ClintchizandClaude Opus 5
eeef2d79df
The dev server shipped two entries, index and serve-entry, bundled independently because the publish build set splitting:false. They share pipeline.ts, which holds mutable module state -- compileCacheDir, set once at startup by the bootstrap, and browserArtifactPaths, populated during compilation and read when serving /__wrnexus/client/*. Duplicating the module duplicated the state, so the writer and the reader addressed different copies: every component client module 404'd and .wrn compilation wrote nothing. It works from source, where there is one module instance, which is why it reached a release. Emitting a shared chunk fixes it for every package at once. resetDevCache also ran several hundred lines after the plugin virtual modules were written into the same directory, deleting them at every boot. An app with no plugins never noticed; an app with one lost them every time. Separately, secureCookieOptions spread ...options after its path default, and setSecureCookie always forwards an explicit path key -- so omitting path emitted a cookie with no Path at all, which the browser then scoped to the request's directory. Verified end to end against a real app installing the published packages: 17 artifacts written, client modules 200, and the sign-in form submits from the UI and reaches /dashboard. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@wrnexus/security
Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.
import { safeFetch, securityPreset, setSecureCookie } from "@wrnexus/security";
export default { security: securityPreset("strict") };
const response = await safeFetch(remoteUrl, { allowedHosts: ["api.example.com"] });
setSecureCookie(ctx, "__Host-session", sessionId);