Page not found
The address may be outdated or misspelled. No private or duplicate route is exposed here.
The address may be outdated or misspelled. No private or duplicate route is exposed here.
WRNexusJS 0.8.4 packages are not available from the public npm registry. Installation requires approval and private registry credentials supplied by WorkRoot. Never paste registry tokens into source control, issue reports, or support messages.
bunx @wrnexus/cli@0.8.4 create my-appAccess approval, response time, licensing terms, and support level remain owner-controlled. This site does not collect access requests directly.
WRNexusJS 0.8.5 packages are not available from the public npm registry. Installation requires approval and private registry credentials supplied by WorkRoot. Never paste registry tokens into source control, issue reports, or support messages.
bunx @wrnexus/cli@0.8.5 create my-appAccess approval, response time, licensing terms, and support level remain owner-controlled. This site does not collect access requests directly.
WRNexusJS is Bun-native and SSR-first. File discovery maps pages and API handlers; middleware enriches or short-circuits a request; the compiler turns .wrn declarations into server render functions and small feature runtimes.
core owns contexts, middleware, sessions and rooms; router discovers routes; compiler parses .wrn; ssr renders documents; csr supplies browser runtimes; dev-server and cli orchestrate development and builds.
Validation happens at trust boundaries. Session authentication establishes identity; authorization makes resource decisions. CSP, Trusted Types, CSRF, upload checks, WebSocket origins, request limits, and output escaping are layered controls—not substitutes for application policy.
Rooms are process-local unless connected through pub/sub. Redis-backed pub/sub distributes events. Queue durability depends on the selected driver and must be evaluated explicitly.
The gateway can dispatch multiple applications while preserving route, component, asset, config, and session boundaries. Validate host routing and isolation before production.
wrnexus build . produces dist/server.js and hashed/static assets. Run the server with Bun, apply migrations before traffic, terminate TLS at a trusted edge, and forward only expected proxy headers.
Mobile compatibility bridges SSR-safe Capacitor capabilities; native route generation is experimental and is not general web portability. Test each target platform.
app/routes.gen.ts, .wrnexus/, and dist/ are generated. The runtime is Bun-only. Preview packages are private. Historical compatibility and long-term support policy are not yet published.
WRNexusJS is Bun-native and SSR-first. File discovery maps pages and API handlers; middleware enriches or short-circuits a request; the compiler turns .wrn declarations into server render functions and small feature runtimes.
core owns contexts, middleware, sessions and rooms; router discovers routes; compiler parses .wrn; ssr renders documents; csr supplies browser runtimes; dev-server and cli orchestrate development and builds.
Validation happens at trust boundaries. Session authentication establishes identity; authorization makes resource decisions. CSP, Trusted Types, CSRF, upload checks, WebSocket origins, request limits, and output escaping are layered controls—not substitutes for application policy.
Rooms are process-local unless connected through pub/sub. Redis-backed pub/sub distributes events. Queue durability depends on the selected driver and must be evaluated explicitly.
The gateway can dispatch multiple applications while preserving route, component, asset, config, and session boundaries. Validate host routing and isolation before production.
wrnexus build . produces dist/server.js and hashed/static assets. Run the server with Bun, apply migrations before traffic, terminate TLS at a trusted edge, and forward only expected proxy headers.
Mobile compatibility bridges SSR-safe Capacitor capabilities; native route generation is experimental and is not general web portability. Test each target platform.
app/routes.gen.ts, .wrnexus/, and dist/ are generated. The runtime is Bun-only. Preview packages are private. Historical compatibility and long-term support policy are not yet published.
No comparative speed claims are published. A valid baseline must record scripts, commit, Bun/framework versions, hardware, OS, warmup, samples, workload, raw results, median, percentiles, memory, HTML size, browser JavaScript size, and run date.
The roadmap starts with WRNexusJS-only measurements before any maintained equivalent-workload comparison.
Documentation is aligned to all 46 installed packages. This release adds @wrnexus/helpers, original-request URL helpers, safe login redirects, working wrnexus workspace add, and forward-auth redirect propagation.
Run wrnexus update --latest and keep every @wrnexus/* package on 0.8.4. Existing applications must explicitly add @wrnexus/helpers before importing it; newly scaffolded applications include it automatically.
The packages use semantic-looking versions, but a formal compatibility and old-release support policy has not been approved. Preview consumers should treat minor releases as potentially requiring migration review.
Documentation is aligned to all 47 installed packages. This release adds @wrnexus/helpers, original-request URL helpers, safe login redirects, working wrnexus workspace add, and forward-auth redirect propagation.
Run wrnexus update --latest and keep every @wrnexus/* package on 0.8.5. Existing applications must explicitly add @wrnexus/helpers before importing it; newly scaffolded applications include it automatically.
The packages use semantic-looking versions, but a formal compatibility and old-release support policy has not been approved. Preview consumers should treat minor releases as potentially requiring migration review.
Examples are tied to installed 0.8.4 package documentation. The focused snippets in guides are source-verified; standalone runnable projects and CI compilation are tracked as remaining work.
Examples are tied to installed 0.8.5 package documentation. The focused snippets in guides are source-verified; standalone runnable projects and CI compilation are tracked as remaining work.
This path creates a server-rendered page, validated API route, middleware, and realtime next step. It requires approved registry access and Bun 1.3.x; this site was verified with Bun 1.3.14.
bunx @wrnexus/cli@0.8.4 create my-app
+ Preview guide · v0.8.5Build a contact inbox
This path creates a server-rendered page, validated API route, middleware, and realtime next step. It requires approved registry access and Bun 1.3.x; this site was verified with Bun 1.3.14.
1. Create the project
bunx @wrnexus/cli@0.8.5 create my-app
cd my-app
bun install
bun run dev
2. Know the structure
app/pages/ # file-based .wrn routes
@@ -39,7 +39,7 @@ export const POST = async (ctx) => {
}
7. Test and ship
bun run test
bun run build
bun dist/server.js
Next: deployment, database, authentication, and workspaces.
Export GET, POST, PUT, PATCH, or DELETE from app/api files. Validate request bodies, enforce authentication and authorization, cap request sizes, and return Web Responses.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Export GET, POST, PUT, PATCH, or DELETE from app/api files. Validate request bodies, enforce authentication and authorization, cap request sizes, and return Web Responses.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure session authentication, log users in through supported auth helpers, and read identity from context. Cookie flags, rotation, expiry, and secret storage remain deployment responsibilities.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure session authentication, log users in through supported auth helpers, and read identity from context. Cookie flags, rotation, expiry, and secret storage remain deployment responsibilities.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Authentication identifies; authorization decides. Enforce permissions in server routes and policies, including object ownership. UI hiding is never an authorization boundary.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Authentication identifies; authorization decides. Enforce permissions in server routes and policies, including object ownership. UI hiding is never an authorization boundary.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
wrnexus.config.ts owns styles, SEO, security, data, mobile, fonts, and profiles. Keep secrets in validated environment variables and review merged production configuration.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
wrnexus.config.ts owns styles, SEO, security, data, mobile, fonts, and profiles. Keep secrets in validated environment variables and review merged production configuration.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure SQLite or the installed supported driver, keep queries in named SQL blocks, generate typed functions, and apply migrations before traffic. Back up data and test rollback independently.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure SQLite or the installed supported driver, keep queries in named SQL blocks, generate typed functions, and apply migrations before traffic. Back up data and test rollback independently.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Run bun run build, apply migrations, and start dist/server.js with Bun. Configure TLS, proxy trust, environment validation, health checks, graceful restarts, logs, backups, and restrictive security headers.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Run bun run build, apply migrations, and start dist/server.js with Bun. Configure TLS, proxy trust, environment validation, health checks, graceful restarts, logs, backups, and restrictive security headers.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Define a v.object schema, use data-schema on the form, show field errors with data-error, and always call parseBody on the server. refine is server-only.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Define a v.object schema, use data-schema on the form, show field errors with data-error, and always call parseBody on the server. refine is server-only.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Store locale JSON under app/locales and use translation directives. Themes resolve CSS tokens; ensure contrast, system preference behavior, persistence, and non-color cues.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Store locale JSON under app/locales and use translation directives. Themes resolve CSS tokens; ensure contrast, system preference behavior, persistence, and non-color cues.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Middleware receives context and next. Return next() to continue or return a Response to stop. Put request limits and trust-boundary controls before business logic.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Middleware receives context and next. Return next() to continue or return a Response to stop. Put request limits and trust-boundary controls before business logic.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Mobile capabilities are experimental in this preview. Test Capacitor permissions and lifecycle on each platform; do not assume every .wrn or browser API converts to native.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Mobile capabilities are experimental in this preview. Test Capacitor permissions and lifecycle on each platform; do not assume every .wrn or browser API converts to native.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use tracking middleware and sinks with redaction, sampling, stable request identifiers, alert ownership, and retention limits. Never capture registry tokens or session secrets.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use tracking middleware and sinks with redaction, sampling, stable request identifiers, alert ownership, and retention limits. Never capture registry tokens or session secrets.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Pages are routable, components are reusable, and layouts provide shared slots. Mount a component with data-component and keep browser state scoped and minimal.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Pages are routable, components are reusable, and layouts provide shared slots. Mount a component with data-component and keep browser state scoped and minimal.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Pages, components, layouts, APIs, middleware, schemas, database files, locales, realtime rooms, and styles live under app. Never edit app/routes.gen.ts, .wrnexus, or dist by hand.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Pages, components, layouts, APIs, middleware, schemas, database files, locales, realtime rooms, and styles live under app. Never edit app/routes.gen.ts, .wrnexus, or dist by hand.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
The in-process driver cannot cross processes. Use Redis where instances must share events, define channel ownership, and design for reconnects and duplicate delivery.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
The in-process driver cannot cross processes. Use Redis where instances must share events, define channel ownership, and design for reconnects and duplicate delivery.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Queue behavior is preview-level. Treat in-process work as non-durable, make handlers idempotent, cap retries, record failures, and choose a production persistence strategy.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Queue behavior is preview-level. Treat in-process work as non-durable, make handlers idempotent, cap retries, record failures, and choose a production persistence strategy.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
defineRoom handles connection and messages. Validate message shapes, authorize subscriptions, restrict origins, bound payloads, and use pub/sub to scale across processes.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
defineRoom handles connection and messages. Validate message shapes, authorize subscriptions, restrict origins, bound payloads, and use pub/sub to scale across processes.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
A page filename defines its URL; index maps to the directory root and bracket segments are dynamic parameters. API files under app/api expose HTTP method functions and receive a Context.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
A page filename defines its URL; index maps to the directory root and bracket segments are dynamic parameters. API files under app/api expose HTTP method functions and receive a Context.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use CSP, CSRF, Trusted Types, session hardening, validation, origin checks, upload restrictions, encryption, request limits, and explicit CORS. See the security policy for reporting.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use CSP, CSRF, Trusted Types, session hardening, validation, origin checks, upload restrictions, encryption, request limits, and explicit CORS. See the security policy for reporting.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use an ssr API binding, return the desired response field, and render it with a server #each block. Values are escaped. Avoid fetching private data through a route that lacks authorization.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use an ssr API binding, return the desired response field, and render it with a server #each block. Values are escaped. Avoid fetching private data through a route that lacks authorization.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use Bun tests and @wrnexus/test helpers. Cover server HTML, API status and validation, authorization failures, reactive behavior, and a production startup smoke test.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Use Bun tests and @wrnexus/test helpers. Cover server HTML, API status and validation, authorization failures, reactive behavior, and a production startup smoke test.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Confirm Bun and package versions, regenerate docs/routes through supported commands, read the first compiler diagnostic, check file naming, validate config, and reproduce under a production build.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Confirm Bun and package versions, regenerate docs/routes through supported commands, read the first compiler diagnostic, check file naming, validate config, and reproduce under a production build.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Back up and commit first, then use wrnexus update --latest as documented by the installed CLI. Review migrations and keep every @wrnexus package aligned. Current release: 0.8.4.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Back up and commit first, then use wrnexus update --latest as documented by the installed CLI. Review migrations and keep every @wrnexus package aligned. Current release: 0.8.5.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure named stores, accepted MIME/extensions, and maxBytes. Random keys avoid path traversal. Private files require an authenticated serving route; v1 buffers each file in memory.
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Configure named stores, accepted MIME/extensions, and maxBytes. Random keys avoid path traversal. Private files require an authenticated serving route; v1 buffers each file in memory.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
A workspace runs isolated applications behind one domain-routing gateway. Add an application from the workspace root; the CLI scaffolds apps/reports and registers it in wrnexus.workspace.ts:
wrnexus workspace add reports --domain=reports.localhost
+ Preview guide · 0.8.5Workspaces and gateway
A workspace runs isolated applications behind one domain-routing gateway. Add an application from the workspace root; the CLI scaffolds apps/reports and registers it in wrnexus.workspace.ts:
wrnexus workspace add reports --domain=reports.localhost
bun install
bun run dev
Forward authentication
Point protected applications at a dedicated verifier endpoint. The verifier must return 2xx for an authenticated session, 401/403 to deny access, or an HTTP redirect to begin browser login.
// wrnexus.workspace.ts
{
@@ -28,8 +28,8 @@ export const GET = async (ctx: Context) => {
return redirectToLogin(ctx, "/login", {
allowedHosts: ["admin.localhost:3000", "reports.localhost:3000"],
});
-};
Always allowlist redirect hosts. After login, validate or sign the returnTo value before redirecting. Keep internal app ports private and open applications through the gateway port.
Release scope
This guide describes installed 0.8.4 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Always allowlist redirect hosts. After login, validate or sign the returnTo value before redirecting. Keep internal app ports private and open applications through the gateway port.
This guide describes installed 0.8.5 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
WRNexusJS v0.8.4
WRNexusJS is an SSR-first, Bun-native full-stack framework. Build typed pages, APIs, validated forms, realtime rooms, secure sessions, workspaces, and optional mobile experiences with the .wrn component language.
Private developer preview. Request access to the package registry.
page Dashboard {
+ WRNexusJS v0.8.5
Build from the server.
Ship only what matters.
WRNexusJS is an SSR-first, Bun-native full-stack framework. Build typed pages, APIs, validated forms, realtime rooms, secure sessions, workspaces, and optional mobile experiences with the .wrn component language.
Private developer preview. Request access to the package registry.
app/pages/dashboard.wrnpage Dashboard {
ssr { api tasks GET /api/tasks { return tasks } }
view {
<main>
@@ -35,10 +35,10 @@ export const POST = async (ctx) => {
return result.ok ? Response.json({ ok: true }, { status: 201 }) : result.response;
};
Request lifecycle
- RequestSecurity headers and request limits
- MiddlewareAuthentication, policy, and context
- File routePage or API handler
- Compiler + SSRSafe HTML and scoped runtime
- ResponseHTML, JSON, stream, or realtime upgrade
Production proof
WorkRoot
Public creator/company site and approved WRNexusJS production showcase.
wrnexusjs.dev
This documentation application runs WRNexusJS 0.8.4.
Capability status
Capability Status Details SSR, routing, compiler, APIs Preview Installed in 0.8.4; public support policy pending. Mobile/native Experimental Capacitor compatibility and native generation have platform limitations. Durable queues Experimental Production durability requires an appropriate driver strategy.
Continue exploring
Production proof
WorkRoot
Public creator/company site and approved WRNexusJS production showcase.
wrnexusjs.dev
This documentation application runs WRNexusJS 0.8.5.
Capability status
Capability Status Details SSR, routing, compiler, APIs Preview Installed in 0.8.5; public support policy pending. Mobile/native Experimental Capacitor compatibility and native generation have platform limitations. Durable queues Experimental Production durability requires an appropriate driver strategy.
Continue exploring
W WRNexusJS
+ W WRNexusJS
Browse documentation
- Language reference · 0.8.4The .wrn language
File anatomy
page Account {
+ Language reference · 0.8.5The .wrn language
File anatomy
page Account {
layout = "public"
seo { title = "Account" description = "Manage your account." }
state count = 0
view { <button @click="count++">Count {count}</button> }
}
Pages, components, layouts, props, and state
Pages are routes. Components declare default-valued props and may hold state. Layouts provide shared slots. Mount components with data-component; fill default or named slots with data-slot.
Interpolation, conditionals, and loops
Interpolation is HTML-escaped. Use server {#if} and {#each} for SSR data. Use data-show for reactive client visibility.
Events and directives
@click and other events execute in the reactive scope. Data attributes opt into forms, i18n, themes, realtime, uploader, browser, and mobile behavior. Consult the exact package page because availability varies.
Forms, i18n, themes, and realtime
form[data-schema] connects descriptors to client and server validation. Translation keys use {t:key}. Theme toggles use data-wire-theme-toggle. Realtime pages opt into a named room.
Escaping and security
Text interpolation is escaped by default. Do not construct trusted HTML from user input. Server-only refinements must be repeated at the authoritative mutation boundary.
Common compiler errors
- Use balanced braces; a literal brace must be escaped.
- Declare UI in
view, not JSX or hooks. - Use a valid page, component, or layout declaration matching the file role.
- Keep server loops tied to available SSR bindings.
- Check troubleshooting and compiler API for this release.
W WRNexusJS
+ W WRNexusJS
Browse documentation
License
Owner decision requiredThis documentation repository contains no public license file, and the packages are unavailable from the public npm registry. No open-source license or redistribution right should be inferred.
Approved preview users must follow the private/commercial terms supplied by WorkRoot. Contact WorkRoot before copying, redistributing, or using WRNexusJS in production.
W WRNexusJS
-
+
Browse documentation
- 46 focused packagesPackage reference
Everything in the framework, organized by responsibility and documented from the published 0.8.4 APIs.
Showing {category} packages
+ 46 focused packagesPackage reference
Everything in the framework, organized by responsibility and documented from the published 0.8.5 APIs.
Showing {category} packages
AI@wrnexus/ai
Server-side Anthropic client with generation and streaming.
Open documentation →
@@ -153,7 +153,7 @@ page Packages {
Security@wrnexus/validation
Typed schemas, coercion, validation, and browser descriptors.
Open documentation →
Server-side Anthropic client with generation and streaming.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/ai@0.8.4Request preview access. Never put registry tokens in source control.
Provider-neutral AI orchestration for OpenAI, Anthropic, Google and local OpenAI-compatible models, with streaming, structured output, tools, embeddings, vector search/RAG, conversation persistence, templates, guardrails, usage events, fallback, rate limits and evaluation reports.
+Server-side Anthropic client with generation and streaming.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/ai@0.8.5Request preview access. Never put registry tokens in source control.
Provider-neutral AI orchestration for OpenAI, Anthropic, Google and local OpenAI-compatible models, with streaming, structured output, tools, embeddings, vector search/RAG, conversation persistence, templates, guardrails, usage events, fallback, rate limits and evaluation reports.
A tiny, zero-dependency Claude (Anthropic) client for WRNexusJS apps — generate and stream text with Claude from any server-side code.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
Authentication routes, sessions, forms, guards, and account flows.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/auth@0.8.4Request preview access. Never put registry tokens in source control.
Framework-native authentication, identity, account-security, and session management for WRNexusJS.
+Authentication routes, sessions, forms, guards, and account flows.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/auth@0.8.5Request preview access. Never put registry tokens in source control.
Framework-native authentication, identity, account-security, and session management for WRNexusJS.
Role, permission, policy, and authorization guards.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/authz@0.8.4Request preview access. Never put registry tokens in source control.
Composable authorization for WRNexusJS — role-based (RBAC), policy-based (PBAC), and attribute-based (ABAC) access control that reduces to a boolean check plus an authorize() guard.
+ Role, permission, policy, and authorization guards.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/authz@0.8.5Request preview access. Never put registry tokens in source control.
Composable authorization for WRNexusJS — role-based (RBAC), policy-based (PBAC), and attribute-based (ABAC) access control that reduces to a boolean check plus an authorize() guard.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/authz is a small, server-side authorization toolkit. It gives you three interchangeable models — RBAC (roles → permissions), PBAC (policy predicates), and ABAC (attribute matchers) — that all collapse to a boolean | Promise<boolean> decision. Wrap any decision in a Middleware guard (authorize, requireRole, requirePermission) to protect WRNexusJS routes. Reach for it whenever a route or action needs to be gated on who the user is, what roles they hold, or attributes of the user and the resource. It plugs into @wrnexus/core by reading ctx.user as the authorization subject.
@wrnexus/core](../core) — the guards return Middleware and read the subject from ctx.user on the request Context. Both types are imported from @wrnexus/core.any, all) and authorize are async-aware, so policies may return a Promise<boolean> (e.g. for a database ownership check).Generated from the exact installed package declarations.
import { Context, Middleware } from '@wrnexus/core';
+
+Declaring permissions
+The RBAC/PBAC/ABAC surface above is the low-level toolkit. On top of it sits a declarative registry + catalog + store + engine: permissions, roles, and policies are declared once in code, merged into a frozen catalog at boot, and resolved per-request against a pluggable PermissionStore that holds who has what.
+Put declarations in app/authz/<name>.ts; they are discovered automatically and merged (conflicting declarations of the same permission/role/policy across files fail the boot loudly, naming both source files).
+import { defineAuthz, owner } from "@wrnexus/authz";
-interface AuthorizationDecision {
+export default defineAuthz({
+ permissions: {
+ "post:read": { title: "View posts", public: true },
+ "post:delete": { title: "Delete posts", risk: "high" },
+ },
+ // "post:*" is a namespace wildcard grant, valid inside a role's list — it is
+ // not itself a registered permission, so it can only ever grant permissions
+ // that ARE declared above (e.g. "post:read", "post:delete").
+ roles: { editor: ["post:*"], admin: ["role:editor"] },
+ policies: { ownsPost: owner("id", "authorId") },
+ bindings: { "post:delete": ["ownsPost"] },
+});
+public: true means anonymous callers may hold the permission — but any policy bound to it still runs, and can still veto the anonymous caller (e.g. a notBanned policy on a public post:preview permission).
+Checking permissions
+Register authzMiddleware once, in app/middleware/, with the merged catalog and a PermissionStore. Like every other app/middleware/*.ts file, the registration is an eager, module-scope call — the same shape as authzMiddleware({ catalog, store }) requires — so it must run after the catalog has been populated. Both the dev server and wrnexus build's generated production entry guarantee getAuthzCatalog() is populated before any app middleware module evaluates. Name the file so it sorts after whatever middleware sets ctx.user (middleware runs in alphabetical filename order — authz.ts after auth.ts, for instance).
+// app/middleware/authz.ts
+import { authzMiddleware, getAuthzCatalog } from "@wrnexus/authz";
+import { dbPermissionStore } from "@wrnexus/authz/db";
+import { getDb } from "@wrnexus/db";
+
+export default authzMiddleware({ catalog: getAuthzCatalog(), store: dbPermissionStore(getDb()) });
+subject.id must be a non-empty string. The engine denies (and logs to
+stderr) whenever ctx.user.id is present but not a non-empty string — this
+includes the common case of an integer primary key. Coerce it before it
+reaches ctx.user, e.g. user.id = String(row.id), or every request for
+that user denies with "Invalid subject" instead of resolving normally.
+owner() (the built-in ownership policy) compares subject and resource ids
+with Object.is, so both sides must be the same type too — owner() on a
+numeric resource.authorId against a stringified subject.id never
+matches even when they represent "the same" id.
+There is no per-route middleware export — app/middleware/*.ts is the only place middleware is registered. To gate part of the app, branch on the request the same way any other conditional middleware does (compare app/middleware/captcha-login.ts in the auth showcase, which branches on method + path the same way):
+// app/middleware/protect-posts.ts
+import type { Context, Next } from "@wrnexus/core";
+import { guardPermission } from "@wrnexus/authz";
+
+const guardPostWrite = guardPermission("post:write");
+
+export default function protectPosts(ctx: Context, next: Next) {
+ return ctx.url.pathname.startsWith("/api/posts") && ctx.req.method !== "GET"
+ ? guardPostWrite(ctx, next)
+ : next();
+}
+Or check inline inside a route handler with the free function can():
+// app/api/posts/[id].ts
+import type { Context } from "@wrnexus/core";
+import { can } from "@wrnexus/authz";
+
+export const DELETE = async (ctx: Context) => {
+ const post = { id: "1", authorId: "alice" }; // load your own resource here
+ if (!(await can(ctx, "post:delete", post))) {
+ return Response.json({ ok: false, error: "Forbidden" }, { status: 403 });
+ }
+ return Response.json({ ok: true });
+};
+can() is a free function taking ctx, not ctx.can — @wrnexus/core must not depend on @wrnexus/authz, so the per-request resolver lives in ctx.locals instead, reached through can() / decideFor() / guardPermission() / filterCan(). Calling any of them before authzMiddleware has run for that request throws a WRN-AUTHZ-SETUP error naming the missing registration, rather than silently denying.
+See examples/auth-showcase/app/authz/showcase.ts and examples/auth-showcase/app/middleware/authz.ts for a complete, runnable version of this wiring.
+Precedence
+1. An explicit deny wins over everything, including * — and honours the same namespace-wildcard matching as grants (denying post:* blocks post:comment:delete, not just post:* itself). 2. A bound policy can veto a permission a role grants, and runs even for a public: true permission — including for an anonymous caller. 3. Otherwise the permission must be held via a role or an explicit grant. 4. Default deny.
+Every failure — an unknown permission (outside strict/dev mode), a store outage, a thrown policy — denies rather than throwing through to the caller.
+permissionsFor() (on the resolver returned by createAuthzResolver) is a coarse hint for hiding UI (e.g. a menu section), never authoritative. A Set<string> cannot represent "granted post:* except post:delete", so a narrow deny beneath a broad grant is invisible to it — the set still contains post:* while can() / decide() correctly refuse post:delete. Gate real actions with can(), decideFor(), or filterCan(); never by matching against permissionsFor()'s result.
+CLI
+wrnexus authz list # every registered permission, role, and policy
+wrnexus authz generate # app/authz/permissions.gen.ts type unions
+wrnexus authz init # scaffold the assignment-table migration
+wrnexus authz generate's output is a plain Permission | Role string-literal union — can(), guardPermission(), and decideFor() all take a bare string and nothing reads this file automatically, so import it to type your own helpers/constants against the registered catalog, e.g.:
+import type { Permission } from "app/authz/permissions.gen.ts";
+
+function guard(permission: Permission) {
+ return guardPermission(permission);
+}
Generated from the exact installed package declarations.
import { Context, Middleware } from '@wrnexus/core';
+
+/**
+ * Validate and freeze one authorization declaration. Called from
+ * `app/authz/<name>.ts` as the module's default export.
+ */
+declare function defineAuthz(module: AuthzModule): AuthzModule;
+
+interface CatalogSource {
+ /** File or package that declared this module, used in conflict messages. */
+ source: string;
+ module: AuthzModule;
+}
+declare function emptyCatalog(): AuthzCatalog;
+declare function mergeCatalogs(sources: CatalogSource[]): AuthzCatalog;
+
+/**
+ * A process-wide authorization catalog registry, mirroring `@wrnexus/db`'s
+ * `client.ts` (`setDb`/`getDb`/`hasDb`). It exists for the same reason: app
+ * middleware runs at module-eval time — `app/middleware/*.ts` registers
+ * `authzMiddleware({ catalog, store, ... })` itself, an EAGER call (the same
+ * shape as `logger.ts`'s `export default requestLogger({...})`), and it needs
+ * the merged catalog *then*, before its own module body finishes running.
+ * Passing it through `ctx` does not work at that point, so the framework
+ * loads and merges every `app/authz/*.ts` declaration and stashes it here
+ * before any other module can observe it:
+ *
+ * - dev: `startServer` calls `loadAppAuthzCatalog` + `setAuthzCatalog`
+ * before middleware is resolved.
+ * - prod (the normal `wrnexus build` output): the generated entry statically
+ * imports a small `.authz-setup.ts` module FIRST — before any page, API,
+ * or middleware import — which calls `setAuthzCatalog` at ITS OWN module
+ * scope. ES modules evaluate every static import before the importing
+ * module's body runs, and evaluate sibling imports in declaration order,
+ * so import position is evaluation order: this guarantees the catalog
+ * exists before app middleware's own module body (which may read it
+ * eagerly) ever evaluates. `createProductionHandlers` (`prod.ts`) then
+ * repeats the merge as an idempotent second pass, mainly so a caller who
+ * bypasses the generated entry and invokes it directly still gets a
+ * catalog — for THAT path specifically, an eager module-scope read in
+ * middleware is only safe if the caller sets the catalog before importing
+ * the middleware itself, since no generated `.authz-setup.ts` runs first.
+ *
+ * The framework never installs `authzMiddleware` itself — the app always
+ * chooses its own store and registers the middleware; this registry only
+ * makes the merged catalog reachable when it does.
+ */
+
+/** Set the process-wide authorization catalog (called by the framework at boot). */
+declare function setAuthzCatalog(next: AuthzCatalog): AuthzCatalog;
+/** The process-wide authorization catalog. Throws if it hasn't been set. */
+declare function getAuthzCatalog(): AuthzCatalog;
+/** Whether the process-wide authorization catalog has been set. */
+declare function hasAuthzCatalog(): boolean;
+
+interface AuthzAuditEvent {
+ subjectId?: string;
+ scope?: AuthzScope;
+ permission: string;
allowed: boolean;
reason?: string;
policy?: string;
- metadata?: Record<string, unknown>;
+ /** Epoch milliseconds. */
+ at: number;
}
-type DecisionPolicy<S = Subject, R = unknown> = (subject: S, resource?: R) => AuthorizationDecision | Promise<AuthorizationDecision>;
-declare function allow(reason?: string, metadata?: Record<string, unknown>): AuthorizationDecision;
-declare function deny(reason?: string, metadata?: Record<string, unknown>): AuthorizationDecision;
-declare function decision<S, R>(name: string, policy: Policy<S, R>, denial?: string): DecisionPolicy<S, R>;
-declare function owner<SubjectType extends Subject, Resource extends Record<string, unknown>>(subjectKey?: keyof SubjectType, resourceKey?: keyof Resource | string): DecisionPolicy<SubjectType, Resource>;
-declare function anyDecision<S, R>(...policies: DecisionPolicy<S, R>[]): DecisionPolicy<S, R>;
-declare function allDecisions<S, R>(...policies: DecisionPolicy<S, R>[]): DecisionPolicy<S, R>;
-declare function authorizeDecision(evaluate: (ctx: Context) => AuthorizationDecision | Promise<AuthorizationDecision>): Middleware;
-declare function filterAuthorized<S, R>(subject: S, values: readonly R[], policy: Policy<S, R>): Promise<R[]>;
+interface AuthzAuditSink {
+ record(event: AuthzAuditEvent): void | Promise<void>;
+}
+interface MemoryAuditSink extends AuthzAuditSink {
+ events: AuthzAuditEvent[];
+ clear(): void;
+}
+declare function memoryAuditSink(): MemoryAuditSink;
+declare function consoleAuditSink(): AuthzAuditSink;
+/** Record without ever letting a sink failure escape into the request path. */
+declare function safeRecord(sink: AuthzAuditSink | undefined, event: AuthzAuditEvent): void;
+
+interface AuthzResolverOptions {
+ catalog: AuthzCatalog;
+ store: PermissionStore;
+ audit?: AuthzAuditSink;
+ /**
+ * Throw on an unregistered permission instead of denying. Defaults to true
+ * outside production, so typos surface during development.
+ */
+ strict?: boolean;
+ /** Record allows as well as denies. Off by default to bound write volume. */
+ auditAllows?: boolean;
+}
+interface DecideInput {
+ subject: {
+ id?: string;
+ [key: string]: unknown;
+ } | null | undefined;
+ permission: string;
+ resource?: unknown;
+ scope?: AuthzScope;
+}
+interface AuthzResolver {
+ /**
+ * Effective permissions with denied entries removed — for coarse gating such
+ * as hiding a menu section.
+ *
+ * NOT authoritative. A set of strings cannot express "everything under
+ * `post:*` except `post:delete`", so a narrow deny beneath a broad grant is
+ * not representable here: the set still contains `post:*` while `decide()`
+ * correctly refuses `post:delete`. Gate individual actions with `decide()`
+ * (or `can()` / `filterCan()`), never by matching against this set.
+ */
+ permissionsFor(subjectId: string, scope?: AuthzScope): Promise<Set<string>>;
+ decide(input: DecideInput): Promise<AuthorizationDecision>;
+}
+/** Expand roles into their granted entries, following `role:` and stopping on cycles. */
+declare function expandRoles(catalog: AuthzCatalog, roles: readonly string[]): Set<string>;
+/**
+ * Exact match, root wildcard, or a namespace wildcard at any depth.
+ *
+ * Do NOT gate access by matching against `permissionsFor()`'s result — that set
+ * cannot represent a narrow deny beneath a broad grant, so the composition
+ * returns true where `decide()` refuses. Use `decide()` / `can()` instead.
+ */
+declare function permissionMatches(granted: Set<string>, permission: string): boolean;
+/**
+ * True if any entry in the deny list covers `permission`. Denies honour the
+ * same depth-aware wildcards as grants, so denying "post:*" blocks
+ * post:comment:delete rather than being accepted and silently doing nothing.
+ */
+declare function deniedBy(denies: readonly string[], permission: string): boolean;
+declare function createAuthzResolver(options: AuthzResolverOptions): AuthzResolver;
+
+/**
+ * `can` is deliberately not a Context member: @wrnexus/core must not depend on
+ * @wrnexus/authz. The per-request resolver lives here instead.
+ */
+declare const AUTHZ_LOCALS_KEY = "_authz";
+/** Install the per-request resolver. Register early, after sessionAuth. */
+declare function authzMiddleware(options: AuthzResolverOptions): Middleware;
+/**
+ * Object resources are memoised by identity (`byRef`), never by serialising
+ * their contents — serialisation is what let unrelated resources collide
+ * (same `id` shape, circular references, BigInt fields, throwing getters all
+ * funnelled into one bucket). Symbols are memoised by identity too (`bySymbol`)
+ * since `String(symbol)` collapses distinct symbols with the same description.
+ * Primitive/absent resources are memoised by a
+ * `[scope, permission, typeof, String(value)]` tuple, with `-0` rendered
+ * distinctly from `0` since `String(-0) === "0"` would otherwise merge them.
+ *
+ * Subject and scope are both part of the key. A request that reassigns
+ * ctx.user (impersonation, step-up auth, session revocation) or ctx.tenant
+ * must not be served the previous principal's verdict from the memo.
+ */
+declare function decideFor(ctx: Context, permission: string, resource?: unknown): Promise<AuthorizationDecision>;
+declare function can(ctx: Context, permission: string, resource?: unknown): Promise<boolean>;
+interface GuardOptions {
+ /** Load the resource a bound policy needs. */
+ getResource?: (ctx: Context) => unknown;
+ /** Include reason and policy name in the 403 body. Off by default. */
+ exposeReason?: boolean;
+ /** Redirect page requests here instead of returning 403. Ignored for JSON/API requests and for any non-local target. */
+ redirectTo?: string;
+}
+/**
+ * Guard a route on a registered permission. Named `guardPermission` because
+ * `requirePermission(rbac, permission)` already exists with a different shape.
+ */
+declare function guardPermission(permission: string, options?: GuardOptions): Middleware;
+/** Keep only the items the current subject may act on. */
+declare function filterCan<T>(ctx: Context, permission: string, items: readonly T[]): Promise<T[]>;
+
+/**
+ * Emit `Permission`/`Role` string-literal unions from the registered catalog.
+ *
+ * This does NOT make `can(ctx, "post:wrtie")` a type error — `can()`,
+ * `guardPermission()`, and `decideFor()` all take a bare `string`, and
+ * nothing in the framework consumes this generated file automatically.
+ * Import the unions yourself to type your OWN helpers/constants, e.g.
+ * `const PERM: Permission = "post:write"` or a typed wrapper around `can()`.
+ */
+declare function generatePermissionTypes(catalog: AuthzCatalog): string;
/**
* @wrnexus/authz — authorization: role-based (RBAC), policy-based (PBAC), and
@@ -183,7 +420,108 @@ declare function requireRole(...roles: string[]): Middleware;
/** Guard requiring an RBAC permission. */
declare function requirePermission(rbac: Rbac, permission: string): Middleware;
-export { type AuthorizationDecision, type DecisionPolicy, type Policy, type Rbac, type Subject, all, allDecisions, allow, any, anyDecision, attr, authorize, authorizeDecision, decision, defineRbac, deny, filterAuthorized, hasRole, owner, requirePermission, requireRole };
+interface AuthorizationDecision {
+ allowed: boolean;
+ reason?: string;
+ policy?: string;
+ metadata?: Record<string, unknown>;
+}
+type DecisionPolicy<S = Subject, R = unknown> = (subject: S, resource?: R) => AuthorizationDecision | Promise<AuthorizationDecision>;
+declare function allow(reason?: string, metadata?: Record<string, unknown>): AuthorizationDecision;
+declare function deny(reason?: string, metadata?: Record<string, unknown>): AuthorizationDecision;
+declare function decision<S, R>(name: string, policy: Policy<S, R>, denial?: string): DecisionPolicy<S, R>;
+declare function owner<SubjectType extends Subject, Resource extends Record<string, unknown>>(subjectKey?: keyof SubjectType, resourceKey?: keyof Resource | string): DecisionPolicy<SubjectType, Resource>;
+declare function anyDecision<S, R>(...policies: DecisionPolicy<S, R>[]): DecisionPolicy<S, R>;
+declare function allDecisions<S, R>(...policies: DecisionPolicy<S, R>[]): DecisionPolicy<S, R>;
+interface AuthorizeDecisionOptions {
+ /**
+ * Include `reason` and `policy` in the 403 body. Off by default: policy
+ * names describe internal authorization structure and should not reach an
+ * unauthenticated caller.
+ */
+ exposeReason?: boolean;
+}
+declare function authorizeDecision(evaluate: (ctx: Context) => AuthorizationDecision | Promise<AuthorizationDecision>, options?: AuthorizeDecisionOptions): Middleware;
+declare function filterAuthorized<S, R>(subject: S, values: readonly R[], policy: Policy<S, R>): Promise<R[]>;
+
+/** Narrows an assignment to a tenant. Absent means a global assignment. */
+interface AuthzScope {
+ tenantId?: string;
+}
+interface PermissionMeta {
+ title?: string;
+ description?: string;
+ risk?: "low" | "medium" | "high";
+ /** Granted to anonymous subjects. Every other permission denies without a user. */
+ public?: boolean;
+}
+interface AttributeMeta {
+ description?: string;
+}
+/** One `app/authz/<name>.ts` declaration. */
+interface AuthzModule {
+ permissions?: Record<string, PermissionMeta>;
+ roles?: Record<string, string[]>;
+ policies?: Record<string, DecisionPolicy<never, never>>;
+ attributes?: Record<string, AttributeMeta>;
+ /** permission id -> policy names that must pass for it. */
+ bindings?: Record<string, string[]>;
+}
+/** The merged, frozen view of every declaration in the app. */
+interface AuthzCatalog {
+ permissions: ReadonlyMap<string, PermissionMeta>;
+ roles: ReadonlyMap<string, readonly string[]>;
+ policies: ReadonlyMap<string, DecisionPolicy<never, never>>;
+ attributes: ReadonlyMap<string, AttributeMeta>;
+ bindings: ReadonlyMap<string, readonly string[]>;
+}
+interface SubjectAssignments {
+ roles: string[];
+ /** Explicit allows, bypassing roles. */
+ grants: string[];
+ /** Explicit denies. Win over everything, including "*". */
+ denies: string[];
+}
+
+type GrantEffect = "allow" | "deny";
+interface PermissionStore {
+ assignmentsFor(subjectId: string, scope?: AuthzScope): Promise<SubjectAssignments>;
+ assignRole(subjectId: string, role: string, scope?: AuthzScope): Promise<void>;
+ revokeRole(subjectId: string, role: string, scope?: AuthzScope): Promise<void>;
+ grant(subjectId: string, permission: string, effect: GrantEffect, scope?: AuthzScope): Promise<void>;
+ revokeGrant(subjectId: string, permission: string, scope?: AuthzScope): Promise<void>;
+ listSubjects(scope?: AuthzScope): Promise<string[]>;
+}
+/**
+ * Global assignments are stored under the empty-string scope key. An OMITTED
+ * scope means global; an explicitly EMPTY or non-string tenantId is refused,
+ * because an empty string is indistinguishable from global (and would let a
+ * caller who controls the tenant id read and write global assignments), and a
+ * non-string value (e.g. `null` from a JSON body or a nullable column) would
+ * otherwise flow through un-normalised and leave the adapters disagreeing
+ * about what happened.
+ */
+declare function scopeKey(scope?: AuthzScope): string;
+declare function memoryPermissionStore(): PermissionStore;
+interface CachedPermissionStore extends PermissionStore {
+ /** Drop one subject. Call after changing roles out of band. */
+ invalidate(subjectId: string, scope?: AuthzScope): void;
+ invalidateAll(): void;
+ /** Cached entry count, for tests and diagnostics. */
+ size(): number;
+}
+interface CacheOptions {
+ ttlMs?: number;
+ max?: number;
+}
+/**
+ * Caches assignment reads. Writes through this decorator invalidate the
+ * affected subject immediately; changes made directly against the inner store
+ * need an explicit `invalidate()` call rather than waiting out the TTL.
+ */
+declare function cachedPermissionStore(inner: PermissionStore, options?: CacheOptions): CachedPermissionStore;
+
+export { AUTHZ_LOCALS_KEY, type AttributeMeta, type AuthorizationDecision, type AuthorizeDecisionOptions, type AuthzAuditEvent, type AuthzAuditSink, type AuthzCatalog, type AuthzModule, type AuthzResolver, type AuthzResolverOptions, type AuthzScope, type CacheOptions, type CachedPermissionStore, type CatalogSource, type DecideInput, type DecisionPolicy, type GrantEffect, type GuardOptions, type MemoryAuditSink, type PermissionMeta, type PermissionStore, type Policy, type Rbac, type Subject, type SubjectAssignments, all, allDecisions, allow, any, anyDecision, attr, authorize, authorizeDecision, authzMiddleware, cachedPermissionStore, can, consoleAuditSink, createAuthzResolver, decideFor, decision, defineAuthz, defineRbac, deniedBy, deny, emptyCatalog, expandRoles, filterAuthorized, filterCan, generatePermissionTypes, getAuthzCatalog, guardPermission, hasAuthzCatalog, hasRole, memoryAuditSink, memoryPermissionStore, mergeCatalogs, owner, permissionMatches, requirePermission, requireRole, safeRecord, scopeKey, setAuthzCatalog };
Copy-ready examples from the installed package documentation.
import { defineRbac, hasRole } from "@wrnexus/authz";
const rbac = defineRbac({
@@ -240,9 +578,9 @@ app.put(
authorize((ctx) => canEdit(ctx.user as User, loadPost(ctx))),
handler,
);Framework benchmark scenarios and repeatable performance measurements.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/benchmark@0.8.4Request preview access. Never put registry tokens in source control.
Deterministic benchmark execution, percentiles, baseline comparisons, and regression budgets for builds, SSR, hydration, stores, and application hot paths.
+Framework benchmark scenarios and repeatable performance measurements.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/benchmark@0.8.5Request preview access. Never put registry tokens in source control.
Deterministic benchmark execution, percentiles, baseline comparisons, and regression budgets for builds, SSR, hydration, stores, and application hot paths.
import { runBenchmark, assertBenchmarkBudget } from "@wrnexus/benchmark";
const result = await runBenchmark("render", render, { iterations: 100 });
assertBenchmarkBudget(result, baseline, { p95Percent: 5 });Generated from the exact installed package declarations.
interface BenchmarkOptions {
@@ -61,7 +61,7 @@ const result = await runBenchmark("render", render, { iterations:
assertBenchmarkBudget(result, baseline, { p95Percent: 5 });bun add @wrnexus/benchmarkMemory and distributed caching with coordination and invalidation.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/cache@0.8.4Request preview access. Never put registry tokens in source control.
Bounded in-memory/tag caching and HTTP response caching for WRNexusJS. Supports request deduplication, tag invalidation, ETags, fresh/stale states, and optional detached stale revalidation.
+Memory and distributed caching with coordination and invalidation.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/cache@0.8.5Request preview access. Never put registry tokens in source control.
Bounded in-memory/tag caching and HTTP response caching for WRNexusJS. Supports request deduplication, tag invalidation, ETags, fresh/stale states, and optional detached stale revalidation.
import { connectCacheInvalidation, TagCache, responseCache } from "@wrnexus/cache";
const cache = new TagCache({ ttlMs: 60_000, staleWhileRevalidateMs: 300_000 });
export default responseCache({ cache, tags: ["products"] });Managed CAPTCHA verification, middleware, and UI integration.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/captcha@0.8.4Request preview access. Never put registry tokens in source control.
A first-class CAPTCHA and anti-automation package for WRNexusJS. It supports self-hosted challenges, a managed WRNexus service, external providers, form submission guards, page gates, accessible audio, adaptive risk checks, and a Tailwind-only .wrn component.
Managed CAPTCHA verification, middleware, and UI integration.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/captcha@0.8.5Request preview access. Never put registry tokens in source control.
A first-class CAPTCHA and anti-automation package for WRNexusJS. It supports self-hosted challenges, a managed WRNexus service, external providers, form submission guards, page gates, accessible audio, adaptive risk checks, and a Tailwind-only .wrn component.
bun add @wrnexus/captchaWRNexusJS automatically discovers the package plugin, component, client runtime, styles, and DevToolbar audit. Use <Captcha /> directly after installation. The browser runtime is injected once only on responses that render a CAPTCHA; no script tag, public-file copy, or manual plugin registration is required. Call captchaPlugin(options) explicitly only when an application needs to override the discovered package configuration.
Create, develop, build, generate, test, and maintain WRNexusJS apps.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/cli@0.8.4Request preview access. Never put registry tokens in source control.
Production parity commands:
+Create, develop, build, generate, test, and maintain WRNexusJS apps.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/cli@0.8.5Request preview access. Never put registry tokens in source control.
Production parity commands:
wrnexus build .
wrnexus preview . --port=3000
wrnexus dev . --production-runtimeParser and code generators for the .wrn language.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/compiler@0.8.4Request preview access. Never put registry tokens in source control.
Parser and code generators for the .wrn language.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/compiler@0.8.5Request preview access. Never put registry tokens in source control.
Pages can select render = "partial-static" and divide their view with <Static> and <Dynamic> boundaries. The compiler emits a build-only shell renderer that never evaluates dynamic-boundary children. wrnexus build expands static component mounts into dist/partial-shells.json, records byte/region evidence in build-report.json, and embeds the shell in the production route manifest. At request time the production runtime retains request-aware layouts, locale/theme metadata and security nonces while streaming dynamic regions into stable placeholders.
Compiler for the.wrnlanguage — tokenizes, parses, and lowers.wrnpage and component files to TypeScript.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@@ -409,7 +409,7 @@ lx.next(); // { type: "ident", value: "Home", pos: 5 &# lx.next(); // { type: "lbrace", value: "{", pos: 10 }Content collections, validation, querying, and publishing workflows.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/content@0.8.4Request preview access. Never put registry tokens in source control.
Typed content collections for Markdown/MDX-like documents and remote CMS records. Collections validate frontmatter through any { parse(input) } schema, render escaped HTML, and expose draft preview, versions, references, headings, search indexes, pagination, RSS and sitemaps.
Content collections, validation, querying, and publishing workflows.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/content@0.8.5Request preview access. Never put registry tokens in source control.
Typed content collections for Markdown/MDX-like documents and remote CMS records. Collections validate frontmatter through any { parse(input) } schema, render escaped HTML, and expose draft preview, versions, references, headings, search indexes, pagination, RSS and sitemaps.
const posts = defineCollection({
name: "posts",
schema: PostSchema,
@@ -170,7 +170,7 @@ const published = await posts.load();
const preview = await posts.load({ previewToken: request.headers.get("x-preview-token") ?? "" });bun add @wrnexus/contentContexts, middleware, security, sessions, caching, JSX, and realtime.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/core@0.8.4Request preview access. Never put registry tokens in source control.
The framework core: the request Context, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.
+ Contexts, middleware, security, sessions, caching, JSX, and realtime.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/core@0.8.5Request preview access. Never put registry tokens in source control.
The framework core: the request Context, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/core is the shared foundation of WRNexusJS. It defines the Context object that flows through every middleware, page, and API route, plus the Middleware/Next contract they implement. On top of that it ships the building blocks a real app needs: cookie-backed sessions, password auth, CSRF protection, rate limiting, request logging, HTTP + in-memory caching, file uploads, streaming/SSE responses, WebSocket "rooms", security headers/CORS, and a server-side JSX runtime that renders to HTML strings. Everything here is server-side and Bun-native (it uses Bun.password, Bun.write, the web-standard Request/Response, and crypto). You depend on it directly and transitively through the rest of the framework.
Reactive, navigation, and realtime browser runtimes.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/csr@0.8.4Request preview access. Never put registry tokens in source control.
Reactive, navigation, and realtime browser runtimes.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/csr@0.8.5Request preview access. Never put registry tokens in source control.
Pages can opt into restoration across client navigation:
page Users {
navigation {
@@ -330,7 +330,7 @@ room.on("chat", (msg) => console.log(msg.user, msg.text));
room.send({ type: "chat", user: "ada", text: "hi" });Database adapters, typed queries, models, migrations, and sessions.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/db@0.8.4Request preview access. Never put registry tokens in source control.
Database adapters, typed queries, models, migrations, and sessions.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/db@0.8.5Request preview access. Never put registry tokens in source control.
Run wrnexus db check in CI before deployment. The analyzer reports stable diagnostics for drops, renames, type changes, new/enforced required columns, and potentially blocking index creation, with an expand/backfill/switch/contract recommendation. wrnexus db migrate blocks critical issues in pending migrations. --allow-breaking is an explicit operator override; already-applied migrations do not block later releases.
The database layer for WRNexusJS: TS models as the single source of truth for DDL, validation, and result typing, plus a driver-based Db client, migrations, and a sqlc-style query generator.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@@ -527,7 +527,7 @@ await repo.insert({ email: "a@b.com" }); const active = await repo.find({ active: true });Development and production servers, HMR, assets, and gateways.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/dev-server@0.8.4Request preview access. Never put registry tokens in source control.
The WRNexusJS HTTP + WebSocket server runtime — request dispatch, SSR document assembly, live-reload (HMR), and the portable production handler.+
Development and production servers, HMR, assets, and gateways.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/dev-server@0.8.5Request preview access. Never put registry tokens in source control.
The WRNexusJS HTTP + WebSocket server runtime — request dispatch, SSR document assembly, live-reload (HMR), and the portable production handler.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
This package is the server runtime that powers a WRNexusJS app in both development and production. A single request runtime (createHandlers) owns HTTP/WebSocket dispatch and SSR document assembly; it knows nothing about _how_ modules and assets are produced, so the dev and prod entry points wire in different backends: dev uses dynamic module loading plus on-the-fly bundling and injects a live-reload client; prod uses a static, pre-built manifest with cache-immutable assets. The package also ships a multi-app gateway (route several apps by Host header behind one port) and a portable node:http adapter for WinterCG hosts. It is entirely server-side and Bun-native (Bun.serve, Bun.file, Bun.gzipSync).
Copy-ready examples from the installed package documentation.
import { startServer } from "@wrnexus/dev-server";
const server = await startServer({
@@ -819,7 +860,7 @@ await startGateway({
});Development toolbar diagnostics, inspection, and runtime status.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/dev-toolbar@0.8.4Request preview access. Never put registry tokens in source control.
Development-only page quality toolbar for WRNexusJS.
+Development toolbar diagnostics, inspection, and runtime status.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/dev-toolbar@0.8.5Request preview access. Never put registry tokens in source control.
Development-only page quality toolbar for WRNexusJS.
Hashing, HMAC, authenticated encryption, and key derivation.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/encryption@0.8.4Request preview access. Never put registry tokens in source control.
Authenticated encryption, hashing, HMAC, key rotation, and optional encrypted HTTP exchanges for WRNexusJS.
+Hashing, HMAC, authenticated encryption, and key derivation.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/encryption@0.8.5Request preview access. Never put registry tokens in source control.
Authenticated encryption, hashing, HMAC, key rotation, and optional encrypted HTTP exchanges for WRNexusJS.
generateKey() — random 256-bit AES key encoded as base64.bun add @wrnexus/encryptionGraphQL schemas, routes, and framework plugin integration.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/graphql@0.8.4Request preview access. Never put registry tokens in source control.
Optional GraphQL endpoint plugin. Supply the executor from GraphQL.js, GraphQL Yoga, Mercurius, or another maintained engine; WRNexus owns bounded HTTP input, depth/alias limits, introspection policy, generic production errors and plugin route integration.
Generated from the exact installed package declarations.
export { G as GraphqlExecutionResult, a as GraphqlOptions, b as GraphqlRequest, c as createGraphqlHandler, default as graphqlPlugin } from './plugin.js';
+ Data · Package reference@wrnexus/graphql
GraphQL schemas, routes, and framework plugin integration.
Install the package
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/graphql@0.8.5
Request preview access. Never put registry tokens in source control.
Optional GraphQL endpoint plugin. Supply the executor from GraphQL.js, GraphQL Yoga, Mercurius, or another maintained engine; WRNexus owns bounded HTTP input, depth/alias limits, introspection policy, generic production errors and plugin route integration.
Complete TypeScript API
Generated from the exact installed package declarations.
export { G as GraphqlExecutionResult, a as GraphqlOptions, b as GraphqlRequest, c as createGraphqlHandler, default as graphqlPlugin } from './plugin.js';
import '@wrnexus/plugin';
Examples
Copy-ready examples from the installed package documentation.
Install @wrnexus/graphql
bun add @wrnexus/graphql
Import @wrnexus/graphql
import * as graphql from "@wrnexus/graphql";
Safe Context URL helpers and forward-auth login redirects.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/helpers@0.8.4Request preview access. Never put registry tokens in source control.
Safe convenience helpers for common WRNexusJS application flows. The package uses standard Context, URL, and Response values and has no runtime dependency beyond @wrnexus/core.
Safe Context URL helpers and forward-auth login redirects.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/helpers@0.8.5Request preview access. Never put registry tokens in source control.
Safe convenience helpers for common WRNexusJS application flows. The package uses standard Context, URL, and Response values and has no runtime dependency beyond @wrnexus/core.
bun add @wrnexus/helpersThe package is private, so the machine must be authenticated to the wrnexus npm organization.
Translation loading, locale resolution, and Intl formatting.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/i18n@0.8.4Request preview access. Never put registry tokens in source control.
Recursive locale loading, fallback resolution, SSR/browser translations, locale formatting, and language UI blocks for WRNexusJS.
+Translation loading, locale resolution, and Intl formatting.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/i18n@0.8.5Request preview access. Never put registry tokens in source control.
Recursive locale loading, fallback resolution, SSR/browser translations, locale formatting, and language UI blocks for WRNexusJS.
Both layouts can be used together:
app/locales/en.json
@@ -231,7 +231,7 @@ const enXA = createPseudoLocale(messages.en);
const arXB = createPseudoLocale(messages.en, { rtl: true });Portable identity records, claims, and account linking.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/identity@0.8.4Request preview access. Never put registry tokens in source control.
Enterprise identity and governance for WRNexusJS: OIDC discovery, signed SAML adapter flows, LDAP/Active Directory synchronization adapters, SCIM provisioning, scoped API keys, service accounts, approval workflows, consent history, retention, subject export/deletion and audit.
+Portable identity records, claims, and account linking.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/identity@0.8.5Request preview access. Never put registry tokens in source control.
Enterprise identity and governance for WRNexusJS: OIDC discovery, signed SAML adapter flows, LDAP/Active Directory synchronization adapters, SCIM provisioning, scoped API keys, service accounts, approval workflows, consent history, retention, subject export/deletion and audit.
The package complements @wrnexus/auth (passkeys, MFA, devices, sessions, OAuth and audited impersonation) and @wrnexus/authz (RBAC, ABAC and policy decisions). Protocol-specific SAML and directory parsing is supplied through adapters so applications can select a maintained vendor SDK without weakening framework validation, replay protection or governance auditing.
Generated from the exact installed package declarations.
interface OidcMetadata {
issuer: string;
authorization_endpoint: string;
@@ -233,7 +233,7 @@ export { type DirectoryAdapter, type EnterpriseIdentity, type GovernanceEve
Copy-ready examples from the installed package documentation.
bun add @wrnexus/identityimport * as identity from "@wrnexus/identity";Responsive image optimization, loaders, placeholders, and components.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/image@0.8.4Request preview access. Never put registry tokens in source control.
Secure responsive-image planning, loader adapters, picture sources, preload hints, placeholders, and performance auditing for WRNexusJS.
+Responsive image optimization, loaders, placeholders, and components.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/image@0.8.5Request preview access. Never put registry tokens in source control.
Secure responsive-image planning, loader adapters, picture sources, preload hints, placeholders, and performance auditing for WRNexusJS.
Build-time conversion is available through optimizeImage. It normalizes and bounds width/format variants, prevents variant explosions, writes deterministic filenames, and returns a manifest with dimensions and byte sizes:
import { optimizeImage } from "@wrnexus/image";
@@ -219,7 +219,7 @@ const picture = createPicture({
});HS256 JWT signing, verification, and bearer authentication.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/jwt@0.8.4Request preview access. Never put registry tokens in source control.
Dependency-free JSON Web Tokens (HS256) via Web Crypto, plus a bearer-token auth middleware for WRNexusJS.+
HS256 JWT signing, verification, and bearer authentication.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/jwt@0.8.5Request preview access. Never put registry tokens in source control.
Dependency-free JSON Web Tokens (HS256) via Web Crypto, plus a bearer-token auth middleware for WRNexusJS.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/jwt signs and verifies stateless JSON Web Tokens using the HS256 (HMAC-SHA-256) algorithm. It has no runtime dependencies — signing and verification are implemented directly on the standard Web Crypto API (crypto.subtle), which Bun provides natively. It runs server-side and pairs with the session-based auth in @wrnexus/core, giving you a stateless option for API and mobile clients. Reach for it when you need bearer-token auth rather than cookie sessions.
Editor-neutral language intelligence for WRN files.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/language-server@0.8.4Request preview access. Never put registry tokens in source control.
Editor-neutral Language Server Protocol support for .wrn files. It uses the canonical @wrnexus/syntax parser, diagnostics, accessibility rules, and formatter.
Editor-neutral language intelligence for WRN files.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/language-server@0.8.5Request preview access. Never put registry tokens in source control.
Editor-neutral Language Server Protocol support for .wrn files. It uses the canonical @wrnexus/syntax parser, diagnostics, accessibility rules, and formatter.
bunx wrnexus-language-server --stdioCapabilities include syntax, accessibility and TypeScript expression diagnostics, formatting, completion, hover, document symbols, go-to-definition, references, rename, and quick fixes. The custom wrnexus/virtualDocument request returns the mapped TypeScript representation of an open .wrn document for editor TypeScript plugins and safe refactoring tools. Any LSP 3.x client can launch the stdio command. Example Neovim configuration:
vim.lsp.start({
@@ -157,7 +157,7 @@ export { type Position, type Range, type TextDocument, WRN_COMPLETIONS, typ
})Model Context Protocol tools for WRNexus projects.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/mcp@0.8.4Request preview access. Never put registry tokens in source control.
Editor-neutral Model Context Protocol server for AI development tools.
+Model Context Protocol tools for WRNexus projects.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/mcp@0.8.5Request preview access. Never put registry tokens in source control.
Editor-neutral Model Context Protocol server for AI development tools.
bunx wrnexus-mcp --root=.It exposes current routes, components with props/events, database schema files, compiler diagnostics, runtime errors, dev-server health, framework documentation and installed packages. Files are resolved inside the configured application root and returned as bounded structured JSON.
Generated from the exact installed package declarations.
interface McpTool {
name: string;
@@ -43,7 +43,7 @@ export { type McpServer, type McpServerOptions, type McpTool, createFramewo
Copy-ready examples from the installed package documentation.
bunx wrnexus-mcp --root=.bun add @wrnexus/mcpSSR-safe compatibility access to Capacitor plugins.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/mobile@0.8.4Request preview access. Never put registry tokens in source control.
SSR-safe access to Capacitor plugins from WRNexusJS browser code.+
SSR-safe compatibility access to Capacitor plugins.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/mobile@0.8.5Request preview access. Never put registry tokens in source control.
SSR-safe access to Capacitor plugins from WRNexusJS browser code.
@wrnexus/mobile keeps optional native imports out of server rendering while giving browser-owned modules one consistent registry for Capacitor plugins. During SSR, mobile.isNative() is false and mobile.platform() is "web".
Install a plugin through the WRNexusJS CLI so the web and native projects stay aligned:
@@ -213,7 +213,7 @@ const network = mobile.plugin<NetworkPlugin>("Network"); const status = network ? await network.getStatus() : { connected: true, connectionType: "unknown" };Cross-platform browser and Capacitor capability registry.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/native@0.8.4Request preview access. Never put registry tokens in source control.
Cross-platform capabilities for browsers, Capacitor WebViews, and compiled native apps.+
Cross-platform browser and Capacitor capability registry.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/native@0.8.5Request preview access. Never put registry tokens in source control.
Cross-platform capabilities for browsers, Capacitor WebViews, and compiled native apps.
@wrnexus/native exposes capabilities by name so application code can ask what the current platform supports before presenting an action. Browser capabilities use Web APIs; mobile capabilities use installed Capacitor plugins. platform() returns "server" during SSR, "browser" on the web, and the Capacitor platform in a native WebView.
bun add @wrnexus/nativeOAuth 2.0, PKCE, provider presets, and profile mapping.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/oauth@0.8.4Request preview access. Never put registry tokens in source control.
Dependency-free OAuth 2.0 sign-in for any provider, with PKCE and presets for Google, GitHub, and Discord.+
OAuth 2.0, PKCE, provider presets, and profile mapping.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/oauth@0.8.5Request preview access. Never put registry tokens in source control.
Dependency-free OAuth 2.0 sign-in for any provider, with PKCE and presets for Google, GitHub, and Discord.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/oauth implements the OAuth 2.0 Authorization Code flow (with PKCE) for server-side sign-in. It ships ready-made provider presets and a defineProvider helper for custom providers, then gives you two flow functions — startAuth (build the redirect) and completeAuth (exchange the code and fetch the user's profile). It has no runtime dependencies: it uses the platform fetch and WebCrypto only. Pairs naturally with @wrnexus/core's logIn to establish a session once you have a normalized profile.
Structured logging, tracing, health, and integration adapters.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/observability@0.8.4Request preview access. Never put registry tokens in source control.
Open-standard traces, metrics, logs, health checks, Web Vitals, error reporting and profiling.
+Structured logging, tracing, health, and integration adapters.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/observability@0.8.5Request preview access. Never put registry tokens in source control.
Open-standard traces, metrics, logs, health checks, Web Vitals, error reporting and profiling.
Use createOperationTracer() for database, cache, queue, realtime, server-action or custom application spans. Export through OTLP, Prometheus, Zipkin/Jaeger, or the Sentry-compatible error reporter; Grafana can consume the Prometheus or OTLP signals.
Privacy-conscious counters, gauges, histograms, HTTP middleware, Web Vitals ingestion, browser collection, and exporter adapters. Request bodies and user identifiers are not collected by default.
export default {
@@ -126,7 +126,7 @@ export const live = createLivenessHandler();
export const ready = createReadinessHandler(health);Interactive framework examples and executable playground utilities.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/playground@0.8.4Request preview access. Never put registry tokens in source control.
A deployable, shareable .wrn playground with diagnostics, generated JavaScript, safe SSR-shaped HTML, sandboxed preview, reactive/UI examples, and version adapters.
Interactive framework examples and executable playground utilities.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/playground@0.8.5Request preview access. Never put registry tokens in source control.
A deployable, shareable .wrn playground with diagnostics, generated JavaScript, safe SSR-shaped HTML, sandboxed preview, reactive/UI examples, and version adapters.
Run wrnexus playground, or deploy createPlaygroundHandler().
Generated from the exact installed package declarations.
interface PlaygroundCompilation {
source: string;
generated: string;
@@ -59,7 +59,7 @@ export { type PlaygroundCompilation, type PlaygroundVersionAdapter, compare
Copy-ready examples from the installed package documentation.
bun add @wrnexus/playgroundimport * as playground from "@wrnexus/playground";Plugin contracts, lifecycle hooks, composition, and framework integration.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/plugin@0.8.4Request preview access. Never put registry tokens in source control.
Plugin contracts, lifecycle hooks, composition, and framework integration.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/plugin@0.8.5Request preview access. Never put registry tokens in source control.
Package manifests declare every framework capability they register:
{
"wrnexus": {
@@ -79,7 +79,7 @@ export { type PluginCompatibilityResult, type PluginCompatibilityTarget, Pl
};In-process and Redis-backed publish/subscribe.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/pubsub@0.8.4Request preview access. Never put registry tokens in source control.
Topic-based publish/subscribe with a pluggable driver — in-process by default, Redis for cross-process messaging.+
In-process and Redis-backed publish/subscribe.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/pubsub@0.8.5Request preview access. Never put registry tokens in source control.
Topic-based publish/subscribe with a pluggable driver — in-process by default, Redis for cross-process messaging.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/pubsub is a small server-side pub/sub bus. You publish messages to a topic and subscribe with topic patterns; handlers fire for matching topics. The default driver keeps everything in-process, and you can swap in the Redis driver (@wrnexus/pubsub/redis) to fan messages out across processes or hosts. It also backs @wrnexus/core's realtime bridge for horizontal scaling.
Progressive Web App manifests, service workers, and offline strategies.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/pwa@0.8.4Request preview access. Never put registry tokens in source control.
Official PWA primitives for manifests, service workers, offline pages and precaching, runtime caching, background synchronization, push notifications, install/update events, offline mutation stores, and conflict resolution. createOfflineQueue() accepts a durable IndexedDB-style store and retries requests with stable idempotency headers.
Generated from the exact installed package declarations.
interface IndexedDbMigration {
+ Frontend · Package reference@wrnexus/pwa
Progressive Web App manifests, service workers, and offline strategies.
Install the package
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/pwa@0.8.5
Request preview access. Never put registry tokens in source control.
Official PWA primitives for manifests, service workers, offline pages and precaching, runtime caching, background synchronization, push notifications, install/update events, offline mutation stores, and conflict resolution. createOfflineQueue() accepts a durable IndexedDB-style store and retries requests with stable idempotency headers.
Complete TypeScript API
Generated from the exact installed package declarations.
interface IndexedDbMigration {
version: number;
migrate(db: IDBDatabase, transaction: IDBTransaction): void;
}
@@ -176,7 +176,7 @@ export { type ConflictResolution, type IndexedDbMigration, type OfflineMuta
Examples
Copy-ready examples from the installed package documentation.
Install @wrnexus/pwa
bun add @wrnexus/pwa
Import @wrnexus/pwa
import * as pwa from "@wrnexus/pwa";
Background jobs with delay, concurrency, retry, and repetition.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/queue@0.8.4Request preview access. Never put registry tokens in source control.
A background job queue with delays, retries + exponential backoff, recurring jobs, and concurrent workers.+
Background jobs with delay, concurrency, retry, and repetition.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/queue@0.8.5Request preview access. Never put registry tokens in source control.
A background job queue with delays, retries + exponential backoff, recurring jobs, and concurrent workers.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/queue is a server-side in-process job queue. You register named workers, enqueue jobs (optionally delayed or recurring), and let the queue poll and run them on a timer — with per-job retry limits and doubling backoff between attempts. The default store lives in memory; the design allows a pluggable driver to back it with Redis/SQL for durability across restarts. Reach for it when you need to defer work (emails, webhooks, cleanup) off the request path without a heavyweight external broker. Tests can drive it deterministically via drain().
Small type-safe reactive signal primitives.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/reactive@0.8.4Request preview access. Never put registry tokens in source control.
Tiny, type-safe reactive primitives (signals) with zero dependencies.+
Small type-safe reactive signal primitives.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/reactive@0.8.5Request preview access. Never put registry tokens in source control.
Tiny, type-safe reactive primitives (signals) with zero dependencies.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/reactive is the seed of WRNexusJS's reactivity layer: a minimal signal primitive that holds a value, notifies subscribers when it changes, and hands back an unsubscribe function. It is deliberately small and framework-agnostic — it powers nothing on its own, but is shaped so client islands (and later the .wrn compiler's state blocks) can build reactive bindings on top of it. Reach for it when you need observable state without pulling in a full reactivity library.
Rooms, presence, messaging, history, streams, and UI components.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/realtime@0.8.4Request preview access. Never put registry tokens in source control.
Typed rooms, secure message envelopes, browser room helpers, presence utilities, and complete realtime UI blocks for WRNexusJS.
+Rooms, presence, messaging, history, streams, and UI components.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/realtime@0.8.5Request preview access. Never put registry tokens in source control.
Typed rooms, secure message envelopes, browser room helpers, presence utilities, and complete realtime UI blocks for WRNexusJS.
import { defineRoom } from "@wrnexus/realtime";
@@ -267,7 +267,7 @@ history.acknowledge("support", clientId, entry.sequence);
const missed = history.resume("support", clientId);Filesystem discovery, route matching, and typed route generation.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/router@0.8.4Request preview access. Never put registry tokens in source control.
File-based router that maps an app/ directory onto route tables and matches request paths against them.
+ Filesystem discovery, route matching, and typed route generation.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/router@0.8.5Request preview access. Never put registry tokens in source control.
File-based router that maps an app/ directory onto route tables and matches request paths against them.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/router scans an application's app/ directory once at startup and builds route tables for pages, API endpoints, realtime channels, middleware, server-rendered .wrn components, layouts, and validation schemas. It also compiles URL patterns (/users/[id]) into RegExps and matches request paths against them. Request input is never turned into a file path, which makes the router immune to path traversal. This is a server-side package used by the WRNexusJS runtime to resolve incoming requests, plus a codegen helper for compile-time typed links.
Security headers, CSRF protection, rate limits, and safe rendering.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/security@0.8.4Request preview access. Never put registry tokens in source control.
Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.
+Security headers, CSRF protection, rate limits, and safe rendering.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/security@0.8.5Request preview access. Never put registry tokens in source control.
Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.
import { safeFetch, securityPreset, setSecureCookie } from "@wrnexus/security";
export default { security: securityPreset("strict") };
const response = await safeFetch(remoteUrl, { allowedHosts: ["api.example.com"] });
-setSecureCookie(ctx, "__Host-session", sessionId);Generated from the exact installed package declarations.
export { S as SafeFetchOptions, a as SafeUrlPolicy, i as isPrivateAddress, b as isSafeUrl, s as safeFetch, c as sanitizeUrl, v as validateUrl } from './fetch-DNyX0J_D.js';
+setSecureCookie(ctx, "__Host-session", sessionId);Generated from the exact installed package declarations.
export { S as SafeFetchOptions, a as SafeUrlPolicy, i as isPrivateAddress, b as isSafeUrl, s as safeFetch, c as sanitizeUrl, v as validateUrl } from './fetch-DzQ8J9S2.js';
export { SecureSerializeOptions, secureJsonStringify, serializeForHtml } from './serialization.js';
import { CookieOptions, Context, RequestLimitsConfig, Middleware, SecurityConfig } from '@wrnexus/core';
export { TrustedHtmlPolicy, TrustedHtmlValue, createTrustedHtml, isTrustedHtml, unwrapTrustedHtml } from './trusted-html.js';
@@ -59,7 +59,7 @@ const response = await safeFetch(remoteUrl, { allowedHosts: ["api.exam
setSecureCookie(ctx, "__Host-session", sessionId);bun add @wrnexus/securitySecure HTML document rendering and SEO metadata.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/ssr@0.8.4Request preview access. Never put registry tokens in source control.
Server-side rendering: wraps a page's HTML body in a complete HTML document with a metadata-driven <head>.
+ Secure HTML document rendering and SEO metadata.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/ssr@0.8.5Request preview access. Never put registry tokens in source control.
Server-side rendering: wraps a page's HTML body in a complete HTML document with a metadata-driven <head>.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
Pages in WRNexusJS return an HTML string for the body. @wrnexus/ssr takes that body and produces a full HTML document — building the <head> from page metadata and global SEO defaults, resolving canonical/Open Graph/Twitter tags, and injecting module preloads and <script type="module"> tags. It is deliberately server-only: nothing in this package touches the DOM or ships to the browser, keeping server code genuinely server-only. Reach for it on the server when turning a rendered page body into a response document.
Application state stores shared across server and browser runtimes.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/store@0.8.4Request preview access. Never put registry tokens in source control.
Typed global and page-scoped WRNexusJS stores with runtime-specific state, computed values, actions, lifecycle hooks, persistence, SSR isolation, and HMR support.
+Application state stores shared across server and browser runtimes.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/store@0.8.5Request preview access. Never put registry tokens in source control.
Typed global and page-scoped WRNexusJS stores with runtime-specific state, computed values, actions, lifecycle hooks, persistence, SSR isolation, and HMR support.
Use defineStore() to declare a store and createStoreContainer() to create an isolated request or browser container. Store definitions are framework helpers and do not require UI components.
Generated from the exact installed package declarations.
import { StoreMutation, StoreFunction, StoreDefinition, StoreInstance, StoreCombinedState } from './types.js';
export { PersistenceStorage, StoreActionContext, StoreActionDefinition, StoreInstanceCore, StoreKind, StoreLifecycleContext, StorePersistenceConfig, StoreRuntime } from './types.js';
@@ -62,7 +62,7 @@ export { StoreCombinedState, StoreContainer, type StoreContainerOptions, St
Copy-ready examples from the installed package documentation.
bun add @wrnexus/storeimport * as store from "@wrnexus/store";CSS pipeline, themes, fonts, profiles, and application config.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/styles@0.8.4Request preview access. Never put registry tokens in source control.
CSS pipeline, themes, fonts, profiles, and application config.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/styles@0.8.5Request preview access. Never put registry tokens in source control.
Compose local or package foundations in order; later layers override earlier ones and the application has final base-config precedence:
export default defineConfig({
extends: ["@workroot/wrnexus-enterprise", "./layers/company"],
@@ -885,7 +885,7 @@ const themeJs = renderThemeRuntime(theme); // served at THEME_JS_HREFEditor syntax definitions and language tooling for .wrn files.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/syntax@0.8.4Request preview access. Never put registry tokens in source control.
Canonical WRN lexer, parser, AST, language metadata, source positions, and stable diagnostics. Framework tooling should import this package instead of implementing a separate .wrn parser.
Editor syntax definitions and language tooling for .wrn files.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/syntax@0.8.5Request preview access. Never put registry tokens in source control.
Canonical WRN lexer, parser, AST, language metadata, source positions, and stable diagnostics. Framework tooling should import this package instead of implementing a separate .wrn parser.
See docs/WRN-LANGUAGE-SPEC-1.0.md in the WRNexusJS repository.
Generated from the exact installed package declarations.
export { LexError, Lexer } from './tokenizer.js';
export { FormatWrnOptions, formatWrn } from './formatter.js';
export { A as ActionBlock, a as ApiBlock, b as Attr, C as ComputedDecl, D as DataApiBlock, c as DataMode, E as EffectBlock, d as EventDecl, F as FunctionParameterDecl, e as FunctionRuntime, L as LifecycleBlock, f as LoadBlock, M as ModeFunctionsBlock, O as OutputDecl, P as PageAst, g as ParseError, h as PersistDecl, i as PropDecl, R as RealtimeBlock, j as RealtimeHandler, k as RuntimeFunctionDecl, S as SeoBlock, l as StateDecl, m as StateRuntime, n as StoreKind, o as StoreLifecycleDecl, p as StructuredImportDecl, V as VOID_ELEMENTS, q as ViewNode, W as WatchBlock, r as parse, s as parseComputedDeclarations, t as parseHtmlView, u as parseOutputs, v as parsePersist, w as parseRuntimeFunctions, x as parseStateDeclarations, y as parseStoreLifecycle, z as parseStructuredImports, B as stripRuntimeFunctionModifiers } from './parser-CTLO4mcT.js';
@@ -49,7 +49,7 @@ const ast = parse('component Greeting { view { <p>Hello</p>
const summary = diagnosticSummary(diagnose(source));WRNexusJS-aware component, route, and browser testing utilities.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/test@0.8.4Request preview access. Never put registry tokens in source control.
Testing utilities for WRNexusJS apps — component rendering, reactive-DOM mounting, route handler calls, and a full in-process app harness, plus a one-import re-export of bun:test.
+ WRNexusJS-aware component, route, and browser testing utilities.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/test@0.8.5Request preview access. Never put registry tokens in source control.
Testing utilities for WRNexusJS apps — component rendering, reactive-DOM mounting, route handler calls, and a full in-process app harness, plus a one-import re-export of bun:test.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/test is the server-side test toolkit you reach for when writing tests for a WRNexusJS app. It runs under bun test (invoked via wrnexus test) and gives you a single import surface: the bun:test primitives (test, expect, mock, …) re-exported alongside WRNexusJS-aware helpers that compile .wrn components, hydrate server HTML in a DOM, invoke API route handlers, and boot the real app on an ephemeral port for integration tests.
Error/event capture, middleware, filtering, and sinks.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/tracking@0.8.4Request preview access. Never put registry tokens in source control.
Error tracking for WRNexusJS apps: capture exceptions manually or via middleware and fan them out to pluggable sinks.+
Error/event capture, middleware, filtering, and sinks.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/tracking@0.8.5Request preview access. Never put registry tokens in source control.
Error tracking for WRNexusJS apps: capture exceptions manually or via middleware and fan them out to pluggable sinks.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/tracking is a small, server-side error-capture layer. You create a tracker with one or more sinks, then feed it errors — either manually with tracker.capture(err, context) or automatically by mounting tracker.middleware() in your request pipeline. A consoleSink is included; forwarding to Sentry, Datadog, or any other backend is just a matter of writing a tiny sink. Reach for it when you want a single, sink-agnostic place to route application errors. Sinks run best-effort — a throwing sink never breaks the request.
WRN-aware TypeScript diagnostics and virtual documents.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/typecheck@0.8.4Request preview access. Never put registry tokens in source control.
Static type checking for .wrn declarations, props, state, outputs, functions, stores, and generated virtual TypeScript files.
WRN-aware TypeScript diagnostics and virtual documents.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/typecheck@0.8.5Request preview access. Never put registry tokens in source control.
Static type checking for .wrn declarations, props, state, outputs, functions, stores, and generated virtual TypeScript files.
The package is compiler tooling rather than a browser UI package, so its public kit consists of programmatic typecheck helpers and diagnostics.
Generated from the exact installed package declarations.
import { PageAst } from '@wrnexus/syntax';
export { componentContract, storeContract } from './contracts.js';
export { findAppRoot, loadApplicationTypes } from './project.js';
@@ -65,7 +65,7 @@ export { type TypecheckOptions, type VirtualTypeScriptModule, type WrnTypeD
Copy-ready examples from the installed package documentation.
bun add @wrnexus/typecheckimport * as typecheck from "@wrnexus/typecheck";Themeable server-rendered UI components and CSS.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/ui@0.8.4Request preview access. Never put registry tokens in source control.
First-party Wire UI component library — a set of themeable .wrn components plus a single tokenized stylesheet.
+ Themeable server-rendered UI components and CSS.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/ui@0.8.5Request preview access. Never put registry tokens in source control.
First-party Wire UI component library — a set of themeable .wrn components plus a single tokenized stylesheet.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
@wrnexus/ui ships a library of server-rendered .wrn components (layout, form controls, and feedback UI) together with one themeable stylesheet, ui.css. The components are auto-discovered by the framework router — you don't import them in code. Once the package's component directory is on the router's scan path, you mount any component in a page with data-component="<name>". Every visual is driven by var(--wire-*) theme tokens, so components restyle instantly when the theme changes. The tiny JS surface (src/index.ts) exists only so the toolchain (CLI build + dev server) can locate the component directory and stylesheet.
@wrnexus/core](../core) (dependencies).theme-toggle relies on the framework's theme runtime, which binds thedata-wire-theme-toggle attribute — no per-component JS is required.
Generated from the exact installed package declarations.
interface UiComponentMetadata {
- name: string;
- mount: string;
- category?: string;
- purpose?: string;
- props?: Array<{
- name: string;
- default?: unknown;
- }>;
- events?: string[];
-}
-interface UiComponentReference {
- count: number;
- components: UiComponentMetadata[];
-}
-declare function uiComponentReference(): UiComponentReference;
-declare function findUiComponent(name: string): UiComponentMetadata | undefined;
-declare function auditUiComponents(): Array<{
- component: string;
- issue: string;
-}>;
-
-/**
- * @wrnexus/ui — the Wire UI component library.
- *
- * Components are `.wrn` files under `components/`, auto-discovered by the
- * framework (the router scans this directory in addition to the app's own
- * `app/components`). Mount them in any page with `data-component="<name>"`.
- * Their styles live in a single themeable stylesheet, `ui.css`, served once at
- * `/__wrnexus/ui.css` — every class uses `var(--wire-*)` theme tokens.
- *
- * Override, in increasing order of power:
- * 1. theme tokens (change `--wire-color-primary`, etc.)
- * 2. redefine a `.wire-*` class in your own CSS (loaded after ui.css)
- * 3. pass a `class` prop (appended to the component root)
- * 4. `wrnexus eject <name>` to copy the component into `app/components` and own it
- */
-/** Absolute path to the directory of Wire UI component `.wrn` files. */
-declare function uiComponentsDir(): string;
-/** Absolute path to the Wire UI stylesheet. */
-declare function uiCssPath(): string;
-/** The Wire UI stylesheet contents (all `.wire-*` classes, themed via tokens). */
-declare function uiCss(): string;
-/** Names declared by the bundled components, independent of filename casing. */
-declare function uiComponentNames(): string[];
-/** Absolute path to a bundled component by its declared component name. */
-declare function uiComponentPath(name: string): string;
-
-export { type UiComponentMetadata, type UiComponentReference, auditUiComponents, findUiComponent, uiComponentNames, uiComponentPath, uiComponentReference, uiComponentsDir, uiCss, uiCssPath };
+Generated from the exact installed package declarations.
+export { }
Copy-ready examples from the installed package documentation.
import { buildRouter } from "@wrnexus/router";
import { uiComponentsDir } from "@wrnexus/ui";
@@ -155,7 +108,7 @@ const router = buildRouter(appDir, { componentDirs: [uiComponentsDir()]
</div>Browse interactive examples and complete component usage in the dedicated WRNexusJS component showcase.
Validated local/S3 uploads and secure file serving.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/uploader@0.8.4Request preview access. Never put registry tokens in source control.
Config-driven file uploads + serving for WRNexusJS. Declare named storage stores (local disk or any S3-compatible backend) in wrnexus.config.ts, upload with one function call, drop a drag-and-drop widget on a page, and serve files back — public or private. Zero external dependencies (S3 is signed with a built-in AWS SigV4 implementation, like the rest of the framework).
Validated local/S3 uploads and secure file serving.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/uploader@0.8.5Request preview access. Never put registry tokens in source control.
Config-driven file uploads + serving for WRNexusJS. Declare named storage stores (local disk or any S3-compatible backend) in wrnexus.config.ts, upload with one function call, drop a drag-and-drop widget on a page, and serve files back — public or private. Zero external dependencies (S3 is signed with a built-in AWS SigV4 implementation, like the rest of the framework).
// wrnexus.config.ts
@@ -632,7 +632,7 @@ import { serveFromStore } from "@wrnexus/uploader";
export const GET = serveFromStore("docs"); // your middleware decides who gets inTyped schemas, coercion, validation, and browser descriptors.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/validation@0.8.4Request preview access. Never put registry tokens in source control.
One fluent schema, validated on the server (API bodies, env vars) and mirrored to an eval-free browser validator for forms.+
Typed schemas, coercion, validation, and browser descriptors.
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/validation@0.8.5Request preview access. Never put registry tokens in source control.
One fluent schema, validated on the server (API bodies, env vars) and mirrored to an eval-free browser validator for forms.
Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.
Use ContractRegistry with defineContract or defineEvent to publish the same schema descriptors for APIs, actions, webhooks, realtime, queues, cron, pub/sub, plugins, configuration, and environment variables.
Released 2026-07-13. All 47 installed packages are aligned to this version. Highlights include the new helpers package, reliable workspace app addition, and browser SSO redirects through forward authentication. See the changelog, upgrade guide, and package references.
Roadmap items are direction, not delivery commitments. Dates require explicit owner approval.
This build-time index is local and sends no query to a third party. Use your browser’s find command to filter this compact index.
Get started · Packages · Components · Language · Architecture
Project structure · Routing · Pages and components · Server data · API routes · Middleware · Forms and validation · Authentication · Authorization · Application security · Database · Uploads · Realtime · Pub/sub · Queues · Testing · Workspaces and gateway · Deployment · Configuration and profiles · Internationalization and themes · Mobile · Observability · Upgrading · Troubleshooting
@wrnexus/ai · @wrnexus/authz · @wrnexus/compiler · @wrnexus/core · @wrnexus/csr · @wrnexus/db · @wrnexus/dev-server · @wrnexus/encryption · @wrnexus/helpers · @wrnexus/i18n · @wrnexus/jwt · @wrnexus/mobile · @wrnexus/native · @wrnexus/oauth · @wrnexus/pubsub · @wrnexus/queue · @wrnexus/reactive · @wrnexus/router · @wrnexus/ssr · @wrnexus/styles · @wrnexus/test · @wrnexus/tracking · @wrnexus/ui · @wrnexus/uploader · @wrnexus/validation · @wrnexus/dev-toolbar · @wrnexus/syntax · @wrnexus/plugin · @wrnexus/captcha · @wrnexus/auth · @wrnexus/store · @wrnexus/typecheck · @wrnexus/security · @wrnexus/cache · @wrnexus/image · @wrnexus/observability · @wrnexus/benchmark · @wrnexus/realtime · @wrnexus/content · @wrnexus/graphql · @wrnexus/identity · @wrnexus/language-server · @wrnexus/mcp · @wrnexus/playground · @wrnexus/pwa · @wrnexus/cli
This build-time index is local and sends no query to a third party. Use your browser’s find command to filter this compact index.
Get started · Packages · Components · Language · Architecture
Project structure · Routing · Pages and components · Server data · API routes · Middleware · Forms and validation · Authentication · Authorization · Application security · Database · Uploads · Realtime · Pub/sub · Queues · Testing · Workspaces and gateway · Deployment · Configuration and profiles · Internationalization and themes · Mobile · Observability · Upgrading · Troubleshooting
@wrnexus/ai · @wrnexus/authz · @wrnexus/compiler · @wrnexus/core · @wrnexus/csr · @wrnexus/db · @wrnexus/dev-server · @wrnexus/encryption · @wrnexus/helpers · @wrnexus/i18n · @wrnexus/jwt · @wrnexus/mobile · @wrnexus/native · @wrnexus/oauth · @wrnexus/pubsub · @wrnexus/queue · @wrnexus/reactive · @wrnexus/router · @wrnexus/ssr · @wrnexus/styles · @wrnexus/test · @wrnexus/tracking · @wrnexus/ui · @wrnexus/uploader · @wrnexus/validation · @wrnexus/dev-toolbar · @wrnexus/syntax · @wrnexus/plugin · @wrnexus/captcha · @wrnexus/auth · @wrnexus/store · @wrnexus/typecheck · @wrnexus/security · @wrnexus/cache · @wrnexus/image · @wrnexus/observability · @wrnexus/benchmark · @wrnexus/realtime · @wrnexus/content · @wrnexus/graphql · @wrnexus/identity · @wrnexus/language-server · @wrnexus/mcp · @wrnexus/playground · @wrnexus/pwa · @wrnexus/rpc · @wrnexus/cli
WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.
Only the current private-preview release 0.8.4 is documented here. A formal old-release support window is not yet published.
Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.
Use restrictive CSP and permissions policies, HSTS only on HTTPS production origins, MIME sniffing protection, restrictive referrers, explicit CORS, secure cookies, CSRF validation, request limits, and origin checks. See application security.
WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.
Only the current private-preview release 0.8.5 is documented here. A formal old-release support window is not yet published.
Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.
Use restrictive CSP and permissions policies, HSTS only on HTTPS production origins, MIME sniffing protection, restrictive referrers, explicit CORS, secure cookies, CSRF validation, request limits, and origin checks. See application security.
Only confirmed public properties are listed; no customer or traffic claims are made.
Creator/company site demonstrating a public WRNexusJS deployment. Exact deployed version and infrastructure notes await owner confirmation.
This documentation portal, built and verified against WRNexusJS 0.8.4 on Bun.
Screenshots are intentionally deferred until approved assets and alt text are available.
Only confirmed public properties are listed; no customer or traffic claims are made.
Creator/company site demonstrating a public WRNexusJS deployment. Exact deployed version and infrastructure notes await owner confirmation.
This documentation portal, built and verified against WRNexusJS 0.8.5 on Bun.
Screenshots are intentionally deferred until approved assets and alt text are available.
WRNexusJS has no public Discord, public issue tracker, or guaranteed community support channel listed by this repository. Preview access and support begin through WorkRoot’s public contact path.
Include WRNexusJS version, Bun version, OS, a minimal reproduction, expected and actual behavior, and sanitized logs. Never include registry tokens, credentials, session cookies, or private data.
Support scope, service levels, and commercial terms require owner confirmation.
This tutorial connects the installed 0.8.4 APIs into one design. Snippets are limited to declarations and README patterns verified in the installed packages; a CI-compiled standalone fixture remains on the roadmap.
A .wrn page renders tasks from an SSR API binding. A shared validation schema protects mutations. Session middleware identifies users, authorization policies gate updates, and a realtime room broadcasts changes.
import { v, parseBody } from "@wrnexus/validation";
+ Preview · runnable-project extraction pendingSecure task board
This tutorial connects the installed 0.8.5 APIs into one design. Snippets are limited to declarations and README patterns verified in the installed packages; a CI-compiled standalone fixture remains on the roadmap.
Application shape
A .wrn page renders tasks from an SSR API binding. A shared validation schema protects mutations. Session middleware identifies users, authorization policies gate updates, and a realtime room broadcasts changes.
Schema and create route
import { v, parseBody } from "@wrnexus/validation";
const task = v.object({ title: v.string().trim().min(3).max(120) });
export const POST = async (ctx) => {
const parsed = await parseBody(task, ctx.req);
@@ -23,7 +23,7 @@ export const POST = async (ctx) => {
</ul></main>
}
}
Production checklist
- Choose SQLite for local development or configure the supported PostgreSQL driver.
- Run migrations before accepting traffic.
- Enable session authentication and enforce authorization on every mutation.
- Validate upload types and sizes; keep private objects behind authenticated routes.
- Use Redis pub/sub when realtime rooms span processes.
- Treat the default queue as non-durable until a production driver is selected.
Follow the focused database, authentication, authorization, realtime, and upload guides.
= P extends ProcedureDef = P extends ProcedureDef>(schema: S): ProcedureBuilder
+ {#if caption || description || searchable}
+
+ {/if}
+
+
+ }
+
+ style {
+ .wire-table {
+ --table-accent: var(--wire-color-primary);
+ display: flex;
+ flex-direction: column;
+ gap: 0.85rem;
+ width: 100%;
+ min-width: 0;
+ max-width: 100%;
+ color: var(--wire-color-text);
+ }
+
+ .wire-table[data-color="secondary"] {
+ --table-accent: var(--wire-color-secondary);
+ }
+
+ .wire-table[data-color="success"] {
+ --table-accent: var(--wire-color-success);
+ }
+
+ .wire-table[data-color="danger"] {
+ --table-accent: var(--wire-color-danger);
+ }
+
+ .wire-table[data-color="info"] {
+ --table-accent: var(--wire-color-info);
+ }
+
+ .wire-table__toolbar {
+ display: flex;
+ align-items: flex-end;
+ justify-content: space-between;
+ flex-wrap: wrap;
+ gap: 0.75rem;
+ }
+
+ .wire-table__heading {
+ display: grid;
+ gap: 0.2rem;
+ min-width: 0;
+ }
+
+ .wire-table__caption {
+ margin: 0;
+ color: var(--wire-color-text);
+ font-size: 0.98rem;
+ font-weight: 650;
+ }
+
+ .wire-table__description {
+ margin: 0;
+ color: var(--wire-color-text-muted);
+ font-size: 0.82rem;
+ }
+
+ .wire-table__actions {
+ display: flex;
+ align-items: center;
+ flex-wrap: wrap;
+ gap: 0.4rem;
+ }
+
+ .wire-table__selected-count {
+ color: var(--wire-color-text-muted);
+ font-size: 0.78rem;
+ font-variant-numeric: tabular-nums;
+ }
+
+ .wire-table__action {
+ appearance: none;
+ display: inline-flex;
+ align-items: center;
+ gap: 0.35rem;
+ min-height: 2.1rem;
+ padding: 0 0.7rem;
+ color: var(--wire-color-text);
+ background: var(--wire-color-surface-soft);
+ border: 1px solid var(--wire-color-border);
+ border-radius: var(--wire-radius-sm);
+ font: inherit;
+ font-size: 0.79rem;
+ cursor: pointer;
+ transition: border-color 140ms ease, color 140ms ease, background 140ms ease;
+ }
+
+ .wire-table__action:hover {
+ color: var(--table-accent);
+ border-color: color-mix(in srgb, var(--table-accent) 45%, var(--wire-color-border));
+ }
+
+ .wire-table__action[data-tone="danger"] {
+ color: var(--wire-color-danger);
+ border-color: color-mix(in srgb, var(--wire-color-danger) 35%, var(--wire-color-border));
+ }
+
+ .wire-table__action[data-tone="danger"]:hover {
+ background: color-mix(in srgb, var(--wire-color-danger) 12%, transparent);
+ }
+
+ /* Full gridlines: vertical rules between columns as well as rows. */
+ .wire-table[data-gridlines="grid"] .wire-table__table th,
+ .wire-table[data-gridlines="grid"] .wire-table__table td {
+ border-right: 1px solid color-mix(in srgb, var(--wire-color-border) 60%, transparent);
+ }
+
+ .wire-table[data-gridlines="grid"] .wire-table__table th:last-child,
+ .wire-table[data-gridlines="grid"] .wire-table__table td:last-child {
+ border-right: 0;
+ }
+
+ .wire-table__search {
+ display: inline-flex;
+ align-items: center;
+ gap: 0.45rem;
+ min-height: 2.35rem;
+ padding: 0 0.7rem;
+ color: var(--wire-color-text-muted);
+ background: var(--wire-color-surface-soft);
+ border: 1px solid var(--wire-color-border);
+ border-radius: 0.7rem;
+ }
+
+ .wire-table__search input {
+ width: 12rem;
+ max-width: 100%;
+ padding: 0;
+ color: var(--wire-color-text);
+ background: transparent;
+ border: 0;
+ font: inherit;
+ font-size: 0.83rem;
+ outline: none;
+ }
+
+ .wire-table__search:focus-within {
+ border-color: color-mix(in srgb, var(--table-accent) 45%, var(--wire-color-border));
+ }
+
+ /*
+ * The table scrolls sideways rather than squashing its columns.
+ *
+ * max-width matters as much as width here: a wide table -- a comparison
+ * layout turns every record into a column -- makes the flex item grow to
+ * fit its content unless it is told not to, and the whole table then
+ * spilled out over the page beside it instead of scrolling inside its own
+ * box. min-width: 0 alone is not enough once the parent is a grid.
+ */
+ .wire-table__scroll {
+ position: relative;
+ width: 100%;
+ min-width: 0;
+ max-width: 100%;
+ overflow-x: auto;
+ border: 1px solid var(--wire-color-border);
+ border-radius: 0.9rem;
+ }
+
+ .wire-table[data-bordered="false"] .wire-table__scroll {
+ border: 0;
+ border-radius: 0;
+ }
+
+ .wire-table__table {
+ width: 100%;
+ border-collapse: collapse;
+ font-size: 0.85rem;
+ }
+
+ .wire-table__table th,
+ .wire-table__table td {
+ padding: 0.7rem 0.85rem;
+ text-align: left;
+ vertical-align: middle;
+ white-space: nowrap;
+ }
+
+ .wire-table[data-density="compact"] .wire-table__table th,
+ .wire-table[data-density="compact"] .wire-table__table td {
+ padding: 0.42rem 0.6rem;
+ }
+
+ .wire-table[data-density="comfortable"] .wire-table__table th,
+ .wire-table[data-density="comfortable"] .wire-table__table td {
+ padding: 0.95rem 1rem;
+ }
+
+ .wire-table__table th[data-align="center"],
+ .wire-table__table td[data-align="center"] {
+ text-align: center;
+ }
+
+ .wire-table__table th[data-align="end"],
+ .wire-table__table td[data-align="end"] {
+ text-align: right;
+ }
+
+ .wire-table__table thead th {
+ position: sticky;
+ top: 0;
+ z-index: 1;
+ color: var(--wire-color-text-muted);
+ background: var(--wire-color-surface-soft);
+ border-bottom: 1px solid var(--wire-color-border);
+ font-size: 0.76rem;
+ font-weight: 650;
+ letter-spacing: 0.02em;
+ text-transform: uppercase;
+ }
+
+ .wire-table__table tbody tr {
+ border-bottom: 1px solid color-mix(in srgb, var(--wire-color-border) 60%, transparent);
+ }
+
+ .wire-table__table tbody tr:last-child {
+ border-bottom: 0;
+ }
+
+ /*
+ * Row background: stripe, then hover, then selection, each beating the one
+ * before it.
+ *
+ * These were written at whatever specificity fell out naturally, and the
+ * stripe selector was the strongest -- so a selected row on an even line
+ * kept its stripe and looked different from a selected row on an odd line,
+ * and hovering flipped rows between three shades. Selection is a state
+ * about the row, not decoration, so it wins outright; every rule below
+ * sits at the same specificity and is ordered deliberately.
+ */
+ .wire-table[data-striped="true"] .wire-table__table tbody tr:nth-child(even) {
+ background: color-mix(in srgb, var(--wire-color-surface-soft) 55%, transparent);
+ }
+
+ .wire-table[data-striped] .wire-table__table tbody tr:hover:not([data-selected="true"]) {
+ background: color-mix(in srgb, var(--table-accent) 7%, transparent);
+ }
+
+ /* Every selected row identical, striped or not. */
+ .wire-table[data-striped] .wire-table__table tbody tr[data-selected="true"] {
+ background: color-mix(in srgb, var(--table-accent) 15%, transparent);
+ }
+
+ .wire-table[data-striped] .wire-table__table tbody tr[data-selected="true"]:hover {
+ background: color-mix(in srgb, var(--table-accent) 22%, transparent);
+ }
+
+ .wire-table__sort {
+ appearance: none;
+ display: inline-flex;
+ align-items: center;
+ gap: 0.32rem;
+ padding: 0;
+ color: inherit;
+ background: transparent;
+ border: 0;
+ font: inherit;
+ font-size: inherit;
+ font-weight: inherit;
+ letter-spacing: inherit;
+ text-transform: inherit;
+ cursor: pointer;
+ }
+
+ .wire-table__sort:hover {
+ color: var(--table-accent);
+ }
+
+ .wire-table__sort-icon {
+ flex: 0 0 auto;
+ opacity: 0.45;
+ }
+
+ .wire-table__sort[data-active="true"] {
+ color: var(--table-accent);
+ }
+
+ .wire-table__sort[data-active="true"] .wire-table__sort-icon {
+ opacity: 1;
+ }
+
+ .wire-table__select-cell {
+ width: 2.6rem;
+ text-align: center;
+ }
+
+ .wire-table__check {
+ appearance: none;
+ display: inline-flex;
+ align-items: center;
+ justify-content: center;
+ padding: 0;
+ width: 1.05rem;
+ height: 1.05rem;
+ color: transparent;
+ background: var(--wire-color-surface-raised);
+ border: 1px solid var(--wire-color-border);
+ border-radius: 0.32rem;
+ cursor: pointer;
+ transition: background 140ms ease, border-color 140ms ease, color 140ms ease;
+ }
+
+ .wire-table__check[aria-checked="true"] {
+ color: var(--wire-color-primary-contrast);
+ background: var(--table-accent);
+ border-color: var(--table-accent);
+ }
+
+ .wire-table__check:focus-visible {
+ outline: none;
+ box-shadow: 0 0 0 3px color-mix(in srgb, var(--table-accent) 35%, transparent);
+ }
+
+ .wire-table__table--comparison {
+ width: auto;
+ min-width: 100%;
+ }
+
+ .wire-table__table--comparison th,
+ .wire-table__table--comparison td {
+ min-width: 7rem;
+ }
+
+ .wire-table__table--comparison th[scope="row"] {
+ color: var(--wire-color-text-muted);
+ background: var(--wire-color-surface-soft);
+ font-size: 0.76rem;
+ font-weight: 650;
+ text-transform: uppercase;
+ white-space: nowrap;
+ }
+
+ .wire-table[data-layout="comparison"] .wire-table__table th:first-child,
+ .wire-table[data-layout="comparison"] .wire-table__table td:first-child {
+ position: sticky;
+ left: 0;
+ z-index: 2;
+ }
+
+ .wire-table__status {
+ display: flex;
+ align-items: center;
+ justify-content: center;
+ gap: 0.6rem;
+ padding: 1.75rem 1rem;
+ color: var(--wire-color-text-muted);
+ font-size: 0.85rem;
+ text-align: center;
+ }
+
+ .wire-table__status--error {
+ color: var(--wire-color-danger);
+ }
+
+ .wire-table__spinner {
+ width: 0.95rem;
+ height: 0.95rem;
+ border: 2px solid color-mix(in srgb, currentColor 30%, transparent);
+ border-top-color: currentColor;
+ border-radius: 50%;
+ animation: wire-table-spin 700ms linear infinite;
+ }
+
+ @keyframes wire-table-spin {
+ to {
+ transform: rotate(360deg);
+ }
+ }
+
+ /* Dim the rows while a refresh is in flight rather than tearing them out:
+ a table that empties on every keystroke is far harder to read. */
+ .wire-table[data-loading="true"] .wire-table__table tbody {
+ opacity: 0.45;
+ }
+
+ /* Keeps the first column readable while the rest scrolls sideways. */
+ .wire-table[data-sticky-first="true"] .wire-table__table th:first-child,
+ .wire-table[data-sticky-first="true"] .wire-table__table td:first-child {
+ position: sticky;
+ left: 0;
+ z-index: 2;
+ background: var(--wire-color-surface);
+ }
+
+ .wire-table[data-sticky-first="true"] .wire-table__table thead th:first-child {
+ z-index: 3;
+ }
+
+ .wire-table__empty {
+ margin: 0;
+ padding: 1.75rem 1rem;
+ color: var(--wire-color-text-muted);
+ font-size: 0.85rem;
+ text-align: center;
+ }
+
+ .wire-table__footer {
+ display: flex;
+ align-items: center;
+ justify-content: space-between;
+ flex-wrap: wrap;
+ gap: 0.75rem;
+ }
+
+ .wire-table__range {
+ margin: 0;
+ color: var(--wire-color-text-muted);
+ font-size: 0.8rem;
+ }
+
+ .wire-table__pager {
+ display: flex;
+ align-items: center;
+ gap: 0.5rem;
+ }
+
+ .wire-table__page-size {
+ display: inline-flex;
+ align-items: center;
+ gap: 0.4rem;
+ color: var(--wire-color-text-muted);
+ font-size: 0.78rem;
+ }
+
+ .wire-table__page-dropdown {
+ display: inline-flex;
+ }
+
+ /*
+ * padding is reset explicitly: an app-level button { padding: ... } rule
+ * outranks the browser default and would crush the icon inside these
+ * fixed-size controls.
+ */
+ .wire-table__page-button {
+ appearance: none;
+ display: inline-flex;
+ align-items: center;
+ justify-content: center;
+ flex: 0 0 auto;
+ padding: 0;
+ width: 2rem;
+ height: 2rem;
+ color: var(--wire-color-text);
+ background: var(--wire-color-surface-soft);
+ border: 1px solid var(--wire-color-border);
+ border-radius: 0.55rem;
+ cursor: pointer;
+ }
+
+ .wire-table__page-button:hover:not(:disabled) {
+ color: var(--table-accent);
+ border-color: color-mix(in srgb, var(--table-accent) 40%, var(--wire-color-border));
+ }
+
+ .wire-table__page-button:disabled {
+ opacity: 0.45;
+ cursor: not-allowed;
+ }
+
+ .wire-table__page-button svg {
+ flex: 0 0 auto;
+ }
+
+ .wire-table__page-numbers {
+ display: inline-flex;
+ align-items: center;
+ gap: 0.25rem;
+ }
+
+ .wire-table__page-number {
+ appearance: none;
+ min-width: 2rem;
+ height: 2rem;
+ padding: 0 0.4rem;
+ color: var(--wire-color-text-muted);
+ background: transparent;
+ border: 1px solid transparent;
+ border-radius: 0.55rem;
+ font: inherit;
+ font-size: 0.78rem;
+ font-variant-numeric: tabular-nums;
+ cursor: pointer;
+ }
+
+ .wire-table__page-number:hover {
+ color: var(--wire-color-text);
+ background: var(--wire-color-surface-soft);
+ }
+
+ .wire-table__page-number[data-active="true"] {
+ color: var(--wire-color-primary-contrast);
+ background: var(--table-accent);
+ border-color: var(--table-accent);
+ }
+
+ .wire-table__page-indicator {
+ color: var(--wire-color-text-muted);
+ font-size: 0.78rem;
+ font-variant-numeric: tabular-nums;
+ }
+
+ /*
+ * Below the breakpoint each row becomes its own card and every cell grows
+ * a label from its column, so the data stays readable without a horizontal
+ * scrollbar on a phone.
+ */
+ @media (max-width: 639px) {
+ .wire-table__scroll {
+ overflow-x: visible;
+ border: 0;
+ }
+
+ .wire-table__table,
+ .wire-table__table tbody,
+ .wire-table__table tr,
+ .wire-table__table td {
+ display: block;
+ width: 100%;
+ }
+
+ .wire-table__table thead {
+ display: none;
+ }
+
+ /*
+ * Each row becomes a card. These are the exact tokens Card paints its
+ * surface with (.wire-next__card-panel in ui.css) rather than a lookalike
+ * of my own, so a stacked row and a real Card cannot drift apart.
+ *
+ * The Card component itself cannot be mounted per row: component tags
+ * are resolved once, server side, while these rows are cloned in the
+ * browser from a single template -- every row would share one mount.
+ */
+ .wire-table__table tbody tr {
+ margin-bottom: 0.7rem;
+ padding: 0.5rem 0.25rem;
+ background: var(--wire-color-surface);
+ border: 1px solid var(--wire-color-border);
+ border-radius: var(--wire-radius-md);
+ box-shadow: var(--wire-shadow-1);
+ }
+
+ .wire-table[data-striped="true"] .wire-table__table tbody tr:nth-child(even) {
+ background: var(--wire-color-surface);
+ }
+
+ .wire-table[data-striped] .wire-table__table tbody tr[data-selected="true"] {
+ background: color-mix(in srgb, var(--table-accent) 15%, var(--wire-color-surface));
+ border-color: color-mix(in srgb, var(--table-accent) 45%, var(--wire-color-border));
+ }
+
+ .wire-table__table td {
+ display: flex;
+ align-items: center;
+ justify-content: space-between;
+ gap: 1rem;
+ white-space: normal;
+ text-align: right;
+ }
+
+ .wire-table__table td::before {
+ content: attr(data-label);
+ color: var(--wire-color-text-muted);
+ font-size: 0.72rem;
+ font-weight: 650;
+ text-transform: uppercase;
+ }
+
+ .wire-table__select-cell {
+ width: auto;
+ }
+
+ .wire-table__footer {
+ justify-content: center;
+ }
+
+ .wire-table__actions {
+ width: 100%;
+ }
+
+ /* The page-size menu is anchored to a control near the bottom of the
+ screen; it must be able to render outside the footer box. */
+ .wire-table__footer,
+ .wire-table__pager {
+ overflow: visible;
+ }
+ }
}
}
```
@@ -21144,7 +23507,7 @@ Showcase: https://component.wrnexusjs.dev/
Mount:
+
+
+
+
+
+
+
+
+
+
+ {#if selectable}
+
+
+
+
+
+
+
+ {/if}
+
+
+
+ {column.label}
+
+
+ {#if selectable}
+
+
+
+
+
+ {/if}
+
+
+
+ {cell.value}
+
+
+
+
+
+
+
+
+
+ {caption}
+
+ {heading.label}
+
+
+
+
+ {field.label}
+
+
+ {cell.value}
+
+
+
+ {loadingLabel}
+
+
+
+ {loadError}
+
+
+
+
+ {emptyMessage()}
+
+
+