page wrnexussecurity {
  seo {
    title = "@wrnexus/security"
    description = "Security headers, CSRF protection, rate limits, and safe rendering."
  }

  view {
    <div class="docs-shell">
      <a href="#main" class="skip-link">Skip to content</a>
      <header class="topbar">
        <a class="brand" href="/"><span>W</span> WRNexusJS</a>
        <nav aria-label="Primary"><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a></nav>
        <div class="topbar-actions"><a class="preview-pill" href="/access">Private preview · v0.8.1</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div>
      </header>
      <div class="mobile-doc-nav"><details><summary>Browse documentation</summary><nav><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a><a href="/tutorial">Tutorial</a><a href="/guides/project-structure">Guides</a><a href="/examples">Examples</a><a href="/search">Search</a></nav></details></div>
      <main class="portal-main docs-layout">
      <article id="main" class="documentation prose standalone package-document"><nav class="breadcrumbs" aria-label="Breadcrumb"><a href="/">Home</a><span>/</span><a href="/packages">Packages</a><span>/</span><span aria-current="page">@wrnexus/security</span></nav><section class="doc-intro"><span class="eyebrow">Security · Package reference</span><h1>@wrnexus/security</h1><p>Security headers, CSRF protection, rate limits, and safe rendering.</p><div class="doc-meta"><span>v0.8.1</span><span>Private registry</span><span>Security</span></div><section id="access" class="access-callout"><h2>Install the package</h2><p>After WorkRoot approves private registry access, install the release-aligned package:</p><pre><code>bun add @wrnexus/security@0.8.1</code><button type="button" class="copy-button" aria-label="Copy installation command">Copy</button></pre><p><a href="/access">Request preview access</a>. Never put registry tokens in source control.</p></section></section><section id="guide"><p>Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.</p>
<pre data-language="ts"><code>import &#123; safeFetch, securityPreset, setSecureCookie &#125; from &quot;@wrnexus/security&quot;;

export default &#123; security: securityPreset(&quot;strict&quot;) &#125;;
const response = await safeFetch(remoteUrl, &#123; allowedHosts: [&quot;api.example.com&quot;] &#125;);
setSecureCookie(ctx, &quot;__Host-session&quot;, sessionId);</code></pre></section><section id="api" class="api"><h2>Complete TypeScript API</h2><p>Generated from the exact installed package declarations.</p><pre data-language="typescript"><code>export &#123; S as SafeFetchOptions, a as SafeUrlPolicy, i as isPrivateAddress, b as isSafeUrl, s as safeFetch, c as sanitizeUrl, v as validateUrl &#125; from './fetch-DNyX0J_D.js';
export &#123; SecureSerializeOptions, secureJsonStringify, serializeForHtml &#125; from './serialization.js';
import &#123; CookieOptions, Context, RequestLimitsConfig, Middleware, SecurityConfig &#125; from '@wrnexus/core';
export &#123; TrustedHtmlPolicy, TrustedHtmlValue, createTrustedHtml, isTrustedHtml, unwrapTrustedHtml &#125; from './trusted-html.js';

declare class SecurityError extends Error &#123;
    readonly code: string;
    readonly status: number;
    constructor(code: string, message: string, status?: number, options?: ErrorOptions);
&#125;

interface SafeObjectOptions &#123;
    maxDepth?: number;
    maxKeys?: number;
    allowInstances?: boolean;
&#125;
declare function isDangerousObjectKey(key: string): boolean;
declare function assertSafeObject(value: unknown, options?: SafeObjectOptions): void;
declare function safeMerge&lt;T extends Record&lt;string, unknown&gt;&gt;(target: T, ...sources: Array&lt;Record&lt;string, unknown&gt; | undefined | null&gt;): T;

interface SecureCookieOptions extends CookieOptions &#123;
    hostOnly?: boolean;
&#125;
declare function secureCookieOptions(ctx: Pick&lt;Context, &quot;url&quot;&gt;, options?: SecureCookieOptions): CookieOptions;
declare function setSecureCookie(ctx: Pick&lt;Context, &quot;url&quot; | &quot;cookies&quot;&gt;, name: string, value: string, options?: SecureCookieOptions): void;

type RequestHardeningOptions = RequestLimitsConfig;
declare function requestHardening(options?: RequestHardeningOptions): Middleware;

type SecurityPreset = &quot;balanced&quot; | &quot;strict&quot; | &quot;api&quot;;
declare function securityPreset(preset?: SecurityPreset): SecurityConfig;

export &#123; type RequestHardeningOptions, type SafeObjectOptions, type SecureCookieOptions, SecurityError, type SecurityPreset, assertSafeObject, isDangerousObjectKey, requestHardening, safeMerge, secureCookieOptions, securityPreset, setSecureCookie &#125;;
</code></pre></section><section id="examples" class="examples"><h2>Examples</h2><p>Copy-ready examples from the installed package documentation.</p><div class="example-grid"><article class="example-card"><h3>Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.</h3><pre data-language="ts"><code>import &#123; safeFetch, securityPreset, setSecureCookie &#125; from &quot;@wrnexus/security&quot;;

export default &#123; security: securityPreset(&quot;strict&quot;) &#125;;
const response = await safeFetch(remoteUrl, &#123; allowedHosts: [&quot;api.example.com&quot;] &#125;);
setSecureCookie(ctx, &quot;__Host-session&quot;, sessionId);</code></pre></article><article class="example-card"><h3>Install @wrnexus/security</h3><pre data-language="sh"><code>bun add @wrnexus/security</code></pre></article></div></section></article>
      <aside class="on-this-page"><h2>On this page</h2><nav><a class="toc-level-2" href="#guide">Guide</a><a class="toc-level-2" href="#api">Complete API</a><a class="toc-level-2" href="#examples">Examples</a></nav></aside>
    </main>
      <footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.8.1</strong><span>Complete API documentation generated from installed package declarations.</span></p></div><nav aria-label="Footer"><a href="/packages">All packages</a><a href="/getting-started">Get started</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Private Developer Preview · Bun-native</p></footer>
    </div>
  }
}
