@c9up/aurora 0.1.22 → 0.1.24

package/dist/Pages.js

@@ -28,7 +28,11 @@ export class Pages {
     extension;
     registry = new Map();
     constructor(config) {
-        this.root = config.root;
+        // Normalize the root ONCE so the `startsWith(root + sep)` containment
+        // check below compares like-for-like against the resolved page path.
+        // A raw root with a trailing slash, a relative segment, or `..` would
+        // otherwise never match the resolved absolute path → spurious 403s.
+        this.root = resolvePath(config.root);
         this.urlPrefix = (config.urlPrefix ?? "/__assets/pages").replace(/\/$/, "");
         this.extension = config.extension ?? ".js";
     }

package/dist/browser.js

@@ -6,7 +6,7 @@
  * without `typeof window` guards at every call site. Node-free — part of the
  * client barrel.
  */
-import { effect, signal } from "./reactive.js";
+import { effect, onCleanup, signal } from "./reactive.js";
 /** Navigate to `url` with a full page load. No-op during SSR. */
 export function redirect(url) {
     if (typeof window !== "undefined") {
@@ -185,7 +185,7 @@ export function persistedSignal(key, initial, options = {}) {
         (options.area ?? "local") === "local" &&
         typeof window !== "undefined") {
         const fullKey = store.fullKey(key);
-        window.addEventListener("storage", (event) => {
+        const onStorage = (event) => {
             if (event.key !== fullKey || event.newValue === null)
                 return;
             try {
@@ -194,7 +194,14 @@ export function persistedSignal(key, initial, options = {}) {
             catch {
                 // Ignore a malformed cross-tab write.
             }
-        });
+        };
+        window.addEventListener("storage", onStorage);
+        // Tie the listener to the owning reactive scope so a persistedSignal
+        // created in a component's setup removes it on dispose (matching the
+        // mirror effect above — the JSDoc promises disposal-with-the-component).
+        // At module scope onCleanup is a no-op, so the listener lives for the
+        // page lifetime, as intended for a shared module-level signal.
+        onCleanup(() => window.removeEventListener("storage", onStorage));
     }
     return sig;
 }

package/dist/live.d.ts

@@ -1,60 +1,20 @@
 /**
- * Live components — server-resident reactive UI. The state lives on the server
- * as ordinary aurora signals; this module turns a fine-grained signal change
- * into a PRECISE per-slot patch (`{slot, value}`) instead of re-rendering the
- * whole component. That precision — each signal already knows which template
- * slot it feeds — is the angle that beats HTML-diffing live-view libraries.
+ * `@c9up/aurora/live` barrel — the whole Live surface behind ONE subpath.
  *
- * This is the transport-agnostic CORE (Stage 1): mount a session, render its
- * initial HTML, dispatch events that mutate signals, and drain / subscribe to
- * the patches produced. Wiring patches over `@c9up/relay` (SSE down, POST up)
- * and the thin client applier live in later stages.
+ * The transport-agnostic core (`mountLiveSession` + its types) lives in
+ * `./liveSession.js`; the transport stack (broadcast / client / registry /
+ * router / server) builds on it. Re-exporting everything here keeps the niche
+ * surface behind a single subpath and keeps the main `.` barrel lean (it no
+ * longer eager-pulls these into every browser graph), consistent with how
+ * `./ssr`, `./relay`, `./rpc` and `./hydrate` are already subpath-gated.
  *
- * Node-free / isomorphic: uses only `signal`/`effect`/`renderToString`, so it
- * sits in the main barrel alongside the rest of aurora's runtime.
+ * The core lives in a SEPARATE module (not inline here) so the transport files
+ * import it directly from `./liveSession.js` rather than through this barrel —
+ * which would otherwise form an import cycle (barrel → transport → barrel).
  */
-import type { TemplateResult } from "./types.js";
-/** A precise per-slot update: slot index (positional in the template) + value. */
-export interface SlotPatch {
-    slot: number;
-    value: string;
-}
-/** A live component: its reactive view + named event handlers that mutate it. */
-export interface LiveComponentDefinition {
-    /** The reactive view. Slots reading signals become live-patchable. */
-    view: TemplateResult;
-    /**
-     * Event handlers, by name. A client interaction (`@click="increment"`)
-     * dispatches one of these; it mutates the component's signals, which the
-     * patch tracker turns into a `{slot, value}` patch.
-     */
-    handlers?: Record<string, (payload?: unknown) => void>;
-}
-/** A mounted live component instance — one per connected client session. */
-export interface LiveSession {
-    /** Initial server-side render (the first full-HTML response). */
-    renderToString(): string;
-    /** Run a named handler (mutates signals); emits a patch for the batch. */
-    dispatch(event: string, payload?: unknown): void;
-    /** Collect + clear the patches accumulated since the last drain (pull model). */
-    drainPatches(): SlotPatch[];
-    /**
-     * Subscribe to patches as they are produced (push model — what the relay
-     * transport hooks into). Use `onPatch` OR `drainPatches`, not both.
-     */
-    onPatch(listener: (patch: SlotPatch[]) => void): () => void;
-    /** Stop every effect — call on client disconnect to free the session. */
-    dispose(): void;
-}
-/**
- * Mount a live session from a definition factory. Call once per connected
- * client: the factory's signals become that session's private state. To SHARE
- * state across sessions, close the factory over a signal created OUTSIDE it —
- * every session then reads the same signal and patches on its change.
- */
-export declare function mountLiveSession(factory: () => LiveComponentDefinition): LiveSession;
 export { connectPatches, type LiveStore, liveStore, type RelayBroadcaster, } from "./liveBroadcast.js";
 export { buildLiveTransport, type LiveClientOptions, type LiveClientTransport, type LiveHttpPoster, liveClient, type RelaySubscribeClient, } from "./liveClient.js";
 export { createLiveRegistry, type LiveRegistry, type LiveSessionHandle, } from "./liveRegistry.js";
 export { createLiveRouter, type LiveMount, type LiveRouter, } from "./liveRouter.js";
 export { DEFAULT_LIVE_EVENT_PATH, type LiveHttpContext, type LiveHttpRouter, type WireLiveEventsOptions, wireLiveEvents, } from "./liveServer.js";
+export { type LiveComponentDefinition, type LiveSession, mountLiveSession, type SlotPatch, } from "./liveSession.js";

package/dist/live.js

@@ -1,108 +1,20 @@
 /**
- * Live components — server-resident reactive UI. The state lives on the server
- * as ordinary aurora signals; this module turns a fine-grained signal change
- * into a PRECISE per-slot patch (`{slot, value}`) instead of re-rendering the
- * whole component. That precision — each signal already knows which template
- * slot it feeds — is the angle that beats HTML-diffing live-view libraries.
+ * `@c9up/aurora/live` barrel — the whole Live surface behind ONE subpath.
  *
- * This is the transport-agnostic CORE (Stage 1): mount a session, render its
- * initial HTML, dispatch events that mutate signals, and drain / subscribe to
- * the patches produced. Wiring patches over `@c9up/relay` (SSE down, POST up)
- * and the thin client applier live in later stages.
+ * The transport-agnostic core (`mountLiveSession` + its types) lives in
+ * `./liveSession.js`; the transport stack (broadcast / client / registry /
+ * router / server) builds on it. Re-exporting everything here keeps the niche
+ * surface behind a single subpath and keeps the main `.` barrel lean (it no
+ * longer eager-pulls these into every browser graph), consistent with how
+ * `./ssr`, `./relay`, `./rpc` and `./hydrate` are already subpath-gated.
  *
- * Node-free / isomorphic: uses only `signal`/`effect`/`renderToString`, so it
- * sits in the main barrel alongside the rest of aurora's runtime.
+ * The core lives in a SEPARATE module (not inline here) so the transport files
+ * import it directly from `./liveSession.js` rather than through this barrel —
+ * which would otherwise form an import cycle (barrel → transport → barrel).
  */
-import { effect, isSignal } from "./reactive.js";
-import { renderToString } from "./ssr.js";
-/**
- * Mount a live session from a definition factory. Call once per connected
- * client: the factory's signals become that session's private state. To SHARE
- * state across sessions, close the factory over a signal created OUTSIDE it —
- * every session then reads the same signal and patches on its change.
- */
-export function mountLiveSession(factory) {
-    const { view, handlers = {} } = factory();
-    const listeners = new Set();
-    // slot → latest value. `pending` = current (un-flushed) batch; `buffer` =
-    // accumulated for pull consumers. Both keyed by slot so repeated writes in
-    // one batch collapse to the last value.
-    const pending = new Map();
-    const buffer = new Map();
-    let priming = true;
-    let flushScheduled = false;
-    const flush = () => {
-        flushScheduled = false;
-        if (pending.size === 0)
-            return;
-        const patch = [];
-        for (const [slot, value] of pending) {
-            patch.push({ slot, value });
-            buffer.set(slot, value);
-        }
-        pending.clear();
-        for (const listener of listeners)
-            listener(patch);
-    };
-    const scheduleFlush = () => {
-        if (flushScheduled)
-            return;
-        flushScheduled = true;
-        queueMicrotask(flush);
-    };
-    // One fine-grained effect per reactive slot. The priming run only
-    // subscribes; later runs (a signal changed) record the slot's new value.
-    const stops = view.values.map((value, slot) => {
-        if (!isSignal(value) && typeof value !== "function")
-            return () => { };
-        return effect(() => {
-            const next = String(value());
-            if (priming)
-                return;
-            pending.set(slot, next);
-            scheduleFlush();
-        });
-    });
-    priming = false;
-    return {
-        renderToString: () => renderToString(view),
-        dispatch(event, payload) {
-            const handler = handlers[event];
-            if (!handler)
-                return;
-            handler(payload);
-            flush(); // synchronous — one patch per dispatch (batches the handler's writes)
-        },
-        drainPatches() {
-            flush();
-            const patch = [];
-            for (const [slot, value] of buffer)
-                patch.push({ slot, value });
-            buffer.clear();
-            return patch;
-        },
-        onPatch(listener) {
-            listeners.add(listener);
-            return () => listeners.delete(listener);
-        },
-        dispose() {
-            for (const stop of stops)
-                stop();
-            listeners.clear();
-            pending.clear();
-            buffer.clear();
-        },
-    };
-}
-// ─── `@c9up/aurora/live` barrel ──────────────────────────────────────
-//
-// The Live stack (broadcast / client / registry / router / server) is
-// re-exported here so the whole niche surface lives behind ONE subpath,
-// `@c9up/aurora/live` — keeping the main `.` barrel lean (it no longer
-// eager-pulls these into every browser graph), consistent with how `./ssr`,
-// `./relay`, `./rpc` and `./hydrate` are already subpath-gated.
 export { connectPatches, liveStore, } from "./liveBroadcast.js";
 export { buildLiveTransport, liveClient, } from "./liveClient.js";
 export { createLiveRegistry, } from "./liveRegistry.js";
 export { createLiveRouter, } from "./liveRouter.js";
 export { DEFAULT_LIVE_EVENT_PATH, wireLiveEvents, } from "./liveServer.js";
+export { mountLiveSession, } from "./liveSession.js";

package/dist/liveBroadcast.d.ts

@@ -14,7 +14,7 @@
  * one mutation → one patch computed once → relay fans it out to all subscribers
  * (O(1) compute, O(N) network).
  */
-import { type LiveComponentDefinition, type LiveSession } from "./live.js";
+import { type LiveComponentDefinition, type LiveSession } from "./liveSession.js";
 /**
  * Minimal relay surface aurora needs. The real `@c9up/relay` `Relay` satisfies
  * it (`broadcast(channel, data) → recipient count`); aurora never imports it.

package/dist/liveBroadcast.js

@@ -14,7 +14,7 @@
  * one mutation → one patch computed once → relay fans it out to all subscribers
  * (O(1) compute, O(N) network).
  */
-import { mountLiveSession, } from "./live.js";
+import { mountLiveSession, } from "./liveSession.js";
 /**
  * Pipe a session's patches onto a relay channel as they are produced. Returns
  * an unsubscribe. Each patch becomes one `broadcast(channel, patch)`.

package/dist/liveClient.d.ts

@@ -14,7 +14,7 @@
  * `subscribe` to `@c9up/aurora/relay`'s `relay().subscribe` and `post` to an
  * `HttpClient`. Browser-only (uses the DOM) — part of the client barrel.
  */
-import type { SlotPatch } from "./live.js";
+import type { SlotPatch } from "./liveSession.js";
 import type { TemplateResult } from "./types.js";
 /** The transport the live client needs: a patch subscription + an event POST. */
 export interface LiveClientTransport {

package/dist/liveRegistry.d.ts

@@ -10,7 +10,7 @@
  * `get(id)?.dispatch(...)`; disconnect → `disposeOwner(uid)`. Transport-agnostic
  * and node-free (only `mountLiveSession` + `crypto.randomUUID`, both isomorphic).
  */
-import { type LiveComponentDefinition, type LiveSession } from "./live.js";
+import { type LiveComponentDefinition, type LiveSession } from "./liveSession.js";
 /** A mounted instance: its id, the owner (e.g. relay uid), and the session. */
 export interface LiveSessionHandle {
     id: string;

package/dist/liveRegistry.js

@@ -10,7 +10,7 @@
  * `get(id)?.dispatch(...)`; disconnect → `disposeOwner(uid)`. Transport-agnostic
  * and node-free (only `mountLiveSession` + `crypto.randomUUID`, both isomorphic).
  */
-import { mountLiveSession, } from "./live.js";
+import { mountLiveSession, } from "./liveSession.js";
 /** Create an isolated live-session registry (one per app / per relay instance). */
 export function createLiveRegistry() {
     const defs = new Map();

package/dist/liveSession.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Live components — server-resident reactive UI CORE. The state lives on the
+ * server as ordinary aurora signals; this module turns a fine-grained signal
+ * change into a PRECISE per-slot patch (`{slot, value}`) instead of re-rendering
+ * the whole component. That precision — each signal already knows which template
+ * slot it feeds — is the angle that beats HTML-diffing live-view libraries.
+ *
+ * This is the transport-agnostic core: mount a session, render its initial HTML,
+ * dispatch events that mutate signals, and drain / subscribe to the patches
+ * produced. The transport stack (broadcast / client / registry / router /
+ * server) builds ON this and re-exports through the `./live.js` barrel — kept in
+ * a separate module so those transport files import the core WITHOUT forming an
+ * import cycle back through the barrel.
+ *
+ * Node-free / isomorphic: uses only `signal`/`effect`/`renderToString`.
+ */
+import type { TemplateResult } from "./types.js";
+/** A precise per-slot update: slot index (positional in the template) + value. */
+export interface SlotPatch {
+    slot: number;
+    value: string;
+}
+/** A live component: its reactive view + named event handlers that mutate it. */
+export interface LiveComponentDefinition {
+    /** The reactive view. Slots reading signals become live-patchable. */
+    view: TemplateResult;
+    /**
+     * Event handlers, by name. A client interaction (`@click="increment"`)
+     * dispatches one of these; it mutates the component's signals, which the
+     * patch tracker turns into a `{slot, value}` patch.
+     */
+    handlers?: Record<string, (payload?: unknown) => void>;
+}
+/** A mounted live component instance — one per connected client session. */
+export interface LiveSession {
+    /** Initial server-side render (the first full-HTML response). */
+    renderToString(): string;
+    /** Run a named handler (mutates signals); emits a patch for the batch. */
+    dispatch(event: string, payload?: unknown): void;
+    /** Collect + clear the patches accumulated since the last drain (pull model). */
+    drainPatches(): SlotPatch[];
+    /**
+     * Subscribe to patches as they are produced (push model — what the relay
+     * transport hooks into). Use `onPatch` OR `drainPatches`, not both.
+     */
+    onPatch(listener: (patch: SlotPatch[]) => void): () => void;
+    /** Stop every effect — call on client disconnect to free the session. */
+    dispose(): void;
+}
+/**
+ * Mount a live session from a definition factory. Call once per connected
+ * client: the factory's signals become that session's private state. To SHARE
+ * state across sessions, close the factory over a signal created OUTSIDE it —
+ * every session then reads the same signal and patches on its change.
+ */
+export declare function mountLiveSession(factory: () => LiveComponentDefinition): LiveSession;

package/dist/liveSession.js

@@ -0,0 +1,97 @@
+/**
+ * Live components — server-resident reactive UI CORE. The state lives on the
+ * server as ordinary aurora signals; this module turns a fine-grained signal
+ * change into a PRECISE per-slot patch (`{slot, value}`) instead of re-rendering
+ * the whole component. That precision — each signal already knows which template
+ * slot it feeds — is the angle that beats HTML-diffing live-view libraries.
+ *
+ * This is the transport-agnostic core: mount a session, render its initial HTML,
+ * dispatch events that mutate signals, and drain / subscribe to the patches
+ * produced. The transport stack (broadcast / client / registry / router /
+ * server) builds ON this and re-exports through the `./live.js` barrel — kept in
+ * a separate module so those transport files import the core WITHOUT forming an
+ * import cycle back through the barrel.
+ *
+ * Node-free / isomorphic: uses only `signal`/`effect`/`renderToString`.
+ */
+import { effect, isSignal } from "./reactive.js";
+import { renderToString } from "./ssr.js";
+/**
+ * Mount a live session from a definition factory. Call once per connected
+ * client: the factory's signals become that session's private state. To SHARE
+ * state across sessions, close the factory over a signal created OUTSIDE it —
+ * every session then reads the same signal and patches on its change.
+ */
+export function mountLiveSession(factory) {
+    const { view, handlers = {} } = factory();
+    const listeners = new Set();
+    // slot → latest value. `pending` = current (un-flushed) batch; `buffer` =
+    // accumulated for pull consumers. Both keyed by slot so repeated writes in
+    // one batch collapse to the last value.
+    const pending = new Map();
+    const buffer = new Map();
+    let priming = true;
+    let flushScheduled = false;
+    const flush = () => {
+        flushScheduled = false;
+        if (pending.size === 0)
+            return;
+        const patch = [];
+        for (const [slot, value] of pending) {
+            patch.push({ slot, value });
+            buffer.set(slot, value);
+        }
+        pending.clear();
+        for (const listener of listeners)
+            listener(patch);
+    };
+    const scheduleFlush = () => {
+        if (flushScheduled)
+            return;
+        flushScheduled = true;
+        queueMicrotask(flush);
+    };
+    // One fine-grained effect per reactive slot. The priming run only
+    // subscribes; later runs (a signal changed) record the slot's new value.
+    const stops = view.values.map((value, slot) => {
+        if (!isSignal(value) && typeof value !== "function")
+            return () => { };
+        return effect(() => {
+            const next = String(value());
+            if (priming)
+                return;
+            pending.set(slot, next);
+            scheduleFlush();
+        });
+    });
+    priming = false;
+    return {
+        renderToString: () => renderToString(view),
+        dispatch(event, payload) {
+            const handler = handlers[event];
+            if (!handler)
+                return;
+            handler(payload);
+            flush(); // synchronous — one patch per dispatch (batches the handler's writes)
+        },
+        drainPatches() {
+            flush();
+            const patch = [];
+            for (const [slot, value] of buffer)
+                patch.push({ slot, value });
+            buffer.clear();
+            return patch;
+        },
+        onPatch(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+        dispose() {
+            for (const stop of stops)
+                stop();
+            listeners.clear();
+            pending.clear();
+            buffer.clear();
+        },
+    };
+}

package/dist/middleware.d.ts

@@ -20,7 +20,7 @@ export interface AuroraRequestRenderer {
 /** Request context the middleware needs: render target + optional resolver/slot. */
 interface AuroraMiddlewareContext extends RenderHttpContext {
     containerResolver?: {
-        make(token: unknown): unknown;
+        make(token: unknown): Promise<unknown>;
     };
     aurora?: AuroraRequestRenderer;
 }

package/dist/middleware.js

@@ -19,9 +19,9 @@ function isManager(value) {
         "render" in value &&
         typeof value.render === "function");
 }
-function resolveManager(resolver) {
+async function resolveManager(resolver) {
     try {
-        const resolved = resolver?.make("aurora");
+        const resolved = await resolver?.make("aurora");
         return isManager(resolved) ? resolved : undefined;
     }
     catch {
@@ -32,8 +32,8 @@ function resolveManager(resolver) {
  * Middleware: attach `ctx.aurora` for the request. No-op (passes through) when
  * the AuroraManager isn't registered, so it's safe to mount unconditionally.
  */
-export function auroraContext(ctx, next) {
-    const manager = resolveManager(ctx.containerResolver);
+export async function auroraContext(ctx, next) {
+    const manager = await resolveManager(ctx.containerResolver);
     if (manager) {
         ctx.aurora = {
             render: (name, props, options) => manager.render(ctx, name, props, options),

package/dist/relay.d.ts

@@ -17,8 +17,19 @@
  * `@c9up/aurora`. Node-side code that pulls it will trip on
  * `EventSource` being undefined.
  */
+/**
+ * Connection lifecycle status. Mirrors `@adonisjs/transmit-client`'s
+ * `TransmitStatus` (minus `initializing`, which the singleton never
+ * exposes — the first `relay()` call opens straight into `connecting`).
+ */
+export type RelayStatus = "connecting" | "connected" | "disconnected" | "reconnecting";
 export interface RelayClient {
     subscribe<E>(channel: string, handler: (event: E) => void): () => void;
+    /**
+     * Register a connection-status listener. Returns a detacher. Mirrors
+     * `transmit.on('connected' | 'disconnected' | ...)`.
+     */
+    on(status: RelayStatus, callback: (status: RelayStatus) => void): () => void;
     close(): void;
 }
 export interface RelayOptions {
@@ -26,13 +37,25 @@ export interface RelayOptions {
     sseUrl?: string;
     /** Subscribe POST endpoint. Defaults to `/__relay/subscribe`. */
     subscribeUrl?: string;
+    /** Unsubscribe POST endpoint. Defaults to `/__relay/unsubscribe`. */
+    unsubscribeUrl?: string;
     /** Optional bearer token (for guarded relay routes). */
     bearer?: string;
+    /**
+     * Give up after this many consecutive reconnect attempts. Default 5
+     * (Transmit parity). `0` disables the cap — the browser's native
+     * EventSource keeps retrying forever.
+     */
+    maxReconnectAttempts?: number;
+    /** Fired before each reconnect attempt with the 1-based attempt count. */
+    onReconnectAttempt?: (attempt: number) => void;
+    /** Fired once when `maxReconnectAttempts` is exhausted and we give up. */
+    onReconnectFailed?: () => void;
 }
 /**
- * Configure the relay endpoints + bearer. Call once at boot if you
- * need to override the defaults. Multiple calls overwrite — last call
- * wins.
+ * Configure the relay endpoints + bearer + reconnect policy. Call once
+ * at boot if you need to override the defaults. Multiple calls overwrite
+ * — last call wins.
  */
 export declare function configureRelay(options: RelayOptions): void;
 /**