chore(release): publish db 0.8.21, cli 0.8.65 and seven in-flight packages

Carries the rollback refusal in db and the matching CLI message, together
with the auth, captcha, csr, dev-server, dev-toolbar, ui and validation
changes that were already in the working tree, since publishing stages
from it and those files would otherwise ship without being recorded here.

  @wrnexus/auth        0.8.28 -> 0.8.29
  @wrnexus/captcha     0.8.15 -> 0.8.16
  @wrnexus/cli         0.8.64 -> 0.8.65
  @wrnexus/csr         0.8.37 -> 0.8.38
  @wrnexus/db          0.8.20 -> 0.8.21
  @wrnexus/dev-server  0.8.60 -> 0.8.61
  @wrnexus/dev-toolbar 0.8.17 -> 0.8.18
  @wrnexus/ui          0.8.75 -> 0.8.76
  @wrnexus/validation  0.8.12 -> 0.8.13

Also declares Event among the browser globals captcha's client asset
already lists, which was the last lint failure, and reformats four files.
typecheck, lint, 1998 tests and format:check all pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/csr/package.json

@@ -1,12 +1,12 @@
 {
   "name": "@wrnexus/csr",
-  "version": "0.8.35",
+  "version": "0.8.38",
   "type": "module",
   "main": "src/index.ts",
   "exports": {
     ".": "./src/index.ts"
   },
   "dependencies": {
-    "@wrnexus/core": "workspace:*"
+    "@wrnexus/core": "^0.8.12"
   }
 }

packages/csr/src/realtime-runtime.ts

@@ -24,6 +24,7 @@ export const REALTIME_RUNTIME = String.raw`
   var wrn = (window.wrn = window.wrn || {});
   if (wrn.room) return; // already installed
   var open = {}; // normalized room+query key -> room connection
+  var refreshTimer = null;
 
   function normalizedQuery(query) {
     var params = new URLSearchParams(String(query || "").replace(/^\?/, ""));
@@ -165,6 +166,16 @@ export const REALTIME_RUNTIME = String.raw`
       if (msg.type === "__open") return setStatus("connected", "is-connected");
       if (msg.type === "__close") return setStatus("disconnected", "is-disconnected");
       if (msg.type === "__error") return setStatus("error", "is-error");
+      window.dispatchEvent(new window.CustomEvent("wrnexus:realtime", {
+        detail: { room: name, message: msg }
+      }));
+      if (el.hasAttribute("data-room-refresh")) {
+        clearTimeout(refreshTimer);
+        refreshTimer = setTimeout(function () {
+          if (typeof window.__wrnexusRefresh === "function") window.__wrnexusRefresh();
+          else location.reload();
+        }, Math.max(50, Number(el.getAttribute("data-room-refresh-delay") || 250)));
+      }
       if (!log) return;
       var tpl = templates[msg.type];
       if (tpl == null) tpl = templates[""];

packages/csr/test/realtime.test.ts

@@ -108,6 +108,20 @@ test("submitting [data-room-send] sends JSON and clears reset fields", () => {
   expect((inputs[1] as unknown as HTMLInputElement).value).toBe("");
 });
 
+test("data-room-refresh softly refreshes and emits a browser event", async () => {
+  const win = boot(`<div data-room="updates" data-room-refresh></div>`) as unknown as Window & {
+    __wrnexusRefresh: () => void;
+  };
+  let events = 0;
+  let refreshes = 0;
+  win.addEventListener("wrnexus:realtime", () => events++);
+  win.__wrnexusRefresh = () => refreshes++;
+  sockets[0]!.fireMessage({ type: "invalidate", resource: "messages" });
+  await Bun.sleep(300);
+  expect(events).toBe(1);
+  expect(refreshes).toBe(1);
+});
+
 test("programmatic wrn.room() sends and receives", () => {
   const win = boot(`<div></div>`) as unknown as Window & {
     wrn: {