release: WRNexusJS 0.7.0
This commit is contained in:
+155
-28
@@ -10,11 +10,11 @@ page wrnexuscore {
|
||||
<header class="topbar">
|
||||
<a class="brand" href="/"><span>W</span> WRNexusJS</a>
|
||||
<nav aria-label="Primary"><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a></nav>
|
||||
<div class="topbar-actions"><a class="preview-pill" href="/access">Private preview · v0.6.0</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div>
|
||||
<div class="topbar-actions"><a class="preview-pill" href="/access">Private preview · v0.7.0</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div>
|
||||
</header>
|
||||
<div class="mobile-doc-nav"><details><summary>Browse documentation</summary><nav><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a><a href="/tutorial">Tutorial</a><a href="/guides/project-structure">Guides</a><a href="/examples">Examples</a><a href="/search">Search</a></nav></details></div>
|
||||
<main class="portal-main docs-layout">
|
||||
<article id="main" class="documentation prose standalone package-document"><nav class="breadcrumbs" aria-label="Breadcrumb"><a href="/">Home</a><span>/</span><a href="/packages">Packages</a><span>/</span><span aria-current="page">@wrnexus/core</span></nav><section class="doc-intro"><span class="eyebrow">Core · Package reference</span><h1>@wrnexus/core</h1><p>Contexts, middleware, security, sessions, caching, JSX, and realtime.</p><div class="doc-meta"><span>v0.6.0</span><span>Private registry</span><span>Core</span></div><section id="access" class="access-callout"><h2>Install the package</h2><p>After WorkRoot approves private registry access, install the release-aligned package:</p><pre><code>bun add @wrnexus/core@0.6.0</code><button type="button" class="copy-button" aria-label="Copy installation command">Copy</button></pre><p><a href="/access">Request preview access</a>. Never put registry tokens in source control.</p></section></section><section id="guide"><blockquote>The framework core: the request <code>Context</code>, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.</blockquote>
|
||||
<article id="main" class="documentation prose standalone package-document"><nav class="breadcrumbs" aria-label="Breadcrumb"><a href="/">Home</a><span>/</span><a href="/packages">Packages</a><span>/</span><span aria-current="page">@wrnexus/core</span></nav><section class="doc-intro"><span class="eyebrow">Core · Package reference</span><h1>@wrnexus/core</h1><p>Contexts, middleware, security, sessions, caching, JSX, and realtime.</p><div class="doc-meta"><span>v0.7.0</span><span>Private registry</span><span>Core</span></div><section id="access" class="access-callout"><h2>Install the package</h2><p>After WorkRoot approves private registry access, install the release-aligned package:</p><pre><code>bun add @wrnexus/core@0.7.0</code><button type="button" class="copy-button" aria-label="Copy installation command">Copy</button></pre><p><a href="/access">Request preview access</a>. Never put registry tokens in source control.</p></section></section><section id="guide"><blockquote>The framework core: the request <code>Context</code>, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.</blockquote>
|
||||
<p>Part of the <strong>WRNexusJS</strong> framework — an SSR-first, Bun-native full-stack web framework.</p>
|
||||
<h3 id="overview">Overview</h3>
|
||||
<p><code>@wrnexus/core</code> is the shared foundation of WRNexusJS. It defines the <code>Context</code> object that flows through every middleware, page, and API route, plus the <code>Middleware</code>/<code>Next</code> contract they implement. On top of that it ships the building blocks a real app needs: cookie-backed sessions, password auth, CSRF protection, rate limiting, request logging, HTTP + in-memory caching, file uploads, streaming/SSE responses, WebSocket "rooms", security headers/CORS, and a server-side JSX runtime that renders to HTML strings. Everything here is <strong>server-side</strong> and Bun-native (it uses <code>Bun.password</code>, <code>Bun.write</code>, the web-standard <code>Request</code>/<code>Response</code>, and <code>crypto</code>). You depend on it directly and transitively through the rest of the framework.</p>
|
||||
@@ -291,10 +291,21 @@ interface LocalStorageSnapshot {
|
||||
getAll(): Record<string, string>;
|
||||
has(key: string): boolean;
|
||||
}
|
||||
interface SessionPolicy {
|
||||
cookieName?: string;
|
||||
idleTimeoutMs?: number;
|
||||
absoluteTimeoutMs?: number;
|
||||
sameSite?: NonNullable<CookieOptions["sameSite"]>;
|
||||
secure?: boolean;
|
||||
}
|
||||
declare function setSessionPolicy(policy: SessionPolicy): void;
|
||||
/** A stored session: its data plus an absolute expiry timestamp (ms). */
|
||||
interface SessionEntry {
|
||||
data: Record<string, unknown>;
|
||||
expiresAt: number;
|
||||
/** Creation time used for the absolute session lifetime. Optional for old backends. */
|
||||
createdAt?: number;
|
||||
lastAccessAt?: number;
|
||||
}
|
||||
/**
|
||||
* Pluggable session persistence. The default is process-local memory; swap in a
|
||||
@@ -330,6 +341,10 @@ interface AsyncSessionBackend {
|
||||
*/
|
||||
declare function loadSession(backend: AsyncSessionBackend, options?: {
|
||||
ttlMs?: number;
|
||||
absoluteTtlMs?: number;
|
||||
cookieName?: string;
|
||||
sameSite?: NonNullable<CookieOptions["sameSite"]>;
|
||||
secure?: boolean;
|
||||
}): Middleware;
|
||||
|
||||
/**
|
||||
@@ -436,27 +451,26 @@ declare function isSafeIslandName(name: string): boolean;
|
||||
declare function isSafeRequestPath(pathname: string): boolean;
|
||||
|
||||
/**
|
||||
* CSRF protection via the double-submit cookie pattern.
|
||||
*
|
||||
* The framework sets a readable `wire-csrf` cookie on page loads; the client
|
||||
* echoes it in an `x-csrf-token` header on unsafe requests (the Wire UI form
|
||||
* runtime does this automatically). The server checks header === cookie. A
|
||||
* cross-site attacker can't read the cookie to forge the header, so the request
|
||||
* is rejected — while same-origin requests pass.
|
||||
* CSRF protection via the double-submit cookie pattern plus origin/fetch
|
||||
* metadata validation for unsafe requests.
|
||||
*/
|
||||
|
||||
declare const CSRF_COOKIE = "wire-csrf";
|
||||
declare const CSRF_HEADER = "x-csrf-token";
|
||||
interface CsrfProtectionOptions {
|
||||
/** Validate Origin when present. Defaults to true. */
|
||||
verifyOrigin?: boolean;
|
||||
/** Additional exact origins permitted for trusted cross-origin clients. */
|
||||
trustedOrigins?: string[];
|
||||
/** Reject Sec-Fetch-Site: cross-site on unsafe requests. Defaults to true. */
|
||||
verifyFetchMetadata?: boolean;
|
||||
}
|
||||
/** Ensure the CSRF cookie exists (readable by JS) and return its token. */
|
||||
declare function csrfToken(ctx: Context): string;
|
||||
/**
|
||||
* Verify an unsafe request's CSRF token against the cookie. Safe methods
|
||||
* (GET/HEAD/OPTIONS) always pass. The token may arrive in the `x-csrf-token`
|
||||
* header or a `_csrf` field already parsed onto `ctx.locals`.
|
||||
*/
|
||||
declare function verifyCsrf(ctx: Context): boolean;
|
||||
/** Middleware that 403s unsafe requests with a missing/mismatched CSRF token. */
|
||||
declare function csrfProtection(): Middleware;
|
||||
/** Verify an unsafe request's token, origin, and browser fetch metadata. */
|
||||
declare function verifyCsrf(ctx: Context, options?: CsrfProtectionOptions): boolean;
|
||||
/** Middleware that 403s unsafe requests with a missing/mismatched token. */
|
||||
declare function csrfProtection(options?: CsrfProtectionOptions): Middleware;
|
||||
|
||||
/**
|
||||
* Authentication primitives.
|
||||
@@ -614,6 +628,8 @@ interface CacheControlOptions {
|
||||
noCache?: boolean;
|
||||
/** stale-while-revalidate window in seconds. */
|
||||
staleWhileRevalidate?: number;
|
||||
/** stale-if-error window in seconds. */
|
||||
staleIfError?: number;
|
||||
immutable?: boolean;
|
||||
}
|
||||
/** Build a Cache-Control header value from options. */
|
||||
@@ -626,16 +642,37 @@ declare function etag(body: string | ArrayBuffer | Uint8Array, weak?: boolean):
|
||||
declare function notModified(req: Request, tag: string): boolean;
|
||||
|
||||
/**
|
||||
* File upload helpers. Bun parses `multipart/form-data` natively via
|
||||
* `Request.formData()`, yielding web `File` objects; these helpers validate and
|
||||
* persist them safely (size/type limits, filename sanitisation to prevent path
|
||||
* traversal).
|
||||
* File upload helpers. The legacy `saveUpload` keeps the original sanitized
|
||||
* filename for compatibility. New applications should use `saveUploadSecure`,
|
||||
* which stores a random name and supports content inspection/scanning hooks.
|
||||
*/
|
||||
declare class UploadError extends Error {
|
||||
constructor(message: string);
|
||||
readonly code: string;
|
||||
constructor(message: string, code?: string);
|
||||
}
|
||||
interface UploadInspectionResult {
|
||||
allowed: boolean;
|
||||
detectedType?: string;
|
||||
reason?: string;
|
||||
}
|
||||
type UploadInspector = (input: {
|
||||
file: File;
|
||||
bytes: Uint8Array;
|
||||
filename: string;
|
||||
}) => UploadInspectionResult | Promise<UploadInspectionResult>;
|
||||
type UploadScanner = (input: {
|
||||
file: File;
|
||||
bytes: Uint8Array;
|
||||
filename: string;
|
||||
}) => boolean | {
|
||||
clean: boolean;
|
||||
reason?: string;
|
||||
} | Promise<boolean | {
|
||||
clean: boolean;
|
||||
reason?: string;
|
||||
}>;
|
||||
interface SaveUploadOptions {
|
||||
/** Destination directory. */
|
||||
/** Destination directory. Keep this outside the public web root. */
|
||||
dir: string;
|
||||
/** Reject files larger than this many bytes. */
|
||||
maxBytes?: number;
|
||||
@@ -643,22 +680,48 @@ interface SaveUploadOptions {
|
||||
allowedTypes?: string[];
|
||||
/** Choose the stored filename. Default: the sanitised original name. */
|
||||
filename?: (file: File) => string;
|
||||
/** Content/magic-byte inspection hook. */
|
||||
inspect?: UploadInspector;
|
||||
/** Malware scanning hook. */
|
||||
scan?: UploadScanner;
|
||||
/** Called after validation but before persistence. */
|
||||
beforeSave?: (input: {
|
||||
file: File;
|
||||
bytes: Uint8Array;
|
||||
filename: string;
|
||||
}) => void | Promise<void>;
|
||||
}
|
||||
interface SecureUploadOptions extends Omit<SaveUploadOptions, "filename"> {
|
||||
/** Preserve the original sanitized name instead of a random server name. */
|
||||
preserveOriginalName?: boolean;
|
||||
/** Optional custom secure filename generator. */
|
||||
filename?: (file: File) => string;
|
||||
/** Preserve a conservative extension on random filenames. Defaults to true. */
|
||||
preserveExtension?: boolean;
|
||||
}
|
||||
interface SavedUpload {
|
||||
path: string;
|
||||
filename: string;
|
||||
size: number;
|
||||
type: string;
|
||||
detectedType?: string;
|
||||
}
|
||||
/** All `File` values in a parsed form, with their field names. */
|
||||
declare function collectUploads(form: FormData): {
|
||||
declare function collectUploads(form: FormData, options?: {
|
||||
maxFiles?: number;
|
||||
maxTotalBytes?: number;
|
||||
}): {
|
||||
field: string;
|
||||
file: File;
|
||||
}[];
|
||||
/** Validate and write one uploaded file to disk. Throws `UploadError` on reject. */
|
||||
/** Validate and write one uploaded file using a compatibility filename policy. */
|
||||
declare function saveUpload(file: File, options: SaveUploadOptions): Promise<SavedUpload>;
|
||||
/** Store an upload under a random server-generated name by default. */
|
||||
declare function saveUploadSecure(file: File, options: SecureUploadOptions): Promise<SavedUpload>;
|
||||
/** Strip directory separators, traversal, and control chars from a filename. */
|
||||
declare function sanitizeFilename(name: string): string;
|
||||
declare function randomUploadFilename(originalName?: string, preserveExtension?: boolean): string;
|
||||
declare function secureDownloadHeaders(filename: string, type?: string): Headers;
|
||||
|
||||
/**
|
||||
* Streaming response primitives.
|
||||
@@ -780,7 +843,27 @@ interface RoomAuthInfo {
|
||||
/** The upgrade request's headers (cookies, etc.). */
|
||||
headers: Headers;
|
||||
}
|
||||
interface RealtimeSecurityOptions {
|
||||
/** Maximum inbound or outbound serialized message size. Defaults to 64 KiB. */
|
||||
maxMessageBytes?: number;
|
||||
/** Maximum messages accepted per connection per rolling second. Defaults to 30. */
|
||||
maxMessagesPerSecond?: number;
|
||||
/** Maximum live connections in one room. Defaults to 1,000. */
|
||||
maxConnectionsPerRoom?: number;
|
||||
/** Maximum connections for one authenticated user in a room. Defaults to 10. */
|
||||
maxConnectionsPerUser?: number;
|
||||
/** Reject anonymous connections before onConnect. */
|
||||
requireUser?: boolean;
|
||||
/** Maximum nested JSON depth. Defaults to 32. */
|
||||
maxJsonDepth?: number;
|
||||
/** Optional message schema/authorization predicate. */
|
||||
validateMessage?(message: unknown, client: RoomClient): boolean | Promise<boolean>;
|
||||
/** Called when a connection is rejected or closed for a policy violation. */
|
||||
onViolation?(reason: string, client?: RoomClient): void;
|
||||
}
|
||||
interface RoomHandlers<TData = Record<string, unknown>> {
|
||||
/** Per-room abuse and payload controls. */
|
||||
security?: RealtimeSecurityOptions;
|
||||
/**
|
||||
* Gate the connection BEFORE it is accepted. Return false to reject the
|
||||
* upgrade with 403 (e.g. `authorize: (info) => !!info.user` to require auth).
|
||||
@@ -822,6 +905,9 @@ interface RealtimeEnvelope {
|
||||
interface RealtimeBridge {
|
||||
publish(envelope: RealtimeEnvelope): void;
|
||||
}
|
||||
interface RealtimeRegistryOptions extends RealtimeSecurityOptions {
|
||||
now?: () => number;
|
||||
}
|
||||
interface RealtimeRegistry {
|
||||
open(socket: RawSocket, meta: RealtimeConnectMeta): void | Promise<void>;
|
||||
message(socket: RawSocket, raw: string | Uint8Array): void | Promise<void>;
|
||||
@@ -834,7 +920,7 @@ interface RealtimeRegistry {
|
||||
size(): number;
|
||||
}
|
||||
/** Create the registry that maps sockets ↔ rooms and drives room handlers. */
|
||||
declare function createRealtimeRegistry(): RealtimeRegistry;
|
||||
declare function createRealtimeRegistry(options?: RealtimeRegistryOptions): RealtimeRegistry;
|
||||
/**
|
||||
* A minimal pub/sub bus (structurally satisfied by `@wrnexus/pubsub`). Used to
|
||||
* bridge realtime broadcasts across processes without a hard dependency.
|
||||
@@ -931,9 +1017,22 @@ interface TrustedTypesConfig {
|
||||
allowDuplicates?: boolean;
|
||||
}
|
||||
type PermissionsPolicyConfig = Record<string, string | string[] | false | null | undefined>;
|
||||
interface RequestLimitsConfig {
|
||||
maxUrlLength?: number;
|
||||
maxHeaderCount?: number;
|
||||
maxHeaderBytes?: number;
|
||||
maxQueryParameters?: number;
|
||||
maxBodyBytes?: number;
|
||||
timeoutMs?: number;
|
||||
maxConcurrent?: number;
|
||||
trustedHosts?: string[];
|
||||
fetchMetadata?: boolean;
|
||||
}
|
||||
interface SecurityConfig {
|
||||
/** Set false to skip all framework security headers except explicitly enabled CORS. */
|
||||
headers?: boolean;
|
||||
/** Built-in request size, timeout, concurrency, host, and Fetch Metadata limits. */
|
||||
requestLimits?: RequestLimitsConfig;
|
||||
/**
|
||||
* Trust `X-Forwarded-Proto` / `X-Forwarded-Host` when building `ctx.url` — set
|
||||
* this when the app runs behind a TLS-terminating reverse proxy (nginx, the
|
||||
@@ -952,6 +1051,12 @@ interface SecurityConfig {
|
||||
frameOptions?: false | "DENY" | "SAMEORIGIN";
|
||||
/** Defaults to "strict-origin-when-cross-origin". */
|
||||
referrerPolicy?: false | string;
|
||||
/** Defaults to "same-origin". */
|
||||
crossOriginResourcePolicy?: false | "same-origin" | "same-site" | "cross-origin";
|
||||
/** Isolate the origin in its own agent cluster. Defaults to true. */
|
||||
originAgentCluster?: boolean;
|
||||
/** Disable speculative DNS prefetching. Defaults to true. */
|
||||
disableDnsPrefetch?: boolean;
|
||||
/** Defaults to a restrictive browser capability policy. */
|
||||
permissionsPolicy?: false | PermissionsPolicyConfig;
|
||||
/** Extra static headers applied last. */
|
||||
@@ -1055,6 +1160,20 @@ interface PerformanceBudgets {
|
||||
imageBytes?: number;
|
||||
hydrationMs?: number;
|
||||
serverRenderMs?: number;
|
||||
/** Largest Contentful Paint in milliseconds. Recommended <= 2500. */
|
||||
lcpMs?: number;
|
||||
/** Interaction to Next Paint in milliseconds. Recommended <= 200. */
|
||||
inpMs?: number;
|
||||
/** Cumulative Layout Shift score. Recommended <= 0.1. */
|
||||
cls?: number;
|
||||
/** Time to First Byte in milliseconds. */
|
||||
ttfbMs?: number;
|
||||
/** Longest main-thread task in milliseconds. Recommended <= 50. */
|
||||
longTaskMs?: number;
|
||||
/** Number of client hydration boundaries on the route. */
|
||||
hydratedComponents?: number;
|
||||
/** Total request count for the initial navigation. */
|
||||
requests?: number;
|
||||
}
|
||||
interface PerformanceMeasurement {
|
||||
routeJsBytes?: number;
|
||||
@@ -1063,6 +1182,13 @@ interface PerformanceMeasurement {
|
||||
imageBytes?: number;
|
||||
hydrationMs?: number;
|
||||
serverRenderMs?: number;
|
||||
lcpMs?: number;
|
||||
inpMs?: number;
|
||||
cls?: number;
|
||||
ttfbMs?: number;
|
||||
longTaskMs?: number;
|
||||
hydratedComponents?: number;
|
||||
requests?: number;
|
||||
}
|
||||
interface BudgetViolation {
|
||||
metric: keyof PerformanceBudgets;
|
||||
@@ -1070,6 +1196,7 @@ interface BudgetViolation {
|
||||
actual: number;
|
||||
overBy: number;
|
||||
}
|
||||
declare const recommendedWebBudgets: Readonly<PerformanceBudgets>;
|
||||
declare function checkPerformanceBudgets(budgets: PerformanceBudgets, measurement: PerformanceMeasurement): BudgetViolation[];
|
||||
|
||||
interface ProblemDetails {
|
||||
@@ -1146,7 +1273,7 @@ declare function withIdempotency<T>(store: IdempotencyStore<T>, key:
|
||||
replayed: boolean;
|
||||
}>;
|
||||
|
||||
export { type ActionDefinition, ApplicationLifecycle, type AsyncSessionBackend, type Bucket, type BudgetViolation, CSRF_COOKIE, CSRF_HEADER, type CacheControlOptions, type CachePolicy, type ContentSecurityPolicyConfig, type Context, type CookieOptions, type CookieStore, type CorsConfig, type CorsOrigin, type CspDirectiveValue, type DefinedAction, type DefinedEndpoint, type DefinedLoader, type EndpointDefinition, EndpointError, type EndpointErrorBody, type FeatureFlags, type FeatureRule, type FeatureValue, type HealthCheck, type HealthCheckResult, HealthRegistry, type HstsConfig, type IdempotencyRecord, type IdempotencyStore, type LifecycleHandler, type LifecyclePhase, type LoaderDefinition, type LocalStorageSnapshot, type Middleware, type Mode, type Next, type PageComponent, type PageMeta, type PerformanceBudgets, type PerformanceMeasurement, type PermissionsPolicyConfig, type ProblemDetails, type ProblemDetailsInput, type RateLimitOptions, type RateLimitStore, type RawSocket, type RealtimeBridge, type RealtimeBus, type RealtimeConnectMeta, type RealtimeEnvelope, type RealtimeHandler, type RealtimeRegistry, type RealtimeSocket, type RequestLoggerOptions, type RequestRecord, type RequireAuthOptions, type Room, type RoomAuthInfo, type RoomClient, type RoomDefinition, type RoomHandlers, type RpcClientOptions, SESSION_USER_KEY, type SaveUploadOptions, type SavedUpload, type SchemaLike, type SecurityConfig, type SeoConfig, type ServerSentEvent, ServiceContainer, type ServiceToken, type SessionBackend, type SessionEntry, type SessionStore, type Span, type SpanRecord, type StreamResponseInit, type TFunction, TTLCache, type Target, type Tenant, type TenantMiddlewareOptions, type TenantResolver, type Tracer, type TrustedTypesConfig, UploadError, bridgeRealtime, cacheControl, checkPerformanceBudgets, collectUploads, createContext, createCorsPreflightResponse, createRealtimeRegistry, createRpcClient, createTracer, csrfProtection, csrfToken, dedupe, defaultKey, defineAction, defineEndpoint, defineFeatureFlags, defineLoader, defineRoom, escapeHtml, etag, getUser, hashPassword, isRoomDefinition, isSafeIslandName, isSafeRequestPath, isWebSocketOriginAllowed, loadSession, logIn, logOut, memoryIdempotencyStore, notModified, peerKey, problem, proxyKey, rateLimit, renderDevError, renderError, renderNotFound, renderProdError, renderStatusPage, requestId, requestLogger, requireAuth, requireTenant, resolveRequestUrl, sanitizeFilename, saveUpload, serviceToken, sessionAuth, setSessionBackend, sse, streamResponse, tenantFromSubdomain, tenantMiddleware, tenantScope, tracingMiddleware, verifyCsrf, verifyPassword, withCacheControl, withContextHeaders, withIdempotency, withSecurityHeaders, withSpan };
|
||||
export { type ActionDefinition, ApplicationLifecycle, type AsyncSessionBackend, type Bucket, type BudgetViolation, CSRF_COOKIE, CSRF_HEADER, type CacheControlOptions, type CachePolicy, type ContentSecurityPolicyConfig, type Context, type CookieOptions, type CookieStore, type CorsConfig, type CorsOrigin, type CspDirectiveValue, type CsrfProtectionOptions, type DefinedAction, type DefinedEndpoint, type DefinedLoader, type EndpointDefinition, EndpointError, type EndpointErrorBody, type FeatureFlags, type FeatureRule, type FeatureValue, type HealthCheck, type HealthCheckResult, HealthRegistry, type HstsConfig, type IdempotencyRecord, type IdempotencyStore, type LifecycleHandler, type LifecyclePhase, type LoaderDefinition, type LocalStorageSnapshot, type Middleware, type Mode, type Next, type PageComponent, type PageMeta, type PerformanceBudgets, type PerformanceMeasurement, type PermissionsPolicyConfig, type ProblemDetails, type ProblemDetailsInput, type RateLimitOptions, type RateLimitStore, type RawSocket, type RealtimeBridge, type RealtimeBus, type RealtimeConnectMeta, type RealtimeEnvelope, type RealtimeHandler, type RealtimeRegistry, type RealtimeRegistryOptions, type RealtimeSecurityOptions, type RealtimeSocket, type RequestLimitsConfig, type RequestLoggerOptions, type RequestRecord, type RequireAuthOptions, type Room, type RoomAuthInfo, type RoomClient, type RoomDefinition, type RoomHandlers, type RpcClientOptions, SESSION_USER_KEY, type SaveUploadOptions, type SavedUpload, type SchemaLike, type SecureUploadOptions, type SecurityConfig, type SeoConfig, type ServerSentEvent, ServiceContainer, type ServiceToken, type SessionBackend, type SessionEntry, type SessionPolicy, type SessionStore, type Span, type SpanRecord, type StreamResponseInit, type TFunction, TTLCache, type Target, type Tenant, type TenantMiddlewareOptions, type TenantResolver, type Tracer, type TrustedTypesConfig, UploadError, type UploadInspectionResult, type UploadInspector, type UploadScanner, bridgeRealtime, cacheControl, checkPerformanceBudgets, collectUploads, createContext, createCorsPreflightResponse, createRealtimeRegistry, createRpcClient, createTracer, csrfProtection, csrfToken, dedupe, defaultKey, defineAction, defineEndpoint, defineFeatureFlags, defineLoader, defineRoom, escapeHtml, etag, getUser, hashPassword, isRoomDefinition, isSafeIslandName, isSafeRequestPath, isWebSocketOriginAllowed, loadSession, logIn, logOut, memoryIdempotencyStore, notModified, peerKey, problem, proxyKey, randomUploadFilename, rateLimit, recommendedWebBudgets, renderDevError, renderError, renderNotFound, renderProdError, renderStatusPage, requestId, requestLogger, requireAuth, requireTenant, resolveRequestUrl, sanitizeFilename, saveUpload, saveUploadSecure, secureDownloadHeaders, serviceToken, sessionAuth, setSessionBackend, setSessionPolicy, sse, streamResponse, tenantFromSubdomain, tenantMiddleware, tenantScope, tracingMiddleware, verifyCsrf, verifyPassword, withCacheControl, withContextHeaders, withIdempotency, withSecurityHeaders, withSpan };
|
||||
</code></pre></section><section id="examples" class="examples"><h2>Examples</h2><p>Copy-ready examples from the installed package documentation.</p><div class="example-grid"><article class="example-card"><h3>A minimal middleware chain</h3><pre data-language="ts"><code>import {
|
||||
createContext,
|
||||
withContextHeaders,
|
||||
@@ -1210,7 +1337,7 @@ const registry = createRealtimeRegistry();
|
||||
bridgeRealtime(registry, createPubSub(redisDriver(process.env.REDIS_URL)));</code></pre></article></div></section></article>
|
||||
<aside class="on-this-page"><h2>On this page</h2><nav><a class="toc-level-2" href="#guide">Guide</a><a class="toc-level-3" href="#overview">Overview</a><a class="toc-level-3" href="#api">API</a><a class="toc-level-4" href="#context-middleware-wrnexus-core">Context & middleware — @wrnexus/core</a><a class="toc-level-4" href="#authentication-wrnexus-core">Authentication — @wrnexus/core</a><a class="toc-level-4" href="#csrf-wrnexus-core">CSRF — @wrnexus/core</a><a class="toc-level-4" href="#rate-limiting-wrnexus-core">Rate limiting — @wrnexus/core</a><a class="toc-level-4" href="#request-logging-wrnexus-core">Request logging — @wrnexus/core</a><a class="toc-level-4" href="#caching-wrnexus-core">Caching — @wrnexus/core</a><a class="toc-level-4" href="#file-uploads-wrnexus-core">File uploads — @wrnexus/core</a><a class="toc-level-4" href="#streaming-sse-wrnexus-core">Streaming & SSE — @wrnexus/core</a><a class="toc-level-4" href="#realtime-rooms-wrnexus-core">Realtime rooms — @wrnexus/core</a><a class="toc-level-4" href="#error-pages-wrnexus-core">Error pages — @wrnexus/core</a><a class="toc-level-4" href="#security-headers-cors-wrnexus-core">Security headers & CORS — @wrnexus/core</a><a class="toc-level-4" href="#storage-cookies-sessions-localstorage-wrnexus-core">Storage: cookies, sessions, localStorage — @wrnexus/core</a><a class="toc-level-4" href="#low-level-security-helpers-wrnexus-core">Low-level security helpers — @wrnexus/core</a><a class="toc-level-4" href="#jsx-runtime-wrnexus-core-wrnexus-core-jsx-runtime-wrnexus-core-jsx-dev-runtime">JSX runtime — @wrnexus/core, @wrnexus/core/jsx-runtime, @wrnexus/core/jsx-dev-runtime</a><a class="toc-level-3" href="#usage">Usage</a><a class="toc-level-4" href="#a-minimal-middleware-chain">A minimal middleware chain</a><a class="toc-level-4" href="#password-auth">Password auth</a><a class="toc-level-4" href="#http-caching-with-etags">HTTP caching with ETags</a><a class="toc-level-4" href="#streaming-sse">Streaming SSE</a><a class="toc-level-4" href="#a-realtime-room">A realtime room</a><a class="toc-level-4" href="#jsx-rendering">JSX rendering</a><a class="toc-level-3" href="#requirements-notes">Requirements / Notes</a><a class="toc-level-2" href="#api">Complete API</a><a class="toc-level-2" href="#examples">Examples</a></nav></aside>
|
||||
</main>
|
||||
<footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.6.0</strong><span>Complete API documentation generated from installed package declarations.</span></p></div><nav aria-label="Footer"><a href="/packages">All packages</a><a href="/getting-started">Get started</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Private Developer Preview · Bun-native</p></footer>
|
||||
<footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.7.0</strong><span>Complete API documentation generated from installed package declarations.</span></p></div><nav aria-label="Footer"><a href="/packages">All packages</a><a href="/getting-started">Get started</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Private Developer Preview · Bun-native</p></footer>
|
||||
<BackToTop />
|
||||
</div>
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user