docs: update portal for WRNexusJS 0.2.30

public/llms.txt

@@ -1,4 +1,4 @@
-# WRNexusJS documentation 0.2.29
+# WRNexusJS documentation 0.2.30
 
 Status: Private Developer Preview. This site documents 26 release-aligned packages.
 
@@ -281,7 +281,7 @@ wrnexus eject <component>     # copy a Wire UI component's .wrn into app/compone
 
 # Installed package documentation
 
-The following README files and declarations come from the installed private 0.2.29 release.
+The following README files and declarations come from the installed private 0.2.30 release.
 
 ## @wrnexus/ai
 
@@ -3654,9 +3654,18 @@ declare function createHandlers(deps: RuntimeDeps): Handlers;
  * reverse proxy for both HTTP and WebSocket. Apps talk to each other at runtime
  * via @wrnexus/pubsub (use the Redis driver so messages cross processes).
  */
-/** Per-app access control, enforced at the gateway before proxying. */
+type GatewayForwardAuth = ({
+    url: string;
+    app?: never;
+    path?: never;
+} | {
+    app: string;
+    path?: string;
+    url?: never;
+}) & {
+    headers?: string[];
+};
 interface GatewayAuth {
-    /** HTTP Basic auth — one or more allowed user/password pairs. */
     basic?: {
         user: string;
         pass: string;
@@ -3664,16 +3673,8 @@ interface GatewayAuth {
         user: string;
         pass: string;
     }>;
-    /** Allow only these client IPs (exact match; others get 403). */
     allowIps?: string[];
-    /**
-     * Forward-auth (SSO): the gateway GETs `url` forwarding the request's cookies +
-     * Authorization; a 2xx allows the request, anything else blocks it (its status
-     * is returned). Point it at your own verify endpoint.
-     */
-    forward?: {
-        url: string;
-    };
+    forward?: GatewayForwardAuth;
 }
 interface GatewayApp {
     /** App id (for logs). */