diff --git a/editors/vscode/src/compiler.cjs b/editors/vscode/src/compiler.cjs index 4d1f2034..58923777 100644 --- a/editors/vscode/src/compiler.cjs +++ b/editors/vscode/src/compiler.cjs @@ -1,6 +1,6 @@ "use strict"; // Generated by scripts/build-editor-compiler.mjs. Do not edit directly. -// WRN editor compiler source hash: 1e7593d6b6bd1c9b8439fc34a30f9db9f7ae64f1788365a74115170aa34cd185 +// WRN editor compiler source hash: 884c9faffb5517c907321484014e00562654ea0ba96e432bec319e0001934446 // WRN editor compiler generator hash: a54ca847c758bc98d8e353ad6d70088df31de1820f6cf9d1c3462505f563e6b8 // Generated with TypeScript: 6.0.3 const __nodeRequire = require; @@ -1148,6 +1148,31 @@ function componentEventAttribute(name) { } return `data-wrn-out-${name}`; } +/** Expand bind:value/bind:checked into a reactive prop plus assignment handler. */ +function expandBindings(attrs) { + const output = []; + for (const attr of attrs) { + if (attr.event || !attr.name.startsWith("bind:")) { + output.push(attr); + continue; + } + const target = attr.name.slice("bind:".length); + if (target !== "value" && target !== "checked") { + throw new Error(`Unknown .wrn binding '${attr.name}'. Use bind:value or bind:checked.`); + } + const expression = wholeAttributeExpression(attr.value) ?? attr.value.trim(); + if (!/^[A-Za-z_$][\w$]*$/.test(expression)) { + throw new Error(`${attr.name} requires a writable state name, received '${expression}'.`); + } + output.push({ name: target, value: `{${expression}}`, event: false }); + output.push({ + name: target === "checked" ? "change" : "input", + value: `${expression} = payload.${target}`, + event: true, + }); + } + return output; +} function reactiveAttrValue(raw, reactive) { let found = false; const value = raw.replace(/\{([^{}]+)\}/g, (whole, inner) => { @@ -1166,6 +1191,7 @@ function reactiveAttrValue(raw, reactive) { return found ? value : null; } function renderAttrs(attrs, csrId, reactive = null, dynamicExpressions) { + attrs = expandBindings(attrs); let bindIndex = 0; const rendered = attrs .map((attr) => { @@ -1302,7 +1328,7 @@ function renderLoopBody(node, locals = []) { return compileIfExpr(node, locals); } const componentTag = isComponentTag(node.tag); - const attrs = node.attrs + const attrs = expandBindings(node.attrs) .filter((attr) => attr.name !== "data-component") .map((attr) => { const name = attr.event @@ -1562,9 +1588,9 @@ function renderPageComponentInvocation(node, ssrBindings, csrBindings, apiBindin const island = islandMarkerFor(node); if (island) return island; - const attrs = node.attrs + const attrs = expandBindings(node.attrs) .filter((attr) => attr.name !== "data-component") - .map((attr) => renderPageComponentAttr(attr, loops)) + .map((attr) => renderPageComponentAttr(attr, loops, reactive)) .join(""); const inner = node.children .map((child) => renderNode(child, ssrBindings, csrBindings, apiBindings, loops, reactive)) @@ -1577,7 +1603,7 @@ function renderNestedComponentInvocation(node, ctx) { if (island) return island; let bindIndex = 0; - const attrs = node.attrs + const attrs = expandBindings(node.attrs) .filter((attr) => attr.name !== "data-component") .map((attr) => { const spread = /^\{\.\.\.([A-Za-z_$][\w$]*)\}$/.exec(attr.name); @@ -2446,6 +2472,8 @@ ${exposed ${declarations} ${visible.length ? ` const __values = await Promise.all([${visible.map((entry) => `__load_${entry.name}()`).join(", ")}]); + const __response = __values.find((value) => value instanceof Response); + if (__response) return __response; return { ${visible.map((entry, index) => `${JSON.stringify(entry.name)}: __values[${index}]`).join(", ")} };` : ""} }`; @@ -2765,7 +2793,7 @@ function renderClientControlTemplate(nodes) { } const componentTag = isComponentTag(node.tag); let bindIndex = 0; - const attrs = node.attrs + const attrs = expandBindings(node.attrs) .map((attribute) => { const name = attribute.event ? componentTag @@ -2803,19 +2831,21 @@ function encodeClientControl(value) { } function renderComponentIfNode(node, ctx) { let expression = "``"; + const clientBranches = []; for (let index = node.branches.length - 1; index >= 0; index--) { const branch = node.branches[index]; const body = branch.body.map((child) => renderComponentNode(child, ctx)).join(""); const bodyExpression = "`" + body + "`"; + clientBranches.unshift(`{ cond: ${branch.cond === null ? "null" : JSON.stringify(branch.cond)}, body: ${bodyExpression} }`); expression = branch.cond === null ? bodyExpression : `(${ctx.resolveExpr(branch.cond)}) ? ${bodyExpression} : ${expression}`; } - const definition = encodeClientControl(node.branches.map((branch) => ({ - cond: branch.cond, - body: renderClientControlTemplate(branch.body), - }))); + // Render all branches on the server into an inert, encoded definition. + // A branch first selected in the browser therefore contains the real nested + // component HTML and scope metadata, not a data-component placeholder. + const definition = `\${__wrnexusEncodeControl([${clientBranches.join(",")}])}`; return `${"${" + expression + "}"}`; } function renderComponentEachNode(node, ctx) { @@ -2955,7 +2985,7 @@ function renderComponentNode(node, ctx) { } } const isExplicitComponentMount = node.attrs.some((attribute) => attribute.name === "data-component"); - const attrs = node.attrs + const attrs = expandBindings(node.attrs) .filter((a) => a.name !== "class" && !a.name.startsWith("class:")) .map((a) => { const spread = /^\{\.\.\.([A-Za-z_$][\w$]*)\}$/.exec(a.name); @@ -3413,6 +3443,9 @@ function __wrnRaw(v: unknown): string { }`); } if (needsScope) { + out.push(`function __wrnexusEncodeControl(value: unknown): string { + return __WrnexusBuffer.from(JSON.stringify(value), "utf8").toString("base64"); +}`); out.push(`function __wrnexusSerializeScopeValue(value: unknown): string { if (value === undefined) { return "undefined"; @@ -3495,7 +3528,7 @@ function __wrnProp(v) { const value = v !== null && typeof v === "object" ? JSON.stringify(v) : String(v == null ? "" : v); return __wrnAttr(value); } -function renderPageComponentAttr(attr, dynamicExpressions) { +function renderPageComponentAttr(attr, dynamicExpressions, _reactive) { if (attr.event) { return ` ${componentEventAttribute(attr.name)}="${attrEscape(attr.value)}"`; } @@ -3508,7 +3541,11 @@ function renderPageComponentAttr(attr, dynamicExpressions) { } dynamicExpressions.push(`\${__wrnexusPropAttr(${expression})}`); const marker = `\x00WRNEACH${dynamicExpressions.length - 1}\x00`; - return ` ${attr.name}="${marker}"`; + // The mount disappears during SSR. Preserve every dynamic component prop + // as a parent-owned binding; server-only expressions simply fail closed in + // the browser, while page state can continue driving the mounted child. + const binding = ` data-wrn-prop-bind-${dynamicExpressions.length - 1}="${attrEscape(JSON.stringify([attr.name, attr.value]))}"`; + return ` ${attr.name}="${marker}"${binding}`; } }, diff --git a/editors/vscode/src/extension.bundle.cjs b/editors/vscode/src/extension.bundle.cjs index df07fda5..bde3747d 100644 --- a/editors/vscode/src/extension.bundle.cjs +++ b/editors/vscode/src/extension.bundle.cjs @@ -1,4 +1,4 @@ -// WRN editor extension source hash: 7fd27405852b02ce3f64e8b7cc08e84029aca9f5505217caafe56be8d3ca4931 +// WRN editor extension source hash: 20e8ecae36b610b418104c3bfd7f25326dd7ad85a0822416b8245107819f7ed2 // WRN editor extension generator hash: 456d1d614e44e5fb1f19b784176c09cf2ade9b64ef73a17934c2698150b62728 "use strict"; var __commonJS = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports); diff --git a/editors/vscode/src/language-server.cjs b/editors/vscode/src/language-server.cjs index 6d50ae28..3436da61 100644 --- a/editors/vscode/src/language-server.cjs +++ b/editors/vscode/src/language-server.cjs @@ -1,5 +1,5 @@ #!/usr/bin/env node -// WRN editor language server source hash: 3c6060ff9db332cf1dc01a467d795fb2d002300400072a4b87437c48d61ab7f9 +// WRN editor language server source hash: 7d485053c38631885fd8d53d84d92f0ef02893d99d0f6c0553d6839971dd7ac5 // WRN editor language server generator hash: f593a44aaf05495b789ce7a3086bee1eebb951b884d41c0e017bbcfe5f547e72 // @bun @bun-cjs (function(exports, require, module, __filename, __dirname) {var __create = Object.create; @@ -173103,6 +173103,7 @@ function virtualTypeScriptModule(source, filePath = "component.wrn", appRoot = f append(`declare const api: { ${apiType} };`); append(`declare const props: Readonly<${ast.name}Props>;`); append("declare const refs: Record;"); + append("declare function useFetch(path: string, method?: string | { method?: string; query?: unknown; params?: unknown; body?: unknown; data?: unknown }, input?: unknown): Promise;"); append(ast.kind === "global-store" || ast.kind === "page-store" ? storeContract(ast) : componentContract(ast)); append(importedWrnDeclarations(ast, filePath, appRoot)); const sharedNames = new Set(ast.runtimeFunctions.filter((fn) => fn.runtime === "shared").map((fn) => fn.name)); @@ -173119,6 +173120,49 @@ ${sharedAliases}`); append(functionDeclaration(fn), fn.source); append("}"); } + const viewFunctions = new Map; + for (const fn of ast.runtimeFunctions) { + if (fn.runtime !== "server") + viewFunctions.set(fn.name, fn.runtime); + } + for (const [name, runtime] of viewFunctions) { + append(`declare const ${name}: typeof ${runtimeNamespace(runtime)}.${name};`); + } + let bindingIndex = 0; + const appendViewBindings = (nodes, locals) => { + for (const node of nodes) { + if (node.type === "element") { + for (const attr of node.attrs) { + const expressions = attr.event ? [attr.value] : [...attr.value.matchAll(/\{([^{}]+)\}/g)].map((match) => match[1].trim()); + for (const expression of expressions) { + if (!expression.trim()) + continue; + const declarations = [ + ...[...locals].map((name) => `declare const ${name}: any;`), + ...attr.event ? ["declare const payload: any;", "declare const event: Event;"] : [] + ].join(" "); + append(`namespace __wrn_view_${bindingIndex++} { ${declarations} void (${expression}); }`, attr.value); + } + } + appendViewBindings(node.children, locals); + } else if (node.type === "if") { + for (const branch of node.branches) { + if (branch.cond) + append(`namespace __wrn_view_${bindingIndex++} { void (${branch.cond}); }`, branch.cond); + appendViewBindings(branch.body, locals); + } + } else if (node.type === "each") { + append(`namespace __wrn_view_${bindingIndex++} { void (${node.list}); }`, node.list); + const nested = new Set(locals); + nested.add(node.item); + if (node.index) + nested.add(node.index); + appendViewBindings(node.body, nested); + appendViewBindings(node.empty, locals); + } + } + }; + appendViewBindings(ast.view, new Set); return { ast, fileName: filePath.replace(/\.wrn$/i, ".wrn.ts"), @@ -173224,7 +173268,7 @@ function componentUsageDiagnostics(source, ast, filePath, appRoot) { const shape = shapes.get(node.tag); if (!shape) return; - const attributes = new Map(node.attrs.filter((attr) => !attr.event).map((attr) => [attr.name, attr])); + const attributes = new Map(node.attrs.filter((attr) => !attr.event).map((attr) => [attr.name.startsWith("bind:") ? attr.name.slice(5) : attr.name, attr])); const outputNames = new Set(shape.outputs.map((output) => output.name)); const position = lineAt(source, `<${node.tag}`); for (const prop of shape.props) { @@ -173261,7 +173305,8 @@ function componentUsageDiagnostics(source, ast, filePath, appRoot) { } if (/^(?:class|id|style|slot|data-|aria-)/.test(attr.name) || attr.name === "attrs") continue; - const prop = known.get(attr.name); + const propName = attr.name.startsWith("bind:") ? attr.name.slice(5) : attr.name; + const prop = known.get(propName); if (!prop) { diagnostics.push({ code: "WRN-COMPONENT-UNKNOWN-PROP", diff --git a/packages/cli/src/test.ts b/packages/cli/src/test.ts index cb3796e8..72c9ca07 100644 --- a/packages/cli/src/test.ts +++ b/packages/cli/src/test.ts @@ -72,7 +72,9 @@ export function createTestPlan(appRoot: string, args: string[]): TestCommandPlan const watch = args.includes("--watch"); const profile = args.find((value) => value.startsWith("--profile="))?.slice(10) || "test"; const setupSource = join(import.meta.dir, "test-setup.ts"); - const setupModule = existsSync(setupSource) ? setupSource : join(import.meta.dir, "test-setup.js"); + const setupModule = existsSync(setupSource) + ? setupSource + : join(import.meta.dir, "test-setup.js"); const shard = args.find((value) => value.startsWith("--shard="))?.slice(8); const browsers = (args.find((value) => value.startsWith("--browsers="))?.slice(11) ?? "chromium") .split(",") diff --git a/packages/compiler/src/codegen.ts b/packages/compiler/src/codegen.ts index 9889c240..ad4a127a 100644 --- a/packages/compiler/src/codegen.ts +++ b/packages/compiler/src/codegen.ts @@ -3175,7 +3175,7 @@ function __wrnProp(v: unknown): string { function renderPageComponentAttr( attr: Attr, dynamicExpressions: string[], - reactive: PageReactive | null, + _reactive: PageReactive | null, ): string { if (attr.event) { return ` ${componentEventAttribute(attr.name)}="${attrEscape(attr.value)}"`; diff --git a/packages/db/test/seed.test.ts b/packages/db/test/seed.test.ts index 6e09e709..6e1d18fa 100644 --- a/packages/db/test/seed.test.ts +++ b/packages/db/test/seed.test.ts @@ -15,9 +15,17 @@ function fakeDb() { test("seed helpers parameterize object rows and removals", async () => { const { db, calls } = fakeDb(); - await addSeedData(db, [{ code: "free", credits: 10 }, { code: "pro", credits: 20 }], "plans", { - conflict: "ignore", - }); + await addSeedData( + db, + [ + { code: "free", credits: 10 }, + { code: "pro", credits: 20 }, + ], + "plans", + { + conflict: "ignore", + }, + ); await removeSeedData(db, { code: "free" }, "plans"); expect(calls[0]).toEqual({ sql: "INSERT OR IGNORE INTO plans (code, credits) VALUES (?, ?)", diff --git a/packages/dev-server/src/runtime.ts b/packages/dev-server/src/runtime.ts index 05379c32..2f646495 100644 --- a/packages/dev-server/src/runtime.ts +++ b/packages/dev-server/src/runtime.ts @@ -1777,7 +1777,10 @@ export function createHandlers(deps: RuntimeDeps): Handlers { (match) => ` ${match[1]}`, ).join(""); const bridged = propBindings - ? rendered.replace(/(<[A-Za-z][A-Za-z0-9-]*\b[^>]*\bdata-scope="[^"]*")/, `$1${propBindings}`) + ? rendered.replace( + /(<[A-Za-z][A-Za-z0-9-]*\b[^>]*\bdata-scope="[^"]*")/, + `$1${propBindings}`, + ) : rendered; result += await renderComponents(bridged, translate, language, depth + 1); } catch (err) { diff --git a/packages/dev-server/test/component-composition-runtime.test.ts b/packages/dev-server/test/component-composition-runtime.test.ts index 1f86cdbf..041f736f 100644 --- a/packages/dev-server/test/component-composition-runtime.test.ts +++ b/packages/dev-server/test/component-composition-runtime.test.ts @@ -97,7 +97,10 @@ test("SSR carries a parent prop binding onto the rendered child scope", async () mkdirSync(join(app, "pages"), { recursive: true }); mkdirSync(join(app, "components"), { recursive: true }); writeFileSync(join(app, "pages/index.ts"), "export default () => '';\n"); - writeFileSync(join(app, "components/Child.wrn"), "component Child { props { value = 0 } view { {value} } }\n"); + writeFileSync( + join(app, "components/Child.wrn"), + "component Child { props { value = 0 } view { {value} } }\n", + ); const marker = "["value","{count}"]"; const handlers = createHandlers({ mode: "development", @@ -106,11 +109,16 @@ test("SSR carries a parent prop binding onto the rendered child scope", async () loadModule: async (file) => basename(file) === "Child.wrn" ? { render: () => '
1
' } - : { default: () => `
` }, + : { + default: () => + `
`, + }, getMiddleware: async () => [], assets: { serve: async () => null }, } satisfies RuntimeDeps); - const response = await handlers.fetch(new Request("https://example.test/"), { upgrade: () => false }); + const response = await handlers.fetch(new Request("https://example.test/"), { + upgrade: () => false, + }); const html = await response!.text(); expect(html).toContain(`data-wrn-prop-bind-0="${marker}"`); expect(html).not.toContain('data-component="Child"'); diff --git a/packages/mail/src/index.ts b/packages/mail/src/index.ts index 9223cfd7..2077a6c8 100644 --- a/packages/mail/src/index.ts +++ b/packages/mail/src/index.ts @@ -117,7 +117,7 @@ export function defineSealedMailCredentials(options: SealedMailCredentialsOption const secret = process.env[env]; if (!secret) throw new Error(`${env} is not set; it is required to seal mail credentials at rest.`); - let length = 0; + let length: number; try { length = atob(secret).length; } catch { diff --git a/packages/metering/README.md b/packages/metering/README.md new file mode 100644 index 00000000..2c92391f --- /dev/null +++ b/packages/metering/README.md @@ -0,0 +1,40 @@ +# @wrnexus/metering + +Framework-native entitlement catalogs, credit packs, and usage metering for WrNexus applications. + +The package keeps policy separate from persistence: applications provide a `MeterStore`, while the metering facade validates unit amounts and reports insufficient balances separately from storage faults. All amounts are positive safe integers except explicit adjustments, which may be positive or negative but never zero. + +## Usage + +```ts +import { defineEntitlements, defineMeter, definePacks } from "@wrnexus/metering"; + +const entitlements = defineEntitlements({ + plans: () => [ + { code: "free", name: "Free", features: [], allowance: 10 }, + { code: "pro", name: "Pro", features: ["exports"], allowance: 1_000 }, + ], + subscriptionFor: async (subjectId) => subscriptions.planFor(subjectId), + fallback: "free", +}); + +const packs = definePacks([ + { code: "starter", units: 100 }, + { code: "plus", units: 500 }, +]); + +const meter = defineMeter({ store }); + +if (await entitlements.enabled("user-1", "exports")) { + const result = await meter.reserve("user-1", 1, "export report"); + if (!result.ok) console.error(result.reason); +} +``` + +## API + +- `defineEntitlements(options)` resolves a subject's plan, features, and allowance from a server-owned catalog, with an explicit fallback plan. +- `definePacks(entries)` creates an immutable, prototype-safe lookup of purchasable unit packs. Clients select a pack code rather than supplying an amount. +- `defineMeter(options)` exposes `balance`, `reserve`, `grant`, `purchase`, `refund`, and `adjust` operations over an application-provided store. + +Meter operations return `{ ok: true }` on success or `{ ok: false, reason, fault? }` on refusal. A result with `fault: true` identifies an underlying storage error; use `onFault` for operational reporting without exposing exception-based control flow to callers. diff --git a/packages/queue/README.md b/packages/queue/README.md index 02ca93ab..5db6607b 100644 --- a/packages/queue/README.md +++ b/packages/queue/README.md @@ -37,15 +37,15 @@ function createQueue(options?: QueueOptions): Queue; #### `QueueOptions` -| Option | Type | Default | Description | -| ------------- | ------------------------------------ | ---------- | -------------------------------------------------------- | -| `maxAttempts` | `number` | `3` | Default max attempts per job before it is dead-lettered. | -| `backoffMs` | `number` | `1000` | Base retry backoff in ms; doubles per attempt. | -| `pollMs` | `number` | `250` | Poll interval used once `start()` is called (ms). | -| `onFailed` | `(job: Job, error: unknown) => void` | — | Called when a job exhausts its attempts. | -| `concurrency` | `number` | unlimited | Maximum jobs claimed by one `drain()` call. | +| Option | Type | Default | Description | +| ------------- | ------------------------------------ | ---------- | --------------------------------------------------------------------------------------- | +| `maxAttempts` | `number` | `3` | Default max attempts per job before it is dead-lettered. | +| `backoffMs` | `number` | `1000` | Base retry backoff in ms; doubles per attempt. | +| `pollMs` | `number` | `250` | Poll interval used once `start()` is called (ms). | +| `onFailed` | `(job: Job, error: unknown) => void` | — | Called when a job exhausts its attempts. | +| `concurrency` | `number` | unlimited | Maximum jobs claimed by one `drain()` call. | | `capacity` | `number` | unlimited | Optional maximum queued jobs; omitted queues never scan merely to enforce a hidden cap. | -| `now` | `() => number` | `Date.now` | Clock injection for deterministic tests. | +| `now` | `() => number` | `Date.now` | Clock injection for deterministic tests. | ### `Queue` diff --git a/packages/test/src/index.ts b/packages/test/src/index.ts index 39bccda8..adc47901 100644 --- a/packages/test/src/index.ts +++ b/packages/test/src/index.ts @@ -206,8 +206,4 @@ export type { export { withDatabaseRollback, createFactory, captureBrowserArtifacts } from "./platform.ts"; export type { TransactionalDatabase, BrowserArtifactPage } from "./platform.ts"; export { detectMutations } from "./mutation.ts"; -export type { - MutationCase, - MutationReport, - DetectMutationsOptions, -} from "./mutation.ts"; +export type { MutationCase, MutationReport, DetectMutationsOptions } from "./mutation.ts"; diff --git a/packages/test/src/mutation.ts b/packages/test/src/mutation.ts index a280f665..eb9d3b02 100644 --- a/packages/test/src/mutation.ts +++ b/packages/test/src/mutation.ts @@ -43,10 +43,9 @@ export async function detectMutations( (same ? survived : killed).push(mutation.name); } if (survived.length) { - throw Object.assign( - new Error(`WRN-MUTATION-SURVIVED: ${survived.join(", ")}`), - { report: { baseline, killed, survived } }, - ); + throw Object.assign(new Error(`WRN-MUTATION-SURVIVED: ${survived.join(", ")}`), { + report: { baseline, killed, survived }, + }); } return { baseline, killed, survived }; } diff --git a/packages/typecheck/test/api-block-binding.test.ts b/packages/typecheck/test/api-block-binding.test.ts index 11e3e7c0..93d45b52 100644 --- a/packages/typecheck/test/api-block-binding.test.ts +++ b/packages/typecheck/test/api-block-binding.test.ts @@ -1,5 +1,5 @@ import { expect, test } from "bun:test"; -import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs"; +import { mkdirSync, mkdtempSync } from "node:fs"; import { tmpdir } from "node:os"; import { join } from "node:path"; import { checkWrnSource } from "../src/index.ts"; diff --git a/scripts/security-performance-audit.mjs b/scripts/security-performance-audit.mjs index f6eb23f5..3bab66f9 100644 --- a/scripts/security-performance-audit.mjs +++ b/scripts/security-performance-audit.mjs @@ -191,7 +191,11 @@ const runtimeBudgets = { // buys a correctness fix, not a feature. The encoder was trimmed to the // btoa/encodeURIComponent idiom first, which recovered 65 of those bytes; // what remains is the smallest form that still handles non-ASCII. - "reactive-runtime.ts": 51_600, + // Raised to 52_000 on 2026-08-23 after the reviewed callApi transport and + // loop-locals runtime landed together at 51,926 bytes under the pinned Bun + // 1.3.14 production minifier. This preserves a narrow 74-byte ceiling rather + // than masking the shipped feature cost with a broad allowance. + "reactive-runtime.ts": 52_000, "component-controllers.ts": 24_100, "nav-runtime.ts": 12_000, "realtime-runtime.ts": 8_000,