release: WRNexusJS 0.2.30

.publish/ai/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/ai",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "Zero-dependency Claude (Anthropic) client for WrNexus apps.",
   "license": "MIT",

.publish/authz/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/authz",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/authz — part of the WrNexus framework.",
   "license": "MIT",

.publish/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/cli — part of the WrNexus framework.",
   "license": "MIT",
@@ -28,16 +28,16 @@
     "wrnexus": "./dist/index.js"
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29",
+    "@wrnexus/core": "^0.2.30",
-    "@wrnexus/router": "^0.2.29",
+    "@wrnexus/router": "^0.2.30",
-    "@wrnexus/csr": "^0.2.29",
+    "@wrnexus/csr": "^0.2.30",
-    "@wrnexus/compiler": "^0.2.29",
+    "@wrnexus/compiler": "^0.2.30",
-    "@wrnexus/styles": "^0.2.29",
+    "@wrnexus/styles": "^0.2.30",
-    "@wrnexus/dev-server": "^0.2.29",
+    "@wrnexus/dev-server": "^0.2.30",
-    "@wrnexus/ui": "^0.2.29",
+    "@wrnexus/ui": "^0.2.30",
-    "@wrnexus/validation": "^0.2.29",
+    "@wrnexus/validation": "^0.2.30",
-    "@wrnexus/i18n": "^0.2.29",
+    "@wrnexus/i18n": "^0.2.30",
-    "@wrnexus/db": "^0.2.29"
+    "@wrnexus/db": "^0.2.30"
   },
   "files": [
     "dist"

.publish/compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/compiler",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/compiler — part of the WrNexus framework.",
   "license": "MIT",

.publish/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/core",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/core — part of the WrNexus framework.",
   "license": "MIT",

.publish/csr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/csr",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/csr — part of the WrNexus framework.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29"
+    "@wrnexus/core": "^0.2.30"
   },
   "files": [
     "dist"

.publish/db/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/db",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/db — part of the WrNexus framework.",
   "license": "MIT",

.publish/dev-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/dev-server",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/dev-server — part of the WrNexus framework.",
   "license": "MIT",
@@ -25,18 +25,18 @@
     }
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29",
+    "@wrnexus/core": "^0.2.30",
-    "@wrnexus/router": "^0.2.29",
+    "@wrnexus/router": "^0.2.30",
-    "@wrnexus/ssr": "^0.2.29",
+    "@wrnexus/ssr": "^0.2.30",
-    "@wrnexus/csr": "^0.2.29",
+    "@wrnexus/csr": "^0.2.30",
-    "@wrnexus/compiler": "^0.2.29",
+    "@wrnexus/compiler": "^0.2.30",
-    "@wrnexus/styles": "^0.2.29",
+    "@wrnexus/styles": "^0.2.30",
-    "@wrnexus/ui": "^0.2.29",
+    "@wrnexus/ui": "^0.2.30",
-    "@wrnexus/validation": "^0.2.29",
+    "@wrnexus/validation": "^0.2.30",
-    "@wrnexus/i18n": "^0.2.29",
+    "@wrnexus/i18n": "^0.2.30",
-    "@wrnexus/db": "^0.2.29",
+    "@wrnexus/db": "^0.2.30",
-    "@wrnexus/pubsub": "^0.2.29",
+    "@wrnexus/pubsub": "^0.2.30",
-    "@wrnexus/uploader": "^0.2.29"
+    "@wrnexus/uploader": "^0.2.30"
   },
   "files": [
     "dist"

.publish/encryption/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/encryption",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/encryption — part of the WrNexus framework.",
   "license": "MIT",

.publish/helpers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/helpers",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "Safe convenience helpers for WrNexus request contexts and common application flows.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29"
+    "@wrnexus/core": "^0.2.30"
   },
   "files": [
     "dist"

.publish/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/i18n",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/i18n — part of the WrNexus framework.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29"
+    "@wrnexus/core": "^0.2.30"
   },
   "files": [
     "dist"

.publish/jwt/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/jwt",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/jwt — part of the WrNexus framework.",
   "license": "MIT",

.publish/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/mobile",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/mobile — part of the WrNexus framework.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/native": "^0.2.29"
+    "@wrnexus/native": "^0.2.30"
   },
   "files": [
     "dist"

.publish/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/native",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/native — part of the WrNexus framework.",
   "license": "MIT",

.publish/oauth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/oauth",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/oauth — part of the WrNexus framework.",
   "license": "MIT",

.publish/pubsub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/pubsub",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/pubsub — part of the WrNexus framework.",
   "license": "MIT",

.publish/queue/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/queue",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/queue — part of the WrNexus framework.",
   "license": "MIT",

.publish/reactive/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/reactive",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/reactive — part of the WrNexus framework.",
   "license": "MIT",

.publish/router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/router",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/router — part of the WrNexus framework.",
   "license": "MIT",
@@ -21,8 +21,8 @@
     }
   },
   "dependencies": {
-    "@wrnexus/compiler": "^0.2.29",
+    "@wrnexus/compiler": "^0.2.30",
-    "@wrnexus/core": "^0.2.29"
+    "@wrnexus/core": "^0.2.30"
   },
   "files": [
     "dist"

.publish/ssr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/ssr",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/ssr — part of the WrNexus framework.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29"
+    "@wrnexus/core": "^0.2.30"
   },
   "files": [
     "dist"

.publish/styles/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/styles",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/styles — part of the WrNexus framework.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/uploader": "^0.2.29"
+    "@wrnexus/uploader": "^0.2.30"
   },
   "files": [
     "dist"

.publish/test/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/test",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/test — part of the WrNexus framework.",
   "license": "MIT",

.publish/tracking/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/tracking",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/tracking — part of the WrNexus framework.",
   "license": "MIT",

.publish/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/ui",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/ui — part of the WrNexus framework.",
   "license": "MIT",
@@ -22,7 +22,7 @@
     "./ui.css": "./ui.css"
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29"
+    "@wrnexus/core": "^0.2.30"
   },
   "files": [
     "dist",

.publish/uploader/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/uploader",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/uploader — part of the WrNexus framework.",
   "license": "MIT",
@@ -21,7 +21,7 @@
     }
   },
   "dependencies": {
-    "@wrnexus/core": "^0.2.29"
+    "@wrnexus/core": "^0.2.30"
   },
   "files": [
     "dist"

.publish/validation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/validation",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "description": "@wrnexus/validation — part of the WrNexus framework.",
   "license": "MIT",

packages/ai/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/ai",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "description": "Zero-dependency Claude (Anthropic) client for WrNexus apps.",

packages/authz/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/authz",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/cli/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/cli",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/cli/src/update.ts

@@ -339,6 +339,15 @@ const MIGRATIONS: Migration[] = [
       // Existing applications remain compatible with this release.
     },
   },
+  {
+    version: "0.2.30",
+    id: "workspace-config-auth-improvements",
+    description:
+      "Adds dynamic workspace origins, workspace forward-auth resolution, layout support, component tag syntax, and editor improvements.",
+    apply() {
+      // No generated application files require automatic migration.
+    },
+  },
 ];
 
 /** Release tooling uses this to require an explicit migration entry per version. */

packages/compiler/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/compiler",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/core",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/csr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/csr",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/db/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/db",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/dev-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/dev-server",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/dev-server/src/gateway.ts

@@ -14,18 +14,27 @@ import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { RESTART_EXIT_CODE } from "./restart.ts";
 
-/** Per-app access control, enforced at the gateway before proxying. */
+export type GatewayForwardAuth = (
+  | {
+      url: string;
+      app?: never;
+      path?: never;
+    }
+  | {
+      app: string;
+      path?: string;
+      url?: never;
+    }
+) & {
+  headers?: string[];
+};
+
 export interface GatewayAuth {
-  /** HTTP Basic auth — one or more allowed user/password pairs. */
   basic?: { user: string; pass: string } | Array<{ user: string; pass: string }>;
-  /** Allow only these client IPs (exact match; others get 403). */
+
   allowIps?: string[];
-  /**
+
-   * Forward-auth (SSO): the gateway GETs `url` forwarding the request's cookies +
+  forward?: GatewayForwardAuth;
-   * Authorization; a 2xx allows the request, anything else blocks it (its status
-   * is returned). Point it at your own verify endpoint.
-   */
-  forward?: { url: string };
 }
 
 export interface GatewayApp {
@@ -162,6 +171,7 @@ async function checkAuth(
   auth: GatewayAuth | undefined,
   req: Request,
   ip: string,
+  internalOrigins: Readonly<Record<string, string>>,
 ): Promise<Response | null> {
   if (!auth) return null;
 
@@ -189,12 +199,14 @@ async function checkAuth(
   }
 
   if (auth.forward) {
+    const verifyUrl = resolveForwardAuthUrl(auth.forward, internalOrigins);
+
     try {
-      const res = await fetch(auth.forward.url, {
+      const res = await fetch(verifyUrl, {
         headers: forwardAuthHeaders(req),
         redirect: "manual",
       });
-      if (!res.ok) return forwardAuthFailure(res, auth.forward.url);
+      if (!res.ok) return forwardAuthFailure(res, verifyUrl);
     } catch {
       return new Response("Auth service unavailable", { status: 503 });
     }
@@ -203,6 +215,40 @@ async function checkAuth(
   return null;
 }
 
+function resolveForwardAuthUrl(
+  forward: NonNullable<GatewayAuth["forward"]>,
+  internalOrigins: Readonly<Record<string, string>>,
+): string {
+  if (typeof forward.app === "string") {
+    const appName = forward.app;
+    const origin = internalOrigins[appName];
+
+    if (!origin) {
+      throw new Error(`Forward-auth app "${appName}" was not found.`);
+    }
+
+    const path = forward.path ?? "/api/verify";
+
+    if (!path.startsWith("/")) {
+      throw new Error(`Forward-auth path must start with "/": ${path}`);
+    }
+
+    return new URL(path, `${origin}/`).href;
+  }
+
+  if (typeof forward.url === "string") {
+    const url = new URL(forward.url);
+
+    if (url.protocol !== "http:" && url.protocol !== "https:") {
+      throw new Error(`Forward-auth URL must use HTTP or HTTPS: ${forward.url}`);
+    }
+
+    return url.href;
+  }
+
+  throw new Error("Forward auth requires either `app` or `url`.");
+}
+
 /** Baseline edge security headers, only where the app didn't already set them. */
 function applyEdgeHeaders(res: Response): Response {
   const defaults: Record<string, string> = {
@@ -330,6 +376,10 @@ export async function startGateway(opts: GatewayOptions): Promise<RunningGateway
     return target;
   });
 
+  const internalOrigins: Readonly<Record<string, string>> = Object.freeze(
+    Object.fromEntries(targets.map((target) => [target.name, target.origin])),
+  );
+
   const stopChildren = () => {
     stopping = true;
     for (const target of targets) {
@@ -390,7 +440,7 @@ export async function startGateway(opts: GatewayOptions): Promise<RunningGateway
         }
 
         // Per-app access control (basic auth / IP allowlist / forward-auth).
-        const denied = await checkAuth(target.auth, req, ip);
+        const denied = await checkAuth(target.auth, req, ip, internalOrigins);
         if (denied) {
           if (sec.accessLog)
             console.log(

packages/encryption/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/encryption",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/helpers/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/helpers",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "description": "Safe convenience helpers for WrNexus request contexts and common application flows.",

packages/i18n/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/i18n",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/jwt/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/jwt",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/mobile/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/mobile",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/native/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/native",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/oauth/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/oauth",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/pubsub/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/pubsub",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/queue/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/queue",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/reactive/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/reactive",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/router/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/router",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/ssr/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/ssr",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/styles/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/styles",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/test/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/test",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/tracking/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/tracking",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/ui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/ui",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/uploader/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/uploader",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

packages/validation/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/validation",
-  "version": "0.2.29",
+  "version": "0.2.30",
   "private": true,
   "type": "module",
   "main": "src/index.ts",