false);
+        });
+
+        it('hasAllRoles should return true if all roles match', () => {
+            expect(context.hasAllRoles(['player', 'premium'])).toBe(true);
+        });
+
+        it('hasAllRoles should return false if any role is missing', () => {
+            expect(context.hasAllRoles(['player', 'admin'])).toBe(false);
+        });
+    });
+
+    describe('clear', () => {
+        it('should reset all state', () => {
+            context.setAuthenticated({
+                success: true,
+                user: { id: '123', name: 'Alice', roles: ['player'] },
+                expiresAt: Date.now() + 3600000
+            });
+
+            context.clear();
+
+            expect(context.isAuthenticated).toBe(false);
+            expect(context.user).toBeNull();
+            expect(context.userId).toBeNull();
+            expect(context.roles).toEqual([]);
+            expect(context.authenticatedAt).toBeNull();
+            expect(context.expiresAt).toBeNull();
+        });
+    });
+});
+
+describe('defaultUserExtractor', () => {
+    describe('getId', () => {
+        it('should extract id from user object', () => {
+            expect(defaultUserExtractor.getId({ id: '123' })).toBe('123');
+        });
+
+        it('should extract numeric id as string', () => {
+            expect(defaultUserExtractor.getId({ id: 456 })).toBe('456');
+        });
+
+        it('should extract userId', () => {
+            expect(defaultUserExtractor.getId({ userId: 'abc' })).toBe('abc');
+        });
+
+        it('should extract sub (JWT standard)', () => {
+            expect(defaultUserExtractor.getId({ sub: 'jwt-sub' })).toBe('jwt-sub');
+        });
+
+        it('should return empty string for invalid user', () => {
+            expect(defaultUserExtractor.getId(null)).toBe('');
+            expect(defaultUserExtractor.getId(undefined)).toBe('');
+            expect(defaultUserExtractor.getId({})).toBe('');
+        });
+    });
+
+    describe('getRoles', () => {
+        it('should extract roles array', () => {
+            expect(defaultUserExtractor.getRoles({ roles: ['a', 'b'] })).toEqual(['a', 'b']);
+        });
+
+        it('should extract single role', () => {
+            expect(defaultUserExtractor.getRoles({ role: 'admin' })).toEqual(['admin']);
+        });
+
+        it('should filter non-string roles', () => {
+            expect(defaultUserExtractor.getRoles({ roles: ['a', 123, 'b'] })).toEqual(['a', 'b']);
+        });
+
+        it('should return empty array for invalid user', () => {
+            expect(defaultUserExtractor.getRoles(null)).toEqual([]);
+            expect(defaultUserExtractor.getRoles({})).toEqual([]);
+        });
+    });
+});
+
+describe('createGuestContext', () => {
+    it('should create unauthenticated context', () => {
+        const guest = createGuestContext();
+        expect(guest.isAuthenticated).toBe(false);
+        expect(guest.user).toBeNull();
+    });
+});
+
+describe('createAuthContext', () => {
+    it('should create authenticated context from result', () => {
+        const result: AuthResult<{ id: string }> = {
+            success: true,
+            user: { id: '123' }
+        };
+
+        const ctx = createAuthContext(result);
+        expect(ctx.isAuthenticated).toBe(true);
+        expect(ctx.userId).toBe('123');
+    });
+
+    it('should create unauthenticated context from failed result', () => {
+        const result: AuthResult<{ id: string }> = {
+            success: false,
+            error: 'Failed'
+        };
+
+        const ctx = createAuthContext(result);
+        expect(ctx.isAuthenticated).toBe(false);
+    });
+});

packages/framework/server/src/auth/__tests__/decorators.test.ts

@@ -0,0 +1,165 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { requireAuth, AUTH_METADATA_KEY, getAuthMetadata, type AuthMetadata } from '../decorators/requireAuth';
+import { requireRole } from '../decorators/requireRole';
+
+describe('requireAuth decorator', () => {
+    class TestClass {
+        @requireAuth()
+        basicMethod() {
+            return 'basic';
+        }
+
+        @requireAuth({ allowGuest: true })
+        guestAllowedMethod() {
+            return 'guest';
+        }
+
+        @requireAuth({ errorMessage: 'Custom error' })
+        customErrorMethod() {
+            return 'custom';
+        }
+
+        undecorated() {
+            return 'undecorated';
+        }
+    }
+
+    let instance: TestClass;
+
+    beforeEach(() => {
+        instance = new TestClass();
+    });
+
+    describe('metadata storage', () => {
+        it('should store auth metadata on target', () => {
+            const metadata = getAuthMetadata(TestClass.prototype, 'basicMethod');
+            expect(metadata).toBeDefined();
+            expect(metadata?.requireAuth).toBe(true);
+        });
+
+        it('should store options in metadata', () => {
+            const metadata = getAuthMetadata(TestClass.prototype, 'guestAllowedMethod');
+            expect(metadata?.options?.allowGuest).toBe(true);
+        });
+
+        it('should store custom error message', () => {
+            const metadata = getAuthMetadata(TestClass.prototype, 'customErrorMethod');
+            expect(metadata?.options?.errorMessage).toBe('Custom error');
+        });
+
+        it('should return undefined for undecorated methods', () => {
+            const metadata = getAuthMetadata(TestClass.prototype, 'undecorated');
+            expect(metadata).toBeUndefined();
+        });
+
+        it('should return undefined for non-existent methods', () => {
+            const metadata = getAuthMetadata(TestClass.prototype, 'nonExistent');
+            expect(metadata).toBeUndefined();
+        });
+    });
+
+    describe('method behavior', () => {
+        it('should not alter method behavior', () => {
+            expect(instance.basicMethod()).toBe('basic');
+            expect(instance.guestAllowedMethod()).toBe('guest');
+            expect(instance.customErrorMethod()).toBe('custom');
+        });
+    });
+
+    describe('metadata key', () => {
+        it('should use symbol for metadata storage', () => {
+            expect(typeof AUTH_METADATA_KEY).toBe('symbol');
+        });
+
+        it('should store metadata in a Map', () => {
+            const metadataMap = (TestClass.prototype as any)[AUTH_METADATA_KEY];
+            expect(metadataMap).toBeInstanceOf(Map);
+        });
+    });
+});
+
+describe('requireRole decorator', () => {
+    class RoleTestClass {
+        @requireRole('admin')
+        adminOnly() {
+            return 'admin';
+        }
+
+        @requireRole(['moderator', 'admin'])
+        modOrAdmin() {
+            return 'mod';
+        }
+
+        @requireRole(['verified', 'premium'], { mode: 'all' })
+        verifiedPremium() {
+            return 'vip';
+        }
+
+        @requireRole('player', { mode: 'any' })
+        playerExplicit() {
+            return 'player';
+        }
+    }
+
+    describe('single role', () => {
+        it('should store single role as array', () => {
+            const metadata = getAuthMetadata(RoleTestClass.prototype, 'adminOnly');
+            expect(metadata?.roles).toEqual(['admin']);
+        });
+
+        it('should set requireAuth to true', () => {
+            const metadata = getAuthMetadata(RoleTestClass.prototype, 'adminOnly');
+            expect(metadata?.requireAuth).toBe(true);
+        });
+
+        it('should default to any mode', () => {
+            const metadata = getAuthMetadata(RoleTestClass.prototype, 'adminOnly');
+            expect(metadata?.roleMode).toBe('any');
+        });
+    });
+
+    describe('multiple roles', () => {
+        it('should store multiple roles', () => {
+            const metadata = getAuthMetadata(RoleTestClass.prototype, 'modOrAdmin');
+            expect(metadata?.roles).toEqual(['moderator', 'admin']);
+        });
+    });
+
+    describe('role mode', () => {
+        it('should support all mode', () => {
+            const metadata = getAuthMetadata(RoleTestClass.prototype, 'verifiedPremium');
+            expect(metadata?.roleMode).toBe('all');
+            expect(metadata?.roles).toEqual(['verified', 'premium']);
+        });
+
+        it('should support explicit any mode', () => {
+            const metadata = getAuthMetadata(RoleTestClass.prototype, 'playerExplicit');
+            expect(metadata?.roleMode).toBe('any');
+        });
+    });
+
+    describe('method behavior', () => {
+        it('should not alter method behavior', () => {
+            const instance = new RoleTestClass();
+            expect(instance.adminOnly()).toBe('admin');
+            expect(instance.modOrAdmin()).toBe('mod');
+            expect(instance.verifiedPremium()).toBe('vip');
+        });
+    });
+});
+
+describe('combined decorators', () => {
+    class CombinedTestClass {
+        @requireAuth({ allowGuest: false })
+        @requireRole('admin')
+        combinedMethod() {
+            return 'combined';
+        }
+    }
+
+    it('should merge metadata from both decorators', () => {
+        const metadata = getAuthMetadata(CombinedTestClass.prototype, 'combinedMethod');
+        expect(metadata?.requireAuth).toBe(true);
+        expect(metadata?.roles).toEqual(['admin']);
+    });
+});

packages/framework/server/src/auth/__tests__/providers.test.ts

@@ -0,0 +1,330 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { JwtAuthProvider, createJwtAuthProvider } from '../providers/JwtAuthProvider';
+import { SessionAuthProvider, createSessionAuthProvider, type ISessionStorage } from '../providers/SessionAuthProvider';
+
+describe('JwtAuthProvider', () => {
+    const secret = 'test-secret-key-for-testing';
+    let provider: JwtAuthProvider<{ id: string; name: string; roles: string[] }>;
+
+    beforeEach(() => {
+        provider = createJwtAuthProvider({
+            secret,
+            expiresIn: 3600
+        });
+    });
+
+    describe('sign and verify', () => {
+        it('should sign and verify a token', async () => {
+            const payload = { sub: '123', name: 'Alice', roles: ['player'] };
+            const token = provider.sign(payload);
+
+            expect(token).toBeTypeOf('string');
+            expect(token.split('.')).toHaveLength(3);
+
+            const result = await provider.verify(token);
+            expect(result.success).toBe(true);
+            expect(result.user).toBeDefined();
+        });
+
+        it('should extract user from payload', async () => {
+            const payload = { sub: '123', name: 'Alice' };
+            const token = provider.sign(payload);
+
+            const result = await provider.verify(token);
+            expect(result.success).toBe(true);
+            expect((result.user as any).sub).toBe('123');
+            expect((result.user as any).name).toBe('Alice');
+        });
+
+        it('should return expiration time', async () => {
+            const token = provider.sign({ sub: '123' });
+            const result = await provider.verify(token);
+
+            expect(result.expiresAt).toBeTypeOf('number');
+            expect(result.expiresAt).toBeGreaterThan(Date.now());
+        });
+    });
+
+    describe('verify errors', () => {
+        it('should fail for empty token', async () => {
+            const result = await provider.verify('');
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('INVALID_TOKEN');
+        });
+
+        it('should fail for invalid token', async () => {
+            const result = await provider.verify('invalid.token.here');
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('INVALID_TOKEN');
+        });
+
+        it('should fail for expired token', async () => {
+            const shortLivedProvider = createJwtAuthProvider({
+                secret,
+                expiresIn: -1
+            });
+
+            const token = shortLivedProvider.sign({ sub: '123' });
+            const result = await shortLivedProvider.verify(token);
+
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('EXPIRED_TOKEN');
+        });
+
+        it('should fail for wrong secret', async () => {
+            const token = provider.sign({ sub: '123' });
+
+            const wrongSecretProvider = createJwtAuthProvider({
+                secret: 'wrong-secret'
+            });
+
+            const result = await wrongSecretProvider.verify(token);
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('INVALID_TOKEN');
+        });
+    });
+
+    describe('with getUser callback', () => {
+        it('should use getUser to transform payload', async () => {
+            const customProvider = createJwtAuthProvider({
+                secret,
+                getUser: async (payload) => ({
+                    id: payload.sub as string,
+                    name: payload.name as string,
+                    roles: (payload.roles as string[]) || []
+                })
+            });
+
+            const token = customProvider.sign({ sub: '123', name: 'Bob', roles: ['admin'] });
+            const result = await customProvider.verify(token);
+
+            expect(result.success).toBe(true);
+            expect(result.user).toEqual({
+                id: '123',
+                name: 'Bob',
+                roles: ['admin']
+            });
+        });
+
+        it('should fail when getUser returns null', async () => {
+            const customProvider = createJwtAuthProvider({
+                secret,
+                getUser: async () => null
+            });
+
+            const token = customProvider.sign({ sub: '123' });
+            const result = await customProvider.verify(token);
+
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('USER_NOT_FOUND');
+        });
+    });
+
+    describe('refresh', () => {
+        it('should refresh a valid token', async () => {
+            const token = provider.sign({ sub: '123', name: 'Alice' });
+
+            // Wait a bit so iat changes
+            await new Promise(resolve => setTimeout(resolve, 1100));
+
+            const result = await provider.refresh(token);
+
+            expect(result.success).toBe(true);
+            expect(result.token).toBeDefined();
+            expect(result.token).not.toBe(token);
+        });
+
+        it('should return new expiration time', async () => {
+            const token = provider.sign({ sub: '123' });
+            const result = await provider.refresh(token);
+
+            expect(result.success).toBe(true);
+            expect(result.expiresAt).toBeTypeOf('number');
+            expect(result.expiresAt).toBeGreaterThan(Date.now());
+        });
+
+        it('should fail to refresh invalid token', async () => {
+            const result = await provider.refresh('invalid');
+
+            expect(result.success).toBe(false);
+        });
+    });
+
+    describe('decode', () => {
+        it('should decode token without verification', () => {
+            const token = provider.sign({ sub: '123', name: 'Alice' });
+            const payload = provider.decode(token);
+
+            expect(payload).toBeDefined();
+            expect(payload?.sub).toBe('123');
+            expect(payload?.name).toBe('Alice');
+        });
+
+        it('should return null for invalid token', () => {
+            const payload = provider.decode('not-a-token');
+            expect(payload).toBeNull();
+        });
+    });
+});
+
+describe('SessionAuthProvider', () => {
+    let storage: ISessionStorage;
+    let provider: SessionAuthProvider<{ id: string; name: string }>;
+    let storageData: Map<string, unknown>;
+
+    beforeEach(() => {
+        storageData = new Map();
+
+        storage = {
+            async get<T>(key: string): Promise<T | null> {
+                return (storageData.get(key) as T) ?? null;
+            },
+            async set<T>(key: string, value: T): Promise<void> {
+                storageData.set(key, value);
+            },
+            async delete(key: string): Promise<boolean> {
+                return storageData.delete(key);
+            }
+        };
+
+        provider = createSessionAuthProvider({
+            storage,
+            sessionTTL: 3600000
+        });
+    });
+
+    describe('createSession and verify', () => {
+        it('should create and verify a session', async () => {
+            const user = { id: '123', name: 'Alice' };
+            const sessionId = await provider.createSession(user);
+
+            expect(sessionId).toBeTypeOf('string');
+            expect(sessionId.length).toBeGreaterThan(10);
+
+            const result = await provider.verify(sessionId);
+
+            expect(result.success).toBe(true);
+            expect(result.user).toEqual(user);
+        });
+
+        it('should store session data', async () => {
+            const user = { id: '123', name: 'Alice' };
+            const sessionId = await provider.createSession(user, { customField: 'value' });
+
+            const session = await provider.getSession(sessionId);
+
+            expect(session).toBeDefined();
+            expect(session?.user).toEqual(user);
+            expect(session?.data?.customField).toBe('value');
+            expect(session?.createdAt).toBeTypeOf('number');
+            expect(session?.lastActiveAt).toBeTypeOf('number');
+        });
+    });
+
+    describe('verify errors', () => {
+        it('should fail for empty session id', async () => {
+            const result = await provider.verify('');
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('INVALID_TOKEN');
+        });
+
+        it('should fail for non-existent session', async () => {
+            const result = await provider.verify('non-existent-session');
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('EXPIRED_TOKEN');
+        });
+    });
+
+    describe('with validateUser', () => {
+        it('should validate user on verify', async () => {
+            const validatingProvider = createSessionAuthProvider({
+                storage,
+                validateUser: (user) => user.id !== 'banned'
+            });
+
+            const sessionId = await validatingProvider.createSession({ id: 'banned', name: 'Bad User' });
+            const result = await validatingProvider.verify(sessionId);
+
+            expect(result.success).toBe(false);
+            expect(result.errorCode).toBe('ACCOUNT_DISABLED');
+        });
+
+        it('should pass validation for valid user', async () => {
+            const validatingProvider = createSessionAuthProvider({
+                storage,
+                validateUser: (user) => user.id !== 'banned'
+            });
+
+            const sessionId = await validatingProvider.createSession({ id: '123', name: 'Good User' });
+            const result = await validatingProvider.verify(sessionId);
+
+            expect(result.success).toBe(true);
+        });
+    });
+
+    describe('refresh', () => {
+        it('should refresh session and update lastActiveAt', async () => {
+            const sessionId = await provider.createSession({ id: '123', name: 'Alice' });
+
+            const session1 = await provider.getSession(sessionId);
+            const lastActive1 = session1?.lastActiveAt;
+
+            await new Promise(resolve => setTimeout(resolve, 10));
+
+            const result = await provider.refresh(sessionId);
+            expect(result.success).toBe(true);
+
+            const session2 = await provider.getSession(sessionId);
+            expect(session2?.lastActiveAt).toBeGreaterThanOrEqual(lastActive1!);
+        });
+    });
+
+    describe('revoke', () => {
+        it('should revoke session', async () => {
+            const sessionId = await provider.createSession({ id: '123', name: 'Alice' });
+
+            const revoked = await provider.revoke(sessionId);
+            expect(revoked).toBe(true);
+
+            const result = await provider.verify(sessionId);
+            expect(result.success).toBe(false);
+        });
+    });
+
+    describe('updateSession', () => {
+        it('should update session data', async () => {
+            const sessionId = await provider.createSession({ id: '123', name: 'Alice' });
+
+            const updated = await provider.updateSession(sessionId, { newField: 'newValue' });
+            expect(updated).toBe(true);
+
+            const session = await provider.getSession(sessionId);
+            expect(session?.data?.newField).toBe('newValue');
+        });
+
+        it('should return false for non-existent session', async () => {
+            const updated = await provider.updateSession('non-existent', { field: 'value' });
+            expect(updated).toBe(false);
+        });
+    });
+});
+
+describe('createJwtAuthProvider', () => {
+    it('should create provider with default options', () => {
+        const provider = createJwtAuthProvider({ secret: 'test' });
+        expect(provider.name).toBe('jwt');
+    });
+});
+
+describe('createSessionAuthProvider', () => {
+    it('should create provider with default options', () => {
+        const storage: ISessionStorage = {
+            get: async () => null,
+            set: async () => {},
+            delete: async () => true
+        };
+
+        const provider = createSessionAuthProvider({ storage });
+        expect(provider.name).toBe('session');
+    });
+});

packages/framework/server/src/auth/context.ts

@@ -0,0 +1,202 @@
+/**
+ * @zh 认证上下文实现
+ * @en Authentication context implementation
+ */
+
+import type { IAuthContext, AuthResult } from './types.js';
+
+/**
+ * @zh 用户信息提取器
+ * @en User info extractor
+ */
+export interface UserInfoExtractor<TUser> {
+    /**
+     * @zh 提取用户 ID
+     * @en Extract user ID
+     */
+    getId(user: TUser): string;
+
+    /**
+     * @zh 提取用户角色
+     * @en Extract user roles
+     */
+    getRoles(user: TUser): string[];
+}
+
+/**
+ * @zh 默认用户信息提取器
+ * @en Default user info extractor
+ */
+export const defaultUserExtractor: UserInfoExtractor<unknown> = {
+    getId(user: unknown): string {
+        if (user && typeof user === 'object') {
+            const u = user as Record<string, unknown>;
+            if (typeof u.id === 'string') return u.id;
+            if (typeof u.id === 'number') return String(u.id);
+            if (typeof u.userId === 'string') return u.userId;
+            if (typeof u.userId === 'number') return String(u.userId);
+            if (typeof u.sub === 'string') return u.sub;
+        }
+        return '';
+    },
+
+    getRoles(user: unknown): string[] {
+        if (user && typeof user === 'object') {
+            const u = user as Record<string, unknown>;
+            if (Array.isArray(u.roles)) {
+                return u.roles.filter((r): r is string => typeof r === 'string');
+            }
+            if (typeof u.role === 'string') {
+                return [u.role];
+            }
+        }
+        return [];
+    }
+};
+
+/**
+ * @zh 认证上下文
+ * @en Authentication context
+ *
+ * @zh 存储连接的认证状态
+ * @en Stores authentication state for a connection
+ */
+export class AuthContext<TUser = unknown> implements IAuthContext<TUser> {
+    private _isAuthenticated: boolean = false;
+    private _user: TUser | null = null;
+    private _userId: string | null = null;
+    private _roles: string[] = [];
+    private _authenticatedAt: number | null = null;
+    private _expiresAt: number | null = null;
+    private _extractor: UserInfoExtractor<TUser>;
+
+    constructor(extractor?: UserInfoExtractor<TUser>) {
+        this._extractor = (extractor ?? defaultUserExtractor) as UserInfoExtractor<TUser>;
+    }
+
+    /**
+     * @zh 是否已认证
+     * @en Whether authenticated
+     */
+    get isAuthenticated(): boolean {
+        if (this._expiresAt && Date.now() > this._expiresAt) {
+            return false;
+        }
+        return this._isAuthenticated;
+    }
+
+    /**
+     * @zh 用户信息
+     * @en User information
+     */
+    get user(): TUser | null {
+        return this._user;
+    }
+
+    /**
+     * @zh 用户 ID
+     * @en User ID
+     */
+    get userId(): string | null {
+        return this._userId;
+    }
+
+    /**
+     * @zh 用户角色
+     * @en User roles
+     */
+    get roles(): ReadonlyArray<string> {
+        return this._roles;
+    }
+
+    /**
+     * @zh 认证时间
+     * @en Authentication timestamp
+     */
+    get authenticatedAt(): number | null {
+        return this._authenticatedAt;
+    }
+
+    /**
+     * @zh 令牌过期时间
+     * @en Token expiration time
+     */
+    get expiresAt(): number | null {
+        return this._expiresAt;
+    }
+
+    /**
+     * @zh 检查是否有指定角色
+     * @en Check if has specified role
+     */
+    hasRole(role: string): boolean {
+        return this._roles.includes(role);
+    }
+
+    /**
+     * @zh 检查是否有任一指定角色
+     * @en Check if has any of specified roles
+     */
+    hasAnyRole(roles: string[]): boolean {
+        return roles.some(role => this._roles.includes(role));
+    }
+
+    /**
+     * @zh 检查是否有所有指定角色
+     * @en Check if has all specified roles
+     */
+    hasAllRoles(roles: string[]): boolean {
+        return roles.every(role => this._roles.includes(role));
+    }
+
+    /**
+     * @zh 设置认证结果
+     * @en Set authentication result
+     */
+    setAuthenticated(result: AuthResult<TUser>): void {
+        if (result.success && result.user) {
+            this._isAuthenticated = true;
+            this._user = result.user;
+            this._userId = this._extractor.getId(result.user);
+            this._roles = this._extractor.getRoles(result.user);
+            this._authenticatedAt = Date.now();
+            this._expiresAt = result.expiresAt ?? null;
+        } else {
+            this.clear();
+        }
+    }
+
+    /**
+     * @zh 清除认证状态
+     * @en Clear authentication state
+     */
+    clear(): void {
+        this._isAuthenticated = false;
+        this._user = null;
+        this._userId = null;
+        this._roles = [];
+        this._authenticatedAt = null;
+        this._expiresAt = null;
+    }
+}
+
+/**
+ * @zh 创建访客认证上下文
+ * @en Create guest auth context
+ */
+export function createGuestContext<TUser = unknown>(): IAuthContext<TUser> {
+    return new AuthContext<TUser>();
+}
+
+/**
+ * @zh 从认证结果创建认证上下文
+ * @en Create auth context from auth result
+ */
+export function createAuthContext<TUser = unknown>(
+    result: AuthResult<TUser>,
+    extractor?: UserInfoExtractor<TUser>
+): AuthContext<TUser> {
+    const context = new AuthContext<TUser>(extractor);
+    context.setAuthenticated(result);
+    return context;
+}

packages/framework/server/src/auth/decorators/index.ts

@@ -0,0 +1,13 @@
+/**
+ * @zh 认证装饰器
+ * @en Authentication decorators
+ */
+
+export {
+    requireAuth,
+    getAuthMetadata,
+    AUTH_METADATA_KEY,
+    type AuthMetadata
+} from './requireAuth.js';
+
+export { requireRole } from './requireRole.js';

packages/framework/server/src/auth/decorators/requireAuth.ts

@@ -0,0 +1,86 @@
+/**
+ * @zh requireAuth 装饰器
+ * @en requireAuth decorator
+ */
+
+import type { RequireAuthOptions } from '../types.js';
+
+/**
+ * @zh 认证元数据键
+ * @en Auth metadata key
+ */
+export const AUTH_METADATA_KEY = Symbol('authMetadata');
+
+/**
+ * @zh 认证元数据
+ * @en Auth metadata
+ */
+export interface AuthMetadata {
+    requireAuth: boolean;
+    options?: RequireAuthOptions;
+    roles?: string[];
+    roleMode?: 'any' | 'all';
+}
+
+/**
+ * @zh 获取方法的认证元数据
+ * @en Get auth metadata for method
+ */
+export function getAuthMetadata(target: any, propertyKey: string): AuthMetadata | undefined {
+    const metadata = target[AUTH_METADATA_KEY] as Map<string, AuthMetadata> | undefined;
+    return metadata?.get(propertyKey);
+}
+
+/**
+ * @zh 设置方法的认证元数据
+ * @en Set auth metadata for method
+ */
+function setAuthMetadata(target: any, propertyKey: string, metadata: AuthMetadata): void {
+    if (!target[AUTH_METADATA_KEY]) {
+        target[AUTH_METADATA_KEY] = new Map<string, AuthMetadata>();
+    }
+    (target[AUTH_METADATA_KEY] as Map<string, AuthMetadata>).set(propertyKey, metadata);
+}
+
+/**
+ * @zh 要求认证装饰器
+ * @en Require authentication decorator
+ *
+ * @zh 标记方法需要认证才能访问，用于消息处理器
+ * @en Marks method as requiring authentication, used for message handlers
+ *
+ * @example
+ * ```typescript
+ * class GameRoom extends withRoomAuth(Room) {
+ *     @requireAuth()
+ *     @onMessage('Trade')
+ *     handleTrade(data: TradeData, player: AuthPlayer) {
+ *         // Only authenticated players can trade
+ *     }
+ *
+ *     @requireAuth({ allowGuest: true })
+ *     @onMessage('Chat')
+ *     handleChat(data: ChatData, player: AuthPlayer) {
+ *         // Guests can also chat
+ *     }
+ * }
+ * ```
+ */
+export function requireAuth(options?: RequireAuthOptions): MethodDecorator {
+    return function (
+        target: any,
+        propertyKey: string | symbol,
+        descriptor: PropertyDescriptor
+    ) {
+        const key = String(propertyKey);
+        const existing = getAuthMetadata(target, key);
+
+        setAuthMetadata(target, key, {
+            ...existing,
+            requireAuth: true,
+            options
+        });
+
+        return descriptor;
+    };
+}

packages/framework/server/src/auth/decorators/requireRole.ts

@@ -0,0 +1,73 @@
+/**
+ * @zh requireRole 装饰器
+ * @en requireRole decorator
+ */
+
+import type { RequireRoleOptions } from '../types.js';
+import { AUTH_METADATA_KEY, getAuthMetadata, type AuthMetadata } from './requireAuth.js';
+
+/**
+ * @zh 设置方法的认证元数据
+ * @en Set auth metadata for method
+ */
+function setAuthMetadata(target: any, propertyKey: string, metadata: AuthMetadata): void {
+    if (!target[AUTH_METADATA_KEY]) {
+        target[AUTH_METADATA_KEY] = new Map<string, AuthMetadata>();
+    }
+    (target[AUTH_METADATA_KEY] as Map<string, AuthMetadata>).set(propertyKey, metadata);
+}
+
+/**
+ * @zh 要求角色装饰器
+ * @en Require role decorator
+ *
+ * @zh 标记方法需要特定角色才能访问
+ * @en Marks method as requiring specific role(s)
+ *
+ * @example
+ * ```typescript
+ * class AdminRoom extends withRoomAuth(Room) {
+ *     @requireRole('admin')
+ *     @onMessage('Ban')
+ *     handleBan(data: BanData, player: AuthPlayer) {
+ *         // Only admins can ban
+ *     }
+ *
+ *     @requireRole(['moderator', 'admin'])
+ *     @onMessage('Mute')
+ *     handleMute(data: MuteData, player: AuthPlayer) {
+ *         // Moderators or admins can mute
+ *     }
+ *
+ *     @requireRole(['verified', 'premium'], { mode: 'all' })
+ *     @onMessage('SpecialFeature')
+ *     handleSpecial(data: any, player: AuthPlayer) {
+ *         // Requires both verified AND premium roles
+ *     }
+ * }
+ * ```
+ */
+export function requireRole(
+    roles: string | string[],
+    options?: RequireRoleOptions
+): MethodDecorator {
+    return function (
+        target: any,
+        propertyKey: string | symbol,
+        descriptor: PropertyDescriptor
+    ) {
+        const key = String(propertyKey);
+        const existing = getAuthMetadata(target, key);
+        const roleArray = Array.isArray(roles) ? roles : [roles];
+
+        setAuthMetadata(target, key, {
+            ...existing,
+            requireAuth: true,
+            roles: roleArray,
+            roleMode: options?.mode ?? 'any',
+            options
+        });
+
+        return descriptor;
+    };
+}

packages/framework/server/src/auth/index.ts

@@ -0,0 +1,129 @@
+/**
+ * @zh 认证模块
+ * @en Authentication module
+ *
+ * @zh 为 @esengine/server 提供可插拔的认证系统
+ * @en Provides pluggable authentication system for @esengine/server
+ *
+ * @example
+ * ```typescript
+ * import { createServer, Room, onMessage } from '@esengine/server';
+ * import {
+ *     withAuth,
+ *     withRoomAuth,
+ *     createJwtAuthProvider,
+ *     requireAuth,
+ *     requireRole,
+ *     type AuthPlayer
+ * } from '@esengine/server/auth';
+ *
+ * // 1. Create auth provider
+ * const jwtProvider = createJwtAuthProvider({
+ *     secret: process.env.JWT_SECRET!,
+ *     expiresIn: 3600,
+ * });
+ *
+ * // 2. Wrap server with auth
+ * const server = withAuth(await createServer({ port: 3000 }), {
+ *     provider: jwtProvider,
+ *     extractCredentials: (req) => {
+ *         const url = new URL(req.url, 'http://localhost');
+ *         return url.searchParams.get('token');
+ *     },
+ * });
+ *
+ * // 3. Create auth-enabled room
+ * class GameRoom extends withRoomAuth<User>(Room, {
+ *     requireAuth: true,
+ *     allowedRoles: ['player'],
+ * }) {
+ *     onJoin(player: AuthPlayer<User>) {
+ *         console.log(`${player.user?.name} joined`);
+ *     }
+ *
+ *     @requireAuth()
+ *     @onMessage('Chat')
+ *     handleChat(data: { text: string }, player: AuthPlayer<User>) {
+ *         this.broadcast('Chat', { from: player.user?.name, text: data.text });
+ *     }
+ *
+ *     @requireRole('admin')
+ *     @onMessage('Kick')
+ *     handleKick(data: { playerId: string }, player: AuthPlayer<User>) {
+ *         this.kick(data.playerId);
+ *     }
+ * }
+ *
+ * server.define('game', GameRoom);
+ * await server.start();
+ * ```
+ */
+
+// Types
+export type {
+    AuthResult,
+    AuthErrorCode,
+    IAuthProvider,
+    IAuthContext,
+    AuthConnectionData,
+    AuthConnection,
+    AuthApiContext,
+    AuthMsgContext,
+    ConnectionRequest,
+    AuthServerConfig,
+    AuthGameServer,
+    AuthRoomConfig,
+    RequireAuthOptions,
+    RequireRoleOptions
+} from './types.js';
+
+// Context
+export {
+    AuthContext,
+    createGuestContext,
+    createAuthContext,
+    defaultUserExtractor,
+    type UserInfoExtractor
+} from './context.js';
+
+// Providers
+export {
+    JwtAuthProvider,
+    createJwtAuthProvider,
+    type JwtAuthConfig,
+    type JwtPayload
+} from './providers/JwtAuthProvider.js';
+
+export {
+    SessionAuthProvider,
+    createSessionAuthProvider,
+    type SessionAuthConfig,
+    type SessionData,
+    type ISessionStorage
+} from './providers/SessionAuthProvider.js';
+
+// Mixins
+export {
+    withAuth,
+    getAuthContext,
+    setAuthContext,
+    requireAuthentication,
+    requireRole as requireRoleCheck
+} from './mixin/withAuth.js';
+
+export {
+    withRoomAuth,
+    AuthRoomBase,
+    type AuthPlayer,
+    type IAuthRoom,
+    type AuthRoomClass
+} from './mixin/withRoomAuth.js';
+
+// Decorators
+export {
+    requireAuth,
+    requireRole,
+    getAuthMetadata,
+    AUTH_METADATA_KEY,
+    type AuthMetadata
+} from './decorators/index.js';

packages/framework/server/src/auth/mixin/index.ts

@@ -0,0 +1,20 @@
+/**
+ * @zh 认证 Mixin
+ * @en Authentication mixins
+ */
+
+export {
+    withAuth,
+    getAuthContext,
+    setAuthContext,
+    requireAuthentication,
+    requireRole
+} from './withAuth.js';
+
+export {
+    withRoomAuth,
+    AuthRoomBase,
+    type AuthPlayer,
+    type IAuthRoom,
+    type AuthRoomClass
+} from './withRoomAuth.js';

packages/framework/server/src/auth/mixin/withAuth.ts

@@ -0,0 +1,221 @@
+/**
+ * @zh 服务器认证 Mixin
+ * @en Server authentication mixin
+ */
+
+import type { ServerConnection, GameServer } from '../../types/index.js';
+import type {
+    IAuthProvider,
+    AuthResult,
+    AuthServerConfig,
+    AuthGameServer,
+    IAuthContext,
+    ConnectionRequest
+} from '../types.js';
+import { AuthContext } from '../context.js';
+
+/**
+ * @zh 认证数据键
+ * @en Auth data key
+ */
+const AUTH_CONTEXT_KEY = Symbol('authContext');
+
+/**
+ * @zh 获取连接的认证上下文
+ * @en Get auth context for connection
+ */
+export function getAuthContext<TUser = unknown>(conn: ServerConnection): IAuthContext<TUser> | null {
+    const data = conn.data as Record<symbol, unknown>;
+    return (data[AUTH_CONTEXT_KEY] as IAuthContext<TUser>) ?? null;
+}
+
+/**
+ * @zh 设置连接的认证上下文
+ * @en Set auth context for connection
+ */
+export function setAuthContext<TUser = unknown>(conn: ServerConnection, context: IAuthContext<TUser>): void {
+    const data = conn.data as Record<symbol, unknown>;
+    data[AUTH_CONTEXT_KEY] = context;
+}
+
+/**
+ * @zh 包装服务器添加认证功能
+ * @en Wrap server with authentication functionality
+ *
+ * @zh 使用 mixin 模式为服务器添加认证能力，不修改原始服务器
+ * @en Uses mixin pattern to add authentication to server without modifying original
+ *
+ * @example
+ * ```typescript
+ * import { createServer } from '@esengine/server';
+ * import { withAuth, createJwtAuthProvider } from '@esengine/server/auth';
+ *
+ * const jwtProvider = createJwtAuthProvider({
+ *     secret: 'your-secret-key',
+ *     expiresIn: 3600,
+ * });
+ *
+ * const server = withAuth(await createServer({ port: 3000 }), {
+ *     provider: jwtProvider,
+ *     extractCredentials: (req) => {
+ *         const url = new URL(req.url, 'http://localhost');
+ *         return url.searchParams.get('token');
+ *     },
+ *     onAuthSuccess: (conn, user) => {
+ *         console.log(`User ${user.name} authenticated`);
+ *     },
+ *     onAuthFailure: (conn, error) => {
+ *         console.log(`Auth failed: ${error.error}`);
+ *     }
+ * });
+ *
+ * await server.start();
+ * ```
+ */
+export function withAuth<TUser = unknown>(
+    server: GameServer,
+    config: AuthServerConfig<TUser>
+): AuthGameServer<TUser> {
+    const {
+        provider,
+        extractCredentials,
+        autoAuthOnConnect = true,
+        disconnectOnAuthFailure = false,
+        onAuthSuccess,
+        onAuthFailure
+    } = config;
+
+    const originalConnections = server.connections;
+    const connectionAuthMap = new WeakMap<ServerConnection, AuthContext<TUser>>();
+
+    const authServer: AuthGameServer<TUser> = {
+        ...server,
+
+        get authProvider(): IAuthProvider<TUser> {
+            return provider;
+        },
+
+        async authenticate(
+            conn: ServerConnection,
+            credentials: unknown
+        ): Promise<AuthResult<TUser>> {
+            const result = await provider.verify(credentials as never);
+
+            let authContext = connectionAuthMap.get(conn);
+            if (!authContext) {
+                authContext = new AuthContext<TUser>();
+                connectionAuthMap.set(conn, authContext);
+                setAuthContext(conn, authContext);
+            }
+
+            if (result.success) {
+                authContext.setAuthenticated(result);
+                await onAuthSuccess?.(conn, result.user!);
+            } else {
+                authContext.clear();
+                await onAuthFailure?.(conn, result);
+            }
+
+            return result;
+        },
+
+        getAuthContext(conn: ServerConnection): IAuthContext<TUser> | null {
+            return connectionAuthMap.get(conn) ?? null;
+        },
+
+        get connections(): ReadonlyArray<ServerConnection> {
+            return originalConnections;
+        }
+    };
+
+    const originalOnConnect = (server as any)._onConnect;
+    (server as any)._onConnect = async (conn: ServerConnection, req?: unknown) => {
+        const authContext = new AuthContext<TUser>();
+        connectionAuthMap.set(conn, authContext);
+        setAuthContext(conn, authContext);
+
+        if (autoAuthOnConnect && extractCredentials && req) {
+            try {
+                const connReq = req as ConnectionRequest;
+                const credentials = await extractCredentials(connReq);
+
+                if (credentials) {
+                    const result = await provider.verify(credentials as never);
+
+                    if (result.success) {
+                        authContext.setAuthenticated(result);
+                        await onAuthSuccess?.(conn, result.user!);
+                    } else {
+                        await onAuthFailure?.(conn, result);
+
+                        if (disconnectOnAuthFailure) {
+                            (conn as any).close?.();
+                            return;
+                        }
+                    }
+                }
+            } catch (error) {
+                console.error('[Auth] Error during auto-authentication:', error);
+            }
+        }
+
+        if (originalOnConnect) {
+            await originalOnConnect(conn, req);
+        }
+    };
+
+    const originalOnDisconnect = (server as any)._onDisconnect;
+    (server as any)._onDisconnect = async (conn: ServerConnection) => {
+        connectionAuthMap.delete(conn);
+
+        if (originalOnDisconnect) {
+            await originalOnDisconnect(conn);
+        }
+    };
+
+    return authServer;
+}
+
+/**
+ * @zh 创建认证中间件
+ * @en Create authentication middleware
+ *
+ * @zh 用于在 API 处理器中检查认证状态
+ * @en Used to check authentication status in API handlers
+ */
+export function requireAuthentication<TUser = unknown>(
+    conn: ServerConnection,
+    options?: { errorMessage?: string }
+): IAuthContext<TUser> {
+    const auth = getAuthContext<TUser>(conn);
+
+    if (!auth || !auth.isAuthenticated) {
+        throw new Error(options?.errorMessage ?? 'Authentication required');
+    }
+
+    return auth;
+}
+
+/**
+ * @zh 创建角色检查中间件
+ * @en Create role check middleware
+ */
+export function requireRole<TUser = unknown>(
+    conn: ServerConnection,
+    roles: string | string[],
+    options?: { mode?: 'any' | 'all'; errorMessage?: string }
+): IAuthContext<TUser> {
+    const auth = requireAuthentication<TUser>(conn);
+    const roleArray = Array.isArray(roles) ? roles : [roles];
+    const mode = options?.mode ?? 'any';
+
+    const hasRole = mode === 'any'
+        ? auth.hasAnyRole(roleArray)
+        : auth.hasAllRoles(roleArray);
+
+    if (!hasRole) {
+        throw new Error(options?.errorMessage ?? 'Insufficient permissions');
+    }
+
+    return auth;
+}

packages/framework/server/src/auth/mixin/withRoomAuth.ts

@@ -0,0 +1,317 @@
+/**
+ * @zh 房间认证 Mixin
+ * @en Room authentication mixin
+ */
+
+import type { Room, Player } from '../../room/index.js';
+import type { IAuthContext, AuthRoomConfig } from '../types.js';
+import { getAuthContext } from './withAuth.js';
+import { createGuestContext } from '../context.js';
+
+/**
+ * @zh 带认证的玩家
+ * @en Player with authentication
+ */
+export interface AuthPlayer<TUser = unknown, TData = Record<string, unknown>> extends Player<TData> {
+    /**
+     * @zh 认证上下文
+     * @en Authentication context
+     */
+    readonly auth: IAuthContext<TUser>;
+
+    /**
+     * @zh 用户信息（快捷访问）
+     * @en User info (shortcut)
+     */
+    readonly user: TUser | null;
+}
+
+/**
+ * @zh 带认证的房间接口
+ * @en Room with authentication interface
+ */
+export interface IAuthRoom<TUser = unknown> {
+    /**
+     * @zh 认证钩子（在 onJoin 之前调用）
+     * @en Auth hook (called before onJoin)
+     */
+    onAuth?(player: AuthPlayer<TUser>): boolean | Promise<boolean>;
+
+    /**
+     * @zh 获取带认证信息的玩家
+     * @en Get player with auth info
+     */
+    getAuthPlayer(id: string): AuthPlayer<TUser> | undefined;
+
+    /**
+     * @zh 获取所有带认证信息的玩家
+     * @en Get all players with auth info
+     */
+    getAuthPlayers(): AuthPlayer<TUser>[];
+
+    /**
+     * @zh 按角色获取玩家
+     * @en Get players by role
+     */
+    getPlayersByRole(role: string): AuthPlayer<TUser>[];
+
+    /**
+     * @zh 按用户 ID 获取玩家
+     * @en Get player by user ID
+     */
+    getPlayerByUserId(userId: string): AuthPlayer<TUser> | undefined;
+}
+
+/**
+ * @zh 认证房间构造器类型
+ * @en Auth room constructor type
+ */
+export type AuthRoomClass<TUser = unknown> = new (...args: any[]) => Room & IAuthRoom<TUser>;
+
+/**
+ * @zh 玩家认证上下文存储
+ * @en Player auth context storage
+ */
+const playerAuthContexts = new WeakMap<Player, IAuthContext<unknown>>();
+
+/**
+ * @zh 包装玩家对象添加认证信息
+ * @en Wrap player object with auth info
+ */
+function wrapPlayerWithAuth<TUser>(player: Player, authContext: IAuthContext<TUser>): AuthPlayer<TUser> {
+    playerAuthContexts.set(player, authContext);
+
+    Object.defineProperty(player, 'auth', {
+        get: () => playerAuthContexts.get(player) ?? createGuestContext<TUser>(),
+        enumerable: true,
+        configurable: false
+    });
+
+    Object.defineProperty(player, 'user', {
+        get: () => (playerAuthContexts.get(player) as IAuthContext<TUser> | undefined)?.user ?? null,
+        enumerable: true,
+        configurable: false
+    });
+
+    return player as AuthPlayer<TUser>;
+}
+
+/**
+ * @zh 包装房间类添加认证功能
+ * @en Wrap room class with authentication functionality
+ *
+ * @zh 使用 mixin 模式为房间添加认证检查，在玩家加入前验证认证状态
+ * @en Uses mixin pattern to add auth checks to room, validates auth before player joins
+ *
+ * @example
+ * ```typescript
+ * import { Room, onMessage } from '@esengine/server';
+ * import { withRoomAuth, type AuthPlayer } from '@esengine/server/auth';
+ *
+ * interface User {
+ *     id: string;
+ *     name: string;
+ *     roles: string[];
+ * }
+ *
+ * class GameRoom extends withRoomAuth<User>(Room, {
+ *     requireAuth: true,
+ *     allowedRoles: ['player', 'premium'],
+ * }) {
+ *     onJoin(player: AuthPlayer<User>) {
+ *         console.log(`${player.user?.name} joined the game`);
+ *         this.broadcast('PlayerJoined', {
+ *             id: player.id,
+ *             name: player.user?.name
+ *         });
+ *     }
+ *
+ *     // Optional: custom auth validation
+ *     async onAuth(player: AuthPlayer<User>): Promise<boolean> {
+ *         // Additional validation logic
+ *         if (player.auth.hasRole('banned')) {
+ *             return false;
+ *         }
+ *         return true;
+ *     }
+ *
+ *     @onMessage('Chat')
+ *     handleChat(data: { text: string }, player: AuthPlayer<User>) {
+ *         this.broadcast('Chat', {
+ *             from: player.user?.name ?? 'Guest',
+ *             text: data.text
+ *         });
+ *     }
+ * }
+ * ```
+ */
+export function withRoomAuth<TUser = unknown, TBase extends new (...args: any[]) => Room = new (...args: any[]) => Room>(
+    Base: TBase,
+    config: AuthRoomConfig = {}
+): TBase & (new (...args: any[]) => IAuthRoom<TUser>) {
+    const {
+        requireAuth = true,
+        allowedRoles = [],
+        roleCheckMode = 'any'
+    } = config;
+
+    abstract class AuthRoom extends (Base as new (...args: any[]) => Room) implements IAuthRoom<TUser> {
+        private _originalOnJoin: ((player: Player) => void | Promise<void>) | undefined;
+
+        constructor(...args: any[]) {
+            super(...args);
+            this._originalOnJoin = this.onJoin?.bind(this);
+            this.onJoin = this._authOnJoin.bind(this);
+        }
+
+        /**
+         * @zh 认证钩子（可覆盖）
+         * @en Auth hook (can be overridden)
+         */
+        onAuth?(player: AuthPlayer<TUser>): boolean | Promise<boolean>;
+
+        /**
+         * @zh 包装的 onJoin 方法
+         * @en Wrapped onJoin method
+         */
+        private async _authOnJoin(player: Player): Promise<void> {
+            const conn = (player as any).connection ?? (player as any)._conn;
+            const authContext = conn
+                ? (getAuthContext<TUser>(conn) ?? createGuestContext<TUser>())
+                : createGuestContext<TUser>();
+
+            if (requireAuth && !authContext.isAuthenticated) {
+                console.warn(`[AuthRoom] Rejected unauthenticated player: ${player.id}`);
+                this.kick(player as any, 'Authentication required');
+                return;
+            }
+
+            if (allowedRoles.length > 0) {
+                const hasRole = roleCheckMode === 'any'
+                    ? authContext.hasAnyRole(allowedRoles)
+                    : authContext.hasAllRoles(allowedRoles);
+
+                if (!hasRole) {
+                    console.warn(`[AuthRoom] Rejected player ${player.id}: insufficient roles`);
+                    this.kick(player as any, 'Insufficient permissions');
+                    return;
+                }
+            }
+
+            const authPlayer = wrapPlayerWithAuth<TUser>(player, authContext);
+
+            if (typeof this.onAuth === 'function') {
+                try {
+                    const allowed = await this.onAuth(authPlayer);
+                    if (!allowed) {
+                        console.warn(`[AuthRoom] Rejected player ${player.id}: onAuth returned false`);
+                        this.kick(player as any, 'Authentication rejected');
+                        return;
+                    }
+                } catch (error) {
+                    console.error(`[AuthRoom] Error in onAuth for player ${player.id}:`, error);
+                    this.kick(player as any, 'Authentication error');
+                    return;
+                }
+            }
+
+            if (this._originalOnJoin) {
+                await this._originalOnJoin(authPlayer as unknown as Player);
+            }
+        }
+
+        /**
+         * @zh 获取带认证信息的玩家
+         * @en Get player with auth info
+         */
+        getAuthPlayer(id: string): AuthPlayer<TUser> | undefined {
+            const player = this.getPlayer(id);
+            return player as AuthPlayer<TUser> | undefined;
+        }
+
+        /**
+         * @zh 获取所有带认证信息的玩家
+         * @en Get all players with auth info
+         */
+        getAuthPlayers(): AuthPlayer<TUser>[] {
+            return this.players as AuthPlayer<TUser>[];
+        }
+
+        /**
+         * @zh 按角色获取玩家
+         * @en Get players by role
+         */
+        getPlayersByRole(role: string): AuthPlayer<TUser>[] {
+            return this.getAuthPlayers().filter(p => p.auth?.hasRole(role));
+        }
+
+        /**
+         * @zh 按用户 ID 获取玩家
+         * @en Get player by user ID
+         */
+        getPlayerByUserId(userId: string): AuthPlayer<TUser> | undefined {
+            return this.getAuthPlayers().find(p => p.auth?.userId === userId);
+        }
+    }
+
+    return AuthRoom as unknown as TBase & (new (...args: any[]) => IAuthRoom<TUser>);
+}
+
+/**
+ * @zh 抽象认证房间基类
+ * @en Abstract auth room base class
+ *
+ * @zh 如果不想使用 mixin，可以直接继承此类
+ * @en If you don't want to use mixin, you can extend this class directly
+ *
+ * @example
+ * ```typescript
+ * import { AuthRoomBase } from '@esengine/server/auth';
+ *
+ * class GameRoom extends AuthRoomBase<User> {
+ *     protected readonly authConfig = {
+ *         requireAuth: true,
+ *         allowedRoles: ['player']
+ *     };
+ *
+ *     onJoin(player: AuthPlayer<User>) {
+ *         // player has .auth and .user properties
+ *     }
+ * }
+ * ```
+ */
+export abstract class AuthRoomBase<TUser = unknown, TState = any, TPlayerData = Record<string, unknown>>
+    implements IAuthRoom<TUser> {
+
+    /**
+     * @zh 认证配置（子类可覆盖）
+     * @en Auth config (can be overridden by subclass)
+     */
+    protected readonly authConfig: AuthRoomConfig = {
+        requireAuth: true,
+        allowedRoles: [],
+        roleCheckMode: 'any'
+    };
+
+    /**
+     * @zh 认证钩子
+     * @en Auth hook
+     */
+    onAuth?(player: AuthPlayer<TUser>): boolean | Promise<boolean>;
+
+    getAuthPlayer(id: string): AuthPlayer<TUser> | undefined {
+        return undefined;
+    }
+
+    getAuthPlayers(): AuthPlayer<TUser>[] {
+        return [];
+    }
+
+    getPlayersByRole(role: string): AuthPlayer<TUser>[] {
+        return [];
+    }
+
+    getPlayerByUserId(userId: string): AuthPlayer<TUser> | undefined {
+        return undefined;
+    }
+}

packages/framework/server/src/auth/providers/IAuthProvider.ts

@@ -0,0 +1,6 @@
+/**
+ * @zh 认证提供者接口
+ * @en Authentication provider interface
+ */
+
+export type { IAuthProvider, AuthResult, AuthErrorCode } from '../types.js';

packages/framework/server/src/auth/providers/JwtAuthProvider.ts

@@ -0,0 +1,253 @@
+/**
+ * @zh JWT 认证提供者
+ * @en JWT authentication provider
+ */
+
+import type { IAuthProvider, AuthResult, AuthErrorCode } from '../types.js';
+import * as jwt from 'jsonwebtoken';
+
+/**
+ * @zh JWT 载荷
+ * @en JWT payload
+ */
+export interface JwtPayload {
+    /**
+     * @zh 主题（用户 ID）
+     * @en Subject (user ID)
+     */
+    sub?: string;
+
+    /**
+     * @zh 签发时间
+     * @en Issued at
+     */
+    iat?: number;
+
+    /**
+     * @zh 过期时间
+     * @en Expiration time
+     */
+    exp?: number;
+
+    /**
+     * @zh 自定义字段
+     * @en Custom fields
+     */
+    [key: string]: unknown;
+}
+
+/**
+ * @zh JWT 认证配置
+ * @en JWT authentication configuration
+ */
+export interface JwtAuthConfig<TUser = unknown> {
+    /**
+     * @zh 密钥
+     * @en Secret key
+     */
+    secret: string;
+
+    /**
+     * @zh 算法
+     * @en Algorithm
+     * @defaultValue 'HS256'
+     */
+    algorithm?: 'HS256' | 'HS384' | 'HS512' | 'RS256' | 'RS384' | 'RS512';
+
+    /**
+     * @zh 令牌过期时间（秒）
+     * @en Token expiration in seconds
+     * @defaultValue 3600
+     */
+    expiresIn?: number;
+
+    /**
+     * @zh 从载荷获取用户信息
+     * @en Get user from payload
+     */
+    getUser?: (payload: JwtPayload) => TUser | Promise<TUser | null> | null;
+
+    /**
+     * @zh 签发者
+     * @en Issuer
+     */
+    issuer?: string;
+
+    /**
+     * @zh 受众
+     * @en Audience
+     */
+    audience?: string;
+}
+
+/**
+ * @zh JWT 认证提供者
+ * @en JWT authentication provider
+ *
+ * @zh 使用 jsonwebtoken 库实现 JWT 认证
+ * @en Uses jsonwebtoken library for JWT authentication
+ *
+ * @example
+ * ```typescript
+ * const jwtProvider = createJwtAuthProvider({
+ *     secret: 'your-secret-key',
+ *     expiresIn: 3600,
+ *     getUser: async (payload) => {
+ *         return await db.users.findById(payload.sub);
+ *     }
+ * });
+ * ```
+ */
+export class JwtAuthProvider<TUser = unknown> implements IAuthProvider<TUser, string> {
+    readonly name = 'jwt';
+
+    private _config: Required<Pick<JwtAuthConfig<TUser>, 'secret' | 'algorithm' | 'expiresIn'>> & JwtAuthConfig<TUser>;
+
+    constructor(config: JwtAuthConfig<TUser>) {
+        this._config = {
+            algorithm: 'HS256',
+            expiresIn: 3600,
+            ...config
+        };
+    }
+
+    /**
+     * @zh 验证令牌
+     * @en Verify token
+     */
+    async verify(token: string): Promise<AuthResult<TUser>> {
+        if (!token) {
+            return {
+                success: false,
+                error: 'Token is required',
+                errorCode: 'INVALID_TOKEN'
+            };
+        }
+
+        try {
+            const verifyOptions: jwt.VerifyOptions = {
+                algorithms: [this._config.algorithm]
+            };
+            if (this._config.issuer) {
+                verifyOptions.issuer = this._config.issuer;
+            }
+            if (this._config.audience) {
+                verifyOptions.audience = this._config.audience;
+            }
+            const payload = jwt.verify(token, this._config.secret, verifyOptions) as JwtPayload;
+
+            let user: TUser | null = null;
+
+            if (this._config.getUser) {
+                user = await this._config.getUser(payload);
+                if (!user) {
+                    return {
+                        success: false,
+                        error: 'User not found',
+                        errorCode: 'USER_NOT_FOUND'
+                    };
+                }
+            } else {
+                user = payload as unknown as TUser;
+            }
+
+            return {
+                success: true,
+                user,
+                token,
+                expiresAt: payload.exp ? payload.exp * 1000 : undefined
+            };
+        } catch (error) {
+            const err = error as Error;
+
+            if (err.name === 'TokenExpiredError') {
+                return {
+                    success: false,
+                    error: 'Token has expired',
+                    errorCode: 'EXPIRED_TOKEN'
+                };
+            }
+
+            return {
+                success: false,
+                error: err.message || 'Invalid token',
+                errorCode: 'INVALID_TOKEN'
+            };
+        }
+    }
+
+    /**
+     * @zh 刷新令牌
+     * @en Refresh token
+     */
+    async refresh(token: string): Promise<AuthResult<TUser>> {
+        const result = await this.verify(token);
+
+        if (!result.success || !result.user) {
+            return result;
+        }
+
+        const payload = jwt.decode(token) as JwtPayload;
+
+        // Remove JWT standard claims that will be regenerated
+        const { iat, exp, nbf, ...restPayload } = payload;
+
+        const newToken = this.sign(restPayload);
+
+        return {
+            success: true,
+            user: result.user,
+            token: newToken,
+            expiresAt: Date.now() + this._config.expiresIn * 1000
+        };
+    }
+
+    /**
+     * @zh 生成令牌
+     * @en Generate token
+     */
+    sign(payload: Record<string, unknown>): string {
+        const signOptions: jwt.SignOptions = {
+            algorithm: this._config.algorithm,
+            expiresIn: this._config.expiresIn
+        };
+        if (this._config.issuer) {
+            signOptions.issuer = this._config.issuer;
+        }
+        if (this._config.audience) {
+            signOptions.audience = this._config.audience;
+        }
+        return jwt.sign(payload, this._config.secret, signOptions);
+    }
+
+    /**
+     * @zh 解码令牌（不验证）
+     * @en Decode token (without verification)
+     */
+    decode(token: string): JwtPayload | null {
+        return jwt.decode(token) as JwtPayload | null;
+    }
+}
+
+/**
+ * @zh 创建 JWT 认证提供者
+ * @en Create JWT authentication provider
+ *
+ * @example
+ * ```typescript
+ * import { createJwtAuthProvider } from '@esengine/server/auth';
+ *
+ * const jwtProvider = createJwtAuthProvider({
+ *     secret: process.env.JWT_SECRET!,
+ *     expiresIn: 3600,
+ *     getUser: async (payload) => {
+ *         return { id: payload.sub, name: payload.name };
+ *     }
+ * });
+ * ```
+ */
+export function createJwtAuthProvider<TUser = unknown>(
+    config: JwtAuthConfig<TUser>
+): JwtAuthProvider<TUser> {
+    return new JwtAuthProvider<TUser>(config);
+}

packages/framework/server/src/auth/providers/SessionAuthProvider.ts

@@ -0,0 +1,292 @@
+/**
+ * @zh Session 认证提供者
+ * @en Session authentication provider
+ */
+
+import { randomBytes } from 'crypto';
+import type { IAuthProvider, AuthResult } from '../types.js';
+
+/**
+ * @zh Session 存储接口（兼容 ITransactionStorage）
+ * @en Session storage interface (compatible with ITransactionStorage)
+ */
+export interface ISessionStorage {
+    get<T>(key: string): Promise<T | null>;
+    set<T>(key: string, value: T, ttl?: number): Promise<void>;
+    delete(key: string): Promise<boolean>;
+}
+
+/**
+ * @zh Session 数据
+ * @en Session data
+ */
+export interface SessionData<TUser = unknown> {
+    /**
+     * @zh 用户信息
+     * @en User information
+     */
+    user: TUser;
+
+    /**
+     * @zh 创建时间
+     * @en Created at
+     */
+    createdAt: number;
+
+    /**
+     * @zh 最后活跃时间
+     * @en Last active at
+     */
+    lastActiveAt: number;
+
+    /**
+     * @zh 自定义数据
+     * @en Custom data
+     */
+    data?: Record<string, unknown>;
+}
+
+/**
+ * @zh Session 认证配置
+ * @en Session authentication configuration
+ */
+export interface SessionAuthConfig<TUser = unknown> {
+    /**
+     * @zh Session 存储
+     * @en Session storage
+     */
+    storage: ISessionStorage;
+
+    /**
+     * @zh Session 过期时间（毫秒）
+     * @en Session expiration in milliseconds
+     * @defaultValue 86400000 (24h)
+     */
+    sessionTTL?: number;
+
+    /**
+     * @zh Session 键前缀
+     * @en Session key prefix
+     * @defaultValue 'session:'
+     */
+    prefix?: string;
+
+    /**
+     * @zh 验证用户（可选额外验证）
+     * @en Validate user (optional extra validation)
+     */
+    validateUser?: (user: TUser) => boolean | Promise<boolean>;
+
+    /**
+     * @zh 是否自动续期
+     * @en Auto renew session
+     * @defaultValue true
+     */
+    autoRenew?: boolean;
+}
+
+/**
+ * @zh Session 认证提供者
+ * @en Session authentication provider
+ *
+ * @zh 基于存储的会话认证，支持 Redis、MongoDB 等后端
+ * @en Storage-based session authentication, supports Redis, MongoDB, etc.
+ *
+ * @example
+ * ```typescript
+ * import { createSessionAuthProvider } from '@esengine/server/auth';
+ * import { createRedisStorage } from '@esengine/transaction';
+ *
+ * const sessionProvider = createSessionAuthProvider({
+ *     storage: createRedisStorage({ factory: () => new Redis() }),
+ *     sessionTTL: 86400000, // 24 hours
+ * });
+ * ```
+ */
+export class SessionAuthProvider<TUser = unknown> implements IAuthProvider<TUser, string> {
+    readonly name = 'session';
+
+    private _config: Required<Pick<SessionAuthConfig<TUser>, 'sessionTTL' | 'prefix' | 'autoRenew'>> & SessionAuthConfig<TUser>;
+
+    constructor(config: SessionAuthConfig<TUser>) {
+        this._config = {
+            sessionTTL: 86400000,
+            prefix: 'session:',
+            autoRenew: true,
+            ...config
+        };
+    }
+
+    /**
+     * @zh 获取存储键
+     * @en Get storage key
+     */
+    private _getKey(sessionId: string): string {
+        return `${this._config.prefix}${sessionId}`;
+    }
+
+    /**
+     * @zh 验证 Session
+     * @en Verify session
+     */
+    async verify(sessionId: string): Promise<AuthResult<TUser>> {
+        if (!sessionId) {
+            return {
+                success: false,
+                error: 'Session ID is required',
+                errorCode: 'INVALID_TOKEN'
+            };
+        }
+
+        const key = this._getKey(sessionId);
+        const session = await this._config.storage.get<SessionData<TUser>>(key);
+
+        if (!session) {
+            return {
+                success: false,
+                error: 'Session not found or expired',
+                errorCode: 'EXPIRED_TOKEN'
+            };
+        }
+
+        if (this._config.validateUser) {
+            const isValid = await this._config.validateUser(session.user);
+            if (!isValid) {
+                return {
+                    success: false,
+                    error: 'User validation failed',
+                    errorCode: 'ACCOUNT_DISABLED'
+                };
+            }
+        }
+
+        if (this._config.autoRenew) {
+            session.lastActiveAt = Date.now();
+            await this._config.storage.set(key, session, this._config.sessionTTL);
+        }
+
+        return {
+            success: true,
+            user: session.user,
+            token: sessionId,
+            expiresAt: session.createdAt + this._config.sessionTTL
+        };
+    }
+
+    /**
+     * @zh 刷新 Session
+     * @en Refresh session
+     */
+    async refresh(sessionId: string): Promise<AuthResult<TUser>> {
+        const result = await this.verify(sessionId);
+
+        if (!result.success) {
+            return result;
+        }
+
+        const key = this._getKey(sessionId);
+        const session = await this._config.storage.get<SessionData<TUser>>(key);
+
+        if (session) {
+            session.lastActiveAt = Date.now();
+            await this._config.storage.set(key, session, this._config.sessionTTL);
+        }
+
+        return {
+            ...result,
+            expiresAt: Date.now() + this._config.sessionTTL
+        };
+    }
+
+    /**
+     * @zh 撤销 Session
+     * @en Revoke session
+     */
+    async revoke(sessionId: string): Promise<boolean> {
+        const key = this._getKey(sessionId);
+        return await this._config.storage.delete(key);
+    }
+
+    /**
+     * @zh 创建 Session
+     * @en Create session
+     */
+    async createSession(user: TUser, data?: Record<string, unknown>): Promise<string> {
+        const sessionId = this._generateSessionId();
+        const key = this._getKey(sessionId);
+
+        const session: SessionData<TUser> = {
+            user,
+            createdAt: Date.now(),
+            lastActiveAt: Date.now(),
+            data
+        };
+
+        await this._config.storage.set(key, session, this._config.sessionTTL);
+
+        return sessionId;
+    }
+
+    /**
+     * @zh 获取 Session 数据
+     * @en Get session data
+     */
+    async getSession(sessionId: string): Promise<SessionData<TUser> | null> {
+        const key = this._getKey(sessionId);
+        return await this._config.storage.get<SessionData<TUser>>(key);
+    }
+
+    /**
+     * @zh 更新 Session 数据
+     * @en Update session data
+     */
+    async updateSession(sessionId: string, data: Record<string, unknown>): Promise<boolean> {
+        const key = this._getKey(sessionId);
+        const session = await this._config.storage.get<SessionData<TUser>>(key);
+
+        if (!session) {
+            return false;
+        }
+
+        session.data = { ...session.data, ...data };
+        session.lastActiveAt = Date.now();
+        await this._config.storage.set(key, session, this._config.sessionTTL);
+
+        return true;
+    }
+
+    /**
+     * @zh 生成 Session ID（使用加密安全的随机数）
+     * @en Generate session ID (using cryptographically secure random)
+     */
+    private _generateSessionId(): string {
+        return randomBytes(32).toString('hex');
+    }
+}
+
+/**
+ * @zh 创建 Session 认证提供者
+ * @en Create session authentication provider
+ *
+ * @example
+ * ```typescript
+ * import { createSessionAuthProvider } from '@esengine/server/auth';
+ * import { MemoryStorage } from '@esengine/transaction';
+ *
+ * const sessionProvider = createSessionAuthProvider({
+ *     storage: new MemoryStorage(),
+ *     sessionTTL: 3600000, // 1 hour
+ * });
+ *
+ * // Create a session
+ * const sessionId = await sessionProvider.createSession({ id: '1', name: 'Alice' });
+ *
+ * // Verify session
+ * const result = await sessionProvider.verify(sessionId);
+ * ```
+ */
+export function createSessionAuthProvider<TUser = unknown>(
+    config: SessionAuthConfig<TUser>
+): SessionAuthProvider<TUser> {
+    return new SessionAuthProvider<TUser>(config);
+}

packages/framework/server/src/auth/providers/index.ts

@@ -0,0 +1,8 @@
+/**
+ * @zh 认证提供者
+ * @en Authentication providers
+ */
+
+export type { IAuthProvider, AuthResult, AuthErrorCode } from './IAuthProvider.js';
+export { JwtAuthProvider, createJwtAuthProvider, type JwtAuthConfig, type JwtPayload } from './JwtAuthProvider.js';
+export { SessionAuthProvider, createSessionAuthProvider, type SessionAuthConfig, type SessionData, type ISessionStorage } from './SessionAuthProvider.js';

packages/framework/server/src/auth/testing/MockAuthProvider.ts

@@ -0,0 +1,278 @@
+/**
+ * @zh 模拟认证提供者
+ * @en Mock authentication provider
+ */
+
+import type { IAuthProvider, AuthResult, AuthErrorCode } from '../types.js';
+
+/**
+ * @zh 模拟用户
+ * @en Mock user
+ */
+export interface MockUser {
+    id: string;
+    name?: string;
+    roles?: string[];
+    [key: string]: unknown;
+}
+
+/**
+ * @zh 模拟认证配置
+ * @en Mock authentication configuration
+ */
+export interface MockAuthConfig {
+    /**
+     * @zh 预设用户列表
+     * @en Preset user list
+     */
+    users?: MockUser[];
+
+    /**
+     * @zh 默认用户（无 token 时返回）
+     * @en Default user (returned when no token)
+     */
+    defaultUser?: MockUser;
+
+    /**
+     * @zh 模拟延迟（毫秒）
+     * @en Simulated delay (ms)
+     */
+    delay?: number;
+
+    /**
+     * @zh 是否自动创建用户
+     * @en Auto create users
+     */
+    autoCreate?: boolean;
+
+    /**
+     * @zh 验证令牌格式
+     * @en Token format validator
+     */
+    validateToken?: (token: string) => boolean;
+}
+
+/**
+ * @zh 模拟认证提供者
+ * @en Mock authentication provider
+ *
+ * @zh 用于测试的认证提供者，不需要真实的 JWT 或数据库
+ * @en Authentication provider for testing, no real JWT or database required
+ *
+ * @example
+ * ```typescript
+ * import { createMockAuthProvider } from '@esengine/server/auth/testing';
+ *
+ * const mockProvider = createMockAuthProvider({
+ *     users: [
+ *         { id: '1', name: 'Alice', roles: ['player'] },
+ *         { id: '2', name: 'Bob', roles: ['admin'] },
+ *     ],
+ *     autoCreate: true, // Unknown tokens create guest users
+ * });
+ *
+ * // Verify with user ID as token
+ * const result = await mockProvider.verify('1');
+ * // result.user = { id: '1', name: 'Alice', roles: ['player'] }
+ * ```
+ */
+export class MockAuthProvider<TUser extends MockUser = MockUser>
+    implements IAuthProvider<TUser, string> {
+
+    readonly name = 'mock';
+
+    private _users: Map<string, TUser>;
+    private _config: MockAuthConfig;
+    private _revokedTokens: Set<string> = new Set();
+
+    constructor(config: MockAuthConfig = {}) {
+        this._config = config;
+        this._users = new Map();
+
+        if (config.users) {
+            for (const user of config.users) {
+                this._users.set(user.id, user as TUser);
+            }
+        }
+    }
+
+    /**
+     * @zh 模拟延迟
+     * @en Simulate delay
+     */
+    private async _delay(): Promise<void> {
+        if (this._config.delay && this._config.delay > 0) {
+            await new Promise(resolve => setTimeout(resolve, this._config.delay));
+        }
+    }
+
+    /**
+     * @zh 验证令牌
+     * @en Verify token
+     */
+    async verify(token: string): Promise<AuthResult<TUser>> {
+        await this._delay();
+
+        if (!token) {
+            if (this._config.defaultUser) {
+                return {
+                    success: true,
+                    user: this._config.defaultUser as TUser,
+                    token: 'default'
+                };
+            }
+            return {
+                success: false,
+                error: 'Token is required',
+                errorCode: 'INVALID_TOKEN'
+            };
+        }
+
+        if (this._revokedTokens.has(token)) {
+            return {
+                success: false,
+                error: 'Token has been revoked',
+                errorCode: 'INVALID_TOKEN'
+            };
+        }
+
+        if (this._config.validateToken && !this._config.validateToken(token)) {
+            return {
+                success: false,
+                error: 'Invalid token format',
+                errorCode: 'INVALID_TOKEN'
+            };
+        }
+
+        const user = this._users.get(token);
+
+        if (user) {
+            return {
+                success: true,
+                user,
+                token,
+                expiresAt: Date.now() + 3600000
+            };
+        }
+
+        if (this._config.autoCreate) {
+            const newUser = {
+                id: token,
+                name: `User_${token}`,
+                roles: ['guest']
+            } as TUser;
+
+            this._users.set(token, newUser);
+
+            return {
+                success: true,
+                user: newUser,
+                token,
+                expiresAt: Date.now() + 3600000
+            };
+        }
+
+        return {
+            success: false,
+            error: 'User not found',
+            errorCode: 'USER_NOT_FOUND'
+        };
+    }
+
+    /**
+     * @zh 刷新令牌
+     * @en Refresh token
+     */
+    async refresh(token: string): Promise<AuthResult<TUser>> {
+        return this.verify(token);
+    }
+
+    /**
+     * @zh 撤销令牌
+     * @en Revoke token
+     */
+    async revoke(token: string): Promise<boolean> {
+        this._revokedTokens.add(token);
+        return true;
+    }
+
+    /**
+     * @zh 添加用户
+     * @en Add user
+     */
+    addUser(user: TUser): void {
+        this._users.set(user.id, user);
+    }
+
+    /**
+     * @zh 移除用户
+     * @en Remove user
+     */
+    removeUser(id: string): boolean {
+        return this._users.delete(id);
+    }
+
+    /**
+     * @zh 获取用户
+     * @en Get user
+     */
+    getUser(id: string): TUser | undefined {
+        return this._users.get(id);
+    }
+
+    /**
+     * @zh 获取所有用户
+     * @en Get all users
+     */
+    getUsers(): TUser[] {
+        return Array.from(this._users.values());
+    }
+
+    /**
+     * @zh 清空所有状态
+     * @en Clear all state
+     */
+    clear(): void {
+        this._users.clear();
+        this._revokedTokens.clear();
+
+        if (this._config.users) {
+            for (const user of this._config.users) {
+                this._users.set(user.id, user as TUser);
+            }
+        }
+    }
+
+    /**
+     * @zh 生成测试令牌
+     * @en Generate test token
+     */
+    generateToken(userId: string): string {
+        return userId;
+    }
+}
+
+/**
+ * @zh 创建模拟认证提供者
+ * @en Create mock authentication provider
+ *
+ * @example
+ * ```typescript
+ * const provider = createMockAuthProvider({
+ *     users: [
+ *         { id: 'admin', name: 'Admin', roles: ['admin'] }
+ *     ]
+ * });
+ *
+ * // Use in tests
+ * const server = withAuth(await createServer({ port: 0 }), {
+ *     provider,
+ *     extractCredentials: (req) => req.headers['x-token']
+ * });
+ * ```
+ */
+export function createMockAuthProvider<TUser extends MockUser = MockUser>(
+    config?: MockAuthConfig
+): MockAuthProvider<TUser> {
+    return new MockAuthProvider<TUser>(config);
+}

packages/framework/server/src/auth/testing/index.ts

@@ -0,0 +1,11 @@
+/**
+ * @zh 认证测试工具
+ * @en Authentication testing utilities
+ */
+
+export {
+    MockAuthProvider,
+    createMockAuthProvider,
+    type MockUser,
+    type MockAuthConfig
+} from './MockAuthProvider.js';

packages/framework/server/src/auth/types.ts

@@ -0,0 +1,400 @@
+/**
+ * @zh 认证系统类型定义
+ * @en Authentication system type definitions
+ */
+
+import type { ServerConnection, ApiContext, MsgContext, GameServer } from '../types/index.js';
+
+// ============================================================================
+// Error Codes
+// ============================================================================
+
+/**
+ * @zh 认证错误代码
+ * @en Authentication error codes
+ */
+export type AuthErrorCode =
+    | 'INVALID_CREDENTIALS'
+    | 'EXPIRED_TOKEN'
+    | 'INVALID_TOKEN'
+    | 'USER_NOT_FOUND'
+    | 'ACCOUNT_DISABLED'
+    | 'RATE_LIMITED'
+    | 'INSUFFICIENT_PERMISSIONS';
+
+// ============================================================================
+// Auth Result
+// ============================================================================
+
+/**
+ * @zh 认证结果
+ * @en Authentication result
+ */
+export interface AuthResult<TUser = unknown> {
+    /**
+     * @zh 是否成功
+     * @en Whether succeeded
+     */
+    success: boolean;
+
+    /**
+     * @zh 用户信息
+     * @en User information
+     */
+    user?: TUser;
+
+    /**
+     * @zh 错误信息
+     * @en Error message
+     */
+    error?: string;
+
+    /**
+     * @zh 错误代码
+     * @en Error code
+     */
+    errorCode?: AuthErrorCode;
+
+    /**
+     * @zh 令牌
+     * @en Token
+     */
+    token?: string;
+
+    /**
+     * @zh 令牌过期时间（时间戳）
+     * @en Token expiration time (timestamp)
+     */
+    expiresAt?: number;
+}
+
+// ============================================================================
+// Auth Provider
+// ============================================================================
+
+/**
+ * @zh 认证提供者接口
+ * @en Authentication provider interface
+ */
+export interface IAuthProvider<TUser = unknown, TCredentials = unknown> {
+    /**
+     * @zh 提供者名称
+     * @en Provider name
+     */
+    readonly name: string;
+
+    /**
+     * @zh 验证凭证
+     * @en Verify credentials
+     *
+     * @param credentials - @zh 凭证数据 @en Credential data
+     * @returns @zh 验证结果 @en Verification result
+     */
+    verify(credentials: TCredentials): Promise<AuthResult<TUser>>;
+
+    /**
+     * @zh 刷新令牌（可选）
+     * @en Refresh token (optional)
+     */
+    refresh?(token: string): Promise<AuthResult<TUser>>;
+
+    /**
+     * @zh 撤销令牌（可选）
+     * @en Revoke token (optional)
+     */
+    revoke?(token: string): Promise<boolean>;
+}
+
+// ============================================================================
+// Auth Context
+// ============================================================================
+
+/**
+ * @zh 认证上下文接口
+ * @en Authentication context interface
+ */
+export interface IAuthContext<TUser = unknown> {
+    /**
+     * @zh 是否已认证
+     * @en Whether authenticated
+     */
+    readonly isAuthenticated: boolean;
+
+    /**
+     * @zh 用户信息
+     * @en User information
+     */
+    readonly user: TUser | null;
+
+    /**
+     * @zh 用户 ID
+     * @en User ID
+     */
+    readonly userId: string | null;
+
+    /**
+     * @zh 用户角色
+     * @en User roles
+     */
+    readonly roles: ReadonlyArray<string>;
+
+    /**
+     * @zh 认证时间
+     * @en Authentication timestamp
+     */
+    readonly authenticatedAt: number | null;
+
+    /**
+     * @zh 令牌过期时间
+     * @en Token expiration time
+     */
+    readonly expiresAt: number | null;
+
+    /**
+     * @zh 检查是否有指定角色
+     * @en Check if has specified role
+     */
+    hasRole(role: string): boolean;
+
+    /**
+     * @zh 检查是否有任一指定角色
+     * @en Check if has any of specified roles
+     */
+    hasAnyRole(roles: string[]): boolean;
+
+    /**
+     * @zh 检查是否有所有指定角色
+     * @en Check if has all specified roles
+     */
+    hasAllRoles(roles: string[]): boolean;
+}
+
+// ============================================================================
+// Auth Connection
+// ============================================================================
+
+/**
+ * @zh 认证连接数据
+ * @en Authentication connection data
+ */
+export interface AuthConnectionData<TUser = unknown> {
+    /**
+     * @zh 认证上下文
+     * @en Authentication context
+     */
+    auth: IAuthContext<TUser>;
+}
+
+/**
+ * @zh 带认证的连接
+ * @en Connection with authentication
+ */
+export interface AuthConnection<TUser = unknown, TData extends AuthConnectionData<TUser> = AuthConnectionData<TUser>>
+    extends ServerConnection<TData> {
+    /**
+     * @zh 认证上下文（快捷访问）
+     * @en Authentication context (shortcut)
+     */
+    readonly auth: IAuthContext<TUser>;
+}
+
+/**
+ * @zh 带认证的 API 上下文
+ * @en API context with authentication
+ */
+export interface AuthApiContext<TUser = unknown, TData extends AuthConnectionData<TUser> = AuthConnectionData<TUser>>
+    extends ApiContext<TData> {
+    /**
+     * @zh 当前连接（带认证）
+     * @en Current connection (with auth)
+     */
+    conn: AuthConnection<TUser, TData>;
+}
+
+/**
+ * @zh 带认证的消息上下文
+ * @en Message context with authentication
+ */
+export interface AuthMsgContext<TUser = unknown, TData extends AuthConnectionData<TUser> = AuthConnectionData<TUser>>
+    extends MsgContext<TData> {
+    /**
+     * @zh 当前连接（带认证）
+     * @en Current connection (with auth)
+     */
+    conn: AuthConnection<TUser, TData>;
+}
+
+// ============================================================================
+// Auth Server Config
+// ============================================================================
+
+/**
+ * @zh 连接请求信息
+ * @en Connection request info
+ */
+export interface ConnectionRequest {
+    /**
+     * @zh 请求 URL
+     * @en Request URL
+     */
+    url: string;
+
+    /**
+     * @zh 请求头
+     * @en Request headers
+     */
+    headers: Record<string, string | string[] | undefined>;
+
+    /**
+     * @zh 客户端 IP
+     * @en Client IP
+     */
+    ip: string;
+}
+
+/**
+ * @zh 认证服务器配置
+ * @en Authentication server configuration
+ */
+export interface AuthServerConfig<TUser = unknown> {
+    /**
+     * @zh 认证提供者
+     * @en Authentication provider
+     */
+    provider: IAuthProvider<TUser>;
+
+    /**
+     * @zh 从连接请求提取凭证
+     * @en Extract credentials from connection request
+     */
+    extractCredentials?: (req: ConnectionRequest) => unknown | Promise<unknown>;
+
+    /**
+     * @zh 连接时自动认证
+     * @en Auto authenticate on connection
+     * @defaultValue true
+     */
+    autoAuthOnConnect?: boolean;
+
+    /**
+     * @zh 未认证连接的宽限期（毫秒）
+     * @en Grace period for unauthenticated connections (ms)
+     * @defaultValue 30000
+     */
+    authGracePeriod?: number;
+
+    /**
+     * @zh 认证失败是否断开连接
+     * @en Disconnect on auth failure
+     * @defaultValue false
+     */
+    disconnectOnAuthFailure?: boolean;
+
+    /**
+     * @zh 认证成功回调
+     * @en Authentication success callback
+     */
+    onAuthSuccess?: (conn: ServerConnection, user: TUser) => void | Promise<void>;
+
+    /**
+     * @zh 认证失败回调
+     * @en Authentication failure callback
+     */
+    onAuthFailure?: (conn: ServerConnection, error: AuthResult<TUser>) => void | Promise<void>;
+}
+
+// ============================================================================
+// Auth Game Server
+// ============================================================================
+
+/**
+ * @zh 带认证的游戏服务器
+ * @en Game server with authentication
+ */
+export interface AuthGameServer<TUser = unknown> extends GameServer {
+    /**
+     * @zh 认证提供者
+     * @en Authentication provider
+     */
+    readonly authProvider: IAuthProvider<TUser>;
+
+    /**
+     * @zh 手动认证连接
+     * @en Manually authenticate connection
+     */
+    authenticate(
+        conn: ServerConnection,
+        credentials: unknown
+    ): Promise<AuthResult<TUser>>;
+
+    /**
+     * @zh 获取连接的认证上下文
+     * @en Get auth context for connection
+     */
+    getAuthContext(conn: ServerConnection): IAuthContext<TUser> | null;
+}
+
+// ============================================================================
+// Auth Room Config
+// ============================================================================
+
+/**
+ * @zh 带认证的房间配置
+ * @en Auth room configuration
+ */
+export interface AuthRoomConfig {
+    /**
+     * @zh 是否要求认证才能加入
+     * @en Require authentication to join
+     * @defaultValue true
+     */
+    requireAuth?: boolean;
+
+    /**
+     * @zh 允许的角色（空数组表示任意角色）
+     * @en Allowed roles (empty array means any role)
+     */
+    allowedRoles?: string[];
+
+    /**
+     * @zh 角色检查模式
+     * @en Role check mode
+     * @defaultValue 'any'
+     */
+    roleCheckMode?: 'any' | 'all';
+}
+
+// ============================================================================
+// Decorator Options
+// ============================================================================
+
+/**
+ * @zh requireAuth 装饰器选项
+ * @en requireAuth decorator options
+ */
+export interface RequireAuthOptions {
+    /**
+     * @zh 认证失败时的错误消息
+     * @en Error message on auth failure
+     */
+    errorMessage?: string;
+
+    /**
+     * @zh 是否允许访客
+     * @en Allow guest access
+     */
+    allowGuest?: boolean;
+}
+
+/**
+ * @zh requireRole 装饰器选项
+ * @en requireRole decorator options
+ */
+export interface RequireRoleOptions extends RequireAuthOptions {
+    /**
+     * @zh 角色检查模式
+     * @en Role check mode
+     * @defaultValue 'any'
+     */
+    mode?: 'any' | 'all';
+}

packages/framework/server/src/ratelimit/__tests__/context.test.ts

@@ -0,0 +1,142 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { RateLimitContext } from '../context';
+import { TokenBucketStrategy } from '../strategies/TokenBucket';
+import { FixedWindowStrategy } from '../strategies/FixedWindow';
+
+describe('RateLimitContext', () => {
+    let globalStrategy: TokenBucketStrategy;
+    let context: RateLimitContext;
+
+    beforeEach(() => {
+        globalStrategy = new TokenBucketStrategy({
+            rate: 10,
+            capacity: 20
+        });
+        context = new RateLimitContext('player-123', globalStrategy);
+    });
+
+    describe('check', () => {
+        it('should check without consuming', () => {
+            const result1 = context.check();
+            const result2 = context.check();
+
+            expect(result1.remaining).toBe(result2.remaining);
+        });
+
+        it('should use global strategy by default', () => {
+            const result = context.check();
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(20);
+        });
+    });
+
+    describe('consume', () => {
+        it('should consume from global strategy', () => {
+            const result = context.consume();
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(19);
+        });
+
+        it('should track consecutive limits', () => {
+            for (let i = 0; i < 25; i++) {
+                context.consume();
+            }
+
+            expect(context.consecutiveLimitCount).toBeGreaterThan(0);
+        });
+
+        it('should reset consecutive count on success', () => {
+            // Consume all 20 tokens plus some more to trigger rate limiting
+            for (let i = 0; i < 25; i++) {
+                context.consume();
+            }
+
+            // After consuming 25 tokens (20 capacity), 5 should be rate limited
+            expect(context.consecutiveLimitCount).toBeGreaterThan(0);
+
+            context.reset();
+            const result = context.consume();
+
+            expect(result.allowed).toBe(true);
+            expect(context.consecutiveLimitCount).toBe(0);
+        });
+    });
+
+    describe('reset', () => {
+        it('should reset global strategy', () => {
+            for (let i = 0; i < 15; i++) {
+                context.consume();
+            }
+
+            context.reset();
+
+            const status = context.check();
+            expect(status.remaining).toBe(20);
+        });
+
+        it('should reset specific message type', () => {
+            const msgStrategy = new FixedWindowStrategy({ rate: 5, capacity: 5 });
+            context.setMessageStrategy('Trade', msgStrategy);
+
+            for (let i = 0; i < 5; i++) {
+                context.consume('Trade');
+            }
+
+            context.reset('Trade');
+
+            const status = context.check('Trade');
+            expect(status.remaining).toBe(5);
+        });
+    });
+
+    describe('message strategies', () => {
+        it('should use message-specific strategy', () => {
+            const tradeStrategy = new FixedWindowStrategy({ rate: 1, capacity: 1 });
+            context.setMessageStrategy('Trade', tradeStrategy);
+
+            const result1 = context.consume('Trade');
+            expect(result1.allowed).toBe(true);
+
+            const result2 = context.consume('Trade');
+            expect(result2.allowed).toBe(false);
+        });
+
+        it('should fall back to global strategy for unknown types', () => {
+            const result = context.consume('UnknownType');
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(19);
+        });
+
+        it('should check if message strategy exists', () => {
+            expect(context.hasMessageStrategy('Trade')).toBe(false);
+
+            const tradeStrategy = new FixedWindowStrategy({ rate: 1, capacity: 1 });
+            context.setMessageStrategy('Trade', tradeStrategy);
+
+            expect(context.hasMessageStrategy('Trade')).toBe(true);
+        });
+
+        it('should remove message strategy', () => {
+            const tradeStrategy = new FixedWindowStrategy({ rate: 1, capacity: 1 });
+            context.setMessageStrategy('Trade', tradeStrategy);
+
+            context.removeMessageStrategy('Trade');
+
+            expect(context.hasMessageStrategy('Trade')).toBe(false);
+        });
+    });
+
+    describe('resetConsecutiveCount', () => {
+        it('should reset consecutive limit count', () => {
+            for (let i = 0; i < 25; i++) {
+                context.consume();
+            }
+
+            expect(context.consecutiveLimitCount).toBeGreaterThan(0);
+
+            context.resetConsecutiveCount();
+
+            expect(context.consecutiveLimitCount).toBe(0);
+        });
+    });
+});

packages/framework/server/src/ratelimit/__tests__/decorators.test.ts

@@ -0,0 +1,185 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import {
+    rateLimit,
+    noRateLimit,
+    rateLimitMessage,
+    noRateLimitMessage,
+    getRateLimitMetadata,
+    RATE_LIMIT_METADATA_KEY
+} from '../decorators/rateLimit';
+
+describe('rateLimitMessage decorator', () => {
+    class TestClass {
+        @rateLimitMessage('Trade', { messagesPerSecond: 1, burstSize: 2 })
+        handleTrade() {
+            return 'trade';
+        }
+
+        @rateLimitMessage('Move', { cost: 2 })
+        handleMove() {
+            return 'move';
+        }
+
+        undecorated() {
+            return 'undecorated';
+        }
+    }
+
+    describe('metadata storage', () => {
+        it('should store rate limit metadata on target', () => {
+            const metadata = getRateLimitMetadata(TestClass.prototype, 'Trade');
+            expect(metadata).toBeDefined();
+            expect(metadata?.enabled).toBe(true);
+        });
+
+        it('should store config in metadata', () => {
+            const metadata = getRateLimitMetadata(TestClass.prototype, 'Trade');
+            expect(metadata?.config?.messagesPerSecond).toBe(1);
+            expect(metadata?.config?.burstSize).toBe(2);
+        });
+
+        it('should store cost in metadata', () => {
+            const metadata = getRateLimitMetadata(TestClass.prototype, 'Move');
+            expect(metadata?.config?.cost).toBe(2);
+        });
+
+        it('should return undefined for unregistered message types', () => {
+            const metadata = getRateLimitMetadata(TestClass.prototype, 'Unknown');
+            expect(metadata).toBeUndefined();
+        });
+    });
+
+    describe('method behavior', () => {
+        it('should not alter method behavior', () => {
+            const instance = new TestClass();
+            expect(instance.handleTrade()).toBe('trade');
+            expect(instance.handleMove()).toBe('move');
+        });
+    });
+});
+
+describe('noRateLimitMessage decorator', () => {
+    class TestClass {
+        @noRateLimitMessage('Heartbeat')
+        handleHeartbeat() {
+            return 'heartbeat';
+        }
+
+        @noRateLimitMessage('Ping')
+        handlePing() {
+            return 'ping';
+        }
+    }
+
+    describe('metadata storage', () => {
+        it('should mark message as exempt', () => {
+            const metadata = getRateLimitMetadata(TestClass.prototype, 'Heartbeat');
+            expect(metadata?.exempt).toBe(true);
+            expect(metadata?.enabled).toBe(false);
+        });
+
+        it('should store for multiple messages', () => {
+            const heartbeatMeta = getRateLimitMetadata(TestClass.prototype, 'Heartbeat');
+            const pingMeta = getRateLimitMetadata(TestClass.prototype, 'Ping');
+
+            expect(heartbeatMeta?.exempt).toBe(true);
+            expect(pingMeta?.exempt).toBe(true);
+        });
+    });
+
+    describe('method behavior', () => {
+        it('should not alter method behavior', () => {
+            const instance = new TestClass();
+            expect(instance.handleHeartbeat()).toBe('heartbeat');
+            expect(instance.handlePing()).toBe('ping');
+        });
+    });
+});
+
+describe('combined decorators', () => {
+    class CombinedTestClass {
+        @rateLimitMessage('SlowAction', { messagesPerSecond: 1 })
+        handleSlow() {
+            return 'slow';
+        }
+
+        @noRateLimitMessage('FastAction')
+        handleFast() {
+            return 'fast';
+        }
+
+        @rateLimitMessage('ExpensiveAction', { cost: 10 })
+        handleExpensive() {
+            return 'expensive';
+        }
+    }
+
+    it('should handle multiple different decorators', () => {
+        const slowMeta = getRateLimitMetadata(CombinedTestClass.prototype, 'SlowAction');
+        const fastMeta = getRateLimitMetadata(CombinedTestClass.prototype, 'FastAction');
+        const expensiveMeta = getRateLimitMetadata(CombinedTestClass.prototype, 'ExpensiveAction');
+
+        expect(slowMeta?.enabled).toBe(true);
+        expect(slowMeta?.config?.messagesPerSecond).toBe(1);
+
+        expect(fastMeta?.exempt).toBe(true);
+        expect(fastMeta?.enabled).toBe(false);
+
+        expect(expensiveMeta?.enabled).toBe(true);
+        expect(expensiveMeta?.config?.cost).toBe(10);
+    });
+});
+
+describe('RATE_LIMIT_METADATA_KEY', () => {
+    it('should be a symbol', () => {
+        expect(typeof RATE_LIMIT_METADATA_KEY).toBe('symbol');
+    });
+
+    it('should be used for metadata storage', () => {
+        class TestClass {
+            @rateLimitMessage('Test', {})
+            handleTest() {}
+        }
+
+        const metadataMap = (TestClass.prototype as any)[RATE_LIMIT_METADATA_KEY];
+        expect(metadataMap).toBeInstanceOf(Map);
+    });
+});
+
+describe('rateLimit decorator (auto-detect)', () => {
+    it('should be a decorator function', () => {
+        expect(typeof rateLimit).toBe('function');
+        expect(typeof rateLimit()).toBe('function');
+    });
+
+    it('should accept config', () => {
+        class TestClass {
+            @rateLimit({ messagesPerSecond: 5 })
+            someMethod() {
+                return 'test';
+            }
+        }
+
+        const instance = new TestClass();
+        expect(instance.someMethod()).toBe('test');
+    });
+});
+
+describe('noRateLimit decorator (auto-detect)', () => {
+    it('should be a decorator function', () => {
+        expect(typeof noRateLimit).toBe('function');
+        expect(typeof noRateLimit()).toBe('function');
+    });
+
+    it('should work as decorator', () => {
+        class TestClass {
+            @noRateLimit()
+            someMethod() {
+                return 'test';
+            }
+        }
+
+        const instance = new TestClass();
+        expect(instance.someMethod()).toBe('test');
+    });
+});

packages/framework/server/src/ratelimit/__tests__/mixin.test.ts

@@ -0,0 +1,157 @@
+import { describe, it, expect, beforeEach, vi } from 'vitest';
+import { Room } from '../../room/Room';
+import { Player } from '../../room/Player';
+import { withRateLimit, getPlayerRateLimitContext } from '../mixin/withRateLimit';
+import { noRateLimitMessage, rateLimitMessage } from '../decorators/rateLimit';
+import { onMessage } from '../../room/decorators';
+
+describe('withRateLimit mixin', () => {
+    let RateLimitedRoom: ReturnType<typeof withRateLimit>;
+
+    beforeEach(() => {
+        RateLimitedRoom = withRateLimit(Room, {
+            messagesPerSecond: 10,
+            burstSize: 20
+        });
+    });
+
+    describe('basic functionality', () => {
+        it('should create a rate limited room class', () => {
+            expect(RateLimitedRoom).toBeDefined();
+        });
+
+        it('should have rateLimitStrategy property', () => {
+            class TestRoom extends RateLimitedRoom {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            expect(room.rateLimitStrategy).toBeDefined();
+            expect(room.rateLimitStrategy.name).toBe('token-bucket');
+        });
+    });
+
+    describe('strategy selection', () => {
+        it('should use token-bucket by default', () => {
+            class TestRoom extends withRateLimit(Room) {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            expect(room.rateLimitStrategy.name).toBe('token-bucket');
+        });
+
+        it('should use sliding-window when specified', () => {
+            class TestRoom extends withRateLimit(Room, { strategy: 'sliding-window' }) {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            expect(room.rateLimitStrategy.name).toBe('sliding-window');
+        });
+
+        it('should use fixed-window when specified', () => {
+            class TestRoom extends withRateLimit(Room, { strategy: 'fixed-window' }) {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            expect(room.rateLimitStrategy.name).toBe('fixed-window');
+        });
+    });
+
+    describe('configuration', () => {
+        it('should use default values', () => {
+            class TestRoom extends withRateLimit(Room) {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            expect(room.rateLimitStrategy).toBeDefined();
+        });
+
+        it('should accept custom messagesPerSecond', () => {
+            class TestRoom extends withRateLimit(Room, { messagesPerSecond: 5 }) {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            expect(room.rateLimitStrategy).toBeDefined();
+        });
+
+        it('should accept custom burstSize', () => {
+            class TestRoom extends withRateLimit(Room, { burstSize: 50 }) {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            expect(room.rateLimitStrategy).toBeDefined();
+        });
+    });
+
+    describe('dispose', () => {
+        it('should clean up on dispose', () => {
+            class TestRoom extends RateLimitedRoom {
+                onCreate() {}
+            }
+
+            const room = new TestRoom();
+            room._init({
+                id: 'test-room',
+                sendFn: vi.fn(),
+                broadcastFn: vi.fn(),
+                disposeFn: vi.fn()
+            });
+
+            expect(() => room.dispose()).not.toThrow();
+        });
+    });
+});
+
+describe('withRateLimit with auth', () => {
+    it('should be composable with other mixins', () => {
+        class TestRoom extends withRateLimit(Room, { messagesPerSecond: 10 }) {
+            onCreate() {}
+        }
+
+        const room = new TestRoom();
+        expect(room.rateLimitStrategy).toBeDefined();
+    });
+});
+
+describe('getPlayerRateLimitContext', () => {
+    it('should return null for player without context', () => {
+        const mockPlayer = {
+            id: 'player-1',
+            roomId: 'room-1',
+            data: {},
+            send: vi.fn(),
+            leave: vi.fn()
+        } as unknown as Player;
+
+        const context = getPlayerRateLimitContext(mockPlayer);
+        expect(context).toBeNull();
+    });
+});
+
+describe('decorator metadata', () => {
+    it('rateLimitMessage should set metadata', () => {
+        class TestRoom extends withRateLimit(Room) {
+            @rateLimitMessage('Trade', { messagesPerSecond: 1 })
+            @onMessage('Trade')
+            handleTrade() {}
+        }
+
+        expect(TestRoom).toBeDefined();
+    });
+
+    it('noRateLimitMessage should set exempt metadata', () => {
+        class TestRoom extends withRateLimit(Room) {
+            @noRateLimitMessage('Heartbeat')
+            @onMessage('Heartbeat')
+            handleHeartbeat() {}
+        }
+
+        expect(TestRoom).toBeDefined();
+    });
+});

packages/framework/server/src/ratelimit/__tests__/strategies.test.ts

@@ -0,0 +1,249 @@
+import { describe, it, expect, beforeEach, vi, afterEach } from 'vitest';
+import { TokenBucketStrategy, createTokenBucketStrategy } from '../strategies/TokenBucket';
+import { SlidingWindowStrategy, createSlidingWindowStrategy } from '../strategies/SlidingWindow';
+import { FixedWindowStrategy, createFixedWindowStrategy } from '../strategies/FixedWindow';
+
+describe('TokenBucketStrategy', () => {
+    let strategy: TokenBucketStrategy;
+
+    beforeEach(() => {
+        strategy = createTokenBucketStrategy({
+            rate: 10,
+            capacity: 20
+        });
+    });
+
+    describe('consume', () => {
+        it('should allow requests when tokens available', () => {
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(19);
+        });
+
+        it('should consume multiple tokens', () => {
+            const result = strategy.consume('user-1', 5);
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(15);
+        });
+
+        it('should deny when not enough tokens', () => {
+            for (let i = 0; i < 20; i++) {
+                strategy.consume('user-1');
+            }
+
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(false);
+            expect(result.remaining).toBe(0);
+            expect(result.retryAfter).toBeGreaterThan(0);
+        });
+
+        it('should refill tokens over time', async () => {
+            for (let i = 0; i < 20; i++) {
+                strategy.consume('user-1');
+            }
+
+            await new Promise(resolve => setTimeout(resolve, 150));
+
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(true);
+        });
+
+        it('should handle different keys independently', () => {
+            for (let i = 0; i < 20; i++) {
+                strategy.consume('user-1');
+            }
+
+            const result1 = strategy.consume('user-1');
+            const result2 = strategy.consume('user-2');
+
+            expect(result1.allowed).toBe(false);
+            expect(result2.allowed).toBe(true);
+        });
+    });
+
+    describe('getStatus', () => {
+        it('should return full capacity for new key', () => {
+            const status = strategy.getStatus('new-user');
+            expect(status.remaining).toBe(20);
+            expect(status.allowed).toBe(true);
+        });
+
+        it('should not consume tokens', () => {
+            strategy.getStatus('user-1');
+            const status = strategy.getStatus('user-1');
+            expect(status.remaining).toBe(20);
+        });
+    });
+
+    describe('reset', () => {
+        it('should reset key to full capacity', () => {
+            for (let i = 0; i < 15; i++) {
+                strategy.consume('user-1');
+            }
+
+            strategy.reset('user-1');
+
+            const status = strategy.getStatus('user-1');
+            expect(status.remaining).toBe(20);
+        });
+    });
+
+    describe('cleanup', () => {
+        it('should clean up full buckets', async () => {
+            strategy.consume('user-1');
+
+            await new Promise(resolve => setTimeout(resolve, 100));
+
+            strategy.cleanup();
+        });
+    });
+});
+
+describe('SlidingWindowStrategy', () => {
+    let strategy: SlidingWindowStrategy;
+
+    beforeEach(() => {
+        strategy = createSlidingWindowStrategy({
+            rate: 10,
+            capacity: 10
+        });
+    });
+
+    describe('consume', () => {
+        it('should allow requests within capacity', () => {
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(9);
+        });
+
+        it('should deny when capacity exceeded', () => {
+            for (let i = 0; i < 10; i++) {
+                strategy.consume('user-1');
+            }
+
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(false);
+            expect(result.remaining).toBe(0);
+        });
+
+        it('should allow after window expires', async () => {
+            for (let i = 0; i < 10; i++) {
+                strategy.consume('user-1');
+            }
+
+            await new Promise(resolve => setTimeout(resolve, 1100));
+
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(true);
+        });
+    });
+
+    describe('getStatus', () => {
+        it('should return full capacity for new key', () => {
+            const status = strategy.getStatus('new-user');
+            expect(status.remaining).toBe(10);
+            expect(status.allowed).toBe(true);
+        });
+    });
+
+    describe('reset', () => {
+        it('should clear timestamps', () => {
+            for (let i = 0; i < 5; i++) {
+                strategy.consume('user-1');
+            }
+
+            strategy.reset('user-1');
+
+            const status = strategy.getStatus('user-1');
+            expect(status.remaining).toBe(10);
+        });
+    });
+});
+
+describe('FixedWindowStrategy', () => {
+    let strategy: FixedWindowStrategy;
+
+    beforeEach(() => {
+        strategy = createFixedWindowStrategy({
+            rate: 10,
+            capacity: 10
+        });
+    });
+
+    describe('consume', () => {
+        it('should allow requests within capacity', () => {
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(9);
+        });
+
+        it('should deny when capacity exceeded', () => {
+            for (let i = 0; i < 10; i++) {
+                strategy.consume('user-1');
+            }
+
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(false);
+            expect(result.retryAfter).toBeGreaterThanOrEqual(0);
+        });
+
+        it('should reset at window boundary', async () => {
+            for (let i = 0; i < 10; i++) {
+                strategy.consume('user-1');
+            }
+
+            await new Promise(resolve => setTimeout(resolve, 1100));
+
+            const result = strategy.consume('user-1');
+            expect(result.allowed).toBe(true);
+            expect(result.remaining).toBe(9);
+        });
+    });
+
+    describe('getStatus', () => {
+        it('should return full capacity for new key', () => {
+            const status = strategy.getStatus('new-user');
+            expect(status.remaining).toBe(10);
+        });
+    });
+
+    describe('reset', () => {
+        it('should reset count', () => {
+            for (let i = 0; i < 5; i++) {
+                strategy.consume('user-1');
+            }
+
+            strategy.reset('user-1');
+
+            const status = strategy.getStatus('user-1');
+            expect(status.remaining).toBe(10);
+        });
+    });
+
+    describe('cleanup', () => {
+        it('should clean up old windows', async () => {
+            strategy.consume('user-1');
+
+            await new Promise(resolve => setTimeout(resolve, 2100));
+
+            strategy.cleanup();
+        });
+    });
+});
+
+describe('Factory functions', () => {
+    it('createTokenBucketStrategy should create TokenBucketStrategy', () => {
+        const strategy = createTokenBucketStrategy({ rate: 5, capacity: 10 });
+        expect(strategy.name).toBe('token-bucket');
+    });
+
+    it('createSlidingWindowStrategy should create SlidingWindowStrategy', () => {
+        const strategy = createSlidingWindowStrategy({ rate: 5, capacity: 5 });
+        expect(strategy.name).toBe('sliding-window');
+    });
+
+    it('createFixedWindowStrategy should create FixedWindowStrategy', () => {
+        const strategy = createFixedWindowStrategy({ rate: 5, capacity: 5 });
+        expect(strategy.name).toBe('fixed-window');
+    });
+});

packages/framework/server/src/ratelimit/context.ts

@@ -0,0 +1,146 @@
+/**
+ * @zh 速率限制上下文
+ * @en Rate limit context
+ */
+
+import type {
+    IRateLimitContext,
+    IRateLimitStrategy,
+    RateLimitResult,
+    MessageRateLimitConfig
+} from './types.js';
+
+/**
+ * @zh 速率限制上下文
+ * @en Rate limit context
+ *
+ * @zh 管理单个玩家的速率限制状态，支持全局限制和按消息类型限制
+ * @en Manages rate limit status for a single player, supports global and per-message-type limits
+ *
+ * @example
+ * ```typescript
+ * const context = new RateLimitContext('player-123', globalStrategy);
+ *
+ * // Check global rate limit
+ * const result = context.consume();
+ *
+ * // Check per-message rate limit
+ * const tradeResult = context.consume('Trade', 1);
+ * ```
+ */
+export class RateLimitContext implements IRateLimitContext {
+    private _key: string;
+    private _globalStrategy: IRateLimitStrategy;
+    private _messageStrategies: Map<string, IRateLimitStrategy> = new Map();
+    private _consecutiveLimitCount: number = 0;
+
+    /**
+     * @zh 创建速率限制上下文
+     * @en Create rate limit context
+     *
+     * @param key - @zh 限流键（通常是玩家ID）@en Rate limit key (usually player ID)
+     * @param globalStrategy - @zh 全局限流策略 @en Global rate limit strategy
+     */
+    constructor(key: string, globalStrategy: IRateLimitStrategy) {
+        this._key = key;
+        this._globalStrategy = globalStrategy;
+    }
+
+    /**
+     * @zh 获取连续被限流次数
+     * @en Get consecutive limit count
+     */
+    get consecutiveLimitCount(): number {
+        return this._consecutiveLimitCount;
+    }
+
+    /**
+     * @zh 检查是否允许（不消费）
+     * @en Check if allowed (without consuming)
+     */
+    check(messageType?: string): RateLimitResult {
+        if (messageType && this._messageStrategies.has(messageType)) {
+            return this._messageStrategies.get(messageType)!.getStatus(this._key);
+        }
+
+        return this._globalStrategy.getStatus(this._key);
+    }
+
+    /**
+     * @zh 消费配额
+     * @en Consume quota
+     */
+    consume(messageType?: string, cost: number = 1): RateLimitResult {
+        let result: RateLimitResult;
+
+        if (messageType && this._messageStrategies.has(messageType)) {
+            result = this._messageStrategies.get(messageType)!.consume(this._key, cost);
+        } else {
+            result = this._globalStrategy.consume(this._key, cost);
+        }
+
+        if (result.allowed) {
+            this._consecutiveLimitCount = 0;
+        } else {
+            this._consecutiveLimitCount++;
+        }
+
+        return result;
+    }
+
+    /**
+     * @zh 重置限流状态
+     * @en Reset rate limit status
+     */
+    reset(messageType?: string): void {
+        if (messageType) {
+            if (this._messageStrategies.has(messageType)) {
+                this._messageStrategies.get(messageType)!.reset(this._key);
+            }
+        } else {
+            this._globalStrategy.reset(this._key);
+            for (const strategy of this._messageStrategies.values()) {
+                strategy.reset(this._key);
+            }
+        }
+    }
+
+    /**
+     * @zh 重置连续限流计数
+     * @en Reset consecutive limit count
+     */
+    resetConsecutiveCount(): void {
+        this._consecutiveLimitCount = 0;
+    }
+
+    /**
+     * @zh 为特定消息类型设置独立的限流策略
+     * @en Set independent rate limit strategy for specific message type
+     *
+     * @param messageType - @zh 消息类型 @en Message type
+     * @param strategy - @zh 限流策略 @en Rate limit strategy
+     */
+    setMessageStrategy(messageType: string, strategy: IRateLimitStrategy): void {
+        this._messageStrategies.set(messageType, strategy);
+    }
+
+    /**
+     * @zh 移除特定消息类型的限流策略
+     * @en Remove rate limit strategy for specific message type
+     *
+     * @param messageType - @zh 消息类型 @en Message type
+     */
+    removeMessageStrategy(messageType: string): void {
+        this._messageStrategies.delete(messageType);
+    }
+
+    /**
+     * @zh 检查是否有特定消息类型的限流策略
+     * @en Check if has rate limit strategy for specific message type
+     *
+     * @param messageType - @zh 消息类型 @en Message type
+     */
+    hasMessageStrategy(messageType: string): boolean {
+        return this._messageStrategies.has(messageType);
+    }
+}

packages/framework/server/src/ratelimit/decorators/index.ts

@@ -0,0 +1,13 @@
+/**
+ * @zh 速率限制装饰器
+ * @en Rate limit decorators
+ */
+
+export {
+    rateLimit,
+    noRateLimit,
+    rateLimitMessage,
+    noRateLimitMessage,
+    getRateLimitMetadata,
+    RATE_LIMIT_METADATA_KEY
+} from './rateLimit.js';

packages/framework/server/src/ratelimit/decorators/rateLimit.ts

@@ -0,0 +1,246 @@
+/**
+ * @zh 速率限制装饰器
+ * @en Rate limit decorators
+ */
+
+import type { MessageRateLimitConfig, RateLimitMetadata } from '../types.js';
+
+/**
+ * @zh 速率限制元数据存储键
+ * @en Rate limit metadata storage key
+ */
+export const RATE_LIMIT_METADATA_KEY = Symbol('rateLimitMetadata');
+
+/**
+ * @zh 获取速率限制元数据
+ * @en Get rate limit metadata
+ *
+ * @param target - @zh 目标对象 @en Target object
+ * @param messageType - @zh 消息类型 @en Message type
+ * @returns @zh 元数据 @en Metadata
+ */
+export function getRateLimitMetadata(target: any, messageType: string): RateLimitMetadata | undefined {
+    const metadataMap = target[RATE_LIMIT_METADATA_KEY] as Map<string, RateLimitMetadata> | undefined;
+    return metadataMap?.get(messageType);
+}
+
+/**
+ * @zh 设置速率限制元数据
+ * @en Set rate limit metadata
+ *
+ * @param target - @zh 目标对象 @en Target object
+ * @param messageType - @zh 消息类型 @en Message type
+ * @param metadata - @zh 元数据 @en Metadata
+ */
+function setRateLimitMetadata(target: any, messageType: string, metadata: RateLimitMetadata): void {
+    if (!target[RATE_LIMIT_METADATA_KEY]) {
+        target[RATE_LIMIT_METADATA_KEY] = new Map<string, RateLimitMetadata>();
+    }
+    const metadataMap = target[RATE_LIMIT_METADATA_KEY] as Map<string, RateLimitMetadata>;
+    const existing = metadataMap.get(messageType) ?? { enabled: true };
+    metadataMap.set(messageType, { ...existing, ...metadata });
+}
+
+/**
+ * @zh 从方法获取消息类型
+ * @en Get message type from method
+ *
+ * @zh 通过查找 onMessage 装饰器设置的元数据来获取消息类型
+ * @en Gets message type by looking up metadata set by onMessage decorator
+ */
+function getMessageTypeFromMethod(target: any, methodName: string): string | undefined {
+    const messageHandlers = Symbol.for('messageHandlers');
+
+    for (const sym of Object.getOwnPropertySymbols(target.constructor)) {
+        const desc = Object.getOwnPropertyDescriptor(target.constructor, sym);
+        if (desc?.value && Array.isArray(desc.value)) {
+            for (const handler of desc.value) {
+                if (handler.method === methodName) {
+                    return handler.type;
+                }
+            }
+        }
+    }
+
+    const handlers = target.constructor[Symbol.for('messageHandlers')] as { type: string; method: string }[] | undefined;
+    if (handlers) {
+        for (const handler of handlers) {
+            if (handler.method === methodName) {
+                return handler.type;
+            }
+        }
+    }
+
+    return undefined;
+}
+
+/**
+ * @zh 速率限制装饰器
+ * @en Rate limit decorator
+ *
+ * @zh 为消息处理器设置独立的速率限制配置
+ * @en Set independent rate limit configuration for message handler
+ *
+ * @example
+ * ```typescript
+ * class GameRoom extends withRateLimit(Room) {
+ *     @rateLimit({ messagesPerSecond: 1, burstSize: 2 })
+ *     @onMessage('Trade')
+ *     handleTrade(data: TradeData, player: Player) {
+ *         // This message has stricter rate limit
+ *     }
+ *
+ *     @rateLimit({ cost: 5 })
+ *     @onMessage('ExpensiveAction')
+ *     handleExpensiveAction(data: any, player: Player) {
+ *         // This message consumes 5 tokens
+ *     }
+ * }
+ * ```
+ */
+export function rateLimit(config?: MessageRateLimitConfig): MethodDecorator {
+    return function (
+        target: Object,
+        propertyKey: string | symbol,
+        descriptor: PropertyDescriptor
+    ): PropertyDescriptor {
+        const methodName = String(propertyKey);
+
+        queueMicrotask(() => {
+            const msgType = getMessageTypeFromMethod(target, methodName);
+            if (msgType) {
+                setRateLimitMetadata(target, msgType, {
+                    enabled: true,
+                    config
+                });
+            }
+        });
+
+        const metadata: RateLimitMetadata = {
+            enabled: true,
+            config
+        };
+
+        if (!target.hasOwnProperty(RATE_LIMIT_METADATA_KEY)) {
+            Object.defineProperty(target, RATE_LIMIT_METADATA_KEY, {
+                value: new Map<string, RateLimitMetadata>(),
+                writable: false,
+                enumerable: false
+            });
+        }
+
+        return descriptor;
+    };
+}
+
+/**
+ * @zh 豁免速率限制装饰器
+ * @en Exempt from rate limit decorator
+ *
+ * @zh 标记消息处理器不受速率限制
+ * @en Mark message handler as exempt from rate limit
+ *
+ * @example
+ * ```typescript
+ * class GameRoom extends withRateLimit(Room) {
+ *     @noRateLimit()
+ *     @onMessage('Heartbeat')
+ *     handleHeartbeat(data: any, player: Player) {
+ *         // This message is not rate limited
+ *     }
+ *
+ *     @noRateLimit()
+ *     @onMessage('Ping')
+ *     handlePing(data: any, player: Player) {
+ *         player.send('Pong', {});
+ *     }
+ * }
+ * ```
+ */
+export function noRateLimit(): MethodDecorator {
+    return function (
+        target: Object,
+        propertyKey: string | symbol,
+        descriptor: PropertyDescriptor
+    ): PropertyDescriptor {
+        const methodName = String(propertyKey);
+
+        queueMicrotask(() => {
+            const msgType = getMessageTypeFromMethod(target, methodName);
+            if (msgType) {
+                setRateLimitMetadata(target, msgType, {
+                    enabled: false,
+                    exempt: true
+                });
+            }
+        });
+
+        return descriptor;
+    };
+}
+
+/**
+ * @zh 速率限制消息装饰器（直接指定消息类型）
+ * @en Rate limit message decorator (directly specify message type)
+ *
+ * @zh 当无法自动获取消息类型时使用此装饰器
+ * @en Use this decorator when message type cannot be obtained automatically
+ *
+ * @example
+ * ```typescript
+ * class GameRoom extends withRateLimit(Room) {
+ *     @rateLimitMessage('Trade', { messagesPerSecond: 1 })
+ *     @onMessage('Trade')
+ *     handleTrade(data: TradeData, player: Player) {
+ *         // Explicitly rate limited
+ *     }
+ * }
+ * ```
+ */
+export function rateLimitMessage(
+    messageType: string,
+    config?: MessageRateLimitConfig
+): MethodDecorator {
+    return function (
+        target: Object,
+        propertyKey: string | symbol,
+        descriptor: PropertyDescriptor
+    ): PropertyDescriptor {
+        setRateLimitMetadata(target, messageType, {
+            enabled: true,
+            config
+        });
+
+        return descriptor;
+    };
+}
+
+/**
+ * @zh 豁免速率限制消息装饰器（直接指定消息类型）
+ * @en Exempt rate limit message decorator (directly specify message type)
+ *
+ * @example
+ * ```typescript
+ * class GameRoom extends withRateLimit(Room) {
+ *     @noRateLimitMessage('Heartbeat')
+ *     @onMessage('Heartbeat')
+ *     handleHeartbeat(data: any, player: Player) {
+ *         // Explicitly exempted
+ *     }
+ * }
+ * ```
+ */
+export function noRateLimitMessage(messageType: string): MethodDecorator {
+    return function (
+        target: Object,
+        propertyKey: string | symbol,
+        descriptor: PropertyDescriptor
+    ): PropertyDescriptor {
+        setRateLimitMetadata(target, messageType, {
+            enabled: false,
+            exempt: true
+        });
+
+        return descriptor;
+    };
+}

packages/framework/server/src/ratelimit/index.ts

@@ -0,0 +1,91 @@
+/**
+ * @zh 速率限制模块
+ * @en Rate limit module
+ *
+ * @zh 提供可插拔的速率限制系统，支持多种限流算法
+ * @en Provides pluggable rate limit system with multiple algorithms
+ *
+ * @example
+ * ```typescript
+ * import { Room, onMessage } from '@esengine/server';
+ * import {
+ *     withRateLimit,
+ *     rateLimit,
+ *     noRateLimit
+ * } from '@esengine/server/ratelimit';
+ *
+ * class GameRoom extends withRateLimit(Room, {
+ *     messagesPerSecond: 10,
+ *     burstSize: 20,
+ *     strategy: 'token-bucket',
+ *     onLimited: (player, type, result) => {
+ *         player.send('Error', {
+ *             code: 'RATE_LIMITED',
+ *             retryAfter: result.retryAfter
+ *         });
+ *     }
+ * }) {
+ *     @onMessage('Move')
+ *     handleMove(data: { x: number, y: number }, player: Player) {
+ *         // Protected by default rate limit
+ *     }
+ *
+ *     @rateLimit({ messagesPerSecond: 1 })
+ *     @onMessage('Trade')
+ *     handleTrade(data: TradeData, player: Player) {
+ *         // Stricter rate limit for trading
+ *     }
+ *
+ *     @noRateLimit()
+ *     @onMessage('Heartbeat')
+ *     handleHeartbeat(data: any, player: Player) {
+ *         // No rate limit for heartbeat
+ *     }
+ * }
+ * ```
+ */
+
+// Types
+export type {
+    RateLimitResult,
+    IRateLimitStrategy,
+    RateLimitStrategyType,
+    RateLimitConfig,
+    MessageRateLimitConfig,
+    RateLimitMetadata,
+    IRateLimitContext,
+    RateLimitedRoom,
+    StrategyConfig
+} from './types.js';
+
+// Strategies
+export {
+    TokenBucketStrategy,
+    createTokenBucketStrategy,
+    SlidingWindowStrategy,
+    createSlidingWindowStrategy,
+    FixedWindowStrategy,
+    createFixedWindowStrategy
+} from './strategies/index.js';
+
+// Context
+export { RateLimitContext } from './context.js';
+
+// Mixin
+export {
+    withRateLimit,
+    getPlayerRateLimitContext,
+    type RateLimitedPlayer,
+    type IRateLimitRoom,
+    type RateLimitRoomClass
+} from './mixin/index.js';
+
+// Decorators
+export {
+    rateLimit,
+    noRateLimit,
+    rateLimitMessage,
+    noRateLimitMessage,
+    getRateLimitMetadata,
+    RATE_LIMIT_METADATA_KEY
+} from './decorators/index.js';

packages/framework/server/src/ratelimit/mixin/index.ts

@@ -0,0 +1,12 @@
+/**
+ * @zh 速率限制 Mixin
+ * @en Rate limit mixin
+ */
+
+export {
+    withRateLimit,
+    getPlayerRateLimitContext,
+    type RateLimitedPlayer,
+    type IRateLimitRoom,
+    type RateLimitRoomClass
+} from './withRateLimit.js';

packages/framework/server/src/ratelimit/mixin/withRateLimit.ts

@@ -0,0 +1,385 @@
+/**
+ * @zh 房间速率限制 Mixin
+ * @en Room rate limit mixin
+ */
+
+import type { Player, Room } from '../../room/index.js';
+import { RateLimitContext } from '../context.js';
+import { getRateLimitMetadata, RATE_LIMIT_METADATA_KEY } from '../decorators/rateLimit.js';
+import { FixedWindowStrategy } from '../strategies/FixedWindow.js';
+import { SlidingWindowStrategy } from '../strategies/SlidingWindow.js';
+import { TokenBucketStrategy } from '../strategies/TokenBucket.js';
+import type {
+    IRateLimitContext,
+    IRateLimitStrategy,
+    RateLimitConfig,
+    RateLimitMetadata,
+    RateLimitResult
+} from '../types.js';
+
+/**
+ * @zh 玩家速率限制上下文存储
+ * @en Player rate limit context storage
+ */
+const PLAYER_RATE_LIMIT_CONTEXT = Symbol('playerRateLimitContext');
+
+/**
+ * @zh 带速率限制的玩家
+ * @en Player with rate limit
+ */
+export interface RateLimitedPlayer<TData = Record<string, unknown>> extends Player<TData> {
+    /**
+     * @zh 速率限制上下文
+     * @en Rate limit context
+     */
+    readonly rateLimit: IRateLimitContext;
+}
+
+/**
+ * @zh 带速率限制的房间接口
+ * @en Room with rate limit interface
+ */
+export interface IRateLimitRoom {
+    /**
+     * @zh 获取玩家的速率限制上下文
+     * @en Get rate limit context for player
+     */
+    getRateLimitContext(player: Player): IRateLimitContext | null;
+
+    /**
+     * @zh 全局速率限制策略
+     * @en Global rate limit strategy
+     */
+    readonly rateLimitStrategy: IRateLimitStrategy;
+
+    /**
+     * @zh 速率限制钩子（被限流时调用）
+     * @en Rate limit hook (called when rate limited)
+     */
+    onRateLimited?(player: Player, messageType: string, result: RateLimitResult): void;
+}
+
+/**
+ * @zh 速率限制房间构造器类型
+ * @en Rate limit room constructor type
+ */
+export type RateLimitRoomClass = new (...args: any[]) => Room & IRateLimitRoom;
+
+/**
+ * @zh 创建策略实例
+ * @en Create strategy instance
+ */
+function createStrategy(config: RateLimitConfig): IRateLimitStrategy {
+    const rate = config.messagesPerSecond ?? 10;
+    const capacity = config.burstSize ?? rate * 2;
+
+    switch (config.strategy) {
+        case 'sliding-window':
+            return new SlidingWindowStrategy({ rate, capacity });
+        case 'fixed-window':
+            return new FixedWindowStrategy({ rate, capacity });
+        case 'token-bucket':
+        default:
+            return new TokenBucketStrategy({ rate, capacity });
+    }
+}
+
+/**
+ * @zh 获取玩家的速率限制上下文
+ * @en Get rate limit context for player
+ */
+export function getPlayerRateLimitContext(player: Player): IRateLimitContext | null {
+    const data = player as unknown as Record<symbol, unknown>;
+    return (data[PLAYER_RATE_LIMIT_CONTEXT] as IRateLimitContext) ?? null;
+}
+
+/**
+ * @zh 设置玩家的速率限制上下文
+ * @en Set rate limit context for player
+ */
+function setPlayerRateLimitContext(player: Player, context: IRateLimitContext): void {
+    const data = player as unknown as Record<symbol, unknown>;
+    data[PLAYER_RATE_LIMIT_CONTEXT] = context;
+
+    Object.defineProperty(player, 'rateLimit', {
+        get: () => data[PLAYER_RATE_LIMIT_CONTEXT],
+        enumerable: true,
+        configurable: false
+    });
+}
+
+/**
+ * @zh 包装房间类添加速率限制功能
+ * @en Wrap room class with rate limit functionality
+ *
+ * @zh 使用 mixin 模式为房间添加速率限制，在消息处理前验证速率限制
+ * @en Uses mixin pattern to add rate limit to room, validates rate before processing messages
+ *
+ * @example
+ * ```typescript
+ * import { Room, onMessage } from '@esengine/server';
+ * import { withRateLimit } from '@esengine/server/ratelimit';
+ *
+ * class GameRoom extends withRateLimit(Room, {
+ *     messagesPerSecond: 10,
+ *     burstSize: 20,
+ *     onLimited: (player, type, result) => {
+ *         player.send('Error', {
+ *             code: 'RATE_LIMITED',
+ *             retryAfter: result.retryAfter
+ *         });
+ *     }
+ * }) {
+ *     @onMessage('Move')
+ *     handleMove(data: { x: number, y: number }, player: Player) {
+ *         // Protected by rate limit
+ *     }
+ * }
+ * ```
+ *
+ * @example
+ * // Combine with auth
+ * ```typescript
+ * class GameRoom extends withRateLimit(
+ *     withRoomAuth(Room, { requireAuth: true }),
+ *     { messagesPerSecond: 10 }
+ * ) {
+ *     // Both auth and rate limit active
+ * }
+ * ```
+ */
+export function withRateLimit<TBase extends new (...args: any[]) => Room = new (...args: any[]) => Room>(
+    Base: TBase,
+    config: RateLimitConfig = {}
+): TBase & (new (...args: any[]) => IRateLimitRoom) {
+    const {
+        messagesPerSecond = 10,
+        burstSize = 20,
+        strategy = 'token-bucket',
+        onLimited,
+        disconnectOnLimit = false,
+        maxConsecutiveLimits = 0,
+        getKey = (player: Player) => player.id,
+        cleanupInterval = 60000
+    } = config;
+
+    abstract class RateLimitRoom extends (Base as new (...args: any[]) => Room) implements IRateLimitRoom {
+        private _rateLimitStrategy: IRateLimitStrategy;
+        private _playerContexts: WeakMap<Player, RateLimitContext> = new WeakMap();
+        private _cleanupTimer: ReturnType<typeof setInterval> | null = null;
+        private _messageStrategies: Map<string, IRateLimitStrategy> = new Map();
+
+        constructor(...args: any[]) {
+            super(...args);
+            this._rateLimitStrategy = createStrategy({
+                messagesPerSecond,
+                burstSize,
+                strategy
+            });
+
+            this._startCleanup();
+            this._initMessageStrategies();
+        }
+
+        /**
+         * @zh 全局速率限制策略
+         * @en Global rate limit strategy
+         */
+        get rateLimitStrategy(): IRateLimitStrategy {
+            return this._rateLimitStrategy;
+        }
+
+        /**
+         * @zh 速率限制钩子（可覆盖）
+         * @en Rate limit hook (can be overridden)
+         */
+        onRateLimited?(player: Player, messageType: string, result: RateLimitResult): void;
+
+        /**
+         * @zh 获取玩家的速率限制上下文
+         * @en Get rate limit context for player
+         */
+        getRateLimitContext(player: Player): IRateLimitContext | null {
+            return this._playerContexts.get(player) ?? null;
+        }
+
+        /**
+         * @internal
+         * @zh 重写消息处理以添加速率限制检查
+         * @en Override message handling to add rate limit check
+         */
+        _handleMessage(type: string, data: unknown, playerId: string): void {
+            const player = this.getPlayer(playerId);
+            if (!player) return;
+
+            let context = this._playerContexts.get(player);
+            if (!context) {
+                context = this._createPlayerContext(player);
+            }
+
+            const metadata = this._getMessageMetadata(type);
+
+            if (metadata?.exempt) {
+                super._handleMessage(type, data, playerId);
+                return;
+            }
+
+            const cost = metadata?.config?.cost ?? 1;
+            let result: RateLimitResult;
+
+            if (metadata?.config && (metadata.config.messagesPerSecond || metadata.config.burstSize)) {
+                if (!context.hasMessageStrategy(type)) {
+                    const msgStrategy = createStrategy({
+                        messagesPerSecond: metadata.config.messagesPerSecond ?? messagesPerSecond,
+                        burstSize: metadata.config.burstSize ?? burstSize,
+                        strategy
+                    });
+                    context.setMessageStrategy(type, msgStrategy);
+                }
+                result = context.consume(type, cost);
+            } else {
+                result = context.consume(undefined, cost);
+            }
+
+            if (!result.allowed) {
+                this._handleRateLimited(player, type, result, context);
+                return;
+            }
+
+            super._handleMessage(type, data, playerId);
+        }
+
+        /**
+         * @internal
+         * @zh 重写 _addPlayer 以初始化速率限制上下文
+         * @en Override _addPlayer to initialize rate limit context
+         */
+        async _addPlayer(id: string, conn: any): Promise<Player | null> {
+            const player = await super._addPlayer(id, conn);
+            if (player) {
+                this._createPlayerContext(player);
+            }
+            return player;
+        }
+
+        /**
+         * @internal
+         * @zh 重写 _removePlayer 以清理速率限制上下文
+         * @en Override _removePlayer to cleanup rate limit context
+         */
+        async _removePlayer(id: string, reason?: string): Promise<void> {
+            const player = this.getPlayer(id);
+            if (player) {
+                const context = this._playerContexts.get(player);
+                if (context) {
+                    context.reset();
+                }
+                this._playerContexts.delete(player);
+            }
+            await super._removePlayer(id, reason);
+        }
+
+        /**
+         * @zh 重写 dispose 以清理定时器
+         * @en Override dispose to cleanup timer
+         */
+        dispose(): void {
+            this._stopCleanup();
+            super.dispose();
+        }
+
+        /**
+         * @zh 创建玩家的速率限制上下文
+         * @en Create rate limit context for player
+         */
+        private _createPlayerContext(player: Player): RateLimitContext {
+            const key = getKey(player);
+            const context = new RateLimitContext(key, this._rateLimitStrategy);
+            this._playerContexts.set(player, context);
+            setPlayerRateLimitContext(player, context);
+            return context;
+        }
+
+        /**
+         * @zh 处理被限流的情况
+         * @en Handle rate limited situation
+         */
+        private _handleRateLimited(
+            player: Player,
+            messageType: string,
+            result: RateLimitResult,
+            context: RateLimitContext
+        ): void {
+            if (this.onRateLimited) {
+                this.onRateLimited(player, messageType, result);
+            }
+
+            onLimited?.(player, messageType, result);
+
+            if (disconnectOnLimit) {
+                this.kick(player as any, 'rate_limited');
+                return;
+            }
+
+            if (maxConsecutiveLimits > 0 && context.consecutiveLimitCount >= maxConsecutiveLimits) {
+                this.kick(player as any, 'too_many_rate_limits');
+            }
+        }
+
+        /**
+         * @zh 获取消息的元数据
+         * @en Get message metadata
+         */
+        private _getMessageMetadata(type: string): RateLimitMetadata | undefined {
+            return getRateLimitMetadata(this.constructor.prototype, type);
+        }
+
+        /**
+         * @zh 初始化消息策略（从装饰器元数据）
+         * @en Initialize message strategies (from decorator metadata)
+         */
+        private _initMessageStrategies(): void {
+            const metadataMap = (this.constructor.prototype as any)[RATE_LIMIT_METADATA_KEY];
+            if (metadataMap instanceof Map) {
+                for (const [msgType, metadata] of metadataMap) {
+                    if (metadata.config && (metadata.config.messagesPerSecond || metadata.config.burstSize)) {
+                        const msgStrategy = createStrategy({
+                            messagesPerSecond: metadata.config.messagesPerSecond ?? messagesPerSecond,
+                            burstSize: metadata.config.burstSize ?? burstSize,
+                            strategy
+                        });
+                        this._messageStrategies.set(msgType, msgStrategy);
+                    }
+                }
+            }
+        }
+
+        /**
+         * @zh 开始清理定时器
+         * @en Start cleanup timer
+         */
+        private _startCleanup(): void {
+            if (cleanupInterval > 0) {
+                this._cleanupTimer = setInterval(() => {
+                    this._rateLimitStrategy.cleanup();
+                    for (const strategy of this._messageStrategies.values()) {
+                        strategy.cleanup();
+                    }
+                }, cleanupInterval);
+            }
+        }
+
+        /**
+         * @zh 停止清理定时器
+         * @en Stop cleanup timer
+         */
+        private _stopCleanup(): void {
+            if (this._cleanupTimer) {
+                clearInterval(this._cleanupTimer);
+                this._cleanupTimer = null;
+            }
+        }
+    }
+
+    return RateLimitRoom as unknown as TBase & (new (...args: any[]) => IRateLimitRoom);
+}

packages/framework/server/src/ratelimit/strategies/FixedWindow.ts

@@ -0,0 +1,204 @@
+/**
+ * @zh 固定窗口速率限制策略
+ * @en Fixed window rate limit strategy
+ */
+
+import type { IRateLimitStrategy, RateLimitResult, StrategyConfig } from '../types.js';
+
+/**
+ * @zh 固定窗口状态
+ * @en Fixed window state
+ */
+interface WindowState {
+    /**
+     * @zh 当前窗口计数
+     * @en Current window count
+     */
+    count: number;
+
+    /**
+     * @zh 窗口开始时间
+     * @en Window start time
+     */
+    windowStart: number;
+}
+
+/**
+ * @zh 固定窗口速率限制策略
+ * @en Fixed window rate limit strategy
+ *
+ * @zh 固定窗口算法将时间划分为固定长度的窗口，在每个窗口内计数请求。
+ * 实现简单，内存开销小，但在窗口边界可能有两倍突发的问题。
+ * @en Fixed window algorithm divides time into fixed-length windows and counts requests in each window.
+ * Simple to implement with low memory overhead, but may have 2x burst issue at window boundaries.
+ *
+ * @example
+ * ```typescript
+ * const strategy = new FixedWindowStrategy({
+ *     rate: 10,       // 10 requests per second
+ *     capacity: 10    // same as rate for 1-second window
+ * });
+ *
+ * const result = strategy.consume('player-123');
+ * if (result.allowed) {
+ *     // Process message
+ * }
+ * ```
+ */
+export class FixedWindowStrategy implements IRateLimitStrategy {
+    readonly name = 'fixed-window';
+
+    private _rate: number;
+    private _capacity: number;
+    private _windowMs: number;
+    private _windows: Map<string, WindowState> = new Map();
+
+    /**
+     * @zh 创建固定窗口策略
+     * @en Create fixed window strategy
+     *
+     * @param config - @zh 配置 @en Configuration
+     * @param config.rate - @zh 每秒允许的请求数 @en Requests allowed per second
+     * @param config.capacity - @zh 窗口容量 @en Window capacity
+     */
+    constructor(config: StrategyConfig) {
+        this._rate = config.rate;
+        this._capacity = config.capacity;
+        this._windowMs = 1000;
+    }
+
+    /**
+     * @zh 尝试消费配额
+     * @en Try to consume quota
+     */
+    consume(key: string, cost: number = 1): RateLimitResult {
+        const now = Date.now();
+        const window = this._getOrCreateWindow(key, now);
+
+        this._maybeResetWindow(window, now);
+
+        if (window.count + cost <= this._capacity) {
+            window.count += cost;
+
+            return {
+                allowed: true,
+                remaining: this._capacity - window.count,
+                resetAt: window.windowStart + this._windowMs
+            };
+        }
+
+        const retryAfter = window.windowStart + this._windowMs - now;
+
+        return {
+            allowed: false,
+            remaining: 0,
+            resetAt: window.windowStart + this._windowMs,
+            retryAfter: Math.max(0, retryAfter)
+        };
+    }
+
+    /**
+     * @zh 获取当前状态
+     * @en Get current status
+     */
+    getStatus(key: string): RateLimitResult {
+        const now = Date.now();
+        const window = this._windows.get(key);
+
+        if (!window) {
+            return {
+                allowed: true,
+                remaining: this._capacity,
+                resetAt: this._getWindowStart(now) + this._windowMs
+            };
+        }
+
+        this._maybeResetWindow(window, now);
+
+        const remaining = Math.max(0, this._capacity - window.count);
+
+        return {
+            allowed: remaining > 0,
+            remaining,
+            resetAt: window.windowStart + this._windowMs
+        };
+    }
+
+    /**
+     * @zh 重置指定键
+     * @en Reset specified key
+     */
+    reset(key: string): void {
+        this._windows.delete(key);
+    }
+
+    /**
+     * @zh 清理所有过期记录
+     * @en Clean up all expired records
+     */
+    cleanup(): void {
+        const now = Date.now();
+        const currentWindowStart = this._getWindowStart(now);
+
+        for (const [key, window] of this._windows) {
+            if (window.windowStart < currentWindowStart - this._windowMs) {
+                this._windows.delete(key);
+            }
+        }
+    }
+
+    /**
+     * @zh 获取或创建窗口
+     * @en Get or create window
+     */
+    private _getOrCreateWindow(key: string, now: number): WindowState {
+        let window = this._windows.get(key);
+
+        if (!window) {
+            window = {
+                count: 0,
+                windowStart: this._getWindowStart(now)
+            };
+            this._windows.set(key, window);
+        }
+
+        return window;
+    }
+
+    /**
+     * @zh 如果需要则重置窗口
+     * @en Reset window if needed
+     */
+    private _maybeResetWindow(window: WindowState, now: number): void {
+        const currentWindowStart = this._getWindowStart(now);
+
+        if (window.windowStart < currentWindowStart) {
+            window.count = 0;
+            window.windowStart = currentWindowStart;
+        }
+    }
+
+    /**
+     * @zh 获取窗口开始时间
+     * @en Get window start time
+     */
+    private _getWindowStart(now: number): number {
+        return Math.floor(now / this._windowMs) * this._windowMs;
+    }
+}
+
+/**
+ * @zh 创建固定窗口策略
+ * @en Create fixed window strategy
+ *
+ * @example
+ * ```typescript
+ * const strategy = createFixedWindowStrategy({
+ *     rate: 10,
+ *     capacity: 10
+ * });
+ * ```
+ */
+export function createFixedWindowStrategy(config: StrategyConfig): FixedWindowStrategy {
+    return new FixedWindowStrategy(config);
+}

packages/framework/server/src/ratelimit/strategies/SlidingWindow.ts

@@ -0,0 +1,201 @@
+/**
+ * @zh 滑动窗口速率限制策略
+ * @en Sliding window rate limit strategy
+ */
+
+import type { IRateLimitStrategy, RateLimitResult, StrategyConfig } from '../types.js';
+
+/**
+ * @zh 滑动窗口状态
+ * @en Sliding window state
+ */
+interface WindowState {
+    /**
+     * @zh 请求时间戳列表
+     * @en Request timestamp list
+     */
+    timestamps: number[];
+}
+
+/**
+ * @zh 滑动窗口速率限制策略
+ * @en Sliding window rate limit strategy
+ *
+ * @zh 滑动窗口算法精确跟踪时间窗口内的请求数。
+ * 比固定窗口更精确，但内存开销稍大。
+ * @en Sliding window algorithm precisely tracks requests within a time window.
+ * More accurate than fixed window, but with slightly higher memory overhead.
+ *
+ * @example
+ * ```typescript
+ * const strategy = new SlidingWindowStrategy({
+ *     rate: 10,       // 10 requests per second
+ *     capacity: 10    // window size (same as rate for 1-second window)
+ * });
+ *
+ * const result = strategy.consume('player-123');
+ * if (result.allowed) {
+ *     // Process message
+ * }
+ * ```
+ */
+export class SlidingWindowStrategy implements IRateLimitStrategy {
+    readonly name = 'sliding-window';
+
+    private _rate: number;
+    private _capacity: number;
+    private _windowMs: number;
+    private _windows: Map<string, WindowState> = new Map();
+
+    /**
+     * @zh 创建滑动窗口策略
+     * @en Create sliding window strategy
+     *
+     * @param config - @zh 配置 @en Configuration
+     * @param config.rate - @zh 每秒允许的请求数 @en Requests allowed per second
+     * @param config.capacity - @zh 窗口容量 @en Window capacity
+     */
+    constructor(config: StrategyConfig) {
+        this._rate = config.rate;
+        this._capacity = config.capacity;
+        this._windowMs = 1000;
+    }
+
+    /**
+     * @zh 尝试消费配额
+     * @en Try to consume quota
+     */
+    consume(key: string, cost: number = 1): RateLimitResult {
+        const now = Date.now();
+        const window = this._getOrCreateWindow(key);
+
+        this._cleanExpiredTimestamps(window, now);
+
+        const currentCount = window.timestamps.length;
+
+        if (currentCount + cost <= this._capacity) {
+            for (let i = 0; i < cost; i++) {
+                window.timestamps.push(now);
+            }
+
+            return {
+                allowed: true,
+                remaining: this._capacity - window.timestamps.length,
+                resetAt: this._getResetAt(window, now)
+            };
+        }
+
+        const oldestTimestamp = window.timestamps[0] || now;
+        const retryAfter = Math.max(0, oldestTimestamp + this._windowMs - now);
+
+        return {
+            allowed: false,
+            remaining: 0,
+            resetAt: oldestTimestamp + this._windowMs,
+            retryAfter
+        };
+    }
+
+    /**
+     * @zh 获取当前状态
+     * @en Get current status
+     */
+    getStatus(key: string): RateLimitResult {
+        const now = Date.now();
+        const window = this._windows.get(key);
+
+        if (!window) {
+            return {
+                allowed: true,
+                remaining: this._capacity,
+                resetAt: now + this._windowMs
+            };
+        }
+
+        this._cleanExpiredTimestamps(window, now);
+
+        const remaining = Math.max(0, this._capacity - window.timestamps.length);
+
+        return {
+            allowed: remaining > 0,
+            remaining,
+            resetAt: this._getResetAt(window, now)
+        };
+    }
+
+    /**
+     * @zh 重置指定键
+     * @en Reset specified key
+     */
+    reset(key: string): void {
+        this._windows.delete(key);
+    }
+
+    /**
+     * @zh 清理所有过期记录
+     * @en Clean up all expired records
+     */
+    cleanup(): void {
+        const now = Date.now();
+
+        for (const [key, window] of this._windows) {
+            this._cleanExpiredTimestamps(window, now);
+
+            if (window.timestamps.length === 0) {
+                this._windows.delete(key);
+            }
+        }
+    }
+
+    /**
+     * @zh 获取或创建窗口
+     * @en Get or create window
+     */
+    private _getOrCreateWindow(key: string): WindowState {
+        let window = this._windows.get(key);
+
+        if (!window) {
+            window = { timestamps: [] };
+            this._windows.set(key, window);
+        }
+
+        return window;
+    }
+
+    /**
+     * @zh 清理过期的时间戳
+     * @en Clean expired timestamps
+     */
+    private _cleanExpiredTimestamps(window: WindowState, now: number): void {
+        const cutoff = now - this._windowMs;
+        window.timestamps = window.timestamps.filter(ts => ts > cutoff);
+    }
+
+    /**
+     * @zh 获取重置时间
+     * @en Get reset time
+     */
+    private _getResetAt(window: WindowState, now: number): number {
+        if (window.timestamps.length === 0) {
+            return now + this._windowMs;
+        }
+
+        return window.timestamps[0] + this._windowMs;
+    }
+}
+
+/**
+ * @zh 创建滑动窗口策略
+ * @en Create sliding window strategy
+ *
+ * @example
+ * ```typescript
+ * const strategy = createSlidingWindowStrategy({
+ *     rate: 10,
+ *     capacity: 10
+ * });
+ * ```
+ */
+export function createSlidingWindowStrategy(config: StrategyConfig): SlidingWindowStrategy {
+    return new SlidingWindowStrategy(config);
+}

packages/framework/server/src/ratelimit/strategies/TokenBucket.ts

@@ -0,0 +1,191 @@
+/**
+ * @zh 令牌桶速率限制策略
+ * @en Token bucket rate limit strategy
+ */
+
+import type { IRateLimitStrategy, RateLimitResult, StrategyConfig } from '../types.js';
+
+/**
+ * @zh 令牌桶状态
+ * @en Token bucket state
+ */
+interface BucketState {
+    /**
+     * @zh 当前令牌数
+     * @en Current token count
+     */
+    tokens: number;
+
+    /**
+     * @zh 上次更新时间
+     * @en Last update time
+     */
+    lastUpdate: number;
+}
+
+/**
+ * @zh 令牌桶速率限制策略
+ * @en Token bucket rate limit strategy
+ *
+ * @zh 令牌桶算法允许突发流量，同时保持长期速率限制。
+ * 令牌以固定速率添加到桶中，每个请求消耗一个或多个令牌。
+ * @en Token bucket algorithm allows burst traffic while maintaining long-term rate limit.
+ * Tokens are added to the bucket at a fixed rate, each request consumes one or more tokens.
+ *
+ * @example
+ * ```typescript
+ * const strategy = new TokenBucketStrategy({
+ *     rate: 10,      // 10 tokens per second
+ *     capacity: 20   // bucket can hold 20 tokens max
+ * });
+ *
+ * const result = strategy.consume('player-123');
+ * if (result.allowed) {
+ *     // Process message
+ * }
+ * ```
+ */
+export class TokenBucketStrategy implements IRateLimitStrategy {
+    readonly name = 'token-bucket';
+
+    private _rate: number;
+    private _capacity: number;
+    private _buckets: Map<string, BucketState> = new Map();
+
+    /**
+     * @zh 创建令牌桶策略
+     * @en Create token bucket strategy
+     *
+     * @param config - @zh 配置 @en Configuration
+     * @param config.rate - @zh 每秒添加的令牌数 @en Tokens added per second
+     * @param config.capacity - @zh 桶容量（最大令牌数）@en Bucket capacity (max tokens)
+     */
+    constructor(config: StrategyConfig) {
+        this._rate = config.rate;
+        this._capacity = config.capacity;
+    }
+
+    /**
+     * @zh 尝试消费令牌
+     * @en Try to consume tokens
+     */
+    consume(key: string, cost: number = 1): RateLimitResult {
+        const now = Date.now();
+        const bucket = this._getOrCreateBucket(key, now);
+
+        this._refillBucket(bucket, now);
+
+        if (bucket.tokens >= cost) {
+            bucket.tokens -= cost;
+            return {
+                allowed: true,
+                remaining: Math.floor(bucket.tokens),
+                resetAt: now + Math.ceil((this._capacity - bucket.tokens) / this._rate * 1000)
+            };
+        }
+
+        const tokensNeeded = cost - bucket.tokens;
+        const retryAfter = Math.ceil(tokensNeeded / this._rate * 1000);
+
+        return {
+            allowed: false,
+            remaining: 0,
+            resetAt: now + retryAfter,
+            retryAfter
+        };
+    }
+
+    /**
+     * @zh 获取当前状态
+     * @en Get current status
+     */
+    getStatus(key: string): RateLimitResult {
+        const now = Date.now();
+        const bucket = this._buckets.get(key);
+
+        if (!bucket) {
+            return {
+                allowed: true,
+                remaining: this._capacity,
+                resetAt: now
+            };
+        }
+
+        this._refillBucket(bucket, now);
+
+        return {
+            allowed: bucket.tokens >= 1,
+            remaining: Math.floor(bucket.tokens),
+            resetAt: now + Math.ceil((this._capacity - bucket.tokens) / this._rate * 1000)
+        };
+    }
+
+    /**
+     * @zh 重置指定键
+     * @en Reset specified key
+     */
+    reset(key: string): void {
+        this._buckets.delete(key);
+    }
+
+    /**
+     * @zh 清理所有记录
+     * @en Clean up all records
+     */
+    cleanup(): void {
+        const now = Date.now();
+        const expireThreshold = 60000;
+
+        for (const [key, bucket] of this._buckets) {
+            if (now - bucket.lastUpdate > expireThreshold && bucket.tokens >= this._capacity) {
+                this._buckets.delete(key);
+            }
+        }
+    }
+
+    /**
+     * @zh 获取或创建桶
+     * @en Get or create bucket
+     */
+    private _getOrCreateBucket(key: string, now: number): BucketState {
+        let bucket = this._buckets.get(key);
+
+        if (!bucket) {
+            bucket = {
+                tokens: this._capacity,
+                lastUpdate: now
+            };
+            this._buckets.set(key, bucket);
+        }
+
+        return bucket;
+    }
+
+    /**
+     * @zh 补充令牌
+     * @en Refill tokens
+     */
+    private _refillBucket(bucket: BucketState, now: number): void {
+        const elapsed = now - bucket.lastUpdate;
+        const tokensToAdd = (elapsed / 1000) * this._rate;
+
+        bucket.tokens = Math.min(this._capacity, bucket.tokens + tokensToAdd);
+        bucket.lastUpdate = now;
+    }
+}
+
+/**
+ * @zh 创建令牌桶策略
+ * @en Create token bucket strategy
+ *
+ * @example
+ * ```typescript
+ * const strategy = createTokenBucketStrategy({
+ *     rate: 10,
+ *     capacity: 20
+ * });
+ * ```
+ */
+export function createTokenBucketStrategy(config: StrategyConfig): TokenBucketStrategy {
+    return new TokenBucketStrategy(config);
+}

packages/framework/server/src/ratelimit/strategies/index.ts

@@ -0,0 +1,8 @@
+/**
+ * @zh 速率限制策略
+ * @en Rate limit strategies
+ */
+
+export { TokenBucketStrategy, createTokenBucketStrategy } from './TokenBucket.js';
+export { SlidingWindowStrategy, createSlidingWindowStrategy } from './SlidingWindow.js';
+export { FixedWindowStrategy, createFixedWindowStrategy } from './FixedWindow.js';

packages/framework/server/src/ratelimit/types.ts

@@ -0,0 +1,267 @@
+/**
+ * @zh 速率限制类型定义
+ * @en Rate limit type definitions
+ */
+
+import type { Player } from '../room/Player.js';
+
+/**
+ * @zh 速率限制结果
+ * @en Rate limit result
+ */
+export interface RateLimitResult {
+    /**
+     * @zh 是否允许
+     * @en Whether allowed
+     */
+    allowed: boolean;
+
+    /**
+     * @zh 剩余配额
+     * @en Remaining quota
+     */
+    remaining: number;
+
+    /**
+     * @zh 配额重置时间（毫秒时间戳）
+     * @en Quota reset time (milliseconds timestamp)
+     */
+    resetAt: number;
+
+    /**
+     * @zh 重试等待时间（毫秒），仅在被限流时返回
+     * @en Retry after time (milliseconds), only returned when rate limited
+     */
+    retryAfter?: number;
+}
+
+/**
+ * @zh 速率限制策略接口
+ * @en Rate limit strategy interface
+ */
+export interface IRateLimitStrategy {
+    /**
+     * @zh 策略名称
+     * @en Strategy name
+     */
+    readonly name: string;
+
+    /**
+     * @zh 尝试消费配额
+     * @en Try to consume quota
+     *
+     * @param key - @zh 限流键（通常是玩家ID或连接ID）@en Rate limit key (usually player ID or connection ID)
+     * @param cost - @zh 消费数量（默认1）@en Consumption amount (default 1)
+     * @returns @zh 限流结果 @en Rate limit result
+     */
+    consume(key: string, cost?: number): RateLimitResult;
+
+    /**
+     * @zh 获取当前状态（不消费）
+     * @en Get current status (without consuming)
+     *
+     * @param key - @zh 限流键 @en Rate limit key
+     * @returns @zh 限流结果 @en Rate limit result
+     */
+    getStatus(key: string): RateLimitResult;
+
+    /**
+     * @zh 重置指定键的限流状态
+     * @en Reset rate limit status for specified key
+     *
+     * @param key - @zh 限流键 @en Rate limit key
+     */
+    reset(key: string): void;
+
+    /**
+     * @zh 清理所有过期的限流记录
+     * @en Clean up all expired rate limit records
+     */
+    cleanup(): void;
+}
+
+/**
+ * @zh 速率限制策略类型
+ * @en Rate limit strategy type
+ */
+export type RateLimitStrategyType = 'token-bucket' | 'sliding-window' | 'fixed-window';
+
+/**
+ * @zh 速率限制配置
+ * @en Rate limit configuration
+ */
+export interface RateLimitConfig {
+    /**
+     * @zh 每秒允许的消息数
+     * @en Messages allowed per second
+     * @defaultValue 10
+     */
+    messagesPerSecond?: number;
+
+    /**
+     * @zh 突发容量（令牌桶大小）
+     * @en Burst capacity (token bucket size)
+     * @defaultValue 20
+     */
+    burstSize?: number;
+
+    /**
+     * @zh 限流策略
+     * @en Rate limit strategy
+     * @defaultValue 'token-bucket'
+     */
+    strategy?: RateLimitStrategyType;
+
+    /**
+     * @zh 被限流时的回调
+     * @en Callback when rate limited
+     */
+    onLimited?: (player: Player, messageType: string, result: RateLimitResult) => void;
+
+    /**
+     * @zh 是否在限流时断开连接
+     * @en Whether to disconnect when rate limited
+     * @defaultValue false
+     */
+    disconnectOnLimit?: boolean;
+
+    /**
+     * @zh 连续被限流多少次后断开连接（0 表示不断开）
+     * @en Disconnect after how many consecutive rate limits (0 means never)
+     * @defaultValue 0
+     */
+    maxConsecutiveLimits?: number;
+
+    /**
+     * @zh 获取限流键的函数（默认使用玩家ID）
+     * @en Function to get rate limit key (default uses player ID)
+     */
+    getKey?: (player: Player) => string;
+
+    /**
+     * @zh 清理间隔（毫秒）
+     * @en Cleanup interval (milliseconds)
+     * @defaultValue 60000
+     */
+    cleanupInterval?: number;
+}
+
+/**
+ * @zh 单个消息的速率限制配置
+ * @en Rate limit configuration for individual message
+ */
+export interface MessageRateLimitConfig {
+    /**
+     * @zh 每秒允许的消息数
+     * @en Messages allowed per second
+     */
+    messagesPerSecond?: number;
+
+    /**
+     * @zh 突发容量
+     * @en Burst capacity
+     */
+    burstSize?: number;
+
+    /**
+     * @zh 消费的令牌数（默认1）
+     * @en Tokens to consume (default 1)
+     */
+    cost?: number;
+}
+
+/**
+ * @zh 速率限制元数据
+ * @en Rate limit metadata
+ */
+export interface RateLimitMetadata {
+    /**
+     * @zh 是否启用速率限制
+     * @en Whether rate limit is enabled
+     */
+    enabled: boolean;
+
+    /**
+     * @zh 是否豁免速率限制
+     * @en Whether exempt from rate limit
+     */
+    exempt?: boolean;
+
+    /**
+     * @zh 自定义配置
+     * @en Custom configuration
+     */
+    config?: MessageRateLimitConfig;
+}
+
+/**
+ * @zh 速率限制上下文接口
+ * @en Rate limit context interface
+ */
+export interface IRateLimitContext {
+    /**
+     * @zh 检查是否允许（不消费）
+     * @en Check if allowed (without consuming)
+     */
+    check(messageType?: string): RateLimitResult;
+
+    /**
+     * @zh 消费配额
+     * @en Consume quota
+     */
+    consume(messageType?: string, cost?: number): RateLimitResult;
+
+    /**
+     * @zh 重置限流状态
+     * @en Reset rate limit status
+     */
+    reset(messageType?: string): void;
+
+    /**
+     * @zh 获取连续被限流次数
+     * @en Get consecutive limit count
+     */
+    readonly consecutiveLimitCount: number;
+
+    /**
+     * @zh 重置连续限流计数
+     * @en Reset consecutive limit count
+     */
+    resetConsecutiveCount(): void;
+}
+
+/**
+ * @zh 带速率限制的 Room 接口
+ * @en Room interface with rate limit
+ */
+export interface RateLimitedRoom {
+    /**
+     * @zh 获取玩家的速率限制上下文
+     * @en Get rate limit context for player
+     */
+    getRateLimitContext(player: Player): IRateLimitContext | null;
+
+    /**
+     * @zh 全局速率限制策略
+     * @en Global rate limit strategy
+     */
+    readonly rateLimitStrategy: IRateLimitStrategy;
+}
+
+/**
+ * @zh 速率限制策略配置
+ * @en Rate limit strategy configuration
+ */
+export interface StrategyConfig {
+    /**
+     * @zh 每秒允许的请求数
+     * @en Requests allowed per second
+     */
+    rate: number;
+
+    /**
+     * @zh 容量/窗口大小
+     * @en Capacity/window size
+     */
+    capacity: number;
+}

packages/framework/server/src/room/RoomManager.ts

@@ -197,9 +197,9 @@ export class RoomManager {
         )
     }
 
-    private _findAvailableRoom(name: string): Room | undefined {
+    private _findAvailableRoom(name: string): Room | null {
         const def = this._definitions.get(name)
-        if (!def) return undefined
+        if (!def) return null
 
         for (const room of this._rooms.values()) {
             if (
@@ -212,7 +212,7 @@ export class RoomManager {
             }
         }
 
-        return undefined
+        return null
     }
 
     private _generateRoomId(): string {

packages/framework/server/src/testing/MockRoom.ts

@@ -0,0 +1,134 @@
+/**
+ * @zh 模拟房间
+ * @en Mock room for testing
+ */
+
+import { Room, onMessage, type Player } from '../room/index.js'
+
+/**
+ * @zh 模拟房间状态
+ * @en Mock room state
+ */
+export interface MockRoomState {
+    messages: Array<{ type: string; data: unknown; playerId: string }>
+    joinCount: number
+    leaveCount: number
+}
+
+/**
+ * @zh 模拟房间
+ * @en Mock room for testing
+ *
+ * @zh 记录所有事件和消息，用于测试断言
+ * @en Records all events and messages for test assertions
+ *
+ * @example
+ * ```typescript
+ * const env = await createTestEnv()
+ * env.server.define('mock', MockRoom)
+ *
+ * const client = await env.createClient()
+ * await client.joinRoom('mock')
+ *
+ * client.sendToRoom('Test', { value: 123 })
+ * await wait(50)
+ *
+ * // MockRoom 会广播收到的消息
+ * const msg = client.getLastMessage('RoomMessage')
+ * ```
+ */
+export class MockRoom extends Room<MockRoomState> {
+    state: MockRoomState = {
+        messages: [],
+        joinCount: 0,
+        leaveCount: 0,
+    }
+
+    onCreate(): void {
+        // 房间创建
+    }
+
+    onJoin(player: Player): void {
+        this.state.joinCount++
+        this.broadcast('PlayerJoined', {
+            playerId: player.id,
+            joinCount: this.state.joinCount,
+        })
+    }
+
+    onLeave(player: Player): void {
+        this.state.leaveCount++
+        this.broadcast('PlayerLeft', {
+            playerId: player.id,
+            leaveCount: this.state.leaveCount,
+        })
+    }
+
+    @onMessage('*')
+    handleAnyMessage(data: unknown, player: Player, type: string): void {
+        this.state.messages.push({
+            type,
+            data,
+            playerId: player.id,
+        })
+
+        // 回显消息给所有玩家
+        this.broadcast('MessageReceived', {
+            type,
+            data,
+            from: player.id,
+        })
+    }
+
+    @onMessage('Echo')
+    handleEcho(data: unknown, player: Player): void {
+        // 只回复给发送者
+        player.send('EchoReply', data)
+    }
+
+    @onMessage('Broadcast')
+    handleBroadcast(data: unknown, _player: Player): void {
+        this.broadcast('BroadcastMessage', data)
+    }
+
+    @onMessage('Ping')
+    handlePing(_data: unknown, player: Player): void {
+        player.send('Pong', { timestamp: Date.now() })
+    }
+}
+
+/**
+ * @zh 简单回显房间
+ * @en Simple echo room
+ *
+ * @zh 将收到的任何消息回显给发送者
+ * @en Echoes any received message back to sender
+ */
+export class EchoRoom extends Room {
+    @onMessage('*')
+    handleAnyMessage(data: unknown, player: Player, type: string): void {
+        player.send(type, data)
+    }
+}
+
+/**
+ * @zh 广播房间
+ * @en Broadcast room
+ *
+ * @zh 将收到的任何消息广播给所有玩家
+ * @en Broadcasts any received message to all players
+ */
+export class BroadcastRoom extends Room {
+    onJoin(player: Player): void {
+        this.broadcast('PlayerJoined', { id: player.id })
+    }
+
+    onLeave(player: Player): void {
+        this.broadcast('PlayerLeft', { id: player.id })
+    }
+
+    @onMessage('*')
+    handleAnyMessage(data: unknown, player: Player, type: string): void {
+        this.broadcast(type, { from: player.id, data })
+    }
+}

packages/framework/server/src/testing/Room.test.ts

@@ -0,0 +1,371 @@
+/**
+ * @zh 房间测试示例
+ * @en Room test examples
+ *
+ * @zh 这个文件展示了如何使用测试工具进行服务器测试
+ * @en This file demonstrates how to use testing utilities for server testing
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest'
+import { createTestEnv, type TestEnvironment, wait } from './TestServer.js'
+import { MockRoom, BroadcastRoom } from './MockRoom.js'
+import { Room, onMessage, type Player } from '../room/index.js'
+
+// ============================================================================
+// Custom Room for Testing | 自定义测试房间
+// ============================================================================
+
+interface GameState {
+    players: Map<string, { x: number; y: number }>
+    scores: Map<string, number>
+}
+
+class GameRoom extends Room<GameState> {
+    maxPlayers = 4
+
+    state: GameState = {
+        players: new Map(),
+        scores: new Map(),
+    }
+
+    onJoin(player: Player): void {
+        this.state.players.set(player.id, { x: 0, y: 0 })
+        this.state.scores.set(player.id, 0)
+        this.broadcast('PlayerJoined', {
+            playerId: player.id,
+            playerCount: this.state.players.size,
+        })
+    }
+
+    onLeave(player: Player): void {
+        this.state.players.delete(player.id)
+        this.state.scores.delete(player.id)
+        this.broadcast('PlayerLeft', {
+            playerId: player.id,
+            playerCount: this.state.players.size,
+        })
+    }
+
+    @onMessage('Move')
+    handleMove(data: { x: number; y: number }, player: Player): void {
+        const pos = this.state.players.get(player.id)
+        if (pos) {
+            pos.x = data.x
+            pos.y = data.y
+            this.broadcast('PlayerMoved', {
+                playerId: player.id,
+                x: data.x,
+                y: data.y,
+            })
+        }
+    }
+
+    @onMessage('Score')
+    handleScore(data: { points: number }, player: Player): void {
+        const current = this.state.scores.get(player.id) ?? 0
+        this.state.scores.set(player.id, current + data.points)
+        player.send('ScoreUpdated', {
+            score: this.state.scores.get(player.id),
+        })
+    }
+}
+
+// ============================================================================
+// Test Suites | 测试套件
+// ============================================================================
+
+describe('Room Integration Tests', () => {
+    let env: TestEnvironment
+
+    beforeEach(async () => {
+        env = await createTestEnv()
+    })
+
+    afterEach(async () => {
+        await env.cleanup()
+    })
+
+    // ========================================================================
+    // Basic Tests | 基础测试
+    // ========================================================================
+
+    describe('Basic Room Operations', () => {
+        it('should create and join room', async () => {
+            env.server.define('game', GameRoom)
+
+            const client = await env.createClient()
+            const result = await client.joinRoom('game')
+
+            expect(result.roomId).toBeDefined()
+            expect(result.playerId).toBeDefined()
+            expect(client.roomId).toBe(result.roomId)
+        })
+
+        it('should leave room', async () => {
+            env.server.define('game', GameRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('game')
+
+            await client.leaveRoom()
+
+            expect(client.roomId).toBeNull()
+        })
+
+        it('should join existing room by id', async () => {
+            env.server.define('game', GameRoom)
+
+            const client1 = await env.createClient()
+            const { roomId } = await client1.joinRoom('game')
+
+            const client2 = await env.createClient()
+            const result = await client2.joinRoomById(roomId)
+
+            expect(result.roomId).toBe(roomId)
+        })
+    })
+
+    // ========================================================================
+    // Message Tests | 消息测试
+    // ========================================================================
+
+    describe('Room Messages', () => {
+        it('should receive room messages', async () => {
+            env.server.define('game', GameRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('game')
+
+            const movePromise = client.waitForRoomMessage('PlayerMoved')
+            client.sendToRoom('Move', { x: 100, y: 200 })
+
+            const msg = await movePromise
+            expect(msg).toEqual({
+                playerId: client.playerId,
+                x: 100,
+                y: 200,
+            })
+        })
+
+        it('should receive broadcast messages', async () => {
+            env.server.define('game', GameRoom)
+
+            const [client1, client2] = await env.createClients(2)
+
+            const { roomId } = await client1.joinRoom('game')
+            await client2.joinRoomById(roomId)
+
+            // client1 等待收到 client2 的移动消息
+            const movePromise = client1.waitForRoomMessage('PlayerMoved')
+            client2.sendToRoom('Move', { x: 50, y: 75 })
+
+            const msg = await movePromise
+            expect(msg).toMatchObject({
+                playerId: client2.playerId,
+                x: 50,
+                y: 75,
+            })
+        })
+
+        it('should handle player join/leave broadcasts', async () => {
+            env.server.define('broadcast', BroadcastRoom)
+
+            const client1 = await env.createClient()
+            const { roomId } = await client1.joinRoom('broadcast')
+
+            // 等待 client2 加入的广播
+            const joinPromise = client1.waitForRoomMessage<{ id: string }>('PlayerJoined')
+
+            const client2 = await env.createClient()
+            const client2Result = await client2.joinRoomById(roomId)
+
+            const joinMsg = await joinPromise
+            expect(joinMsg).toMatchObject({ id: client2Result.playerId })
+
+            // 等待 client2 离开的广播
+            const leavePromise = client1.waitForRoomMessage<{ id: string }>('PlayerLeft')
+            const client2PlayerId = client2.playerId // 保存 playerId
+            await client2.leaveRoom()
+
+            const leaveMsg = await leavePromise
+            expect(leaveMsg).toMatchObject({ id: client2PlayerId })
+        })
+    })
+
+    // ========================================================================
+    // MockRoom Tests | 模拟房间测试
+    // ========================================================================
+
+    describe('MockRoom', () => {
+        it('should record messages', async () => {
+            env.server.define('mock', MockRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('mock')
+
+            // 使用 Echo 消息，因为它是明确定义的
+            const echoPromise = client.waitForRoomMessage('EchoReply')
+            client.sendToRoom('Echo', { value: 123 })
+            await echoPromise
+
+            expect(client.hasReceivedMessage('RoomMessage')).toBe(true)
+        })
+
+        it('should handle echo', async () => {
+            env.server.define('mock', MockRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('mock')
+
+            const echoPromise = client.waitForRoomMessage('EchoReply')
+            client.sendToRoom('Echo', { message: 'hello' })
+
+            const reply = await echoPromise
+            expect(reply).toEqual({ message: 'hello' })
+        })
+
+        it('should handle ping/pong', async () => {
+            env.server.define('mock', MockRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('mock')
+
+            const pongPromise = client.waitForRoomMessage<{ timestamp: number }>('Pong')
+            client.sendToRoom('Ping', {})
+
+            const pong = await pongPromise
+            expect(pong.timestamp).toBeGreaterThan(0)
+        })
+    })
+
+    // ========================================================================
+    // Multiple Clients Tests | 多客户端测试
+    // ========================================================================
+
+    describe('Multiple Clients', () => {
+        it('should handle multiple clients in same room', async () => {
+            env.server.define('game', GameRoom)
+
+            const clients = await env.createClients(3)
+            const { roomId } = await clients[0].joinRoom('game')
+
+            for (let i = 1; i < clients.length; i++) {
+                await clients[i].joinRoomById(roomId)
+            }
+
+            // 所有客户端都应该能收到消息
+            const promises = clients.map((c) => c.waitForRoomMessage('PlayerMoved'))
+
+            clients[0].sendToRoom('Move', { x: 1, y: 2 })
+
+            const results = await Promise.all(promises)
+            for (const result of results) {
+                expect(result).toMatchObject({ x: 1, y: 2 })
+            }
+        })
+
+        it('should handle concurrent room operations', async () => {
+            env.server.define('game', GameRoom)
+
+            const clients = await env.createClients(4) // maxPlayers = 4
+
+            // 顺序加入房间（避免并发创建多个房间）
+            const { roomId } = await clients[0].joinRoom('game')
+
+            // 其余客户端加入同一房间
+            const results = await Promise.all(
+                clients.slice(1).map((c) => c.joinRoomById(roomId))
+            )
+
+            // 验证所有客户端都在同一房间
+            for (const result of results) {
+                expect(result.roomId).toBe(roomId)
+            }
+        })
+    })
+
+    // ========================================================================
+    // Error Handling Tests | 错误处理测试
+    // ========================================================================
+
+    describe('Error Handling', () => {
+        it('should reject joining non-existent room type', async () => {
+            const client = await env.createClient()
+
+            await expect(client.joinRoom('nonexistent')).rejects.toThrow()
+        })
+
+        it('should handle client disconnect gracefully', async () => {
+            env.server.define('game', GameRoom)
+
+            const client1 = await env.createClient()
+            const { roomId } = await client1.joinRoom('game')
+
+            const client2 = await env.createClient()
+            await client2.joinRoomById(roomId)
+
+            // 等待 client2 离开的广播
+            const leavePromise = client1.waitForRoomMessage('PlayerLeft')
+
+            // 强制断开 client2
+            await client2.disconnect()
+
+            // client1 应该收到离开消息
+            const msg = await leavePromise
+            expect(msg).toBeDefined()
+        })
+    })
+
+    // ========================================================================
+    // Assertion Helpers Tests | 断言辅助测试
+    // ========================================================================
+
+    describe('TestClient Assertions', () => {
+        it('should track received messages', async () => {
+            env.server.define('mock', MockRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('mock')
+
+            // 发送多条消息
+            client.sendToRoom('Test', { n: 1 })
+            client.sendToRoom('Test', { n: 2 })
+            client.sendToRoom('Test', { n: 3 })
+
+            // 等待消息处理
+            await wait(100)
+
+            expect(client.getMessageCount()).toBeGreaterThan(0)
+            expect(client.hasReceivedMessage('RoomMessage')).toBe(true)
+        })
+
+        it('should get messages of specific type', async () => {
+            env.server.define('mock', MockRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('mock')
+
+            client.sendToRoom('Ping', {})
+            await client.waitForRoomMessage('Pong')
+
+            const pongs = client.getMessagesOfType('RoomMessage')
+            expect(pongs.length).toBeGreaterThan(0)
+        })
+
+        it('should clear message history', async () => {
+            env.server.define('mock', MockRoom)
+
+            const client = await env.createClient()
+            await client.joinRoom('mock')
+
+            client.sendToRoom('Test', {})
+            await wait(50)
+
+            expect(client.getMessageCount()).toBeGreaterThan(0)
+
+            client.clearMessages()
+
+            expect(client.getMessageCount()).toBe(0)
+        })
+    })
+})

packages/framework/server/src/testing/TestClient.ts

@@ -0,0 +1,523 @@
+/**
+ * @zh 测试客户端
+ * @en Test client for server testing
+ */
+
+import WebSocket from 'ws'
+import { json } from '@esengine/rpc/codec'
+import type { Codec } from '@esengine/rpc/codec'
+
+// ============================================================================
+// Types | 类型定义
+// ============================================================================
+
+/**
+ * @zh 测试客户端配置
+ * @en Test client options
+ */
+export interface TestClientOptions {
+    /**
+     * @zh 编解码器
+     * @en Codec
+     * @defaultValue json()
+     */
+    codec?: Codec
+
+    /**
+     * @zh API 调用超时（毫秒）
+     * @en API call timeout in milliseconds
+     * @defaultValue 5000
+     */
+    timeout?: number
+
+    /**
+     * @zh 连接超时（毫秒）
+     * @en Connection timeout in milliseconds
+     * @defaultValue 5000
+     */
+    connectTimeout?: number
+}
+
+/**
+ * @zh 房间加入结果
+ * @en Room join result
+ */
+export interface JoinRoomResult {
+    roomId: string
+    playerId: string
+}
+
+/**
+ * @zh 收到的消息记录
+ * @en Received message record
+ */
+export interface ReceivedMessage {
+    type: string
+    data: unknown
+    timestamp: number
+}
+
+// ============================================================================
+// Constants | 常量
+// ============================================================================
+
+const PacketType = {
+    ApiRequest: 0,
+    ApiResponse: 1,
+    ApiError: 2,
+    Message: 3,
+} as const
+
+// ============================================================================
+// TestClient Class | 测试客户端类
+// ============================================================================
+
+interface PendingCall {
+    resolve: (value: unknown) => void
+    reject: (error: Error) => void
+    timer: ReturnType<typeof setTimeout>
+}
+
+/**
+ * @zh 测试客户端
+ * @en Test client for server integration testing
+ *
+ * @zh 专为测试设计的客户端，提供便捷的断言方法和消息记录功能
+ * @en Client designed for testing, with convenient assertion methods and message recording
+ *
+ * @example
+ * ```typescript
+ * const client = new TestClient(3000)
+ * await client.connect()
+ *
+ * // 加入房间
+ * const { roomId } = await client.joinRoom('game')
+ *
+ * // 发送消息
+ * client.sendToRoom('Move', { x: 10, y: 20 })
+ *
+ * // 等待收到特定消息
+ * const msg = await client.waitForMessage('PlayerMoved')
+ *
+ * // 断言收到消息
+ * expect(client.hasReceivedMessage('PlayerMoved')).toBe(true)
+ *
+ * await client.disconnect()
+ * ```
+ */
+export class TestClient {
+    private readonly _port: number
+    private readonly _codec: Codec
+    private readonly _timeout: number
+    private readonly _connectTimeout: number
+
+    private _ws: WebSocket | null = null
+    private _callIdCounter = 0
+    private _connected = false
+    private _currentRoomId: string | null = null
+    private _currentPlayerId: string | null = null
+
+    private readonly _pendingCalls = new Map<number, PendingCall>()
+    private readonly _msgHandlers = new Map<string, Set<(data: unknown) => void>>()
+    private readonly _receivedMessages: ReceivedMessage[] = []
+
+    constructor(port: number, options: TestClientOptions = {}) {
+        this._port = port
+        this._codec = options.codec ?? json()
+        this._timeout = options.timeout ?? 5000
+        this._connectTimeout = options.connectTimeout ?? 5000
+    }
+
+    // ========================================================================
+    // Properties | 属性
+    // ========================================================================
+
+    /**
+     * @zh 是否已连接
+     * @en Whether connected
+     */
+    get isConnected(): boolean {
+        return this._connected
+    }
+
+    /**
+     * @zh 当前房间 ID
+     * @en Current room ID
+     */
+    get roomId(): string | null {
+        return this._currentRoomId
+    }
+
+    /**
+     * @zh 当前玩家 ID
+     * @en Current player ID
+     */
+    get playerId(): string | null {
+        return this._currentPlayerId
+    }
+
+    /**
+     * @zh 收到的所有消息
+     * @en All received messages
+     */
+    get receivedMessages(): ReadonlyArray<ReceivedMessage> {
+        return this._receivedMessages
+    }
+
+    // ========================================================================
+    // Connection | 连接管理
+    // ========================================================================
+
+    /**
+     * @zh 连接到服务器
+     * @en Connect to server
+     */
+    connect(): Promise<this> {
+        return new Promise((resolve, reject) => {
+            const url = `ws://localhost:${this._port}`
+            this._ws = new WebSocket(url)
+
+            const timeout = setTimeout(() => {
+                this._ws?.close()
+                reject(new Error(`Connection timeout after ${this._connectTimeout}ms`))
+            }, this._connectTimeout)
+
+            this._ws.on('open', () => {
+                clearTimeout(timeout)
+                this._connected = true
+                resolve(this)
+            })
+
+            this._ws.on('close', () => {
+                this._connected = false
+                this._rejectAllPending('Connection closed')
+            })
+
+            this._ws.on('error', (err) => {
+                clearTimeout(timeout)
+                if (!this._connected) {
+                    reject(err)
+                }
+            })
+
+            this._ws.on('message', (data: Buffer) => {
+                this._handleMessage(data)
+            })
+        })
+    }
+
+    /**
+     * @zh 断开连接
+     * @en Disconnect from server
+     */
+    async disconnect(): Promise<void> {
+        return new Promise((resolve) => {
+            if (!this._ws || this._ws.readyState === WebSocket.CLOSED) {
+                resolve()
+                return
+            }
+
+            this._ws.once('close', () => {
+                this._connected = false
+                this._ws = null
+                resolve()
+            })
+
+            this._ws.close()
+        })
+    }
+
+    // ========================================================================
+    // Room Operations | 房间操作
+    // ========================================================================
+
+    /**
+     * @zh 加入房间
+     * @en Join a room
+     */
+    async joinRoom(roomType: string, options?: Record<string, unknown>): Promise<JoinRoomResult> {
+        const result = await this.call<JoinRoomResult>('JoinRoom', { roomType, options })
+        this._currentRoomId = result.roomId
+        this._currentPlayerId = result.playerId
+        return result
+    }
+
+    /**
+     * @zh 通过 ID 加入房间
+     * @en Join a room by ID
+     */
+    async joinRoomById(roomId: string): Promise<JoinRoomResult> {
+        const result = await this.call<JoinRoomResult>('JoinRoom', { roomId })
+        this._currentRoomId = result.roomId
+        this._currentPlayerId = result.playerId
+        return result
+    }
+
+    /**
+     * @zh 离开房间
+     * @en Leave room
+     */
+    async leaveRoom(): Promise<void> {
+        await this.call('LeaveRoom', {})
+        this._currentRoomId = null
+        this._currentPlayerId = null
+    }
+
+    /**
+     * @zh 发送消息到房间
+     * @en Send message to room
+     */
+    sendToRoom(type: string, data: unknown): void {
+        this.send('RoomMessage', { type, data })
+    }
+
+    // ========================================================================
+    // API Calls | API 调用
+    // ========================================================================
+
+    /**
+     * @zh 调用 API
+     * @en Call API
+     */
+    call<T = unknown>(name: string, input: unknown): Promise<T> {
+        return new Promise((resolve, reject) => {
+            if (!this._connected || !this._ws) {
+                reject(new Error('Not connected'))
+                return
+            }
+
+            const id = ++this._callIdCounter
+            const timer = setTimeout(() => {
+                this._pendingCalls.delete(id)
+                reject(new Error(`API call '${name}' timeout after ${this._timeout}ms`))
+            }, this._timeout)
+
+            this._pendingCalls.set(id, {
+                resolve: resolve as (v: unknown) => void,
+                reject,
+                timer,
+            })
+
+            const packet = [PacketType.ApiRequest, id, name, input]
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            this._ws.send(this._codec.encode(packet as any) as Buffer)
+        })
+    }
+
+    /**
+     * @zh 发送消息
+     * @en Send message
+     */
+    send(name: string, data: unknown): void {
+        if (!this._connected || !this._ws) return
+        const packet = [PacketType.Message, name, data]
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        this._ws.send(this._codec.encode(packet as any) as Buffer)
+    }
+
+    // ========================================================================
+    // Message Handling | 消息处理
+    // ========================================================================
+
+    /**
+     * @zh 监听消息
+     * @en Listen for message
+     */
+    on(name: string, handler: (data: unknown) => void): this {
+        let handlers = this._msgHandlers.get(name)
+        if (!handlers) {
+            handlers = new Set()
+            this._msgHandlers.set(name, handlers)
+        }
+        handlers.add(handler)
+        return this
+    }
+
+    /**
+     * @zh 取消监听消息
+     * @en Remove message listener
+     */
+    off(name: string, handler?: (data: unknown) => void): this {
+        if (handler) {
+            this._msgHandlers.get(name)?.delete(handler)
+        } else {
+            this._msgHandlers.delete(name)
+        }
+        return this
+    }
+
+    /**
+     * @zh 等待收到指定消息
+     * @en Wait for a specific message
+     */
+    waitForMessage<T = unknown>(type: string, timeout?: number): Promise<T> {
+        return new Promise((resolve, reject) => {
+            const timeoutMs = timeout ?? this._timeout
+
+            const timer = setTimeout(() => {
+                this.off(type, handler)
+                reject(new Error(`Timeout waiting for message '${type}' after ${timeoutMs}ms`))
+            }, timeoutMs)
+
+            const handler = (data: unknown) => {
+                clearTimeout(timer)
+                this.off(type, handler)
+                resolve(data as T)
+            }
+
+            this.on(type, handler)
+        })
+    }
+
+    /**
+     * @zh 等待收到指定房间消息
+     * @en Wait for a specific room message
+     */
+    waitForRoomMessage<T = unknown>(type: string, timeout?: number): Promise<T> {
+        return new Promise((resolve, reject) => {
+            const timeoutMs = timeout ?? this._timeout
+
+            const timer = setTimeout(() => {
+                this.off('RoomMessage', handler)
+                reject(new Error(`Timeout waiting for room message '${type}' after ${timeoutMs}ms`))
+            }, timeoutMs)
+
+            const handler = (data: unknown) => {
+                const msg = data as { type: string; data: unknown }
+                if (msg.type === type) {
+                    clearTimeout(timer)
+                    this.off('RoomMessage', handler)
+                    resolve(msg.data as T)
+                }
+            }
+
+            this.on('RoomMessage', handler)
+        })
+    }
+
+    // ========================================================================
+    // Assertions | 断言辅助
+    // ========================================================================
+
+    /**
+     * @zh 是否收到过指定消息
+     * @en Whether received a specific message
+     */
+    hasReceivedMessage(type: string): boolean {
+        return this._receivedMessages.some((m) => m.type === type)
+    }
+
+    /**
+     * @zh 获取指定类型的所有消息
+     * @en Get all messages of a specific type
+     */
+    getMessagesOfType<T = unknown>(type: string): T[] {
+        return this._receivedMessages
+            .filter((m) => m.type === type)
+            .map((m) => m.data as T)
+    }
+
+    /**
+     * @zh 获取最后收到的指定类型消息
+     * @en Get the last received message of a specific type
+     */
+    getLastMessage<T = unknown>(type: string): T | undefined {
+        for (let i = this._receivedMessages.length - 1; i >= 0; i--) {
+            if (this._receivedMessages[i].type === type) {
+                return this._receivedMessages[i].data as T
+            }
+        }
+        return undefined
+    }
+
+    /**
+     * @zh 清空消息记录
+     * @en Clear message records
+     */
+    clearMessages(): void {
+        this._receivedMessages.length = 0
+    }
+
+    /**
+     * @zh 获取收到的消息数量
+     * @en Get received message count
+     */
+    getMessageCount(type?: string): number {
+        if (type) {
+            return this._receivedMessages.filter((m) => m.type === type).length
+        }
+        return this._receivedMessages.length
+    }
+
+    // ========================================================================
+    // Private Methods | 私有方法
+    // ========================================================================
+
+    private _handleMessage(raw: Buffer): void {
+        try {
+            const packet = this._codec.decode(raw) as unknown[]
+            const type = packet[0] as number
+
+            switch (type) {
+                case PacketType.ApiResponse:
+                    this._handleApiResponse([packet[0], packet[1], packet[2]] as [number, number, unknown])
+                    break
+                case PacketType.ApiError:
+                    this._handleApiError([packet[0], packet[1], packet[2], packet[3]] as [number, number, string, string])
+                    break
+                case PacketType.Message:
+                    this._handleMsg([packet[0], packet[1], packet[2]] as [number, string, unknown])
+                    break
+            }
+        } catch (err) {
+            console.error('[TestClient] Failed to handle message:', err)
+        }
+    }
+
+    private _handleApiResponse([, id, result]: [number, number, unknown]): void {
+        const pending = this._pendingCalls.get(id)
+        if (pending) {
+            clearTimeout(pending.timer)
+            this._pendingCalls.delete(id)
+            pending.resolve(result)
+        }
+    }
+
+    private _handleApiError([, id, code, message]: [number, number, string, string]): void {
+        const pending = this._pendingCalls.get(id)
+        if (pending) {
+            clearTimeout(pending.timer)
+            this._pendingCalls.delete(id)
+            pending.reject(new Error(`[${code}] ${message}`))
+        }
+    }
+
+    private _handleMsg([, name, data]: [number, string, unknown]): void {
+        // 记录消息
+        this._receivedMessages.push({
+            type: name,
+            data,
+            timestamp: Date.now(),
+        })
+
+        // 触发处理器
+        const handlers = this._msgHandlers.get(name)
+        if (handlers) {
+            for (const handler of handlers) {
+                try {
+                    handler(data)
+                } catch (err) {
+                    console.error('[TestClient] Handler error:', err)
+                }
+            }
+        }
+    }
+
+    private _rejectAllPending(reason: string): void {
+        for (const [, pending] of this._pendingCalls) {
+            clearTimeout(pending.timer)
+            pending.reject(new Error(reason))
+        }
+        this._pendingCalls.clear()
+    }
+}

packages/framework/server/src/testing/TestServer.ts

@@ -0,0 +1,249 @@
+/**
+ * @zh 测试服务器工具
+ * @en Test server utilities
+ */
+
+import { createServer } from '../core/server.js'
+import type { GameServer } from '../types/index.js'
+import { TestClient, type TestClientOptions } from './TestClient.js'
+
+// ============================================================================
+// Types | 类型定义
+// ============================================================================
+
+/**
+ * @zh 测试服务器配置
+ * @en Test server options
+ */
+export interface TestServerOptions {
+    /**
+     * @zh 端口号，0 表示随机端口
+     * @en Port number, 0 for random port
+     * @defaultValue 0
+     */
+    port?: number
+
+    /**
+     * @zh Tick 速率
+     * @en Tick rate
+     * @defaultValue 0
+     */
+    tickRate?: number
+
+    /**
+     * @zh 是否禁用控制台日志
+     * @en Whether to suppress console logs
+     * @defaultValue true
+     */
+    silent?: boolean
+}
+
+/**
+ * @zh 测试环境
+ * @en Test environment
+ */
+export interface TestEnvironment {
+    /**
+     * @zh 服务器实例
+     * @en Server instance
+     */
+    server: GameServer
+
+    /**
+     * @zh 服务器端口
+     * @en Server port
+     */
+    port: number
+
+    /**
+     * @zh 创建测试客户端
+     * @en Create test client
+     */
+    createClient(options?: TestClientOptions): Promise<TestClient>
+
+    /**
+     * @zh 创建多个测试客户端
+     * @en Create multiple test clients
+     */
+    createClients(count: number, options?: TestClientOptions): Promise<TestClient[]>
+
+    /**
+     * @zh 清理测试环境
+     * @en Cleanup test environment
+     */
+    cleanup(): Promise<void>
+
+    /**
+     * @zh 所有已创建的客户端
+     * @en All created clients
+     */
+    readonly clients: ReadonlyArray<TestClient>
+}
+
+// ============================================================================
+// Helper Functions | 辅助函数
+// ============================================================================
+
+/**
+ * @zh 获取随机可用端口
+ * @en Get a random available port
+ */
+async function getRandomPort(): Promise<number> {
+    const net = await import('node:net')
+    return new Promise((resolve, reject) => {
+        const server = net.createServer()
+        server.listen(0, () => {
+            const address = server.address()
+            if (address && typeof address === 'object') {
+                const port = address.port
+                server.close(() => resolve(port))
+            } else {
+                server.close(() => reject(new Error('Failed to get port')))
+            }
+        })
+        server.on('error', reject)
+    })
+}
+
+/**
+ * @zh 等待指定毫秒
+ * @en Wait for specified milliseconds
+ */
+export function wait(ms: number): Promise<void> {
+    return new Promise((resolve) => setTimeout(resolve, ms))
+}
+
+// ============================================================================
+// Factory Functions | 工厂函数
+// ============================================================================
+
+/**
+ * @zh 创建测试服务器
+ * @en Create test server
+ *
+ * @example
+ * ```typescript
+ * const { server, port, cleanup } = await createTestServer()
+ * server.define('game', GameRoom)
+ *
+ * const client = new TestClient(port)
+ * await client.connect()
+ *
+ * // ... run tests ...
+ *
+ * await cleanup()
+ * ```
+ */
+export async function createTestServer(
+    options: TestServerOptions = {}
+): Promise<{ server: GameServer; port: number; cleanup: () => Promise<void> }> {
+    const port = options.port || (await getRandomPort())
+    const silent = options.silent ?? true
+
+    // 临时禁用 console.log
+    const originalLog = console.log
+    if (silent) {
+        console.log = () => {}
+    }
+
+    const server = await createServer({
+        port,
+        tickRate: options.tickRate ?? 0,
+        apiDir: '__non_existent_api__',
+        msgDir: '__non_existent_msg__',
+    })
+
+    await server.start()
+
+    // 恢复 console.log
+    if (silent) {
+        console.log = originalLog
+    }
+
+    return {
+        server,
+        port,
+        cleanup: async () => {
+            await server.stop()
+        },
+    }
+}
+
+/**
+ * @zh 创建完整测试环境
+ * @en Create complete test environment
+ *
+ * @zh 包含服务器、客户端创建和清理功能的完整测试环境
+ * @en Complete test environment with server, client creation and cleanup
+ *
+ * @example
+ * ```typescript
+ * describe('GameRoom', () => {
+ *     let env: TestEnvironment
+ *
+ *     beforeEach(async () => {
+ *         env = await createTestEnv()
+ *         env.server.define('game', GameRoom)
+ *     })
+ *
+ *     afterEach(async () => {
+ *         await env.cleanup()
+ *     })
+ *
+ *     it('should handle player join', async () => {
+ *         const client = await env.createClient()
+ *         const result = await client.joinRoom('game')
+ *         expect(result.roomId).toBeDefined()
+ *     })
+ *
+ *     it('should broadcast to all players', async () => {
+ *         const [client1, client2] = await env.createClients(2)
+ *
+ *         await client1.joinRoom('game')
+ *         const joinPromise = client1.waitForRoomMessage('PlayerJoined')
+ *
+ *         await client2.joinRoom('game')
+ *         const msg = await joinPromise
+ *
+ *         expect(msg).toBeDefined()
+ *     })
+ * })
+ * ```
+ */
+export async function createTestEnv(options: TestServerOptions = {}): Promise<TestEnvironment> {
+    const { server, port, cleanup: serverCleanup } = await createTestServer(options)
+    const clients: TestClient[] = []
+
+    return {
+        server,
+        port,
+        clients,
+
+        async createClient(clientOptions?: TestClientOptions): Promise<TestClient> {
+            const client = new TestClient(port, clientOptions)
+            await client.connect()
+            clients.push(client)
+            return client
+        },
+
+        async createClients(count: number, clientOptions?: TestClientOptions): Promise<TestClient[]> {
+            const newClients: TestClient[] = []
+            for (let i = 0; i < count; i++) {
+                const client = new TestClient(port, clientOptions)
+                await client.connect()
+                clients.push(client)
+                newClients.push(client)
+            }
+            return newClients
+        },
+
+        async cleanup(): Promise<void> {
+            // 断开所有客户端
+            await Promise.all(clients.map((c) => c.disconnect().catch(() => {})))
+            clients.length = 0
+
+            // 停止服务器
+            await serverCleanup()
+        },
+    }
+}

packages/framework/server/src/testing/index.ts

@@ -0,0 +1,37 @@
+/**
+ * @zh 服务器测试工具
+ * @en Server testing utilities
+ *
+ * @example
+ * ```typescript
+ * import { createTestServer, TestClient } from '@esengine/server/testing'
+ *
+ * describe('GameRoom', () => {
+ *     let env: TestEnvironment
+ *
+ *     beforeEach(async () => {
+ *         env = await createTestEnv()
+ *         env.server.define('game', GameRoom)
+ *     })
+ *
+ *     afterEach(async () => {
+ *         await env.cleanup()
+ *     })
+ *
+ *     it('should join room', async () => {
+ *         const client = await env.createClient()
+ *         const result = await client.joinRoom('game')
+ *         expect(result.roomId).toBeDefined()
+ *     })
+ * })
+ * ```
+ */
+
+export { TestClient, type TestClientOptions } from './TestClient.js'
+export {
+    createTestServer,
+    createTestEnv,
+    type TestServerOptions,
+    type TestEnvironment,
+} from './TestServer.js'
+export { MockRoom } from './MockRoom.js'

packages/framework/server/tsup.config.ts

@@ -1,11 +1,17 @@
 import { defineConfig } from 'tsup'
 
 export default defineConfig({
-    entry: ['src/index.ts'],
+    entry: [
+        'src/index.ts',
+        'src/auth/index.ts',
+        'src/auth/testing/index.ts',
+        'src/ratelimit/index.ts',
+        'src/testing/index.ts'
+    ],
     format: ['esm'],
     dts: true,
     clean: true,
     sourcemap: true,
-    external: ['ws', '@esengine/rpc'],
+    external: ['ws', 'jsonwebtoken', '@esengine/rpc', '@esengine/rpc/codec'],
     treeshake: true,
 })

packages/framework/server/vitest.config.ts

@@ -0,0 +1,11 @@
+import { defineConfig } from 'vitest/config'
+
+export default defineConfig({
+    test: {
+        globals: true,
+        environment: 'node',
+        include: ['src/**/*.test.ts'],
+        testTimeout: 10000,
+        hookTimeout: 10000,
+    },
+})

packages/framework/transaction/CHANGELOG.md

@@ -0,0 +1,108 @@
+# @esengine/transaction
+
+## 2.0.2
+
+### Patch Changes
+
+- Updated dependencies [[`afdeb00`](https://github.com/esengine/esengine/commit/afdeb00b4df9427e7f03b91558bf95804a837b70)]:
+    - @esengine/server@1.3.0
+
+## 2.0.1
+
+### Patch Changes
+
+- Updated dependencies [[`61a13ba`](https://github.com/esengine/esengine/commit/61a13baca2e1e8fba14e23d439521ec0e6b7ca6e)]:
+    - @esengine/server@1.2.0
+
+## 2.0.0
+
+### Major Changes
+
+- [#384](https://github.com/esengine/esengine/pull/384) [`3b97838`](https://github.com/esengine/esengine/commit/3b978384c7d4570f9af9d139e3bfea04c6875543) Thanks [@esengine](https://github.com/esengine)! - ## Breaking Changes
+
+    ### Storage API Simplification
+
+    RedisStorage and MongoStorage now use **factory pattern only** for connection management. The direct client injection option has been removed.
+
+    **Before (removed):**
+
+    ```typescript
+    // Direct client injection - NO LONGER SUPPORTED
+    const storage = new RedisStorage({ client: redisClient });
+    const storage = new MongoStorage({ client: mongoClient, database: 'game' });
+    ```
+
+    **After (factory pattern only):**
+
+    ```typescript
+    // RedisStorage
+    const storage = new RedisStorage({
+        factory: () => new Redis('redis://localhost:6379'),
+        prefix: 'tx:',
+        transactionTTL: 86400
+    });
+
+    // MongoStorage
+    const storage = new MongoStorage({
+        factory: async () => {
+            const client = new MongoClient('mongodb://localhost:27017');
+            await client.connect();
+            return client;
+        },
+        database: 'game'
+    });
+    ```
+
+    ### New Features
+    - **Lazy Connection**: Connection is established on first operation, not at construction time
+    - **Automatic Cleanup**: Support `await using` syntax (TypeScript 5.2+) for automatic resource cleanup
+    - **Explicit Close**: Call `storage.close()` when done, or use `await using` for automatic disposal
+
+    ### Migration Guide
+    1. Replace `client` option with `factory` function
+    2. Add `storage.close()` call when done, or use `await using`
+    3. For MongoStorage, ensure factory returns a connected client
+
+## 1.1.0
+
+### Minor Changes
+
+- [#381](https://github.com/esengine/esengine/pull/381) [`d4cef82`](https://github.com/esengine/esengine/commit/d4cef828e1dc1475e8483d40eb1d800c607cf3b6) Thanks [@esengine](https://github.com/esengine)! - feat(transaction): 添加游戏事务系统 | add game transaction system
+
+    **@esengine/transaction** - 游戏事务系统 | Game transaction system
+
+    ### 核心功能 | Core Features
+    - **TransactionManager** - 事务生命周期管理 | Transaction lifecycle management
+        - begin()/run() 创建事务 | Create transactions
+        - 分布式锁支持 | Distributed lock support
+        - 自动恢复未完成事务 | Auto-recover pending transactions
+    - **TransactionContext** - 事务上下文 | Transaction context
+        - 操作链式添加 | Chain operation additions
+        - 上下文数据共享 | Context data sharing
+        - 超时控制 | Timeout control
+    - **Saga 模式** - 补偿式事务 | Compensating transactions
+        - execute/compensate 成对操作 | Paired execute/compensate
+        - 自动回滚失败事务 | Auto-rollback on failure
+
+    ### 存储实现 | Storage Implementations
+    - **MemoryStorage** - 内存存储，用于开发测试 | In-memory for dev/testing
+    - **RedisStorage** - Redis 分布式锁和缓存 | Redis distributed lock & cache
+    - **MongoStorage** - MongoDB 持久化事务日志 | MongoDB persistent transaction logs
+
+    ### 内置操作 | Built-in Operations
+    - **CurrencyOperation** - 货币增减操作 | Currency add/deduct
+    - **InventoryOperation** - 背包物品操作 | Inventory item operations
+    - **TradeOperation** - 玩家交易操作 | Player trade operations
+
+    ### 分布式事务 | Distributed Transactions
+    - **SagaOrchestrator** - 跨服务器 Saga 编排 | Cross-server Saga orchestration
+    - 完整的 Saga 日志记录 | Complete Saga logging
+    - 未完成 Saga 恢复 | Incomplete Saga recovery
+
+    ### Room 集成 | Room Integration
+    - **withTransactions()** - Room mixin 扩展 | Room mixin extension
+    - **TransactionRoom** - 预配置的事务 Room 基类 | Pre-configured transaction Room base
+
+    ### 文档 | Documentation
+    - 完整的中英文文档 | Complete bilingual documentation
+    - 核心概念、存储层、操作、分布式事务 | Core concepts, storage, operations, distributed

packages/framework/transaction/__tests__/core/TransactionContext.test.ts

@@ -0,0 +1,445 @@
+/**
+ * @zh TransactionContext 单元测试
+ * @en TransactionContext unit tests
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import { TransactionContext, createTransactionContext } from '../../src/core/TransactionContext.js'
+import { MemoryStorage } from '../../src/storage/MemoryStorage.js'
+import type { ITransactionOperation, ITransactionContext, OperationResult } from '../../src/core/types.js'
+
+// ============================================================================
+// Mock Operations | 模拟操作
+// ============================================================================
+
+class SuccessOperation implements ITransactionOperation<{ value: number }, { doubled: number }> {
+    readonly name: string
+    readonly data: { value: number }
+
+    private _compensated = false
+
+    constructor(name: string, value: number) {
+        this.name = name
+        this.data = { value }
+    }
+
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return this.data.value > 0
+    }
+
+    async execute(_ctx: ITransactionContext): Promise<OperationResult<{ doubled: number }>> {
+        return { success: true, data: { doubled: this.data.value * 2 } }
+    }
+
+    async compensate(_ctx: ITransactionContext): Promise<void> {
+        this._compensated = true
+    }
+
+    get compensated(): boolean {
+        return this._compensated
+    }
+}
+
+class FailOperation implements ITransactionOperation {
+    readonly name = 'fail'
+    readonly data = {}
+
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return true
+    }
+
+    async execute(_ctx: ITransactionContext): Promise<OperationResult> {
+        return { success: false, error: 'Intentional failure', errorCode: 'FAIL' }
+    }
+
+    async compensate(_ctx: ITransactionContext): Promise<void> {
+        // No-op
+    }
+}
+
+class ValidationFailOperation implements ITransactionOperation {
+    readonly name = 'validation-fail'
+    readonly data = {}
+
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return false
+    }
+
+    async execute(_ctx: ITransactionContext): Promise<OperationResult> {
+        return { success: true }
+    }
+
+    async compensate(_ctx: ITransactionContext): Promise<void> {
+        // No-op
+    }
+}
+
+class SlowOperation implements ITransactionOperation {
+    readonly name = 'slow'
+    readonly data: { delay: number }
+
+    constructor(delay: number) {
+        this.data = { delay }
+    }
+
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return true
+    }
+
+    async execute(_ctx: ITransactionContext): Promise<OperationResult> {
+        await new Promise((resolve) => setTimeout(resolve, this.data.delay))
+        return { success: true }
+    }
+
+    async compensate(_ctx: ITransactionContext): Promise<void> {
+        // No-op
+    }
+}
+
+class ContextDataOperation implements ITransactionOperation {
+    readonly name = 'context-data'
+    readonly data = {}
+
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return true
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult> {
+        ctx.set('testKey', 'testValue')
+        ctx.set('numberKey', 42)
+        return { success: true, data: { stored: true } }
+    }
+
+    async compensate(_ctx: ITransactionContext): Promise<void> {
+        // No-op
+    }
+}
+
+// ============================================================================
+// Test Suite | 测试套件
+// ============================================================================
+
+describe('TransactionContext', () => {
+    let storage: MemoryStorage
+
+    beforeEach(() => {
+        storage = new MemoryStorage()
+    })
+
+    // ========================================================================
+    // 构造器测试 | Constructor Tests
+    // ========================================================================
+
+    describe('Constructor', () => {
+        it('should create with default options', () => {
+            const ctx = new TransactionContext()
+            expect(ctx.id).toMatch(/^tx_/)
+            expect(ctx.state).toBe('pending')
+            expect(ctx.timeout).toBe(30000)
+            expect(ctx.operations).toHaveLength(0)
+            expect(ctx.storage).toBeNull()
+        })
+
+        it('should create with custom options', () => {
+            const ctx = new TransactionContext({
+                timeout: 10000,
+                storage,
+                metadata: { userId: 'user-1' },
+                distributed: true,
+            })
+
+            expect(ctx.timeout).toBe(10000)
+            expect(ctx.storage).toBe(storage)
+            expect(ctx.metadata.userId).toBe('user-1')
+        })
+
+        it('should use createTransactionContext factory', () => {
+            const ctx = createTransactionContext({ timeout: 5000 })
+            expect(ctx).toBeDefined()
+            expect(ctx.timeout).toBe(5000)
+        })
+    })
+
+    // ========================================================================
+    // 添加操作测试 | Add Operation Tests
+    // ========================================================================
+
+    describe('addOperation()', () => {
+        it('should add operations', () => {
+            const ctx = new TransactionContext()
+            const op1 = new SuccessOperation('op1', 10)
+            const op2 = new SuccessOperation('op2', 20)
+
+            ctx.addOperation(op1).addOperation(op2)
+
+            expect(ctx.operations).toHaveLength(2)
+            expect(ctx.operations[0]).toBe(op1)
+            expect(ctx.operations[1]).toBe(op2)
+        })
+
+        it('should support method chaining', () => {
+            const ctx = new TransactionContext()
+            const result = ctx
+                .addOperation(new SuccessOperation('op1', 10))
+                .addOperation(new SuccessOperation('op2', 20))
+
+            expect(result).toBe(ctx)
+        })
+
+        it('should throw when adding to non-pending transaction', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new SuccessOperation('op1', 10))
+            await ctx.execute()
+
+            expect(() => ctx.addOperation(new SuccessOperation('op2', 20))).toThrow(
+                'Cannot add operation to transaction in state'
+            )
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 | Execute Tests
+    // ========================================================================
+
+    describe('execute()', () => {
+        it('should execute all operations successfully', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new SuccessOperation('op1', 10))
+            ctx.addOperation(new SuccessOperation('op2', 20))
+
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(true)
+            expect(result.transactionId).toBe(ctx.id)
+            expect(result.results).toHaveLength(2)
+            expect(result.duration).toBeGreaterThanOrEqual(0)
+            expect(ctx.state).toBe('committed')
+        })
+
+        it('should return combined result data', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new SuccessOperation('op1', 10))
+
+            const result = await ctx.execute<{ doubled: number }>()
+
+            expect(result.success).toBe(true)
+            expect(result.data?.doubled).toBe(20)
+        })
+
+        it('should fail if already executed', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new SuccessOperation('op1', 10))
+
+            await ctx.execute()
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(false)
+            expect(result.error).toContain('already in state')
+        })
+
+        it('should fail on validation error', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new ValidationFailOperation())
+
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(false)
+            expect(result.error).toContain('Validation failed')
+            expect(ctx.state).toBe('rolledback')
+        })
+
+        it('should fail and rollback on operation failure', async () => {
+            const ctx = new TransactionContext()
+            const op1 = new SuccessOperation('op1', 10)
+            const op2 = new FailOperation()
+
+            ctx.addOperation(op1).addOperation(op2)
+
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(false)
+            expect(result.error).toBe('Intentional failure')
+            expect(ctx.state).toBe('rolledback')
+            expect(op1.compensated).toBe(true)
+        })
+
+        it('should timeout on slow operations', async () => {
+            const ctx = new TransactionContext({ timeout: 50 })
+            // Add two operations - timeout is checked between operations
+            ctx.addOperation(new SlowOperation(100))
+            ctx.addOperation(new SuccessOperation('second', 1))
+
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(false)
+            expect(result.error).toContain('timed out')
+            expect(ctx.state).toBe('rolledback')
+        })
+
+        it('should save transaction log with storage', async () => {
+            const ctx = new TransactionContext({ storage })
+            ctx.addOperation(new SuccessOperation('op1', 10))
+
+            await ctx.execute()
+
+            const log = await storage.getTransaction(ctx.id)
+            expect(log).not.toBeNull()
+            expect(log?.state).toBe('committed')
+            expect(log?.operations).toHaveLength(1)
+            expect(log?.operations[0].state).toBe('executed')
+        })
+
+        it('should update operation states on failure', async () => {
+            const ctx = new TransactionContext({ storage })
+            ctx.addOperation(new SuccessOperation('op1', 10))
+            ctx.addOperation(new FailOperation())
+
+            await ctx.execute()
+
+            const log = await storage.getTransaction(ctx.id)
+            expect(log?.state).toBe('rolledback')
+            expect(log?.operations[0].state).toBe('compensated')
+        })
+    })
+
+    // ========================================================================
+    // 回滚测试 | Rollback Tests
+    // ========================================================================
+
+    describe('rollback()', () => {
+        it('should rollback pending transaction', async () => {
+            const ctx = new TransactionContext()
+            const op1 = new SuccessOperation('op1', 10)
+            ctx.addOperation(op1)
+
+            await ctx.rollback()
+
+            expect(ctx.state).toBe('rolledback')
+        })
+
+        it('should not rollback already committed transaction', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new SuccessOperation('op1', 10))
+
+            await ctx.execute()
+            expect(ctx.state).toBe('committed')
+
+            await ctx.rollback()
+            expect(ctx.state).toBe('committed')
+        })
+
+        it('should not rollback already rolledback transaction', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new FailOperation())
+
+            await ctx.execute()
+            expect(ctx.state).toBe('rolledback')
+
+            await ctx.rollback()
+            expect(ctx.state).toBe('rolledback')
+        })
+    })
+
+    // ========================================================================
+    // 上下文数据测试 | Context Data Tests
+    // ========================================================================
+
+    describe('Context Data', () => {
+        it('should get and set context data', () => {
+            const ctx = new TransactionContext()
+
+            ctx.set('key1', 'value1')
+            ctx.set('key2', { nested: true })
+
+            expect(ctx.get<string>('key1')).toBe('value1')
+            expect(ctx.get<{ nested: boolean }>('key2')).toEqual({ nested: true })
+        })
+
+        it('should return undefined for non-existent key', () => {
+            const ctx = new TransactionContext()
+            expect(ctx.get('nonexistent')).toBeUndefined()
+        })
+
+        it('should allow operations to share context data', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new ContextDataOperation())
+
+            await ctx.execute()
+
+            expect(ctx.get<string>('testKey')).toBe('testValue')
+            expect(ctx.get<number>('numberKey')).toBe(42)
+        })
+    })
+
+    // ========================================================================
+    // 边界情况测试 | Edge Cases
+    // ========================================================================
+
+    describe('Edge Cases', () => {
+        it('should handle empty operations list', async () => {
+            const ctx = new TransactionContext()
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(true)
+            expect(result.results).toHaveLength(0)
+            expect(ctx.state).toBe('committed')
+        })
+
+        it('should handle single operation', async () => {
+            const ctx = new TransactionContext()
+            ctx.addOperation(new SuccessOperation('single', 5))
+
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(true)
+            expect(result.results).toHaveLength(1)
+        })
+
+        it('should handle operation throwing exception', async () => {
+            const ctx = new TransactionContext()
+            const throwOp: ITransactionOperation = {
+                name: 'throw',
+                data: {},
+                validate: async () => true,
+                execute: async () => {
+                    throw new Error('Unexpected error')
+                },
+                compensate: async () => {},
+            }
+
+            ctx.addOperation(throwOp)
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(false)
+            expect(result.error).toBe('Unexpected error')
+        })
+
+        it('should handle compensate throwing exception', async () => {
+            const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+            const ctx = new TransactionContext({ storage })
+            const badCompensateOp: ITransactionOperation = {
+                name: 'bad-compensate',
+                data: {},
+                validate: async () => true,
+                execute: async () => ({ success: true }),
+                compensate: async () => {
+                    throw new Error('Compensation error')
+                },
+            }
+            const failOp = new FailOperation()
+
+            ctx.addOperation(badCompensateOp).addOperation(failOp)
+            const result = await ctx.execute()
+
+            expect(result.success).toBe(false)
+
+            // Check that operation state was updated with error
+            const log = await storage.getTransaction(ctx.id)
+            expect(log?.operations[0].state).toBe('failed')
+            expect(log?.operations[0].error).toContain('Compensation error')
+
+            consoleSpy.mockRestore()
+        })
+    })
+})

packages/framework/transaction/__tests__/core/TransactionManager.test.ts

@@ -0,0 +1,358 @@
+/**
+ * @zh TransactionManager 单元测试
+ * @en TransactionManager unit tests
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import { TransactionManager, createTransactionManager } from '../../src/core/TransactionManager.js'
+import { MemoryStorage } from '../../src/storage/MemoryStorage.js'
+import type { ITransactionOperation, ITransactionContext, OperationResult } from '../../src/core/types.js'
+
+// ============================================================================
+// Mock Operation | 模拟操作
+// ============================================================================
+
+class MockOperation implements ITransactionOperation<{ value: number }, { result: number }> {
+    readonly name = 'mock'
+    readonly data: { value: number }
+
+    private _executed = false
+
+    constructor(value: number) {
+        this.data = { value }
+    }
+
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return this.data.value > 0
+    }
+
+    async execute(_ctx: ITransactionContext): Promise<OperationResult<{ result: number }>> {
+        this._executed = true
+        return { success: true, data: { result: this.data.value * 2 } }
+    }
+
+    async compensate(_ctx: ITransactionContext): Promise<void> {
+        this._executed = false
+    }
+
+    get executed(): boolean {
+        return this._executed
+    }
+}
+
+class FailingOperation implements ITransactionOperation<{ shouldFail: boolean }> {
+    readonly name = 'failing'
+    readonly data: { shouldFail: boolean }
+
+    constructor(shouldFail: boolean) {
+        this.data = { shouldFail }
+    }
+
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return true
+    }
+
+    async execute(_ctx: ITransactionContext): Promise<OperationResult> {
+        if (this.data.shouldFail) {
+            return { success: false, error: 'Intentional failure' }
+        }
+        return { success: true }
+    }
+
+    async compensate(_ctx: ITransactionContext): Promise<void> {
+        // No-op
+    }
+}
+
+// ============================================================================
+// Test Suite | 测试套件
+// ============================================================================
+
+describe('TransactionManager', () => {
+    let manager: TransactionManager
+    let storage: MemoryStorage
+
+    beforeEach(() => {
+        storage = new MemoryStorage()
+        manager = new TransactionManager({
+            storage,
+            defaultTimeout: 5000,
+            serverId: 'test-server',
+        })
+    })
+
+    // ========================================================================
+    // 构造器测试 | Constructor Tests
+    // ========================================================================
+
+    describe('Constructor', () => {
+        it('should create with default config', () => {
+            const defaultManager = new TransactionManager()
+            expect(defaultManager.storage).toBeNull()
+            expect(defaultManager.activeCount).toBe(0)
+            expect(defaultManager.serverId).toMatch(/^server_/)
+        })
+
+        it('should use provided config', () => {
+            expect(manager.storage).toBe(storage)
+            expect(manager.serverId).toBe('test-server')
+        })
+
+        it('should use createTransactionManager factory', () => {
+            const factoryManager = createTransactionManager({ serverId: 'factory-server' })
+            expect(factoryManager).toBeInstanceOf(TransactionManager)
+            expect(factoryManager.serverId).toBe('factory-server')
+        })
+    })
+
+    // ========================================================================
+    // 事务创建测试 | Transaction Creation Tests
+    // ========================================================================
+
+    describe('begin()', () => {
+        it('should create new transaction context', () => {
+            const tx = manager.begin()
+            expect(tx.id).toMatch(/^tx_/)
+            expect(tx.state).toBe('pending')
+        })
+
+        it('should track active transactions', () => {
+            expect(manager.activeCount).toBe(0)
+
+            const tx1 = manager.begin()
+            expect(manager.activeCount).toBe(1)
+
+            const tx2 = manager.begin()
+            expect(manager.activeCount).toBe(2)
+
+            expect(manager.getTransaction(tx1.id)).toBe(tx1)
+            expect(manager.getTransaction(tx2.id)).toBe(tx2)
+        })
+
+        it('should use custom timeout', () => {
+            const tx = manager.begin({ timeout: 10000 })
+            expect(tx.timeout).toBe(10000)
+        })
+
+        it('should include serverId in metadata', () => {
+            const tx = manager.begin()
+            expect(tx.metadata.serverId).toBe('test-server')
+        })
+
+        it('should merge custom metadata', () => {
+            const tx = manager.begin({
+                metadata: { userId: 'user-1', action: 'purchase' },
+            })
+            expect(tx.metadata.serverId).toBe('test-server')
+            expect(tx.metadata.userId).toBe('user-1')
+            expect(tx.metadata.action).toBe('purchase')
+        })
+    })
+
+    // ========================================================================
+    // run() 便捷方法测试 | run() Convenience Method Tests
+    // ========================================================================
+
+    describe('run()', () => {
+        it('should execute transaction with builder', async () => {
+            const result = await manager.run((ctx) => {
+                ctx.addOperation(new MockOperation(10))
+            })
+
+            expect(result.success).toBe(true)
+            expect(result.transactionId).toMatch(/^tx_/)
+            expect(result.duration).toBeGreaterThanOrEqual(0)
+        })
+
+        it('should support async builder', async () => {
+            const result = await manager.run(async (ctx) => {
+                await Promise.resolve()
+                ctx.addOperation(new MockOperation(5))
+            })
+
+            expect(result.success).toBe(true)
+        })
+
+        it('should clean up active transaction after run', async () => {
+            expect(manager.activeCount).toBe(0)
+
+            await manager.run((ctx) => {
+                ctx.addOperation(new MockOperation(10))
+                expect(manager.activeCount).toBe(1)
+            })
+
+            expect(manager.activeCount).toBe(0)
+        })
+
+        it('should clean up even on failure', async () => {
+            await manager.run((ctx) => {
+                ctx.addOperation(new FailingOperation(true))
+            })
+
+            expect(manager.activeCount).toBe(0)
+        })
+
+        it('should return typed result data', async () => {
+            const result = await manager.run<{ result: number }>((ctx) => {
+                ctx.addOperation(new MockOperation(10))
+            })
+
+            expect(result.success).toBe(true)
+            expect(result.data?.result).toBe(20)
+        })
+    })
+
+    // ========================================================================
+    // 分布式锁测试 | Distributed Lock Tests
+    // ========================================================================
+
+    describe('Distributed Lock', () => {
+        it('should acquire and release lock', async () => {
+            const token = await manager.acquireLock('resource-1', 5000)
+            expect(token).not.toBeNull()
+
+            const released = await manager.releaseLock('resource-1', token!)
+            expect(released).toBe(true)
+        })
+
+        it('should return null without storage', async () => {
+            const noStorageManager = new TransactionManager()
+
+            const token = await noStorageManager.acquireLock('key', 5000)
+            expect(token).toBeNull()
+
+            const released = await noStorageManager.releaseLock('key', 'token')
+            expect(released).toBe(false)
+        })
+
+        it('should execute withLock successfully', async () => {
+            let executed = false
+
+            await manager.withLock('resource-1', async () => {
+                executed = true
+                return 'result'
+            })
+
+            expect(executed).toBe(true)
+        })
+
+        it('should throw if lock acquisition fails', async () => {
+            // First acquire the lock
+            await storage.acquireLock('resource-1', 5000)
+
+            // Try to acquire with withLock - should fail
+            await expect(
+                manager.withLock('resource-1', async () => {
+                    return 'should not reach'
+                })
+            ).rejects.toThrow('Failed to acquire lock')
+        })
+
+        it('should release lock after withLock completes', async () => {
+            await manager.withLock('resource-1', async () => {
+                return 'done'
+            })
+
+            // Should be able to acquire again
+            const token = await manager.acquireLock('resource-1', 5000)
+            expect(token).not.toBeNull()
+        })
+
+        it('should release lock even if function throws', async () => {
+            try {
+                await manager.withLock('resource-1', async () => {
+                    throw new Error('Test error')
+                })
+            } catch {
+                // Expected
+            }
+
+            // Should be able to acquire again
+            const token = await manager.acquireLock('resource-1', 5000)
+            expect(token).not.toBeNull()
+        })
+    })
+
+    // ========================================================================
+    // 事务恢复测试 | Transaction Recovery Tests
+    // ========================================================================
+
+    describe('recover()', () => {
+        it('should return 0 without storage', async () => {
+            const noStorageManager = new TransactionManager()
+            const count = await noStorageManager.recover()
+            expect(count).toBe(0)
+        })
+
+        it('should recover pending transactions', async () => {
+            // Save a pending transaction directly to storage
+            await storage.saveTransaction({
+                id: 'tx-pending',
+                state: 'executing',
+                createdAt: Date.now(),
+                updatedAt: Date.now(),
+                timeout: 5000,
+                operations: [
+                    { name: 'op1', state: 'executed' },
+                ],
+                metadata: { serverId: 'test-server' },
+            })
+
+            const count = await manager.recover()
+            expect(count).toBe(1)
+
+            // Check that transaction state was updated
+            const recovered = await storage.getTransaction('tx-pending')
+            expect(recovered?.state).toBe('rolledback')
+        })
+    })
+
+    // ========================================================================
+    // 清理测试 | Cleanup Tests
+    // ========================================================================
+
+    describe('cleanup()', () => {
+        it('should return 0 without storage', async () => {
+            const noStorageManager = new TransactionManager()
+            const count = await noStorageManager.cleanup()
+            expect(count).toBe(0)
+        })
+
+        it('should clean old completed transactions from pending list', async () => {
+            const oldTimestamp = Date.now() - 48 * 60 * 60 * 1000 // 48 hours ago
+
+            // Note: cleanup() uses getPendingTransactions() which only returns pending/executing state
+            // This test verifies the cleanup logic for transactions that are in pending state
+            // but have been marked committed/rolledback (edge case during recovery)
+            await storage.saveTransaction({
+                id: 'tx-old-pending',
+                state: 'pending', // This will be returned by getPendingTransactions
+                createdAt: oldTimestamp,
+                updatedAt: oldTimestamp,
+                timeout: 5000,
+                operations: [],
+            })
+
+            // The current implementation doesn't clean pending transactions
+            // This is a limitation - cleanup only works for committed/rolledback states
+            // but getPendingTransactions doesn't return those
+            const count = await manager.cleanup()
+            expect(count).toBe(0) // Nothing cleaned because state is 'pending', not 'committed'
+        })
+    })
+
+    // ========================================================================
+    // getTransaction 测试 | getTransaction Tests
+    // ========================================================================
+
+    describe('getTransaction()', () => {
+        it('should return active transaction', () => {
+            const tx = manager.begin()
+            expect(manager.getTransaction(tx.id)).toBe(tx)
+        })
+
+        it('should return undefined for non-existent transaction', () => {
+            expect(manager.getTransaction('non-existent')).toBeUndefined()
+        })
+    })
+})

packages/framework/transaction/__tests__/distributed/SagaOrchestrator.test.ts

@@ -0,0 +1,574 @@
+/**
+ * @zh SagaOrchestrator 单元测试
+ * @en SagaOrchestrator unit tests
+ */
+
+import { describe, it, expect, beforeEach, vi } from 'vitest'
+import {
+    SagaOrchestrator,
+    createSagaOrchestrator,
+    type SagaStep,
+    type SagaLog,
+} from '../../src/distributed/SagaOrchestrator.js'
+import { MemoryStorage } from '../../src/storage/MemoryStorage.js'
+
+// ============================================================================
+// Test Suite | 测试套件
+// ============================================================================
+
+describe('SagaOrchestrator', () => {
+    let storage: MemoryStorage
+    let orchestrator: SagaOrchestrator
+
+    beforeEach(() => {
+        storage = new MemoryStorage()
+        orchestrator = new SagaOrchestrator({
+            storage,
+            timeout: 5000,
+            serverId: 'test-server',
+        })
+    })
+
+    // ========================================================================
+    // 构造器测试 | Constructor Tests
+    // ========================================================================
+
+    describe('Constructor', () => {
+        it('should create with default config', () => {
+            const defaultOrchestrator = new SagaOrchestrator()
+            expect(defaultOrchestrator).toBeDefined()
+        })
+
+        it('should create with custom config', () => {
+            const customOrchestrator = new SagaOrchestrator({
+                storage,
+                timeout: 10000,
+                serverId: 'custom-server',
+            })
+            expect(customOrchestrator).toBeDefined()
+        })
+
+        it('should use createSagaOrchestrator factory', () => {
+            const factoryOrchestrator = createSagaOrchestrator({ serverId: 'factory-server' })
+            expect(factoryOrchestrator).toBeInstanceOf(SagaOrchestrator)
+        })
+    })
+
+    // ========================================================================
+    // 成功执行测试 | Successful Execution Tests
+    // ========================================================================
+
+    describe('execute() - success', () => {
+        it('should execute single step saga', async () => {
+            const executeLog: string[] = []
+
+            const steps: SagaStep<{ value: number }>[] = [
+                {
+                    name: 'step1',
+                    execute: async (data) => {
+                        executeLog.push(`execute:${data.value}`)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        executeLog.push(`compensate:${data.value}`)
+                    },
+                    data: { value: 1 },
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            expect(result.success).toBe(true)
+            expect(result.sagaId).toMatch(/^saga_/)
+            expect(result.completedSteps).toEqual(['step1'])
+            expect(result.duration).toBeGreaterThanOrEqual(0)
+            expect(executeLog).toEqual(['execute:1'])
+        })
+
+        it('should execute multi-step saga', async () => {
+            const executeLog: string[] = []
+
+            const steps: SagaStep<{ name: string }>[] = [
+                {
+                    name: 'step1',
+                    execute: async (data) => {
+                        executeLog.push(`execute:${data.name}`)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        executeLog.push(`compensate:${data.name}`)
+                    },
+                    data: { name: 'A' },
+                },
+                {
+                    name: 'step2',
+                    execute: async (data) => {
+                        executeLog.push(`execute:${data.name}`)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        executeLog.push(`compensate:${data.name}`)
+                    },
+                    data: { name: 'B' },
+                },
+                {
+                    name: 'step3',
+                    execute: async (data) => {
+                        executeLog.push(`execute:${data.name}`)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        executeLog.push(`compensate:${data.name}`)
+                    },
+                    data: { name: 'C' },
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            expect(result.success).toBe(true)
+            expect(result.completedSteps).toEqual(['step1', 'step2', 'step3'])
+            expect(executeLog).toEqual(['execute:A', 'execute:B', 'execute:C'])
+        })
+
+        it('should save saga log on success', async () => {
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            const log = await orchestrator.getSagaLog(result.sagaId)
+            expect(log).not.toBeNull()
+            expect(log?.state).toBe('completed')
+            expect(log?.steps[0].state).toBe('completed')
+        })
+    })
+
+    // ========================================================================
+    // 失败和补偿测试 | Failure and Compensation Tests
+    // ========================================================================
+
+    describe('execute() - failure and compensation', () => {
+        it('should compensate on step failure', async () => {
+            const executeLog: string[] = []
+
+            const steps: SagaStep<{ name: string }>[] = [
+                {
+                    name: 'step1',
+                    execute: async (data) => {
+                        executeLog.push(`execute:${data.name}`)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        executeLog.push(`compensate:${data.name}`)
+                    },
+                    data: { name: 'A' },
+                },
+                {
+                    name: 'step2',
+                    execute: async (data) => {
+                        executeLog.push(`execute:${data.name}`)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        executeLog.push(`compensate:${data.name}`)
+                    },
+                    data: { name: 'B' },
+                },
+                {
+                    name: 'step3',
+                    execute: async () => {
+                        return { success: false, error: 'Step 3 failed' }
+                    },
+                    compensate: async () => {},
+                    data: { name: 'C' },
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            expect(result.success).toBe(false)
+            expect(result.failedStep).toBe('step3')
+            expect(result.error).toBe('Step 3 failed')
+            expect(result.completedSteps).toEqual(['step1', 'step2'])
+
+            // Compensation should be in reverse order
+            expect(executeLog).toEqual([
+                'execute:A',
+                'execute:B',
+                'compensate:B',
+                'compensate:A',
+            ])
+        })
+
+        it('should save saga log on failure', async () => {
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {},
+                    data: {},
+                },
+                {
+                    name: 'step2',
+                    execute: async () => ({ success: false, error: 'Failed' }),
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            const log = await orchestrator.getSagaLog(result.sagaId)
+            expect(log?.state).toBe('compensated')
+            expect(log?.steps[0].state).toBe('compensated')
+            expect(log?.steps[1].state).toBe('failed')
+        })
+
+        it('should handle compensation error', async () => {
+            const consoleSpy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {
+                        throw new Error('Compensation failed')
+                    },
+                    data: {},
+                },
+                {
+                    name: 'step2',
+                    execute: async () => ({ success: false, error: 'Failed' }),
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            expect(result.success).toBe(false)
+
+            const log = await orchestrator.getSagaLog(result.sagaId)
+            expect(log?.steps[0].state).toBe('failed')
+            expect(log?.steps[0].error).toContain('Compensation failed')
+
+            consoleSpy.mockRestore()
+        })
+    })
+
+    // ========================================================================
+    // 超时测试 | Timeout Tests
+    // ========================================================================
+
+    describe('timeout', () => {
+        it('should timeout on slow saga', async () => {
+            const fastOrchestrator = new SagaOrchestrator({
+                storage,
+                timeout: 50, // 50ms timeout
+            })
+
+            // Timeout is checked between steps, so we need 2 steps
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'slow-step',
+                    execute: async () => {
+                        await new Promise((resolve) => setTimeout(resolve, 100))
+                        return { success: true }
+                    },
+                    compensate: async () => {},
+                    data: {},
+                },
+                {
+                    name: 'second-step',
+                    execute: async () => {
+                        return { success: true }
+                    },
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await fastOrchestrator.execute(steps)
+
+            expect(result.success).toBe(false)
+            expect(result.error).toContain('timed out')
+        })
+    })
+
+    // ========================================================================
+    // 分布式服务器测试 | Distributed Server Tests
+    // ========================================================================
+
+    describe('distributed servers', () => {
+        it('should track serverId for each step', async () => {
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    serverId: 'server-1',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {},
+                    data: {},
+                },
+                {
+                    name: 'step2',
+                    serverId: 'server-2',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            const log = await orchestrator.getSagaLog(result.sagaId)
+            expect(log?.steps[0].serverId).toBe('server-1')
+            expect(log?.steps[1].serverId).toBe('server-2')
+        })
+
+        it('should include orchestrator serverId in metadata', async () => {
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            const log = await orchestrator.getSagaLog(result.sagaId)
+            expect(log?.metadata?.orchestratorServerId).toBe('test-server')
+        })
+    })
+
+    // ========================================================================
+    // getSagaLog 测试 | getSagaLog Tests
+    // ========================================================================
+
+    describe('getSagaLog()', () => {
+        it('should return saga log by id', async () => {
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+            const log = await orchestrator.getSagaLog(result.sagaId)
+
+            expect(log).not.toBeNull()
+            expect(log?.id).toBe(result.sagaId)
+        })
+
+        it('should return null for non-existent saga', async () => {
+            const log = await orchestrator.getSagaLog('non-existent')
+            expect(log).toBeNull()
+        })
+
+        it('should return null without storage', async () => {
+            const noStorageOrchestrator = new SagaOrchestrator()
+            const log = await noStorageOrchestrator.getSagaLog('any-id')
+            expect(log).toBeNull()
+        })
+    })
+
+    // ========================================================================
+    // 恢复测试 | Recovery Tests
+    // ========================================================================
+
+    describe('recover()', () => {
+        it('should return 0 without storage', async () => {
+            const noStorageOrchestrator = new SagaOrchestrator()
+            const count = await noStorageOrchestrator.recover()
+            expect(count).toBe(0)
+        })
+
+        it('should return 0 when no pending sagas', async () => {
+            const count = await orchestrator.recover()
+            expect(count).toBe(0)
+        })
+    })
+
+    // ========================================================================
+    // 边界情况测试 | Edge Cases
+    // ========================================================================
+
+    describe('Edge Cases', () => {
+        it('should handle empty steps', async () => {
+            const result = await orchestrator.execute([])
+
+            expect(result.success).toBe(true)
+            expect(result.completedSteps).toEqual([])
+        })
+
+        it('should handle execute throwing exception', async () => {
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'throwing-step',
+                    execute: async () => {
+                        throw new Error('Unexpected error')
+                    },
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            expect(result.success).toBe(false)
+            expect(result.error).toBe('Unexpected error')
+        })
+
+        it('should work without storage', async () => {
+            const noStorageOrchestrator = new SagaOrchestrator()
+
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    execute: async () => ({ success: true }),
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await noStorageOrchestrator.execute(steps)
+
+            expect(result.success).toBe(true)
+        })
+
+        it('should track step timing', async () => {
+            const steps: SagaStep<{}>[] = [
+                {
+                    name: 'step1',
+                    execute: async () => {
+                        await new Promise((resolve) => setTimeout(resolve, 50))
+                        return { success: true }
+                    },
+                    compensate: async () => {},
+                    data: {},
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            const log = await orchestrator.getSagaLog(result.sagaId)
+            expect(log?.steps[0].startedAt).toBeGreaterThan(0)
+            expect(log?.steps[0].completedAt).toBeGreaterThan(log?.steps[0].startedAt!)
+        })
+    })
+
+    // ========================================================================
+    // 实际场景测试 | Real World Scenario Tests
+    // ========================================================================
+
+    describe('Real World Scenarios', () => {
+        it('should handle distributed purchase flow', async () => {
+            const inventory: Map<string, number> = new Map()
+            const wallet: Map<string, number> = new Map()
+
+            inventory.set('item-1', 10)
+            wallet.set('player-1', 1000)
+
+            const steps: SagaStep<{ playerId: string; itemId: string; price: number }>[] = [
+                {
+                    name: 'deduct_currency',
+                    serverId: 'wallet-server',
+                    execute: async (data) => {
+                        const balance = wallet.get(data.playerId) ?? 0
+                        if (balance < data.price) {
+                            return { success: false, error: 'Insufficient balance' }
+                        }
+                        wallet.set(data.playerId, balance - data.price)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        const balance = wallet.get(data.playerId) ?? 0
+                        wallet.set(data.playerId, balance + data.price)
+                    },
+                    data: { playerId: 'player-1', itemId: 'item-1', price: 100 },
+                },
+                {
+                    name: 'reserve_item',
+                    serverId: 'inventory-server',
+                    execute: async (data) => {
+                        const stock = inventory.get(data.itemId) ?? 0
+                        if (stock < 1) {
+                            return { success: false, error: 'Out of stock' }
+                        }
+                        inventory.set(data.itemId, stock - 1)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        const stock = inventory.get(data.itemId) ?? 0
+                        inventory.set(data.itemId, stock + 1)
+                    },
+                    data: { playerId: 'player-1', itemId: 'item-1', price: 100 },
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            expect(result.success).toBe(true)
+            expect(wallet.get('player-1')).toBe(900)
+            expect(inventory.get('item-1')).toBe(9)
+        })
+
+        it('should rollback distributed purchase on inventory failure', async () => {
+            const wallet: Map<string, number> = new Map()
+            const inventory: Map<string, number> = new Map()
+
+            wallet.set('player-1', 1000)
+            inventory.set('item-1', 0) // Out of stock
+
+            const steps: SagaStep<{ playerId: string; itemId: string; price: number }>[] = [
+                {
+                    name: 'deduct_currency',
+                    execute: async (data) => {
+                        const balance = wallet.get(data.playerId) ?? 0
+                        wallet.set(data.playerId, balance - data.price)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        const balance = wallet.get(data.playerId) ?? 0
+                        wallet.set(data.playerId, balance + data.price)
+                    },
+                    data: { playerId: 'player-1', itemId: 'item-1', price: 100 },
+                },
+                {
+                    name: 'reserve_item',
+                    execute: async (data) => {
+                        const stock = inventory.get(data.itemId) ?? 0
+                        if (stock < 1) {
+                            return { success: false, error: 'Out of stock' }
+                        }
+                        inventory.set(data.itemId, stock - 1)
+                        return { success: true }
+                    },
+                    compensate: async (data) => {
+                        const stock = inventory.get(data.itemId) ?? 0
+                        inventory.set(data.itemId, stock + 1)
+                    },
+                    data: { playerId: 'player-1', itemId: 'item-1', price: 100 },
+                },
+            ]
+
+            const result = await orchestrator.execute(steps)
+
+            expect(result.success).toBe(false)
+            expect(result.error).toBe('Out of stock')
+            expect(wallet.get('player-1')).toBe(1000) // Restored
+            expect(inventory.get('item-1')).toBe(0) // Unchanged
+        })
+    })
+})

packages/framework/transaction/__tests__/operations/CurrencyOperation.test.ts

@@ -0,0 +1,480 @@
+/**
+ * @zh CurrencyOperation 单元测试
+ * @en CurrencyOperation unit tests
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import { CurrencyOperation, createCurrencyOperation, type ICurrencyProvider } from '../../src/operations/CurrencyOperation.js'
+import { TransactionContext } from '../../src/core/TransactionContext.js'
+import { MemoryStorage } from '../../src/storage/MemoryStorage.js'
+import type { ITransactionContext } from '../../src/core/types.js'
+
+// ============================================================================
+// Mock Provider | 模拟数据提供者
+// ============================================================================
+
+class MockCurrencyProvider implements ICurrencyProvider {
+    private _balances: Map<string, Map<string, number>> = new Map()
+
+    setInitialBalance(playerId: string, currency: string, amount: number): void {
+        if (!this._balances.has(playerId)) {
+            this._balances.set(playerId, new Map())
+        }
+        this._balances.get(playerId)!.set(currency, amount)
+    }
+
+    async getBalance(playerId: string, currency: string): Promise<number> {
+        return this._balances.get(playerId)?.get(currency) ?? 0
+    }
+
+    async setBalance(playerId: string, currency: string, amount: number): Promise<void> {
+        if (!this._balances.has(playerId)) {
+            this._balances.set(playerId, new Map())
+        }
+        this._balances.get(playerId)!.set(currency, amount)
+    }
+}
+
+// ============================================================================
+// Test Suite | 测试套件
+// ============================================================================
+
+describe('CurrencyOperation', () => {
+    let storage: MemoryStorage
+    let ctx: ITransactionContext
+
+    beforeEach(() => {
+        storage = new MemoryStorage()
+        ctx = new TransactionContext({ storage })
+    })
+
+    // ========================================================================
+    // 构造器测试 | Constructor Tests
+    // ========================================================================
+
+    describe('Constructor', () => {
+        it('should create with data', () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            expect(op.name).toBe('currency')
+            expect(op.data.type).toBe('add')
+            expect(op.data.playerId).toBe('player-1')
+            expect(op.data.currency).toBe('gold')
+            expect(op.data.amount).toBe(100)
+        })
+
+        it('should use createCurrencyOperation factory', () => {
+            const op = createCurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-2',
+                currency: 'diamond',
+                amount: 50,
+            })
+
+            expect(op).toBeInstanceOf(CurrencyOperation)
+            expect(op.data.type).toBe('deduct')
+        })
+    })
+
+    // ========================================================================
+    // 验证测试 | Validation Tests
+    // ========================================================================
+
+    describe('validate()', () => {
+        it('should fail validation with zero amount', async () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 0,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should fail validation with negative amount', async () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: -10,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should pass validation for add with positive amount', async () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(true)
+        })
+
+        it('should fail validation for deduct with insufficient balance', async () => {
+            await storage.set('player:player-1:currency:gold', 50)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should pass validation for deduct with sufficient balance', async () => {
+            await storage.set('player:player-1:currency:gold', 150)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(true)
+        })
+
+        it('should use provider for validation', async () => {
+            const provider = new MockCurrencyProvider()
+            provider.setInitialBalance('player-1', 'gold', 200)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 150,
+            }).setProvider(provider)
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(true)
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 增加货币 | Execute Tests - Add Currency
+    // ========================================================================
+
+    describe('execute() - add', () => {
+        it('should add currency to empty balance', async () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeBalance).toBe(0)
+            expect(result.data?.afterBalance).toBe(100)
+
+            const balance = await storage.get<number>('player:player-1:currency:gold')
+            expect(balance).toBe(100)
+        })
+
+        it('should add currency to existing balance', async () => {
+            await storage.set('player:player-1:currency:gold', 50)
+
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeBalance).toBe(50)
+            expect(result.data?.afterBalance).toBe(150)
+        })
+
+        it('should store context data for verification', async () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            await op.execute(ctx)
+
+            expect(ctx.get('currency:player-1:gold:before')).toBe(0)
+            expect(ctx.get('currency:player-1:gold:after')).toBe(100)
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 扣除货币 | Execute Tests - Deduct Currency
+    // ========================================================================
+
+    describe('execute() - deduct', () => {
+        it('should deduct currency from balance', async () => {
+            await storage.set('player:player-1:currency:gold', 200)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 75,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeBalance).toBe(200)
+            expect(result.data?.afterBalance).toBe(125)
+
+            const balance = await storage.get<number>('player:player-1:currency:gold')
+            expect(balance).toBe(125)
+        })
+
+        it('should fail deduct with insufficient balance', async () => {
+            await storage.set('player:player-1:currency:gold', 50)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(false)
+            expect(result.error).toBe('Insufficient balance')
+            expect(result.errorCode).toBe('INSUFFICIENT_BALANCE')
+        })
+
+        it('should deduct exact balance', async () => {
+            await storage.set('player:player-1:currency:gold', 100)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.afterBalance).toBe(0)
+        })
+    })
+
+    // ========================================================================
+    // 补偿测试 | Compensate Tests
+    // ========================================================================
+
+    describe('compensate()', () => {
+        it('should restore balance after add', async () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            await op.execute(ctx)
+            expect(await storage.get('player:player-1:currency:gold')).toBe(100)
+
+            await op.compensate(ctx)
+            expect(await storage.get('player:player-1:currency:gold')).toBe(0)
+        })
+
+        it('should restore balance after deduct', async () => {
+            await storage.set('player:player-1:currency:gold', 200)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 75,
+            })
+
+            await op.execute(ctx)
+            expect(await storage.get('player:player-1:currency:gold')).toBe(125)
+
+            await op.compensate(ctx)
+            expect(await storage.get('player:player-1:currency:gold')).toBe(200)
+        })
+    })
+
+    // ========================================================================
+    // Provider 测试 | Provider Tests
+    // ========================================================================
+
+    describe('Provider', () => {
+        it('should use provider for operations', async () => {
+            const provider = new MockCurrencyProvider()
+            provider.setInitialBalance('player-1', 'gold', 1000)
+
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 300,
+            }).setProvider(provider)
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeBalance).toBe(1000)
+            expect(result.data?.afterBalance).toBe(700)
+
+            const newBalance = await provider.getBalance('player-1', 'gold')
+            expect(newBalance).toBe(700)
+        })
+
+        it('should compensate using provider', async () => {
+            const provider = new MockCurrencyProvider()
+            provider.setInitialBalance('player-1', 'gold', 500)
+
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 200,
+            }).setProvider(provider)
+
+            await op.execute(ctx)
+            expect(await provider.getBalance('player-1', 'gold')).toBe(700)
+
+            await op.compensate(ctx)
+            expect(await provider.getBalance('player-1', 'gold')).toBe(500)
+        })
+
+        it('should support method chaining with setProvider', () => {
+            const provider = new MockCurrencyProvider()
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const result = op.setProvider(provider)
+            expect(result).toBe(op)
+        })
+    })
+
+    // ========================================================================
+    // 多货币类型测试 | Multiple Currency Types Tests
+    // ========================================================================
+
+    describe('Multiple Currency Types', () => {
+        it('should handle different currency types independently', async () => {
+            await storage.set('player:player-1:currency:gold', 1000)
+            await storage.set('player:player-1:currency:diamond', 50)
+
+            const goldOp = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 500,
+            })
+
+            const diamondOp = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'diamond',
+                amount: 10,
+            })
+
+            await goldOp.execute(ctx)
+            await diamondOp.execute(ctx)
+
+            expect(await storage.get('player:player-1:currency:gold')).toBe(500)
+            expect(await storage.get('player:player-1:currency:diamond')).toBe(60)
+        })
+
+        it('should handle multiple players independently', async () => {
+            await storage.set('player:player-1:currency:gold', 1000)
+            await storage.set('player:player-2:currency:gold', 500)
+
+            const op1 = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 300,
+            })
+
+            const op2 = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-2',
+                currency: 'gold',
+                amount: 300,
+            })
+
+            await op1.execute(ctx)
+            await op2.execute(ctx)
+
+            expect(await storage.get('player:player-1:currency:gold')).toBe(700)
+            expect(await storage.get('player:player-2:currency:gold')).toBe(800)
+        })
+    })
+
+    // ========================================================================
+    // 边界情况测试 | Edge Cases
+    // ========================================================================
+
+    describe('Edge Cases', () => {
+        it('should handle zero balance for new player', async () => {
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'new-player',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const result = await op.execute(ctx)
+            expect(result.data?.beforeBalance).toBe(0)
+        })
+
+        it('should handle context without storage', async () => {
+            const noStorageCtx = new TransactionContext()
+
+            const op = new CurrencyOperation({
+                type: 'add',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+            })
+
+            const result = await op.execute(noStorageCtx)
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeBalance).toBe(0)
+            expect(result.data?.afterBalance).toBe(100)
+        })
+
+        it('should include reason in data', () => {
+            const op = new CurrencyOperation({
+                type: 'deduct',
+                playerId: 'player-1',
+                currency: 'gold',
+                amount: 100,
+                reason: 'purchase_item',
+            })
+
+            expect(op.data.reason).toBe('purchase_item')
+        })
+    })
+})

packages/framework/transaction/__tests__/operations/InventoryOperation.test.ts

@@ -0,0 +1,624 @@
+/**
+ * @zh InventoryOperation 单元测试
+ * @en InventoryOperation unit tests
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import {
+    InventoryOperation,
+    createInventoryOperation,
+    type IInventoryProvider,
+    type ItemData,
+} from '../../src/operations/InventoryOperation.js'
+import { TransactionContext } from '../../src/core/TransactionContext.js'
+import { MemoryStorage } from '../../src/storage/MemoryStorage.js'
+import type { ITransactionContext } from '../../src/core/types.js'
+
+// ============================================================================
+// Mock Provider | 模拟数据提供者
+// ============================================================================
+
+class MockInventoryProvider implements IInventoryProvider {
+    private _inventory: Map<string, Map<string, ItemData>> = new Map()
+    private _capacity: Map<string, number> = new Map()
+
+    addItem(playerId: string, itemId: string, item: ItemData): void {
+        if (!this._inventory.has(playerId)) {
+            this._inventory.set(playerId, new Map())
+        }
+        this._inventory.get(playerId)!.set(itemId, item)
+    }
+
+    setCapacity(playerId: string, capacity: number): void {
+        this._capacity.set(playerId, capacity)
+    }
+
+    async getItem(playerId: string, itemId: string): Promise<ItemData | null> {
+        return this._inventory.get(playerId)?.get(itemId) ?? null
+    }
+
+    async setItem(playerId: string, itemId: string, item: ItemData | null): Promise<void> {
+        if (!this._inventory.has(playerId)) {
+            this._inventory.set(playerId, new Map())
+        }
+        if (item) {
+            this._inventory.get(playerId)!.set(itemId, item)
+        } else {
+            this._inventory.get(playerId)!.delete(itemId)
+        }
+    }
+
+    async hasCapacity(playerId: string, count: number): Promise<boolean> {
+        const capacity = this._capacity.get(playerId)
+        if (capacity === undefined) return true
+        const currentCount = this._inventory.get(playerId)?.size ?? 0
+        return currentCount + count <= capacity
+    }
+}
+
+// ============================================================================
+// Test Suite | 测试套件
+// ============================================================================
+
+describe('InventoryOperation', () => {
+    let storage: MemoryStorage
+    let ctx: ITransactionContext
+
+    beforeEach(() => {
+        storage = new MemoryStorage()
+        ctx = new TransactionContext({ storage })
+    })
+
+    // ========================================================================
+    // 构造器测试 | Constructor Tests
+    // ========================================================================
+
+    describe('Constructor', () => {
+        it('should create with data', () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword-001',
+                quantity: 1,
+            })
+
+            expect(op.name).toBe('inventory')
+            expect(op.data.type).toBe('add')
+            expect(op.data.playerId).toBe('player-1')
+            expect(op.data.itemId).toBe('sword-001')
+            expect(op.data.quantity).toBe(1)
+        })
+
+        it('should use createInventoryOperation factory', () => {
+            const op = createInventoryOperation({
+                type: 'remove',
+                playerId: 'player-2',
+                itemId: 'potion-hp',
+                quantity: 5,
+            })
+
+            expect(op).toBeInstanceOf(InventoryOperation)
+            expect(op.data.type).toBe('remove')
+        })
+    })
+
+    // ========================================================================
+    // 验证测试 | Validation Tests
+    // ========================================================================
+
+    describe('validate()', () => {
+        it('should fail validation with zero quantity', async () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 0,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should fail validation with negative quantity', async () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: -1,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should pass validation for add with positive quantity', async () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(true)
+        })
+
+        it('should fail validation for remove with insufficient quantity', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 2,
+            })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 5,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should fail validation for remove with non-existent item', async () => {
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'nonexistent',
+                quantity: 1,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should pass validation for remove with sufficient quantity', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 10,
+            })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 5,
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(true)
+        })
+
+        it('should check capacity with provider', async () => {
+            const provider = new MockInventoryProvider()
+            provider.setCapacity('player-1', 1)
+            provider.addItem('player-1', 'existing', { itemId: 'existing', quantity: 1 })
+
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'new-item',
+                quantity: 1,
+            }).setProvider(provider)
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 添加物品 | Execute Tests - Add Item
+    // ========================================================================
+
+    describe('execute() - add', () => {
+        it('should add new item to empty inventory', async () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeItem).toBeUndefined()
+            expect(result.data?.afterItem).toEqual({
+                itemId: 'sword',
+                quantity: 1,
+                properties: undefined,
+            })
+
+            const item = await storage.get<ItemData>('player:player-1:inventory:sword')
+            expect(item?.quantity).toBe(1)
+        })
+
+        it('should stack items when adding to existing', async () => {
+            await storage.set('player:player-1:inventory:potion', {
+                itemId: 'potion',
+                quantity: 5,
+            })
+
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'potion',
+                quantity: 3,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeItem?.quantity).toBe(5)
+            expect(result.data?.afterItem?.quantity).toBe(8)
+        })
+
+        it('should add item with properties', async () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'enchanted-sword',
+                quantity: 1,
+                properties: { damage: 100, enchant: 'fire' },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.afterItem?.properties).toEqual({
+                damage: 100,
+                enchant: 'fire',
+            })
+        })
+
+        it('should store context data', async () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            await op.execute(ctx)
+
+            expect(ctx.get('inventory:player-1:sword:before')).toBeNull()
+            expect(ctx.get('inventory:player-1:sword:after')).toEqual({
+                itemId: 'sword',
+                quantity: 1,
+                properties: undefined,
+            })
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 移除物品 | Execute Tests - Remove Item
+    // ========================================================================
+
+    describe('execute() - remove', () => {
+        it('should remove partial quantity', async () => {
+            await storage.set('player:player-1:inventory:potion', {
+                itemId: 'potion',
+                quantity: 10,
+            })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'potion',
+                quantity: 3,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.beforeItem?.quantity).toBe(10)
+            expect(result.data?.afterItem?.quantity).toBe(7)
+
+            const item = await storage.get<ItemData>('player:player-1:inventory:potion')
+            expect(item?.quantity).toBe(7)
+        })
+
+        it('should delete item when removing all quantity', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.afterItem).toBeUndefined()
+
+            const item = await storage.get('player:player-1:inventory:sword')
+            expect(item).toBeNull()
+        })
+
+        it('should fail when item not found', async () => {
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'nonexistent',
+                quantity: 1,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(false)
+            expect(result.error).toBe('Insufficient item quantity')
+            expect(result.errorCode).toBe('INSUFFICIENT_ITEM')
+        })
+
+        it('should fail when quantity insufficient', async () => {
+            await storage.set('player:player-1:inventory:potion', {
+                itemId: 'potion',
+                quantity: 2,
+            })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'potion',
+                quantity: 5,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(false)
+            expect(result.errorCode).toBe('INSUFFICIENT_ITEM')
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 更新物品 | Execute Tests - Update Item
+    // ========================================================================
+
+    describe('execute() - update', () => {
+        it('should update item properties', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+                properties: { damage: 10 },
+            })
+
+            const op = new InventoryOperation({
+                type: 'update',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 0, // keep existing
+                properties: { damage: 20, enchant: 'ice' },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.afterItem?.properties).toEqual({
+                damage: 20,
+                enchant: 'ice',
+            })
+            expect(result.data?.afterItem?.quantity).toBe(1)
+        })
+
+        it('should update item quantity', async () => {
+            await storage.set('player:player-1:inventory:potion', {
+                itemId: 'potion',
+                quantity: 5,
+            })
+
+            const op = new InventoryOperation({
+                type: 'update',
+                playerId: 'player-1',
+                itemId: 'potion',
+                quantity: 10,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.afterItem?.quantity).toBe(10)
+        })
+
+        it('should fail when updating non-existent item', async () => {
+            const op = new InventoryOperation({
+                type: 'update',
+                playerId: 'player-1',
+                itemId: 'nonexistent',
+                quantity: 1,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(false)
+            expect(result.error).toBe('Item not found')
+            expect(result.errorCode).toBe('ITEM_NOT_FOUND')
+        })
+    })
+
+    // ========================================================================
+    // 补偿测试 | Compensate Tests
+    // ========================================================================
+
+    describe('compensate()', () => {
+        it('should restore state after add', async () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            await op.execute(ctx)
+            expect(await storage.get('player:player-1:inventory:sword')).not.toBeNull()
+
+            await op.compensate(ctx)
+            expect(await storage.get('player:player-1:inventory:sword')).toBeNull()
+        })
+
+        it('should restore state after remove', async () => {
+            await storage.set('player:player-1:inventory:potion', {
+                itemId: 'potion',
+                quantity: 5,
+            })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'potion',
+                quantity: 3,
+            })
+
+            await op.execute(ctx)
+            const afterRemove = await storage.get<ItemData>('player:player-1:inventory:potion')
+            expect(afterRemove?.quantity).toBe(2)
+
+            await op.compensate(ctx)
+            const afterCompensate = await storage.get<ItemData>('player:player-1:inventory:potion')
+            expect(afterCompensate?.quantity).toBe(5)
+        })
+
+        it('should restore deleted item after remove all', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            await op.execute(ctx)
+            expect(await storage.get('player:player-1:inventory:sword')).toBeNull()
+
+            await op.compensate(ctx)
+            const restored = await storage.get<ItemData>('player:player-1:inventory:sword')
+            expect(restored?.quantity).toBe(1)
+        })
+
+        it('should restore state after update', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+                properties: { damage: 10 },
+            })
+
+            const op = new InventoryOperation({
+                type: 'update',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 0,
+                properties: { damage: 50 },
+            })
+
+            await op.execute(ctx)
+            await op.compensate(ctx)
+
+            const restored = await storage.get<ItemData>('player:player-1:inventory:sword')
+            expect(restored?.properties).toEqual({ damage: 10 })
+        })
+    })
+
+    // ========================================================================
+    // Provider 测试 | Provider Tests
+    // ========================================================================
+
+    describe('Provider', () => {
+        it('should use provider for operations', async () => {
+            const provider = new MockInventoryProvider()
+            provider.addItem('player-1', 'sword', { itemId: 'sword', quantity: 1 })
+
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 2,
+            }).setProvider(provider)
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.afterItem?.quantity).toBe(3)
+
+            const item = await provider.getItem('player-1', 'sword')
+            expect(item?.quantity).toBe(3)
+        })
+
+        it('should compensate using provider', async () => {
+            const provider = new MockInventoryProvider()
+            provider.addItem('player-1', 'potion', { itemId: 'potion', quantity: 10 })
+
+            const op = new InventoryOperation({
+                type: 'remove',
+                playerId: 'player-1',
+                itemId: 'potion',
+                quantity: 3,
+            }).setProvider(provider)
+
+            await op.execute(ctx)
+            expect((await provider.getItem('player-1', 'potion'))?.quantity).toBe(7)
+
+            await op.compensate(ctx)
+            expect((await provider.getItem('player-1', 'potion'))?.quantity).toBe(10)
+        })
+    })
+
+    // ========================================================================
+    // 边界情况测试 | Edge Cases
+    // ========================================================================
+
+    describe('Edge Cases', () => {
+        it('should handle context without storage', async () => {
+            const noStorageCtx = new TransactionContext()
+
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'sword',
+                quantity: 1,
+            })
+
+            const result = await op.execute(noStorageCtx)
+            expect(result.success).toBe(true)
+        })
+
+        it('should include reason in data', () => {
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'reward-sword',
+                quantity: 1,
+                reason: 'quest_reward',
+            })
+
+            expect(op.data.reason).toBe('quest_reward')
+        })
+
+        it('should preserve item properties when stacking', async () => {
+            await storage.set('player:player-1:inventory:potion', {
+                itemId: 'potion',
+                quantity: 5,
+                properties: { quality: 'rare' },
+            })
+
+            const op = new InventoryOperation({
+                type: 'add',
+                playerId: 'player-1',
+                itemId: 'potion',
+                quantity: 3,
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.data?.afterItem?.properties).toEqual({ quality: 'rare' })
+            expect(result.data?.afterItem?.quantity).toBe(8)
+        })
+    })
+})

packages/framework/transaction/__tests__/operations/TradeOperation.test.ts

@@ -0,0 +1,524 @@
+/**
+ * @zh TradeOperation 单元测试
+ * @en TradeOperation unit tests
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import { TradeOperation, createTradeOperation, type ITradeProvider } from '../../src/operations/TradeOperation.js'
+import { TransactionContext } from '../../src/core/TransactionContext.js'
+import { MemoryStorage } from '../../src/storage/MemoryStorage.js'
+import type { ITransactionContext } from '../../src/core/types.js'
+import type { ICurrencyProvider } from '../../src/operations/CurrencyOperation.js'
+import type { IInventoryProvider, ItemData } from '../../src/operations/InventoryOperation.js'
+
+// ============================================================================
+// Mock Providers | 模拟数据提供者
+// ============================================================================
+
+class MockCurrencyProvider implements ICurrencyProvider {
+    private _balances: Map<string, Map<string, number>> = new Map()
+
+    initBalance(playerId: string, currency: string, amount: number): void {
+        if (!this._balances.has(playerId)) {
+            this._balances.set(playerId, new Map())
+        }
+        this._balances.get(playerId)!.set(currency, amount)
+    }
+
+    async getBalance(playerId: string, currency: string): Promise<number> {
+        return this._balances.get(playerId)?.get(currency) ?? 0
+    }
+
+    async setBalance(playerId: string, currency: string, amount: number): Promise<void> {
+        if (!this._balances.has(playerId)) {
+            this._balances.set(playerId, new Map())
+        }
+        this._balances.get(playerId)!.set(currency, amount)
+    }
+}
+
+class MockInventoryProvider implements IInventoryProvider {
+    private _inventory: Map<string, Map<string, ItemData>> = new Map()
+
+    addItem(playerId: string, itemId: string, item: ItemData): void {
+        if (!this._inventory.has(playerId)) {
+            this._inventory.set(playerId, new Map())
+        }
+        this._inventory.get(playerId)!.set(itemId, item)
+    }
+
+    async getItem(playerId: string, itemId: string): Promise<ItemData | null> {
+        return this._inventory.get(playerId)?.get(itemId) ?? null
+    }
+
+    async setItem(playerId: string, itemId: string, item: ItemData | null): Promise<void> {
+        if (!this._inventory.has(playerId)) {
+            this._inventory.set(playerId, new Map())
+        }
+        if (item) {
+            this._inventory.get(playerId)!.set(itemId, item)
+        } else {
+            this._inventory.get(playerId)!.delete(itemId)
+        }
+    }
+}
+
+// ============================================================================
+// Test Suite | 测试套件
+// ============================================================================
+
+describe('TradeOperation', () => {
+    let storage: MemoryStorage
+    let ctx: ITransactionContext
+
+    beforeEach(() => {
+        storage = new MemoryStorage()
+        ctx = new TransactionContext({ storage })
+    })
+
+    // ========================================================================
+    // 构造器测试 | Constructor Tests
+    // ========================================================================
+
+    describe('Constructor', () => {
+        it('should create with data', () => {
+            const op = new TradeOperation({
+                tradeId: 'trade-001',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            })
+
+            expect(op.name).toBe('trade')
+            expect(op.data.tradeId).toBe('trade-001')
+            expect(op.data.partyA.playerId).toBe('player-1')
+            expect(op.data.partyB.playerId).toBe('player-2')
+        })
+
+        it('should use createTradeOperation factory', () => {
+            const op = createTradeOperation({
+                tradeId: 'trade-002',
+                partyA: { playerId: 'player-1' },
+                partyB: { playerId: 'player-2' },
+            })
+
+            expect(op).toBeInstanceOf(TradeOperation)
+        })
+    })
+
+    // ========================================================================
+    // 验证测试 | Validation Tests
+    // ========================================================================
+
+    describe('validate()', () => {
+        it('should validate item trade', async () => {
+            // Player 1 has sword, Player 2 has gold
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+            await storage.set('player:player-2:currency:gold', 1000)
+
+            const op = new TradeOperation({
+                tradeId: 'trade-001',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(true)
+        })
+
+        it('should fail validation when party A lacks items', async () => {
+            await storage.set('player:player-2:currency:gold', 1000)
+
+            const op = new TradeOperation({
+                tradeId: 'trade-001',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+
+        it('should fail validation when party B lacks currency', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+            await storage.set('player:player-2:currency:gold', 500) // Not enough
+
+            const op = new TradeOperation({
+                tradeId: 'trade-001',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            })
+
+            const isValid = await op.validate(ctx)
+            expect(isValid).toBe(false)
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 物品换货币 | Execute Tests - Item for Currency
+    // ========================================================================
+
+    describe('execute() - item for currency', () => {
+        it('should trade item for currency', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+            await storage.set('player:player-2:currency:gold', 1000)
+
+            const op = new TradeOperation({
+                tradeId: 'trade-001',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.tradeId).toBe('trade-001')
+            expect(result.data?.completed).toBe(true)
+
+            // Player 1: no sword, got gold
+            expect(await storage.get('player:player-1:inventory:sword')).toBeNull()
+            expect(await storage.get('player:player-1:currency:gold')).toBe(1000)
+
+            // Player 2: got sword, no gold
+            const p2Sword = await storage.get<ItemData>('player:player-2:inventory:sword')
+            expect(p2Sword?.quantity).toBe(1)
+            expect(await storage.get('player:player-2:currency:gold')).toBe(0)
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 物品换物品 | Execute Tests - Item for Item
+    // ========================================================================
+
+    describe('execute() - item for item', () => {
+        it('should trade items between players', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+            await storage.set('player:player-2:inventory:shield', {
+                itemId: 'shield',
+                quantity: 1,
+            })
+
+            const op = new TradeOperation({
+                tradeId: 'trade-002',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    items: [{ itemId: 'shield', quantity: 1 }],
+                },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+
+            // Player 1: got shield, no sword
+            expect(await storage.get('player:player-1:inventory:sword')).toBeNull()
+            const p1Shield = await storage.get<ItemData>('player:player-1:inventory:shield')
+            expect(p1Shield?.quantity).toBe(1)
+
+            // Player 2: got sword, no shield
+            expect(await storage.get('player:player-2:inventory:shield')).toBeNull()
+            const p2Sword = await storage.get<ItemData>('player:player-2:inventory:sword')
+            expect(p2Sword?.quantity).toBe(1)
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 货币换货币 | Execute Tests - Currency for Currency
+    // ========================================================================
+
+    describe('execute() - currency for currency', () => {
+        it('should trade currencies between players', async () => {
+            await storage.set('player:player-1:currency:gold', 1000)
+            await storage.set('player:player-2:currency:diamond', 100)
+
+            const op = new TradeOperation({
+                tradeId: 'trade-003',
+                partyA: {
+                    playerId: 'player-1',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'diamond', amount: 100 }],
+                },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+
+            // Player 1: no gold, got diamonds
+            expect(await storage.get('player:player-1:currency:gold')).toBe(0)
+            expect(await storage.get('player:player-1:currency:diamond')).toBe(100)
+
+            // Player 2: got gold, no diamonds
+            expect(await storage.get('player:player-2:currency:gold')).toBe(1000)
+            expect(await storage.get('player:player-2:currency:diamond')).toBe(0)
+        })
+    })
+
+    // ========================================================================
+    // 执行测试 - 复杂交易 | Execute Tests - Complex Trade
+    // ========================================================================
+
+    describe('execute() - complex trade', () => {
+        it('should handle multiple items and currencies', async () => {
+            // Setup
+            await storage.set('player:player-1:inventory:sword', { itemId: 'sword', quantity: 2 })
+            await storage.set('player:player-1:inventory:potion', { itemId: 'potion', quantity: 10 })
+            await storage.set('player:player-2:currency:gold', 5000)
+            await storage.set('player:player-2:currency:diamond', 50)
+
+            const op = new TradeOperation({
+                tradeId: 'trade-004',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [
+                        { itemId: 'sword', quantity: 1 },
+                        { itemId: 'potion', quantity: 5 },
+                    ],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [
+                        { currency: 'gold', amount: 2000 },
+                        { currency: 'diamond', amount: 20 },
+                    ],
+                },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+
+            // Player 1
+            const p1Sword = await storage.get<ItemData>('player:player-1:inventory:sword')
+            expect(p1Sword?.quantity).toBe(1) // Had 2, gave 1
+            const p1Potion = await storage.get<ItemData>('player:player-1:inventory:potion')
+            expect(p1Potion?.quantity).toBe(5) // Had 10, gave 5
+            expect(await storage.get('player:player-1:currency:gold')).toBe(2000)
+            expect(await storage.get('player:player-1:currency:diamond')).toBe(20)
+
+            // Player 2
+            const p2Sword = await storage.get<ItemData>('player:player-2:inventory:sword')
+            expect(p2Sword?.quantity).toBe(1)
+            const p2Potion = await storage.get<ItemData>('player:player-2:inventory:potion')
+            expect(p2Potion?.quantity).toBe(5)
+            expect(await storage.get('player:player-2:currency:gold')).toBe(3000) // Had 5000, gave 2000
+            expect(await storage.get('player:player-2:currency:diamond')).toBe(30) // Had 50, gave 20
+        })
+    })
+
+    // ========================================================================
+    // 失败和补偿测试 | Failure and Compensation Tests
+    // ========================================================================
+
+    describe('failure and compensation', () => {
+        it('should rollback on partial failure', async () => {
+            // Player 1 has sword, Player 2 does NOT have enough gold
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+            await storage.set('player:player-2:currency:gold', 500) // Not enough
+
+            const op = new TradeOperation({
+                tradeId: 'trade-fail',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(false)
+            expect(result.errorCode).toBe('TRADE_FAILED')
+
+            // Everything should be restored
+            const p1Sword = await storage.get<ItemData>('player:player-1:inventory:sword')
+            expect(p1Sword?.quantity).toBe(1) // Restored
+            expect(await storage.get('player:player-2:inventory:sword')).toBeNull()
+        })
+
+        it('should compensate after successful execute', async () => {
+            await storage.set('player:player-1:inventory:sword', {
+                itemId: 'sword',
+                quantity: 1,
+            })
+            await storage.set('player:player-2:currency:gold', 1000)
+
+            const op = new TradeOperation({
+                tradeId: 'trade-compensate',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            })
+
+            await op.execute(ctx)
+
+            // Verify trade happened
+            expect(await storage.get('player:player-1:inventory:sword')).toBeNull()
+            expect(await storage.get('player:player-1:currency:gold')).toBe(1000)
+
+            // Compensate
+            await op.compensate(ctx)
+
+            // Everything should be restored
+            const p1Sword = await storage.get<ItemData>('player:player-1:inventory:sword')
+            expect(p1Sword?.quantity).toBe(1)
+            expect(await storage.get('player:player-1:currency:gold')).toBe(0)
+            expect(await storage.get('player:player-2:inventory:sword')).toBeNull()
+            expect(await storage.get('player:player-2:currency:gold')).toBe(1000)
+        })
+    })
+
+    // ========================================================================
+    // Provider 测试 | Provider Tests
+    // ========================================================================
+
+    describe('Provider', () => {
+        it('should use providers for trade', async () => {
+            const currencyProvider = new MockCurrencyProvider()
+            const inventoryProvider = new MockInventoryProvider()
+
+            currencyProvider.initBalance('player-1', 'gold', 0)
+            currencyProvider.initBalance('player-2', 'gold', 1000)
+            inventoryProvider.addItem('player-1', 'sword', { itemId: 'sword', quantity: 1 })
+
+            const provider: ITradeProvider = {
+                currencyProvider,
+                inventoryProvider,
+            }
+
+            const op = new TradeOperation({
+                tradeId: 'trade-provider',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'sword', quantity: 1 }],
+                },
+                partyB: {
+                    playerId: 'player-2',
+                    currencies: [{ currency: 'gold', amount: 1000 }],
+                },
+            }).setProvider(provider)
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+
+            // Verify using providers
+            expect(await inventoryProvider.getItem('player-1', 'sword')).toBeNull()
+            expect(await currencyProvider.getBalance('player-1', 'gold')).toBe(1000)
+            expect((await inventoryProvider.getItem('player-2', 'sword'))?.quantity).toBe(1)
+            expect(await currencyProvider.getBalance('player-2', 'gold')).toBe(0)
+        })
+    })
+
+    // ========================================================================
+    // 边界情况测试 | Edge Cases
+    // ========================================================================
+
+    describe('Edge Cases', () => {
+        it('should handle empty trade', async () => {
+            const op = new TradeOperation({
+                tradeId: 'trade-empty',
+                partyA: { playerId: 'player-1' },
+                partyB: { playerId: 'player-2' },
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(result.data?.completed).toBe(true)
+        })
+
+        it('should handle one-sided gift', async () => {
+            await storage.set('player:player-1:inventory:gift', {
+                itemId: 'gift',
+                quantity: 1,
+            })
+
+            const op = new TradeOperation({
+                tradeId: 'trade-gift',
+                partyA: {
+                    playerId: 'player-1',
+                    items: [{ itemId: 'gift', quantity: 1 }],
+                },
+                partyB: { playerId: 'player-2' }, // Gives nothing
+            })
+
+            const result = await op.execute(ctx)
+
+            expect(result.success).toBe(true)
+            expect(await storage.get('player:player-1:inventory:gift')).toBeNull()
+            const p2Gift = await storage.get<ItemData>('player:player-2:inventory:gift')
+            expect(p2Gift?.quantity).toBe(1)
+        })
+
+        it('should include reason in data', () => {
+            const op = new TradeOperation({
+                tradeId: 'trade-reason',
+                partyA: { playerId: 'player-1' },
+                partyB: { playerId: 'player-2' },
+                reason: 'player_trade',
+            })
+
+            expect(op.data.reason).toBe('player_trade')
+        })
+    })
+})

packages/framework/transaction/__tests__/storage/MemoryStorage.test.ts

@@ -0,0 +1,254 @@
+/**
+ * @zh MemoryStorage 单元测试
+ * @en MemoryStorage unit tests
+ */
+
+import { describe, it, expect, beforeEach } from 'vitest'
+import { MemoryStorage } from '../../src/storage/MemoryStorage.js'
+import type { TransactionLog } from '../../src/core/types.js'
+
+describe('MemoryStorage', () => {
+    let storage: MemoryStorage
+
+    beforeEach(() => {
+        storage = new MemoryStorage()
+    })
+
+    // ========================================================================
+    // 分布式锁测试 | Distributed Lock Tests
+    // ========================================================================
+
+    describe('Distributed Lock', () => {
+        it('should acquire lock successfully', async () => {
+            const token = await storage.acquireLock('test-key', 5000)
+            expect(token).not.toBeNull()
+            expect(typeof token).toBe('string')
+        })
+
+        it('should fail to acquire same lock twice', async () => {
+            const token1 = await storage.acquireLock('test-key', 5000)
+            const token2 = await storage.acquireLock('test-key', 5000)
+
+            expect(token1).not.toBeNull()
+            expect(token2).toBeNull()
+        })
+
+        it('should release lock with correct token', async () => {
+            const token = await storage.acquireLock('test-key', 5000)
+            expect(token).not.toBeNull()
+
+            const released = await storage.releaseLock('test-key', token!)
+            expect(released).toBe(true)
+        })
+
+        it('should fail to release lock with wrong token', async () => {
+            const token = await storage.acquireLock('test-key', 5000)
+            expect(token).not.toBeNull()
+
+            const released = await storage.releaseLock('test-key', 'wrong-token')
+            expect(released).toBe(false)
+        })
+
+        it('should allow re-acquiring after release', async () => {
+            const token1 = await storage.acquireLock('test-key', 5000)
+            await storage.releaseLock('test-key', token1!)
+
+            const token2 = await storage.acquireLock('test-key', 5000)
+            expect(token2).not.toBeNull()
+        })
+
+        it('should expire lock after TTL', async () => {
+            await storage.acquireLock('test-key', 50) // 50ms TTL
+
+            // 等待锁过期
+            await new Promise((resolve) => setTimeout(resolve, 100))
+
+            const token2 = await storage.acquireLock('test-key', 5000)
+            expect(token2).not.toBeNull()
+        })
+    })
+
+    // ========================================================================
+    // 事务日志测试 | Transaction Log Tests
+    // ========================================================================
+
+    describe('Transaction Log', () => {
+        const createMockLog = (id: string): TransactionLog => ({
+            id,
+            state: 'pending',
+            operations: [],
+            createdAt: Date.now(),
+            updatedAt: Date.now(),
+        })
+
+        it('should save and retrieve transaction', async () => {
+            const log = createMockLog('tx-1')
+            await storage.saveTransaction(log)
+
+            const retrieved = await storage.getTransaction('tx-1')
+            expect(retrieved).not.toBeNull()
+            expect(retrieved!.id).toBe('tx-1')
+        })
+
+        it('should return null for non-existent transaction', async () => {
+            const retrieved = await storage.getTransaction('non-existent')
+            expect(retrieved).toBeNull()
+        })
+
+        it('should update transaction state', async () => {
+            const log = createMockLog('tx-1')
+            await storage.saveTransaction(log)
+
+            await storage.updateTransactionState('tx-1', 'committed')
+
+            const retrieved = await storage.getTransaction('tx-1')
+            expect(retrieved!.state).toBe('committed')
+        })
+
+        it('should update operation state', async () => {
+            const log: TransactionLog = {
+                ...createMockLog('tx-1'),
+                operations: [
+                    { name: 'op1', state: 'pending' },
+                    { name: 'op2', state: 'pending' },
+                ],
+            }
+            await storage.saveTransaction(log)
+
+            await storage.updateOperationState('tx-1', 0, 'completed')
+            await storage.updateOperationState('tx-1', 1, 'failed', 'Some error')
+
+            const retrieved = await storage.getTransaction('tx-1')
+            expect(retrieved!.operations[0].state).toBe('completed')
+            expect(retrieved!.operations[1].state).toBe('failed')
+            expect(retrieved!.operations[1].error).toBe('Some error')
+        })
+
+        it('should delete transaction', async () => {
+            const log = createMockLog('tx-1')
+            await storage.saveTransaction(log)
+
+            await storage.deleteTransaction('tx-1')
+
+            const retrieved = await storage.getTransaction('tx-1')
+            expect(retrieved).toBeNull()
+        })
+
+        it('should get pending transactions', async () => {
+            await storage.saveTransaction({ ...createMockLog('tx-1'), state: 'pending' })
+            await storage.saveTransaction({ ...createMockLog('tx-2'), state: 'executing' })
+            await storage.saveTransaction({ ...createMockLog('tx-3'), state: 'committed' })
+
+            const pending = await storage.getPendingTransactions()
+            expect(pending.length).toBe(2) // pending and executing
+            expect(pending.map((p) => p.id).sort()).toEqual(['tx-1', 'tx-2'])
+        })
+
+        it('should filter pending transactions by serverId', async () => {
+            await storage.saveTransaction({
+                ...createMockLog('tx-1'),
+                state: 'pending',
+                metadata: { serverId: 'server-1' },
+            })
+            await storage.saveTransaction({
+                ...createMockLog('tx-2'),
+                state: 'pending',
+                metadata: { serverId: 'server-2' },
+            })
+
+            const pending = await storage.getPendingTransactions('server-1')
+            expect(pending.length).toBe(1)
+            expect(pending[0].id).toBe('tx-1')
+        })
+    })
+
+    // ========================================================================
+    // 数据操作测试 | Data Operations Tests
+    // ========================================================================
+
+    describe('Data Operations', () => {
+        it('should set and get data', async () => {
+            await storage.set('key1', { value: 123 })
+
+            const data = await storage.get<{ value: number }>('key1')
+            expect(data).toEqual({ value: 123 })
+        })
+
+        it('should return null for non-existent key', async () => {
+            const data = await storage.get('non-existent')
+            expect(data).toBeNull()
+        })
+
+        it('should delete data', async () => {
+            await storage.set('key1', { value: 123 })
+            const deleted = await storage.delete('key1')
+
+            expect(deleted).toBe(true)
+            expect(await storage.get('key1')).toBeNull()
+        })
+
+        it('should return false when deleting non-existent key', async () => {
+            const deleted = await storage.delete('non-existent')
+            expect(deleted).toBe(false)
+        })
+
+        it('should expire data after TTL', async () => {
+            await storage.set('key1', { value: 123 }, 50) // 50ms TTL
+
+            // 数据应该存在
+            expect(await storage.get('key1')).toEqual({ value: 123 })
+
+            // 等待过期
+            await new Promise((resolve) => setTimeout(resolve, 100))
+
+            expect(await storage.get('key1')).toBeNull()
+        })
+
+        it('should overwrite existing data', async () => {
+            await storage.set('key1', { value: 1 })
+            await storage.set('key1', { value: 2 })
+
+            const data = await storage.get<{ value: number }>('key1')
+            expect(data).toEqual({ value: 2 })
+        })
+    })
+
+    // ========================================================================
+    // 辅助方法测试 | Helper Methods Tests
+    // ========================================================================
+
+    describe('Helper Methods', () => {
+        it('should clear all data', async () => {
+            await storage.set('key1', 'value1')
+            await storage.set('key2', 'value2')
+            await storage.saveTransaction({
+                id: 'tx-1',
+                state: 'pending',
+                operations: [],
+                createdAt: Date.now(),
+                updatedAt: Date.now(),
+            })
+
+            storage.clear()
+
+            expect(await storage.get('key1')).toBeNull()
+            expect(await storage.get('key2')).toBeNull()
+            expect(await storage.getTransaction('tx-1')).toBeNull()
+            expect(storage.transactionCount).toBe(0)
+        })
+
+        it('should track transaction count', async () => {
+            expect(storage.transactionCount).toBe(0)
+
+            await storage.saveTransaction({
+                id: 'tx-1',
+                state: 'pending',
+                operations: [],
+                createdAt: Date.now(),
+                updatedAt: Date.now(),
+            })
+
+            expect(storage.transactionCount).toBe(1)
+        })
+    })
+})

packages/framework/transaction/module.json

@@ -0,0 +1,23 @@
+{
+    "id": "transaction",
+    "name": "@esengine/transaction",
+    "globalKey": "transaction",
+    "displayName": "Transaction System",
+    "description": "游戏事务系统，支持商店购买、玩家交易、分布式事务 | Game transaction system for shop, trading, distributed transactions",
+    "version": "1.0.0",
+    "category": "Other",
+    "icon": "Receipt",
+    "tags": ["transaction", "distributed", "saga", "database"],
+    "isCore": false,
+    "defaultEnabled": false,
+    "isEngineModule": true,
+    "canContainContent": false,
+    "platforms": ["nodejs"],
+    "dependencies": ["core", "server"],
+    "exports": {
+        "services": ["TransactionManager"],
+        "interfaces": ["ITransactionStorage", "ITransactionOperation"]
+    },
+    "requiresWasm": false,
+    "outputPath": "dist/index.js"
+}

packages/framework/transaction/package.json

@@ -0,0 +1,53 @@
+{
+    "name": "@esengine/transaction",
+    "version": "2.0.2",
+    "description": "Game transaction system with distributed support | 游戏事务系统，支持分布式事务",
+    "type": "module",
+    "main": "./dist/index.js",
+    "module": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "exports": {
+        ".": {
+            "import": "./dist/index.js",
+            "types": "./dist/index.d.ts"
+        }
+    },
+    "files": [
+        "dist",
+        "module.json"
+    ],
+    "scripts": {
+        "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",
+        "build:watch": "tsup --watch",
+        "type-check": "tsc --noEmit",
+        "clean": "rimraf dist",
+        "test": "vitest run",
+        "test:watch": "vitest"
+    },
+    "dependencies": {
+        "@esengine/server": "workspace:*"
+    },
+    "peerDependencies": {
+        "ioredis": "^5.3.0",
+        "mongodb": "^6.0.0"
+    },
+    "peerDependenciesMeta": {
+        "ioredis": {
+            "optional": true
+        },
+        "mongodb": {
+            "optional": true
+        }
+    },
+    "devDependencies": {
+        "@esengine/ecs-framework": "workspace:*",
+        "@esengine/build-config": "workspace:*",
+        "tsup": "^8.0.0",
+        "typescript": "^5.8.0",
+        "rimraf": "^5.0.0",
+        "vitest": "^2.0.0"
+    },
+    "publishConfig": {
+        "access": "public"
+    }
+}

packages/framework/transaction/src/core/TransactionContext.ts

@@ -0,0 +1,286 @@
+/**
+ * @zh 事务上下文实现
+ * @en Transaction context implementation
+ */
+
+import type {
+    ITransactionContext,
+    ITransactionOperation,
+    ITransactionStorage,
+    TransactionState,
+    TransactionResult,
+    TransactionOptions,
+    TransactionLog,
+    OperationLog,
+    OperationResult
+} from './types.js';
+
+/**
+ * @zh 生成唯一 ID
+ * @en Generate unique ID
+ */
+function generateId(): string {
+    return `tx_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 11)}`;
+}
+
+/**
+ * @zh 事务上下文
+ * @en Transaction context
+ *
+ * @zh 封装事务的状态、操作和执行逻辑
+ * @en Encapsulates transaction state, operations, and execution logic
+ *
+ * @example
+ * ```typescript
+ * const ctx = new TransactionContext({ timeout: 5000 })
+ * ctx.addOperation(new DeductCurrency({ playerId: '1', amount: 100 }))
+ * ctx.addOperation(new AddItem({ playerId: '1', itemId: 'sword' }))
+ * const result = await ctx.execute()
+ * ```
+ */
+export class TransactionContext implements ITransactionContext {
+    private _id: string;
+    private _state: TransactionState = 'pending';
+    private _timeout: number;
+    private _operations: ITransactionOperation[] = [];
+    private _storage: ITransactionStorage | null;
+    private _metadata: Record<string, unknown>;
+    private _contextData: Map<string, unknown> = new Map();
+    private _startTime: number = 0;
+    private _distributed: boolean;
+
+    constructor(options: TransactionOptions & { storage?: ITransactionStorage } = {}) {
+        this._id = generateId();
+        this._timeout = options.timeout ?? 30000;
+        this._storage = options.storage ?? null;
+        this._metadata = options.metadata ?? {};
+        this._distributed = options.distributed ?? false;
+    }
+
+    // =========================================================================
+    // 只读属性 | Readonly properties
+    // =========================================================================
+
+    get id(): string {
+        return this._id;
+    }
+
+    get state(): TransactionState {
+        return this._state;
+    }
+
+    get timeout(): number {
+        return this._timeout;
+    }
+
+    get operations(): ReadonlyArray<ITransactionOperation> {
+        return this._operations;
+    }
+
+    get storage(): ITransactionStorage | null {
+        return this._storage;
+    }
+
+    get metadata(): Record<string, unknown> {
+        return this._metadata;
+    }
+
+    // =========================================================================
+    // 公共方法 | Public methods
+    // =========================================================================
+
+    /**
+     * @zh 添加操作
+     * @en Add operation
+     */
+    addOperation<T extends ITransactionOperation>(operation: T): this {
+        if (this._state !== 'pending') {
+            throw new Error(`Cannot add operation to transaction in state: ${this._state}`);
+        }
+        this._operations.push(operation);
+        return this;
+    }
+
+    /**
+     * @zh 执行事务
+     * @en Execute transaction
+     */
+    async execute<T = unknown>(): Promise<TransactionResult<T>> {
+        if (this._state !== 'pending') {
+            return {
+                success: false,
+                transactionId: this._id,
+                results: [],
+                error: `Transaction already in state: ${this._state}`,
+                duration: 0
+            };
+        }
+
+        this._startTime = Date.now();
+        this._state = 'executing';
+
+        const results: OperationResult[] = [];
+        let executedCount = 0;
+
+        try {
+            await this._saveLog();
+
+            for (let i = 0; i < this._operations.length; i++) {
+                if (this._isTimedOut()) {
+                    throw new Error('Transaction timed out');
+                }
+
+                const op = this._operations[i];
+
+                const isValid = await op.validate(this);
+                if (!isValid) {
+                    throw new Error(`Validation failed for operation: ${op.name}`);
+                }
+
+                const result = await op.execute(this);
+                results.push(result);
+                executedCount++;
+
+                await this._updateOperationLog(i, 'executed');
+
+                if (!result.success) {
+                    throw new Error(result.error ?? `Operation ${op.name} failed`);
+                }
+            }
+
+            this._state = 'committed';
+            await this._updateTransactionState('committed');
+
+            return {
+                success: true,
+                transactionId: this._id,
+                results,
+                data: this._collectResultData(results) as T,
+                duration: Date.now() - this._startTime
+            };
+        } catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+
+            await this._compensate(executedCount - 1);
+
+            return {
+                success: false,
+                transactionId: this._id,
+                results,
+                error: errorMessage,
+                duration: Date.now() - this._startTime
+            };
+        }
+    }
+
+    /**
+     * @zh 手动回滚事务
+     * @en Manually rollback transaction
+     */
+    async rollback(): Promise<void> {
+        if (this._state === 'committed' || this._state === 'rolledback') {
+            return;
+        }
+
+        await this._compensate(this._operations.length - 1);
+    }
+
+    /**
+     * @zh 获取上下文数据
+     * @en Get context data
+     */
+    get<T>(key: string): T | undefined {
+        return this._contextData.get(key) as T | undefined;
+    }
+
+    /**
+     * @zh 设置上下文数据
+     * @en Set context data
+     */
+    set<T>(key: string, value: T): void {
+        this._contextData.set(key, value);
+    }
+
+    // =========================================================================
+    // 私有方法 | Private methods
+    // =========================================================================
+
+    private _isTimedOut(): boolean {
+        return Date.now() - this._startTime > this._timeout;
+    }
+
+    private async _compensate(fromIndex: number): Promise<void> {
+        this._state = 'rolledback';
+
+        for (let i = fromIndex; i >= 0; i--) {
+            const op = this._operations[i];
+            try {
+                await op.compensate(this);
+                await this._updateOperationLog(i, 'compensated');
+            } catch (error) {
+                const errorMessage = error instanceof Error ? error.message : String(error);
+                await this._updateOperationLog(i, 'failed', errorMessage);
+            }
+        }
+
+        await this._updateTransactionState('rolledback');
+    }
+
+    private async _saveLog(): Promise<void> {
+        if (!this._storage) return;
+
+        const log: TransactionLog = {
+            id: this._id,
+            state: this._state,
+            createdAt: this._startTime,
+            updatedAt: this._startTime,
+            timeout: this._timeout,
+            operations: this._operations.map((op) => ({
+                name: op.name,
+                data: op.data,
+                state: 'pending' as const
+            })),
+            metadata: this._metadata,
+            distributed: this._distributed
+        };
+
+        await this._storage.saveTransaction(log);
+    }
+
+    private async _updateTransactionState(state: TransactionState): Promise<void> {
+        this._state = state;
+        if (this._storage) {
+            await this._storage.updateTransactionState(this._id, state);
+        }
+    }
+
+    private async _updateOperationLog(
+        index: number,
+        state: OperationLog['state'],
+        error?: string
+    ): Promise<void> {
+        if (this._storage) {
+            await this._storage.updateOperationState(this._id, index, state, error);
+        }
+    }
+
+    private _collectResultData(results: OperationResult[]): unknown {
+        const data: Record<string, unknown> = {};
+        for (const result of results) {
+            if (result.data !== undefined) {
+                Object.assign(data, result.data);
+            }
+        }
+        return Object.keys(data).length > 0 ? data : undefined;
+    }
+}
+
+/**
+ * @zh 创建事务上下文
+ * @en Create transaction context
+ */
+export function createTransactionContext(
+    options: TransactionOptions & { storage?: ITransactionStorage } = {}
+): ITransactionContext {
+    return new TransactionContext(options);
+}

packages/framework/transaction/src/core/TransactionManager.ts

@@ -0,0 +1,255 @@
+/**
+ * @zh 事务管理器
+ * @en Transaction manager
+ */
+
+import type {
+    ITransactionContext,
+    ITransactionStorage,
+    TransactionManagerConfig,
+    TransactionOptions,
+    TransactionLog,
+    TransactionResult
+} from './types.js';
+import { TransactionContext } from './TransactionContext.js';
+
+/**
+ * @zh 事务管理器
+ * @en Transaction manager
+ *
+ * @zh 管理事务的创建、执行和恢复
+ * @en Manages transaction creation, execution, and recovery
+ *
+ * @example
+ * ```typescript
+ * const manager = new TransactionManager({
+ *     storage: new RedisStorage({ url: 'redis://localhost:6379' }),
+ *     defaultTimeout: 10000,
+ * })
+ *
+ * const tx = manager.begin({ timeout: 5000 })
+ * tx.addOperation(new DeductCurrency({ ... }))
+ * tx.addOperation(new AddItem({ ... }))
+ *
+ * const result = await tx.execute()
+ * ```
+ */
+export class TransactionManager {
+    private _storage: ITransactionStorage | null;
+    private _defaultTimeout: number;
+    private _serverId: string;
+    private _autoRecover: boolean;
+    private _activeTransactions: Map<string, ITransactionContext> = new Map();
+
+    constructor(config: TransactionManagerConfig = {}) {
+        this._storage = config.storage ?? null;
+        this._defaultTimeout = config.defaultTimeout ?? 30000;
+        this._serverId = config.serverId ?? this._generateServerId();
+        this._autoRecover = config.autoRecover ?? true;
+    }
+
+    // =========================================================================
+    // 只读属性 | Readonly properties
+    // =========================================================================
+
+    /**
+     * @zh 服务器 ID
+     * @en Server ID
+     */
+    get serverId(): string {
+        return this._serverId;
+    }
+
+    /**
+     * @zh 存储实例
+     * @en Storage instance
+     */
+    get storage(): ITransactionStorage | null {
+        return this._storage;
+    }
+
+    /**
+     * @zh 活跃事务数量
+     * @en Active transaction count
+     */
+    get activeCount(): number {
+        return this._activeTransactions.size;
+    }
+
+    // =========================================================================
+    // 公共方法 | Public methods
+    // =========================================================================
+
+    /**
+     * @zh 开始新事务
+     * @en Begin new transaction
+     *
+     * @param options - @zh 事务选项 @en Transaction options
+     * @returns @zh 事务上下文 @en Transaction context
+     */
+    begin(options: TransactionOptions = {}): ITransactionContext {
+        const ctx = new TransactionContext({
+            timeout: options.timeout ?? this._defaultTimeout,
+            storage: this._storage ?? undefined,
+            metadata: {
+                ...options.metadata,
+                serverId: this._serverId
+            },
+            distributed: options.distributed
+        });
+
+        this._activeTransactions.set(ctx.id, ctx);
+
+        return ctx;
+    }
+
+    /**
+     * @zh 执行事务（便捷方法）
+     * @en Execute transaction (convenience method)
+     *
+     * @param builder - @zh 事务构建函数 @en Transaction builder function
+     * @param options - @zh 事务选项 @en Transaction options
+     * @returns @zh 事务结果 @en Transaction result
+     */
+    async run<T = unknown>(
+        builder: (ctx: ITransactionContext) => void | Promise<void>,
+        options: TransactionOptions = {}
+    ): Promise<TransactionResult<T>> {
+        const ctx = this.begin(options);
+
+        try {
+            await builder(ctx);
+            const result = await ctx.execute<T>();
+            return result;
+        } finally {
+            this._activeTransactions.delete(ctx.id);
+        }
+    }
+
+    /**
+     * @zh 获取活跃事务
+     * @en Get active transaction
+     */
+    getTransaction(id: string): ITransactionContext | undefined {
+        return this._activeTransactions.get(id);
+    }
+
+    /**
+     * @zh 恢复未完成的事务
+     * @en Recover pending transactions
+     */
+    async recover(): Promise<number> {
+        if (!this._storage) return 0;
+
+        const pendingTransactions = await this._storage.getPendingTransactions(this._serverId);
+        let recoveredCount = 0;
+
+        for (const log of pendingTransactions) {
+            try {
+                await this._recoverTransaction(log);
+                recoveredCount++;
+            } catch (error) {
+                console.error(`Failed to recover transaction ${log.id}:`, error);
+            }
+        }
+
+        return recoveredCount;
+    }
+
+    /**
+     * @zh 获取分布式锁
+     * @en Acquire distributed lock
+     */
+    async acquireLock(key: string, ttl: number = 10000): Promise<string | null> {
+        if (!this._storage) return null;
+        return this._storage.acquireLock(key, ttl);
+    }
+
+    /**
+     * @zh 释放分布式锁
+     * @en Release distributed lock
+     */
+    async releaseLock(key: string, token: string): Promise<boolean> {
+        if (!this._storage) return false;
+        return this._storage.releaseLock(key, token);
+    }
+
+    /**
+     * @zh 使用分布式锁执行
+     * @en Execute with distributed lock
+     */
+    async withLock<T>(
+        key: string,
+        fn: () => Promise<T>,
+        ttl: number = 10000
+    ): Promise<T> {
+        const token = await this.acquireLock(key, ttl);
+        if (!token) {
+            throw new Error(`Failed to acquire lock for key: ${key}`);
+        }
+
+        try {
+            return await fn();
+        } finally {
+            await this.releaseLock(key, token);
+        }
+    }
+
+    /**
+     * @zh 清理已完成的事务日志
+     * @en Clean up completed transaction logs
+     */
+    async cleanup(beforeTimestamp?: number): Promise<number> {
+        if (!this._storage) return 0;
+
+        const timestamp = beforeTimestamp ?? Date.now() - 24 * 60 * 60 * 1000; // 默认清理24小时前
+
+        const pendingTransactions = await this._storage.getPendingTransactions();
+        let cleanedCount = 0;
+
+        for (const log of pendingTransactions) {
+            if (
+                log.createdAt < timestamp &&
+                (log.state === 'committed' || log.state === 'rolledback')
+            ) {
+                await this._storage.deleteTransaction(log.id);
+                cleanedCount++;
+            }
+        }
+
+        return cleanedCount;
+    }
+
+    // =========================================================================
+    // 私有方法 | Private methods
+    // =========================================================================
+
+    private _generateServerId(): string {
+        return `server_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 8)}`;
+    }
+
+    private async _recoverTransaction(log: TransactionLog): Promise<void> {
+        if (log.state === 'executing') {
+            const executedOps = log.operations.filter((op) => op.state === 'executed');
+
+            if (executedOps.length > 0 && this._storage) {
+                for (let i = executedOps.length - 1; i >= 0; i--) {
+                    await this._storage.updateOperationState(log.id, i, 'compensated');
+                }
+                await this._storage.updateTransactionState(log.id, 'rolledback');
+            } else {
+                await this._storage?.updateTransactionState(log.id, 'failed');
+            }
+        }
+    }
+}
+
+/**
+ * @zh 创建事务管理器
+ * @en Create transaction manager
+ */
+export function createTransactionManager(
+    config: TransactionManagerConfig = {}
+): TransactionManager {
+    return new TransactionManager(config);
+}

packages/framework/transaction/src/core/index.ts

@@ -0,0 +1,20 @@
+/**
+ * @zh 核心模块导出
+ * @en Core module exports
+ */
+
+export type {
+    TransactionState,
+    OperationResult,
+    TransactionResult,
+    OperationLog,
+    TransactionLog,
+    TransactionOptions,
+    TransactionManagerConfig,
+    ITransactionStorage,
+    ITransactionOperation,
+    ITransactionContext
+} from './types.js';
+
+export { TransactionContext, createTransactionContext } from './TransactionContext.js';
+export { TransactionManager, createTransactionManager } from './TransactionManager.js';

packages/framework/transaction/src/core/types.ts

@@ -0,0 +1,493 @@
+/**
+ * @zh 事务系统核心类型定义
+ * @en Transaction system core type definitions
+ */
+
+// =============================================================================
+// 事务状态 | Transaction State
+// =============================================================================
+
+/**
+ * @zh 事务状态
+ * @en Transaction state
+ */
+export type TransactionState =
+    | 'pending'     // 等待执行 | Waiting to execute
+    | 'executing'   // 执行中 | Executing
+    | 'committed'   // 已提交 | Committed
+    | 'rolledback'  // 已回滚 | Rolled back
+    | 'failed'      // 失败 | Failed
+
+// =============================================================================
+// 操作结果 | Operation Result
+// =============================================================================
+
+/**
+ * @zh 操作结果
+ * @en Operation result
+ */
+export interface OperationResult<T = unknown> {
+    /**
+     * @zh 是否成功
+     * @en Whether succeeded
+     */
+    success: boolean
+
+    /**
+     * @zh 返回数据
+     * @en Return data
+     */
+    data?: T
+
+    /**
+     * @zh 错误信息
+     * @en Error message
+     */
+    error?: string
+
+    /**
+     * @zh 错误代码
+     * @en Error code
+     */
+    errorCode?: string
+}
+
+/**
+ * @zh 事务结果
+ * @en Transaction result
+ */
+export interface TransactionResult<T = unknown> {
+    /**
+     * @zh 是否成功
+     * @en Whether succeeded
+     */
+    success: boolean
+
+    /**
+     * @zh 事务 ID
+     * @en Transaction ID
+     */
+    transactionId: string
+
+    /**
+     * @zh 操作结果列表
+     * @en Operation results
+     */
+    results: OperationResult[]
+
+    /**
+     * @zh 最终数据
+     * @en Final data
+     */
+    data?: T
+
+    /**
+     * @zh 错误信息
+     * @en Error message
+     */
+    error?: string
+
+    /**
+     * @zh 执行时间（毫秒）
+     * @en Execution time in milliseconds
+     */
+    duration: number
+}
+
+// =============================================================================
+// 事务日志 | Transaction Log
+// =============================================================================
+
+/**
+ * @zh 操作日志
+ * @en Operation log
+ */
+export interface OperationLog {
+    /**
+     * @zh 操作名称
+     * @en Operation name
+     */
+    name: string
+
+    /**
+     * @zh 操作数据
+     * @en Operation data
+     */
+    data: unknown
+
+    /**
+     * @zh 操作状态
+     * @en Operation state
+     */
+    state: 'pending' | 'executed' | 'compensated' | 'failed'
+
+    /**
+     * @zh 执行时间
+     * @en Execution timestamp
+     */
+    executedAt?: number
+
+    /**
+     * @zh 补偿时间
+     * @en Compensation timestamp
+     */
+    compensatedAt?: number
+
+    /**
+     * @zh 错误信息
+     * @en Error message
+     */
+    error?: string
+}
+
+/**
+ * @zh 事务日志
+ * @en Transaction log
+ */
+export interface TransactionLog {
+    /**
+     * @zh 事务 ID
+     * @en Transaction ID
+     */
+    id: string
+
+    /**
+     * @zh 事务状态
+     * @en Transaction state
+     */
+    state: TransactionState
+
+    /**
+     * @zh 创建时间
+     * @en Creation timestamp
+     */
+    createdAt: number
+
+    /**
+     * @zh 更新时间
+     * @en Update timestamp
+     */
+    updatedAt: number
+
+    /**
+     * @zh 超时时间（毫秒）
+     * @en Timeout in milliseconds
+     */
+    timeout: number
+
+    /**
+     * @zh 操作日志列表
+     * @en Operation logs
+     */
+    operations: OperationLog[]
+
+    /**
+     * @zh 元数据
+     * @en Metadata
+     */
+    metadata?: Record<string, unknown>
+
+    /**
+     * @zh 是否分布式事务
+     * @en Whether distributed transaction
+     */
+    distributed?: boolean
+
+    /**
+     * @zh 参与的服务器列表
+     * @en Participating servers
+     */
+    participants?: string[]
+}
+
+// =============================================================================
+// 事务配置 | Transaction Configuration
+// =============================================================================
+
+/**
+ * @zh 事务选项
+ * @en Transaction options
+ */
+export interface TransactionOptions {
+    /**
+     * @zh 超时时间（毫秒），默认 30000
+     * @en Timeout in milliseconds, default 30000
+     */
+    timeout?: number
+
+    /**
+     * @zh 是否分布式事务
+     * @en Whether distributed transaction
+     */
+    distributed?: boolean
+
+    /**
+     * @zh 元数据
+     * @en Metadata
+     */
+    metadata?: Record<string, unknown>
+
+    /**
+     * @zh 重试次数，默认 0
+     * @en Retry count, default 0
+     */
+    retryCount?: number
+
+    /**
+     * @zh 重试间隔（毫秒），默认 1000
+     * @en Retry interval in milliseconds, default 1000
+     */
+    retryInterval?: number
+}
+
+/**
+ * @zh 事务管理器配置
+ * @en Transaction manager configuration
+ */
+export interface TransactionManagerConfig {
+    /**
+     * @zh 存储实例
+     * @en Storage instance
+     */
+    storage?: ITransactionStorage
+
+    /**
+     * @zh 默认超时时间（毫秒）
+     * @en Default timeout in milliseconds
+     */
+    defaultTimeout?: number
+
+    /**
+     * @zh 服务器 ID（分布式用）
+     * @en Server ID for distributed transactions
+     */
+    serverId?: string
+
+    /**
+     * @zh 是否自动恢复未完成事务
+     * @en Whether to auto-recover pending transactions
+     */
+    autoRecover?: boolean
+}
+
+// =============================================================================
+// 存储接口 | Storage Interface
+// =============================================================================
+
+/**
+ * @zh 事务存储接口
+ * @en Transaction storage interface
+ */
+export interface ITransactionStorage {
+    /**
+     * @zh 关闭存储连接
+     * @en Close storage connection
+     *
+     * @zh 释放所有资源，关闭数据库连接
+     * @en Release all resources, close database connections
+     */
+    close?(): Promise<void>
+
+    /**
+     * @zh 获取分布式锁
+     * @en Acquire distributed lock
+     *
+     * @param key - @zh 锁的键 @en Lock key
+     * @param ttl - @zh 锁的生存时间（毫秒） @en Lock TTL in milliseconds
+     * @returns @zh 锁令牌，获取失败返回 null @en Lock token, null if failed
+     */
+    acquireLock(key: string, ttl: number): Promise<string | null>
+
+    /**
+     * @zh 释放分布式锁
+     * @en Release distributed lock
+     *
+     * @param key - @zh 锁的键 @en Lock key
+     * @param token - @zh 锁令牌 @en Lock token
+     * @returns @zh 是否成功释放 @en Whether released successfully
+     */
+    releaseLock(key: string, token: string): Promise<boolean>
+
+    /**
+     * @zh 保存事务日志
+     * @en Save transaction log
+     */
+    saveTransaction(tx: TransactionLog): Promise<void>
+
+    /**
+     * @zh 获取事务日志
+     * @en Get transaction log
+     */
+    getTransaction(id: string): Promise<TransactionLog | null>
+
+    /**
+     * @zh 更新事务状态
+     * @en Update transaction state
+     */
+    updateTransactionState(id: string, state: TransactionState): Promise<void>
+
+    /**
+     * @zh 更新操作状态
+     * @en Update operation state
+     */
+    updateOperationState(
+        transactionId: string,
+        operationIndex: number,
+        state: OperationLog['state'],
+        error?: string
+    ): Promise<void>
+
+    /**
+     * @zh 获取待恢复的事务列表
+     * @en Get pending transactions for recovery
+     */
+    getPendingTransactions(serverId?: string): Promise<TransactionLog[]>
+
+    /**
+     * @zh 删除事务日志
+     * @en Delete transaction log
+     */
+    deleteTransaction(id: string): Promise<void>
+
+    /**
+     * @zh 获取数据
+     * @en Get data
+     */
+    get<T>(key: string): Promise<T | null>
+
+    /**
+     * @zh 设置数据
+     * @en Set data
+     */
+    set<T>(key: string, value: T, ttl?: number): Promise<void>
+
+    /**
+     * @zh 删除数据
+     * @en Delete data
+     */
+    delete(key: string): Promise<boolean>
+}
+
+// =============================================================================
+// 操作接口 | Operation Interface
+// =============================================================================
+
+/**
+ * @zh 事务操作接口
+ * @en Transaction operation interface
+ */
+export interface ITransactionOperation<TData = unknown, TResult = unknown> {
+    /**
+     * @zh 操作名称
+     * @en Operation name
+     */
+    readonly name: string
+
+    /**
+     * @zh 操作数据
+     * @en Operation data
+     */
+    readonly data: TData
+
+    /**
+     * @zh 验证前置条件
+     * @en Validate preconditions
+     *
+     * @param ctx - @zh 事务上下文 @en Transaction context
+     * @returns @zh 是否验证通过 @en Whether validation passed
+     */
+    validate(ctx: ITransactionContext): Promise<boolean>
+
+    /**
+     * @zh 执行操作
+     * @en Execute operation
+     *
+     * @param ctx - @zh 事务上下文 @en Transaction context
+     * @returns @zh 操作结果 @en Operation result
+     */
+    execute(ctx: ITransactionContext): Promise<OperationResult<TResult>>
+
+    /**
+     * @zh 补偿操作（回滚）
+     * @en Compensate operation (rollback)
+     *
+     * @param ctx - @zh 事务上下文 @en Transaction context
+     */
+    compensate(ctx: ITransactionContext): Promise<void>
+}
+
+// =============================================================================
+// 事务上下文接口 | Transaction Context Interface
+// =============================================================================
+
+/**
+ * @zh 事务上下文接口
+ * @en Transaction context interface
+ */
+export interface ITransactionContext {
+    /**
+     * @zh 事务 ID
+     * @en Transaction ID
+     */
+    readonly id: string
+
+    /**
+     * @zh 事务状态
+     * @en Transaction state
+     */
+    readonly state: TransactionState
+
+    /**
+     * @zh 超时时间（毫秒）
+     * @en Timeout in milliseconds
+     */
+    readonly timeout: number
+
+    /**
+     * @zh 操作列表
+     * @en Operations
+     */
+    readonly operations: ReadonlyArray<ITransactionOperation>
+
+    /**
+     * @zh 存储实例
+     * @en Storage instance
+     */
+    readonly storage: ITransactionStorage | null
+
+    /**
+     * @zh 元数据
+     * @en Metadata
+     */
+    readonly metadata: Record<string, unknown>
+
+    /**
+     * @zh 添加操作
+     * @en Add operation
+     */
+    addOperation<T extends ITransactionOperation>(operation: T): this
+
+    /**
+     * @zh 执行事务
+     * @en Execute transaction
+     */
+    execute<T = unknown>(): Promise<TransactionResult<T>>
+
+    /**
+     * @zh 回滚事务
+     * @en Rollback transaction
+     */
+    rollback(): Promise<void>
+
+    /**
+     * @zh 获取上下文数据
+     * @en Get context data
+     */
+    get<T>(key: string): T | undefined
+
+    /**
+     * @zh 设置上下文数据
+     * @en Set context data
+     */
+    set<T>(key: string, value: T): void
+}

packages/framework/transaction/src/distributed/SagaOrchestrator.ts

@@ -0,0 +1,350 @@
+/**
+ * @zh Saga 编排器
+ * @en Saga Orchestrator
+ *
+ * @zh 实现分布式事务的 Saga 模式编排
+ * @en Implements Saga pattern orchestration for distributed transactions
+ */
+
+import type {
+    ITransactionStorage,
+    TransactionLog,
+    TransactionState,
+    OperationResult
+} from '../core/types.js';
+
+/**
+ * @zh Saga 步骤状态
+ * @en Saga step state
+ */
+export type SagaStepState = 'pending' | 'executing' | 'completed' | 'compensating' | 'compensated' | 'failed'
+
+/**
+ * @zh Saga 步骤
+ * @en Saga step
+ */
+export interface SagaStep<T = unknown> {
+    /**
+     * @zh 步骤名称
+     * @en Step name
+     */
+    name: string
+
+    /**
+     * @zh 目标服务器 ID（分布式用）
+     * @en Target server ID (for distributed)
+     */
+    serverId?: string
+
+    /**
+     * @zh 执行函数
+     * @en Execute function
+     */
+    execute: (data: T) => Promise<OperationResult>
+
+    /**
+     * @zh 补偿函数
+     * @en Compensate function
+     */
+    compensate: (data: T) => Promise<void>
+
+    /**
+     * @zh 步骤数据
+     * @en Step data
+     */
+    data: T
+}
+
+/**
+ * @zh Saga 步骤日志
+ * @en Saga step log
+ */
+export interface SagaStepLog {
+    name: string
+    serverId?: string
+    state: SagaStepState
+    startedAt?: number
+    completedAt?: number
+    error?: string
+}
+
+/**
+ * @zh Saga 日志
+ * @en Saga log
+ */
+export interface SagaLog {
+    id: string
+    state: 'pending' | 'running' | 'completed' | 'compensating' | 'compensated' | 'failed'
+    steps: SagaStepLog[]
+    createdAt: number
+    updatedAt: number
+    metadata?: Record<string, unknown>
+}
+
+/**
+ * @zh Saga 结果
+ * @en Saga result
+ */
+export interface SagaResult {
+    success: boolean
+    sagaId: string
+    completedSteps: string[]
+    failedStep?: string
+    error?: string
+    duration: number
+}
+
+/**
+ * @zh Saga 编排器配置
+ * @en Saga orchestrator configuration
+ */
+export interface SagaOrchestratorConfig {
+    /**
+     * @zh 存储实例
+     * @en Storage instance
+     */
+    storage?: ITransactionStorage
+
+    /**
+     * @zh 默认超时时间（毫秒）
+     * @en Default timeout in milliseconds
+     */
+    timeout?: number
+
+    /**
+     * @zh 服务器 ID
+     * @en Server ID
+     */
+    serverId?: string
+}
+
+/**
+ * @zh 生成 Saga ID
+ * @en Generate Saga ID
+ */
+function generateSagaId(): string {
+    return `saga_${Date.now().toString(36)}_${Math.random().toString(36).substring(2, 11)}`;
+}
+
+/**
+ * @zh Saga 编排器
+ * @en Saga Orchestrator
+ *
+ * @zh 管理分布式事务的 Saga 模式执行流程
+ * @en Manages Saga pattern execution flow for distributed transactions
+ *
+ * @example
+ * ```typescript
+ * const orchestrator = new SagaOrchestrator({
+ *     storage: redisStorage,
+ *     serverId: 'server1',
+ * })
+ *
+ * const result = await orchestrator.execute([
+ *     {
+ *         name: 'deduct_currency',
+ *         serverId: 'server1',
+ *         execute: async (data) => {
+ *             // 扣除货币
+ *             return { success: true }
+ *         },
+ *         compensate: async (data) => {
+ *             // 恢复货币
+ *         },
+ *         data: { playerId: '1', amount: 100 },
+ *     },
+ *     {
+ *         name: 'add_item',
+ *         serverId: 'server2',
+ *         execute: async (data) => {
+ *             // 添加物品
+ *             return { success: true }
+ *         },
+ *         compensate: async (data) => {
+ *             // 移除物品
+ *         },
+ *         data: { playerId: '1', itemId: 'sword' },
+ *     },
+ * ])
+ * ```
+ */
+export class SagaOrchestrator {
+    private _storage: ITransactionStorage | null;
+    private _timeout: number;
+    private _serverId: string;
+
+    constructor(config: SagaOrchestratorConfig = {}) {
+        this._storage = config.storage ?? null;
+        this._timeout = config.timeout ?? 30000;
+        this._serverId = config.serverId ?? 'default';
+    }
+
+    /**
+     * @zh 执行 Saga
+     * @en Execute Saga
+     */
+    async execute<T>(steps: SagaStep<T>[]): Promise<SagaResult> {
+        const sagaId = generateSagaId();
+        const startTime = Date.now();
+        const completedSteps: string[] = [];
+
+        const sagaLog: SagaLog = {
+            id: sagaId,
+            state: 'pending',
+            steps: steps.map((s) => ({
+                name: s.name,
+                serverId: s.serverId,
+                state: 'pending' as SagaStepState
+            })),
+            createdAt: startTime,
+            updatedAt: startTime,
+            metadata: { orchestratorServerId: this._serverId }
+        };
+
+        await this._saveSagaLog(sagaLog);
+
+        try {
+            sagaLog.state = 'running';
+            await this._saveSagaLog(sagaLog);
+
+            for (let i = 0; i < steps.length; i++) {
+                const step = steps[i];
+
+                if (Date.now() - startTime > this._timeout) {
+                    throw new Error('Saga execution timed out');
+                }
+
+                sagaLog.steps[i].state = 'executing';
+                sagaLog.steps[i].startedAt = Date.now();
+                await this._saveSagaLog(sagaLog);
+
+                const result = await step.execute(step.data);
+
+                if (!result.success) {
+                    sagaLog.steps[i].state = 'failed';
+                    sagaLog.steps[i].error = result.error;
+                    await this._saveSagaLog(sagaLog);
+
+                    throw new Error(result.error ?? `Step ${step.name} failed`);
+                }
+
+                sagaLog.steps[i].state = 'completed';
+                sagaLog.steps[i].completedAt = Date.now();
+                completedSteps.push(step.name);
+                await this._saveSagaLog(sagaLog);
+            }
+
+            sagaLog.state = 'completed';
+            sagaLog.updatedAt = Date.now();
+            await this._saveSagaLog(sagaLog);
+
+            return {
+                success: true,
+                sagaId,
+                completedSteps,
+                duration: Date.now() - startTime
+            };
+        } catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            const failedStepIndex = completedSteps.length;
+
+            sagaLog.state = 'compensating';
+            await this._saveSagaLog(sagaLog);
+
+            for (let i = completedSteps.length - 1; i >= 0; i--) {
+                const step = steps[i];
+
+                sagaLog.steps[i].state = 'compensating';
+                await this._saveSagaLog(sagaLog);
+
+                try {
+                    await step.compensate(step.data);
+                    sagaLog.steps[i].state = 'compensated';
+                } catch (compError) {
+                    const compErrorMessage = compError instanceof Error ? compError.message : String(compError);
+                    sagaLog.steps[i].state = 'failed';
+                    sagaLog.steps[i].error = `Compensation failed: ${compErrorMessage}`;
+                }
+
+                await this._saveSagaLog(sagaLog);
+            }
+
+            sagaLog.state = 'compensated';
+            sagaLog.updatedAt = Date.now();
+            await this._saveSagaLog(sagaLog);
+
+            return {
+                success: false,
+                sagaId,
+                completedSteps,
+                failedStep: steps[failedStepIndex]?.name,
+                error: errorMessage,
+                duration: Date.now() - startTime
+            };
+        }
+    }
+
+    /**
+     * @zh 恢复未完成的 Saga
+     * @en Recover pending Sagas
+     */
+    async recover(): Promise<number> {
+        if (!this._storage) return 0;
+
+        const pendingSagas = await this._getPendingSagas();
+        let recoveredCount = 0;
+
+        for (const saga of pendingSagas) {
+            try {
+                await this._recoverSaga(saga);
+                recoveredCount++;
+            } catch (error) {
+                console.error(`Failed to recover saga ${saga.id}:`, error);
+            }
+        }
+
+        return recoveredCount;
+    }
+
+    /**
+     * @zh 获取 Saga 日志
+     * @en Get Saga log
+     */
+    async getSagaLog(sagaId: string): Promise<SagaLog | null> {
+        if (!this._storage) return null;
+        return this._storage.get<SagaLog>(`saga:${sagaId}`);
+    }
+
+    private async _saveSagaLog(log: SagaLog): Promise<void> {
+        if (!this._storage) return;
+        log.updatedAt = Date.now();
+        await this._storage.set(`saga:${log.id}`, log);
+    }
+
+    private async _getPendingSagas(): Promise<SagaLog[]> {
+        return [];
+    }
+
+    private async _recoverSaga(saga: SagaLog): Promise<void> {
+        if (saga.state === 'running' || saga.state === 'compensating') {
+            const completedSteps = saga.steps
+                .filter((s) => s.state === 'completed')
+                .map((s) => s.name);
+
+            saga.state = 'compensated';
+            saga.updatedAt = Date.now();
+
+            if (this._storage) {
+                await this._storage.set(`saga:${saga.id}`, saga);
+            }
+        }
+    }
+}
+
+/**
+ * @zh 创建 Saga 编排器
+ * @en Create Saga orchestrator
+ */
+export function createSagaOrchestrator(config: SagaOrchestratorConfig = {}): SagaOrchestrator {
+    return new SagaOrchestrator(config);
+}

packages/framework/transaction/src/distributed/index.ts

@@ -0,0 +1,15 @@
+/**
+ * @zh 分布式模块导出
+ * @en Distributed module exports
+ */
+
+export {
+    SagaOrchestrator,
+    createSagaOrchestrator,
+    type SagaOrchestratorConfig,
+    type SagaStep,
+    type SagaStepState,
+    type SagaStepLog,
+    type SagaLog,
+    type SagaResult
+} from './SagaOrchestrator.js';

packages/framework/transaction/src/index.ts

@@ -0,0 +1,165 @@
+/**
+ * @zh @esengine/transaction 事务系统
+ * @en @esengine/transaction Transaction System
+ *
+ * @zh 提供游戏事务处理能力，支持商店购买、玩家交易、分布式事务
+ * @en Provides game transaction capabilities, supporting shop purchases, player trading, and distributed transactions
+ *
+ * @example
+ * ```typescript
+ * import {
+ *     TransactionManager,
+ *     MemoryStorage,
+ *     CurrencyOperation,
+ *     InventoryOperation,
+ * } from '@esengine/transaction'
+ *
+ * // 创建事务管理器
+ * const manager = new TransactionManager({
+ *     storage: new MemoryStorage(),
+ * })
+ *
+ * // 执行事务
+ * const result = await manager.run((tx) => {
+ *     tx.addOperation(new CurrencyOperation({
+ *         type: 'deduct',
+ *         playerId: 'player1',
+ *         currency: 'gold',
+ *         amount: 100,
+ *     }))
+ *     tx.addOperation(new InventoryOperation({
+ *         type: 'add',
+ *         playerId: 'player1',
+ *         itemId: 'sword',
+ *         quantity: 1,
+ *     }))
+ * })
+ *
+ * if (result.success) {
+ *     console.log('Transaction completed!')
+ * }
+ * ```
+ */
+
+// =============================================================================
+// Core | 核心
+// =============================================================================
+
+export type {
+    TransactionState,
+    OperationResult,
+    TransactionResult,
+    OperationLog,
+    TransactionLog,
+    TransactionOptions,
+    TransactionManagerConfig,
+    ITransactionStorage,
+    ITransactionOperation,
+    ITransactionContext
+} from './core/types.js';
+
+export {
+    TransactionContext,
+    createTransactionContext
+} from './core/TransactionContext.js';
+
+export {
+    TransactionManager,
+    createTransactionManager
+} from './core/TransactionManager.js';
+
+// =============================================================================
+// Storage | 存储
+// =============================================================================
+
+export {
+    MemoryStorage,
+    createMemoryStorage,
+    type MemoryStorageConfig
+} from './storage/MemoryStorage.js';
+
+export {
+    RedisStorage,
+    createRedisStorage,
+    type RedisStorageConfig,
+    type RedisClient
+} from './storage/RedisStorage.js';
+
+export {
+    MongoStorage,
+    createMongoStorage,
+    type MongoStorageConfig,
+    type MongoDb,
+    type MongoCollection
+} from './storage/MongoStorage.js';
+
+// =============================================================================
+// Operations | 操作
+// =============================================================================
+
+export { BaseOperation } from './operations/BaseOperation.js';
+
+export {
+    CurrencyOperation,
+    createCurrencyOperation,
+    type CurrencyOperationType,
+    type CurrencyOperationData,
+    type CurrencyOperationResult,
+    type ICurrencyProvider
+} from './operations/CurrencyOperation.js';
+
+export {
+    InventoryOperation,
+    createInventoryOperation,
+    type InventoryOperationType,
+    type InventoryOperationData,
+    type InventoryOperationResult,
+    type IInventoryProvider,
+    type ItemData
+} from './operations/InventoryOperation.js';
+
+export {
+    TradeOperation,
+    createTradeOperation,
+    type TradeOperationData,
+    type TradeOperationResult,
+    type TradeItem,
+    type TradeCurrency,
+    type TradeParty,
+    type ITradeProvider
+} from './operations/TradeOperation.js';
+
+// =============================================================================
+// Distributed | 分布式
+// =============================================================================
+
+export {
+    SagaOrchestrator,
+    createSagaOrchestrator,
+    type SagaOrchestratorConfig,
+    type SagaStep,
+    type SagaStepState,
+    type SagaStepLog,
+    type SagaLog,
+    type SagaResult
+} from './distributed/SagaOrchestrator.js';
+
+// =============================================================================
+// Integration | 集成
+// =============================================================================
+
+export {
+    withTransactions,
+    TransactionRoom,
+    type TransactionRoomConfig,
+    type ITransactionRoom
+} from './integration/RoomTransactionMixin.js';
+
+// =============================================================================
+// Tokens | 令牌
+// =============================================================================
+
+export {
+    TransactionManagerToken,
+    TransactionStorageToken
+} from './tokens.js';

packages/framework/transaction/src/integration/RoomTransactionMixin.ts

@@ -0,0 +1,174 @@
+/**
+ * @zh Room 事务扩展
+ * @en Room transaction extension
+ */
+
+import type {
+    ITransactionStorage,
+    ITransactionContext,
+    TransactionOptions,
+    TransactionResult
+} from '../core/types.js';
+import { TransactionManager } from '../core/TransactionManager.js';
+
+/**
+ * @zh 事务 Room 配置
+ * @en Transaction Room configuration
+ */
+export interface TransactionRoomConfig {
+    /**
+     * @zh 存储实例
+     * @en Storage instance
+     */
+    storage?: ITransactionStorage
+
+    /**
+     * @zh 默认超时时间（毫秒）
+     * @en Default timeout in milliseconds
+     */
+    defaultTimeout?: number
+
+    /**
+     * @zh 服务器 ID
+     * @en Server ID
+     */
+    serverId?: string
+}
+
+/**
+ * @zh 事务 Room 接口
+ * @en Transaction Room interface
+ */
+export interface ITransactionRoom {
+    /**
+     * @zh 事务管理器
+     * @en Transaction manager
+     */
+    readonly transactions: TransactionManager
+
+    /**
+     * @zh 开始事务
+     * @en Begin transaction
+     */
+    beginTransaction(options?: TransactionOptions): ITransactionContext
+
+    /**
+     * @zh 执行事务
+     * @en Run transaction
+     */
+    runTransaction<T = unknown>(
+        builder: (ctx: ITransactionContext) => void | Promise<void>,
+        options?: TransactionOptions
+    ): Promise<TransactionResult<T>>
+}
+
+/**
+ * @zh 创建事务 Room mixin
+ * @en Create transaction Room mixin
+ *
+ * @example
+ * ```typescript
+ * import { Room } from '@esengine/server'
+ * import { withTransactions, RedisStorage } from '@esengine/transaction'
+ *
+ * class GameRoom extends withTransactions(Room, {
+ *     storage: new RedisStorage({ client: redisClient }),
+ * }) {
+ *     async handleBuy(itemId: string, player: Player) {
+ *         const result = await this.runTransaction((tx) => {
+ *             tx.addOperation(new CurrencyOperation({
+ *                 type: 'deduct',
+ *                 playerId: player.id,
+ *                 currency: 'gold',
+ *                 amount: 100,
+ *             }))
+ *         })
+ *
+ *         if (result.success) {
+ *             player.send('buy_success', { itemId })
+ *         }
+ *     }
+ * }
+ * ```
+ */
+export function withTransactions<TBase extends new (...args: any[]) => any>(
+    Base: TBase,
+    config: TransactionRoomConfig = {}
+): TBase & (new (...args: any[]) => ITransactionRoom) {
+    return class TransactionRoom extends Base implements ITransactionRoom {
+        private _transactionManager: TransactionManager;
+
+        constructor(...args: any[]) {
+            super(...args);
+            this._transactionManager = new TransactionManager({
+                storage: config.storage,
+                defaultTimeout: config.defaultTimeout,
+                serverId: config.serverId
+            });
+        }
+
+        get transactions(): TransactionManager {
+            return this._transactionManager;
+        }
+
+        beginTransaction(options?: TransactionOptions): ITransactionContext {
+            return this._transactionManager.begin(options);
+        }
+
+        runTransaction<T = unknown>(
+            builder: (ctx: ITransactionContext) => void | Promise<void>,
+            options?: TransactionOptions
+        ): Promise<TransactionResult<T>> {
+            return this._transactionManager.run<T>(builder, options);
+        }
+    };
+}
+
+/**
+ * @zh 事务 Room 抽象基类
+ * @en Transaction Room abstract base class
+ *
+ * @zh 可以直接继承使用，也可以使用 withTransactions mixin
+ * @en Can be extended directly or use withTransactions mixin
+ *
+ * @example
+ * ```typescript
+ * class GameRoom extends TransactionRoom {
+ *     constructor() {
+ *         super({ storage: new RedisStorage({ client: redisClient }) })
+ *     }
+ *
+ *     async handleTrade(data: TradeData, player: Player) {
+ *         const result = await this.runTransaction((tx) => {
+ *             // 添加交易操作
+ *         })
+ *     }
+ * }
+ * ```
+ */
+export abstract class TransactionRoom implements ITransactionRoom {
+    private _transactionManager: TransactionManager;
+
+    constructor(config: TransactionRoomConfig = {}) {
+        this._transactionManager = new TransactionManager({
+            storage: config.storage,
+            defaultTimeout: config.defaultTimeout,
+            serverId: config.serverId
+        });
+    }
+
+    get transactions(): TransactionManager {
+        return this._transactionManager;
+    }
+
+    beginTransaction(options?: TransactionOptions): ITransactionContext {
+        return this._transactionManager.begin(options);
+    }
+
+    runTransaction<T = unknown>(
+        builder: (ctx: ITransactionContext) => void | Promise<void>,
+        options?: TransactionOptions
+    ): Promise<TransactionResult<T>> {
+        return this._transactionManager.run<T>(builder, options);
+    }
+}

packages/framework/transaction/src/integration/index.ts

@@ -0,0 +1,11 @@
+/**
+ * @zh 集成模块导出
+ * @en Integration module exports
+ */
+
+export {
+    withTransactions,
+    TransactionRoom,
+    type TransactionRoomConfig,
+    type ITransactionRoom
+} from './RoomTransactionMixin.js';

packages/framework/transaction/src/operations/BaseOperation.ts

@@ -0,0 +1,64 @@
+/**
+ * @zh 操作基类
+ * @en Base operation class
+ */
+
+import type {
+    ITransactionOperation,
+    ITransactionContext,
+    OperationResult
+} from '../core/types.js';
+
+/**
+ * @zh 操作基类
+ * @en Base operation class
+ *
+ * @zh 提供通用的操作实现模板
+ * @en Provides common operation implementation template
+ */
+export abstract class BaseOperation<TData = unknown, TResult = unknown>
+implements ITransactionOperation<TData, TResult>
+{
+    abstract readonly name: string
+    readonly data: TData;
+
+    constructor(data: TData) {
+        this.data = data;
+    }
+
+    /**
+     * @zh 验证前置条件（默认通过）
+     * @en Validate preconditions (passes by default)
+     */
+    async validate(_ctx: ITransactionContext): Promise<boolean> {
+        return true;
+    }
+
+    /**
+     * @zh 执行操作
+     * @en Execute operation
+     */
+    abstract execute(ctx: ITransactionContext): Promise<OperationResult<TResult>>
+
+    /**
+     * @zh 补偿操作
+     * @en Compensate operation
+     */
+    abstract compensate(ctx: ITransactionContext): Promise<void>
+
+    /**
+     * @zh 创建成功结果
+     * @en Create success result
+     */
+    protected success(data?: TResult): OperationResult<TResult> {
+        return { success: true, data };
+    }
+
+    /**
+     * @zh 创建失败结果
+     * @en Create failure result
+     */
+    protected failure(error: string, errorCode?: string): OperationResult<TResult> {
+        return { success: false, error, errorCode };
+    }
+}

packages/framework/transaction/src/operations/CurrencyOperation.ts

@@ -0,0 +1,208 @@
+/**
+ * @zh 货币操作
+ * @en Currency operation
+ */
+
+import type { ITransactionContext, OperationResult } from '../core/types.js';
+import { BaseOperation } from './BaseOperation.js';
+
+/**
+ * @zh 货币操作类型
+ * @en Currency operation type
+ */
+export type CurrencyOperationType = 'add' | 'deduct'
+
+/**
+ * @zh 货币操作数据
+ * @en Currency operation data
+ */
+export interface CurrencyOperationData {
+    /**
+     * @zh 操作类型
+     * @en Operation type
+     */
+    type: CurrencyOperationType
+
+    /**
+     * @zh 玩家 ID
+     * @en Player ID
+     */
+    playerId: string
+
+    /**
+     * @zh 货币类型（如 gold, diamond 等）
+     * @en Currency type (e.g., gold, diamond)
+     */
+    currency: string
+
+    /**
+     * @zh 数量
+     * @en Amount
+     */
+    amount: number
+
+    /**
+     * @zh 原因/来源
+     * @en Reason/source
+     */
+    reason?: string
+}
+
+/**
+ * @zh 货币操作结果
+ * @en Currency operation result
+ */
+export interface CurrencyOperationResult {
+    /**
+     * @zh 操作前余额
+     * @en Balance before operation
+     */
+    beforeBalance: number
+
+    /**
+     * @zh 操作后余额
+     * @en Balance after operation
+     */
+    afterBalance: number
+}
+
+/**
+ * @zh 货币数据提供者接口
+ * @en Currency data provider interface
+ */
+export interface ICurrencyProvider {
+    /**
+     * @zh 获取货币余额
+     * @en Get currency balance
+     */
+    getBalance(playerId: string, currency: string): Promise<number>
+
+    /**
+     * @zh 设置货币余额
+     * @en Set currency balance
+     */
+    setBalance(playerId: string, currency: string, amount: number): Promise<void>
+}
+
+/**
+ * @zh 货币操作
+ * @en Currency operation
+ *
+ * @zh 用于处理货币的增加和扣除
+ * @en Used for handling currency addition and deduction
+ *
+ * @example
+ * ```typescript
+ * // 扣除金币
+ * tx.addOperation(new CurrencyOperation({
+ *     type: 'deduct',
+ *     playerId: 'player1',
+ *     currency: 'gold',
+ *     amount: 100,
+ *     reason: 'purchase_item',
+ * }))
+ *
+ * // 增加钻石
+ * tx.addOperation(new CurrencyOperation({
+ *     type: 'add',
+ *     playerId: 'player1',
+ *     currency: 'diamond',
+ *     amount: 50,
+ * }))
+ * ```
+ */
+export class CurrencyOperation extends BaseOperation<CurrencyOperationData, CurrencyOperationResult> {
+    readonly name = 'currency';
+
+    private _provider: ICurrencyProvider | null = null;
+    private _beforeBalance: number = 0;
+
+    /**
+     * @zh 设置货币数据提供者
+     * @en Set currency data provider
+     */
+    setProvider(provider: ICurrencyProvider): this {
+        this._provider = provider;
+        return this;
+    }
+
+    async validate(ctx: ITransactionContext): Promise<boolean> {
+        if (this.data.amount <= 0) {
+            return false;
+        }
+
+        if (this.data.type === 'deduct') {
+            const balance = await this._getBalance(ctx);
+            return balance >= this.data.amount;
+        }
+
+        return true;
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult<CurrencyOperationResult>> {
+        const { type, playerId, currency, amount } = this.data;
+
+        this._beforeBalance = await this._getBalance(ctx);
+
+        let afterBalance: number;
+
+        if (type === 'add') {
+            afterBalance = this._beforeBalance + amount;
+        } else {
+            if (this._beforeBalance < amount) {
+                return this.failure('Insufficient balance', 'INSUFFICIENT_BALANCE');
+            }
+            afterBalance = this._beforeBalance - amount;
+        }
+
+        await this._setBalance(ctx, afterBalance);
+
+        ctx.set(`currency:${playerId}:${currency}:before`, this._beforeBalance);
+        ctx.set(`currency:${playerId}:${currency}:after`, afterBalance);
+
+        return this.success({
+            beforeBalance: this._beforeBalance,
+            afterBalance
+        });
+    }
+
+    async compensate(ctx: ITransactionContext): Promise<void> {
+        await this._setBalance(ctx, this._beforeBalance);
+    }
+
+    private async _getBalance(ctx: ITransactionContext): Promise<number> {
+        const { playerId, currency } = this.data;
+
+        if (this._provider) {
+            return this._provider.getBalance(playerId, currency);
+        }
+
+        if (ctx.storage) {
+            const balance = await ctx.storage.get<number>(`player:${playerId}:currency:${currency}`);
+            return balance ?? 0;
+        }
+
+        return 0;
+    }
+
+    private async _setBalance(ctx: ITransactionContext, amount: number): Promise<void> {
+        const { playerId, currency } = this.data;
+
+        if (this._provider) {
+            await this._provider.setBalance(playerId, currency, amount);
+            return;
+        }
+
+        if (ctx.storage) {
+            await ctx.storage.set(`player:${playerId}:currency:${currency}`, amount);
+        }
+    }
+}
+
+/**
+ * @zh 创建货币操作
+ * @en Create currency operation
+ */
+export function createCurrencyOperation(data: CurrencyOperationData): CurrencyOperation {
+    return new CurrencyOperation(data);
+}

packages/framework/transaction/src/operations/InventoryOperation.ts

@@ -0,0 +1,291 @@
+/**
+ * @zh 背包操作
+ * @en Inventory operation
+ */
+
+import type { ITransactionContext, OperationResult } from '../core/types.js';
+import { BaseOperation } from './BaseOperation.js';
+
+/**
+ * @zh 背包操作类型
+ * @en Inventory operation type
+ */
+export type InventoryOperationType = 'add' | 'remove' | 'update'
+
+/**
+ * @zh 物品数据
+ * @en Item data
+ */
+export interface ItemData {
+    /**
+     * @zh 物品 ID
+     * @en Item ID
+     */
+    itemId: string
+
+    /**
+     * @zh 数量
+     * @en Quantity
+     */
+    quantity: number
+
+    /**
+     * @zh 物品属性
+     * @en Item properties
+     */
+    properties?: Record<string, unknown>
+}
+
+/**
+ * @zh 背包操作数据
+ * @en Inventory operation data
+ */
+export interface InventoryOperationData {
+    /**
+     * @zh 操作类型
+     * @en Operation type
+     */
+    type: InventoryOperationType
+
+    /**
+     * @zh 玩家 ID
+     * @en Player ID
+     */
+    playerId: string
+
+    /**
+     * @zh 物品 ID
+     * @en Item ID
+     */
+    itemId: string
+
+    /**
+     * @zh 数量
+     * @en Quantity
+     */
+    quantity: number
+
+    /**
+     * @zh 物品属性（用于更新）
+     * @en Item properties (for update)
+     */
+    properties?: Record<string, unknown>
+
+    /**
+     * @zh 原因/来源
+     * @en Reason/source
+     */
+    reason?: string
+}
+
+/**
+ * @zh 背包操作结果
+ * @en Inventory operation result
+ */
+export interface InventoryOperationResult {
+    /**
+     * @zh 操作前的物品数据
+     * @en Item data before operation
+     */
+    beforeItem?: ItemData
+
+    /**
+     * @zh 操作后的物品数据
+     * @en Item data after operation
+     */
+    afterItem?: ItemData
+}
+
+/**
+ * @zh 背包数据提供者接口
+ * @en Inventory data provider interface
+ */
+export interface IInventoryProvider {
+    /**
+     * @zh 获取物品
+     * @en Get item
+     */
+    getItem(playerId: string, itemId: string): Promise<ItemData | null>
+
+    /**
+     * @zh 设置物品
+     * @en Set item
+     */
+    setItem(playerId: string, itemId: string, item: ItemData | null): Promise<void>
+
+    /**
+     * @zh 检查背包容量
+     * @en Check inventory capacity
+     */
+    hasCapacity?(playerId: string, count: number): Promise<boolean>
+}
+
+/**
+ * @zh 背包操作
+ * @en Inventory operation
+ *
+ * @zh 用于处理物品的添加、移除和更新
+ * @en Used for handling item addition, removal, and update
+ *
+ * @example
+ * ```typescript
+ * // 添加物品
+ * tx.addOperation(new InventoryOperation({
+ *     type: 'add',
+ *     playerId: 'player1',
+ *     itemId: 'sword_001',
+ *     quantity: 1,
+ * }))
+ *
+ * // 移除物品
+ * tx.addOperation(new InventoryOperation({
+ *     type: 'remove',
+ *     playerId: 'player1',
+ *     itemId: 'potion_hp',
+ *     quantity: 5,
+ * }))
+ * ```
+ */
+export class InventoryOperation extends BaseOperation<InventoryOperationData, InventoryOperationResult> {
+    readonly name = 'inventory';
+
+    private _provider: IInventoryProvider | null = null;
+    private _beforeItem: ItemData | null = null;
+
+    /**
+     * @zh 设置背包数据提供者
+     * @en Set inventory data provider
+     */
+    setProvider(provider: IInventoryProvider): this {
+        this._provider = provider;
+        return this;
+    }
+
+    async validate(ctx: ITransactionContext): Promise<boolean> {
+        const { type, quantity } = this.data;
+
+        if (quantity <= 0) {
+            return false;
+        }
+
+        if (type === 'remove') {
+            const item = await this._getItem(ctx);
+            return item !== null && item.quantity >= quantity;
+        }
+
+        if (type === 'add' && this._provider?.hasCapacity) {
+            return this._provider.hasCapacity(this.data.playerId, 1);
+        }
+
+        return true;
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult<InventoryOperationResult>> {
+        const { type, playerId, itemId, quantity, properties } = this.data;
+
+        this._beforeItem = await this._getItem(ctx);
+
+        let afterItem: ItemData | null = null;
+
+        switch (type) {
+            case 'add': {
+                if (this._beforeItem) {
+                    afterItem = {
+                        ...this._beforeItem,
+                        quantity: this._beforeItem.quantity + quantity
+                    };
+                } else {
+                    afterItem = {
+                        itemId,
+                        quantity,
+                        properties
+                    };
+                }
+                break;
+            }
+
+            case 'remove': {
+                if (!this._beforeItem || this._beforeItem.quantity < quantity) {
+                    return this.failure('Insufficient item quantity', 'INSUFFICIENT_ITEM');
+                }
+
+                const newQuantity = this._beforeItem.quantity - quantity;
+                if (newQuantity > 0) {
+                    afterItem = {
+                        ...this._beforeItem,
+                        quantity: newQuantity
+                    };
+                } else {
+                    afterItem = null;
+                }
+                break;
+            }
+
+            case 'update': {
+                if (!this._beforeItem) {
+                    return this.failure('Item not found', 'ITEM_NOT_FOUND');
+                }
+
+                afterItem = {
+                    ...this._beforeItem,
+                    quantity: quantity > 0 ? quantity : this._beforeItem.quantity,
+                    properties: properties ?? this._beforeItem.properties
+                };
+                break;
+            }
+        }
+
+        await this._setItem(ctx, afterItem);
+
+        ctx.set(`inventory:${playerId}:${itemId}:before`, this._beforeItem);
+        ctx.set(`inventory:${playerId}:${itemId}:after`, afterItem);
+
+        return this.success({
+            beforeItem: this._beforeItem ?? undefined,
+            afterItem: afterItem ?? undefined
+        });
+    }
+
+    async compensate(ctx: ITransactionContext): Promise<void> {
+        await this._setItem(ctx, this._beforeItem);
+    }
+
+    private async _getItem(ctx: ITransactionContext): Promise<ItemData | null> {
+        const { playerId, itemId } = this.data;
+
+        if (this._provider) {
+            return this._provider.getItem(playerId, itemId);
+        }
+
+        if (ctx.storage) {
+            return ctx.storage.get<ItemData>(`player:${playerId}:inventory:${itemId}`);
+        }
+
+        return null;
+    }
+
+    private async _setItem(ctx: ITransactionContext, item: ItemData | null): Promise<void> {
+        const { playerId, itemId } = this.data;
+
+        if (this._provider) {
+            await this._provider.setItem(playerId, itemId, item);
+            return;
+        }
+
+        if (ctx.storage) {
+            if (item) {
+                await ctx.storage.set(`player:${playerId}:inventory:${itemId}`, item);
+            } else {
+                await ctx.storage.delete(`player:${playerId}:inventory:${itemId}`);
+            }
+        }
+    }
+}
+
+/**
+ * @zh 创建背包操作
+ * @en Create inventory operation
+ */
+export function createInventoryOperation(data: InventoryOperationData): InventoryOperation {
+    return new InventoryOperation(data);
+}

packages/framework/transaction/src/operations/TradeOperation.ts

@@ -0,0 +1,331 @@
+/**
+ * @zh 交易操作
+ * @en Trade operation
+ */
+
+import type { ITransactionContext, OperationResult } from '../core/types.js';
+import { BaseOperation } from './BaseOperation.js';
+import { CurrencyOperation, type CurrencyOperationData, type ICurrencyProvider } from './CurrencyOperation.js';
+import { InventoryOperation, type InventoryOperationData, type IInventoryProvider, type ItemData } from './InventoryOperation.js';
+
+/**
+ * @zh 交易物品
+ * @en Trade item
+ */
+export interface TradeItem {
+    /**
+     * @zh 物品 ID
+     * @en Item ID
+     */
+    itemId: string
+
+    /**
+     * @zh 数量
+     * @en Quantity
+     */
+    quantity: number
+}
+
+/**
+ * @zh 交易货币
+ * @en Trade currency
+ */
+export interface TradeCurrency {
+    /**
+     * @zh 货币类型
+     * @en Currency type
+     */
+    currency: string
+
+    /**
+     * @zh 数量
+     * @en Amount
+     */
+    amount: number
+}
+
+/**
+ * @zh 交易方数据
+ * @en Trade party data
+ */
+export interface TradeParty {
+    /**
+     * @zh 玩家 ID
+     * @en Player ID
+     */
+    playerId: string
+
+    /**
+     * @zh 给出的物品
+     * @en Items to give
+     */
+    items?: TradeItem[]
+
+    /**
+     * @zh 给出的货币
+     * @en Currencies to give
+     */
+    currencies?: TradeCurrency[]
+}
+
+/**
+ * @zh 交易操作数据
+ * @en Trade operation data
+ */
+export interface TradeOperationData {
+    /**
+     * @zh 交易 ID
+     * @en Trade ID
+     */
+    tradeId: string
+
+    /**
+     * @zh 交易发起方
+     * @en Trade initiator
+     */
+    partyA: TradeParty
+
+    /**
+     * @zh 交易接收方
+     * @en Trade receiver
+     */
+    partyB: TradeParty
+
+    /**
+     * @zh 原因/备注
+     * @en Reason/note
+     */
+    reason?: string
+}
+
+/**
+ * @zh 交易操作结果
+ * @en Trade operation result
+ */
+export interface TradeOperationResult {
+    /**
+     * @zh 交易 ID
+     * @en Trade ID
+     */
+    tradeId: string
+
+    /**
+     * @zh 交易是否成功
+     * @en Whether trade succeeded
+     */
+    completed: boolean
+}
+
+/**
+ * @zh 交易数据提供者
+ * @en Trade data provider
+ */
+export interface ITradeProvider {
+    currencyProvider?: ICurrencyProvider
+    inventoryProvider?: IInventoryProvider
+}
+
+/**
+ * @zh 交易操作
+ * @en Trade operation
+ *
+ * @zh 用于处理玩家之间的物品和货币交换
+ * @en Used for handling item and currency exchange between players
+ *
+ * @example
+ * ```typescript
+ * tx.addOperation(new TradeOperation({
+ *     tradeId: 'trade_001',
+ *     partyA: {
+ *         playerId: 'player1',
+ *         items: [{ itemId: 'sword', quantity: 1 }],
+ *     },
+ *     partyB: {
+ *         playerId: 'player2',
+ *         currencies: [{ currency: 'gold', amount: 1000 }],
+ *     },
+ * }))
+ * ```
+ */
+export class TradeOperation extends BaseOperation<TradeOperationData, TradeOperationResult> {
+    readonly name = 'trade';
+
+    private _provider: ITradeProvider | null = null;
+    private _subOperations: (CurrencyOperation | InventoryOperation)[] = [];
+    private _executedCount = 0;
+
+    /**
+     * @zh 设置交易数据提供者
+     * @en Set trade data provider
+     */
+    setProvider(provider: ITradeProvider): this {
+        this._provider = provider;
+        return this;
+    }
+
+    async validate(ctx: ITransactionContext): Promise<boolean> {
+        this._buildSubOperations();
+
+        for (const op of this._subOperations) {
+            const isValid = await op.validate(ctx);
+            if (!isValid) {
+                return false;
+            }
+        }
+
+        return true;
+    }
+
+    async execute(ctx: ITransactionContext): Promise<OperationResult<TradeOperationResult>> {
+        this._buildSubOperations();
+        this._executedCount = 0;
+
+        try {
+            for (const op of this._subOperations) {
+                const result = await op.execute(ctx);
+                if (!result.success) {
+                    await this._compensateExecuted(ctx);
+                    return this.failure(result.error ?? 'Trade operation failed', 'TRADE_FAILED');
+                }
+                this._executedCount++;
+            }
+
+            return this.success({
+                tradeId: this.data.tradeId,
+                completed: true
+            });
+        } catch (error) {
+            await this._compensateExecuted(ctx);
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            return this.failure(errorMessage, 'TRADE_ERROR');
+        }
+    }
+
+    async compensate(ctx: ITransactionContext): Promise<void> {
+        await this._compensateExecuted(ctx);
+    }
+
+    private _buildSubOperations(): void {
+        if (this._subOperations.length > 0) return;
+
+        const { partyA, partyB } = this.data;
+
+        if (partyA.items) {
+            for (const item of partyA.items) {
+                const removeOp = new InventoryOperation({
+                    type: 'remove',
+                    playerId: partyA.playerId,
+                    itemId: item.itemId,
+                    quantity: item.quantity,
+                    reason: `trade:${this.data.tradeId}:give`
+                });
+                const addOp = new InventoryOperation({
+                    type: 'add',
+                    playerId: partyB.playerId,
+                    itemId: item.itemId,
+                    quantity: item.quantity,
+                    reason: `trade:${this.data.tradeId}:receive`
+                });
+
+                if (this._provider?.inventoryProvider) {
+                    removeOp.setProvider(this._provider.inventoryProvider);
+                    addOp.setProvider(this._provider.inventoryProvider);
+                }
+
+                this._subOperations.push(removeOp, addOp);
+            }
+        }
+
+        if (partyA.currencies) {
+            for (const curr of partyA.currencies) {
+                const deductOp = new CurrencyOperation({
+                    type: 'deduct',
+                    playerId: partyA.playerId,
+                    currency: curr.currency,
+                    amount: curr.amount,
+                    reason: `trade:${this.data.tradeId}:give`
+                });
+                const addOp = new CurrencyOperation({
+                    type: 'add',
+                    playerId: partyB.playerId,
+                    currency: curr.currency,
+                    amount: curr.amount,
+                    reason: `trade:${this.data.tradeId}:receive`
+                });
+
+                if (this._provider?.currencyProvider) {
+                    deductOp.setProvider(this._provider.currencyProvider);
+                    addOp.setProvider(this._provider.currencyProvider);
+                }
+
+                this._subOperations.push(deductOp, addOp);
+            }
+        }
+
+        if (partyB.items) {
+            for (const item of partyB.items) {
+                const removeOp = new InventoryOperation({
+                    type: 'remove',
+                    playerId: partyB.playerId,
+                    itemId: item.itemId,
+                    quantity: item.quantity,
+                    reason: `trade:${this.data.tradeId}:give`
+                });
+                const addOp = new InventoryOperation({
+                    type: 'add',
+                    playerId: partyA.playerId,
+                    itemId: item.itemId,
+                    quantity: item.quantity,
+                    reason: `trade:${this.data.tradeId}:receive`
+                });
+
+                if (this._provider?.inventoryProvider) {
+                    removeOp.setProvider(this._provider.inventoryProvider);
+                    addOp.setProvider(this._provider.inventoryProvider);
+                }
+
+                this._subOperations.push(removeOp, addOp);
+            }
+        }
+
+        if (partyB.currencies) {
+            for (const curr of partyB.currencies) {
+                const deductOp = new CurrencyOperation({
+                    type: 'deduct',
+                    playerId: partyB.playerId,
+                    currency: curr.currency,
+                    amount: curr.amount,
+                    reason: `trade:${this.data.tradeId}:give`
+                });
+                const addOp = new CurrencyOperation({
+                    type: 'add',
+                    playerId: partyA.playerId,
+                    currency: curr.currency,
+                    amount: curr.amount,
+                    reason: `trade:${this.data.tradeId}:receive`
+                });
+
+                if (this._provider?.currencyProvider) {
+                    deductOp.setProvider(this._provider.currencyProvider);
+                    addOp.setProvider(this._provider.currencyProvider);
+                }
+
+                this._subOperations.push(deductOp, addOp);
+            }
+        }
+    }
+
+    private async _compensateExecuted(ctx: ITransactionContext): Promise<void> {
+        for (let i = this._executedCount - 1; i >= 0; i--) {
+            await this._subOperations[i].compensate(ctx);
+        }
+    }
+}
+
+/**
+ * @zh 创建交易操作
+ * @en Create trade operation
+ */
+export function createTradeOperation(data: TradeOperationData): TradeOperation {
+    return new TradeOperation(data);
+}

packages/framework/transaction/src/operations/index.ts

@@ -0,0 +1,36 @@
+/**
+ * @zh 操作模块导出
+ * @en Operations module exports
+ */
+
+export { BaseOperation } from './BaseOperation.js';
+
+export {
+    CurrencyOperation,
+    createCurrencyOperation,
+    type CurrencyOperationType,
+    type CurrencyOperationData,
+    type CurrencyOperationResult,
+    type ICurrencyProvider
+} from './CurrencyOperation.js';
+
+export {
+    InventoryOperation,
+    createInventoryOperation,
+    type InventoryOperationType,
+    type InventoryOperationData,
+    type InventoryOperationResult,
+    type IInventoryProvider,
+    type ItemData
+} from './InventoryOperation.js';
+
+export {
+    TradeOperation,
+    createTradeOperation,
+    type TradeOperationData,
+    type TradeOperationResult,
+    type TradeItem,
+    type TradeCurrency,
+    type TradeParty,
+    type ITradeProvider
+} from './TradeOperation.js';

packages/framework/transaction/src/storage/MemoryStorage.ts

@@ -0,0 +1,229 @@
+/**
+ * @zh 内存存储实现
+ * @en Memory storage implementation
+ *
+ * @zh 用于开发和测试环境，不支持分布式
+ * @en For development and testing, does not support distributed scenarios
+ */
+
+import type {
+    ITransactionStorage,
+    TransactionLog,
+    TransactionState,
+    OperationLog
+} from '../core/types.js';
+
+/**
+ * @zh 内存存储配置
+ * @en Memory storage configuration
+ */
+export interface MemoryStorageConfig {
+    /**
+     * @zh 最大事务日志数量
+     * @en Maximum transaction log count
+     */
+    maxTransactions?: number
+}
+
+/**
+ * @zh 内存存储
+ * @en Memory storage
+ *
+ * @zh 适用于单机开发和测试，数据仅保存在内存中
+ * @en Suitable for single-machine development and testing, data is stored in memory only
+ */
+export class MemoryStorage implements ITransactionStorage {
+    private _transactions: Map<string, TransactionLog> = new Map();
+    private _data: Map<string, { value: unknown; expireAt?: number }> = new Map();
+    private _locks: Map<string, { token: string; expireAt: number }> = new Map();
+    private _maxTransactions: number;
+
+    constructor(config: MemoryStorageConfig = {}) {
+        this._maxTransactions = config.maxTransactions ?? 1000;
+    }
+
+    // =========================================================================
+    // 分布式锁 | Distributed Lock
+    // =========================================================================
+
+    async acquireLock(key: string, ttl: number): Promise<string | null> {
+        this._cleanExpiredLocks();
+
+        const existing = this._locks.get(key);
+        if (existing && existing.expireAt > Date.now()) {
+            return null;
+        }
+
+        const token = `lock_${Date.now()}_${Math.random().toString(36).substring(2)}`;
+        this._locks.set(key, {
+            token,
+            expireAt: Date.now() + ttl
+        });
+
+        return token;
+    }
+
+    async releaseLock(key: string, token: string): Promise<boolean> {
+        const lock = this._locks.get(key);
+        if (!lock || lock.token !== token) {
+            return false;
+        }
+
+        this._locks.delete(key);
+        return true;
+    }
+
+    // =========================================================================
+    // 事务日志 | Transaction Log
+    // =========================================================================
+
+    async saveTransaction(tx: TransactionLog): Promise<void> {
+        if (this._transactions.size >= this._maxTransactions) {
+            this._cleanOldTransactions();
+        }
+
+        this._transactions.set(tx.id, { ...tx });
+    }
+
+    async getTransaction(id: string): Promise<TransactionLog | null> {
+        const tx = this._transactions.get(id);
+        return tx ? { ...tx } : null;
+    }
+
+    async updateTransactionState(id: string, state: TransactionState): Promise<void> {
+        const tx = this._transactions.get(id);
+        if (tx) {
+            tx.state = state;
+            tx.updatedAt = Date.now();
+        }
+    }
+
+    async updateOperationState(
+        transactionId: string,
+        operationIndex: number,
+        state: OperationLog['state'],
+        error?: string
+    ): Promise<void> {
+        const tx = this._transactions.get(transactionId);
+        if (tx && tx.operations[operationIndex]) {
+            tx.operations[operationIndex].state = state;
+            if (error) {
+                tx.operations[operationIndex].error = error;
+            }
+            if (state === 'executed') {
+                tx.operations[operationIndex].executedAt = Date.now();
+            } else if (state === 'compensated') {
+                tx.operations[operationIndex].compensatedAt = Date.now();
+            }
+            tx.updatedAt = Date.now();
+        }
+    }
+
+    async getPendingTransactions(serverId?: string): Promise<TransactionLog[]> {
+        const result: TransactionLog[] = [];
+
+        for (const tx of this._transactions.values()) {
+            if (tx.state === 'pending' || tx.state === 'executing') {
+                if (!serverId || tx.metadata?.serverId === serverId) {
+                    result.push({ ...tx });
+                }
+            }
+        }
+
+        return result;
+    }
+
+    async deleteTransaction(id: string): Promise<void> {
+        this._transactions.delete(id);
+    }
+
+    // =========================================================================
+    // 数据操作 | Data Operations
+    // =========================================================================
+
+    async get<T>(key: string): Promise<T | null> {
+        this._cleanExpiredData();
+
+        const entry = this._data.get(key);
+        if (!entry) return null;
+
+        if (entry.expireAt && entry.expireAt < Date.now()) {
+            this._data.delete(key);
+            return null;
+        }
+
+        return entry.value as T;
+    }
+
+    async set<T>(key: string, value: T, ttl?: number): Promise<void> {
+        this._data.set(key, {
+            value,
+            expireAt: ttl ? Date.now() + ttl : undefined
+        });
+    }
+
+    async delete(key: string): Promise<boolean> {
+        return this._data.delete(key);
+    }
+
+    // =========================================================================
+    // 辅助方法 | Helper methods
+    // =========================================================================
+
+    /**
+     * @zh 清空所有数据（测试用）
+     * @en Clear all data (for testing)
+     */
+    clear(): void {
+        this._transactions.clear();
+        this._data.clear();
+        this._locks.clear();
+    }
+
+    /**
+     * @zh 获取事务数量
+     * @en Get transaction count
+     */
+    get transactionCount(): number {
+        return this._transactions.size;
+    }
+
+    private _cleanExpiredLocks(): void {
+        const now = Date.now();
+        for (const [key, lock] of this._locks) {
+            if (lock.expireAt < now) {
+                this._locks.delete(key);
+            }
+        }
+    }
+
+    private _cleanExpiredData(): void {
+        const now = Date.now();
+        for (const [key, entry] of this._data) {
+            if (entry.expireAt && entry.expireAt < now) {
+                this._data.delete(key);
+            }
+        }
+    }
+
+    private _cleanOldTransactions(): void {
+        const sorted = Array.from(this._transactions.entries())
+            .sort((a, b) => a[1].createdAt - b[1].createdAt);
+
+        const toRemove = sorted
+            .slice(0, Math.floor(this._maxTransactions * 0.2))
+            .filter(([_, tx]) => tx.state === 'committed' || tx.state === 'rolledback');
+
+        for (const [id] of toRemove) {
+            this._transactions.delete(id);
+        }
+    }
+}
+
+/**
+ * @zh 创建内存存储
+ * @en Create memory storage
+ */
+export function createMemoryStorage(config: MemoryStorageConfig = {}): MemoryStorage {
+    return new MemoryStorage(config);
+}

packages/framework/transaction/src/storage/MongoStorage.ts

@@ -0,0 +1,411 @@
+/**
+ * @zh MongoDB 存储实现
+ * @en MongoDB storage implementation
+ *
+ * @zh 支持持久化事务日志和查询
+ * @en Supports persistent transaction logs and queries
+ */
+
+import type {
+    ITransactionStorage,
+    TransactionLog,
+    TransactionState,
+    OperationLog
+} from '../core/types.js';
+
+/**
+ * @zh MongoDB Collection 接口
+ * @en MongoDB Collection interface
+ */
+export interface MongoCollection<T> {
+    findOne(filter: object): Promise<T | null>
+    find(filter: object): {
+        toArray(): Promise<T[]>
+    }
+    insertOne(doc: T): Promise<{ insertedId: unknown }>
+    updateOne(filter: object, update: object): Promise<{ modifiedCount: number }>
+    deleteOne(filter: object): Promise<{ deletedCount: number }>
+    createIndex(spec: object, options?: object): Promise<string>
+}
+
+/**
+ * @zh MongoDB 数据库接口
+ * @en MongoDB database interface
+ */
+export interface MongoDb {
+    collection<T = unknown>(name: string): MongoCollection<T>
+}
+
+/**
+ * @zh MongoDB 客户端接口
+ * @en MongoDB client interface
+ */
+export interface MongoClient {
+    db(name?: string): MongoDb
+    close(): Promise<void>
+}
+
+/**
+ * @zh MongoDB 连接工厂
+ * @en MongoDB connection factory
+ */
+export type MongoClientFactory = () => MongoClient | Promise<MongoClient>
+
+/**
+ * @zh MongoDB 存储配置
+ * @en MongoDB storage configuration
+ */
+export interface MongoStorageConfig {
+    /**
+     * @zh MongoDB 客户端工厂（惰性连接）
+     * @en MongoDB client factory (lazy connection)
+     *
+     * @example
+     * ```typescript
+     * import { MongoClient } from 'mongodb'
+     * const storage = new MongoStorage({
+     *     factory: async () => {
+     *         const client = new MongoClient('mongodb://localhost:27017')
+     *         await client.connect()
+     *         return client
+     *     },
+     *     database: 'game'
+     * })
+     * ```
+     */
+    factory: MongoClientFactory
+
+    /**
+     * @zh 数据库名称
+     * @en Database name
+     */
+    database: string
+
+    /**
+     * @zh 事务日志集合名称
+     * @en Transaction log collection name
+     */
+    transactionCollection?: string
+
+    /**
+     * @zh 数据集合名称
+     * @en Data collection name
+     */
+    dataCollection?: string
+
+    /**
+     * @zh 锁集合名称
+     * @en Lock collection name
+     */
+    lockCollection?: string
+}
+
+interface LockDocument {
+    _id: string
+    token: string
+    expireAt: Date
+}
+
+interface DataDocument {
+    _id: string
+    value: unknown
+    expireAt?: Date
+}
+
+/**
+ * @zh MongoDB 存储
+ * @en MongoDB storage
+ *
+ * @zh 基于 MongoDB 的事务存储，支持持久化、复杂查询和惰性连接
+ * @en MongoDB-based transaction storage with persistence, complex queries and lazy connection
+ *
+ * @example
+ * ```typescript
+ * import { MongoClient } from 'mongodb'
+ *
+ * // 创建存储（惰性连接，首次操作时才连接）
+ * const storage = new MongoStorage({
+ *     factory: async () => {
+ *         const client = new MongoClient('mongodb://localhost:27017')
+ *         await client.connect()
+ *         return client
+ *     },
+ *     database: 'game'
+ * })
+ *
+ * await storage.ensureIndexes()
+ *
+ * // 使用后手动关闭
+ * await storage.close()
+ *
+ * // 或使用 await using 自动关闭 (TypeScript 5.2+)
+ * await using storage = new MongoStorage({ ... })
+ * // 作用域结束时自动关闭
+ * ```
+ */
+export class MongoStorage implements ITransactionStorage {
+    private _client: MongoClient | null = null;
+    private _db: MongoDb | null = null;
+    private _factory: MongoClientFactory;
+    private _database: string;
+    private _transactionCollection: string;
+    private _dataCollection: string;
+    private _lockCollection: string;
+    private _closed: boolean = false;
+
+    constructor(config: MongoStorageConfig) {
+        this._factory = config.factory;
+        this._database = config.database;
+        this._transactionCollection = config.transactionCollection ?? 'transactions';
+        this._dataCollection = config.dataCollection ?? 'transaction_data';
+        this._lockCollection = config.lockCollection ?? 'transaction_locks';
+    }
+
+    // =========================================================================
+    // 生命周期 | Lifecycle
+    // =========================================================================
+
+    /**
+     * @zh 获取数据库实例（惰性连接）
+     * @en Get database instance (lazy connection)
+     */
+    private async _getDb(): Promise<MongoDb> {
+        if (this._closed) {
+            throw new Error('MongoStorage is closed');
+        }
+
+        if (!this._db) {
+            this._client = await this._factory();
+            this._db = this._client.db(this._database);
+        }
+
+        return this._db;
+    }
+
+    /**
+     * @zh 关闭存储连接
+     * @en Close storage connection
+     */
+    async close(): Promise<void> {
+        if (this._closed) return;
+
+        this._closed = true;
+
+        if (this._client) {
+            await this._client.close();
+            this._client = null;
+            this._db = null;
+        }
+    }
+
+    /**
+     * @zh 支持 await using 语法
+     * @en Support await using syntax
+     */
+    async [Symbol.asyncDispose](): Promise<void> {
+        await this.close();
+    }
+
+    /**
+     * @zh 确保索引存在
+     * @en Ensure indexes exist
+     */
+    async ensureIndexes(): Promise<void> {
+        const db = await this._getDb();
+        const txColl = db.collection<TransactionLog>(this._transactionCollection);
+        await txColl.createIndex({ state: 1 });
+        await txColl.createIndex({ 'metadata.serverId': 1 });
+        await txColl.createIndex({ createdAt: 1 });
+
+        const lockColl = db.collection<LockDocument>(this._lockCollection);
+        await lockColl.createIndex({ expireAt: 1 }, { expireAfterSeconds: 0 });
+
+        const dataColl = db.collection<DataDocument>(this._dataCollection);
+        await dataColl.createIndex({ expireAt: 1 }, { expireAfterSeconds: 0 });
+    }
+
+    // =========================================================================
+    // 分布式锁 | Distributed Lock
+    // =========================================================================
+
+    async acquireLock(key: string, ttl: number): Promise<string | null> {
+        const db = await this._getDb();
+        const coll = db.collection<LockDocument>(this._lockCollection);
+        const token = `${Date.now()}_${Math.random().toString(36).substring(2)}`;
+        const expireAt = new Date(Date.now() + ttl);
+
+        try {
+            await coll.insertOne({
+                _id: key,
+                token,
+                expireAt
+            });
+            return token;
+        } catch (error) {
+            const existing = await coll.findOne({ _id: key });
+            if (existing && existing.expireAt < new Date()) {
+                const result = await coll.updateOne(
+                    { _id: key, expireAt: { $lt: new Date() } },
+                    { $set: { token, expireAt } }
+                );
+                if (result.modifiedCount > 0) {
+                    return token;
+                }
+            }
+            return null;
+        }
+    }
+
+    async releaseLock(key: string, token: string): Promise<boolean> {
+        const db = await this._getDb();
+        const coll = db.collection<LockDocument>(this._lockCollection);
+        const result = await coll.deleteOne({ _id: key, token });
+        return result.deletedCount > 0;
+    }
+
+    // =========================================================================
+    // 事务日志 | Transaction Log
+    // =========================================================================
+
+    async saveTransaction(tx: TransactionLog): Promise<void> {
+        const db = await this._getDb();
+        const coll = db.collection<TransactionLog & { _id: string }>(this._transactionCollection);
+
+        const existing = await coll.findOne({ _id: tx.id });
+        if (existing) {
+            await coll.updateOne(
+                { _id: tx.id },
+                { $set: { ...tx, _id: tx.id } }
+            );
+        } else {
+            await coll.insertOne({ ...tx, _id: tx.id });
+        }
+    }
+
+    async getTransaction(id: string): Promise<TransactionLog | null> {
+        const db = await this._getDb();
+        const coll = db.collection<TransactionLog & { _id: string }>(this._transactionCollection);
+        const doc = await coll.findOne({ _id: id });
+
+        if (!doc) return null;
+
+        const { _id, ...tx } = doc;
+        return tx as TransactionLog;
+    }
+
+    async updateTransactionState(id: string, state: TransactionState): Promise<void> {
+        const db = await this._getDb();
+        const coll = db.collection(this._transactionCollection);
+        await coll.updateOne(
+            { _id: id },
+            { $set: { state, updatedAt: Date.now() } }
+        );
+    }
+
+    async updateOperationState(
+        transactionId: string,
+        operationIndex: number,
+        state: OperationLog['state'],
+        error?: string
+    ): Promise<void> {
+        const db = await this._getDb();
+        const coll = db.collection(this._transactionCollection);
+
+        const update: Record<string, unknown> = {
+            [`operations.${operationIndex}.state`]: state,
+            updatedAt: Date.now()
+        };
+
+        if (error) {
+            update[`operations.${operationIndex}.error`] = error;
+        }
+
+        if (state === 'executed') {
+            update[`operations.${operationIndex}.executedAt`] = Date.now();
+        } else if (state === 'compensated') {
+            update[`operations.${operationIndex}.compensatedAt`] = Date.now();
+        }
+
+        await coll.updateOne(
+            { _id: transactionId },
+            { $set: update }
+        );
+    }
+
+    async getPendingTransactions(serverId?: string): Promise<TransactionLog[]> {
+        const db = await this._getDb();
+        const coll = db.collection<TransactionLog & { _id: string }>(this._transactionCollection);
+
+        const filter: Record<string, unknown> = {
+            state: { $in: ['pending', 'executing'] }
+        };
+
+        if (serverId) {
+            filter['metadata.serverId'] = serverId;
+        }
+
+        const docs = await coll.find(filter).toArray();
+        return docs.map(({ _id, ...tx }) => tx as TransactionLog);
+    }
+
+    async deleteTransaction(id: string): Promise<void> {
+        const db = await this._getDb();
+        const coll = db.collection(this._transactionCollection);
+        await coll.deleteOne({ _id: id });
+    }
+
+    // =========================================================================
+    // 数据操作 | Data Operations
+    // =========================================================================
+
+    async get<T>(key: string): Promise<T | null> {
+        const db = await this._getDb();
+        const coll = db.collection<DataDocument>(this._dataCollection);
+        const doc = await coll.findOne({ _id: key });
+
+        if (!doc) return null;
+
+        if (doc.expireAt && doc.expireAt < new Date()) {
+            await coll.deleteOne({ _id: key });
+            return null;
+        }
+
+        return doc.value as T;
+    }
+
+    async set<T>(key: string, value: T, ttl?: number): Promise<void> {
+        const db = await this._getDb();
+        const coll = db.collection<DataDocument>(this._dataCollection);
+
+        const doc: DataDocument = {
+            _id: key,
+            value
+        };
+
+        if (ttl) {
+            doc.expireAt = new Date(Date.now() + ttl);
+        }
+
+        const existing = await coll.findOne({ _id: key });
+        if (existing) {
+            await coll.updateOne({ _id: key }, { $set: doc });
+        } else {
+            await coll.insertOne(doc);
+        }
+    }
+
+    async delete(key: string): Promise<boolean> {
+        const db = await this._getDb();
+        const coll = db.collection(this._dataCollection);
+        const result = await coll.deleteOne({ _id: key });
+        return result.deletedCount > 0;
+    }
+}
+
+/**
+ * @zh 创建 MongoDB 存储
+ * @en Create MongoDB storage
+ */
+export function createMongoStorage(config: MongoStorageConfig): MongoStorage {
+    return new MongoStorage(config);
+}

packages/framework/transaction/src/storage/RedisStorage.ts

@@ -0,0 +1,324 @@
+/**
+ * @zh Redis 存储实现
+ * @en Redis storage implementation
+ *
+ * @zh 支持分布式锁和快速缓存
+ * @en Supports distributed locking and fast caching
+ */
+
+import type {
+    ITransactionStorage,
+    TransactionLog,
+    TransactionState,
+    OperationLog
+} from '../core/types.js';
+
+/**
+ * @zh Redis 客户端接口（兼容 ioredis）
+ * @en Redis client interface (compatible with ioredis)
+ */
+export interface RedisClient {
+    get(key: string): Promise<string | null>
+    set(key: string, value: string, ...args: string[]): Promise<string | null>
+    del(...keys: string[]): Promise<number>
+    eval(script: string, numkeys: number, ...args: (string | number)[]): Promise<unknown>
+    hget(key: string, field: string): Promise<string | null>
+    hset(key: string, ...args: (string | number)[]): Promise<number>
+    hdel(key: string, ...fields: string[]): Promise<number>
+    hgetall(key: string): Promise<Record<string, string>>
+    keys(pattern: string): Promise<string[]>
+    expire(key: string, seconds: number): Promise<number>
+    quit(): Promise<string>
+}
+
+/**
+ * @zh Redis 连接工厂
+ * @en Redis connection factory
+ */
+export type RedisClientFactory = () => RedisClient | Promise<RedisClient>
+
+/**
+ * @zh Redis 存储配置
+ * @en Redis storage configuration
+ */
+export interface RedisStorageConfig {
+    /**
+     * @zh Redis 客户端工厂（惰性连接）
+     * @en Redis client factory (lazy connection)
+     *
+     * @example
+     * ```typescript
+     * import Redis from 'ioredis'
+     * const storage = new RedisStorage({
+     *     factory: () => new Redis('redis://localhost:6379')
+     * })
+     * ```
+     */
+    factory: RedisClientFactory
+
+    /**
+     * @zh 键前缀
+     * @en Key prefix
+     */
+    prefix?: string
+
+    /**
+     * @zh 事务日志过期时间（秒）
+     * @en Transaction log expiration time in seconds
+     */
+    transactionTTL?: number
+}
+
+const LOCK_SCRIPT = `
+if redis.call("get", KEYS[1]) == ARGV[1] then
+    return redis.call("del", KEYS[1])
+else
+    return 0
+end
+`;
+
+/**
+ * @zh Redis 存储
+ * @en Redis storage
+ *
+ * @zh 基于 Redis 的分布式事务存储，支持分布式锁和惰性连接
+ * @en Redis-based distributed transaction storage with distributed locking and lazy connection
+ *
+ * @example
+ * ```typescript
+ * import Redis from 'ioredis'
+ *
+ * // 创建存储（惰性连接，首次操作时才连接）
+ * const storage = new RedisStorage({
+ *     factory: () => new Redis('redis://localhost:6379')
+ * })
+ *
+ * // 使用后手动关闭
+ * await storage.close()
+ *
+ * // 或使用 await using 自动关闭 (TypeScript 5.2+)
+ * await using storage = new RedisStorage({
+ *     factory: () => new Redis('redis://localhost:6379')
+ * })
+ * // 作用域结束时自动关闭
+ * ```
+ */
+export class RedisStorage implements ITransactionStorage {
+    private _client: RedisClient | null = null;
+    private _factory: RedisClientFactory;
+    private _prefix: string;
+    private _transactionTTL: number;
+    private _closed: boolean = false;
+
+    constructor(config: RedisStorageConfig) {
+        this._factory = config.factory;
+        this._prefix = config.prefix ?? 'tx:';
+        this._transactionTTL = config.transactionTTL ?? 86400; // 24 hours
+    }
+
+    // =========================================================================
+    // 生命周期 | Lifecycle
+    // =========================================================================
+
+    /**
+     * @zh 获取 Redis 客户端（惰性连接）
+     * @en Get Redis client (lazy connection)
+     */
+    private async _getClient(): Promise<RedisClient> {
+        if (this._closed) {
+            throw new Error('RedisStorage is closed');
+        }
+
+        if (!this._client) {
+            this._client = await this._factory();
+        }
+
+        return this._client;
+    }
+
+    /**
+     * @zh 关闭存储连接
+     * @en Close storage connection
+     */
+    async close(): Promise<void> {
+        if (this._closed) return;
+
+        this._closed = true;
+
+        if (this._client) {
+            await this._client.quit();
+            this._client = null;
+        }
+    }
+
+    /**
+     * @zh 支持 await using 语法
+     * @en Support await using syntax
+     */
+    async [Symbol.asyncDispose](): Promise<void> {
+        await this.close();
+    }
+
+    // =========================================================================
+    // 分布式锁 | Distributed Lock
+    // =========================================================================
+
+    async acquireLock(key: string, ttl: number): Promise<string | null> {
+        const client = await this._getClient();
+        const lockKey = `${this._prefix}lock:${key}`;
+        const token = `${Date.now()}_${Math.random().toString(36).substring(2)}`;
+        const ttlSeconds = Math.ceil(ttl / 1000);
+
+        const result = await client.set(lockKey, token, 'NX', 'EX', String(ttlSeconds));
+
+        return result === 'OK' ? token : null;
+    }
+
+    async releaseLock(key: string, token: string): Promise<boolean> {
+        const client = await this._getClient();
+        const lockKey = `${this._prefix}lock:${key}`;
+
+        const result = await client.eval(LOCK_SCRIPT, 1, lockKey, token);
+        return result === 1;
+    }
+
+    // =========================================================================
+    // 事务日志 | Transaction Log
+    // =========================================================================
+
+    async saveTransaction(tx: TransactionLog): Promise<void> {
+        const client = await this._getClient();
+        const key = `${this._prefix}tx:${tx.id}`;
+
+        await client.set(key, JSON.stringify(tx));
+        await client.expire(key, this._transactionTTL);
+
+        if (tx.metadata?.serverId) {
+            const serverKey = `${this._prefix}server:${tx.metadata.serverId}:txs`;
+            await client.hset(serverKey, tx.id, String(tx.createdAt));
+        }
+    }
+
+    async getTransaction(id: string): Promise<TransactionLog | null> {
+        const client = await this._getClient();
+        const key = `${this._prefix}tx:${id}`;
+        const data = await client.get(key);
+
+        return data ? JSON.parse(data) : null;
+    }
+
+    async updateTransactionState(id: string, state: TransactionState): Promise<void> {
+        const tx = await this.getTransaction(id);
+        if (tx) {
+            tx.state = state;
+            tx.updatedAt = Date.now();
+            await this.saveTransaction(tx);
+        }
+    }
+
+    async updateOperationState(
+        transactionId: string,
+        operationIndex: number,
+        state: OperationLog['state'],
+        error?: string
+    ): Promise<void> {
+        const tx = await this.getTransaction(transactionId);
+        if (tx && tx.operations[operationIndex]) {
+            tx.operations[operationIndex].state = state;
+            if (error) {
+                tx.operations[operationIndex].error = error;
+            }
+            if (state === 'executed') {
+                tx.operations[operationIndex].executedAt = Date.now();
+            } else if (state === 'compensated') {
+                tx.operations[operationIndex].compensatedAt = Date.now();
+            }
+            tx.updatedAt = Date.now();
+            await this.saveTransaction(tx);
+        }
+    }
+
+    async getPendingTransactions(serverId?: string): Promise<TransactionLog[]> {
+        const client = await this._getClient();
+        const result: TransactionLog[] = [];
+
+        if (serverId) {
+            const serverKey = `${this._prefix}server:${serverId}:txs`;
+            const txIds = await client.hgetall(serverKey);
+
+            for (const id of Object.keys(txIds)) {
+                const tx = await this.getTransaction(id);
+                if (tx && (tx.state === 'pending' || tx.state === 'executing')) {
+                    result.push(tx);
+                }
+            }
+        } else {
+            const pattern = `${this._prefix}tx:*`;
+            const keys = await client.keys(pattern);
+
+            for (const key of keys) {
+                const data = await client.get(key);
+                if (data) {
+                    const tx: TransactionLog = JSON.parse(data);
+                    if (tx.state === 'pending' || tx.state === 'executing') {
+                        result.push(tx);
+                    }
+                }
+            }
+        }
+
+        return result;
+    }
+
+    async deleteTransaction(id: string): Promise<void> {
+        const client = await this._getClient();
+        const key = `${this._prefix}tx:${id}`;
+        const tx = await this.getTransaction(id);
+
+        await client.del(key);
+
+        if (tx?.metadata?.serverId) {
+            const serverKey = `${this._prefix}server:${tx.metadata.serverId}:txs`;
+            await client.hdel(serverKey, id);
+        }
+    }
+
+    // =========================================================================
+    // 数据操作 | Data Operations
+    // =========================================================================
+
+    async get<T>(key: string): Promise<T | null> {
+        const client = await this._getClient();
+        const fullKey = `${this._prefix}data:${key}`;
+        const data = await client.get(fullKey);
+
+        return data ? JSON.parse(data) : null;
+    }
+
+    async set<T>(key: string, value: T, ttl?: number): Promise<void> {
+        const client = await this._getClient();
+        const fullKey = `${this._prefix}data:${key}`;
+
+        if (ttl) {
+            const ttlSeconds = Math.ceil(ttl / 1000);
+            await client.set(fullKey, JSON.stringify(value), 'EX', String(ttlSeconds));
+        } else {
+            await client.set(fullKey, JSON.stringify(value));
+        }
+    }
+
+    async delete(key: string): Promise<boolean> {
+        const client = await this._getClient();
+        const fullKey = `${this._prefix}data:${key}`;
+        const result = await client.del(fullKey);
+        return result > 0;
+    }
+}
+
+/**
+ * @zh 创建 Redis 存储
+ * @en Create Redis storage
+ */
+export function createRedisStorage(config: RedisStorageConfig): RedisStorage {
+    return new RedisStorage(config);
+}

packages/framework/transaction/src/storage/index.ts

@@ -0,0 +1,8 @@
+/**
+ * @zh 存储模块导出
+ * @en Storage module exports
+ */
+
+export { MemoryStorage, createMemoryStorage, type MemoryStorageConfig } from './MemoryStorage.js';
+export { RedisStorage, createRedisStorage, type RedisStorageConfig, type RedisClient } from './RedisStorage.js';
+export { MongoStorage, createMongoStorage, type MongoStorageConfig, type MongoDb, type MongoCollection } from './MongoStorage.js';

packages/framework/transaction/src/tokens.ts

@@ -0,0 +1,20 @@
+/**
+ * @zh Transaction 模块服务令牌
+ * @en Transaction module service tokens
+ */
+
+import { createServiceToken } from '@esengine/ecs-framework';
+import type { TransactionManager } from './core/TransactionManager.js';
+import type { ITransactionStorage } from './core/types.js';
+
+/**
+ * @zh 事务管理器令牌
+ * @en Transaction manager token
+ */
+export const TransactionManagerToken = createServiceToken<TransactionManager>('transactionManager');
+
+/**
+ * @zh 事务存储令牌
+ * @en Transaction storage token
+ */
+export const TransactionStorageToken = createServiceToken<ITransactionStorage>('transactionStorage');