docs: update portal for WRNexusJS 0.8.72

- Bump every @wrnexus/* dependency to its latest release (ui 0.8.88, styles 0.8.26, cli 0.8.72, core 0.8.16, i18n 0.8.12, ...) and refresh bun.lock and package-lock.json. graphql/native 0.8.8 were republished, so their stale lockfile integrity entries were re-resolved. - wrnexus.config.ts: drop `functions` and `compatibility`, both removed from the framework. - Regenerate package, portal and discovery docs from the installed packages, including the new 0.8.72 release page. - Package pages now install each package's own released version (ui 0.8.88, core 0.8.16) instead of stamping the CLI version on all. - llms.txt / llms-full.txt: the generator kept every earlier run's CLI reference and appended another; it now replaces it, so the guide holds one current reference and no longer advertises the removed `wrnexus compatibility` command. - docs.test.ts: compileWireFile was renamed compileWrnFile; tests follow the per-package install versions and the removed command. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-09-30 16:46:32 +05:30
1 parent 5c591ab7de
commit b536b57447
@@ -10,7 +10,7 @@ page wrnexuscore {
      <header class="topbar">
        <a class="brand" href="/"><span>W</span> WRNexusJS</a>
        <nav aria-label="Primary"><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a></nav>
-        <div class="topbar-actions"><a class="preview-pill" href="/access">Private preview · v0.8.8</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div>
+        <div class="topbar-actions"><a class="preview-pill" href="/access">Private preview · v0.8.72</a><button data-wire-theme-toggle class="theme-button" aria-label="Toggle color theme" title="Toggle color theme">◐</button></div>
      </header>
      <div class="mobile-doc-nav"><details><summary>Browse documentation</summary><nav><a href="/getting-started">Get started</a><a href="/packages">Packages</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/language">Language</a><a href="/architecture">Architecture</a><a href="/tutorial">Tutorial</a><a href="/guides/project-structure">Guides</a><a href="/examples">Examples</a><a href="/search">Search</a></nav></details></div>
      <main id="main" class="portal-main docs-layout docs-layout--navigation"><aside class="docs-section-menu" aria-label="Documentation sections"><nav>
@@ -20,7 +20,7 @@ page wrnexuscore {
  <section><strong>Reference</strong><a href="/packages">Packages overview</a><a href="/packages/cli">CLI</a><a href="/language">.wrn language</a><a href="https://component.wrnexusjs.dev/">Components</a><a href="/examples">Examples</a></section>
  <section class="package-menu"><strong>Packages</strong><a href="/packages/ai">@wrnexus/ai</a><a href="/packages/auth">@wrnexus/auth</a><a href="/packages/authz">@wrnexus/authz</a><a href="/packages/benchmark">@wrnexus/benchmark</a><a href="/packages/cache">@wrnexus/cache</a><a href="/packages/captcha">@wrnexus/captcha</a><a href="/packages/cli">@wrnexus/cli</a><a href="/packages/compiler">@wrnexus/compiler</a><a href="/packages/content">@wrnexus/content</a><a href="/packages/core">@wrnexus/core</a><a href="/packages/csr">@wrnexus/csr</a><a href="/packages/db">@wrnexus/db</a><a href="/packages/dev-server">@wrnexus/dev-server</a><a href="/packages/dev-toolbar">@wrnexus/dev-toolbar</a><a href="/packages/encryption">@wrnexus/encryption</a><a href="/packages/graphql">@wrnexus/graphql</a><a href="/packages/helpers">@wrnexus/helpers</a><a href="/packages/i18n">@wrnexus/i18n</a><a href="/packages/identity">@wrnexus/identity</a><a href="/packages/image">@wrnexus/image</a><a href="/packages/jwt">@wrnexus/jwt</a><a href="/packages/language-server">@wrnexus/language-server</a><a href="/packages/mcp">@wrnexus/mcp</a><a href="/packages/mobile">@wrnexus/mobile</a><a href="/packages/native">@wrnexus/native</a><a href="/packages/oauth">@wrnexus/oauth</a><a href="/packages/observability">@wrnexus/observability</a><a href="/packages/playground">@wrnexus/playground</a><a href="/packages/plugin">@wrnexus/plugin</a><a href="/packages/pubsub">@wrnexus/pubsub</a><a href="/packages/pwa">@wrnexus/pwa</a><a href="/packages/queue">@wrnexus/queue</a><a href="/packages/reactive">@wrnexus/reactive</a><a href="/packages/realtime">@wrnexus/realtime</a><a href="/packages/router">@wrnexus/router</a><a href="/packages/security">@wrnexus/security</a><a href="/packages/ssr">@wrnexus/ssr</a><a href="/packages/store">@wrnexus/store</a><a href="/packages/styles">@wrnexus/styles</a><a href="/packages/syntax">@wrnexus/syntax</a><a href="/packages/test">@wrnexus/test</a><a href="/packages/tracking">@wrnexus/tracking</a><a href="/packages/typecheck">@wrnexus/typecheck</a><a href="/packages/ui">@wrnexus/ui</a><a href="/packages/uploader">@wrnexus/uploader</a><a href="/packages/validation">@wrnexus/validation</a></section>
 </nav></aside><div class="docs-reading-column">
-      <article class="documentation prose standalone package-document"><nav class="breadcrumbs" aria-label="Breadcrumb"><a href="/">Home</a><span>/</span><a href="/packages">Packages</a><span>/</span><span aria-current="page">@wrnexus/core</span></nav><section class="doc-intro"><span class="eyebrow">Core · Package reference</span><h1>@wrnexus/core</h1><p>Contexts, middleware, security, sessions, caching, JSX, and realtime.</p><div class="doc-meta"><span>v0.8.8</span><span>Private registry</span><span>Core</span></div><section id="access" class="access-callout"><h2>Install the package</h2><p>After WorkRoot approves private registry access, install the release-aligned package:</p><pre><code>bun add @wrnexus/core@0.8.8</code><button type="button" class="copy-button" aria-label="Copy installation command">Copy</button></pre><p><a href="/access">Request preview access</a>. Never put registry tokens in source control.</p></section></section><section id="guide"><blockquote>The framework core: the request <code>Context</code>, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.</blockquote>
+      <article class="documentation prose standalone package-document"><nav class="breadcrumbs" aria-label="Breadcrumb"><a href="/">Home</a><span>/</span><a href="/packages">Packages</a><span>/</span><span aria-current="page">@wrnexus/core</span></nav><section class="doc-intro"><span class="eyebrow">Core · Package reference</span><h1>@wrnexus/core</h1><p>Contexts, middleware, security, sessions, caching, JSX, and realtime.</p><div class="doc-meta"><span>v0.8.16</span><span>Private registry</span><span>Core</span></div><section id="access" class="access-callout"><h2>Install the package</h2><p>After WorkRoot approves private registry access, install the package:</p><pre><code>bun add @wrnexus/core@0.8.16</code><button type="button" class="copy-button" aria-label="Copy installation command">Copy</button></pre><p><a href="/access">Request preview access</a>. Never put registry tokens in source control.</p></section></section><section id="guide"><blockquote>The framework core: the request <code>Context</code>, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.</blockquote>
 <p>Part of the <strong>WRNexusJS</strong> framework — an SSR-first, Bun-native full-stack web framework.</p>
 <h3 id="overview">Overview</h3>
 <p><code>@wrnexus/core</code> is the shared foundation of WRNexusJS. It defines the <code>Context</code> object that flows through every middleware, page, and API route, plus the <code>Middleware</code>/<code>Next</code> contract they implement. On top of that it ships the building blocks a real app needs: cookie-backed sessions, password auth, CSRF protection, rate limiting, request logging, HTTP + in-memory caching, file uploads, streaming/SSE responses, WebSocket &quot;rooms&quot;, security headers/CORS, and a server-side JSX runtime that renders to HTML strings. Everything here is <strong>server-side</strong> and Bun-native (it uses <code>Bun.password</code>, <code>Bun.write</code>, the web-standard <code>Request</code>/<code>Response</code>, and <code>crypto</code>). You depend on it directly and transitively through the rest of the framework.</p>
@@ -32,7 +32,7 @@ page wrnexuscore {
 <p>The <code>Context</code> (<code>ctx</code>) is the single value passed to middleware and handlers.</p>
 <div class="table-wrap"><table>
 <thead><tr><th>Export</th><th>Kind</th><th>Description</th></tr></thead>
-<tbody><tr><td><code>Context</code></td><td>type</td><td>Per-request object: <code>req</code>, <code>url</code>, <code>lang</code>, <code>t</code>, <code>params</code>, <code>locals</code>, <code>user?</code>, <code>ip?</code>, <code>cookies</code>, <code>session</code>, <code>localStorage</code>.</td></tr><tr><td><code>Next</code></td><td>type</td><td>`() =&gt; Promise&lt;Response&gt; \</td><td>Response` — invokes the next middleware/handler.</td></tr><tr><td><code>Middleware</code></td><td>type</td><td>`(ctx, next) =&gt; Promise&lt;Response&gt; \</td><td>Response<code>. Return </code>next()<code> to continue, or a </code>Response` to short-circuit.</td></tr><tr><td><code>createContext(req, url)</code></td><td>fn</td><td>Build a fresh <code>Context</code> for an incoming request (wires up cookies, session, localStorage snapshot).</td></tr><tr><td><code>withContextHeaders(ctx, res)</code></td><td>fn</td><td>Apply accumulated headers (e.g. <code>Set-Cookie</code>) from the context onto a response.</td></tr><tr><td><code>PageComponent</code></td><td>type</td><td>`(ctx) =&gt; string \</td><td>Promise&lt;string&gt;` — a page module's default export.</td></tr><tr><td><code>PageMeta</code> / <code>SeoConfig</code></td><td>type</td><td><code>&lt;head&gt;</code> metadata: <code>title</code>, <code>description</code>, <code>canonical</code>, <code>robots</code>, <code>image</code>, <code>twitterCard</code>, <code>themeColor</code>, …</td></tr><tr><td><code>TFunction</code></td><td>type</td><td><code>(key, params?) =&gt; string</code> — translate a key for <code>ctx.lang</code>, interpolating <code>&#123;param&#125;</code> placeholders.</td></tr></tbody></table></div>
+<tbody><tr><td><code>Context</code></td><td>type</td><td>Per-request object: <code>req</code>, <code>url</code>, <code>lang</code>, <code>t</code>, <code>params</code>, <code>locals</code>, <code>user?</code>, <code>ip?</code>, <code>cookies</code>, <code>session</code>, <code>localStorage</code>.</td></tr><tr><td><code>Next</code></td><td>type</td><td>`() =&gt; Promise&lt;Response&gt; \</td><td>Response` — invokes the next middleware/handler.</td></tr><tr><td><code>Middleware</code></td><td>type</td><td>`(ctx, next) =&gt; Promise&lt;Response&gt; \</td><td>Response<code>. Return </code>next()<code> to continue, or a </code>Response` to short-circuit.</td></tr><tr><td><code>createContext(req, url)</code></td><td>fn</td><td>Build a fresh <code>Context</code> for an incoming request (connects up cookies, session, localStorage snapshot).</td></tr><tr><td><code>withContextHeaders(ctx, res)</code></td><td>fn</td><td>Apply accumulated headers (e.g. <code>Set-Cookie</code>) from the context onto a response.</td></tr><tr><td><code>PageComponent</code></td><td>type</td><td>`(ctx) =&gt; string \</td><td>Promise&lt;string&gt;` — a page module's default export.</td></tr><tr><td><code>PageMeta</code> / <code>SeoConfig</code></td><td>type</td><td><code>&lt;head&gt;</code> metadata: <code>title</code>, <code>description</code>, <code>canonical</code>, <code>robots</code>, <code>image</code>, <code>twitterCard</code>, <code>themeColor</code>, …</td></tr><tr><td><code>TFunction</code></td><td>type</td><td><code>(key, params?) =&gt; string</code> — translate a key for <code>ctx.lang</code>, interpolating <code>&#123;param&#125;</code> placeholders.</td></tr></tbody></table></div>
 <p>Key <code>Context</code> fields:</p>
 <ul>
 <li><code>ctx.locals</code> — per-request scratch space for passing values between middleware.</li>
@@ -47,10 +47,10 @@ page wrnexuscore {
 <tbody><tr><td><code>hashPassword(password)</code></td><td><code>(string) =&gt; Promise&lt;string&gt;</code></td><td>argon2id hash to store.</td></tr><tr><td><code>verifyPassword(password, hash)</code></td><td><code>(string, string) =&gt; Promise&lt;boolean&gt;</code></td><td>Constant-safe; returns <code>false</code> on bad/empty hash.</td></tr><tr><td><code>logIn(ctx, user)</code></td><td><code>(Context, U) =&gt; void</code></td><td>Regenerates the session id (fixation defense), stores the user, sets <code>ctx.user</code>.</td></tr><tr><td><code>logOut(ctx)</code></td><td><code>(Context) =&gt; void</code></td><td>Clears the session and <code>ctx.user</code>.</td></tr><tr><td><code>getUser(ctx)</code></td><td>`(Context) =&gt; U \</td><td>null`</td><td>Current user from <code>ctx.user</code>, falling back to the session.</td></tr><tr><td><code>sessionAuth()</code></td><td><code>() =&gt; Middleware</code></td><td>Hydrates <code>ctx.user</code> from the session each request. Register early.</td></tr><tr><td><code>requireAuth(options?)</code></td><td><code>(RequireAuthOptions?) =&gt; Middleware</code></td><td>Guard: API/fetch requests get <code>401 JSON</code>, page navigations get <code>302</code> to <code>loginPath</code> (default <code>/login</code>) with <code>?next=</code>.</td></tr><tr><td><code>SESSION_USER_KEY</code></td><td><code>&quot;user&quot;</code></td><td>Session key holding the user.</td></tr></tbody></table></div>
 <p><code>RequireAuthOptions</code>: <code>&#123; loginPath?: string &#125;</code>.</p>
 <h4 id="csrf-wrnexus-core">CSRF — <code>@wrnexus/core</code></h4>
-<p>Double-submit cookie pattern: a readable <code>wire-csrf</code> cookie is echoed in an <code>x-csrf-token</code> header on unsafe requests.</p>
+<p>Double-submit cookie pattern: a readable <code>wrn-csrf</code> cookie is echoed in an <code>x-csrf-token</code> header on unsafe requests.</p>
 <div class="table-wrap"><table>
 <thead><tr><th>Export</th><th>Signature</th><th>Notes</th></tr></thead>
-<tbody><tr><td><code>csrfToken(ctx)</code></td><td><code>(Context) =&gt; string</code></td><td>Ensures the CSRF cookie exists and returns its token.</td></tr><tr><td><code>verifyCsrf(ctx)</code></td><td><code>(Context) =&gt; boolean</code></td><td>Safe methods (GET/HEAD/OPTIONS) pass; otherwise header/<code>ctx.locals._csrf</code> must match the cookie (constant-time).</td></tr><tr><td><code>csrfProtection()</code></td><td><code>() =&gt; Middleware</code></td><td>403s unsafe requests with a missing/mismatched token.</td></tr><tr><td><code>CSRF_COOKIE</code> / <code>CSRF_HEADER</code></td><td><code>&quot;wire-csrf&quot;</code> / <code>&quot;x-csrf-token&quot;</code></td><td>Cookie &amp; header names.</td></tr></tbody></table></div>
+<tbody><tr><td><code>csrfToken(ctx)</code></td><td><code>(Context) =&gt; string</code></td><td>Ensures the CSRF cookie exists and returns its token.</td></tr><tr><td><code>verifyCsrf(ctx)</code></td><td><code>(Context) =&gt; boolean</code></td><td>Safe methods (GET/HEAD/OPTIONS) pass; otherwise header/<code>ctx.locals._csrf</code> must match the cookie (constant-time).</td></tr><tr><td><code>csrfProtection()</code></td><td><code>() =&gt; Middleware</code></td><td>403s unsafe requests with a missing/mismatched token.</td></tr><tr><td><code>CSRF_COOKIE</code> / <code>CSRF_HEADER</code></td><td><code>&quot;wrn-csrf&quot;</code> / <code>&quot;x-csrf-token&quot;</code></td><td>Cookie &amp; header names.</td></tr></tbody></table></div>
 <h4 id="rate-limiting-wrnexus-core">Rate limiting — <code>@wrnexus/core</code></h4>
 <p>Fixed-window limiter that returns <code>429</code> with <code>Retry-After</code> and emits <code>RateLimit-Limit</code>/<code>-Remaining</code>/<code>-Reset</code> headers.</p>
 <div class="table-wrap"><table>
@@ -111,7 +111,7 @@ const status = await resilientCall(&#123;
 <div class="table-wrap"><table>
 <thead><tr><th>Export</th><th>Signature</th><th>Notes</th></tr></thead>
 <tbody><tr><td><code>withSecurityHeaders(req, res, mode, security?, nonce?)</code></td><td>→ <code>Response</code></td><td>Applies CORS + CSP, HSTS, <code>X-Frame-Options</code>, <code>X-Content-Type-Options</code>, <code>Referrer-Policy</code>, <code>Permissions-Policy</code>, COOP, Trusted Types, and <code>extraHeaders</code>.</td></tr><tr><td><code>createCorsPreflightResponse(req, security?)</code></td><td>→ `Response \</td><td>null`</td><td>Builds a <code>204</code>/<code>403</code> preflight response for CORS <code>OPTIONS</code> requests.</td></tr><tr><td><code>isWebSocketOriginAllowed(req, security?)</code></td><td>→ <code>boolean</code></td><td>Guards WS upgrades against cross-site hijacking (allows same-origin, configured CORS origins, and non-browser clients).</td></tr></tbody></table></div>
-<p>Config types: <code>SecurityConfig</code> (top-level), <code>CorsConfig</code>/<code>CorsOrigin</code>, <code>ContentSecurityPolicyConfig</code>/<code>CspDirectiveValue</code>, <code>HstsConfig</code>, <code>TrustedTypesConfig</code>, <code>PermissionsPolicyConfig</code>. WRNexusJS applies sensible defaults (self-only CSP, <code>frame-ancestors 'none'</code>, restrictive Permissions-Policy, HSTS in production, Trusted Types in production); each is individually overridable or disable-able via <code>false</code>.</p>
+<p>Config types: <code>SecurityConfig</code> (top-level), <code>CorsConfig</code>/<code>CorsOrigin</code>, <code>ContentSecurityPolicyConfig</code>/<code>CspDirectiveValue</code>, <code>HstsConfig</code>, <code>TrustedTypesConfig</code>, <code>PermissionsPolicyConfig</code>. WRNexusJS applies sensible defaults (self-only CSP, <code>frame-ancestors 'self'</code>, restrictive Permissions-Policy, HSTS in production, Trusted Types in production); each is individually overridable or disable-able via <code>false</code>.</p>
 <h4 id="storage-cookies-sessions-localstorage-wrnexus-core">Storage: cookies, sessions, localStorage — <code>@wrnexus/core</code></h4>
 <p>These back the <code>ctx.cookies</code>, <code>ctx.session</code>, and <code>ctx.localStorage</code> fields.</p>
 <div class="table-wrap"><table>
@@ -385,6 +385,12 @@ interface CookieStore &#123;
    set(name: string, value: string, options?: CookieOptions): void;
    delete(name: string, options?: CookieOptions): void;
    headers(): string[];
+    transaction&lt;T extends Record&lt;string, unknown&gt; = Record&lt;string, unknown&gt;&gt;(name: string, options?: CookieOptions): TransactionCookie&lt;T&gt;;
+&#125;
+interface TransactionCookie&lt;T extends Record&lt;string, unknown&gt;&gt; &#123;
+    set(value: T): void;
+    consume(): T | undefined;
+    clear(): void;
 &#125;
 interface SessionStore &#123;
    id(): string;
@@ -467,7 +473,15 @@ declare function loadSession(backend: AsyncSessionBackend, options?: &#123;

 /** Translate a key for the active language, interpolating `&#123;param&#125;` placeholders. */
 type TFunction = (key: string, params?: Record&lt;string, string | number&gt;) =&gt; string;
-type Context = &#123;
+interface PaginationOptions &#123;
+    defaultLimit?: number;
+    maxLimit?: number;
+&#125;
+interface PaginationInput &#123;
+    limit: number;
+    cursor?: string;
+&#125;
+interface Context&lt;Params extends Record&lt;string, string&gt; = Record&lt;string, string&gt;, User = unknown&gt; &#123;
    /** The raw incoming web-standard Request. */
    req: Request;
    /** Parsed URL of the request (pathname, query, etc.). */
@@ -477,17 +491,19 @@ type Context = &#123;
    /** Translate a key for the active language (identity until the runtime sets it). */
    t: TFunction;
    /** Dynamic route params, e.g. `/users/[id]` -&gt; `&#123; id: &quot;42&quot; &#125;`. */
-    params: Record&lt;string, string&gt;;
+    params: Params;
    /**
     * Per-request scratch space. Middleware can attach values here
     * (e.g. the authenticated user) and downstream handlers can read them.
     */
    locals: Record&lt;string, unknown&gt;;
+    /** Resource resolved by a declarative route guard, when present. */
+    resource?: unknown;
    /**
     * The authenticated user for this request, or null when anonymous. Populated
     * by the `sessionAuth` middleware (or `logIn`); read via `getUser(ctx)`.
     */
-    user?: unknown;
+    user?: User | null;
    /** Active tenant/workspace resolved by tenant middleware. */
    tenant?: Tenant;
    /** Request tracer installed by observability middleware. */
@@ -504,7 +520,9 @@ type Context = &#123;
    session: SessionStore;
    /** Read-only localStorage snapshot sent by the browser for CSR data bindings. */
    localStorage: LocalStorageSnapshot;
-&#125;;
+    /** Parse and bound the standard `limit` and `cursor` query parameters. */
+    pagination(options?: PaginationOptions): PaginationInput;
+&#125;
 /** Calls the next middleware in the chain (or the final route handler). */
 type Next = () =&gt; Promise&lt;Response&gt; | Response;
 /**
@@ -538,10 +556,14 @@ type PageMeta = SeoConfig;
 /** A page module's default export. Returns an HTML string for the body. */
 type PageComponent = (ctx: Context) =&gt; string | Promise&lt;string&gt;;
 /** Create a fresh context for an incoming request. */
-declare function createContext(req: Request, url: URL): Context;
+declare function createContext&lt;Params extends Record&lt;string, string&gt; = Record&lt;string, string&gt;&gt;(req: Request, url: URL): Context&lt;Params&gt;;
 /** Apply headers accumulated on the context, such as Set-Cookie. */
 declare function withContextHeaders(ctx: Context, res: Response): Response;

+declare function runWithRequestContext&lt;T&gt;(ctx: Context, fn: () =&gt; T): T;
+declare function getRequestContext(): Context | undefined;
+declare function requireRequestContext(what: string): Context;
+
 type ExecutionKind = &quot;http&quot; | &quot;api&quot; | &quot;action&quot; | &quot;loader&quot; | &quot;middleware&quot; | &quot;realtime&quot; | &quot;queue&quot; | &quot;cron&quot; | &quot;webhook&quot;;
 interface ResponseContext &#123;
    status: number;
@@ -583,6 +605,21 @@ interface ExecutionContextInput extends Partial&lt;Omit&lt;ExecutionContext, &qu
 declare function createExecutionContext(input: ExecutionContextInput): ExecutionContext;
 declare function executionContextFromHttp(context: Context, kind?: Extract&lt;ExecutionKind, &quot;http&quot; | &quot;api&quot; | &quot;action&quot; | &quot;loader&quot; | &quot;middleware&quot; | &quot;webhook&quot;&gt;, input?: Omit&lt;ExecutionContextInput, &quot;kind&quot; | &quot;request&quot; | &quot;user&quot; | &quot;tenant&quot; | &quot;locale&quot; | &quot;trace&quot;&gt;): ExecutionContext;

+/**
+ * Assemble an API request from a block's declared input.
+ *
+ * Shared by both transports on purpose. The browser and the in-process server
+ * caller must send the same thing for the same call; two copies of these rules
+ * would drift, and the drift would be invisible because each side is tested
+ * separately.
+ */
+interface BuiltApiRequest &#123;
+    url: string;
+    body?: string;
+    contentType?: string;
+&#125;
+declare function buildApiRequest(path: string, method: string, input: Record&lt;string, unknown&gt; | undefined): BuiltApiRequest;
+
 /**
 * Small, dependency-free security helpers shared across packages.
 */
@@ -606,7 +643,7 @@ declare function isSafeRequestPath(pathname: string): boolean;
 * metadata validation for unsafe requests.
 */

-declare const CSRF_COOKIE = &quot;wire-csrf&quot;;
+declare const CSRF_COOKIE = &quot;wrn-csrf&quot;;
 declare const CSRF_HEADER = &quot;x-csrf-token&quot;;
 interface CsrfProtectionOptions &#123;
    /** Validate Origin when present. Defaults to true. */
@@ -1048,7 +1085,7 @@ interface RealtimeEnvelope &#123;
    message: unknown;
 &#125;
 /**
- * A pub/sub bridge for horizontal scaling. Wire the registry to a shared bus
+ * A pub/sub bridge for horizontal scaling. WRNexusJS the registry to a shared bus
 * (Redis pub/sub, NATS, …): local broadcasts/`toUser` sends are published to
 * peers, and messages received from peers are delivered via `registry.deliver`.
 * Connection-targeted sends (`send`, `to(id)`) stay local (ids are per-process).
@@ -1198,7 +1235,7 @@ interface SecurityConfig &#123;
    trustedTypes?: false | TrustedTypesConfig;
    /** Defaults to &quot;same-origin&quot;. */
    crossOriginOpenerPolicy?: false | &quot;same-origin&quot; | &quot;same-origin-allow-popups&quot; | &quot;unsafe-none&quot;;
-    /** Defaults to &quot;DENY&quot;. */
+    /** Defaults to &quot;SAMEORIGIN&quot;. */
    frameOptions?: false | &quot;DENY&quot; | &quot;SAMEORIGIN&quot;;
    /** Defaults to &quot;strict-origin-when-cross-origin&quot;. */
    referrerPolicy?: false | string;
@@ -1256,6 +1293,10 @@ interface EndpointDefinition&lt;I, O&gt; &#123;
    input?: SchemaLike&lt;I&gt; | OutputSchemaLike&lt;I&gt;;
    output?: SchemaLike&lt;O&gt; | OutputSchemaLike&lt;O&gt;;
    auth?: &quot;optional&quot; | &quot;required&quot;;
+    /** Permission checked through an installed @wrnexus/authz middleware. */
+    permission?: string;
+    /** Resource supplied to bound authorization policies. */
+    resource?: (ctx: Context, input: I) =&gt; unknown | Promise&lt;unknown&gt;;
    description?: string;
    tags?: string[];
    handler(input: I, ctx: Context): O | Promise&lt;O&gt;;
@@ -1492,7 +1533,11 @@ declare function withIdempotency&lt;T&gt;(store: IdempotencyStore&lt;T&gt;, key:
    replayed: boolean;
 &#125;&gt;;

-export &#123; type ActionDefinition, ApplicationLifecycle, type AsyncSessionBackend, type BackoffStrategy, type Bucket, type BudgetViolation, Bulkhead, type BulkheadOptions, CSRF_COOKIE, CSRF_HEADER, type CacheControlOptions, type CachePolicy, CircuitBreaker, type CircuitBreakerOptions, type CircuitBreakerSnapshot, type ContentSecurityPolicyConfig, type Context, type CookieOptions, type CookieStore, type CorsConfig, type CorsOrigin, type CspDirectiveValue, type CsrfProtectionOptions, type DefinedAction, type DefinedEndpoint, type DefinedLoader, type Duration, type EndpointDefinition, EndpointError, type EndpointErrorBody, type ExecutionContext, type ExecutionContextInput, type ExecutionKind, type FeatureFlags, type FeatureRule, type FeatureValue, type HealthCheck, type HealthCheckResult, HealthRegistry, type HstsConfig, type IdempotencyRecord, type IdempotencyStore, type InferEndpointSchema, type LifecycleHandler, type LifecyclePhase, type LoaderDefinition, type LocalStorageSnapshot, type Middleware, type Mode, type Next, type OutputSchemaLike, POSTGRES_TENANT_DIRECTORY_SCHEMA, type PageComponent, type PageMeta, type PerformanceBudgets, type PerformanceMeasurement, type PermissionsPolicyConfig, type ProblemDetails, type ProblemDetailsInput, type RateLimitOptions, type RateLimitStore, type RawSocket, type RealtimeBridge, type RealtimeBus, type RealtimeConnectMeta, type RealtimeEnvelope, type RealtimeHandler, type RealtimeRegistry, type RealtimeRegistryOptions, type RealtimeSecurityOptions, type RealtimeSocket, type RequestLimitsConfig, type RequestLoggerOptions, type RequestRecord, type RequireAuthOptions, ResilienceError, type ResilientCallOptions, type ResponseContext, type Room, type RoomAuthInfo, type RoomClient, type RoomDefinition, type RoomHandlers, type RpcClientOptions, SESSION_USER_KEY, type SaveUploadOptions, type SavedUpload, type SchemaLike, type SecureUploadOptions, type SecurityConfig, type SeoConfig, type ServerSentEvent, ServiceContainer, type ServiceToken, type SessionBackend, type SessionEntry, type SessionPolicy, type SessionStore, type Span, type SpanRecord, type StreamResponseInit, type TFunction, TTLCache, type Target, type Tenant, type TenantAuditEvent, type TenantDirectoryStore, type TenantMembership, type TenantMiddlewareOptions, type TenantQuota, type TenantResolver, type TenantResource, type TenantSqlClient, type Tracer, type TrustedTypesConfig, UploadError, type UploadInspectionResult, type UploadInspector, type UploadScanner, assertTenantAccess, bridgeRealtime, cacheControl, checkPerformanceBudgets, collectUploads, composeTenantResolvers, createContext, createCorsPreflightResponse, createExecutionContext, createPersistentTenantDirectory, createRealtimeRegistry, createRpcClient, createTenantDirectory, createTracer, csrfProtection, csrfToken, dedupe, defaultKey, defineAction, defineEndpoint, defineFeatureFlags, defineLoader, defineRoom, durationMs, escapeHtml, etag, executionContextFromHttp, getUser, hashPassword, isRoomDefinition, isSafeIslandName, isSafeRequestPath, isWebSocketOriginAllowed, loadSession, logIn, logOut, memoryIdempotencyStore, memoryTenantDirectoryStore, migrateTenants, notModified, peerKey, postgresTenantDirectoryStore, problem, proxyKey, randomUploadFilename, rateLimit, recommendedWebBudgets, renderDevError, renderError, renderNotFound, renderProdError, renderStatusPage, requestId, requestLogger, requireAuth, requireTenant, resilientCall, resolveRequestUrl, sanitizeFilename, saveUpload, saveUploadSecure, secureDownloadHeaders, serviceToken, sessionAuth, setSessionBackend, setSessionPolicy, sse, streamResponse, tenantFromDomain, tenantFromHeader, tenantFromPath, tenantFromSession, tenantFromSubdomain, tenantKey, tenantMiddleware, tenantScope, tracingMiddleware, verifyCsrf, verifyPassword, withCacheControl, withContextHeaders, withIdempotency, withSecurityHeaders, withSpan &#125;;
+/** Hoist nested templates out of each other for linear-size hydration data. */
+declare function encodeControlTemplate(value: unknown): string;
+declare function renderControlTemplates(): string;
+
+export &#123; type ActionDefinition, ApplicationLifecycle, type AsyncSessionBackend, type BackoffStrategy, type Bucket, type BudgetViolation, type BuiltApiRequest, Bulkhead, type BulkheadOptions, CSRF_COOKIE, CSRF_HEADER, type CacheControlOptions, type CachePolicy, CircuitBreaker, type CircuitBreakerOptions, type CircuitBreakerSnapshot, type ContentSecurityPolicyConfig, type Context, type CookieOptions, type CookieStore, type CorsConfig, type CorsOrigin, type CspDirectiveValue, type CsrfProtectionOptions, type DefinedAction, type DefinedEndpoint, type DefinedLoader, type Duration, type EndpointDefinition, EndpointError, type EndpointErrorBody, type ExecutionContext, type ExecutionContextInput, type ExecutionKind, type FeatureFlags, type FeatureRule, type FeatureValue, type HealthCheck, type HealthCheckResult, HealthRegistry, type HstsConfig, type IdempotencyRecord, type IdempotencyStore, type InferEndpointSchema, type LifecycleHandler, type LifecyclePhase, type LoaderDefinition, type LocalStorageSnapshot, type Middleware, type Mode, type Next, type OutputSchemaLike, POSTGRES_TENANT_DIRECTORY_SCHEMA, type PageComponent, type PageMeta, type PaginationInput, type PaginationOptions, type PerformanceBudgets, type PerformanceMeasurement, type PermissionsPolicyConfig, type ProblemDetails, type ProblemDetailsInput, type RateLimitOptions, type RateLimitStore, type RawSocket, type RealtimeBridge, type RealtimeBus, type RealtimeConnectMeta, type RealtimeEnvelope, type RealtimeHandler, type RealtimeRegistry, type RealtimeRegistryOptions, type RealtimeSecurityOptions, type RealtimeSocket, type RequestLimitsConfig, type RequestLoggerOptions, type RequestRecord, type RequireAuthOptions, ResilienceError, type ResilientCallOptions, type ResponseContext, type Room, type RoomAuthInfo, type RoomClient, type RoomDefinition, type RoomHandlers, type RpcClientOptions, SESSION_USER_KEY, type SaveUploadOptions, type SavedUpload, type SchemaLike, type SecureUploadOptions, type SecurityConfig, type SeoConfig, type ServerSentEvent, ServiceContainer, type ServiceToken, type SessionBackend, type SessionEntry, type SessionPolicy, type SessionStore, type Span, type SpanRecord, type StreamResponseInit, type TFunction, TTLCache, type Target, type Tenant, type TenantAuditEvent, type TenantDirectoryStore, type TenantMembership, type TenantMiddlewareOptions, type TenantQuota, type TenantResolver, type TenantResource, type TenantSqlClient, type Tracer, type TransactionCookie, type TrustedTypesConfig, UploadError, type UploadInspectionResult, type UploadInspector, type UploadScanner, assertTenantAccess, bridgeRealtime, buildApiRequest, cacheControl, checkPerformanceBudgets, collectUploads, composeTenantResolvers, createContext, createCorsPreflightResponse, createExecutionContext, createPersistentTenantDirectory, createRealtimeRegistry, createRpcClient, createTenantDirectory, createTracer, csrfProtection, csrfToken, dedupe, defaultKey, defineAction, defineEndpoint, defineFeatureFlags, defineLoader, defineRoom, durationMs, encodeControlTemplate, escapeHtml, etag, executionContextFromHttp, getRequestContext, getUser, hashPassword, isRoomDefinition, isSafeIslandName, isSafeRequestPath, isWebSocketOriginAllowed, loadSession, logIn, logOut, memoryIdempotencyStore, memoryTenantDirectoryStore, migrateTenants, notModified, peerKey, postgresTenantDirectoryStore, problem, proxyKey, randomUploadFilename, rateLimit, recommendedWebBudgets, renderControlTemplates, renderDevError, renderError, renderNotFound, renderProdError, renderStatusPage, requestId, requestLogger, requireAuth, requireRequestContext, requireTenant, resilientCall, resolveRequestUrl, runWithRequestContext, sanitizeFilename, saveUpload, saveUploadSecure, secureDownloadHeaders, serviceToken, sessionAuth, setSessionBackend, setSessionPolicy, sse, streamResponse, tenantFromDomain, tenantFromHeader, tenantFromPath, tenantFromSession, tenantFromSubdomain, tenantKey, tenantMiddleware, tenantScope, tracingMiddleware, verifyCsrf, verifyPassword, withCacheControl, withContextHeaders, withIdempotency, withSecurityHeaders, withSpan &#125;;
 </code></pre></section><section id="examples" class="examples"><h2>Examples</h2><p>Copy-ready examples from the installed package documentation.</p><div class="example-grid"><article class="example-card"><h3>A minimal middleware chain</h3><pre data-language="ts"><code>import &#123;
  createContext,
  withContextHeaders,
@@ -1556,7 +1601,7 @@ const registry = createRealtimeRegistry();
 bridgeRealtime(registry, createPubSub(redisDriver(process.env.REDIS_URL)));</code></pre></article></div></section></article></div>
      <aside class="on-this-page"><h2>On this page</h2><nav><a class="toc-level-2" href="#guide">Guide</a><a class="toc-level-3" href="#overview">Overview</a><a class="toc-level-3" href="#api">API</a><a class="toc-level-4" href="#context-middleware-wrnexus-core">Context &amp; middleware — @wrnexus/core</a><a class="toc-level-4" href="#authentication-wrnexus-core">Authentication — @wrnexus/core</a><a class="toc-level-4" href="#csrf-wrnexus-core">CSRF — @wrnexus/core</a><a class="toc-level-4" href="#rate-limiting-wrnexus-core">Rate limiting — @wrnexus/core</a><a class="toc-level-4" href="#request-logging-wrnexus-core">Request logging — @wrnexus/core</a><a class="toc-level-4" href="#resilience-wrnexus-core">Resilience — @wrnexus/core</a><a class="toc-level-4" href="#caching-wrnexus-core">Caching — @wrnexus/core</a><a class="toc-level-4" href="#file-uploads-wrnexus-core">File uploads — @wrnexus/core</a><a class="toc-level-4" href="#streaming-sse-wrnexus-core">Streaming &amp; SSE — @wrnexus/core</a><a class="toc-level-4" href="#realtime-rooms-wrnexus-core">Realtime rooms — @wrnexus/core</a><a class="toc-level-4" href="#error-pages-wrnexus-core">Error pages — @wrnexus/core</a><a class="toc-level-4" href="#security-headers-cors-wrnexus-core">Security headers &amp; CORS — @wrnexus/core</a><a class="toc-level-4" href="#storage-cookies-sessions-localstorage-wrnexus-core">Storage: cookies, sessions, localStorage — @wrnexus/core</a><a class="toc-level-4" href="#low-level-security-helpers-wrnexus-core">Low-level security helpers — @wrnexus/core</a><a class="toc-level-4" href="#jsx-runtime-wrnexus-core-wrnexus-core-jsx-runtime-wrnexus-core-jsx-dev-runtime">JSX runtime — @wrnexus/core, @wrnexus/core/jsx-runtime, @wrnexus/core/jsx-dev-runtime</a><a class="toc-level-3" href="#usage">Usage</a><a class="toc-level-4" href="#a-minimal-middleware-chain">A minimal middleware chain</a><a class="toc-level-4" href="#password-auth">Password auth</a><a class="toc-level-4" href="#http-caching-with-etags">HTTP caching with ETags</a><a class="toc-level-4" href="#streaming-sse">Streaming SSE</a><a class="toc-level-4" href="#a-realtime-room">A realtime room</a><a class="toc-level-4" href="#jsx-rendering">JSX rendering</a><a class="toc-level-3" href="#requirements-notes">Requirements / Notes</a><a class="toc-level-2" href="#api">Complete API</a><a class="toc-level-2" href="#examples">Examples</a></nav></aside>
    </main>
-      <footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.8.8</strong><span>Complete API documentation generated from installed package declarations.</span></p></div><nav aria-label="Footer"><a href="/packages">All packages</a><a href="/getting-started">Get started</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Private Developer Preview · Bun-native</p></footer>
+      <footer><div class="footer-brand"><span class="footer-mark" aria-hidden="true">W</span><p><strong>WRNexusJS 0.8.72</strong><span>Complete API documentation generated from installed package declarations.</span></p></div><nav aria-label="Footer"><a href="/packages">All packages</a><a href="/getting-started">Get started</a><a href="/security">Security</a><a href="/support">Support</a><a href="/llms.txt">AI guide</a></nav><p class="footer-meta">Private Developer Preview · Bun-native</p></footer>
    </div>
  }
 }