# WRNexusJS

WRNexusJS is a compiler-driven, SSR-first, Bun-native full-stack framework for building secure, fast, maintainable applications with `.wrn` pages, layouts, components, stores, server functions, client functions, typed outputs, APIs, validation, authentication, realtime rooms, and production tooling.

Current framework version: **0.8.0**

## Core principles

- Secure by default with CSP, CSRF, safe serialization, URL policies, request limits, SSRF protection, secret scanning, and release gates.
- Performance-first SSR with zero framework JavaScript for static pages and selective hydration for interactive pages.
- One compiler-understood `.wrn` model for markup, props, state, outputs, and runtime-specific functions.
- Backward-compatible package upgrades with migrations, generated references, validation scripts, and private publishing controls.
- Package kits that give developers public helpers, package tests, documentation, and complete UI blocks where a package has a developer-facing interface.

## Quick start

```bash
bun install
bun run validate:0.8
bun run check
bun run dev
```

Create or upgrade a project:

```bash
bunx @wrnexus/cli@0.8.0 create my-app
bunx @wrnexus/cli@0.8.0 update --version=0.8.0 --report
```

## Package kits in 0.8

All 39 framework packages expose a documented helper/API surface and package tests. UI-facing packages additionally own complete `.wrn` blocks composed from `@wrnexus/ui`:

- `@wrnexus/auth` — complete account, sign-in, sign-up, MFA, passkey, recovery, device, provider, and security blocks.
- `@wrnexus/captcha` — challenge, field, status, extraction, verification, response, and context helpers.
- `@wrnexus/i18n` — recursive locale loading, fallback chains, request resolution, SSR/browser translations, language controls, and formatters.
- `@wrnexus/image` — responsive picture plans, secure loaders, placeholders, preload hints, audits, and image blocks.
- `@wrnexus/realtime` — typed messages, room connections, presence, typing, metadata, composer, status, and message blocks.
- `@wrnexus/uploader` — upload attributes, result validation, formatting, dropzone, and status blocks.
- `@wrnexus/validation` — parse/throw helpers, consistent error responses, summaries, and field errors.
- `@wrnexus/ui` — the complete shared design-system component catalog.

Infrastructure packages remain helper/API-only so database, encryption, security, compiler, server, and build packages do not pull browser UI into production server code.

## Security note for encrypted HTTP bodies

`@wrnexus/encryption` supports authenticated application-layer request and response envelopes with method, path, request-ID, timestamp, expiry, key-rotation, body-size, and replay binding.

This feature **does not replace HTTPS**. It is appropriate for service-to-service calls, native/mobile clients, controlled agents, or selected fields with server-managed keys. It cannot hide data from an end user when a browser receives the decryption key.

## Validation commands

```bash
bun run audit:packages
bun run test:package-kits
bun run validate:0.8
bun run security:framework
bun run sbom
bun run benchmark:framework
bun run validate:staging
bun run check
```