chore(release): publish db 0.8.21, cli 0.8.65 and seven in-flight packages

Carries the rollback refusal in db and the matching CLI message, together
with the auth, captcha, csr, dev-server, dev-toolbar, ui and validation
changes that were already in the working tree, since publishing stages
from it and those files would otherwise ship without being recorded here.

  @wrnexus/auth        0.8.28 -> 0.8.29
  @wrnexus/captcha     0.8.15 -> 0.8.16
  @wrnexus/cli         0.8.64 -> 0.8.65
  @wrnexus/csr         0.8.37 -> 0.8.38
  @wrnexus/db          0.8.20 -> 0.8.21
  @wrnexus/dev-server  0.8.60 -> 0.8.61
  @wrnexus/dev-toolbar 0.8.17 -> 0.8.18
  @wrnexus/ui          0.8.75 -> 0.8.76
  @wrnexus/validation  0.8.12 -> 0.8.13

Also declares Event among the browser globals captcha's client asset
already lists, which was the last lint failure, and reformats four files.
typecheck, lint, 1998 tests and format:check all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/captcha/assets/client/captcha.js

@@ -1,4 +1,4 @@
-/* global Audio, CSS, CustomEvent, Element, HTMLElement, MutationObserver, URL, clearInterval, clearTimeout, document, fetch, window */
+/* global Audio, CSS, CustomEvent, Element, Event, HTMLElement, MutationObserver, URL, clearInterval, clearTimeout, document, fetch, window */
 (function () {
   "use strict";
 
@@ -149,6 +149,11 @@
     if (input) {
       input.name = state.config.responseField;
       input.value = state.responseToken;
+      // Keep the serialized attribute in sync for enhanced forms and DOM
+      // serializers that read attributes rather than the live value property.
+      input.setAttribute("value", state.responseToken);
+      input.dispatchEvent(new Event("input", { bubbles: true }));
+      input.dispatchEvent(new Event("change", { bubbles: true }));
     }
   }
 

packages/captcha/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/captcha",
-  "version": "0.8.14",
+  "version": "0.8.16",
   "description": "First-class CAPTCHA challenges, providers, verification guards, page gates, and WRNexusJS UI.",
   "type": "module",
   "sideEffects": false,

packages/captcha/test/component.test.ts

@@ -4,6 +4,7 @@ import { join } from "node:path";
 import { parse } from "@wrnexus/syntax";
 
 const componentPath = join(import.meta.dir, "../components/Captcha.wrn");
+const clientPath = join(import.meta.dir, "../assets/client/captcha.js");
 
 test("Captcha.wrn parses and exposes the full public contract", async () => {
   const source = await readFile(componentPath, "utf8");
@@ -70,3 +71,10 @@ test("Captcha.wrn parses and exposes the full public contract", async () => {
   expect(source).not.toContain("captcha.js");
   expect(source).not.toContain("lifecycle {");
 });
+
+test("CAPTCHA response tokens remain visible to enhanced form serializers", async () => {
+  const source = await readFile(clientPath, "utf8");
+  expect(source).toContain('input.setAttribute("value", state.responseToken)');
+  expect(source).toContain('new Event("input", { bubbles: true })');
+  expect(source).toContain('new Event("change", { bubbles: true })');
+});