WRNexusJS/CHANGELOG.md

# Changelog

## Unreleased

- Added framework-owned authentication and authorization integration: lazy auth stores,
  configured OAuth routes with cookie-bound transactions, production configuration validation,
  default lifecycle roles, typed request users, declarative API permissions, page guards, and
  consistent unauthorized/forbidden responses.
- Added reusable application primitives for typed route params, bounded cursor pagination,
  owned-resource authorization, atomic database state transitions, queue batching and explicit
  worker lifecycles.
- Expanded `@wrnexus/test` with official typed contexts, Bun-compatible fetch mocking and a
  full-stack harness alias; made generated files deterministic and introduced `wrnexus check` as
  the canonical build-before-check command for generated applications.

- Fixed `v.boolean()` coercion in `@wrnexus/validation` (`checkField` in both `src/index.ts`
  and the browser mirror in `src/runtime.ts`): previously any string other than `"true"` or
  `"on"` silently coerced to `false` with no error, so typos and unrecognised values (e.g.
  `"yes"`, `"1"`, `"TRUE"`, `"treu"`) passed validation as a silent, wrong `false`. Now
  recognised true strings (`"true"`, `"on"`, `"1"`, `"yes"`, case-insensitive and trimmed) and
  false strings (`"false"`, `"off"`, `"0"`, `"no"`) coerce as expected, numeric `1`/`0` coerce
  (for JSON payloads), and absent/empty input (`undefined`/`null`/`""`) still coerces to
  `false` exactly as before (unchanged HTML-checkbox semantics). **Behavior change for
  downstream apps:** any other value — an unrecognised string, an object, an array — is now a
  type error (`desc.typeMessage` or "Must be true or false") instead of a silent `false`. A
  required boolean field given `false` still errors, as before (checkbox-required semantics
  are unchanged). A repo-wide search of `packages/`, `examples/`, and `services/` found no
  existing `v.boolean()` usage that feeds an unrecognised value, so no call sites are expected
  to start failing.

- Fixed `defineEndpoint` (`@wrnexus/core`) so routes invoked through the real HTTP router
  (which calls handlers as `handler(ctx)`, with no second argument) actually receive their
  request input: it now parses query parameters for GET/HEAD and the JSON body otherwise
  when no input is passed explicitly. Previously such endpoints silently validated
  `undefined`, so an `input` schema with only optional fields passed vacuously regardless of
  what was sent. **Behavior change for downstream apps:** a request that previously passed
  vacuous validation on a `defineEndpoint` route can now legitimately fail (400
  `VALIDATION_ERROR`) if it does not actually satisfy the schema. Explicitly passing a second
  argument (e.g. from a unit test or an internal caller) is unaffected and still takes
  priority over reading the request.

## 0.8.8

- Added the framework request context to `.wrn` language-server type environments.
- Kept workspace type declarations inside runnable apps during updates.
- Regenerated lint-safe application declarations before update verification.

All notable framework changes are recorded here. Every release must also include an idempotent
entry in the CLI migration registry.

## 0.8.3 - 2026-08-03

- Bundled hydrated browser modules so package aliases and filesystem imports do not leak into
  browser-native modules.
- Fixed SSR computed values, Async branch aliases, typed object props in loops, reactive route
  state, loader invalidation, realtime identity isolation, and client-function hydration.
- Fixed template-literal parsing in the reactive fallback evaluator and removed the unsupported
  default `unload` Permissions Policy directive.
- Made official package components compatible with strict explicit imports and added regression
  coverage for the TeamSpace application failures.
- Fixed Bun 1.3.14 and TypeScript 5.9 release-gate compatibility in client bundling, alias
  resolution, and Happy DOM event tests.
- Fixed ESLint compatibility in Node release scripts by declaring Node globals and using explicit
  regex space quantifiers.
- Fixed package component import validation after workspace installation by excluding generated and
  dependency directories such as nested `node_modules` from first-party source scans.
- Made the VS Code embedded compiler freshness check deterministic across TypeScript patch
  versions, Windows/Linux line endings, and workspace environments by verifying normalized source
  and generator fingerprints while retaining exact-output checks for the same TypeScript version.
- Fixed the VS Code language-server bundle so it executes under Node instead of exiting after
  defining an uninvoked Bun CommonJS wrapper, and added request-level crash containment.
- Scoped HTML diagnostics to `view` blocks, ignored TypeScript generic syntax and WRN expressions,
  and preserved JavaScript-looking documentation inside `<pre><code>` examples.
- Fixed formatter corruption of preformatted examples, balanced compact sibling markup, long bare
  tags, and repeated format-on-save indentation drift.
- Fixed component prop intelligence for dynamic boolean/union expressions, boolean string literals,
  literal-union runtime types, and reserved prop names such as `class`.
- Prevented bundled editor type checking from publishing TypeScript standard-library path failures or
  unmapped synthetic virtual-document diagnostics.
- Fixed language-server virtual TypeScript inference for untyped dynamic handler parameters and
  indexed output dispatch, while retaining strict diagnostics for explicitly typed parameters.
- Made bundled editor type checking resolve TypeScript standard libraries from the active workspace,
  and added a regression test that proves semantic diagnostics are actually running.
- Fixed final release-gate lint failures by removing the obsolete editor `stripComments` helper and
  importing Node `Buffer` explicitly in the language-server bundle generator.
- Reviewed the UI visual-contract change caused only by corrected `AuthForm.wrn` indentation and
  regenerated the 0.8 baseline after confirming no rendered component behavior changed.

## 0.8.0 - 2026-08-02

- Added package-owned helper and component kits across all 39 framework packages.
- Added standalone realtime and package-aware auth, i18n, image, uploader, validation, JWT,
  encryption, database, and CAPTCHA improvements.
- Added whole-application WRN syntax, import, and formatting modernization to the CLI update.
- Added Windows/Linux CI, read-only package audits, governance documents, and security gates.