@c9up/aurora 0.1.32 → 0.1.34

package/dist/liveClient.js

@@ -76,7 +76,14 @@ export function buildLiveTransport(relayClient, http, options = {}) {
     return {
         subscribe: (channel, handler) => relayClient.subscribe(channel, handler),
         post: (id, event, payload) => {
-            void http.post(path, { id, event, payload });
+            // A post that fails means the server never saw this interaction, so
+            // the component's server-side state and what the user is looking at
+            // have diverged — silence is the worst possible answer. Unhandled,
+            // it was also a bare `Uncaught (in promise)` with no clue which
+            // event was lost.
+            void (async () => http.post(path, { id, event, payload }))().catch((err) => {
+                console.warn(`[aurora/live] '${event}' on ${id} did not reach the server; this component is now out of sync:`, err);
+            });
         },
     };
 }

package/dist/server/renderPage.js

@@ -30,19 +30,23 @@ const renderScope = new AsyncLocalStorage();
 setCookieStoreReader(() => renderScope.getStore()?.cookies);
 setRouteManifestReader(() => renderScope.getStore()?.routes);
 function isCookieReadable(request) {
-    return (typeof request === "object" &&
-        request !== null &&
-        "cookie" in request &&
-        typeof request.cookie === "function");
+    if (typeof request !== "object" || request === null)
+        return false;
+    return (typeof Reflect.get(request, "plainCookie") === "function" ||
+        typeof Reflect.get(request, "cookie") === "function");
 }
 /** Read the allowlisted cookies off the request into a `name → value` seed. */
 function readRequestCookies(request, names) {
     if (!isCookieReadable(request))
         return {};
     const seed = {};
+    // Unsigned first; `cookie()` only when the host offers nothing else.
+    const read = request.plainCookie
+        ? (name) => request.plainCookie?.(name, undefined, { encoded: false })
+        : (name) => request.cookie?.(name);
     for (const name of names) {
-        const value = request.cookie(name);
-        if (value !== null)
+        const value = read(name);
+        if (value !== null && value !== undefined)
             seed[name] = value;
     }
     return seed;

package/dist/ssr.js

@@ -45,19 +45,34 @@ function stringifyTemplateResult(result) {
     // the matching value, and consume the closing `"` from the next
     // segment. This three-step coordination is why the loop holds a
     // `pendingClosingQuote` flag.
-    let pendingClosingQuote = false;
+    // Which quote closes the directive currently being skipped, so the closing
+    // one consumed is the one that was opened. Undefined when none is pending.
+    let pendingClosingQuote;
     const scanner = new TagScanner();
     for (let i = 0; i < strings.length; i++) {
         let segment = strings[i];
-        if (pendingClosingQuote) {
-            segment = segment.replace(/^"/, "");
-            pendingClosingQuote = false;
+        if (pendingClosingQuote !== undefined) {
+            segment =
+                pendingClosingQuote === '"'
+                    ? segment.replace(/^"/, "")
+                    : segment.replace(/^'/, "");
+            pendingClosingQuote = undefined;
         }
-        const directiveMatch = segment.match(/\s([@?.][\w-]+)="$/);
+        // Both quote styles. Matching only `="` left `@click='${handler}'`
+        // unrecognised, so the handler fell through to `stringifyValue`, which
+        // CALLED it — a client event handler running on the server, its return
+        // value written into the HTML, and any exception swallowed.
+        const directiveMatch = segment.match(/\s([@?.][\w-]+)=("|'|)$/);
         const skipValue = directiveMatch !== null;
         if (directiveMatch) {
             segment = segment.slice(0, segment.length - directiveMatch[0].length);
-            pendingClosingQuote = true;
+            // Only a quoted directive leaves a closing quote to swallow.
+            pendingClosingQuote =
+                directiveMatch[2] === '"'
+                    ? '"'
+                    : directiveMatch[2] === "'"
+                        ? "'"
+                        : undefined;
         }
         out += segment;
         scanner.consume(segment);
@@ -147,10 +162,10 @@ function stringifyValue(value, inAttribute) {
     if (isSignal(value))
         return stringifyValue(value(), inAttribute);
     if (typeof value === "function") {
-        // In attribute position: directive handlers (`@click`, `?disabled`,
-        // `.prop`) have already been stripped by `stripDirectiveBefore`.
-        // A function reaching this point is a reactive-expression text
-        // slot (`${() => ...}`), which we evaluate eagerly server-side.
+        // A function here is a reactive expression — `class="${() => …}"` in an
+        // attribute, `${() => …}` in text — and is evaluated eagerly
+        // server-side. Directive values (`@click`, `?disabled`, `.prop`) never
+        // reach this point: the scanner skips them, whatever quoting they use.
         try {
             return stringifyValue(value(), inAttribute);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@c9up/aurora",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Aurora — reactive UI runtime for the Ream framework. Tagged-template DOM, signal-based state, isomorphic SSR + hydration, zero build step.",
   "license": "MIT",
   "type": "module",
@@ -56,9 +56,9 @@
     "@biomejs/biome": "^2.4.10",
     "@c9up/comet": "^0.1.0",
     "@types/node": "^22.19.15",
-    "@vitest/browser": "4.1.9",
-    "@vitest/browser-playwright": "4.1.9",
-    "happy-dom": "^15.11.7",
+    "@vitest/browser": "4.1.11",
+    "@vitest/browser-playwright": "4.1.11",
+    "happy-dom": "^20.12.0",
     "playwright": "^1.61.1",
     "typescript": "^6.0.2",
     "vitest": "4.1.9"

package/src/liveClient.ts

@@ -118,7 +118,19 @@ export function buildLiveTransport(
 		subscribe: (channel, handler) =>
 			relayClient.subscribe<SlotPatch[]>(channel, handler),
 		post: (id, event, payload) => {
-			void http.post(path, { id, event, payload });
+			// A post that fails means the server never saw this interaction, so
+			// the component's server-side state and what the user is looking at
+			// have diverged — silence is the worst possible answer. Unhandled,
+			// it was also a bare `Uncaught (in promise)` with no clue which
+			// event was lost.
+			void (async () => http.post(path, { id, event, payload }))().catch(
+				(err: unknown) => {
+					console.warn(
+						`[aurora/live] '${event}' on ${id} did not reach the server; this component is now out of sync:`,
+						err,
+					);
+				},
+			);
 		},
 	};
 }

package/src/server/renderPage.ts

@@ -142,8 +142,24 @@ export type SharedPropsResolver = (
 ) => SharedProps | Promise<SharedProps>;
 
 /** A request that can read a cookie by name — the structural slice we need. */
+/**
+ * The slice of a host request this needs: reading a cookie the browser wrote.
+ *
+ * `plainCookie` is the one to use. These cookies are written client-side
+ * through `document.cookie`, so they carry no signature; a host whose
+ * `cookie()` verifies one (as Ream's does) returns nothing for them, and the
+ * seed silently empties — which is the flash this exists to prevent.
+ *
+ * `cookie` is accepted as a fallback so a host that only offers that spelling
+ * still seeds, rather than rendering default state and saying nothing.
+ */
 interface CookieReadableRequest {
-	cookie(name: string): string | null;
+	plainCookie?<T = string>(
+		name: string,
+		defaultValue?: T,
+		options?: { encoded?: boolean },
+	): T | null;
+	cookie?(name: string): string | null;
 }
 
 interface RenderScope {
@@ -157,11 +173,10 @@ setCookieStoreReader(() => renderScope.getStore()?.cookies);
 setRouteManifestReader(() => renderScope.getStore()?.routes);
 
 function isCookieReadable(request: unknown): request is CookieReadableRequest {
+	if (typeof request !== "object" || request === null) return false;
 	return (
-		typeof request === "object" &&
-		request !== null &&
-		"cookie" in request &&
-		typeof request.cookie === "function"
+		typeof Reflect.get(request, "plainCookie") === "function" ||
+		typeof Reflect.get(request, "cookie") === "function"
 	);
 }
 
@@ -172,9 +187,14 @@ function readRequestCookies(
 ): Record<string, string> {
 	if (!isCookieReadable(request)) return {};
 	const seed: Record<string, string> = {};
+	// Unsigned first; `cookie()` only when the host offers nothing else.
+	const read = request.plainCookie
+		? (name: string) =>
+				request.plainCookie?.<string>(name, undefined, { encoded: false })
+		: (name: string) => request.cookie?.(name);
 	for (const name of names) {
-		const value = request.cookie(name);
-		if (value !== null) seed[name] = value;
+		const value = read(name);
+		if (value !== null && value !== undefined) seed[name] = value;
 	}
 	return seed;
 }

package/src/ssr.ts

@@ -49,19 +49,34 @@ function stringifyTemplateResult(result: TemplateResult): string {
 	// the matching value, and consume the closing `"` from the next
 	// segment. This three-step coordination is why the loop holds a
 	// `pendingClosingQuote` flag.
-	let pendingClosingQuote = false;
+	// Which quote closes the directive currently being skipped, so the closing
+	// one consumed is the one that was opened. Undefined when none is pending.
+	let pendingClosingQuote: '"' | "'" | undefined;
 	const scanner = new TagScanner();
 	for (let i = 0; i < strings.length; i++) {
 		let segment = strings[i];
-		if (pendingClosingQuote) {
-			segment = segment.replace(/^"/, "");
-			pendingClosingQuote = false;
+		if (pendingClosingQuote !== undefined) {
+			segment =
+				pendingClosingQuote === '"'
+					? segment.replace(/^"/, "")
+					: segment.replace(/^'/, "");
+			pendingClosingQuote = undefined;
 		}
-		const directiveMatch = segment.match(/\s([@?.][\w-]+)="$/);
+		// Both quote styles. Matching only `="` left `@click='${handler}'`
+		// unrecognised, so the handler fell through to `stringifyValue`, which
+		// CALLED it — a client event handler running on the server, its return
+		// value written into the HTML, and any exception swallowed.
+		const directiveMatch = segment.match(/\s([@?.][\w-]+)=("|'|)$/);
 		const skipValue = directiveMatch !== null;
 		if (directiveMatch) {
 			segment = segment.slice(0, segment.length - directiveMatch[0].length);
-			pendingClosingQuote = true;
+			// Only a quoted directive leaves a closing quote to swallow.
+			pendingClosingQuote =
+				directiveMatch[2] === '"'
+					? '"'
+					: directiveMatch[2] === "'"
+						? "'"
+						: undefined;
 		}
 		out += segment;
 		scanner.consume(segment);
@@ -148,10 +163,10 @@ function stringifyValue(value: unknown, inAttribute: boolean): string {
 	if (value === true) return inAttribute ? "" : "true";
 	if (isSignal(value)) return stringifyValue(value(), inAttribute);
 	if (typeof value === "function") {
-		// In attribute position: directive handlers (`@click`, `?disabled`,
-		// `.prop`) have already been stripped by `stripDirectiveBefore`.
-		// A function reaching this point is a reactive-expression text
-		// slot (`${() => ...}`), which we evaluate eagerly server-side.
+		// A function here is a reactive expression — `class="${() => …}"` in an
+		// attribute, `${() => …}` in text — and is evaluated eagerly
+		// server-side. Directive values (`@click`, `?disabled`, `.prop`) never
+		// reach this point: the scanner skips them, whatever quoting they use.
 		try {
 			return stringifyValue((value as () => unknown)(), inAttribute);
 		} catch {