WRNexusJS/CHANGELOG.md

Changelog

Unreleased

• Added framework-owned authentication and authorization integration: lazy auth stores, configured OAuth routes with cookie-bound transactions, production configuration validation, default lifecycle roles, typed request users, declarative API permissions, page guards, and consistent unauthorized/forbidden responses.

• Added reusable application primitives for typed route params, bounded cursor pagination, owned-resource authorization, atomic database state transitions, queue batching and explicit worker lifecycles.

• Expanded @wrnexus/test with official typed contexts, Bun-compatible fetch mocking and a full-stack harness alias; made generated files deterministic and introduced wrnexus check as the canonical build-before-check command for generated applications.

• Fixed v.boolean() coercion in @wrnexus/validation (checkField in both src/index.ts and the browser mirror in src/runtime.ts): previously any string other than "true" or "on" silently coerced to false with no error, so typos and unrecognised values (e.g. "yes", "1", "TRUE", "treu") passed validation as a silent, wrong false. Now recognised true strings ("true", "on", "1", "yes", case-insensitive and trimmed) and false strings ("false", "off", "0", "no") coerce as expected, numeric 1/0 coerce (for JSON payloads), and absent/empty input (undefined/null/"") still coerces to false exactly as before (unchanged HTML-checkbox semantics). Behavior change for downstream apps: any other value — an unrecognised string, an object, an array — is now a type error (desc.typeMessage or "Must be true or false") instead of a silent false. A required boolean field given false still errors, as before (checkbox-required semantics are unchanged). A repo-wide search of packages/, examples/, and services/ found no existing v.boolean() usage that feeds an unrecognised value, so no call sites are expected to start failing.

• Fixed defineEndpoint (@wrnexus/core) so routes invoked through the real HTTP router (which calls handlers as handler(ctx), with no second argument) actually receive their request input: it now parses query parameters for GET/HEAD and the JSON body otherwise when no input is passed explicitly. Previously such endpoints silently validated undefined, so an input schema with only optional fields passed vacuously regardless of what was sent. Behavior change for downstream apps: a request that previously passed vacuous validation on a defineEndpoint route can now legitimately fail (400 VALIDATION_ERROR) if it does not actually satisfy the schema. Explicitly passing a second argument (e.g. from a unit test or an internal caller) is unaffected and still takes priority over reading the request.

0.8.8

• Added the framework request context to .wrn language-server type environments.
• Kept workspace type declarations inside runnable apps during updates.
• Regenerated lint-safe application declarations before update verification.

All notable framework changes are recorded here. Every release must also include an idempotent entry in the CLI migration registry.

0.8.3 - 2026-08-03

• Bundled hydrated browser modules so package aliases and filesystem imports do not leak into browser-native modules.
• Fixed SSR computed values, Async branch aliases, typed object props in loops, reactive route state, loader invalidation, realtime identity isolation, and client-function hydration.
• Fixed template-literal parsing in the reactive fallback evaluator and removed the unsupported default unload Permissions Policy directive.
• Made official package components compatible with strict explicit imports and added regression coverage for the TeamSpace application failures.
• Fixed Bun 1.3.14 and TypeScript 5.9 release-gate compatibility in client bundling, alias resolution, and Happy DOM event tests.
• Fixed ESLint compatibility in Node release scripts by declaring Node globals and using explicit regex space quantifiers.
• Fixed package component import validation after workspace installation by excluding generated and dependency directories such as nested node_modules from first-party source scans.
• Made the VS Code embedded compiler freshness check deterministic across TypeScript patch versions, Windows/Linux line endings, and workspace environments by verifying normalized source and generator fingerprints while retaining exact-output checks for the same TypeScript version.
• Fixed the VS Code language-server bundle so it executes under Node instead of exiting after defining an uninvoked Bun CommonJS wrapper, and added request-level crash containment.
• Scoped HTML diagnostics to view blocks, ignored TypeScript generic syntax and WRN expressions, and preserved JavaScript-looking documentation inside <pre><code> examples.
• Fixed formatter corruption of preformatted examples, balanced compact sibling markup, long bare tags, and repeated format-on-save indentation drift.
• Fixed component prop intelligence for dynamic boolean/union expressions, boolean string literals, literal-union runtime types, and reserved prop names such as class.
• Prevented bundled editor type checking from publishing TypeScript standard-library path failures or unmapped synthetic virtual-document diagnostics.
• Fixed language-server virtual TypeScript inference for untyped dynamic handler parameters and indexed output dispatch, while retaining strict diagnostics for explicitly typed parameters.
• Made bundled editor type checking resolve TypeScript standard libraries from the active workspace, and added a regression test that proves semantic diagnostics are actually running.
• Fixed final release-gate lint failures by removing the obsolete editor stripComments helper and importing Node Buffer explicitly in the language-server bundle generator.
• Reviewed the UI visual-contract change caused only by corrected AuthForm.wrn indentation and regenerated the 0.8 baseline after confirming no rendered component behavior changed.

0.8.0 - 2026-08-02

• Added package-owned helper and component kits across all 39 framework packages.
• Added standalone realtime and package-aware auth, i18n, image, uploader, validation, JWT, encryption, database, and CAPTCHA improvements.
• Added whole-application WRN syntax, import, and formatting modernization to the CLI update.
• Added Windows/Linux CI, read-only package audits, governance documents, and security gates.