ClintchizandClaude Opus 5
f19462dff0
The database store review found two Critical defects and several Important ones, all reachable in production. grant() was wrapped in db.tx for atomicity. The sqlite driver runs a bare BEGIN on one shared connection with no serialization, so an open transaction swallows any concurrent write from another method and discards it on rollback. Demonstrated: revokeRole resolved with no error while the role survived - a security-critical revoke reporting success with the privilege retained. Concurrent grants also rejected outright with "cannot start a transaction within a transaction". Replaced with single-statement upserts, which are atomic without a transaction; assignRole likewise drops its check-then-act SELECT for ON CONFLICT DO NOTHING, which was rejecting 19 of 20 concurrent identical calls. effect had no CHECK constraint and assignmentsFor classified by exact equality, so a mis-cased or corrupted value was dropped from BOTH buckets - a deny row that silently stopped denying. Added the constraint and made anything that is not literally "allow" count as a deny. scopeKey now refuses an explicitly empty tenantId rather than treating it as global, which otherwise let a caller who controls the tenant id read and write global assignments. Also: ensureAuthzTables takes the dialect from db.driver.dialect instead of defaulting to sqlite; the DDL is a list of statements rather than a blob split on a formatting-dependent separator; MySQL identity columns get a binary collation so tenant "T1" cannot match "t1"; and postgres placeholders are numbered. Adds four conformance tests for the concurrency and empty-scope cases. The suite was entirely sequential and structurally could not catch any of this. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
WRNexusJS
WRNexusJS is a compiler-driven, SSR-first, Bun-native full-stack framework for building secure, fast, maintainable applications with .wrn pages, layouts, components, stores, server functions, client functions, typed outputs, APIs, validation, authentication, realtime rooms, and production tooling.
Current framework version: 0.8.0
Core principles
- Secure by default with CSP, CSRF, safe serialization, URL policies, request limits, SSRF protection, secret scanning, and release gates.
- Performance-first SSR with zero framework JavaScript for static pages and selective hydration for interactive pages.
- One compiler-understood
.wrnmodel for markup, props, state, outputs, and runtime-specific functions. - Backward-compatible package upgrades with migrations, generated references, validation scripts, and private publishing controls.
- Package kits that give developers public helpers, package tests, documentation, and complete UI blocks where a package has a developer-facing interface.
Quick start
bun install
bun run validate:0.8
bun run check
bun run dev
Create or upgrade a project:
bunx @wrnexus/cli@0.8.0 create my-app
bunx @wrnexus/cli@0.8.0 update --version=0.8.0 --report
Package kits in 0.8
All 39 framework packages expose a documented helper/API surface and package tests. UI-facing packages additionally own complete .wrn blocks composed from @wrnexus/ui:
@wrnexus/auth— complete account, sign-in, sign-up, MFA, passkey, recovery, device, provider, and security blocks.@wrnexus/captcha— challenge, field, status, extraction, verification, response, and context helpers.@wrnexus/i18n— recursive locale loading, fallback chains, request resolution, SSR/browser translations, language controls, and formatters.@wrnexus/image— responsive picture plans, secure loaders, placeholders, preload hints, audits, and image blocks.@wrnexus/realtime— typed messages, room connections, presence, typing, metadata, composer, status, and message blocks.@wrnexus/uploader— upload attributes, result validation, formatting, dropzone, and status blocks.@wrnexus/validation— parse/throw helpers, consistent error responses, summaries, and field errors.@wrnexus/ui— the complete shared design-system component catalog.
Infrastructure packages remain helper/API-only so database, encryption, security, compiler, server, and build packages do not pull browser UI into production server code.
Security note for encrypted HTTP bodies
@wrnexus/encryption supports authenticated application-layer request and response envelopes with method, path, request-ID, timestamp, expiry, key-rotation, body-size, and replay binding.
This feature does not replace HTTPS. It is appropriate for service-to-service calls, native/mobile clients, controlled agents, or selected fields with server-managed keys. It cannot hide data from an end user when a browser receives the decryption key.
Validation commands
bun run audit:packages
bun run test:package-kits
bun run validate:0.8
bun run security:framework
bun run sbom
bun run benchmark:framework
bun run validate:staging
bun run check