Refresh UI components and showcase; release updated framework packages

packages/dev-server/test/fixtures/plugin-runtime/chunk.js

@@ -0,0 +1 @@
+export const label = "published-runtime-chunk-loaded";

packages/dev-server/test/fixtures/plugin-runtime/entry.js

@@ -0,0 +1,2 @@
+import { label } from "./chunk.js";
+globalThis.__pluginFixture = label;

packages/dev-server/test/fixtures/plugin-runtime/reexport.js

@@ -0,0 +1,2 @@
+import { label } from "./chunk.js";
+export { label };

packages/dev-server/test/plugin-assets.test.ts

@@ -1,4 +1,5 @@
 import { expect, test } from "bun:test";
+import { fileURLToPath } from "node:url";
 import {
   mergePluginAssets,
   runtimeIdsFromMarkup,
@@ -35,6 +36,23 @@ test("serves package assets with a safe content type", async () => {
   expect(await response?.text()).toContain("window.captcha");
 });
 
+test("published JavaScript runtimes bundle relative chunks by default", async () => {
+  const entry=fileURLToPath(new URL("./fixtures/plugin-runtime/entry.js",import.meta.url));
+  const assets=mergePluginAssets([{id:"published",entry}],[]);
+  const response=await servePluginAsset(assets,"/__wrnexus/assets/published.js","development");
+  expect(response?.status).toBe(200);
+  const source=await response!.text();
+  expect(source).toContain("published-runtime-chunk-loaded");
+  expect(source).not.toMatch(/from\s+["']\.\/chunk\.js["']/);
+});
+
+test("explicit bundle false preserves prebuilt runtime modules", async () => {
+  const entry=fileURLToPath(new URL("./fixtures/plugin-runtime/entry.js",import.meta.url));
+  const assets=mergePluginAssets([{id:"raw",entry,bundle:false}],[]);
+  const response=await servePluginAsset(assets,"/__wrnexus/assets/raw.js","development");
+  expect(await response!.text()).toContain('from "./chunk.js"');
+});
+
 test("resolves inline package migrations for the requested database", () => {
   const migrations = resolvePackageMigrations(
     [

packages/dev-server/test/realtime-auth-runtime.test.ts

@@ -0,0 +1,53 @@
+import { expect, test } from "bun:test";
+import { defineRoom, type Middleware } from "@wrnexus/core";
+import { createProductionHandlers } from "../src/prod.ts";
+
+const room = defineRoom({ security: { requireUser: true }, authorize: info => info.user === "signed-in-user" });
+const auth: Middleware = async (ctx, next) => {
+  if (ctx.req.headers.get("cookie") === "test-session=valid") ctx.user = { id: "signed-in-user" };
+  return next();
+};
+function handlers(middleware: Middleware[] = [auth]) {
+  return createProductionHandlers({ pages: [], api: [], realtime: [{raw:"/realtime/updates",mod:{default:room}}], middleware, components:[], layouts:[] }, {});
+}
+function request(query = "", cookie = "test-session=valid", origin = "https://account.example.test") {
+  return new Request("https://account.example.test/realtime/updates"+query, { headers: {host:"account.example.test", origin, cookie, upgrade:"websocket"} });
+}
+test("room upgrade receives middleware identity after post-processing completes", async () => {
+  let finished = false;
+  const post: Middleware = async (_, next) => { const res = await next(); finished = true; return new Response(res.body, { status:res.status, headers:res.headers }); };
+  let upgraded = false;
+  const response = await handlers([auth,post]).fetch(request(), { upgrade: (_, options) => {
+    expect(finished).toBe(true);
+    expect((options.data as any).meta.user).toBe("signed-in-user");
+    expect(options.headers?.has("x-wrnexus-upgrade-permit")).toBe(false);
+    upgraded = true; return true;
+  } });
+  expect(response).toBeUndefined(); expect(upgraded).toBe(true);
+});
+test("query user cannot impersonate an authenticated room member", async () => {
+  const response = await handlers().fetch(request("?user=signed-in-user", ""), {upgrade:()=>{throw Error("must not upgrade")}});
+  expect(response?.status).toBe(403);
+});
+test("middleware rejection and cross-site origins never upgrade", async () => {
+  const server = {upgrade:()=>{throw Error("must not upgrade")}};
+  expect((await handlers([()=>new Response("denied",{status:401})]).fetch(request(),server))?.status).toBe(401);
+  expect((await handlers().fetch(request("", "test-session=valid", "https://evil.example"),server))?.status).toBe(403);
+});
+test("post-processing rejection overrides room authorization", async () => {
+  const deny: Middleware = async (_,next)=>{await next();return new Response("denied",{status:403})};
+  expect((await handlers([auth,deny]).fetch(request(),{upgrade:()=>{throw Error("must not upgrade")}}))?.status).toBe(403);
+});
+
+test("Bun accepts a real socket with the middleware-authenticated identity", async () => {
+  const app = handlers();
+  const server = Bun.serve({ port:0, fetch:app.fetch, websocket:app.websocket });
+  try {
+    await new Promise<void>((resolve,reject)=>{
+      const socket = new WebSocket(`ws://localhost:${server.port}/realtime/updates`, {headers:{cookie:"test-session=valid",origin:`http://localhost:${server.port}`}});
+      const timer=setTimeout(()=>{socket.close();reject(Error("upgrade timed out"))},3000);
+      socket.onopen=()=>{clearTimeout(timer);socket.close();resolve()};
+      socket.onerror=()=>{clearTimeout(timer);reject(Error("upgrade failed"))};
+    });
+  } finally { server.stop(true); await app.shutdown(); }
+});