Page not found
The address may be outdated or misspelled. No private or duplicate route is exposed here.
The address may be outdated or misspelled. No private or duplicate route is exposed here.
The address may be outdated or misspelled. No private or duplicate route is exposed here.
WRNexusJS 0.8.7 packages are not available from the public npm registry. Installation requires approval and private registry credentials supplied by WorkRoot. Never paste registry tokens into source control, issue reports, or support messages.
bunx @wrnexus/cli@0.8.7 create my-appAccess approval, response time, licensing terms, and support level remain owner-controlled. This site does not collect access requests directly.
WRNexusJS 0.8.7 packages are not available from the public npm registry. Installation requires approval and private registry credentials supplied by WorkRoot. Never paste registry tokens into source control, issue reports, or support messages.
bunx @wrnexus/cli@0.8.7 create my-appAccess approval, response time, licensing terms, and support level remain owner-controlled. This site does not collect access requests directly.
WRNexusJS is Bun-native and SSR-first. File discovery maps pages and API handlers; middleware enriches or short-circuits a request; the compiler turns .wrn declarations into server render functions and small feature runtimes.
core owns contexts, middleware, sessions and rooms; router discovers routes; compiler parses .wrn; ssr renders documents; csr supplies browser runtimes; dev-server and cli orchestrate development and builds.
Validation happens at trust boundaries. Session authentication establishes identity; authorization makes resource decisions. CSP, Trusted Types, CSRF, upload checks, WebSocket origins, request limits, and output escaping are layered controls—not substitutes for application policy.
Rooms are process-local unless connected through pub/sub. Redis-backed pub/sub distributes events. Queue durability depends on the selected driver and must be evaluated explicitly.
The gateway can dispatch multiple applications while preserving route, component, asset, config, and session boundaries. Validate host routing and isolation before production.
wrnexus build . produces dist/server.js and hashed/static assets. Run the server with Bun, apply migrations before traffic, terminate TLS at a trusted edge, and forward only expected proxy headers.
Mobile compatibility bridges SSR-safe Capacitor capabilities; native route generation is experimental and is not general web portability. Test each target platform.
app/routes.gen.ts, .wrnexus/, and dist/ are generated. The runtime is Bun-only. Preview packages are private. Historical compatibility and long-term support policy are not yet published.
WRNexusJS is Bun-native and SSR-first. File discovery maps pages and API handlers; middleware enriches or short-circuits a request; the compiler turns .wrn declarations into server render functions and small feature runtimes.
core owns contexts, middleware, sessions and rooms; router discovers routes; compiler parses .wrn; ssr renders documents; csr supplies browser runtimes; dev-server and cli orchestrate development and builds.
Validation happens at trust boundaries. Session authentication establishes identity; authorization makes resource decisions. CSP, Trusted Types, CSRF, upload checks, WebSocket origins, request limits, and output escaping are layered controls—not substitutes for application policy.
Rooms are process-local unless connected through pub/sub. Redis-backed pub/sub distributes events. Queue durability depends on the selected driver and must be evaluated explicitly.
The gateway can dispatch multiple applications while preserving route, component, asset, config, and session boundaries. Validate host routing and isolation before production.
wrnexus build . produces dist/server.js and hashed/static assets. Run the server with Bun, apply migrations before traffic, terminate TLS at a trusted edge, and forward only expected proxy headers.
Mobile compatibility bridges SSR-safe Capacitor capabilities; native route generation is experimental and is not general web portability. Test each target platform.
app/routes.gen.ts, .wrnexus/, and dist/ are generated. The runtime is Bun-only. Preview packages are private. Historical compatibility and long-term support policy are not yet published.
No comparative speed claims are published. A valid baseline must record scripts, commit, Bun/framework versions, hardware, OS, warmup, samples, workload, raw results, median, percentiles, memory, HTML size, browser JavaScript size, and run date.
The roadmap starts with WRNexusJS-only measurements before any maintained equivalent-workload comparison.
No comparative speed claims are published. A valid baseline must record scripts, commit, Bun/framework versions, hardware, OS, warmup, samples, workload, raw results, median, percentiles, memory, HTML size, browser JavaScript size, and run date.
The roadmap starts with WRNexusJS-only measurements before any maintained equivalent-workload comparison.
Documentation is aligned to all 47 installed packages. This release adds @wrnexus/helpers, original-request URL helpers, safe login redirects, working wrnexus workspace add, and forward-auth redirect propagation.
Run wrnexus update --latest and keep every @wrnexus/* package on 0.8.7. Existing applications must explicitly add @wrnexus/helpers before importing it; newly scaffolded applications include it automatically.
The packages use semantic-looking versions, but a formal compatibility and old-release support policy has not been approved. Preview consumers should treat minor releases as potentially requiring migration review.
Documentation is aligned to all 47 installed packages. This release adds @wrnexus/helpers, original-request URL helpers, safe login redirects, working wrnexus workspace add, and forward-auth redirect propagation.
Run wrnexus update --latest and keep every @wrnexus/* package on 0.8.7. Existing applications must explicitly add @wrnexus/helpers before importing it; newly scaffolded applications include it automatically.
The packages use semantic-looking versions, but a formal compatibility and old-release support policy has not been approved. Preview consumers should treat minor releases as potentially requiring migration review.
Examples are tied to installed 0.8.7 package documentation. The focused snippets in guides are source-verified; standalone runnable projects and CI compilation are tracked as remaining work.
Examples are tied to installed 0.8.7 package documentation. The focused snippets in guides are source-verified; standalone runnable projects and CI compilation are tracked as remaining work.
This path creates a server-rendered page, validated API route, middleware, and realtime next step. It requires approved registry access and Bun 1.3.x; this site was verified with Bun 1.3.14.
bunx @wrnexus/cli@0.8.7 create my-app
+ Preview guide · v0.8.7Build a contact inbox
This path creates a server-rendered page, validated API route, middleware, and realtime next step. It requires approved registry access and Bun 1.3.x; this site was verified with Bun 1.3.14.
1. Create the project
bunx @wrnexus/cli@0.8.7 create my-app
cd my-app
bun install
bun run dev
2. Know the structure
app/pages/ # file-based .wrn routes
@@ -38,7 +45,7 @@ export const POST = async (ctx) => {
return next();
}
7. Test and ship
bun run test
bun run build
-bun dist/server.js
Next: deployment, database, authentication, and workspaces.
+bun dist/server.jsNext: deployment, database, authentication, and workspaces.
Export GET, POST, PUT, PATCH, or DELETE from app/api files. Validate request bodies, enforce authentication and authorization, cap request sizes, and return Web Responses.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Export GET, POST, PUT, PATCH, or DELETE from app/api files. Validate request bodies, enforce authentication and authorization, cap request sizes, and return Web Responses.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Configure session authentication, log users in through supported auth helpers, and read identity from context. Cookie flags, rotation, expiry, and secret storage remain deployment responsibilities.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure session authentication, log users in through supported auth helpers, and read identity from context. Cookie flags, rotation, expiry, and secret storage remain deployment responsibilities.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Authentication identifies; authorization decides. Enforce permissions in server routes and policies, including object ownership. UI hiding is never an authorization boundary.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Authentication identifies; authorization decides. Enforce permissions in server routes and policies, including object ownership. UI hiding is never an authorization boundary.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
wrnexus.config.ts owns styles, SEO, security, data, mobile, fonts, and profiles. Keep secrets in validated environment variables and review merged production configuration.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
wrnexus.config.ts owns styles, SEO, security, data, mobile, fonts, and profiles. Keep secrets in validated environment variables and review merged production configuration.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Configure SQLite or the installed supported driver, keep queries in named SQL blocks, generate typed functions, and apply migrations before traffic. Back up data and test rollback independently.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure SQLite or the installed supported driver, keep queries in named SQL blocks, generate typed functions, and apply migrations before traffic. Back up data and test rollback independently.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Run bun run build, apply migrations, and start dist/server.js with Bun. Configure TLS, proxy trust, environment validation, health checks, graceful restarts, logs, backups, and restrictive security headers.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Run bun run build, apply migrations, and start dist/server.js with Bun. Configure TLS, proxy trust, environment validation, health checks, graceful restarts, logs, backups, and restrictive security headers.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Define a v.object schema, use data-schema on the form, show field errors with data-error, and always call parseBody on the server. refine is server-only.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Define a v.object schema, use data-schema on the form, show field errors with data-error, and always call parseBody on the server. refine is server-only.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
This walkthrough builds a small team portal. Public visitors can read the home and pricing pages, users can sign in, and the dashboard separates ordinary members from administrators. Every authorization decision remains on the server.
+bunx @wrnexus/cli@0.8.7 create team-portal
+cd team-portal
+bun install
+bun add @wrnexus/auth @wrnexus/authz @wrnexus/db @wrnexus/validation @wrnexus/ui
+bunx wrnexus generate page pricing
+bunx wrnexus generate page login
+bunx wrnexus generate page dashboard
+bunx wrnexus generate api session/login
+bunx wrnexus generate api session/logout
+bunx wrnexus generate schema login
+bunx wrnexus authz init --dialect=sqlite
+bunx wrnexus db new initial_auth --from-models
+bunx wrnexus db migrate
+bunx wrnexus generate types .Expected success output includes created file paths, an initialized authorization catalog, the applied migration name, and the generated application declaration path.
+// wrnexus.config.ts
+import type { AppConfig } from "@wrnexus/styles";
+
+const config: AppConfig = {
+ seo: { title: "Team Portal", titleTemplate: "%s | Team Portal" },
+ theme: { default: "system", palette: "violet" },
+ security: {
+ contentSecurityPolicy: true,
+ csrf: true,
+ frameOptions: "deny",
+ },
+ profiles: {
+ development: { envFiles: [".env", ".env.development"] },
+ production: { envFiles: [".env", ".env.production"] },
+ },
+};
+
+export default config;# .env.example — commit names, never real secrets
+DATABASE_URL=sqlite:./data/team-portal.db
+SESSION_SECRET=replace-with-at-least-32-random-bytes
+APP_ORIGIN=http://localhost:3000Run wrnexus config . --explain --profile=production before deployment and confirm no development fallback or secret value is printed.
// app/layouts/public.wrn
+layout Public {
+ view {
+ <Navbar brand="Team Portal" />
+ <main><slot /></main>
+ <Footer copyright="Team Portal" />
+ }
+}
+
+// app/pages/index.wrn
+page Home {
+ layout = "public"
+ seo { title = "Home" description = "A secure portal for modern teams." }
+ view {
+ <Hero eyebrow="Team operations" title="One secure place for every team." />
+ <FeatureGrid columns="3"><slot /></FeatureGrid>
+ }
+}Create pricing.wrn, privacy.wrn, and terms.wrn with the same public layout. Public routes must not load private account data.
// app/schemas/login.ts
+import { v } from "@wrnexus/validation";
+export default v.object({
+ email: v.string().trim().email(),
+ password: v.string().min(12).max(128),
+});
+
+// app/api/session/login.ts
+import schema from "../../schemas/login";
+import { parseBody } from "@wrnexus/validation";
+
+export const POST = async (ctx) => {
+ const parsed = await parseBody(schema, ctx.req);
+ if (!parsed.ok) return parsed.response;
+ // Look up the account, verify its password, rotate the session,
+ // and return the same failure shape for unknown users and bad passwords.
+ return Response.json({ ok: true, redirect: "/dashboard" });
+};Use the exact installed authentication package API for account lookup, password verification, session rotation, rate limiting, and audit events. Do not copy placeholder authentication logic into production.
+// app/authz/main.ts
+export const permissions = [
+ "dashboard:read",
+ "member:read",
+ "member:invite",
+ "member:manage",
+] as const;
+
+export const roles = {
+ member: ["dashboard:read", "member:read"],
+ manager: ["dashboard:read", "member:read", "member:invite"],
+ admin: ["dashboard:read", "member:read", "member:invite", "member:manage"],
+} as const;bunx wrnexus authz generate
+bunx wrnexus authz list
+bunx wrnexus contracts snapshot .Expected output lists the four permission identifiers and generated authorization artifacts. Commit the contract snapshot so later permission drift is reviewable.
+// app/middleware/auth.ts
+export default async function requireUser(ctx, next) {
+ const user = await readAuthenticatedUser(ctx);
+ if (!user) return Response.redirect(new URL("/login", ctx.url), 303);
+ ctx.state.user = user;
+ return next();
+}
+
+// app/api/members.ts
+export const GET = async (ctx) => {
+ await requirePermission(ctx, "member:read");
+ return Response.json({ members: await listMembers(ctx.state.user.tenantId) });
+};
+
+export const POST = async (ctx) => {
+ await requirePermission(ctx, "member:invite");
+ // Validate input and keep the tenant identifier server-owned.
+ return Response.json({ ok: true }, { status: 201 });
+};Route middleware establishes identity; each API mutation still checks its exact permission and resource boundary. Hiding an Invite button is useful UX but never authorization.
+page Dashboard {
+ layout = "dashboard"
+ ssr {
+ api summary GET /api/dashboard { return summary }
+ api members GET /api/members { return members }
+ }
+ view {
+ <PageHeader eyebrow="Workspace" title="Dashboard" />
+ <MetricGrid columns="3">
+ <MetricCard label="Members" value={summary.memberCount} />
+ <MetricCard label="Invitations" value={summary.invitationCount} />
+ <MetricCard label="Active today" value={summary.activeToday} />
+ </MetricGrid>
+ <DataTable rows={members} />
+ }
+}Keep dashboard data tenant-scoped in the API. Server rendering prevents an empty shell, while the client receives only the modules required for interactive controls.
+bunx wrnexus typecheck .
+bunx wrnexus test unit .
+bunx wrnexus test api .
+bunx wrnexus test browser .
+bunx wrnexus security audit .
+bunx wrnexus contracts check .
+bunx wrnexus build .
+bunx wrnexus preview . --port=3000Tests should prove anonymous dashboard access redirects, members cannot invite, managers can invite but cannot manage roles, administrators can manage roles, cross-tenant identifiers are rejected, login failures are rate-limited, CSRF failures return 403, and the production server starts from dist/server.js.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Store locale JSON under app/locales and use translation directives. Themes resolve CSS tokens; ensure contrast, system preference behavior, persistence, and non-color cues.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Store locale JSON under app/locales and use translation directives. Themes resolve CSS tokens; ensure contrast, system preference behavior, persistence, and non-color cues.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Middleware receives context and next. Return next() to continue or return a Response to stop. Put request limits and trust-boundary controls before business logic.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Middleware receives context and next. Return next() to continue or return a Response to stop. Put request limits and trust-boundary controls before business logic.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Mobile capabilities are experimental in this preview. Test Capacitor permissions and lifecycle on each platform; do not assume every .wrn or browser API converts to native.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Mobile capabilities are experimental in this preview. Test Capacitor permissions and lifecycle on each platform; do not assume every .wrn or browser API converts to native.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Use tracking middleware and sinks with redaction, sampling, stable request identifiers, alert ownership, and retention limits. Never capture registry tokens or session secrets.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use tracking middleware and sinks with redaction, sampling, stable request identifiers, alert ownership, and retention limits. Never capture registry tokens or session secrets.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Pages are routable, components are reusable, and layouts provide shared slots. Mount a component with data-component and keep browser state scoped and minimal.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Pages are routable, components are reusable, and layouts provide shared slots. Mount a component with data-component and keep browser state scoped and minimal.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Pages, components, layouts, APIs, middleware, schemas, database files, locales, realtime rooms, and styles live under app. Never edit app/routes.gen.ts, .wrnexus, or dist by hand.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Pages, components, layouts, APIs, middleware, schemas, database files, locales, realtime rooms, and styles live under app. Never edit app/routes.gen.ts, .wrnexus, or dist by hand.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
The in-process driver cannot cross processes. Use Redis where instances must share events, define channel ownership, and design for reconnects and duplicate delivery.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
The in-process driver cannot cross processes. Use Redis where instances must share events, define channel ownership, and design for reconnects and duplicate delivery.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Queue behavior is preview-level. Treat in-process work as non-durable, make handlers idempotent, cap retries, record failures, and choose a production persistence strategy.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Queue behavior is preview-level. Treat in-process work as non-durable, make handlers idempotent, cap retries, record failures, and choose a production persistence strategy.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
defineRoom handles connection and messages. Validate message shapes, authorize subscriptions, restrict origins, bound payloads, and use pub/sub to scale across processes.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
defineRoom handles connection and messages. Validate message shapes, authorize subscriptions, restrict origins, bound payloads, and use pub/sub to scale across processes.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
A page filename defines its URL; index maps to the directory root and bracket segments are dynamic parameters. API files under app/api expose HTTP method functions and receive a Context.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
A page filename defines its URL; index maps to the directory root and bracket segments are dynamic parameters. API files under app/api expose HTTP method functions and receive a Context.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Use CSP, CSRF, Trusted Types, session hardening, validation, origin checks, upload restrictions, encryption, request limits, and explicit CORS. See the security policy for reporting.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use CSP, CSRF, Trusted Types, session hardening, validation, origin checks, upload restrictions, encryption, request limits, and explicit CORS. See the security policy for reporting.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Use an ssr API binding, return the desired response field, and render it with a server #each block. Values are escaped. Avoid fetching private data through a route that lacks authorization.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use an ssr API binding, return the desired response field, and render it with a server #each block. Values are escaped. Avoid fetching private data through a route that lacks authorization.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Use Bun tests and @wrnexus/test helpers. Cover server HTML, API status and validation, authorization failures, reactive behavior, and a production startup smoke test.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use Bun tests and @wrnexus/test helpers. Cover server HTML, API status and validation, authorization failures, reactive behavior, and a production startup smoke test.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Confirm Bun and package versions, regenerate docs/routes through supported commands, read the first compiler diagnostic, check file naming, validate config, and reproduce under a production build.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Confirm Bun and package versions, regenerate docs/routes through supported commands, read the first compiler diagnostic, check file naming, validate config, and reproduce under a production build.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Back up and commit first, then use wrnexus update --latest as documented by the installed CLI. Review migrations and keep every @wrnexus package aligned. Current release: 0.8.7.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Back up and commit first, then use wrnexus update --latest as documented by the installed CLI. Review migrations and keep every @wrnexus package aligned. Current release: 0.8.7.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
Configure named stores, accepted MIME/extensions, and maxBytes. Random keys avoid path traversal. Private files require an authenticated serving route; v1 buffers each file in memory.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure named stores, accepted MIME/extensions, and maxBytes. Random keys avoid path traversal. Private files require an authenticated serving route; v1 buffers each file in memory.
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
A workspace runs isolated applications behind one domain-routing gateway. Add an application from the workspace root; the CLI scaffolds apps/reports and registers it in wrnexus.workspace.ts:
wrnexus workspace add reports --domain=reports.localhost
+ Preview guide · 0.8.7Workspaces and gateway
A workspace runs isolated applications behind one domain-routing gateway. Add an application from the workspace root; the CLI scaffolds apps/reports and registers it in wrnexus.workspace.ts:
wrnexus workspace add reports --domain=reports.localhost
bun install
-bun run dev
Forward authentication
Point protected applications at a dedicated verifier endpoint. The verifier must return 2xx for an authenticated session, 401/403 to deny access, or an HTTP redirect to begin browser login.
// wrnexus.workspace.ts
+bun run dev
Forward authentication
Point protected applications at a dedicated verifier endpoint. The verifier must return 2xx for an authenticated session, 401/403 to deny access, or an HTTP redirect to begin browser login.
// wrnexus.workspace.ts
{
name: "admin",
dir: "apps/admin",
@@ -28,7 +35,10 @@ export const GET = async (ctx: Context) => {
return redirectToLogin(ctx, "/login", {
allowedHosts: ["admin.localhost:3000", "reports.localhost:3000"],
});
-};
Always allowlist redirect hosts. After login, validate or sign the returnTo value before redirecting. Keep internal app ports private and open applications through the gateway port.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
+};Always allowlist redirect hosts. After login, validate or sign the returnTo value before redirecting. Keep internal app ports private and open applications through the gateway port.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus inspect routes .
+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
- Inputs are validated at the authoritative server boundary.
- Authentication and resource authorization are tested independently.
- Generated routes and application types are current.
- Error, empty, loading, denied, and success states are documented.
- The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
.wrn languagepage Account {
+ Language reference · 0.8.7The .wrn language
File anatomy
page Account {
layout = "public"
seo { title = "Account" description = "Manage your account." }
state count = 0
view { <button @click="count++">Count {count}</button> }
-}
Pages, components, layouts, props, and state
Pages are routes. Components declare default-valued props and may hold state. Layouts provide shared slots. Mount components with data-component; fill default or named slots with data-slot.
Interpolation, conditionals, and loops
Interpolation is HTML-escaped. Use server {#if} and {#each} for SSR data. Use data-show for reactive client visibility.
Events and directives
@click and other events execute in the reactive scope. Data attributes opt into forms, i18n, themes, realtime, uploader, browser, and mobile behavior. Consult the exact package page because availability varies.
Forms, i18n, themes, and realtime
form[data-schema] connects descriptors to client and server validation. Translation keys use {t:key}. Theme toggles use data-wire-theme-toggle. Realtime pages opt into a named room.
Escaping and security
Text interpolation is escaped by default. Do not construct trusted HTML from user input. Server-only refinements must be repeated at the authoritative mutation boundary.
Common compiler errors
- Use balanced braces; a literal brace must be escaped.
- Declare UI in
view, not JSX or hooks. - Use a valid page, component, or layout declaration matching the file role.
- Keep server loops tied to available SSR bindings.
- Check troubleshooting and compiler API for this release.
+}Pages, components, layouts, props, and state
Pages are routes. Components declare default-valued props and may hold state. Layouts provide shared slots. Mount components with data-component; fill default or named slots with data-slot.
Interpolation, conditionals, and loops
Interpolation is HTML-escaped. Use server {#if} and {#each} for SSR data. Use data-show for reactive client visibility.
Events and directives
@click and other events execute in the reactive scope. Data attributes opt into forms, i18n, themes, realtime, uploader, browser, and mobile behavior. Consult the exact package page because availability varies.
Forms, i18n, themes, and realtime
form[data-schema] connects descriptors to client and server validation. Translation keys use {t:key}. Theme toggles use data-wire-theme-toggle. Realtime pages opt into a named room.
Escaping and security
Text interpolation is escaped by default. Do not construct trusted HTML from user input. Server-only refinements must be repeated at the authoritative mutation boundary.
Common compiler errors
- Use balanced braces; a literal brace must be escaped.
- Declare UI in
view, not JSX or hooks. - Use a valid page, component, or layout declaration matching the file role.
- Keep server loops tied to available SSR bindings.
- Check troubleshooting and compiler API for this release.
This documentation repository contains no public license file, and the packages are unavailable from the public npm registry. No open-source license or redistribution right should be inferred.
Approved preview users must follow the private/commercial terms supplied by WorkRoot. Contact WorkRoot before copying, redistributing, or using WRNexusJS in production.
This documentation repository contains no public license file, and the packages are unavailable from the public npm registry. No open-source license or redistribution right should be inferred.
Approved preview users must follow the private/commercial terms supplied by WorkRoot. Contact WorkRoot before copying, redistributing, or using WRNexusJS in production.
Released 2026-07-13. All 47 installed packages are aligned to this version. Highlights include the new helpers package, reliable workspace app addition, and browser SSO redirects through forward authentication. See the changelog, upgrade guide, and package references.
Released 2026-07-13. All 47 installed packages are aligned to this version. Highlights include the new helpers package, reliable workspace app addition, and browser SSO redirects through forward authentication. See the changelog, upgrade guide, and package references.
Roadmap items are direction, not delivery commitments. Dates require explicit owner approval.
Roadmap items are direction, not delivery commitments. Dates require explicit owner approval.
This build-time index is local and sends no query to a third party. Use your browser’s find command to filter this compact index.
Get started · Packages · Components · Language · Architecture
Project structure · Routing · Pages and components · Server data · API routes · Middleware · Forms and validation · Authentication · Authorization · Application security · Database · Uploads · Realtime · Pub/sub · Queues · Testing · Workspaces and gateway · Deployment · Configuration and profiles · Internationalization and themes · Mobile · Observability · Upgrading · Troubleshooting
@wrnexus/ai · @wrnexus/authz · @wrnexus/compiler · @wrnexus/core · @wrnexus/csr · @wrnexus/db · @wrnexus/dev-server · @wrnexus/encryption · @wrnexus/helpers · @wrnexus/i18n · @wrnexus/jwt · @wrnexus/mobile · @wrnexus/native · @wrnexus/oauth · @wrnexus/pubsub · @wrnexus/queue · @wrnexus/reactive · @wrnexus/router · @wrnexus/ssr · @wrnexus/styles · @wrnexus/test · @wrnexus/tracking · @wrnexus/ui · @wrnexus/uploader · @wrnexus/validation · @wrnexus/dev-toolbar · @wrnexus/syntax · @wrnexus/plugin · @wrnexus/captcha · @wrnexus/auth · @wrnexus/store · @wrnexus/typecheck · @wrnexus/security · @wrnexus/cache · @wrnexus/image · @wrnexus/observability · @wrnexus/benchmark · @wrnexus/realtime · @wrnexus/content · @wrnexus/graphql · @wrnexus/identity · @wrnexus/language-server · @wrnexus/mcp · @wrnexus/playground · @wrnexus/pwa · @wrnexus/rpc · @wrnexus/cli
This build-time index is local and sends no query to a third party. Use your browser’s find command to filter this compact index.
Get started · Packages · Components · Language · Architecture
Project structure · Routing · Pages and components · Server data · API routes · Middleware · Forms and validation · Authentication · Authorization · Application security · Database · Uploads · Realtime · Pub/sub · Queues · Testing · Workspaces and gateway · Deployment · Configuration and profiles · Internationalization and themes · Mobile · Observability · Upgrading · Troubleshooting · Auth and permissions dashboard demo
@wrnexus/ai · @wrnexus/authz · @wrnexus/compiler · @wrnexus/core · @wrnexus/csr · @wrnexus/db · @wrnexus/dev-server · @wrnexus/encryption · @wrnexus/helpers · @wrnexus/i18n · @wrnexus/jwt · @wrnexus/mobile · @wrnexus/native · @wrnexus/oauth · @wrnexus/pubsub · @wrnexus/queue · @wrnexus/reactive · @wrnexus/router · @wrnexus/ssr · @wrnexus/styles · @wrnexus/test · @wrnexus/tracking · @wrnexus/ui · @wrnexus/uploader · @wrnexus/validation · @wrnexus/dev-toolbar · @wrnexus/syntax · @wrnexus/plugin · @wrnexus/captcha · @wrnexus/auth · @wrnexus/store · @wrnexus/typecheck · @wrnexus/security · @wrnexus/cache · @wrnexus/image · @wrnexus/observability · @wrnexus/benchmark · @wrnexus/realtime · @wrnexus/content · @wrnexus/graphql · @wrnexus/identity · @wrnexus/language-server · @wrnexus/mcp · @wrnexus/playground · @wrnexus/pwa · @wrnexus/rpc · @wrnexus/cli
WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.
Only the current private-preview release 0.8.7 is documented here. A formal old-release support window is not yet published.
Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.
Use restrictive CSP and permissions policies, HSTS only on HTTPS production origins, MIME sniffing protection, restrictive referrers, explicit CORS, secure cookies, CSRF validation, request limits, and origin checks. See application security.
WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.
Only the current private-preview release 0.8.7 is documented here. A formal old-release support window is not yet published.
Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.
Use restrictive CSP and permissions policies, HSTS only on HTTPS production origins, MIME sniffing protection, restrictive referrers, explicit CORS, secure cookies, CSRF validation, request limits, and origin checks. See application security.
Only confirmed public properties are listed; no customer or traffic claims are made.
Creator/company site demonstrating a public WRNexusJS deployment. Exact deployed version and infrastructure notes await owner confirmation.
This documentation portal, built and verified against WRNexusJS 0.8.7 on Bun.
Screenshots are intentionally deferred until approved assets and alt text are available.
Only confirmed public properties are listed; no customer or traffic claims are made.
Creator/company site demonstrating a public WRNexusJS deployment. Exact deployed version and infrastructure notes await owner confirmation.
This documentation portal, built and verified against WRNexusJS 0.8.7 on Bun.
Screenshots are intentionally deferred until approved assets and alt text are available.
WRNexusJS has no public Discord, public issue tracker, or guaranteed community support channel listed by this repository. Preview access and support begin through WorkRoot’s public contact path.
Include WRNexusJS version, Bun version, OS, a minimal reproduction, expected and actual behavior, and sanitized logs. Never include registry tokens, credentials, session cookies, or private data.
Support scope, service levels, and commercial terms require owner confirmation.
WRNexusJS has no public Discord, public issue tracker, or guaranteed community support channel listed by this repository. Preview access and support begin through WorkRoot’s public contact path.
Include WRNexusJS version, Bun version, OS, a minimal reproduction, expected and actual behavior, and sanitized logs. Never include registry tokens, credentials, session cookies, or private data.
Support scope, service levels, and commercial terms require owner confirmation.
This tutorial connects the installed 0.8.7 APIs into one design. Snippets are limited to declarations and README patterns verified in the installed packages; a CI-compiled standalone fixture remains on the roadmap.
A .wrn page renders tasks from an SSR API binding. A shared validation schema protects mutations. Session middleware identifies users, authorization policies gate updates, and a realtime room broadcasts changes.
import { v, parseBody } from "@wrnexus/validation";
+ Preview · runnable-project extraction pendingSecure task board
This tutorial connects the installed 0.8.7 APIs into one design. Snippets are limited to declarations and README patterns verified in the installed packages; a CI-compiled standalone fixture remains on the roadmap.
Application shape
A .wrn page renders tasks from an SSR API binding. A shared validation schema protects mutations. Session middleware identifies users, authorization policies gate updates, and a realtime room broadcasts changes.
Schema and create route
import { v, parseBody } from "@wrnexus/validation";
const task = v.object({ title: v.string().trim().min(3).max(120) });
export const POST = async (ctx) => {
const parsed = await parseBody(task, ctx.req);
if (!parsed.ok) return parsed.response;
return Response.json({ ok: true, task: parsed.value }, { status: 201 });
-};
Server-rendered list
page Tasks {
+};
Server-rendered list
page Tasks {
ssr { api tasks GET /api/tasks { return tasks } }
view {
<main><h1>Tasks</h1><ul>
{#each tasks as task}<li>{task.title}</li>{:empty}<li>No tasks yet.</li>{/each}
</ul></main>
}
-}
Production checklist
- Choose SQLite for local development or configure the supported PostgreSQL driver.
- Run migrations before accepting traffic.
- Enable session authentication and enforce authorization on every mutation.
- Validate upload types and sizes; keep private objects behind authenticated routes.
- Use Redis pub/sub when realtime rooms span processes.
- Treat the default queue as non-durable until a production driver is selected.
Follow the focused database, authentication, authorization, realtime, and upload guides.
+}Production checklist
- Choose SQLite for local development or configure the supported PostgreSQL driver.
- Run migrations before accepting traffic.
- Enable session authentication and enforce authorization on every mutation.
- Validate upload types and sizes; keep private objects behind authenticated routes.
- Use Redis pub/sub when realtime rooms span processes.
- Treat the default queue as non-durable until a production driver is selected.
Follow the focused database, authentication, authorization, realtime, and upload guides.
This walkthrough builds a small team portal. Public visitors can read the home and pricing pages, users can sign in, and the dashboard separates ordinary members from administrators. Every authorization decision remains on the server.
+Expected success output includes created file paths, an initialized authorization catalog, the applied migration name, and the generated application declaration path.
+Run wrnexus config . --explain --profile=production before deployment and confirm no development fallback or secret value is printed.
Create pricing.wrn, privacy.wrn, and terms.wrn with the same public layout. Public routes must not load private account data.
Use the exact installed authentication package API for account lookup, password verification, session rotation, rate limiting, and audit events. Do not copy placeholder authentication logic into production.
+Expected output lists the four permission identifiers and generated authorization artifacts. Commit the contract snapshot so later permission drift is reviewable.
+Route middleware establishes identity; each API mutation still checks its exact permission and resource boundary. Hiding an Invite button is useful UX but never authorization.
+Keep dashboard data tenant-scoped in the API. Server rendering prevents an empty shell, while the client receives only the modules required for interactive controls.
+Tests should prove anonymous dashboard access redirects, members cannot invite, managers can invite but cannot manage roles, administrators can manage roles, cross-tenant identifiers are rejected, login failures are rate-limited, CSRF failures return 403, and the production server starts from dist/server.js.
${text}
`}This guide describes installed ${version} capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
${text}
`}Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
This guide describes installed ${version} capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support