@c9up/aurora 0.1.25 → 0.1.27

package/README.md

@@ -22,6 +22,56 @@ providers: [
 ]
 ```
 
+```ts
+// config/aurora.ts
+export default {
+  pages: {
+    root: new URL('../resources/pages', import.meta.url).pathname,
+  },
+  root: {
+    tag: 'main',
+    class: 'min-h-screen',
+  },
+  shared: async (ctx) => ({
+    auth: { user: ctx.auth?.user ?? null },
+    flash: ctx.session?.flashMessages?.all?.() ?? {},
+    errors: ctx.session?.flashMessages?.get?.('errors') ?? {},
+  }),
+}
+```
+
+Controllers stay thin, like Adonis/Inertia controllers:
+
+```ts
+export default class DashboardController {
+  async show({ aurora }) {
+    return aurora.render('dashboard/show', {
+      stats: await loadStats(),
+    })
+  }
+}
+```
+
+## Dev live-reload (HMR)
+
+Pages are dynamic-imported per request; aurora dev-busts the page module by mtime, but a page's **transitive** imports (components/layouts/services) stay cached until you restart. Enable graph-aware SSR HMR — the AdonisJS way — with [`hot-hook`](https://github.com/Julien-R44/hot-hook):
+
+```bash
+pnpm add -D hot-hook @hot-hook/runner
+```
+
+```jsonc
+// package.json
+{
+  "scripts": {
+    "dev": "hot-runner --node-args=--import=tsx --node-args=--import=hot-hook/register bin/server.ts"
+  },
+  "hotHook": { "boundaries": ["./resources/pages/*.js"] }
+}
+```
+
+Editing a page or any component it imports now hot-reloads the SSR with no restart. **Point `boundaries` at page entries only** (`./resources/pages/*.js`, not `**/*.js`) — hot-hook requires boundary files to be dynamically imported, so a statically-imported component matched by the glob forces a full reload. aurora itself needs no change.
+
 ## Entry points
 
 - `@c9up/aurora` — main API: reactive primitives (`signal`/`effect`/`html`/`component`/`hydrate`) plus the client toolkit — `WebStorage`/`persistedSignal`, reactive browser signals (`prefersDark`/`online`/`windowSize`/…), SPA navigation (`navigate`/`queryParam`), `cookie`/`clipboard`/`share`, the `HttpClient` fetch wrapper, `createRpcClient()` (JSON-RPC 2.0), `command()` (async action + reactive loading/data/error), `form()` (reactive form controller; optional rune validation + rosetta i18n), `urlFor()` (isomorphic named-route URLs, paired with Ream's `router.namedManifest()`), and `cn()` (zero-dependency Tailwind v4 class merge — `clsx` + `tailwind-merge` reimplemented)
@@ -30,6 +80,48 @@ providers: [
 - `@c9up/aurora/relay` — realtime adapter
 - `@c9up/aurora/ssr` — server-side rendering
 - `@c9up/aurora/hydrate` — client hydration
+- `@c9up/aurora/server` — server-only helpers and types (`AuroraManager`,
+  `Pages`, `renderPage`, `serveAssets`, `SharedProps`, `SharedPropsResolver`)
+
+## Adonis / Inertia parity
+
+Implemented in Aurora:
+
+- provider + IoC service;
+- `ctx.aurora.render(name, props, options)`;
+- named page rendering from routes/controllers;
+- shared props per request via `shared`;
+- root tag/class customization;
+- named-route manifest for `urlFor()`;
+- asset/version marker in page data;
+- SSR + hydration payload.
+
+Still intentionally tracked as remaining work:
+
+- `@adonisjs/vite`-equivalent frontend integration: asset bundling, dev manifest and browser-asset HMR (SSR page-module HMR is available today via hot-hook — see [Dev live-reload](#dev-live-reload-hmr));
+- full Inertia navigation semantics: preserve state, history encryption, version
+  mismatch handling and client-side visit lifecycle;
+- generated page-name types.
+
+## Security notes
+
+- `renderPage()` isolates SSR cookies and route manifests per request. Pages can
+  read `cookieState()` and `urlFor()` across async boundaries without leaking
+  another concurrent request's state.
+- `renderPage()` and `AuroraManager.render()` support Adonis/Inertia-style
+  shared props via `shared`, plus root element customization via `rootTag`,
+  `rootClass` or `config.aurora.root`.
+- `HttpClient` does not send managed bearer/default `Authorization` headers to
+  cross-origin absolute URLs by default. Set `allowCrossOriginAuth: true` only
+  when the external origin is intentional and trusted, or pass an explicit
+  per-request `Authorization` header.
+- `wireLiveEvents()` accepts an `authorize(ctx, body)` hook. Use it to bind live
+  event POSTs to the same auth/CSRF/owner policy as the page that mounted the
+  live session.
+- `redirect()`, `replace()` and `navigate()` reject `javascript:`, `vbscript:`
+  and `data:` URLs.
+- `auroraRoute()` is the legacy low-level route helper. Prefer the provider /
+  `ctx.aurora.render()` pipeline for Adonis-style applications.
 
 ## License
 

package/dist/AuroraManager.d.ts

@@ -12,10 +12,25 @@
  * the app can also instantiate one manually for tests.
  */
 import { Pages, type PagesConfig } from "./Pages.js";
-import { type RenderHttpContext, type RenderPageOptions } from "./server/renderPage.js";
+import { type RenderHttpContext, type RenderPageOptions, type SharedProps, type SharedPropsResolver } from "./server/renderPage.js";
 import { type AssetsHttpContext } from "./server/serveAssets.js";
 export interface AuroraManagerConfig {
     pages: PagesConfig;
+    /**
+     * Shared props injected into every `render()` call, matching Adonis/Inertia's
+     * request-level shared data model. Per-call `options.shared` is merged over it.
+     */
+    shared?: SharedProps | SharedPropsResolver;
+    /**
+     * Default root tag/class for rendered pages. Mirrors Inertia's root template
+     * customization while keeping controllers thin.
+     */
+    root?: {
+        tag?: string;
+        class?: string;
+    };
+    /** Default asset/version marker serialized into the page payload. */
+    assetsVersion?: string;
     /**
      * Filesystem path to aurora's pre-built `dist/`. Defaults to the
      * dist directory shipped with the installed `@c9up/aurora` package.
@@ -67,6 +82,12 @@ export declare class AuroraManager {
     readonly cometDistRoot: string | null;
     /** App-level importmap overrides from `config/aurora.ts`, merged on render. */
     readonly importmap: Record<string, string>;
+    /** App-level shared props from config/aurora.ts. */
+    readonly shared?: SharedProps | SharedPropsResolver;
+    /** App-level root element defaults from config/aurora.ts. */
+    readonly root?: AuroraManagerConfig["root"];
+    /** App-level asset/version marker. */
+    readonly assetsVersion?: string;
     constructor(config: AuroraManagerConfig);
     /**
      * SSR + hydrate + ship the document. The importmap layers, last wins:

package/dist/AuroraManager.js

@@ -50,6 +50,12 @@ export class AuroraManager {
     cometDistRoot;
     /** App-level importmap overrides from `config/aurora.ts`, merged on render. */
     importmap;
+    /** App-level shared props from config/aurora.ts. */
+    shared;
+    /** App-level root element defaults from config/aurora.ts. */
+    root;
+    /** App-level asset/version marker. */
+    assetsVersion;
     constructor(config) {
         this.assetsPrefix = normalizePrefix(config.assetsPrefix ?? "/__assets");
         this.auroraAssetPath = `${this.assetsPrefix}/aurora`;
@@ -57,6 +63,9 @@ export class AuroraManager {
         this.cometAssetPath = `${this.assetsPrefix}/comet`;
         this.cometDistRoot = config.cometDistRoot ?? resolveCometDist();
         this.importmap = config.importmap ?? {};
+        this.shared = config.shared;
+        this.root = config.root;
+        this.assetsVersion = config.assetsVersion;
         // Pages serve their compiled JS from the same prefix unless the app
         // pins an explicit urlPrefix.
         this.pages = new Pages({
@@ -75,6 +84,10 @@ export class AuroraManager {
     render(ctx, name, props, options) {
         return renderPage(ctx, this.pages, name, props, {
             ...options,
+            rootTag: options?.rootTag ?? this.root?.tag,
+            rootClass: options?.rootClass ?? this.root?.class,
+            assetsVersion: options?.assetsVersion ?? this.assetsVersion,
+            shared: mergeSharedResolvers(this.shared, options?.shared),
             importmap: {
                 "@c9up/aurora": `${this.auroraAssetPath}/index.js`,
                 // The browser-facing subpath (RPC client) needs an explicit entry —
@@ -120,3 +133,16 @@ export class AuroraManager {
             : null;
     }
 }
+function mergeSharedResolvers(base, override) {
+    if (!base)
+        return override;
+    if (!override)
+        return base;
+    return async (ctx) => ({
+        ...(await resolveShared(ctx, base)),
+        ...(await resolveShared(ctx, override)),
+    });
+}
+async function resolveShared(ctx, shared) {
+    return typeof shared === "function" ? shared(ctx) : shared;
+}

package/dist/browser.d.ts

@@ -153,6 +153,12 @@ export interface CookieOptions {
     /** Restrict to HTTPS. */
     secure?: boolean;
 }
+type CookieStoreReader = () => Record<string, string> | undefined;
+/**
+ * @internal Server-side hook used by `renderPage()` to provide a request-scoped
+ * cookie store without importing Node built-ins from this browser-safe module.
+ */
+export declare function setCookieStoreReader(reader: CookieStoreReader | undefined): void;
 /**
  * Install the SSR cookie seed (`name → value`). Called by `renderPage` from its
  * `cookies` allowlist; the hydrate bootstrap does NOT call it (the browser reads
@@ -228,3 +234,4 @@ export interface ShareData {
  * user cancels — never throws.
  */
 export declare function share(data: ShareData): Promise<boolean>;
+export {};

package/dist/browser.js

@@ -10,7 +10,7 @@ import { effect, onCleanup, signal } from "./reactive.js";
 /** Navigate to `url` with a full page load. No-op during SSR. */
 export function redirect(url) {
     if (typeof window !== "undefined") {
-        window.location.href = url;
+        window.location.href = safeNavigationUrl(url);
     }
 }
 /**
@@ -19,7 +19,7 @@ export function redirect(url) {
  */
 export function replace(url) {
     if (typeof window !== "undefined") {
-        window.location.replace(url);
+        window.location.replace(safeNavigationUrl(url));
     }
 }
 /** Reload the current page. No-op during SSR. */
@@ -278,6 +278,22 @@ export function forward() {
     if (typeof window !== "undefined")
         window.history.forward();
 }
+/**
+ * Drop every C0 control character (U+0000–U+001F).
+ *
+ * Written as a scan rather than a regex: a character class over control
+ * characters is exactly what `noControlCharactersInRegex` flags, and the rule
+ * is right in general — here the stripping is the point, so the loop states it
+ * without needing a suppression.
+ */
+function stripControlChars(value) {
+    let out = "";
+    for (const char of value) {
+        if (char.charCodeAt(0) > 0x1f)
+            out += char;
+    }
+    return out;
+}
 /**
  * SPA navigation: push `url` onto history WITHOUT a full page reload (contrast
  * {@link redirect}, which reloads). Emits a `popstate` event so reactive URL
@@ -287,9 +303,23 @@ export function forward() {
 export function navigate(url) {
     if (typeof window === "undefined")
         return;
-    window.history.pushState({}, "", url);
+    window.history.pushState({}, "", safeNavigationUrl(url));
     window.dispatchEvent(new Event("popstate"));
 }
+function safeNavigationUrl(url) {
+    // Browsers strip ASCII tab/newline/CR from ANYWHERE in a URL and trim leading
+    // control chars + whitespace before resolving the scheme, so `java\tscript:`
+    // (or a leading NUL) is evaluated as `javascript:`. A guard that only
+    // `trimStart()`s is trivially bypassed — mirror the browser and strip every
+    // C0 control char before comparing the scheme.
+    const normalized = stripControlChars(url).trimStart().toLowerCase();
+    if (normalized.startsWith("javascript:") ||
+        normalized.startsWith("vbscript:") ||
+        normalized.startsWith("data:")) {
+        throw new Error(`[aurora] blocked unsafe navigation URL: ${url}`);
+    }
+    return url;
+}
 /**
  * A {@link Signal} bound to a single URL query parameter. Reading reflects the
  * current value (`null` when absent); writing updates the URL via `pushState`
@@ -331,13 +361,20 @@ export function queryParam(key) {
  * no view of the request cookies and renders default UI state → a flash /
  * mismatch on hydration (the classic collapsed-sidebar flicker).
  *
- * Module-global by necessity (the page factory reads it ambiently). It is set
- * synchronously immediately before the synchronous render, so read your cookie
- * signals at the TOP of a page (before any `await`) to avoid a cross-request
- * race under concurrent async page factories. In the browser it is unused —
+ * Fallback module-global for manual/server tests. `renderPage()` installs a
+ * request-scoped reader backed by AsyncLocalStorage, so concurrent SSR renders
+ * do not share this mutable object. In the browser it is unused —
  * {@link cookie.get} reads `document.cookie` directly there.
  */
 let cookieSeed = {};
+let cookieStoreReader;
+/**
+ * @internal Server-side hook used by `renderPage()` to provide a request-scoped
+ * cookie store without importing Node built-ins from this browser-safe module.
+ */
+export function setCookieStoreReader(reader) {
+    cookieStoreReader = reader;
+}
 /**
  * Install the SSR cookie seed (`name → value`). Called by `renderPage` from its
  * `cookies` allowlist; the hydrate bootstrap does NOT call it (the browser reads
@@ -358,8 +395,12 @@ export function getCookieStore() {
  */
 export const cookie = {
     get(name) {
-        if (typeof document === "undefined")
+        if (typeof document === "undefined") {
+            const scoped = cookieStoreReader?.();
+            if (scoped && Object.hasOwn(scoped, name))
+                return scoped[name];
             return cookieSeed[name] ?? null;
+        }
         const prefix = `${encodeURIComponent(name)}=`;
         for (const part of document.cookie.split("; ")) {
             if (part.startsWith(prefix)) {

package/dist/form.d.ts

@@ -5,7 +5,7 @@
  * `html\`\`` and never hand-roll field state or try/catch.
  *
  * Validation is OPTIONAL and **agnostic**: pass a `validate` function returning a
- * `{ field: message }` map, OR any object with a `.validate(values)` method
+ * `{ field: message }` map, OR any object with a `.validateResult(values)` method
  * (e.g. a `@c9up/rune` schema) — aurora never imports a validator, it only
  * duck-types `.validate`. With no `validate`, the form simply never reports field
  * errors. Node-free — part of the client barrel.
@@ -31,15 +31,25 @@
 import { type ReadSignal } from "./reactive.js";
 /** A field-keyed error map: `{ email: "Invalid", … }`. Absent key ⇒ no error. */
 export type FieldErrors<T> = Partial<Record<keyof T, string>>;
-/** Anything `.validate()`-shaped (a `@c9up/rune` schema satisfies this). */
+/** The synchronous, never-throwing outcome a form schema hands back. */
+export interface FormValidationOutcome {
+    valid: boolean;
+    errors?: ReadonlyArray<{
+        field?: string;
+        message: string;
+    }>;
+}
+/**
+ * Anything schema-shaped (a `@c9up/rune` schema satisfies this).
+ *
+ * Both spellings are accepted, and `validateResult` wins when present: rune
+ * reserves `validate()` for the VineJS contract (async, throwing), and reading
+ * `.valid` off a Promise yields `undefined` — the form would then report itself
+ * invalid with no error to show.
+ */
 export interface FormSchema<T> {
-    validate(values: T): {
-        valid: boolean;
-        errors?: ReadonlyArray<{
-            field?: string;
-            message: string;
-        }>;
-    };
+    validate?(values: T): FormValidationOutcome;
+    validateResult?(values: T): FormValidationOutcome;
 }
 /** Validation source — a function, a schema-like object, or omitted. */
 export type FormValidate<T> = ((values: T) => FieldErrors<T>) | FormSchema<T>;

package/dist/form.js

@@ -5,7 +5,7 @@
  * `html\`\`` and never hand-roll field state or try/catch.
  *
  * Validation is OPTIONAL and **agnostic**: pass a `validate` function returning a
- * `{ field: message }` map, OR any object with a `.validate(values)` method
+ * `{ field: message }` map, OR any object with a `.validateResult(values)` method
  * (e.g. a `@c9up/rune` schema) — aurora never imports a validator, it only
  * duck-types `.validate`. With no `validate`, the form simply never reports field
  * errors. Node-free — part of the client barrel.
@@ -36,7 +36,10 @@ function computeErrors(validate, values) {
         return {};
     if (typeof validate === "function")
         return validate(values);
-    const result = validate.validate(values);
+    const check = validate.validateResult ?? validate.validate;
+    if (typeof check !== "function")
+        return {};
+    const result = check.call(validate, values);
     if (result.valid)
         return {};
     const errors = {};

package/dist/http.d.ts

@@ -28,6 +28,13 @@ export interface HttpClientOptions {
     token?: string | null | (() => string | null | undefined);
     /** Default `credentials` mode (e.g. `"include"` to send cookies). */
     credentials?: RequestCredentials;
+    /**
+     * Allow default bearer/default Authorization headers to be sent to absolute
+     * cross-origin URLs. Default `false`: same-origin API clients should not leak
+     * credentials if an untrusted value becomes the request URL. Per-request
+     * `headers.Authorization` is still treated as explicit caller intent.
+     */
+    allowCrossOriginAuth?: boolean;
     /**
      * Default timeout in ms — the request is aborted (rejecting with a
      * `TimeoutError`) if it doesn't settle in time. Combined with a per-request
@@ -48,6 +55,11 @@ export interface HttpRequestOptions<T = unknown> {
     timeout?: number;
     /** `credentials` mode for this request. */
     credentials?: RequestCredentials;
+    /**
+     * Per-request override for sending managed auth headers to cross-origin
+     * absolute URLs. Default inherits the client option (`false` by default).
+     */
+    allowCrossOriginAuth?: boolean;
     /**
      * Runtime validator/mapper for the parsed body. When provided, the return
      * type is whatever it returns — no unchecked cast. When omitted, the parsed

package/dist/http.js

@@ -71,6 +71,39 @@ function hasHeader(headers, name) {
     }
     return false;
 }
+/** Delete every case variant of a header from a plain header record. */
+function deleteHeader(headers, name) {
+    const lower = name.toLowerCase();
+    for (const key of Object.keys(headers)) {
+        if (key.toLowerCase() === lower)
+            delete headers[key];
+    }
+}
+function originOf(value) {
+    try {
+        if (/^[a-z][a-z\d+\-.]*:\/\//i.test(value))
+            return new URL(value).origin;
+        if (typeof window !== "undefined")
+            return new URL(value, window.location.href).origin;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+function isCrossOriginAbsoluteUrl(url, baseURL) {
+    if (!/^[a-z][a-z\d+\-.]*:\/\//i.test(url))
+        return false;
+    const targetOrigin = originOf(url);
+    if (targetOrigin === null)
+        return true;
+    const baseOrigin = baseURL ? originOf(baseURL) : null;
+    if (baseOrigin !== null)
+        return targetOrigin !== baseOrigin;
+    if (typeof window !== "undefined")
+        return targetOrigin !== window.location.origin;
+    return true;
+}
 /** Merge abort signals into one (whichever fires first wins). `undefined` if none. */
 function combineSignals(signals) {
     const present = signals.filter((s) => s !== undefined);
@@ -109,12 +142,14 @@ export class HttpClient {
     #token;
     #credentials;
     #timeout;
+    #allowCrossOriginAuth;
     constructor(options = {}) {
         this.#baseURL = options.baseURL ?? "";
         this.#headers = { ...options.headers };
         this.#token = options.token;
         this.#credentials = options.credentials;
         this.#timeout = options.timeout;
+        this.#allowCrossOriginAuth = options.allowCrossOriginAuth ?? false;
     }
     /** Set a default header for every subsequent request (case-insensitive replace). Chainable. */
     setHeader(name, value) {
@@ -196,6 +231,7 @@ export class HttpClient {
             token: options.token ?? this.#token,
             credentials: options.credentials ?? this.#credentials,
             timeout: options.timeout ?? this.#timeout,
+            allowCrossOriginAuth: options.allowCrossOriginAuth ?? this.#allowCrossOriginAuth,
         });
     }
     #resolveToken(override) {
@@ -220,12 +256,25 @@ export class HttpClient {
         return `${base}${base.includes("?") ? "&" : "?"}${qs}`;
     }
     #send(method, url, body, options) {
+        const finalUrl = this.#buildUrl(url, options.query);
+        const crossOrigin = isCrossOriginAbsoluteUrl(finalUrl, this.#baseURL);
+        const allowCrossOriginAuth = options.allowCrossOriginAuth ?? this.#allowCrossOriginAuth;
+        const explicitRequestAuth = options.headers !== undefined &&
+            hasHeader(options.headers, "authorization");
         const headers = {
             ...this.#headers,
             ...options.headers,
         };
+        if (crossOrigin &&
+            !allowCrossOriginAuth &&
+            !explicitRequestAuth &&
+            hasHeader(this.#headers, "authorization")) {
+            deleteHeader(headers, "authorization");
+        }
         const token = this.#resolveToken(options.token);
-        if (token != null && !hasHeader(headers, "authorization")) {
+        if (token != null &&
+            !hasHeader(headers, "authorization") &&
+            (!crossOrigin || allowCrossOriginAuth)) {
             headers.Authorization = `Bearer ${token}`;
         }
         let payload;
@@ -246,7 +295,7 @@ export class HttpClient {
             options.signal,
             timeout !== undefined ? AbortSignal.timeout(timeout) : undefined,
         ]);
-        return fetch(this.#buildUrl(url, options.query), {
+        return fetch(finalUrl, {
             method,
             headers,
             body: payload,

package/dist/hydrate.js

@@ -257,6 +257,11 @@ function hydrateTemplateResult(result, liveNodes, cleanups, mountHooks, markerCu
     const syntheticRoot = {
         childNodes: liveNodes,
     };
+    // An attribute interpolating several slots — `class="static ${a} ${b}"` — is
+    // ONE attribute value built from all of them plus the static segments in
+    // between. Binding each slot on its own would have the last writer win and
+    // wipe the statics, which is what render.ts already avoids server-side.
+    const multiGroups = new Map();
     for (let i = 0; i < tpl.slots.length; i++) {
         const slot = tpl.slots[i];
         const liveNode = resolvePathLive(syntheticRoot, slot.path, liveNodes);
@@ -270,8 +275,47 @@ function hydrateTemplateResult(result, liveNodes, cleanups, mountHooks, markerCu
             }
             continue;
         }
+        if (slot.kind === "attr" && slot.staticParts !== undefined) {
+            collectMultiAttr(slot, liveNode, result.values[i], multiGroups);
+            continue;
+        }
         hydrateSlot(slot, liveNode, result.values[i], cleanups, mountHooks, markerCursor);
     }
+    for (const group of multiGroups.values()) {
+        applyMultiAttrGroup(group, cleanups);
+    }
+}
+function collectMultiAttr(slot, el, value, groups) {
+    if (!slot.staticParts)
+        return;
+    const key = `${slot.name}::${slot.path.join(".")}`;
+    let group = groups.get(key);
+    if (!group) {
+        group = { el, name: slot.name, staticParts: slot.staticParts, values: [] };
+        groups.set(key, group);
+    }
+    group.values.push(value);
+}
+function applyMultiAttrGroup(group, cleanups) {
+    function join() {
+        let out = group.staticParts[0] ?? "";
+        for (let i = 0; i < group.values.length; i++) {
+            const v = group.values[i];
+            const resolved = isSignal(v) || typeof v === "function" ? v() : v;
+            out += resolved == null || resolved === false ? "" : String(resolved);
+            out += group.staticParts[i + 1] ?? "";
+        }
+        return out;
+    }
+    const hasReactive = group.values.some((v) => isSignal(v) || typeof v === "function");
+    if (hasReactive) {
+        // SSR already wrote the joined value; re-joining on every tick is what
+        // keeps the statics in place when only one part changes.
+        cleanups.push(effect(() => {
+            group.el.setAttribute(group.name, join());
+        }));
+    }
+    // Fully static groups need nothing: SSR wrote the final value.
 }
 /**
  * Resolve a slot's path against the LIVE DOM. The first index of the

package/dist/index.d.ts

@@ -15,7 +15,7 @@ export { connectPatches, type LiveStore, liveStore, type RelayBroadcaster, } fro
 export { buildLiveTransport, type LiveClientOptions, type LiveClientTransport, type LiveHttpPoster, liveClient, type RelaySubscribeClient, } from "./liveClient.js";
 export { createLiveRegistry, type LiveRegistry, type LiveSessionHandle, } from "./liveRegistry.js";
 export { createLiveRouter, type LiveMount, type LiveRouter, } from "./liveRouter.js";
-export { DEFAULT_LIVE_EVENT_PATH, type LiveHttpContext, type LiveHttpRouter, type WireLiveEventsOptions, wireLiveEvents, } from "./liveServer.js";
+export { DEFAULT_LIVE_EVENT_PATH, type LiveEventBody, type LiveHttpContext, type LiveHttpRouter, type WireLiveEventsOptions, wireLiveEvents, } from "./liveServer.js";
 export { batch, effect, isSignal, memo, onCleanup, type ReadSignal, type Signal, signal, untrack, } from "./reactive.js";
 export { type Disposer, render } from "./render.js";
 export { type AuroraHttpContext, type AuroraResponse, type AuroraRouteConfig, auroraRoute, } from "./route.js";

package/dist/live.d.ts

@@ -16,5 +16,5 @@ export { connectPatches, type LiveStore, liveStore, type RelayBroadcaster, } fro
 export { buildLiveTransport, type LiveClientOptions, type LiveClientTransport, type LiveHttpPoster, liveClient, type RelaySubscribeClient, } from "./liveClient.js";
 export { createLiveRegistry, type LiveRegistry, type LiveSessionHandle, } from "./liveRegistry.js";
 export { createLiveRouter, type LiveMount, type LiveRouter, } from "./liveRouter.js";
-export { DEFAULT_LIVE_EVENT_PATH, type LiveHttpContext, type LiveHttpRouter, type WireLiveEventsOptions, wireLiveEvents, } from "./liveServer.js";
+export { DEFAULT_LIVE_EVENT_PATH, type LiveEventBody, type LiveHttpContext, type LiveHttpRouter, type WireLiveEventsOptions, wireLiveEvents, } from "./liveServer.js";
 export { type LiveComponentDefinition, type LiveSession, mountLiveSession, type SlotPatch, } from "./liveSession.js";

package/dist/liveServer.d.ts

@@ -27,6 +27,18 @@ export interface LiveHttpContext {
 export interface WireLiveEventsOptions {
     /** Route path for inbound events (must match the client transport). */
     path?: string;
+    /**
+     * Optional per-request guard. Return `false` to reject the event with 403.
+     * Use this to enforce the same auth/CSRF/owner policy as the page that mounted
+     * the live session. When omitted, aurora preserves the framework-agnostic
+     * legacy behavior and expects the host route/middleware to guard the endpoint.
+     */
+    authorize?: (ctx: LiveHttpContext, body: LiveEventBody) => boolean | Promise<boolean>;
+}
+export interface LiveEventBody {
+    id: string;
+    event: string;
+    payload?: unknown;
 }
 /** Default inbound-event route — keep the client transport's `path` in sync. */
 export declare const DEFAULT_LIVE_EVENT_PATH = "/__live/event";

package/dist/liveServer.js

@@ -25,13 +25,27 @@ export const DEFAULT_LIVE_EVENT_PATH = "/__live/event";
  */
 export function wireLiveEvents(router, live, options = {}) {
     const path = options.path ?? DEFAULT_LIVE_EVENT_PATH;
-    router.post(path, (ctx) => {
+    router.post(path, async (ctx) => {
         const body = ctx.request.body();
         if (!isLiveEventBody(body)) {
             ctx.response.status(400);
             ctx.response.json({ error: "live event requires { id, event }" });
             return;
         }
+        let authorized = true;
+        if (options.authorize) {
+            try {
+                authorized = await options.authorize(ctx, body);
+            }
+            catch {
+                authorized = false;
+            }
+        }
+        if (!authorized) {
+            ctx.response.status(403);
+            ctx.response.json({ error: "forbidden live event" });
+            return;
+        }
         const handled = live.event(body.id, body.event, body.payload);
         if (!handled) {
             ctx.response.status(404);

package/dist/relay.js

@@ -263,7 +263,17 @@ function retrieveXsrfToken() {
     if (typeof document === "undefined")
         return null;
     const match = document.cookie.match(/(?:^|;\s*)XSRF-TOKEN=([^;]*)/);
-    return match ? decodeURIComponent(match[1]) : null;
+    if (!match)
+        return null;
+    try {
+        return decodeURIComponent(match[1]);
+    }
+    catch {
+        // A malformed cookie must not break subscribe/unsubscribe handshakes. The
+        // server will reject an invalid token normally; the client should not throw
+        // before it even sends the request.
+        return match[1];
+    }
 }
 function safeJson(raw) {
     if (typeof raw !== "string")