# WRNexusJS 0.4.0 validation report

Validation date: 2026-07-25

Baseline archive:

- File: `WRNexusJS-main-current.zip`
- SHA-256: `7860543f1b0d8bb227857bb01f70c6a3719d51215e24990cc0b3e45a18211c50`

## Result

All validation that can be performed in this build environment passed. The repository is structurally aligned to 0.4.0, TypeScript source is syntactically and semantically valid under the project configuration used for validation, automatic package discovery works, CAPTCHA is loaded automatically without a copied `captcha.js`, editor checks pass, generated component documentation succeeds, and targeted runtime smoke checks pass.

Bun is not installed in this environment and external package installation is unavailable. Therefore the Bun unit-test suite, ESLint, Prettier, and real Bun production builds were not executed here. Run the final commands in the last section on the target Windows/Bun environment before publishing.

## Passed checks

### Repository structure

Command:

```bash
node scripts/verify-0.4.mjs
```

Passed:

- 30 `@wrnexus/*` packages aligned to version 0.4.0
- Managed CAPTCHA service aligned to version 0.4.0
- 73 unique updater migrations
- Package/runtime/asset/migration discovery markers
- CAPTCHA has no copied UI component or public JavaScript requirement
- Bun workspace lock structure
- VS Code extension package and lock versions
- Required 0.4 architecture, migration, runtime, testing, and documentation files

### TypeScript

Passed:

- 346 TypeScript files transpiled with zero syntax diagnostics
- Strict semantic TypeScript check completed with zero diagnostics
- Compiler cache runtime-cycle smoke check passed

The semantic check used the repository `tsconfig.json` plus temporary environment-only type roots for Node/Bun declarations. The temporary config is not included in the delivered archives.

### WRN source

Passed:

- 211 `.wrn` files parsed successfully
- CAPTCHA component parses without a manual `<script>` tag
- Runtime marker `data-wrnexus-runtime="captcha"` is present

### VS Code extension

Passed:

- 23 Node test cases
- Grammar, snippets, package metadata, language association, formatter, compiler, JSON, and Marketplace asset validation

### Generated UI documentation

Passed:

- 85 component detail pages generated
- 325 live demos generated
- 8 category pages generated

### JavaScript and JSON

Passed:

- 58 strict JSON files parsed
- 28 JavaScript/MJS/CJS files passed `node --check`

### Runtime smoke checks

Passed targeted Node/TypeScript smoke checks for:

- Automatic discovery of `@wrnexus/captcha` from the application dependency list
- Automatic CAPTCHA component, runtime, and style contributions
- Runtime marker collection and one-time script injection
- Correct JavaScript MIME type and `X-Content-Type-Options: nosniff`
- Package migration resolution
- Package style ordering
- Package-only CSS wrapper generation without an application stylesheet
- Application route precedence over package routes
- Durable queue visibility during processing, retries, and dead letters
- Telemetry batch requeue behavior with multiple failing sinks
- Syntax version and source ranges
- Service container, health registry, and idempotency store
- Reactive watcher lifecycle, resource supersession, and abort behavior
- Stable JSON with repeated references and circular-reference rejection
- Retry and backoff helpers
- PubSub validation and defensive presence values
- Upload content sniffing, safe object keys, and signed file tokens
- Encryption and JWT keyring duplicate/active-key validation and defensive copies
- Theme token and contrast audits

## Important architecture verification

The CAPTCHA package now behaves as a framework-native package:

1. An application installs `@wrnexus/captcha`.
2. WRNexusJS discovers `wrnexus.plugin` from the package manifest.
3. `<Captcha />` is resolved from the package component directory.
4. SSR records the `captcha` runtime marker only when the component is rendered.
5. Development serves `/__wrnexus/assets/captcha.js` with the correct MIME type.
6. Production emits a hashed runtime asset.
7. SSR or CSR navigation loads the runtime once and runs its mount lifecycle.
8. No user-authored script tag or copied public JavaScript file is required.

## Required final local validation

Run from the repository root with Bun 1.3.14 or newer:

```bash
bun install
bun run verify:0.4
bun run validate:0.4
```

`validate:0.4` runs:

```text
structural verification
full typecheck
ESLint
all package tests
Prettier check
integration tests
basic application tests and production build
component showcase check
CAPTCHA showcase check
managed CAPTCHA service tests
```

For release preparation, also run:

```bash
bun run release:prepare
```

Do not publish if any local Bun, lint, format, test, build, or migration check fails. The included code fixes the issues found through available static and runtime validation, but no responsible validation process can guarantee that future environments or untested integrations contain zero defects.