From c767435cc04df450e8212c3e1407d39f6f1fde3d Mon Sep 17 00:00:00 2001 From: Ajay Ghanwat Date: Mon, 10 Aug 2026 14:18:31 +0530 Subject: [PATCH] docs: expand full-width guides and package navigation --- app/docs.test.ts | 27 ++ app/pages/404.wrn | 3 +- app/pages/access.wrn | 3 +- app/pages/architecture.wrn | 3 +- app/pages/benchmarks.wrn | 3 +- app/pages/changelog.wrn | 3 +- app/pages/examples.wrn | 3 +- app/pages/getting-started.wrn | 3 +- app/pages/guides/api-routes.wrn | 12 +- app/pages/guides/authentication.wrn | 12 +- app/pages/guides/authorization.wrn | 11 +- .../guides/configuration-and-profiles.wrn | 15 +- app/pages/guides/database.wrn | 10 +- app/pages/guides/deployment.wrn | 11 +- app/pages/guides/forms-and-validation.wrn | 12 +- app/pages/guides/full-stack-auth-demo.wrn | 3 +- app/pages/guides/i18n-and-themes.wrn | 12 +- app/pages/guides/middleware.wrn | 12 +- app/pages/guides/mobile.wrn | 9 +- app/pages/guides/observability.wrn | 11 +- app/pages/guides/pages-and-components.wrn | 13 +- app/pages/guides/project-structure.wrn | 11 +- app/pages/guides/pubsub.wrn | 9 +- app/pages/guides/queues.wrn | 9 +- app/pages/guides/realtime.wrn | 13 +- app/pages/guides/routing.wrn | 10 +- app/pages/guides/security.wrn | 21 +- app/pages/guides/server-data.wrn | 10 +- app/pages/guides/testing.wrn | 13 +- app/pages/guides/troubleshooting.wrn | 11 +- app/pages/guides/upgrading.wrn | 11 +- app/pages/guides/uploads.wrn | 12 +- app/pages/guides/workspaces-and-gateway.wrn | 10 +- app/pages/language.wrn | 3 +- app/pages/license.wrn | 3 +- app/pages/packages.wrn | 10 +- app/pages/packages/ai.wrn | 12 +- app/pages/packages/auth.wrn | 12 +- app/pages/packages/authz.wrn | 12 +- app/pages/packages/benchmark.wrn | 12 +- app/pages/packages/cache.wrn | 12 +- app/pages/packages/captcha.wrn | 12 +- app/pages/packages/cli.wrn | 12 +- app/pages/packages/compiler.wrn | 12 +- app/pages/packages/content.wrn | 12 +- app/pages/packages/core.wrn | 12 +- app/pages/packages/csr.wrn | 12 +- app/pages/packages/db.wrn | 12 +- app/pages/packages/dev-server.wrn | 12 +- app/pages/packages/dev-toolbar.wrn | 12 +- app/pages/packages/encryption.wrn | 12 +- app/pages/packages/graphql.wrn | 12 +- app/pages/packages/helpers.wrn | 12 +- app/pages/packages/i18n.wrn | 12 +- app/pages/packages/identity.wrn | 12 +- app/pages/packages/image.wrn | 12 +- app/pages/packages/jwt.wrn | 12 +- app/pages/packages/language-server.wrn | 12 +- app/pages/packages/mcp.wrn | 12 +- app/pages/packages/mobile.wrn | 12 +- app/pages/packages/native.wrn | 12 +- app/pages/packages/oauth.wrn | 12 +- app/pages/packages/observability.wrn | 12 +- app/pages/packages/playground.wrn | 12 +- app/pages/packages/plugin.wrn | 12 +- app/pages/packages/pubsub.wrn | 12 +- app/pages/packages/pwa.wrn | 12 +- app/pages/packages/queue.wrn | 12 +- app/pages/packages/reactive.wrn | 12 +- app/pages/packages/realtime.wrn | 12 +- app/pages/packages/router.wrn | 12 +- app/pages/packages/security.wrn | 12 +- app/pages/packages/ssr.wrn | 12 +- app/pages/packages/store.wrn | 12 +- app/pages/packages/styles.wrn | 12 +- app/pages/packages/syntax.wrn | 12 +- app/pages/packages/test.wrn | 12 +- app/pages/packages/tracking.wrn | 12 +- app/pages/packages/typecheck.wrn | 12 +- app/pages/packages/ui.wrn | 12 +- app/pages/packages/uploader.wrn | 12 +- app/pages/packages/validation.wrn | 12 +- app/pages/releases/0.8.7.wrn | 3 +- app/pages/roadmap.wrn | 3 +- app/pages/search.wrn | 3 +- app/pages/security.wrn | 19 +- app/pages/showcase.wrn | 3 +- app/pages/support.wrn | 3 +- app/pages/tutorial.wrn | 3 +- app/styles/global.css | 69 ++++++ public/llms-full.txt | 211 ++++++++++++++++ public/llms.txt | 211 ++++++++++++++++ scripts/generate-docs.ts | 17 +- scripts/generate-portal.ts | 234 +++++++++++++++++- 94 files changed, 1442 insertions(+), 236 deletions(-) diff --git a/app/docs.test.ts b/app/docs.test.ts index a44313f2..29a54143 100644 --- a/app/docs.test.ts +++ b/app/docs.test.ts @@ -219,6 +219,8 @@ test("guide pages expose section navigation, on-page navigation, and a complete expect(authentication).toContain('class="on-this-page"'); expect(authentication).toContain("Configuration"); expect(authentication).toContain("Verification checklist"); + expect(authentication).toContain("Practical example"); + expect(authentication).toContain("requireSession"); const demo = readFileSync( join(root, "app", "pages", "guides", "full-stack-auth-demo.wrn"), @@ -230,6 +232,31 @@ test("guide pages expose section navigation, on-page navigation, and a complete expect(demo).toContain("cross-tenant identifiers are rejected"); }); +test("every technical guide teaches a practical configuration or workflow", () => { + for (const file of readdirSync(join(root, "app", "pages", "guides"))) { + if (!file.endsWith(".wrn")) continue; + const source = readFileSync(join(root, "app", "pages", "guides", file), "utf8"); + expect(source).toContain("
");
+    expect(source).toContain("Verification checklist");
+  }
+
+  const security = readFileSync(join(root, "app", "pages", "security.wrn"), "utf8");
+  expect(security).toContain("contentSecurityPolicy: true");
+  expect(security).toContain("What you can change");
+  expect(security).toContain("wrnexus security audit .");
+});
+
+test("documentation navigation exposes every package and uses the full-width shell", () => {
+  const core = readFileSync(join(root, "app", "pages", "packages", "core.wrn"), "utf8");
+  const index = readFileSync(join(root, "app", "pages", "packages.wrn"), "utf8");
+  for (const name of expected) {
+    expect(core).toContain(`href="/packages/${name}"`);
+    expect(index).toContain(`href="/packages/${name}"`);
+  }
+  expect(core).toContain("docs-layout--navigation");
+  expect(index).toContain("package-index-document");
+});
+
 test("package index includes searchable category filters", () => {
   const source = readFileSync(join(root, "app", "pages", "packages.wrn"), "utf8");
   expect(source).toContain('state category = "All"');
diff --git a/app/pages/404.wrn b/app/pages/404.wrn
index 4991e89c..ee8b1ebc 100644
--- a/app/pages/404.wrn
+++ b/app/pages/404.wrn
@@ -14,7 +14,8 @@ page Pagenotfound {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 

       
diff --git a/app/pages/access.wrn b/app/pages/access.wrn
index 6e5e6e1f..2aed8ff2 100644
--- a/app/pages/access.wrn
+++ b/app/pages/access.wrn
@@ -14,7 +14,8 @@ page Access {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Request preview access
WRNexusJS 0.8.7 packages are not available from the public npm registry. Installation requires approval and private registry credentials supplied by WorkRoot. Never paste registry tokens into source control, issue reports, or support messages.
Request process
  1. Contact WorkRoot through the public contact path at workroot.in.
  2. Describe the application, team, expected deployment, and Bun environment.
  3. After approval, follow the registry instructions supplied privately.
  4. Use the canonical scaffold command below only after authentication.
bunx @wrnexus/cli@0.8.7 create my-app
Access approval, response time, licensing terms, and support level remain owner-controlled. This site does not collect access requests directly.

       
diff --git a/app/pages/architecture.wrn b/app/pages/architecture.wrn
index 6f56c7a6..f83d774a 100644
--- a/app/pages/architecture.wrn
+++ b/app/pages/architecture.wrn
@@ -14,7 +14,8 @@ page Architecture {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Framework architecture · 0.8.7
Architecture
WRNexusJS is Bun-native and SSR-first. File discovery maps pages and API handlers; middleware enriches or short-circuits a request; the compiler turns .wrn declarations into server render functions and small feature runtimes.
Request and build lifecycle
  1. DiscoverPages, APIs, middleware, components, layouts, schemas, rooms
  2. CompileParse .wrn, validate grammar, generate server code
  3. RequestLimits, security, locale, session, middleware
  4. MatchStatic and dynamic file route
  5. RenderSSR data, escaped interpolation, components, metadata
  6. EnhanceOnly required reactive/directive runtimes
Package boundaries
core owns contexts, middleware, sessions and rooms; router discovers routes; compiler parses .wrn; ssr renders documents; csr supplies browser runtimes; dev-server and cli orchestrate development and builds.
Security and data flow
Validation happens at trust boundaries. Session authentication establishes identity; authorization makes resource decisions. CSP, Trusted Types, CSRF, upload checks, WebSocket origins, request limits, and output escaping are layered controls—not substitutes for application policy.
Realtime and scale
Rooms are process-local unless connected through pub/sub. Redis-backed pub/sub distributes events. Queue durability depends on the selected driver and must be evaluated explicitly.
Workspaces and gateways
The gateway can dispatch multiple applications while preserving route, component, asset, config, and session boundaries. Validate host routing and isolation before production.
Build and deployment
wrnexus build . produces dist/server.js and hashed/static assets. Run the server with Bun, apply migrations before traffic, terminate TLS at a trusted edge, and forward only expected proxy headers.
Mobile
Mobile compatibility bridges SSR-safe Capacitor capabilities; native route generation is experimental and is not general web portability. Test each target platform.
Generated files and limits
app/routes.gen.ts, .wrnexus/, and dist/ are generated. The runtime is Bun-only. Preview packages are private. Historical compatibility and long-term support policy are not yet published.

       
diff --git a/app/pages/benchmarks.wrn b/app/pages/benchmarks.wrn
index 33a07b5c..3b8afa2b 100644
--- a/app/pages/benchmarks.wrn
+++ b/app/pages/benchmarks.wrn
@@ -14,7 +14,8 @@ page Benchmarks {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Benchmarks
No publishable benchmark dataset yet
No comparative speed claims are published. A valid baseline must record scripts, commit, Bun/framework versions, hardware, OS, warmup, samples, workload, raw results, median, percentiles, memory, HTML size, browser JavaScript size, and run date.
The roadmap starts with WRNexusJS-only measurements before any maintained equivalent-workload comparison.

       
diff --git a/app/pages/changelog.wrn b/app/pages/changelog.wrn
index ebdde196..ccb982dd 100644
--- a/app/pages/changelog.wrn
+++ b/app/pages/changelog.wrn
@@ -14,7 +14,8 @@ page Changelog {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Changelog
0.8.7 2026-07-13
Documentation is aligned to all 47 installed packages. This release adds @wrnexus/helpers, original-request URL helpers, safe login redirects, working wrnexus workspace add, and forward-auth redirect propagation.
Migration notes
Run wrnexus update --latest and keep every @wrnexus/* package on 0.8.7. Existing applications must explicitly add @wrnexus/helpers before importing it; newly scaffolded applications include it automatically.
Versioning and support
The packages use semantic-looking versions, but a formal compatibility and old-release support policy has not been approved. Preview consumers should treat minor releases as potentially requiring migration review.

       
diff --git a/app/pages/examples.wrn b/app/pages/examples.wrn
index 612745e0..4e6e0ded 100644
--- a/app/pages/examples.wrn
+++ b/app/pages/examples.wrn
@@ -14,7 +14,8 @@ page Examples {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Examples
Examples are tied to installed 0.8.7 package documentation. The focused snippets in guides are source-verified; standalone runnable projects and CI compilation are tracked as remaining work.
Minimal .wrn page
Documented
Database CRUD
Planned fixture
Authentication and protected route
Planned fixture
Permissions
Planned fixture
Forms and validation
Documented
Realtime dashboard
Planned fixture
File upload
Planned fixture
Background queue
Planned fixture
Redis pub/sub
Planned fixture
Workspace gateway
Planned fixture
Deployment
Planned fixture
Experimental mobile mode
Planned fixture

       
diff --git a/app/pages/getting-started.wrn b/app/pages/getting-started.wrn
index 5e176e9c..f8cf9cfc 100644
--- a/app/pages/getting-started.wrn
+++ b/app/pages/getting-started.wrn
@@ -14,7 +14,8 @@ page Gettingstarted {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Preview guide · v0.8.7
Build a contact inbox
This path creates a server-rendered page, validated API route, middleware, and realtime next step. It requires approved registry access and Bun 1.3.x; this site was verified with Bun 1.3.14.
1. Create the project
bunx @wrnexus/cli@0.8.7 create my-app
 cd my-app
diff --git a/app/pages/guides/api-routes.wrn b/app/pages/guides/api-routes.wrn
index 439965e5..f8c3423f 100644
--- a/app/pages/guides/api-routes.wrn
+++ b/app/pages/guides/api-routes.wrn
@@ -14,12 +14,18 @@ page APIroutes {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
API routes
Export GET, POST, PUT, PATCH, or DELETE from app/api files. Validate request bodies, enforce authentication and authorization, cap request sizes, and return Web Responses.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
API routes
Export GET, POST, PUT, PATCH, or DELETE from app/api files. Validate request bodies, enforce authentication and authorization, cap request sizes, and return Web Responses.
Practical example
Validate a mutation and return an explicit HTTP result.
import { v, parseBody } from "@wrnexus/validation";
+const input = v.object({ name: v.string().trim().min(2).max(80) });
+export const POST = async (ctx) => {
+  const parsed = await parseBody(input, ctx.req);
+  return parsed.ok ? Response.json(parsed.value, { status: 201 }) : parsed.response;
+};
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     

   }
diff --git a/app/pages/guides/authentication.wrn b/app/pages/guides/authentication.wrn
index 879dee24..e9d51b2d 100644
--- a/app/pages/guides/authentication.wrn
+++ b/app/pages/guides/authentication.wrn
@@ -14,12 +14,18 @@ page Authentication {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Authentication
Configure session authentication, log users in through supported auth helpers, and read identity from context. Cookie flags, rotation, expiry, and secret storage remain deployment responsibilities.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Authentication
Configure session authentication, log users in through supported auth helpers, and read identity from context. Cookie flags, rotation, expiry, and secret storage remain deployment responsibilities.
Practical example
Require an authenticated session in middleware and redirect browser requests to login.
export default async function requireSession(ctx, next) {
+  const user = await readAuthenticatedUser(ctx);
+  if (!user) return Response.redirect(new URL("/login", ctx.url), 303);
+  ctx.state.user = user;
+  return next();
+}
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/authorization.wrn b/app/pages/guides/authorization.wrn
index d79374bc..8ada5d92 100644
--- a/app/pages/guides/authorization.wrn
+++ b/app/pages/guides/authorization.wrn
@@ -14,12 +14,17 @@ page Authorization {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Authorization
Authentication identifies; authorization decides. Enforce permissions in server routes and policies, including object ownership. UI hiding is never an authorization boundary.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Authorization
Authentication identifies; authorization decides. Enforce permissions in server routes and policies, including object ownership. UI hiding is never an authorization boundary.
Practical example
Check the exact permission at the mutation boundary; hiding UI is only a convenience.
export const DELETE = async (ctx) => {
+  await requirePermission(ctx, "member:delete");
+  await deleteMember(ctx.params.id, ctx.state.user.tenantId);
+  return new Response(null, { status: 204 });
+};
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/configuration-and-profiles.wrn b/app/pages/guides/configuration-and-profiles.wrn
index b7e7b4fd..ce0b086f 100644
--- a/app/pages/guides/configuration-and-profiles.wrn
+++ b/app/pages/guides/configuration-and-profiles.wrn
@@ -14,12 +14,21 @@ page Configurationandprofiles {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Configuration and profiles
wrnexus.config.ts owns styles, SEO, security, data, mobile, fonts, and profiles. Keep secrets in validated environment variables and review merged production configuration.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Configuration and profiles
wrnexus.config.ts owns styles, SEO, security, data, mobile, fonts, and profiles. Keep secrets in validated environment variables and review merged production configuration.
Practical example
Keep shared defaults at the root and make production differences explicit.
export default {
+  server: { port: 3000 },
+  profiles: {
+    development: { envFiles: [".env", ".env.development"] },
+    production: { envFiles: [".env", ".env.production"] },
+  },
+};
+
+bunx wrnexus config . --explain --profile=production
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/database.wrn b/app/pages/guides/database.wrn
index 55dd924f..efc65f6d 100644
--- a/app/pages/guides/database.wrn
+++ b/app/pages/guides/database.wrn
@@ -14,12 +14,16 @@ page Database {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Database
Configure SQLite or the installed supported driver, keep queries in named SQL blocks, generate typed functions, and apply migrations before traffic. Back up data and test rollback independently.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Database
Configure SQLite or the installed supported driver, keep queries in named SQL blocks, generate typed functions, and apply migrations before traffic. Back up data and test rollback independently.
Practical example
Create a migration from models, apply it, and regenerate typed database functions.
bunx wrnexus db status
+bunx wrnexus db new create_accounts --from-models
+bunx wrnexus db migrate
+bunx wrnexus db generate
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/deployment.wrn b/app/pages/guides/deployment.wrn
index 65031765..0f33e96e 100644
--- a/app/pages/guides/deployment.wrn
+++ b/app/pages/guides/deployment.wrn
@@ -14,12 +14,17 @@ page Deployment {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Deployment
Run bun run build, apply migrations, and start dist/server.js with Bun. Configure TLS, proxy trust, environment validation, health checks, graceful restarts, logs, backups, and restrictive security headers.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Deployment
Run bun run build, apply migrations, and start dist/server.js with Bun. Configure TLS, proxy trust, environment validation, health checks, graceful restarts, logs, backups, and restrictive security headers.
Practical example
Build once, apply migrations before traffic, and run the immutable Bun server artifact.
bun install --frozen-lockfile
+bunx wrnexus typecheck .
+bunx wrnexus db migrate
+bunx wrnexus build .
+bun dist/server.js
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/forms-and-validation.wrn b/app/pages/guides/forms-and-validation.wrn
index fcddfef6..4500e557 100644
--- a/app/pages/guides/forms-and-validation.wrn
+++ b/app/pages/guides/forms-and-validation.wrn
@@ -14,12 +14,18 @@ page Formsandvalidation {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Forms and validation
Define a v.object schema, use data-schema on the form, show field errors with data-error, and always call parseBody on the server. refine is server-only.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Forms and validation
Define a v.object schema, use data-schema on the form, show field errors with data-error, and always call parseBody on the server. refine is server-only.
Practical example
Use the same named schema in the browser form and authoritative API handler.
page Signup { view {
+  <form data-schema="signup" action="/api/signup" method="post">
+    <input name="email" type="email" /><span data-error="email"></span>
+    <button type="submit">Create account</button>
+  </form>
+} }
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/full-stack-auth-demo.wrn b/app/pages/guides/full-stack-auth-demo.wrn
index bb14334a..0607690b 100644
--- a/app/pages/guides/full-stack-auth-demo.wrn
+++ b/app/pages/guides/full-stack-auth-demo.wrn
@@ -14,7 +14,8 @@ page Authandpermissionsdashboarddemo {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Preview guide · 0.8.7
Auth and permissions dashboard demo
This walkthrough builds a small team portal. Public visitors can read the home and pricing pages, users can sign in, and the dashboard separates ordinary members from administrators. Every authorization decision remains on the server.

     
1. Create the application
bunx @wrnexus/cli@0.8.7 create team-portal
diff --git a/app/pages/guides/i18n-and-themes.wrn b/app/pages/guides/i18n-and-themes.wrn
index 96dcdc10..b4e15e21 100644
--- a/app/pages/guides/i18n-and-themes.wrn
+++ b/app/pages/guides/i18n-and-themes.wrn
@@ -14,12 +14,18 @@ page Internationalizationandthemes {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Internationalization and themes
Store locale JSON under app/locales and use translation directives. Themes resolve CSS tokens; ensure contrast, system preference behavior, persistence, and non-color cues.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Internationalization and themes
Store locale JSON under app/locales and use translation directives. Themes resolve CSS tokens; ensure contrast, system preference behavior, persistence, and non-color cues.
Practical example
Configure one default locale and theme, then reference translation keys in server-rendered markup.
export default {
+  i18n: { defaultLocale: "en", locales: ["en", "fr"] },
+  theme: { default: "system", palette: "violet" },
+};
+
+page Home { view { <h1>{t:home.title}</h1><button data-wire-theme-toggle>Theme</button> } }
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     

   }
diff --git a/app/pages/guides/middleware.wrn b/app/pages/guides/middleware.wrn
index 88509864..3fd59bd4 100644
--- a/app/pages/guides/middleware.wrn
+++ b/app/pages/guides/middleware.wrn
@@ -14,12 +14,18 @@ page Middleware {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Middleware
Middleware receives context and next. Return next() to continue or return a Response to stop. Put request limits and trust-boundary controls before business logic.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Middleware
Middleware receives context and next. Return next() to continue or return a Response to stop. Put request limits and trust-boundary controls before business logic.
Practical example
Add a request identifier and reject unsupported methods before application handlers run.
export default async function requestContext(ctx, next) {
+  ctx.state.requestId = crypto.randomUUID();
+  if (!["GET", "HEAD", "POST"].includes(ctx.req.method))
+    return new Response("Method not allowed", { status: 405 });
+  return next();
+}
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/mobile.wrn b/app/pages/guides/mobile.wrn
index 852bbc42..0b09a891 100644
--- a/app/pages/guides/mobile.wrn
+++ b/app/pages/guides/mobile.wrn
@@ -14,12 +14,15 @@ page Mobile {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Mobile
Mobile capabilities are experimental in this preview. Test Capacitor permissions and lifecycle on each platform; do not assume every .wrn or browser API converts to native.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Mobile
Mobile capabilities are experimental in this preview. Test Capacitor permissions and lifecycle on each platform; do not assume every .wrn or browser API converts to native.
Practical example
Generate the mobile surface, compile it, and inspect supported native capabilities before relying on one.
bunx wrnexus generate mobile
+bunx wrnexus mobile compile
+bunx wrnexus native list
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/observability.wrn b/app/pages/guides/observability.wrn
index 88b52dbe..9cb6e130 100644
--- a/app/pages/guides/observability.wrn
+++ b/app/pages/guides/observability.wrn
@@ -14,12 +14,17 @@ page Observability {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Observability
Use tracking middleware and sinks with redaction, sampling, stable request identifiers, alert ownership, and retention limits. Never capture registry tokens or session secrets.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Observability
Use tracking middleware and sinks with redaction, sampling, stable request identifiers, alert ownership, and retention limits. Never capture registry tokens or session secrets.
Practical example
Redact credentials at the sink boundary and attach a stable request identifier.
const tracking = createTracking({
+  redact: ["authorization", "cookie", "password", "token"],
+  sampleRate: 0.1,
+});
+export default tracking.middleware();
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/pages-and-components.wrn b/app/pages/guides/pages-and-components.wrn
index e7b892cd..1713e16d 100644
--- a/app/pages/guides/pages-and-components.wrn
+++ b/app/pages/guides/pages-and-components.wrn
@@ -14,12 +14,19 @@ page Pagesandcomponents {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Pages and components
Pages are routable, components are reusable, and layouts provide shared slots. Mount a component with data-component and keep browser state scoped and minimal.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Pages and components
Pages are routable, components are reusable, and layouts provide shared slots. Mount a component with data-component and keep browser state scoped and minimal.
Practical example
Declare the reusable contract in a component, then pass data from the owning page.
component StatusCard {
+  prop title = "Status"
+  prop value = "Unknown"
+  view { <article><h2>{title}</h2><p>{value}</p><slot /></article> }
+}
+
+page Dashboard { view { <StatusCard title="API" value="Healthy" /> } }
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/project-structure.wrn b/app/pages/guides/project-structure.wrn
index fe41631c..ef673d6d 100644
--- a/app/pages/guides/project-structure.wrn
+++ b/app/pages/guides/project-structure.wrn
@@ -14,12 +14,17 @@ page Projectstructure {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Project structure
Pages, components, layouts, APIs, middleware, schemas, database files, locales, realtime rooms, and styles live under app. Never edit app/routes.gen.ts, .wrnexus, or dist by hand.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Project structure
Pages, components, layouts, APIs, middleware, schemas, database files, locales, realtime rooms, and styles live under app. Never edit app/routes.gen.ts, .wrnexus, or dist by hand.
Practical example
Generate files through the CLI so routes and application types stay synchronized.
bunx wrnexus generate page account/settings
+bunx wrnexus generate component account-card
+bunx wrnexus generate api account/profile
+bunx wrnexus generate routes
+bunx wrnexus generate types .
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/pubsub.wrn b/app/pages/guides/pubsub.wrn
index 5793ebca..00f7ede1 100644
--- a/app/pages/guides/pubsub.wrn
+++ b/app/pages/guides/pubsub.wrn
@@ -14,12 +14,15 @@ page Pubsub {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Pub/sub
The in-process driver cannot cross processes. Use Redis where instances must share events, define channel ownership, and design for reconnects and duplicate delivery.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Pub/sub
The in-process driver cannot cross processes. Use Redis where instances must share events, define channel ownership, and design for reconnects and duplicate delivery.
Practical example
Use Redis when events must cross processes; use a namespaced channel contract.
const bus = createRedisPubSub({ url: env.REDIS_URL });
+await bus.subscribe("team:42:events", (event) => handleTeamEvent(event));
+await bus.publish("team:42:events", JSON.stringify({ type: "member.invited" }));
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/queues.wrn b/app/pages/guides/queues.wrn
index bfc73a8d..1091a365 100644
--- a/app/pages/guides/queues.wrn
+++ b/app/pages/guides/queues.wrn
@@ -14,12 +14,15 @@ page Queues {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Queues
Queue behavior is preview-level. Treat in-process work as non-durable, make handlers idempotent, cap retries, record failures, and choose a production persistence strategy.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Queues
Queue behavior is preview-level. Treat in-process work as non-durable, make handlers idempotent, cap retries, record failures, and choose a production persistence strategy.
Practical example
Make jobs idempotent and bound retry behavior before processing external effects.
const emails = queue("emails", { concurrency: 4, retries: 3 });
+emails.process(async (job) => sendInviteOnce(job.data.invitationId));
+await emails.add({ invitationId }, { delay: 1_000 });
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/realtime.wrn b/app/pages/guides/realtime.wrn
index 5d4043ad..ce6588a6 100644
--- a/app/pages/guides/realtime.wrn
+++ b/app/pages/guides/realtime.wrn
@@ -14,12 +14,19 @@ page Realtime {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Realtime
defineRoom handles connection and messages. Validate message shapes, authorize subscriptions, restrict origins, bound payloads, and use pub/sub to scale across processes.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Realtime
defineRoom handles connection and messages. Validate message shapes, authorize subscriptions, restrict origins, bound payloads, and use pub/sub to scale across processes.
Practical example
Authorize room membership and validate every incoming message before broadcasting.
export default defineRoom("team", {
+  async connect(client, ctx) { await requireTeamMember(ctx, ctx.params.teamId); },
+  async message(client, raw) {
+    const message = chatMessage.parse(JSON.parse(raw));
+    client.room.broadcast(JSON.stringify(message));
+  },
+});
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/routing.wrn b/app/pages/guides/routing.wrn
index a008e1a6..12edaf0c 100644
--- a/app/pages/guides/routing.wrn
+++ b/app/pages/guides/routing.wrn
@@ -14,12 +14,16 @@ page Routing {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Routing
A page filename defines its URL; index maps to the directory root and bracket segments are dynamic parameters. API files under app/api expose HTTP method functions and receive a Context.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Routing
A page filename defines its URL; index maps to the directory root and bracket segments are dynamic parameters. API files under app/api expose HTTP method functions and receive a Context.
Practical example
This creates a dynamic, server-rendered account route and verifies that the router discovered it.
// app/pages/accounts/[id].wrn
+page Account { view { <main><h1>Account {params.id}</h1></main> } }
+
+bunx wrnexus inspect routes .
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/security.wrn b/app/pages/guides/security.wrn
index 9b38d5d3..66ca9c0b 100644
--- a/app/pages/guides/security.wrn
+++ b/app/pages/guides/security.wrn
@@ -14,12 +14,27 @@ page Applicationsecurity {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Application security
Use CSP, CSRF, Trusted Types, session hardening, validation, origin checks, upload restrictions, encryption, request limits, and explicit CORS. See the security policy for reporting.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Application security
Use CSP, CSRF, Trusted Types, session hardening, validation, origin checks, upload restrictions, encryption, request limits, and explicit CORS. See the security policy for reporting.
Practical example
Enable the main browser and request protections in application configuration, then audit the resolved production profile.
// wrnexus.config.ts
+export default {
+  security: {
+    contentSecurityPolicy: true,
+    csrf: true,
+    trustedTypes: true,
+    frameOptions: "deny",
+    referrerPolicy: "strict-origin-when-cross-origin",
+    requestLimit: { maxBytes: 1_048_576 },
+    cors: { origins: ["https://app.example.com"] },
+  },
+};
+
+bunx wrnexus config . --explain --profile=production
+bunx wrnexus security audit .
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/server-data.wrn b/app/pages/guides/server-data.wrn
index c73039d0..f5deba03 100644
--- a/app/pages/guides/server-data.wrn
+++ b/app/pages/guides/server-data.wrn
@@ -14,12 +14,16 @@ page Serverdata {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Server data
Use an ssr API binding, return the desired response field, and render it with a server #each block. Values are escaped. Avoid fetching private data through a route that lacks authorization.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Server data
Use an ssr API binding, return the desired response field, and render it with a server #each block. Values are escaped. Avoid fetching private data through a route that lacks authorization.
Practical example
Fetch on the server and render useful HTML before browser JavaScript loads.
page Accounts {
+  ssr { api result GET /api/accounts { return result.accounts } }
+  view { <ul>{#each result as account}<li>{account.name}</li>{:empty}<li>No accounts</li>{/each}</ul> }
+}
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/testing.wrn b/app/pages/guides/testing.wrn
index ab921810..f3514d1f 100644
--- a/app/pages/guides/testing.wrn
+++ b/app/pages/guides/testing.wrn
@@ -14,12 +14,19 @@ page Testing {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Testing
Use Bun tests and @wrnexus/test helpers. Cover server HTML, API status and validation, authorization failures, reactive behavior, and a production startup smoke test.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Testing
Use Bun tests and @wrnexus/test helpers. Cover server HTML, API status and validation, authorization failures, reactive behavior, and a production startup smoke test.
Practical example
Cover successful output and the denial path, then run the built server smoke check.
import { describe, expect, test } from "bun:test";
+describe("members API", () => {
+  test("denies anonymous requests", async () => {
+    const response = await request("/api/members");
+    expect(response.status).toBe(401);
+  });
+});
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/troubleshooting.wrn b/app/pages/guides/troubleshooting.wrn
index 4179a7c9..0a4bcf5f 100644
--- a/app/pages/guides/troubleshooting.wrn
+++ b/app/pages/guides/troubleshooting.wrn
@@ -14,12 +14,17 @@ page Troubleshooting {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Troubleshooting
Confirm Bun and package versions, regenerate docs/routes through supported commands, read the first compiler diagnostic, check file naming, validate config, and reproduce under a production build.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Troubleshooting
Confirm Bun and package versions, regenerate docs/routes through supported commands, read the first compiler diagnostic, check file naming, validate config, and reproduce under a production build.
Practical example
Collect deterministic diagnostics without exposing application secrets.
bun --version
+bunx wrnexus doctor .
+bunx wrnexus config . --explain
+bunx wrnexus inspect routes .
+bunx wrnexus report . --file=app/pages/index.wrn
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/upgrading.wrn b/app/pages/guides/upgrading.wrn
index 43c80314..733d723b 100644
--- a/app/pages/guides/upgrading.wrn
+++ b/app/pages/guides/upgrading.wrn
@@ -14,12 +14,17 @@ page Upgrading {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Upgrading
Back up and commit first, then use wrnexus update --latest as documented by the installed CLI. Review migrations and keep every @wrnexus package aligned. Current release: 0.8.7.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Upgrading
Back up and commit first, then use wrnexus update --latest as documented by the installed CLI. Review migrations and keep every @wrnexus package aligned. Current release: 0.8.7.
Practical example
Preview migrations first, review the report, then update the aligned package set.
git status --short
+bunx wrnexus update . --latest --dry-run
+bunx wrnexus update . --latest
+bunx wrnexus typecheck .
+bunx wrnexus build .
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/uploads.wrn b/app/pages/guides/uploads.wrn
index c90b412f..2fa10e92 100644
--- a/app/pages/guides/uploads.wrn
+++ b/app/pages/guides/uploads.wrn
@@ -14,12 +14,18 @@ page Uploads {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
-
Preview guide · 0.8.7
Uploads
Configure named stores, accepted MIME/extensions, and maxBytes. Random keys avoid path traversal. Private files require an authenticated serving route; v1 buffers each file in memory.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+
Preview guide · 0.8.7
Uploads
Configure named stores, accepted MIME/extensions, and maxBytes. Random keys avoid path traversal. Private files require an authenticated serving route; v1 buffers each file in memory.
Practical example
Keep size and type policy server-owned and serve private objects through an authorized route.
export default {
+  uploads: { stores: { avatars: {
+    driver: "local", directory: "./data/avatars",
+    maxBytes: 2_000_000, accept: ["image/png", "image/jpeg"],
+  } } },
+};
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

       
     
   }
diff --git a/app/pages/guides/workspaces-and-gateway.wrn b/app/pages/guides/workspaces-and-gateway.wrn
index 0b28de88..9234187c 100644
--- a/app/pages/guides/workspaces-and-gateway.wrn
+++ b/app/pages/guides/workspaces-and-gateway.wrn
@@ -14,7 +14,8 @@ page Workspacesandgateway {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
Preview guide · 0.8.7
Workspaces and gateway
A workspace runs isolated applications behind one domain-routing gateway. Add an application from the workspace root; the CLI scaffolds apps/reports and registers it in wrnexus.workspace.ts:
wrnexus workspace add reports --domain=reports.localhost
 bun install
@@ -35,10 +36,13 @@ export const GET = async (ctx: Context) => {
   return redirectToLogin(ctx, "/login", {
     allowedHosts: ["admin.localhost:3000", "reports.localhost:3000"],
   });
-};
Always allowlist redirect hosts. After login, validate or sign the returnTo value before redirecting. Keep internal app ports private and open applications through the gateway port.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
+};
Always allowlist redirect hosts. After login, validate or sign the returnTo value before redirecting. Keep internal app ports private and open applications through the gateway port.
Practical example
Register applications explicitly and verify host routing through the gateway port.
bunx wrnexus workspace company-platform
+cd company-platform
+bunx wrnexus workspace add admin --domain=admin.localhost
+bunx wrnexus gateway --port=3000
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
-bunx wrnexus build .
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support

+bunx wrnexus build .

Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.

Verification checklist

Release scope

This guide describes installed 0.8.7 capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.

Browse package APIs · CLI reference · Troubleshooting · Support

} diff --git a/app/pages/language.wrn b/app/pages/language.wrn index 1d497620..69a75265 100644 --- a/app/pages/language.wrn +++ b/app/pages/language.wrn @@ -14,7 +14,8 @@ page Thewrnlanguage {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation
Language reference · 0.8.7

The .wrn language

File anatomy

page Account {
   layout = "public"
diff --git a/app/pages/license.wrn b/app/pages/license.wrn
index 37a9c02e..1aa938da 100644
--- a/app/pages/license.wrn
+++ b/app/pages/license.wrn
@@ -14,7 +14,8 @@ page License {
     
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration

     
BuildPages and componentsRoutingServer dataForms and validationDatabase

     
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy

-    
ReferencePackagesCLI.wrn languageComponentsExamples

+    
ReferencePackages overviewCLI.wrn languageComponentsExamples

+    
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

   
 
License
Owner decision required
This documentation repository contains no public license file, and the packages are unavailable from the public npm registry. No open-source license or redistribution right should be inferred.
Approved preview users must follow the private/commercial terms supplied by WorkRoot. Contact WorkRoot before copying, redistributing, or using WRNexusJS in production.

       
diff --git a/app/pages/packages.wrn b/app/pages/packages.wrn
index e12cdaff..2e127f7b 100644
--- a/app/pages/packages.wrn
+++ b/app/pages/packages.wrn
@@ -15,7 +15,13 @@ page Packages {
         
Private preview · v0.8.7

       
       
Browse documentation

-      
46 focused packages
Package reference
Everything in the framework, organized by responsibility and documented from the published 0.8.7 APIs.
Showing {category} packages

+      
46 focused packages
Package reference
Everything in the framework, organized by responsibility and documented from the published 0.8.7 APIs.
Find a package
Showing {category} packages
All packages

           AI
@wrnexus/ai
Server-side Anthropic client with generation and streaming.
Open documentation →
         
 
@@ -152,7 +158,7 @@ page Packages {
         
 
           Security
@wrnexus/validation
Typed schemas, coercion, validation, and browser descriptors.
Open documentation →
-        

+
} diff --git a/app/pages/packages/ai.wrn b/app/pages/packages/ai.wrn index 0ec8ca79..b446a513 100644 --- a/app/pages/packages/ai.wrn +++ b/app/pages/packages/ai.wrn @@ -13,8 +13,14 @@ page wrnexusai {
Private preview · v0.8.7
Browse documentation
-
-
AI · Package reference

@wrnexus/ai

Server-side Anthropic client with generation and streaming.

v0.8.7Private registryAI

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/ai@0.8.7

Request preview access. Never put registry tokens in source control.

Provider-neutral AI orchestration for OpenAI, Anthropic, Google and local OpenAI-compatible models, with streaming, structured output, tools, embeddings, vector search/RAG, conversation persistence, templates, guardrails, usage events, fallback, rate limits and evaluation reports.

+
+
AI · Package reference

@wrnexus/ai

Server-side Anthropic client with generation and streaming.

v0.8.7Private registryAI

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/ai@0.8.7

Request preview access. Never put registry tokens in source control.

Provider-neutral AI orchestration for OpenAI, Anthropic, Google and local OpenAI-compatible models, with streaming, structured output, tools, embeddings, vector search/RAG, conversation persistence, templates, guardrails, usage events, fallback, rate limits and evaluation reports.

A tiny, zero-dependency Claude (Anthropic) client for WRNexusJS apps — generate and stream text with Claude from any server-side code.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@@ -148,7 +154,7 @@ export const POST = async (ctx) => { system: "Answer using concise Markdown.", maxTokens: 1_500, }); -};
+};
diff --git a/app/pages/packages/auth.wrn b/app/pages/packages/auth.wrn index af233918..e6c0c4b7 100644 --- a/app/pages/packages/auth.wrn +++ b/app/pages/packages/auth.wrn @@ -13,8 +13,14 @@ page wrnexusauth {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/auth

Authentication routes, sessions, forms, guards, and account flows.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/auth@0.8.7

Request preview access. Never put registry tokens in source control.

Framework-native authentication, identity, account-security, and session management for WRNexusJS.

+
+
Security · Package reference

@wrnexus/auth

Authentication routes, sessions, forms, guards, and account flows.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/auth@0.8.7

Request preview access. Never put registry tokens in source control.

Framework-native authentication, identity, account-security, and session management for WRNexusJS.

Capabilities

  • Password registration, login, recovery, reset, and authenticated password changes
    • @@ -383,7 +389,7 @@ export const auth = createAuthEngine({ middleware: true, migrations: true, }, -};
+};
diff --git a/app/pages/packages/authz.wrn b/app/pages/packages/authz.wrn index 289ca9ff..957dba8f 100644 --- a/app/pages/packages/authz.wrn +++ b/app/pages/packages/authz.wrn @@ -13,8 +13,14 @@ page wrnexusauthz {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/authz

Role, permission, policy, and authorization guards.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/authz@0.8.7

Request preview access. Never put registry tokens in source control.

Composable authorization for WRNexusJS — role-based (RBAC), policy-based (PBAC), and attribute-based (ABAC) access control that reduces to a boolean check plus an authorize() guard.
+
+
Security · Package reference

@wrnexus/authz

Role, permission, policy, and authorization guards.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/authz@0.8.7

Request preview access. Never put registry tokens in source control.

Composable authorization for WRNexusJS — role-based (RBAC), policy-based (PBAC), and attribute-based (ABAC) access control that reduces to a boolean check plus an authorize() guard.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/authz is a small, server-side authorization toolkit. It gives you three interchangeable models — RBAC (roles → permissions), PBAC (policy predicates), and ABAC (attribute matchers) — that all collapse to a boolean | Promise<boolean> decision. Wrap any decision in a Middleware guard (authorize, requireRole, requirePermission) to protect WRNexusJS routes. Reach for it whenever a route or action needs to be gated on who the user is, what roles they hold, or attributes of the user and the resource. It plugs into @wrnexus/core by reading ctx.user as the authorization subject.

@@ -577,7 +583,7 @@ app.put( "/posts/:id", authorize((ctx) => canEdit(ctx.user as User, loadPost(ctx))), handler, -);
+);
diff --git a/app/pages/packages/benchmark.wrn b/app/pages/packages/benchmark.wrn index 03b10227..6fe0d31c 100644 --- a/app/pages/packages/benchmark.wrn +++ b/app/pages/packages/benchmark.wrn @@ -13,8 +13,14 @@ page wrnexusbenchmark {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/benchmark

Framework benchmark scenarios and repeatable performance measurements.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/benchmark@0.8.7

Request preview access. Never put registry tokens in source control.

Deterministic benchmark execution, percentiles, baseline comparisons, and regression budgets for builds, SSR, hydration, stores, and application hot paths.

+
+
Tooling · Package reference

@wrnexus/benchmark

Framework benchmark scenarios and repeatable performance measurements.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/benchmark@0.8.7

Request preview access. Never put registry tokens in source control.

Deterministic benchmark execution, percentiles, baseline comparisons, and regression budgets for builds, SSR, hydration, stores, and application hot paths.

import { runBenchmark, assertBenchmarkBudget } from "@wrnexus/benchmark";
 const result = await runBenchmark("render", render, { iterations: 100 });
 assertBenchmarkBudget(result, baseline, { p95Percent: 5 });

Complete TypeScript API

Generated from the exact installed package declarations.

interface BenchmarkOptions {
@@ -58,7 +64,7 @@ declare function assertBenchmarkBudget(current: BenchmarkResult, baseline: Bench
 export { type BenchmarkOptions, type BenchmarkResult, type RegressionBudget, type RegressionViolation, assertBenchmarkBudget, compareBenchmark, percentile, runBenchmark };

Examples

Copy-ready examples from the installed package documentation.

Deterministic benchmark execution, percentiles, baseline comparisons, and regression budgets for builds, SSR, hydration, stores, and application hot paths.

import { runBenchmark, assertBenchmarkBudget } from "@wrnexus/benchmark";
 const result = await runBenchmark("render", render, { iterations: 100 });
-assertBenchmarkBudget(result, baseline, { p95Percent: 5 });

Install @wrnexus/benchmark

bun add @wrnexus/benchmark
+assertBenchmarkBudget(result, baseline, { p95Percent: 5 });

Install @wrnexus/benchmark

bun add @wrnexus/benchmark
diff --git a/app/pages/packages/cache.wrn b/app/pages/packages/cache.wrn index 2dc95414..287c92cf 100644 --- a/app/pages/packages/cache.wrn +++ b/app/pages/packages/cache.wrn @@ -13,8 +13,14 @@ page wrnexuscache {
Private preview · v0.8.7
Browse documentation
-
-
Data · Package reference

@wrnexus/cache

Memory and distributed caching with coordination and invalidation.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/cache@0.8.7

Request preview access. Never put registry tokens in source control.

Bounded in-memory/tag caching and HTTP response caching for WRNexusJS. Supports request deduplication, tag invalidation, ETags, fresh/stale states, and optional detached stale revalidation.

+
+
Data · Package reference

@wrnexus/cache

Memory and distributed caching with coordination and invalidation.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/cache@0.8.7

Request preview access. Never put registry tokens in source control.

Bounded in-memory/tag caching and HTTP response caching for WRNexusJS. Supports request deduplication, tag invalidation, ETags, fresh/stale states, and optional detached stale revalidation.

import { connectCacheInvalidation, TagCache, responseCache } from "@wrnexus/cache";
 const cache = new TagCache({ ttlMs: 60_000, staleWhileRevalidateMs: 300_000 });
 export default responseCache({ cache, tags: ["products"] });
@@ -232,7 +238,7 @@ await bus.close();

Pages stale = "10m" tags = ["catalog", "marketing"] vary = ["tenant", "language"] -}

+}
diff --git a/app/pages/packages/captcha.wrn b/app/pages/packages/captcha.wrn index 6bdcddb2..60d1646e 100644 --- a/app/pages/packages/captcha.wrn +++ b/app/pages/packages/captcha.wrn @@ -13,8 +13,14 @@ page wrnexuscaptcha {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/captcha

Managed CAPTCHA verification, middleware, and UI integration.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/captcha@0.8.7

Request preview access. Never put registry tokens in source control.

A first-class CAPTCHA and anti-automation package for WRNexusJS. It supports self-hosted challenges, a managed WRNexus service, external providers, form submission guards, page gates, accessible audio, adaptive risk checks, and a Tailwind-only .wrn component.

+
+
Security · Package reference

@wrnexus/captcha

Managed CAPTCHA verification, middleware, and UI integration.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/captcha@0.8.7

Request preview access. Never put registry tokens in source control.

A first-class CAPTCHA and anti-automation package for WRNexusJS. It supports self-hosted challenges, a managed WRNexus service, external providers, form submission guards, page gates, accessible audio, adaptive risk checks, and a Tailwind-only .wrn component.

Install

bun add @wrnexus/captcha

WRNexusJS automatically discovers the package plugin, component, client runtime, styles, and DevToolbar audit. Use <Captcha /> directly after installation. The browser runtime is injected once only on responses that render a CAPTCHA; no script tag, public-file copy, or manual plugin registration is required. Call captchaPlugin(options) explicitly only when an application needs to override the discovered package configuration.

@@ -330,7 +336,7 @@ export const HEAD = POST;

Component sizes

<Captcha size="compact" action="small-form" />
 <Captcha size="normal" action="standard-form" />
 <Captcha size="big" action="security-page" />

Listen button visibility

<Captcha showListen="false" action="without-listen-button" />
-<Captcha showAudio="false" action="without-audio-alternative" />
+<Captcha showAudio="false" action="without-audio-alternative" />
diff --git a/app/pages/packages/cli.wrn b/app/pages/packages/cli.wrn index 87cf5010..ed670da3 100644 --- a/app/pages/packages/cli.wrn +++ b/app/pages/packages/cli.wrn @@ -13,8 +13,14 @@ page wrnexuscli {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/cli

Create, develop, build, generate, test, and maintain WRNexusJS apps.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/cli@0.8.7

Request preview access. Never put registry tokens in source control.

Production parity commands:

+
+
Tooling · Package reference

@wrnexus/cli

Create, develop, build, generate, test, and maintain WRNexusJS apps.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/cli@0.8.7

Request preview access. Never put registry tokens in source control.

Production parity commands:

wrnexus build .
 wrnexus preview . --port=3000
 wrnexus dev . --production-runtime
@@ -164,7 +170,7 @@ wrnexus workspace add reports --domain=reports.localhost bun install wrnexus gateway --port=3000

Upgrade with migrations and verification

wrnexus update --latest --dry-run
 wrnexus update --latest
-wrnexus doctor
+wrnexus doctor
diff --git a/app/pages/packages/compiler.wrn b/app/pages/packages/compiler.wrn index fe7922c7..0171ad9f 100644 --- a/app/pages/packages/compiler.wrn +++ b/app/pages/packages/compiler.wrn @@ -13,8 +13,14 @@ page wrnexuscompiler {
Private preview · v0.8.7
Browse documentation
-
-
Core · Package reference

@wrnexus/compiler

Parser and code generators for the .wrn language.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/compiler@0.8.7

Request preview access. Never put registry tokens in source control.

Partial-static rendering

+
+
Core · Package reference

@wrnexus/compiler

Parser and code generators for the .wrn language.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/compiler@0.8.7

Request preview access. Never put registry tokens in source control.

Partial-static rendering

Pages can select render = "partial-static" and divide their view with <Static> and <Dynamic> boundaries. The compiler emits a build-only shell renderer that never evaluates dynamic-boundary children. wrnexus build expands static component mounts into dist/partial-shells.json, records byte/region evidence in build-report.json, and embeds the shell in the production route manifest. At request time the production runtime retains request-aware layouts, locale/theme metadata and security nonces while streaming dynamic regions into stable placeholders.

Compiler for the .wrn language — tokenizes, parses, and lowers .wrn page and component files to TypeScript.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

@@ -407,7 +413,7 @@ const module = generate(ast); // exports render(props) + __wrnexusComponent
+lx.next(); // { type: "lbrace", value: "{", pos: 10 }
diff --git a/app/pages/packages/content.wrn b/app/pages/packages/content.wrn index 01df8aa5..0550e8f8 100644 --- a/app/pages/packages/content.wrn +++ b/app/pages/packages/content.wrn @@ -13,8 +13,14 @@ page wrnexuscontent {
Private preview · v0.8.7
Browse documentation
-
-
Data · Package reference

@wrnexus/content

Content collections, validation, querying, and publishing workflows.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/content@0.8.7

Request preview access. Never put registry tokens in source control.

Typed content collections for Markdown/MDX-like documents and remote CMS records. Collections validate frontmatter through any { parse(input) } schema, render escaped HTML, and expose draft preview, versions, references, headings, search indexes, pagination, RSS and sitemaps.

+
+
Data · Package reference

@wrnexus/content

Content collections, validation, querying, and publishing workflows.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/content@0.8.7

Request preview access. Never put registry tokens in source control.

Typed content collections for Markdown/MDX-like documents and remote CMS records. Collections validate frontmatter through any { parse(input) } schema, render escaped HTML, and expose draft preview, versions, references, headings, search indexes, pagination, RSS and sitemaps.

const posts = defineCollection({
   name: "posts",
   schema: PostSchema,
@@ -167,7 +173,7 @@ export { type CmsAdapter, type ContentCollection, type ContentCollectionOpt
 });
 
 const published = await posts.load();
-const preview = await posts.load({ previewToken: request.headers.get("x-preview-token") ?? "" });

Install @wrnexus/content

bun add @wrnexus/content
+const preview = await posts.load({ previewToken: request.headers.get("x-preview-token") ?? "" });

Install @wrnexus/content

bun add @wrnexus/content
diff --git a/app/pages/packages/core.wrn b/app/pages/packages/core.wrn index a8880c51..25ac7d3f 100644 --- a/app/pages/packages/core.wrn +++ b/app/pages/packages/core.wrn @@ -13,8 +13,14 @@ page wrnexuscore {
Private preview · v0.8.7
Browse documentation
-
-
Core · Package reference

@wrnexus/core

Contexts, middleware, security, sessions, caching, JSX, and realtime.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/core@0.8.7

Request preview access. Never put registry tokens in source control.

The framework core: the request Context, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.
+
+
Core · Package reference

@wrnexus/core

Contexts, middleware, security, sessions, caching, JSX, and realtime.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/core@0.8.7

Request preview access. Never put registry tokens in source control.

The framework core: the request Context, middleware contract, and the security, session, caching, streaming, realtime, and JSX primitives every other WRNexusJS package builds on.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/core is the shared foundation of WRNexusJS. It defines the Context object that flows through every middleware, page, and API route, plus the Middleware/Next contract they implement. On top of that it ships the building blocks a real app needs: cookie-backed sessions, password auth, CSRF protection, rate limiting, request logging, HTTP + in-memory caching, file uploads, streaming/SSE responses, WebSocket "rooms", security headers/CORS, and a server-side JSX runtime that renders to HTML strings. Everything here is server-side and Bun-native (it uses Bun.password, Bun.write, the web-standard Request/Response, and crypto). You depend on it directly and transitively through the rest of the framework.

@@ -1547,7 +1553,7 @@ import { createPubSub } from "@wrnexus/pubsub"; import { redisDriver } from "@wrnexus/pubsub/redis"; const registry = createRealtimeRegistry(); -bridgeRealtime(registry, createPubSub(redisDriver(process.env.REDIS_URL)));
+bridgeRealtime(registry, createPubSub(redisDriver(process.env.REDIS_URL)));
diff --git a/app/pages/packages/csr.wrn b/app/pages/packages/csr.wrn index d84439be..22b2d3b9 100644 --- a/app/pages/packages/csr.wrn +++ b/app/pages/packages/csr.wrn @@ -13,8 +13,14 @@ page wrnexuscsr {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/csr

Reactive, navigation, and realtime browser runtimes.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/csr@0.8.7

Request preview access. Never put registry tokens in source control.

+
+
Frontend · Package reference

@wrnexus/csr

Reactive, navigation, and realtime browser runtimes.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/csr@0.8.7

Request preview access. Never put registry tokens in source control.

Pages can opt into restoration across client navigation:

page Users {
   navigation {
@@ -329,7 +335,7 @@ Bun.serve({
 </div>
 <script src="/__wrnexus/realtime.js"></script>

Or drive a room from code

const room = wire.room("lobby");
 room.on("chat", (msg) => console.log(msg.user, msg.text));
-room.send({ type: "chat", user: "ada", text: "hi" });
+room.send({ type: "chat", user: "ada", text: "hi" });
diff --git a/app/pages/packages/db.wrn b/app/pages/packages/db.wrn index c897d159..b500f2ef 100644 --- a/app/pages/packages/db.wrn +++ b/app/pages/packages/db.wrn @@ -13,8 +13,14 @@ page wrnexusdb {
Private preview · v0.8.7
Browse documentation
-
-
Data · Package reference

@wrnexus/db

Database adapters, typed queries, models, migrations, and sessions.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/db@0.8.7

Request preview access. Never put registry tokens in source control.

Rollout-safe migrations

+
+
Data · Package reference

@wrnexus/db

Database adapters, typed queries, models, migrations, and sessions.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/db@0.8.7

Request preview access. Never put registry tokens in source control.

Rollout-safe migrations

Run wrnexus db check in CI before deployment. The analyzer reports stable diagnostics for drops, renames, type changes, new/enforced required columns, and potentially blocking index creation, with an expand/backfill/switch/contract recommendation. wrnexus db migrate blocks critical issues in pending migrations. --allow-breaking is an explicit operator override; already-applied migrations do not block later releases.

The database layer for WRNexusJS: TS models as the single source of truth for DDL, validation, and result typing, plus a driver-based Db client, migrations, and a sqlc-style query generator.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

@@ -524,7 +530,7 @@ await migrate(db, "app/db/migrations", { const mdb = await mongo(process.env.MONGO_URL!, "app"); const repo = mdb.collection(users); await repo.insert({ email: "a@b.com" }); -const active = await repo.find({ active: true });
+const active = await repo.find({ active: true });
diff --git a/app/pages/packages/dev-server.wrn b/app/pages/packages/dev-server.wrn index bd4525b2..6333d0f6 100644 --- a/app/pages/packages/dev-server.wrn +++ b/app/pages/packages/dev-server.wrn @@ -13,8 +13,14 @@ page wrnexusdevserver {
Private preview · v0.8.7
Browse documentation
-
-
Runtime · Package reference

@wrnexus/dev-server

Development and production servers, HMR, assets, and gateways.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/dev-server@0.8.7

Request preview access. Never put registry tokens in source control.

The WRNexusJS HTTP + WebSocket server runtime — request dispatch, SSR document assembly, live-reload (HMR), and the portable production handler.
+
+
Runtime · Package reference

@wrnexus/dev-server

Development and production servers, HMR, assets, and gateways.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/dev-server@0.8.7

Request preview access. Never put registry tokens in source control.

The WRNexusJS HTTP + WebSocket server runtime — request dispatch, SSR document assembly, live-reload (HMR), and the portable production handler.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

This package is the server runtime that powers a WRNexusJS app in both development and production. A single request runtime (createHandlers) owns HTTP/WebSocket dispatch and SSR document assembly; it knows nothing about _how_ modules and assets are produced, so the dev and prod entry points wire in different backends: dev uses dynamic module loading plus on-the-fly bundling and injects a live-reload client; prod uses a static, pre-built manifest with cache-immutable assets. The package also ships a multi-app gateway (route several apps by Host header behind one port) and a portable node:http adapter for WinterCG hosts. It is entirely server-side and Bun-native (Bun.serve, Bun.file, Bun.gzipSync).

@@ -864,7 +870,7 @@ await startGateway({ }, ], security: { trustedHostsOnly: true, rateLimit: { max: 600 } }, -});
+});
diff --git a/app/pages/packages/dev-toolbar.wrn b/app/pages/packages/dev-toolbar.wrn index 8781d516..3baa50f1 100644 --- a/app/pages/packages/dev-toolbar.wrn +++ b/app/pages/packages/dev-toolbar.wrn @@ -13,8 +13,14 @@ page wrnexusdevtoolbar {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/dev-toolbar

Development toolbar diagnostics, inspection, and runtime status.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/dev-toolbar@0.8.7

Request preview access. Never put registry tokens in source control.

Development-only page quality toolbar for WRNexusJS.

+
+
Tooling · Package reference

@wrnexus/dev-toolbar

Development toolbar diagnostics, inspection, and runtime status.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/dev-toolbar@0.8.7

Request preview access. Never put registry tokens in source control.

Development-only page quality toolbar for WRNexusJS.

Features

  • Runtime, resource and unhandled promise error capture
    • @@ -38,7 +44,7 @@ export { BuiltinPanelOptions, DevToolbarApp, DevToolbarCollector, DevToolba export { DEV_TOOLBAR_CSS, DEV_TOOLBAR_RUNTIME } from './client/index.js';

Examples

Copy-ready examples from the installed package documentation.

Serve DEVTOOLBARRUNTIME at /wrnexus/dev-toolbar.js and DEVTOOLBARCSS at /wrnexus/dev-toolbar.css, then inject this before </body> in development

<script type="module" src="/__wrnexus/dev-toolbar.js" data-wrnexus-dev-toolbar></script>

Run development-toolbar rules

import { runDevToolbarRules } from "@wrnexus/dev-toolbar";
 
-const issues = runDevToolbarRules(context);
+const issues = runDevToolbarRules(context);
diff --git a/app/pages/packages/encryption.wrn b/app/pages/packages/encryption.wrn index c00005bd..108724f1 100644 --- a/app/pages/packages/encryption.wrn +++ b/app/pages/packages/encryption.wrn @@ -13,8 +13,14 @@ page wrnexusencryption {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/encryption

Hashing, HMAC, authenticated encryption, and key derivation.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/encryption@0.8.7

Request preview access. Never put registry tokens in source control.

Authenticated encryption, hashing, HMAC, key rotation, and optional encrypted HTTP exchanges for WRNexusJS.

+
+
Security · Package reference

@wrnexus/encryption

Hashing, HMAC, authenticated encryption, and key derivation.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/encryption@0.8.7

Request preview access. Never put registry tokens in source control.

Authenticated encryption, hashing, HMAC, key rotation, and optional encrypted HTTP exchanges for WRNexusJS.

Core helpers

  • generateKey() — random 256-bit AES key encoded as base64.
    • @@ -210,7 +216,7 @@ const request = await createEncryptedRequest( { method: "POST", keyring }, ); const response = await fetch(request); -const result = await decryptEncryptedResponse(response, request, { keyring });

Install @wrnexus/encryption

bun add @wrnexus/encryption
+const result = await decryptEncryptedResponse(response, request, { keyring });

Install @wrnexus/encryption

bun add @wrnexus/encryption
diff --git a/app/pages/packages/graphql.wrn b/app/pages/packages/graphql.wrn index e1c15456..3f942987 100644 --- a/app/pages/packages/graphql.wrn +++ b/app/pages/packages/graphql.wrn @@ -13,10 +13,16 @@ page wrnexusgraphql {
Private preview · v0.8.7
Browse documentation
-
-
Data · Package reference

@wrnexus/graphql

GraphQL schemas, routes, and framework plugin integration.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/graphql@0.8.7

Request preview access. Never put registry tokens in source control.

Optional GraphQL endpoint plugin. Supply the executor from GraphQL.js, GraphQL Yoga, Mercurius, or another maintained engine; WRNexus owns bounded HTTP input, depth/alias limits, introspection policy, generic production errors and plugin route integration.

Complete TypeScript API

Generated from the exact installed package declarations.

export { G as GraphqlExecutionResult, a as GraphqlOptions, b as GraphqlRequest, c as createGraphqlHandler, default as graphqlPlugin } from './plugin.js';
+      

+      
Data · Package reference
@wrnexus/graphql
GraphQL schemas, routes, and framework plugin integration.
v0.8.7Private registryData
Install the package
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/graphql@0.8.7
Request preview access. Never put registry tokens in source control.
Optional GraphQL endpoint plugin. Supply the executor from GraphQL.js, GraphQL Yoga, Mercurius, or another maintained engine; WRNexus owns bounded HTTP input, depth/alias limits, introspection policy, generic production errors and plugin route integration.
Complete TypeScript API
Generated from the exact installed package declarations.
export { G as GraphqlExecutionResult, a as GraphqlOptions, b as GraphqlRequest, c as createGraphqlHandler, default as graphqlPlugin } from './plugin.js';
 import '@wrnexus/plugin';
-
Examples
Copy-ready examples from the installed package documentation.
Install @wrnexus/graphql
bun add @wrnexus/graphql
Import @wrnexus/graphql
import * as graphql from "@wrnexus/graphql";

+

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/graphql

bun add @wrnexus/graphql

Import @wrnexus/graphql

import * as graphql from "@wrnexus/graphql";
diff --git a/app/pages/packages/helpers.wrn b/app/pages/packages/helpers.wrn index 5dfc45f4..e11f64df 100644 --- a/app/pages/packages/helpers.wrn +++ b/app/pages/packages/helpers.wrn @@ -13,8 +13,14 @@ page wrnexushelpers {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/helpers

Safe Context URL helpers and forward-auth login redirects.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/helpers@0.8.7

Request preview access. Never put registry tokens in source control.

Safe convenience helpers for common WRNexusJS application flows. The package uses standard Context, URL, and Response values and has no runtime dependency beyond @wrnexus/core.

+
+
Tooling · Package reference

@wrnexus/helpers

Safe Context URL helpers and forward-auth login redirects.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/helpers@0.8.7

Request preview access. Never put registry tokens in source control.

Safe convenience helpers for common WRNexusJS application flows. The package uses standard Context, URL, and Response values and has no runtime dependency beyond @wrnexus/core.

bun add @wrnexus/helpers

The package is private, so the machine must be authenticated to the wrnexus npm organization.

Usage

@@ -153,7 +159,7 @@ export const GET = async (ctx: Context) => { returnToParam: "continue", status: 303, }); -};
+};
diff --git a/app/pages/packages/i18n.wrn b/app/pages/packages/i18n.wrn index fb0baa65..67909679 100644 --- a/app/pages/packages/i18n.wrn +++ b/app/pages/packages/i18n.wrn @@ -13,8 +13,14 @@ page wrnexusi18n {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/i18n

Translation loading, locale resolution, and Intl formatting.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/i18n@0.8.7

Request preview access. Never put registry tokens in source control.

Recursive locale loading, fallback resolution, SSR/browser translations, locale formatting, and language UI blocks for WRNexusJS.

+
+
Frontend · Package reference

@wrnexus/i18n

Translation loading, locale resolution, and Intl formatting.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/i18n@0.8.7

Request preview access. Never put registry tokens in source control.

Recursive locale loading, fallback resolution, SSR/browser translations, locale formatting, and language UI blocks for WRNexusJS.

Locale files

Both layouts can be used together:

app/locales/en.json
@@ -228,7 +234,7 @@ t("common.hello", { name: "Ajay" });
< const used = extractTranslationKeysFromFiles(sourceFiles); const coverage = auditLocaleKeys(messages, "en"); const enXA = createPseudoLocale(messages.en); -const arXB = createPseudoLocale(messages.en, { rtl: true });
+const arXB = createPseudoLocale(messages.en, { rtl: true });
diff --git a/app/pages/packages/identity.wrn b/app/pages/packages/identity.wrn index f24e6c4c..97c567bc 100644 --- a/app/pages/packages/identity.wrn +++ b/app/pages/packages/identity.wrn @@ -13,8 +13,14 @@ page wrnexusidentity {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/identity

Portable identity records, claims, and account linking.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/identity@0.8.7

Request preview access. Never put registry tokens in source control.

Enterprise identity and governance for WRNexusJS: OIDC discovery, signed SAML adapter flows, LDAP/Active Directory synchronization adapters, SCIM provisioning, scoped API keys, service accounts, approval workflows, consent history, retention, subject export/deletion and audit.

+
+
Security · Package reference

@wrnexus/identity

Portable identity records, claims, and account linking.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/identity@0.8.7

Request preview access. Never put registry tokens in source control.

Enterprise identity and governance for WRNexusJS: OIDC discovery, signed SAML adapter flows, LDAP/Active Directory synchronization adapters, SCIM provisioning, scoped API keys, service accounts, approval workflows, consent history, retention, subject export/deletion and audit.

The package complements @wrnexus/auth (passkeys, MFA, devices, sessions, OAuth and audited impersonation) and @wrnexus/authz (RBAC, ABAC and policy decisions). Protocol-specific SAML and directory parsing is supplied through adapters so applications can select a maintained vendor SDK without weakening framework validation, replay protection or governance auditing.

Complete TypeScript API

Generated from the exact installed package declarations.

interface OidcMetadata {
     issuer: string;
     authorization_endpoint: string;
@@ -230,7 +236,7 @@ declare function createGovernance(options?: {
 };
 
 export { type DirectoryAdapter, type EnterpriseIdentity, type GovernanceEvent, type MachineCredential, type OidcMetadata, type ReplayStore, type SamlAdapter, type SamlAssertion, type ScimStore, type ScimUser, createGovernance, createMachineIdentityManager, createSamlFederation, createScimHandler, discoverOidc, memoryReplayStore, memoryScimStore, oidcAuthorizationUrl, syncDirectory };
-

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/identity

bun add @wrnexus/identity

Import @wrnexus/identity

import * as identity from "@wrnexus/identity";
+

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/identity

bun add @wrnexus/identity

Import @wrnexus/identity

import * as identity from "@wrnexus/identity";
diff --git a/app/pages/packages/image.wrn b/app/pages/packages/image.wrn index ab0eaae3..ba4a257f 100644 --- a/app/pages/packages/image.wrn +++ b/app/pages/packages/image.wrn @@ -13,8 +13,14 @@ page wrnexusimage {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/image

Responsive image optimization, loaders, placeholders, and components.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/image@0.8.7

Request preview access. Never put registry tokens in source control.

Secure responsive-image planning, loader adapters, picture sources, preload hints, placeholders, and performance auditing for WRNexusJS.

+
+
Frontend · Package reference

@wrnexus/image

Responsive image optimization, loaders, placeholders, and components.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/image@0.8.7

Request preview access. Never put registry tokens in source control.

Secure responsive-image planning, loader adapters, picture sources, preload hints, placeholders, and performance auditing for WRNexusJS.

Build-time conversion is available through optimizeImage. It normalizes and bounds width/format variants, prevents variant explosions, writes deterministic filenames, and returns a manifest with dimensions and byte sizes:

import { optimizeImage } from "@wrnexus/image";
 
@@ -216,7 +222,7 @@ const picture = createPicture({
   sizes: "(max-width: 768px) 100vw, 1200px",
   fetchPriority: "high",
   loader,
-});
+});
diff --git a/app/pages/packages/jwt.wrn b/app/pages/packages/jwt.wrn index 7b117ca0..42d923ae 100644 --- a/app/pages/packages/jwt.wrn +++ b/app/pages/packages/jwt.wrn @@ -13,8 +13,14 @@ page wrnexusjwt {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/jwt

HS256 JWT signing, verification, and bearer authentication.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/jwt@0.8.7

Request preview access. Never put registry tokens in source control.

Dependency-free JSON Web Tokens (HS256) via Web Crypto, plus a bearer-token auth middleware for WRNexusJS.
+
+
Security · Package reference

@wrnexus/jwt

HS256 JWT signing, verification, and bearer authentication.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/jwt@0.8.7

Request preview access. Never put registry tokens in source control.

Dependency-free JSON Web Tokens (HS256) via Web Crypto, plus a bearer-token auth middleware for WRNexusJS.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/jwt signs and verifies stateless JSON Web Tokens using the HS256 (HMAC-SHA-256) algorithm. It has no runtime dependencies — signing and verification are implemented directly on the standard Web Crypto API (crypto.subtle), which Bun provides natively. It runs server-side and pairs with the session-based auth in @wrnexus/core, giving you a stateless option for API and mobile clients. Reach for it when you need bearer-token auth rather than cookie sessions.

@@ -313,7 +319,7 @@ try { app.use(jwtAuth({ secret: process.env.JWT_SECRET! })); // Optional auth — populate ctx.user when present, but don't 401 -app.use(jwtAuth({ secret: process.env.JWT_SECRET!, required: false }));
+app.use(jwtAuth({ secret: process.env.JWT_SECRET!, required: false }));
diff --git a/app/pages/packages/language-server.wrn b/app/pages/packages/language-server.wrn index 7285d84f..11a78500 100644 --- a/app/pages/packages/language-server.wrn +++ b/app/pages/packages/language-server.wrn @@ -13,8 +13,14 @@ page wrnexuslanguageserver {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/language-server

Editor-neutral language intelligence for WRN files.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/language-server@0.8.7

Request preview access. Never put registry tokens in source control.

Editor-neutral Language Server Protocol support for .wrn files. It uses the canonical @wrnexus/syntax parser, diagnostics, accessibility rules, and formatter.

+
+
Tooling · Package reference

@wrnexus/language-server

Editor-neutral language intelligence for WRN files.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/language-server@0.8.7

Request preview access. Never put registry tokens in source control.

Editor-neutral Language Server Protocol support for .wrn files. It uses the canonical @wrnexus/syntax parser, diagnostics, accessibility rules, and formatter.

bunx wrnexus-language-server --stdio

Capabilities include syntax, accessibility and TypeScript expression diagnostics, formatting, completion, hover, document symbols, go-to-definition, references, rename, and quick fixes. The custom wrnexus/virtualDocument request returns the mapped TypeScript representation of an open .wrn document for editor TypeScript plugins and safe refactoring tools. Any LSP 3.x client can launch the stdio command. Example Neovim configuration:

vim.lsp.start({
@@ -154,7 +160,7 @@ export { type Position, type Range, type TextDocument, WRN_COMPLETIONS, typ
   name = "wrnexus",
   cmd = { "bunx", "wrnexus-language-server", "--stdio" },
   root_dir = vim.fs.root(0, { "wrnexus.config.ts", "package.json", ".git" }),
-})
+})
diff --git a/app/pages/packages/mcp.wrn b/app/pages/packages/mcp.wrn index 3fb02fb3..4e7d490d 100644 --- a/app/pages/packages/mcp.wrn +++ b/app/pages/packages/mcp.wrn @@ -13,8 +13,14 @@ page wrnexusmcp {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/mcp

Model Context Protocol tools for WRNexus projects.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/mcp@0.8.7

Request preview access. Never put registry tokens in source control.

Editor-neutral Model Context Protocol server for AI development tools.

+
+
Tooling · Package reference

@wrnexus/mcp

Model Context Protocol tools for WRNexus projects.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/mcp@0.8.7

Request preview access. Never put registry tokens in source control.

Editor-neutral Model Context Protocol server for AI development tools.

bunx wrnexus-mcp --root=.

It exposes current routes, components with props/events, database schema files, compiler diagnostics, runtime errors, dev-server health, framework documentation and installed packages. Files are resolved inside the configured application root and returned as bounded structured JSON.

Complete TypeScript API

Generated from the exact installed package declarations.

interface McpTool {
     name: string;
@@ -40,7 +46,7 @@ interface McpServer {
 declare function createFrameworkMcpServer(appRoot: string, options?: McpServerOptions): McpServer;
 
 export { type McpServer, type McpServerOptions, type McpTool, createFrameworkMcpServer };
-

Examples

Copy-ready examples from the installed package documentation.

Editor-neutral Model Context Protocol server for AI development tools.

bunx wrnexus-mcp --root=.

Install @wrnexus/mcp

bun add @wrnexus/mcp
+

Examples

Copy-ready examples from the installed package documentation.

Editor-neutral Model Context Protocol server for AI development tools.

bunx wrnexus-mcp --root=.

Install @wrnexus/mcp

bun add @wrnexus/mcp
diff --git a/app/pages/packages/mobile.wrn b/app/pages/packages/mobile.wrn index f87643e0..0011536d 100644 --- a/app/pages/packages/mobile.wrn +++ b/app/pages/packages/mobile.wrn @@ -13,8 +13,14 @@ page wrnexusmobile {
Private preview · v0.8.7
Browse documentation
-
-
Native · Package reference

@wrnexus/mobile

SSR-safe compatibility access to Capacitor plugins.

v0.8.7Private registryNative

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/mobile@0.8.7

Request preview access. Never put registry tokens in source control.

SSR-safe access to Capacitor plugins from WRNexusJS browser code.
+
+
Native · Package reference

@wrnexus/mobile

SSR-safe compatibility access to Capacitor plugins.

v0.8.7Private registryNative

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/mobile@0.8.7

Request preview access. Never put registry tokens in source control.

SSR-safe access to Capacitor plugins from WRNexusJS browser code.

Overview

@wrnexus/mobile keeps optional native imports out of server rendering while giving browser-owned modules one consistent registry for Capacitor plugins. During SSR, mobile.isNative() is false and mobile.platform() is "web".

Install a plugin through the WRNexusJS CLI so the web and native projects stay aligned:

@@ -210,7 +216,7 @@ export const confirmAction = () => import { mobile } from "@wrnexus/mobile"; const network = mobile.plugin<NetworkPlugin>("Network"); -const status = network ? await network.getStatus() : { connected: true, connectionType: "unknown" };
+const status = network ? await network.getStatus() : { connected: true, connectionType: "unknown" };
diff --git a/app/pages/packages/native.wrn b/app/pages/packages/native.wrn index 1e2e5909..e9f42b35 100644 --- a/app/pages/packages/native.wrn +++ b/app/pages/packages/native.wrn @@ -13,8 +13,14 @@ page wrnexusnative {
Private preview · v0.8.7
Browse documentation
-
-
Native · Package reference

@wrnexus/native

Cross-platform browser and Capacitor capability registry.

v0.8.7Private registryNative

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/native@0.8.7

Request preview access. Never put registry tokens in source control.

Cross-platform capabilities for browsers, Capacitor WebViews, and compiled native apps.
+
+
Native · Package reference

@wrnexus/native

Cross-platform browser and Capacitor capability registry.

v0.8.7Private registryNative

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/native@0.8.7

Request preview access. Never put registry tokens in source control.

Cross-platform capabilities for browsers, Capacitor WebViews, and compiled native apps.

Overview

@wrnexus/native exposes capabilities by name so application code can ask what the current platform supports before presenting an action. Browser capabilities use Web APIs; mobile capabilities use installed Capacitor plugins. platform() returns "server" during SSR, "browser" on the web, and the Capacitor platform in a native WebView.

bun add @wrnexus/native
@@ -151,7 +157,7 @@ const position = await native.run( "geolocation", { enableHighAccuracy: true }, { target: "browser" }, -);
+);
diff --git a/app/pages/packages/oauth.wrn b/app/pages/packages/oauth.wrn index ab83785c..18659902 100644 --- a/app/pages/packages/oauth.wrn +++ b/app/pages/packages/oauth.wrn @@ -13,8 +13,14 @@ page wrnexusoauth {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/oauth

OAuth 2.0, PKCE, provider presets, and profile mapping.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/oauth@0.8.7

Request preview access. Never put registry tokens in source control.

Dependency-free OAuth 2.0 sign-in for any provider, with PKCE and presets for Google, GitHub, and Discord.
+
+
Security · Package reference

@wrnexus/oauth

OAuth 2.0, PKCE, provider presets, and profile mapping.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/oauth@0.8.7

Request preview access. Never put registry tokens in source control.

Dependency-free OAuth 2.0 sign-in for any provider, with PKCE and presets for Google, GitHub, and Discord.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/oauth implements the OAuth 2.0 Authorization Code flow (with PKCE) for server-side sign-in. It ships ready-made provider presets and a defineProvider helper for custom providers, then gives you two flow functions — startAuth (build the redirect) and completeAuth (exchange the code and fetch the user's profile). It has no runtime dependencies: it uses the platform fetch and WebCrypto only. Pairs naturally with @wrnexus/core's logIn to establish a session once you have a normalized profile.

@@ -347,7 +353,7 @@ const gitlab = defineProvider({ avatar: raw.avatar_url as string | undefined, raw, }), -});
+});
diff --git a/app/pages/packages/observability.wrn b/app/pages/packages/observability.wrn index 6491b8bf..302b9519 100644 --- a/app/pages/packages/observability.wrn +++ b/app/pages/packages/observability.wrn @@ -13,8 +13,14 @@ page wrnexusobservability {
Private preview · v0.8.7
Browse documentation
-
-
Runtime · Package reference

@wrnexus/observability

Structured logging, tracing, health, and integration adapters.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/observability@0.8.7

Request preview access. Never put registry tokens in source control.

Open-standard traces, metrics, logs, health checks, Web Vitals, error reporting and profiling.

+
+
Runtime · Package reference

@wrnexus/observability

Structured logging, tracing, health, and integration adapters.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/observability@0.8.7

Request preview access. Never put registry tokens in source control.

Open-standard traces, metrics, logs, health checks, Web Vitals, error reporting and profiling.

Use createOperationTracer() for database, cache, queue, realtime, server-action or custom application spans. Export through OTLP, Prometheus, Zipkin/Jaeger, or the Sentry-compatible error reporter; Grafana can consume the Prometheus or OTLP signals.

Privacy-conscious counters, gauges, histograms, HTTP middleware, Web Vitals ingestion, browser collection, and exporter adapters. Request bodies and user identifiers are not collected by default.

export default {
@@ -123,7 +129,7 @@ health.register("database", async () =>
 );
 
 export const live = createLivenessHandler();
-export const ready = createReadinessHandler(health);
+export const ready = createReadinessHandler(health);
diff --git a/app/pages/packages/playground.wrn b/app/pages/packages/playground.wrn index 49b871a4..31df570a 100644 --- a/app/pages/packages/playground.wrn +++ b/app/pages/packages/playground.wrn @@ -13,8 +13,14 @@ page wrnexusplayground {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/playground

Interactive framework examples and executable playground utilities.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/playground@0.8.7

Request preview access. Never put registry tokens in source control.

A deployable, shareable .wrn playground with diagnostics, generated JavaScript, safe SSR-shaped HTML, sandboxed preview, reactive/UI examples, and version adapters.

+
+
Tooling · Package reference

@wrnexus/playground

Interactive framework examples and executable playground utilities.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/playground@0.8.7

Request preview access. Never put registry tokens in source control.

A deployable, shareable .wrn playground with diagnostics, generated JavaScript, safe SSR-shaped HTML, sandboxed preview, reactive/UI examples, and version adapters.

Run wrnexus playground, or deploy createPlaygroundHandler().

Complete TypeScript API

Generated from the exact installed package declarations.

interface PlaygroundCompilation {
     source: string;
     generated: string;
@@ -56,7 +62,7 @@ declare function createPlaygroundHandler(options?: {
 }): (request: Request) => Promise<Response>;
 
 export { type PlaygroundCompilation, type PlaygroundVersionAdapter, comparePlaygroundVersions, compilePlayground, createPlaygroundHandler, decodePlaygroundShare, encodePlaygroundShare };
-

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/playground

bun add @wrnexus/playground

Import @wrnexus/playground

import * as playground from "@wrnexus/playground";
+

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/playground

bun add @wrnexus/playground

Import @wrnexus/playground

import * as playground from "@wrnexus/playground";
diff --git a/app/pages/packages/plugin.wrn b/app/pages/packages/plugin.wrn index 00c8bdb9..b1c399e4 100644 --- a/app/pages/packages/plugin.wrn +++ b/app/pages/packages/plugin.wrn @@ -13,8 +13,14 @@ page wrnexusplugin {
Private preview · v0.8.7
Browse documentation
-
-
Core · Package reference

@wrnexus/plugin

Plugin contracts, lifecycle hooks, composition, and framework integration.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/plugin@0.8.7

Request preview access. Never put registry tokens in source control.

Least-privilege package permissions

+
+
Core · Package reference

@wrnexus/plugin

Plugin contracts, lifecycle hooks, composition, and framework integration.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/plugin@0.8.7

Request preview access. Never put registry tokens in source control.

Least-privilege package permissions

Package manifests declare every framework capability they register:

{
   "wrnexus": {
@@ -76,7 +82,7 @@ export { type PluginCompatibilityResult, type PluginCompatibilityTarget, Pl
     enforce: true,
     grants: { "example-plugin": ["routes"] },
   },
-};
+};
diff --git a/app/pages/packages/pubsub.wrn b/app/pages/packages/pubsub.wrn index f277108f..32856ae2 100644 --- a/app/pages/packages/pubsub.wrn +++ b/app/pages/packages/pubsub.wrn @@ -13,8 +13,14 @@ page wrnexuspubsub {
Private preview · v0.8.7
Browse documentation
-
-
Realtime · Package reference

@wrnexus/pubsub

In-process and Redis-backed publish/subscribe.

v0.8.7Private registryRealtime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/pubsub@0.8.7

Request preview access. Never put registry tokens in source control.

Topic-based publish/subscribe with a pluggable driver — in-process by default, Redis for cross-process messaging.
+
+
Realtime · Package reference

@wrnexus/pubsub

In-process and Redis-backed publish/subscribe.

v0.8.7Private registryRealtime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/pubsub@0.8.7

Request preview access. Never put registry tokens in source control.

Topic-based publish/subscribe with a pluggable driver — in-process by default, Redis for cross-process messaging.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/pubsub is a small server-side pub/sub bus. You publish messages to a topic and subscribe with topic patterns; handlers fire for matching topics. The default driver keeps everything in-process, and you can swap in the Redis driver (@wrnexus/pubsub/redis) to fan messages out across processes or hosts. It also backs @wrnexus/core's realtime bridge for horizontal scaling.

@@ -207,7 +213,7 @@ bus.subscribe("order:*", (msg, topic) => { await bus.publish("order:created", { id: 7 }); // on shutdown (also closes the driver) -await bus.close();
+await bus.close();
diff --git a/app/pages/packages/pwa.wrn b/app/pages/packages/pwa.wrn index c79e9666..3cd3f373 100644 --- a/app/pages/packages/pwa.wrn +++ b/app/pages/packages/pwa.wrn @@ -13,8 +13,14 @@ page wrnexuspwa {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/pwa

Progressive Web App manifests, service workers, and offline strategies.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/pwa@0.8.7

Request preview access. Never put registry tokens in source control.

Official PWA primitives for manifests, service workers, offline pages and precaching, runtime caching, background synchronization, push notifications, install/update events, offline mutation stores, and conflict resolution. createOfflineQueue() accepts a durable IndexedDB-style store and retries requests with stable idempotency headers.

Complete TypeScript API

Generated from the exact installed package declarations.

interface IndexedDbMigration {
+      

+      
Frontend · Package reference
@wrnexus/pwa
Progressive Web App manifests, service workers, and offline strategies.
v0.8.7Private registryFrontend
Install the package
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/pwa@0.8.7
Request preview access. Never put registry tokens in source control.
Official PWA primitives for manifests, service workers, offline pages and precaching, runtime caching, background synchronization, push notifications, install/update events, offline mutation stores, and conflict resolution. createOfflineQueue() accepts a durable IndexedDB-style store and retries requests with stable idempotency headers.
Complete TypeScript API
Generated from the exact installed package declarations.
interface IndexedDbMigration {
     version: number;
     migrate(db: IDBDatabase, transaction: IDBTransaction): void;
 }
@@ -173,7 +179,7 @@ declare function pwaClientRuntime(serviceWorkerUrl?: string): string;
 declare function subscribeToPush(registration: ServiceWorkerRegistration, publicKey: Uint8Array): Promise<PushSubscription>;
 
 export { type ConflictResolution, type IndexedDbMigration, type OfflineMutation, type OfflineQueueStore, POSTGRES_PUSH_SUBSCRIPTION_SCHEMA, PWA_REVIEW_RUNTIME, type PushSqlClient, type PushSubscriptionStore, type RuntimeCacheRule, type RuntimeCacheStrategy, type ServiceWorkerOptions, type StoredPushSubscription, type WebManifestOptions, createOfflineQueue, createPushSubscriptionService, createWebManifest, generateServiceWorker, indexedDbOfflineQueueStore, memoryOfflineQueueStore, memoryPushSubscriptionStore, offlineQueueMigration, openPwaDatabase, postgresPushSubscriptionStore, pwaClientRuntime, renderOfflineQueueReview, resolveOfflineConflict, subscribeToPush };
-
Examples
Copy-ready examples from the installed package documentation.
Install @wrnexus/pwa
bun add @wrnexus/pwa
Import @wrnexus/pwa
import * as pwa from "@wrnexus/pwa";

+

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/pwa

bun add @wrnexus/pwa

Import @wrnexus/pwa

import * as pwa from "@wrnexus/pwa";
diff --git a/app/pages/packages/queue.wrn b/app/pages/packages/queue.wrn index a0c4bfd4..43e30564 100644 --- a/app/pages/packages/queue.wrn +++ b/app/pages/packages/queue.wrn @@ -13,8 +13,14 @@ page wrnexusqueue {
Private preview · v0.8.7
Browse documentation
-
-
Data · Package reference

@wrnexus/queue

Background jobs with delay, concurrency, retry, and repetition.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/queue@0.8.7

Request preview access. Never put registry tokens in source control.

A background job queue with delays, retries + exponential backoff, recurring jobs, and concurrent workers.
+
+
Data · Package reference

@wrnexus/queue

Background jobs with delay, concurrency, retry, and repetition.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/queue@0.8.7

Request preview access. Never put registry tokens in source control.

A background job queue with delays, retries + exponential backoff, recurring jobs, and concurrent workers.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/queue is a server-side in-process job queue. You register named workers, enqueue jobs (optionally delayed or recurring), and let the queue poll and run them on a timer — with per-job retry limits and doubling backoff between attempts. The default store lives in memory; the design allows a pluggable driver to back it with Redis/SQL for durability across restarts. Reach for it when you need to defer work (emails, webhooks, cleanup) off the request path without a heavyweight external broker. Tests can drive it deterministically via drain().

@@ -437,7 +443,7 @@ const ran = await queue.drain(); // => 1
+await engine.approve(workflow, run.id, "approve", currentUser.id);
diff --git a/app/pages/packages/reactive.wrn b/app/pages/packages/reactive.wrn index edcdc869..0313ffc7 100644 --- a/app/pages/packages/reactive.wrn +++ b/app/pages/packages/reactive.wrn @@ -13,8 +13,14 @@ page wrnexusreactive {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/reactive

Small type-safe reactive signal primitives.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/reactive@0.8.7

Request preview access. Never put registry tokens in source control.

Tiny, type-safe reactive primitives (signals) with zero dependencies.
+
+
Frontend · Package reference

@wrnexus/reactive

Small type-safe reactive signal primitives.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/reactive@0.8.7

Request preview access. Never put registry tokens in source control.

Tiny, type-safe reactive primitives (signals) with zero dependencies.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/reactive is the seed of WRNexusJS's reactivity layer: a minimal signal primitive that holds a value, notifies subscribers when it changes, and hands back an unsubscribe function. It is deliberately small and framework-agnostic — it powers nothing on its own, but is shaped so client islands (and later the .wrn compiler's state blocks) can build reactive bindings on top of it. Reach for it when you need observable state without pulling in a full reactivity library.

@@ -203,7 +209,7 @@ off(); // stop listening count.set(3); // nothing logged

Typed signals infer T from the initial value, or can be annotated explicitly

import { signal, type Signal } from "@wrnexus/reactive";
 
 const user: Signal<{ name: string } | null> = signal(null);
-user.set({ name: "Ada" });
+user.set({ name: "Ada" });
diff --git a/app/pages/packages/realtime.wrn b/app/pages/packages/realtime.wrn index 0d5ba6ca..03f78717 100644 --- a/app/pages/packages/realtime.wrn +++ b/app/pages/packages/realtime.wrn @@ -13,8 +13,14 @@ page wrnexusrealtime {
Private preview · v0.8.7
Browse documentation
-
-
Realtime · Package reference

@wrnexus/realtime

Rooms, presence, messaging, history, streams, and UI components.

v0.8.7Private registryRealtime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/realtime@0.8.7

Request preview access. Never put registry tokens in source control.

Typed rooms, secure message envelopes, browser room helpers, presence utilities, and complete realtime UI blocks for WRNexusJS.

+
+
Realtime · Package reference

@wrnexus/realtime

Rooms, presence, messaging, history, streams, and UI components.

v0.8.7Private registryRealtime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/realtime@0.8.7

Request preview access. Never put registry tokens in source control.

Typed rooms, secure message envelopes, browser room helpers, presence utilities, and complete realtime UI blocks for WRNexusJS.

Server rooms

import { defineRoom } from "@wrnexus/realtime";
 
@@ -264,7 +270,7 @@ sendRoomMessage(
 });

message, acknowledgement, and sequence counts for monitoring without exposing payloads.

const history = createRealtimeHistory({ limitPerRoom: 100 });
 const entry = history.publish("support", message);
 history.acknowledge("support", clientId, entry.sequence);
-const missed = history.resume("support", clientId);
+const missed = history.resume("support", clientId);
diff --git a/app/pages/packages/router.wrn b/app/pages/packages/router.wrn index dcb3d482..3bde59dd 100644 --- a/app/pages/packages/router.wrn +++ b/app/pages/packages/router.wrn @@ -13,8 +13,14 @@ page wrnexusrouter {
Private preview · v0.8.7
Browse documentation
-
-
Core · Package reference

@wrnexus/router

Filesystem discovery, route matching, and typed route generation.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/router@0.8.7

Request preview access. Never put registry tokens in source control.

File-based router that maps an app/ directory onto route tables and matches request paths against them.
+
+
Core · Package reference

@wrnexus/router

Filesystem discovery, route matching, and typed route generation.

v0.8.7Private registryCore

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/router@0.8.7

Request preview access. Never put registry tokens in source control.

File-based router that maps an app/ directory onto route tables and matches request paths against them.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/router scans an application's app/ directory once at startup and builds route tables for pages, API endpoints, realtime channels, middleware, server-rendered .wrn components, layouts, and validation schemas. It also compiles URL patterns (/users/[id]) into RegExps and matches request paths against them. Request input is never turned into a file path, which makes the router immune to path traversal. This is a server-side package used by the WRNexusJS runtime to resolve incoming requests, plus a codegen helper for compile-time typed links.

@@ -303,7 +309,7 @@ href("/nope"); // type error: unknown path
+const m = matchRoute(routes, "/posts/hello"); // { route, params: { slug: "hello" } }
diff --git a/app/pages/packages/security.wrn b/app/pages/packages/security.wrn index 7e00e6ef..fdb2088c 100644 --- a/app/pages/packages/security.wrn +++ b/app/pages/packages/security.wrn @@ -13,8 +13,14 @@ page wrnexussecurity {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/security

Security headers, CSRF protection, rate limits, and safe rendering.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/security@0.8.7

Request preview access. Never put registry tokens in source control.

Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.

+
+
Security · Package reference

@wrnexus/security

Security headers, CSRF protection, rate limits, and safe rendering.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/security@0.8.7

Request preview access. Never put registry tokens in source control.

Secure-by-default utilities for WRNexusJS: bounded HTML-safe serialization, prototype-pollution rejection, URL policy, secure cookies, request hardening, security presets, and SSRF-safe remote fetches.

import { safeFetch, securityPreset, setSecureCookie } from "@wrnexus/security";
 
 export default { security: securityPreset("strict") };
@@ -56,7 +62,7 @@ export { type RequestHardeningOptions, type SafeObjectOptions, type SecureC
 
 export default { security: securityPreset("strict") };
 const response = await safeFetch(remoteUrl, { allowedHosts: ["api.example.com"] });
-setSecureCookie(ctx, "__Host-session", sessionId);

Install @wrnexus/security

bun add @wrnexus/security
+setSecureCookie(ctx, "__Host-session", sessionId);

Install @wrnexus/security

bun add @wrnexus/security
diff --git a/app/pages/packages/ssr.wrn b/app/pages/packages/ssr.wrn index 52c5e494..5bc8a4d1 100644 --- a/app/pages/packages/ssr.wrn +++ b/app/pages/packages/ssr.wrn @@ -13,8 +13,14 @@ page wrnexusssr {
Private preview · v0.8.7
Browse documentation
-
-
Runtime · Package reference

@wrnexus/ssr

Secure HTML document rendering and SEO metadata.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/ssr@0.8.7

Request preview access. Never put registry tokens in source control.

Server-side rendering: wraps a page's HTML body in a complete HTML document with a metadata-driven <head>.
+
+
Runtime · Package reference

@wrnexus/ssr

Secure HTML document rendering and SEO metadata.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/ssr@0.8.7

Request preview access. Never put registry tokens in source control.

Server-side rendering: wraps a page's HTML body in a complete HTML document with a metadata-driven <head>.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

Pages in WRNexusJS return an HTML string for the body. @wrnexus/ssr takes that body and produces a full HTML document — building the <head> from page metadata and global SEO defaults, resolving canonical/Open Graph/Twitter tags, and injecting module preloads and <script type="module"> tags. It is deliberately server-only: nothing in this package touches the DOM or ships to the browser, keeping server code genuinely server-only. Reach for it on the server when turning a rendered page body into a response document.

@@ -221,7 +227,7 @@ return new Response(html, { extraBody: `<script type="application/json" id="boot">${JSON.stringify(bootData).replaceAll("<", "\\u003c")}</script>`, }); -return new Response(html, { headers: { "content-type": "text/html; charset=utf-8" } });
+return new Response(html, { headers: { "content-type": "text/html; charset=utf-8" } });
diff --git a/app/pages/packages/store.wrn b/app/pages/packages/store.wrn index 2ce2c017..fb4b24d0 100644 --- a/app/pages/packages/store.wrn +++ b/app/pages/packages/store.wrn @@ -13,8 +13,14 @@ page wrnexusstore {
Private preview · v0.8.7
Browse documentation
-
-
Data · Package reference

@wrnexus/store

Application state stores shared across server and browser runtimes.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/store@0.8.7

Request preview access. Never put registry tokens in source control.

Typed global and page-scoped WRNexusJS stores with runtime-specific state, computed values, actions, lifecycle hooks, persistence, SSR isolation, and HMR support.

+
+
Data · Package reference

@wrnexus/store

Application state stores shared across server and browser runtimes.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/store@0.8.7

Request preview access. Never put registry tokens in source control.

Typed global and page-scoped WRNexusJS stores with runtime-specific state, computed values, actions, lifecycle hooks, persistence, SSR isolation, and HMR support.

Use defineStore() to declare a store and createStoreContainer() to create an isolated request or browser container. Store definitions are framework helpers and do not require UI components.

Complete TypeScript API

Generated from the exact installed package declarations.

import { StoreMutation, StoreFunction, StoreDefinition, StoreInstance, StoreCombinedState } from './types.js';
 export { PersistenceStorage, StoreActionContext, StoreActionDefinition, StoreInstanceCore, StoreKind, StoreLifecycleContext, StorePersistenceConfig, StoreRuntime } from './types.js';
 
@@ -59,7 +65,7 @@ declare function createStoreInstance<S extends object, C extends object, A ex
 }): StoreInstance<StoreCombinedState<S, CS, SS>, C, A>;
 
 export { StoreCombinedState, StoreContainer, type StoreContainerOptions, StoreDefinition, StoreFunction, StoreInstance, StoreMutation, createStoreContainer, createStoreInstance, defineStore };
-

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/store

bun add @wrnexus/store

Import @wrnexus/store

import * as store from "@wrnexus/store";
+

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/store

bun add @wrnexus/store

Import @wrnexus/store

import * as store from "@wrnexus/store";
diff --git a/app/pages/packages/styles.wrn b/app/pages/packages/styles.wrn index ec4a3a14..c69633ad 100644 --- a/app/pages/packages/styles.wrn +++ b/app/pages/packages/styles.wrn @@ -13,8 +13,14 @@ page wrnexusstyles {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/styles

CSS pipeline, themes, fonts, profiles, and application config.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/styles@0.8.7

Request preview access. Never put registry tokens in source control.

Reusable layers and presets

+
+
Frontend · Package reference

@wrnexus/styles

CSS pipeline, themes, fonts, profiles, and application config.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/styles@0.8.7

Request preview access. Never put registry tokens in source control.

Reusable layers and presets

Compose local or package foundations in order; later layers override earlier ones and the application has final base-config precedence:

export default defineConfig({
   extends: ["@workroot/wrnexus-enterprise", "./layers/company"],
@@ -887,7 +893,7 @@ const themeJs = renderThemeRuntime(theme); // served at THEME_JS_HREF

Rendering the theme

<button data-wire-theme-toggle>Toggle theme</button>
-<button data-wire-theme-set="brand">Brand theme</button>
+<button data-wire-theme-set="brand">Brand theme</button>
diff --git a/app/pages/packages/syntax.wrn b/app/pages/packages/syntax.wrn index 44711ebf..33c889fd 100644 --- a/app/pages/packages/syntax.wrn +++ b/app/pages/packages/syntax.wrn @@ -13,8 +13,14 @@ page wrnexussyntax {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/syntax

Editor syntax definitions and language tooling for .wrn files.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/syntax@0.8.7

Request preview access. Never put registry tokens in source control.

Canonical WRN lexer, parser, AST, language metadata, source positions, and stable diagnostics. Framework tooling should import this package instead of implementing a separate .wrn parser.

+
+
Frontend · Package reference

@wrnexus/syntax

Editor syntax definitions and language tooling for .wrn files.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/syntax@0.8.7

Request preview access. Never put registry tokens in source control.

Canonical WRN lexer, parser, AST, language metadata, source positions, and stable diagnostics. Framework tooling should import this package instead of implementing a separate .wrn parser.

See docs/WRN-LANGUAGE-SPEC-1.0.md in the WRNexusJS repository.

Complete TypeScript API

Generated from the exact installed package declarations.

export { LexError, Lexer } from './tokenizer.js';
 export { FormatWrnOptions, formatWrn } from './formatter.js';
 export { A as ActionBlock, a as ApiBlock, b as Attr, C as ComputedDecl, D as DataApiBlock, c as DataMode, E as EffectBlock, d as EventDecl, F as FunctionParameterDecl, e as FunctionRuntime, L as LifecycleBlock, f as LoadBlock, M as ModeFunctionsBlock, O as OutputDecl, P as PageAst, g as ParseError, h as PersistDecl, i as PropDecl, R as RealtimeBlock, j as RealtimeHandler, k as RuntimeFunctionDecl, S as SeoBlock, l as StateDecl, m as StateRuntime, n as StoreKind, o as StoreLifecycleDecl, p as StructuredImportDecl, V as VOID_ELEMENTS, q as ViewNode, W as WatchBlock, r as parse, s as parseComputedDeclarations, t as parseHtmlView, u as parseOutputs, v as parsePersist, w as parseRuntimeFunctions, x as parseStateDeclarations, y as parseStoreLifecycle, z as parseStructuredImports, B as stripRuntimeFunctionModifiers } from './parser-CTLO4mcT.js';
@@ -46,7 +52,7 @@ export { type SourceRange, WRN_SYNTAX_FEATURES, WRN_SYNTAX_VERSION, WrnDiag
 
 const ast = parse('component Greeting { view { <p>Hello</p> } }');

Summarize syntax diagnostics

import { diagnose, diagnosticSummary } from "@wrnexus/syntax";
 
-const summary = diagnosticSummary(diagnose(source));
+const summary = diagnosticSummary(diagnose(source));
diff --git a/app/pages/packages/test.wrn b/app/pages/packages/test.wrn index 2d48b244..6e18775b 100644 --- a/app/pages/packages/test.wrn +++ b/app/pages/packages/test.wrn @@ -13,8 +13,14 @@ page wrnexustest {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/test

WRNexusJS-aware component, route, and browser testing utilities.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/test@0.8.7

Request preview access. Never put registry tokens in source control.

Testing utilities for WRNexusJS apps — component rendering, reactive-DOM mounting, route handler calls, and a full in-process app harness, plus a one-import re-export of bun:test.
+
+
Tooling · Package reference

@wrnexus/test

WRNexusJS-aware component, route, and browser testing utilities.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/test@0.8.7

Request preview access. Never put registry tokens in source control.

Testing utilities for WRNexusJS apps — component rendering, reactive-DOM mounting, route handler calls, and a full in-process app harness, plus a one-import re-export of bun:test.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/test is the server-side test toolkit you reach for when writing tests for a WRNexusJS app. It runs under bun test (invoked via wrnexus test) and gives you a single import surface: the bun:test primitives (test, expect, mock, …) re-exported alongside WRNexusJS-aware helpers that compile .wrn components, hydrate server HTML in a DOM, invoke API route handlers, and boot the real app on an ephemeral port for integration tests.

@@ -264,7 +270,7 @@ import { GET } from "../app/api/health.ts"; test("health endpoint", async () => { const res = await callRoute(GET, new Request("http://test/api/health")); expect(res.status).toBe(200); -});
+});
diff --git a/app/pages/packages/tracking.wrn b/app/pages/packages/tracking.wrn index b493f5d6..4e19e673 100644 --- a/app/pages/packages/tracking.wrn +++ b/app/pages/packages/tracking.wrn @@ -13,8 +13,14 @@ page wrnexustracking {
Private preview · v0.8.7
Browse documentation
-
-
Runtime · Package reference

@wrnexus/tracking

Error/event capture, middleware, filtering, and sinks.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/tracking@0.8.7

Request preview access. Never put registry tokens in source control.

Error tracking for WRNexusJS apps: capture exceptions manually or via middleware and fan them out to pluggable sinks.
+
+
Runtime · Package reference

@wrnexus/tracking

Error/event capture, middleware, filtering, and sinks.

v0.8.7Private registryRuntime

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/tracking@0.8.7

Request preview access. Never put registry tokens in source control.

Error tracking for WRNexusJS apps: capture exceptions manually or via middleware and fan them out to pluggable sinks.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/tracking is a small, server-side error-capture layer. You create a tracker with one or more sinks, then feed it errors — either manually with tracker.capture(err, context) or automatically by mounting tracker.middleware() in your request pipeline. A consoleSink is included; forwarding to Sentry, Datadog, or any other backend is just a matter of writing a tiny sink. Reach for it when you want a single, sink-agnostic place to route application errors. Sinks run best-effort — a throwing sink never breaks the request.

@@ -196,7 +202,7 @@ const tracker = createTracker({ }, }); -tracker.addSink(anotherSink); // add more sinks later
+tracker.addSink(anotherSink); // add more sinks later
diff --git a/app/pages/packages/typecheck.wrn b/app/pages/packages/typecheck.wrn index 2cb949a0..1ef9728f 100644 --- a/app/pages/packages/typecheck.wrn +++ b/app/pages/packages/typecheck.wrn @@ -13,8 +13,14 @@ page wrnexustypecheck {
Private preview · v0.8.7
Browse documentation
-
-
Tooling · Package reference

@wrnexus/typecheck

WRN-aware TypeScript diagnostics and virtual documents.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/typecheck@0.8.7

Request preview access. Never put registry tokens in source control.

Static type checking for .wrn declarations, props, state, outputs, functions, stores, and generated virtual TypeScript files.

+
+
Tooling · Package reference

@wrnexus/typecheck

WRN-aware TypeScript diagnostics and virtual documents.

v0.8.7Private registryTooling

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/typecheck@0.8.7

Request preview access. Never put registry tokens in source control.

Static type checking for .wrn declarations, props, state, outputs, functions, stores, and generated virtual TypeScript files.

The package is compiler tooling rather than a browser UI package, so its public kit consists of programmatic typecheck helpers and diagnostics.

Complete TypeScript API

Generated from the exact installed package declarations.

import { PageAst } from '@wrnexus/syntax';
 export { componentContract, storeContract } from './contracts.js';
 export { findAppRoot, loadApplicationTypes } from './project.js';
@@ -62,7 +68,7 @@ declare function checkWrnSource(source: string, options?: TypecheckOptions): Wrn
 declare function checkWrnFile(filePath: string, options?: Omit<TypecheckOptions, "filePath">): WrnTypeDiagnostic[];
 
 export { type TypecheckOptions, type VirtualTypeScriptModule, type WrnTypeDiagnostic, checkWrnFile, checkWrnSource, virtualTypeScriptModule };
-

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/typecheck

bun add @wrnexus/typecheck

Import @wrnexus/typecheck

import * as typecheck from "@wrnexus/typecheck";
+

Examples

Copy-ready examples from the installed package documentation.

Install @wrnexus/typecheck

bun add @wrnexus/typecheck

Import @wrnexus/typecheck

import * as typecheck from "@wrnexus/typecheck";
diff --git a/app/pages/packages/ui.wrn b/app/pages/packages/ui.wrn index 972fba92..a1693924 100644 --- a/app/pages/packages/ui.wrn +++ b/app/pages/packages/ui.wrn @@ -13,8 +13,14 @@ page wrnexusui {
Private preview · v0.8.7
Browse documentation
-
-
Frontend · Package reference

@wrnexus/ui

Themeable server-rendered UI components and CSS.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/ui@0.8.7

Request preview access. Never put registry tokens in source control.

First-party Wire UI component library — a set of themeable .wrn components plus a single tokenized stylesheet.
+
+
Frontend · Package reference

@wrnexus/ui

Themeable server-rendered UI components and CSS.

v0.8.7Private registryFrontend

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/ui@0.8.7

Request preview access. Never put registry tokens in source control.

First-party Wire UI component library — a set of themeable .wrn components plus a single tokenized stylesheet.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Overview

@wrnexus/ui ships a library of server-rendered .wrn components (layout, form controls, and feedback UI) together with one themeable stylesheet, ui.css. The components are auto-discovered by the framework router — you don't import them in code. Once the package's component directory is on the router's scan path, you mount any component in a page with data-component="<name>". Every visual is driven by var(--wire-*) theme tokens, so components restyle instantly when the theme changes. The tiny JS surface (src/index.ts) exists only so the toolchain (CLI build + dev server) can locate the component directory and stylesheet.

@@ -103,7 +109,7 @@ const router = buildRouter(appDir, { componentDirs: [uiComponentsDir()]  <div data-component="badge" label="New"></div> <button data-component="button" label="Save" variant="primary" size="lg"></button> <div data-component="alert" variant="success" title="Done" message="Saved."></div> -</div>

Explore the component library

Browse interactive examples and complete component usage in the dedicated WRNexusJS component showcase.

Browse all 102 components →

+</div>

Explore the component library

Browse interactive examples and complete component usage in the dedicated WRNexusJS component showcase.

Browse all 102 components →

diff --git a/app/pages/packages/uploader.wrn b/app/pages/packages/uploader.wrn index c0d6da04..ee19c45d 100644 --- a/app/pages/packages/uploader.wrn +++ b/app/pages/packages/uploader.wrn @@ -13,8 +13,14 @@ page wrnexusuploader {
Private preview · v0.8.7
Browse documentation
-
-
Data · Package reference

@wrnexus/uploader

Validated local/S3 uploads and secure file serving.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/uploader@0.8.7

Request preview access. Never put registry tokens in source control.

Config-driven file uploads + serving for WRNexusJS. Declare named storage stores (local disk or any S3-compatible backend) in wrnexus.config.ts, upload with one function call, drop a drag-and-drop widget on a page, and serve files back — public or private. Zero external dependencies (S3 is signed with a built-in AWS SigV4 implementation, like the rest of the framework).

+
+
Data · Package reference

@wrnexus/uploader

Validated local/S3 uploads and secure file serving.

v0.8.7Private registryData

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/uploader@0.8.7

Request preview access. Never put registry tokens in source control.

Config-driven file uploads + serving for WRNexusJS. Declare named storage stores (local disk or any S3-compatible backend) in wrnexus.config.ts, upload with one function call, drop a drag-and-drop widget on a page, and serve files back — public or private. Zero external dependencies (S3 is signed with a built-in AWS SigV4 implementation, like the rest of the framework).

Usage

Configure local and S3 stores

// wrnexus.config.ts
@@ -629,7 +635,7 @@ await getStore("docs").driver.delete(files[0].key);

Serve private files behind application authentication

// app/api/files/[key].ts
 import { serveFromStore } from "@wrnexus/uploader";
-export const GET = serveFromStore("docs"); // your middleware decides who gets in
+export const GET = serveFromStore("docs"); // your middleware decides who gets in
diff --git a/app/pages/packages/validation.wrn b/app/pages/packages/validation.wrn index 2afca7c2..d1c231a5 100644 --- a/app/pages/packages/validation.wrn +++ b/app/pages/packages/validation.wrn @@ -13,8 +13,14 @@ page wrnexusvalidation {
Private preview · v0.8.7
Browse documentation
-
-
Security · Package reference

@wrnexus/validation

Typed schemas, coercion, validation, and browser descriptors.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/validation@0.8.7

Request preview access. Never put registry tokens in source control.

One fluent schema, validated on the server (API bodies, env vars) and mirrored to an eval-free browser validator for forms.
+
+
Security · Package reference

@wrnexus/validation

Typed schemas, coercion, validation, and browser descriptors.

v0.8.7Private registrySecurity

Install the package

After WorkRoot approves private registry access, install the release-aligned package:

bun add @wrnexus/validation@0.8.7

Request preview access. Never put registry tokens in source control.

One fluent schema, validated on the server (API bodies, env vars) and mirrored to an eval-free browser validator for forms.

Part of the WRNexusJS framework — an SSR-first, Bun-native full-stack web framework.

Boundary contracts

Use ContractRegistry with defineContract or defineEvent to publish the same schema descriptors for APIs, actions, webhooks, realtime, queues, cron, pub/sub, plugins, configuration, and environment variables.

@@ -542,7 +548,7 @@ import { signupSchema } from "./app/schemas/signup.ts"; const head = `<script>${renderSchemasScript({ signup: signupSchema.describe() })}</script> <script>${VALIDATE_RUNTIME}</script>`; -// render a <form data-schema="signup"> with [data-error="email"] etc.
+// render a <form data-schema="signup"> with [data-error="email"] etc.
diff --git a/app/pages/releases/0.8.7.wrn b/app/pages/releases/0.8.7.wrn index afd3b504..79e57db0 100644 --- a/app/pages/releases/0.8.7.wrn +++ b/app/pages/releases/0.8.7.wrn @@ -14,7 +14,8 @@ page Release087 {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

WRNexusJS 0.8.7

Released 2026-07-13. All 47 installed packages are aligned to this version. Highlights include the new helpers package, reliable workspace app addition, and browser SSO redirects through forward authentication. See the changelog, upgrade guide, and package references.

diff --git a/app/pages/roadmap.wrn b/app/pages/roadmap.wrn index ab4a4534..c945edf0 100644 --- a/app/pages/roadmap.wrn +++ b/app/pages/roadmap.wrn @@ -14,7 +14,8 @@ page Roadmap {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

Roadmap

Roadmap items are direction, not delivery commitments. Dates require explicit owner approval.

Now

  • Private preview onboarding and accurate package references
  • Runnable documentation fixtures and link/accessibility checks
  • License, support, and disclosure owner decisions

Next

  • Durable queue driver guidance
  • Expanded database/auth/realtime examples
  • Versioned release notes and migration fixtures

Later / exploration

  • Historical documentation selector
  • Maintained reproducible benchmarks
  • Broader mobile/native coverage
diff --git a/app/pages/search.wrn b/app/pages/search.wrn index 47e08446..bc930233 100644 --- a/app/pages/search.wrn +++ b/app/pages/search.wrn @@ -14,7 +14,8 @@ page Search {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

Search documentation

This build-time index is local and sends no query to a third party. Use your browser’s find command to filter this compact index.

Core documentation

Get started · Packages · Components · Language · Architecture

Guides

Project structure · Routing · Pages and components · Server data · API routes · Middleware · Forms and validation · Authentication · Authorization · Application security · Database · Uploads · Realtime · Pub/sub · Queues · Testing · Workspaces and gateway · Deployment · Configuration and profiles · Internationalization and themes · Mobile · Observability · Upgrading · Troubleshooting · Auth and permissions dashboard demo

Package APIs

@wrnexus/ai · @wrnexus/authz · @wrnexus/compiler · @wrnexus/core · @wrnexus/csr · @wrnexus/db · @wrnexus/dev-server · @wrnexus/encryption · @wrnexus/helpers · @wrnexus/i18n · @wrnexus/jwt · @wrnexus/mobile · @wrnexus/native · @wrnexus/oauth · @wrnexus/pubsub · @wrnexus/queue · @wrnexus/reactive · @wrnexus/router · @wrnexus/ssr · @wrnexus/styles · @wrnexus/test · @wrnexus/tracking · @wrnexus/ui · @wrnexus/uploader · @wrnexus/validation · @wrnexus/dev-toolbar · @wrnexus/syntax · @wrnexus/plugin · @wrnexus/captcha · @wrnexus/auth · @wrnexus/store · @wrnexus/typecheck · @wrnexus/security · @wrnexus/cache · @wrnexus/image · @wrnexus/observability · @wrnexus/benchmark · @wrnexus/realtime · @wrnexus/content · @wrnexus/graphql · @wrnexus/identity · @wrnexus/language-server · @wrnexus/mcp · @wrnexus/playground · @wrnexus/pwa · @wrnexus/rpc · @wrnexus/cli

diff --git a/app/pages/security.wrn b/app/pages/security.wrn index 61c7c37b..0db126d8 100644 --- a/app/pages/security.wrn +++ b/app/pages/security.wrn @@ -14,9 +14,24 @@ page Security {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation
-

Security

WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.

Supported releases

Only the current private-preview release 0.8.7 is documented here. A formal old-release support window is not yet published.

Report a vulnerability

Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.

Deployment controls

Use restrictive CSP and permissions policies, HSTS only on HTTPS production origins, MIME sniffing protection, restrictive referrers, explicit CORS, secure cookies, CSRF validation, request limits, and origin checks. See application security.

+

Security

WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.

Start with a production policy

The following baseline blocks framing, restricts referrers and cross-origin access, enables CSRF and Trusted Types, and caps request bodies. Replace the example origin with the exact browser origin that calls your application.

// wrnexus.config.ts
+export default {
+  security: {
+    contentSecurityPolicy: true,
+    csrf: true,
+    trustedTypes: true,
+    frameOptions: "deny",
+    referrerPolicy: "strict-origin-when-cross-origin",
+    cors: { origins: ["https://app.example.com"], credentials: true },
+    requestLimit: { maxBytes: 1_048_576 },
+  },
+};

What you can change

  • Add only required API origins to CORS; never use a wildcard with credentialed requests.
  • Lower request limits for JSON APIs and define separate upload limits for accepted file types.
  • Extend CSP only for origins your application actually loads; avoid unsafe inline script exceptions.
  • Enable HSTS only after HTTPS works on every production hostname and subdomain you include.
  • Set session expiry, rotation, secure, HTTP-only, and SameSite behavior for your authentication flow.

Verify the resolved controls

bunx wrnexus config . --explain --profile=production
+bunx wrnexus security audit .
+bunx wrnexus typecheck .
+bunx wrnexus build .

Review the resolved production configuration, then test a valid request, an invalid CSRF token, an oversized body, an unapproved origin, an anonymous protected request, and a permission-denied request. Security configuration is complete only when denial behavior is tested.

Supported releases

Only the current private-preview release 0.8.7 is documented here. A formal old-release support window is not yet published.

Report a vulnerability

Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.

Deployment controls

Terminate TLS at a trusted edge, forward only expected proxy headers, store secrets outside source control, apply database migrations before traffic, and monitor rejected requests without logging credentials. Continue with the complete application security guide.

} diff --git a/app/pages/showcase.wrn b/app/pages/showcase.wrn index 2251f7d3..54ee4430 100644 --- a/app/pages/showcase.wrn +++ b/app/pages/showcase.wrn @@ -14,7 +14,8 @@ page Showcase {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

Showcase

Only confirmed public properties are listed; no customer or traffic claims are made.

WorkRoot

Creator/company site demonstrating a public WRNexusJS deployment. Exact deployed version and infrastructure notes await owner confirmation.

WRNexusJS docs

This documentation portal, built and verified against WRNexusJS 0.8.7 on Bun.

Screenshots are intentionally deferred until approved assets and alt text are available.

diff --git a/app/pages/support.wrn b/app/pages/support.wrn index d97d39a2..be2026ac 100644 --- a/app/pages/support.wrn +++ b/app/pages/support.wrn @@ -14,7 +14,8 @@ page Support {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation

Support

WRNexusJS has no public Discord, public issue tracker, or guaranteed community support channel listed by this repository. Preview access and support begin through WorkRoot’s public contact path.

Include WRNexusJS version, Bun version, OS, a minimal reproduction, expected and actual behavior, and sanitized logs. Never include registry tokens, credentials, session cookies, or private data.

Support scope, service levels, and commercial terms require owner confirmation.

diff --git a/app/pages/tutorial.wrn b/app/pages/tutorial.wrn index 03b26524..e0692078 100644 --- a/app/pages/tutorial.wrn +++ b/app/pages/tutorial.wrn @@ -14,7 +14,8 @@ page Tutorial {
Get startedQuick startTutorialAuth dashboard demoProject structureConfiguration
BuildPages and componentsRoutingServer dataForms and validationDatabase
Auth and securityAuthenticationAuthorizationApplication securitySecurity policy
-
ReferencePackagesCLI.wrn languageComponentsExamples
+
ReferencePackages overviewCLI.wrn languageComponentsExamples
+
Packages@wrnexus/ai@wrnexus/auth@wrnexus/authz@wrnexus/benchmark@wrnexus/cache@wrnexus/captcha@wrnexus/cli@wrnexus/compiler@wrnexus/content@wrnexus/core@wrnexus/csr@wrnexus/db@wrnexus/dev-server@wrnexus/dev-toolbar@wrnexus/encryption@wrnexus/graphql@wrnexus/helpers@wrnexus/i18n@wrnexus/identity@wrnexus/image@wrnexus/jwt@wrnexus/language-server@wrnexus/mcp@wrnexus/mobile@wrnexus/native@wrnexus/oauth@wrnexus/observability@wrnexus/playground@wrnexus/plugin@wrnexus/pubsub@wrnexus/pwa@wrnexus/queue@wrnexus/reactive@wrnexus/realtime@wrnexus/router@wrnexus/rpc@wrnexus/security@wrnexus/ssr@wrnexus/store@wrnexus/styles@wrnexus/syntax@wrnexus/test@wrnexus/tracking@wrnexus/typecheck@wrnexus/ui@wrnexus/uploader@wrnexus/validation
Preview · runnable-project extraction pending

Secure task board

This tutorial connects the installed 0.8.7 APIs into one design. Snippets are limited to declarations and README patterns verified in the installed packages; a CI-compiled standalone fixture remains on the roadmap.

Application shape

A .wrn page renders tasks from an SSR API binding. A shared validation schema protects mutations. Session middleware identifies users, authorization policies gate updates, and a realtime room broadcasts changes.

Schema and create route

import { v, parseBody } from "@wrnexus/validation";
 const task = v.object({ title: v.string().trim().min(3).max(120) });
diff --git a/app/styles/global.css b/app/styles/global.css
index f503a6c6..69a5bb92 100644
--- a/app/styles/global.css
+++ b/app/styles/global.css
@@ -203,6 +203,45 @@
   }
 }
 
+/* Documentation v4: use the available viewport while preserving navigation. */
+.portal-main.docs-layout--navigation {
+  width: calc(100% - clamp(1.5rem, 4vw, 5rem));
+  max-width: none;
+  grid-template-columns: minmax(13rem, 16rem) minmax(0, 1fr) minmax(12rem, 15rem);
+  gap: clamp(1.5rem, 3vw, 3.5rem);
+}
+.docs-reading-column,
+.docs-reading-column .documentation.prose,
+.docs-reading-column .documentation.standalone,
+.docs-reading-column .package-document,
+.package-index-document {
+  width: 100%;
+  max-width: none;
+}
+.docs-section-menu .package-menu {
+  padding-top: 0.25rem;
+  border-top: 1px solid var(--border);
+}
+.docs-section-menu .package-menu a {
+  overflow-wrap: anywhere;
+  font-family: ui-monospace, SFMono-Regular, Consolas, monospace;
+  font-size: 0.75rem;
+}
+.package-index-document .package-grid {
+  grid-template-columns: repeat(auto-fit, minmax(17rem, 1fr));
+}
+@media (max-width: 1080px) {
+  .portal-main.docs-layout--navigation {
+    grid-template-columns: minmax(12rem, 15rem) minmax(0, 1fr);
+  }
+}
+@media (max-width: 640px) {
+  .portal-main.docs-layout--navigation {
+    width: calc(100% - 1.25rem);
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
+
 /* Documentation v3: editorial hierarchy, not a dashboard of cards. */
 .documentation.prose,
 .package-document,
@@ -371,6 +410,36 @@
   }
 }
 
+/* Final documentation width contract; keep after legacy theme layers. */
+body .portal-main.docs-layout--navigation {
+  width: calc(100% - clamp(1.5rem, 4vw, 5rem));
+  max-width: none;
+  grid-template-columns: minmax(13rem, 16rem) minmax(0, 1fr) minmax(12rem, 15rem);
+  gap: clamp(1.5rem, 3vw, 3.5rem);
+}
+body .docs-reading-column,
+body .docs-reading-column .documentation.prose,
+body .docs-reading-column .documentation.standalone,
+body .docs-reading-column .package-document,
+body .package-index-document {
+  width: 100%;
+  max-width: none;
+}
+body .package-index-document .package-grid {
+  grid-template-columns: repeat(auto-fit, minmax(17rem, 1fr));
+}
+@media (max-width: 1080px) {
+  body .portal-main.docs-layout--navigation {
+    grid-template-columns: minmax(12rem, 15rem) minmax(0, 1fr);
+  }
+}
+@media (max-width: 640px) {
+  body .portal-main.docs-layout--navigation {
+    width: calc(100% - 1.25rem);
+    grid-template-columns: minmax(0, 1fr);
+  }
+}
+
 /* Documentation v4: remove every legacy card-shaped documentation shell. */
 body .topbar nav {
   gap: 1.75rem;
diff --git a/public/llms-full.txt b/public/llms-full.txt
index 7e047fc4..7a6c8c99 100644
--- a/public/llms-full.txt
+++ b/public/llms-full.txt
@@ -1113,6 +1113,217 @@ bunx wrnexus update . --latest
 
 The dry run previews dependency and migration changes. A real update prints the source and target versions, backup directory, each migration action, installation result, and verification result. Commit or back up the application before upgrading.
 
+# Complete CLI command reference
+
+This section is generated from the installed `@wrnexus/cli@0.8.7` executable. It is the canonical command inventory for this release.
+
+```text
+wrnexus — WrNexus CLI
+
+Usage:
+  wrnexus dev [app-dir] [--port=3000] [--host=::]
+                                             Start the development server (live reload)
+  wrnexus dev [app-dir] --services        Start local production-service simulators with the app
+  wrnexus dev [app-dir] --production-runtime
+  wrnexus dev [app-dir] --services [--services-port=3099] [--services-http]
+                                             Rebuild and reload the exact production artifact
+  wrnexus build [app-dir]               Build a production server bundle + assets
+  wrnexus preview [app-dir]             Serve the existing exact production output
+  wrnexus create              Scaffold a new app
+  wrnexus workspace               Scaffold a monorepo (apps/* + shared packages/*)
+  wrnexus workspace add  [--domain=name.localhost]
+                                             Add an app to the current workspace
+  wrnexus gateway [--port=3000]         Serve every workspace app behind one port, routed by domain
+  wrnexus production [workspace-dir]    Build, migrate, and serve the complete production workspace
+  wrnexus  [workspace-dir] Run a configured workspace environment (development/staging/custom)
+  wrnexus generate          Scaffold a page | component | api | schema
+  wrnexus generate routes | docker | mobile
+                                             Generate routes or scaffold deployment targets
+  wrnexus generate types [app-dir]       Generate application-wide route/component/key types
+  wrnexus routes [app-dir]               Generate typed named routes
+  wrnexus typecheck [app-dir]            Generate types and check TypeScript plus every .wrn file
+  wrnexus mobile add        Install Capacitor or Expo native packages
+  wrnexus mobile compile                Compile .wrn pages into native Expo routes
+  wrnexus native list                   List cross-platform native capabilities
+  wrnexus native add     Install capability packages for the configured mobile mode
+  wrnexus eject                Copy a Wire UI component into app/components
+  wrnexus update [dir] [--latest]       Upgrade deps, migrate project files, and verify the app
+  wrnexus db                       Migrations: migrate | rollback | status | seed | generate | new
+  wrnexus authz                     Authorization: list | generate | init [--dialect=sqlite|postgres|mysql]
+  wrnexus test [level] [app-dir] [--watch]
+                                             Run unit | component | api | browser | visual | accessibility | performance
+  wrnexus profiles [app-dir]            List config profiles (dev/prod/uat/…) and their env files
+  wrnexus doctor [app-dir] [--fix]      Check project health; optionally apply safe repairs
+  wrnexus compatibility  [app-dir]
+                                             Inspect or explicitly upgrade behavior defaults
+  wrnexus contracts  [app-dir]
+                                             Detect breaking boundary contract changes
+  wrnexus security  [app-dir]
+                                             Audit ASVS controls, inspect headers, or run abuse tests
+  wrnexus api  [app-dir] Generate OpenAPI, docs, Postman, examples and SDKs
+  wrnexus sdk generate  [app-dir]
+                                             Generate TypeScript, JavaScript, Java, Go, or Python SDK
+  wrnexus deploy  [app-dir]       Generate docker | kubernetes | systemd | railway | render | fly
+  wrnexus mcp [app-dir]                   Start the WRNexus MCP server over stdio
+  wrnexus i18n  [app-dir]
+                                             Extract and audit translation keys
+  wrnexus report [app-dir] [--file=app/pages/page.wrn]
+                                             Create a sanitized reproduction bundle
+  wrnexus playground [--port=4173]         Start the shareable WRN compiler playground
+  wrnexus config [app-dir] --explain    Print the fully resolved profile configuration
+  wrnexus analyze [app-dir]             Inspect dist/build-report.json and performance budgets
+  wrnexus explain  [subject] [app-dir]
+                                             Explain compiler and production build decisions
+  wrnexus explain   [app-dir]
+                                             Explain route caching or permission enforcement
+  wrnexus inspect  [app-dir]    Inspect packages | plugins | routes | assets | runtimes | styles | migrations | bundle
+  wrnexus inspect component  [app-dir]
+                                             Inspect a component's typed public contract
+  wrnexus generate system         Scaffold a complete framework-native package
+
+Profiles: pass --profile= to dev/build/db (or set WRNEXUS_PROFILE) to load
+that profile's .env cascade and config overrides. e.g. wrnexus dev --profile=uat
+
+Workspace environments: configure protocol, rootDomain, port, hostname, runtime
+(development|production), hmr, build, migrate, and profile in wrnexus.workspace.ts.
+CLI overrides: --port, --host, --build/--no-build, --migrate/--no-migrate,
+--profile, and --prepare-only.
+
+Update options: --dry-run previews changes; --no-verify skips post-update check/build.
+```
+
+## CLI workflows with expected output
+
+Commands below are copy-ready. Paths, ports, counts, and timings vary by project; the shown output identifies the success condition to check.
+
+### Create, check, build, and preview an application
+
+```bash
+bunx @wrnexus/cli@0.8.7 create my-app
+cd my-app
+bun install
+bunx wrnexus typecheck .
+bunx wrnexus build .
+bunx wrnexus preview . --port=3000
+```
+
+Expected output:
+
+```text
+✓ Application types are valid
+✓ Runtime: .../dist/reactive.js
+✓ Styles:  .../dist/styles.css
+✓ Server:  .../dist/server.js
+Run it:  bun .../dist/server.js
+```
+
+### Generate framework files and committed application types
+
+```bash
+bunx wrnexus generate page Dashboard
+bunx wrnexus generate component status-card
+bunx wrnexus generate api health
+bunx wrnexus generate schema account
+bunx wrnexus generate routes
+bunx wrnexus generate types .
+```
+
+Expected output includes created source paths followed by:
+
+```text
+✓ Generated app/routes.gen.ts (... routes)
+✓ Generated .../app/types/wrnexus.generated.d.ts (... routes, ... components)
+```
+
+### Run development and production-runtime modes
+
+```bash
+bunx wrnexus dev . --port=3000
+bunx wrnexus dev . --services --services-port=3099
+bunx wrnexus dev . --production-runtime --port=3000
+```
+
+Expected output reports the active profile, discovered plugins/routes, generated cache path, and listening URL. Production-runtime mode rebuilds and reloads the exact production artifact.
+
+### Database lifecycle
+
+```bash
+bunx wrnexus db status
+bunx wrnexus db new create_accounts --from-models
+bunx wrnexus db migrate
+bunx wrnexus db generate
+bunx wrnexus db seed
+```
+
+Expected output identifies the selected profile/dialect, migration state, applied migration names, and generated typed query files. Run `db rollback` only when intentionally reverting the latest migration.
+
+### Diagnose, inspect, and enforce contracts
+
+```bash
+bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus compatibility check .
+bunx wrnexus contracts check .
+bunx wrnexus security audit .
+bunx wrnexus inspect packages .
+bunx wrnexus inspect routes .
+bunx wrnexus inspect component Navbar .
+bunx wrnexus analyze .
+```
+
+Successful checks exit with status 0. Inspect commands print the resolved package, route, component, asset, runtime, style, migration, or bundle contract without changing the application.
+
+### Tests, API artifacts, SDKs, and deployment manifests
+
+```bash
+bunx wrnexus test unit .
+bunx wrnexus test component .
+bunx wrnexus test api .
+bunx wrnexus test browser .
+bunx wrnexus api generate .
+bunx wrnexus api docs .
+bunx wrnexus sdk generate typescript .
+bunx wrnexus deploy docker .
+```
+
+Test commands return the underlying suite summary and a nonzero status on failure. API/SDK/deploy commands report each generated artifact; review and commit generated files after validation.
+
+### Workspaces and environments
+
+```bash
+bunx wrnexus workspace company-platform
+cd company-platform
+bunx wrnexus workspace add reports --domain=reports.localhost
+bunx wrnexus gateway --port=3000
+bunx wrnexus production . --prepare-only
+bunx wrnexus staging .
+```
+
+Expected output lists created apps, domain mappings, selected environment/profile, build and migration decisions, and the gateway address.
+
+### Internationalization, native targets, MCP, and support bundles
+
+```bash
+bunx wrnexus i18n extract .
+bunx wrnexus i18n validate .
+bunx wrnexus generate mobile
+bunx wrnexus mobile compile
+bunx wrnexus native list
+bunx wrnexus mcp .
+bunx wrnexus report . --file=app/pages/index.wrn
+```
+
+Expected output identifies extracted/validated translation keys, generated native routes, available capabilities, MCP stdio startup, or the sanitized reproduction archive. MCP uses stdio, so protocol messages—not a web URL—are its normal runtime output.
+
+### Safe upgrades
+
+```bash
+bunx wrnexus update . --latest --dry-run
+bunx wrnexus update . --latest
+```
+
+The dry run previews dependency and migration changes. A real update prints the source and target versions, backup directory, each migration action, installation result, and verification result. Commit or back up the application before upgrading.
+
 Release: WRNexusJS 0.8.7
 
 # Complete CLI command reference
diff --git a/public/llms.txt b/public/llms.txt
index 57bde53f..94fe4f70 100644
--- a/public/llms.txt
+++ b/public/llms.txt
@@ -1324,6 +1324,217 @@ bunx wrnexus update . --latest
 
 The dry run previews dependency and migration changes. A real update prints the source and target versions, backup directory, each migration action, installation result, and verification result. Commit or back up the application before upgrading.
 
+# Complete CLI command reference
+
+This section is generated from the installed `@wrnexus/cli@0.8.7` executable. It is the canonical command inventory for this release.
+
+```text
+wrnexus — WrNexus CLI
+
+Usage:
+  wrnexus dev [app-dir] [--port=3000] [--host=::]
+                                             Start the development server (live reload)
+  wrnexus dev [app-dir] --services        Start local production-service simulators with the app
+  wrnexus dev [app-dir] --production-runtime
+  wrnexus dev [app-dir] --services [--services-port=3099] [--services-http]
+                                             Rebuild and reload the exact production artifact
+  wrnexus build [app-dir]               Build a production server bundle + assets
+  wrnexus preview [app-dir]             Serve the existing exact production output
+  wrnexus create              Scaffold a new app
+  wrnexus workspace               Scaffold a monorepo (apps/* + shared packages/*)
+  wrnexus workspace add  [--domain=name.localhost]
+                                             Add an app to the current workspace
+  wrnexus gateway [--port=3000]         Serve every workspace app behind one port, routed by domain
+  wrnexus production [workspace-dir]    Build, migrate, and serve the complete production workspace
+  wrnexus  [workspace-dir] Run a configured workspace environment (development/staging/custom)
+  wrnexus generate          Scaffold a page | component | api | schema
+  wrnexus generate routes | docker | mobile
+                                             Generate routes or scaffold deployment targets
+  wrnexus generate types [app-dir]       Generate application-wide route/component/key types
+  wrnexus routes [app-dir]               Generate typed named routes
+  wrnexus typecheck [app-dir]            Generate types and check TypeScript plus every .wrn file
+  wrnexus mobile add        Install Capacitor or Expo native packages
+  wrnexus mobile compile                Compile .wrn pages into native Expo routes
+  wrnexus native list                   List cross-platform native capabilities
+  wrnexus native add     Install capability packages for the configured mobile mode
+  wrnexus eject                Copy a Wire UI component into app/components
+  wrnexus update [dir] [--latest]       Upgrade deps, migrate project files, and verify the app
+  wrnexus db                       Migrations: migrate | rollback | status | seed | generate | new
+  wrnexus authz                     Authorization: list | generate | init [--dialect=sqlite|postgres|mysql]
+  wrnexus test [level] [app-dir] [--watch]
+                                             Run unit | component | api | browser | visual | accessibility | performance
+  wrnexus profiles [app-dir]            List config profiles (dev/prod/uat/…) and their env files
+  wrnexus doctor [app-dir] [--fix]      Check project health; optionally apply safe repairs
+  wrnexus compatibility  [app-dir]
+                                             Inspect or explicitly upgrade behavior defaults
+  wrnexus contracts  [app-dir]
+                                             Detect breaking boundary contract changes
+  wrnexus security  [app-dir]
+                                             Audit ASVS controls, inspect headers, or run abuse tests
+  wrnexus api  [app-dir] Generate OpenAPI, docs, Postman, examples and SDKs
+  wrnexus sdk generate  [app-dir]
+                                             Generate TypeScript, JavaScript, Java, Go, or Python SDK
+  wrnexus deploy  [app-dir]       Generate docker | kubernetes | systemd | railway | render | fly
+  wrnexus mcp [app-dir]                   Start the WRNexus MCP server over stdio
+  wrnexus i18n  [app-dir]
+                                             Extract and audit translation keys
+  wrnexus report [app-dir] [--file=app/pages/page.wrn]
+                                             Create a sanitized reproduction bundle
+  wrnexus playground [--port=4173]         Start the shareable WRN compiler playground
+  wrnexus config [app-dir] --explain    Print the fully resolved profile configuration
+  wrnexus analyze [app-dir]             Inspect dist/build-report.json and performance budgets
+  wrnexus explain  [subject] [app-dir]
+                                             Explain compiler and production build decisions
+  wrnexus explain   [app-dir]
+                                             Explain route caching or permission enforcement
+  wrnexus inspect  [app-dir]    Inspect packages | plugins | routes | assets | runtimes | styles | migrations | bundle
+  wrnexus inspect component  [app-dir]
+                                             Inspect a component's typed public contract
+  wrnexus generate system         Scaffold a complete framework-native package
+
+Profiles: pass --profile= to dev/build/db (or set WRNEXUS_PROFILE) to load
+that profile's .env cascade and config overrides. e.g. wrnexus dev --profile=uat
+
+Workspace environments: configure protocol, rootDomain, port, hostname, runtime
+(development|production), hmr, build, migrate, and profile in wrnexus.workspace.ts.
+CLI overrides: --port, --host, --build/--no-build, --migrate/--no-migrate,
+--profile, and --prepare-only.
+
+Update options: --dry-run previews changes; --no-verify skips post-update check/build.
+```
+
+## CLI workflows with expected output
+
+Commands below are copy-ready. Paths, ports, counts, and timings vary by project; the shown output identifies the success condition to check.
+
+### Create, check, build, and preview an application
+
+```bash
+bunx @wrnexus/cli@0.8.7 create my-app
+cd my-app
+bun install
+bunx wrnexus typecheck .
+bunx wrnexus build .
+bunx wrnexus preview . --port=3000
+```
+
+Expected output:
+
+```text
+✓ Application types are valid
+✓ Runtime: .../dist/reactive.js
+✓ Styles:  .../dist/styles.css
+✓ Server:  .../dist/server.js
+Run it:  bun .../dist/server.js
+```
+
+### Generate framework files and committed application types
+
+```bash
+bunx wrnexus generate page Dashboard
+bunx wrnexus generate component status-card
+bunx wrnexus generate api health
+bunx wrnexus generate schema account
+bunx wrnexus generate routes
+bunx wrnexus generate types .
+```
+
+Expected output includes created source paths followed by:
+
+```text
+✓ Generated app/routes.gen.ts (... routes)
+✓ Generated .../app/types/wrnexus.generated.d.ts (... routes, ... components)
+```
+
+### Run development and production-runtime modes
+
+```bash
+bunx wrnexus dev . --port=3000
+bunx wrnexus dev . --services --services-port=3099
+bunx wrnexus dev . --production-runtime --port=3000
+```
+
+Expected output reports the active profile, discovered plugins/routes, generated cache path, and listening URL. Production-runtime mode rebuilds and reloads the exact production artifact.
+
+### Database lifecycle
+
+```bash
+bunx wrnexus db status
+bunx wrnexus db new create_accounts --from-models
+bunx wrnexus db migrate
+bunx wrnexus db generate
+bunx wrnexus db seed
+```
+
+Expected output identifies the selected profile/dialect, migration state, applied migration names, and generated typed query files. Run `db rollback` only when intentionally reverting the latest migration.
+
+### Diagnose, inspect, and enforce contracts
+
+```bash
+bunx wrnexus doctor .
+bunx wrnexus typecheck .
+bunx wrnexus compatibility check .
+bunx wrnexus contracts check .
+bunx wrnexus security audit .
+bunx wrnexus inspect packages .
+bunx wrnexus inspect routes .
+bunx wrnexus inspect component Navbar .
+bunx wrnexus analyze .
+```
+
+Successful checks exit with status 0. Inspect commands print the resolved package, route, component, asset, runtime, style, migration, or bundle contract without changing the application.
+
+### Tests, API artifacts, SDKs, and deployment manifests
+
+```bash
+bunx wrnexus test unit .
+bunx wrnexus test component .
+bunx wrnexus test api .
+bunx wrnexus test browser .
+bunx wrnexus api generate .
+bunx wrnexus api docs .
+bunx wrnexus sdk generate typescript .
+bunx wrnexus deploy docker .
+```
+
+Test commands return the underlying suite summary and a nonzero status on failure. API/SDK/deploy commands report each generated artifact; review and commit generated files after validation.
+
+### Workspaces and environments
+
+```bash
+bunx wrnexus workspace company-platform
+cd company-platform
+bunx wrnexus workspace add reports --domain=reports.localhost
+bunx wrnexus gateway --port=3000
+bunx wrnexus production . --prepare-only
+bunx wrnexus staging .
+```
+
+Expected output lists created apps, domain mappings, selected environment/profile, build and migration decisions, and the gateway address.
+
+### Internationalization, native targets, MCP, and support bundles
+
+```bash
+bunx wrnexus i18n extract .
+bunx wrnexus i18n validate .
+bunx wrnexus generate mobile
+bunx wrnexus mobile compile
+bunx wrnexus native list
+bunx wrnexus mcp .
+bunx wrnexus report . --file=app/pages/index.wrn
+```
+
+Expected output identifies extracted/validated translation keys, generated native routes, available capabilities, MCP stdio startup, or the sanitized reproduction archive. MCP uses stdio, so protocol messages—not a web URL—are its normal runtime output.
+
+### Safe upgrades
+
+```bash
+bunx wrnexus update . --latest --dry-run
+bunx wrnexus update . --latest
+```
+
+The dry run previews dependency and migration changes. A real update prints the source and target versions, backup directory, each migration action, installation result, and verification result. Commit or back up the application before upgrading.
+
 # Canonical documentation locations
 
 - Framework and package documentation: https://wrnexusjs.dev/
diff --git a/scripts/generate-docs.ts b/scripts/generate-docs.ts
index d23a0ae4..df8e23b4 100644
--- a/scripts/generate-docs.ts
+++ b/scripts/generate-docs.ts
@@ -352,6 +352,17 @@ const registry = createDevToolbarRegistry();`,
     .join("");
 }
 
+const packageNavigation = catalog
+  .map(([name]) => `@wrnexus/${name}`)
+  .join("");
+const sectionNavigation = ``;
+
 function shell(title: string, description: string, content: string, state = ""): string {
   const document = `page ${title.replace(/[^A-Za-z0-9]/g, "")} {
   seo {
@@ -405,7 +416,7 @@ writeFileSync(
   shell(
     "Packages",
     "Explore every WrNexus package, API, function, and copy-ready usage example.",
-    `
${catalog.length} focused packages
Package reference
Everything in the framework, organized by responsibility and documented from the published ${frameworkVersion} APIs.
${categoryButtons}
Showing {category} packages
${cards}
`,
+    `
${sectionNavigation}
${catalog.length} focused packages
Package reference
Everything in the framework, organized by responsibility and documented from the published ${frameworkVersion} APIs.
Find a package
${categoryButtons}
Showing {category} packages
All packages
${cards}
`,
     '  state query = ""\n  state category = "All"\n',
   ),
 );
@@ -440,8 +451,8 @@ for (const [name, category, summary] of catalog) {
         `${escape(heading.title)}`,
     )
     .join("");
-  const content = `

-      
${category} · Package reference
@wrnexus/${name}
${summary}
v${frameworkVersion}Private registry${category}
Install the package
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/${name}@${frameworkVersion}
Request preview access. Never put registry tokens in source control.
${guide.html}
Complete TypeScript API
Generated from the exact installed package declarations.
${escape(types)}
Examples
Copy-ready examples from the installed package documentation.
${examplesFrom(readme, name)}
${componentReference}

+  const content = `
${sectionNavigation}

+      
${category} · Package reference
@wrnexus/${name}
${summary}
v${frameworkVersion}Private registry${category}
Install the package
After WorkRoot approves private registry access, install the release-aligned package:
bun add @wrnexus/${name}@${frameworkVersion}
Request preview access. Never put registry tokens in source control.
${guide.html}
Complete TypeScript API
Generated from the exact installed package declarations.
${escape(types)}
Examples
Copy-ready examples from the installed package documentation.
${examplesFrom(readme, name)}
${componentReference}

       
     
`;
   writeFileSync(join(packagePages, `${name}.wrn`), shell(`@wrnexus/${name}`, summary, content));
diff --git a/scripts/generate-portal.ts b/scripts/generate-portal.ts
index 1b30181c..9dc99639 100644
--- a/scripts/generate-portal.ts
+++ b/scripts/generate-portal.ts
@@ -210,12 +210,16 @@ const documentationNavigation = [
   ["/search", "Search"],
 ] as const;
 
+const packageNavigation = packageNames
+  .map((name) => `@wrnexus/${name}`)
+  .join("");
 const sectionNavigation = ``;
 
@@ -668,12 +672,222 @@ bunx wrnexus preview . --port=3000`)}
Tests should prove anonymous dashboard a
     
9. Demo checklist
  • Public home, pricing, privacy, and terms pages render without authentication.
  • Login creates and rotates a secure session.
  • Dashboard navigation changes by permission, while APIs enforce every permission independently.
  • Member lists and mutations are tenant-scoped on the server.
  • Development and production profiles resolve explicitly.
  • Typecheck, API tests, browser tests, security audit, contract check, build, and preview all pass.
`,
   ],
 };
+const guideExamples: Record = {
+  "project-structure": [
+    "Generate files through the CLI so routes and application types stay synchronized.",
+    `bunx wrnexus generate page account/settings
+bunx wrnexus generate component account-card
+bunx wrnexus generate api account/profile
+bunx wrnexus generate routes
+bunx wrnexus generate types .`,
+  ],
+  routing: [
+    "This creates a dynamic, server-rendered account route and verifies that the router discovered it.",
+    `// app/pages/accounts/[id].wrn
+page Account { view { 
Account {params.id}
 } }
+
+bunx wrnexus inspect routes .`,
+  ],
+  "pages-and-components": [
+    "Declare the reusable contract in a component, then pass data from the owning page.",
+    `component StatusCard {
+  prop title = "Status"
+  prop value = "Unknown"
+  view { 
{title}
{value}
 }
+}
+
+page Dashboard { view {  } }`,
+  ],
+  "server-data": [
+    "Fetch on the server and render useful HTML before browser JavaScript loads.",
+    `page Accounts {
+  ssr { api result GET /api/accounts { return result.accounts } }
+  view { 
    {#each result as account}
  • {account.name}
    • {:empty}
  • No accounts
    • {/each}
 }
+}`,
+  ],
+  "api-routes": [
+    "Validate a mutation and return an explicit HTTP result.",
+    `import { v, parseBody } from "@wrnexus/validation";
+const input = v.object({ name: v.string().trim().min(2).max(80) });
+export const POST = async (ctx) => {
+  const parsed = await parseBody(input, ctx.req);
+  return parsed.ok ? Response.json(parsed.value, { status: 201 }) : parsed.response;
+};`,
+  ],
+  middleware: [
+    "Add a request identifier and reject unsupported methods before application handlers run.",
+    `export default async function requestContext(ctx, next) {
+  ctx.state.requestId = crypto.randomUUID();
+  if (!["GET", "HEAD", "POST"].includes(ctx.req.method))
+    return new Response("Method not allowed", { status: 405 });
+  return next();
+}`,
+  ],
+  "forms-and-validation": [
+    "Use the same named schema in the browser form and authoritative API handler.",
+    `page Signup { view {
+  

+    
+    
+  

+} }`,
+  ],
+  authentication: [
+    "Require an authenticated session in middleware and redirect browser requests to login.",
+    `export default async function requireSession(ctx, next) {
+  const user = await readAuthenticatedUser(ctx);
+  if (!user) return Response.redirect(new URL("/login", ctx.url), 303);
+  ctx.state.user = user;
+  return next();
+}`,
+  ],
+  authorization: [
+    "Check the exact permission at the mutation boundary; hiding UI is only a convenience.",
+    `export const DELETE = async (ctx) => {
+  await requirePermission(ctx, "member:delete");
+  await deleteMember(ctx.params.id, ctx.state.user.tenantId);
+  return new Response(null, { status: 204 });
+};`,
+  ],
+  security: [
+    "Enable the main browser and request protections in application configuration, then audit the resolved production profile.",
+    `// wrnexus.config.ts
+export default {
+  security: {
+    contentSecurityPolicy: true,
+    csrf: true,
+    trustedTypes: true,
+    frameOptions: "deny",
+    referrerPolicy: "strict-origin-when-cross-origin",
+    requestLimit: { maxBytes: 1_048_576 },
+    cors: { origins: ["https://app.example.com"] },
+  },
+};
+
+bunx wrnexus config . --explain --profile=production
+bunx wrnexus security audit .`,
+  ],
+  database: [
+    "Create a migration from models, apply it, and regenerate typed database functions.",
+    `bunx wrnexus db status
+bunx wrnexus db new create_accounts --from-models
+bunx wrnexus db migrate
+bunx wrnexus db generate`,
+  ],
+  uploads: [
+    "Keep size and type policy server-owned and serve private objects through an authorized route.",
+    `export default {
+  uploads: { stores: { avatars: {
+    driver: "local", directory: "./data/avatars",
+    maxBytes: 2_000_000, accept: ["image/png", "image/jpeg"],
+  } } },
+};`,
+  ],
+  realtime: [
+    "Authorize room membership and validate every incoming message before broadcasting.",
+    `export default defineRoom("team", {
+  async connect(client, ctx) { await requireTeamMember(ctx, ctx.params.teamId); },
+  async message(client, raw) {
+    const message = chatMessage.parse(JSON.parse(raw));
+    client.room.broadcast(JSON.stringify(message));
+  },
+});`,
+  ],
+  pubsub: [
+    "Use Redis when events must cross processes; use a namespaced channel contract.",
+    `const bus = createRedisPubSub({ url: env.REDIS_URL });
+await bus.subscribe("team:42:events", (event) => handleTeamEvent(event));
+await bus.publish("team:42:events", JSON.stringify({ type: "member.invited" }));`,
+  ],
+  queues: [
+    "Make jobs idempotent and bound retry behavior before processing external effects.",
+    `const emails = queue("emails", { concurrency: 4, retries: 3 });
+emails.process(async (job) => sendInviteOnce(job.data.invitationId));
+await emails.add({ invitationId }, { delay: 1_000 });`,
+  ],
+  testing: [
+    "Cover successful output and the denial path, then run the built server smoke check.",
+    `import { describe, expect, test } from "bun:test";
+describe("members API", () => {
+  test("denies anonymous requests", async () => {
+    const response = await request("/api/members");
+    expect(response.status).toBe(401);
+  });
+});`,
+  ],
+  "workspaces-and-gateway": [
+    "Register applications explicitly and verify host routing through the gateway port.",
+    `bunx wrnexus workspace company-platform
+cd company-platform
+bunx wrnexus workspace add admin --domain=admin.localhost
+bunx wrnexus gateway --port=3000`,
+  ],
+  deployment: [
+    "Build once, apply migrations before traffic, and run the immutable Bun server artifact.",
+    `bun install --frozen-lockfile
+bunx wrnexus typecheck .
+bunx wrnexus db migrate
+bunx wrnexus build .
+bun dist/server.js`,
+  ],
+  "configuration-and-profiles": [
+    "Keep shared defaults at the root and make production differences explicit.",
+    `export default {
+  server: { port: 3000 },
+  profiles: {
+    development: { envFiles: [".env", ".env.development"] },
+    production: { envFiles: [".env", ".env.production"] },
+  },
+};
+
+bunx wrnexus config . --explain --profile=production`,
+  ],
+  "i18n-and-themes": [
+    "Configure one default locale and theme, then reference translation keys in server-rendered markup.",
+    `export default {
+  i18n: { defaultLocale: "en", locales: ["en", "fr"] },
+  theme: { default: "system", palette: "violet" },
+};
+
+page Home { view { 
{t:home.title}
 } }`,
+  ],
+  mobile: [
+    "Generate the mobile surface, compile it, and inspect supported native capabilities before relying on one.",
+    `bunx wrnexus generate mobile
+bunx wrnexus mobile compile
+bunx wrnexus native list`,
+  ],
+  observability: [
+    "Redact credentials at the sink boundary and attach a stable request identifier.",
+    `const tracking = createTracking({
+  redact: ["authorization", "cookie", "password", "token"],
+  sampleRate: 0.1,
+});
+export default tracking.middleware();`,
+  ],
+  upgrading: [
+    "Preview migrations first, review the report, then update the aligned package set.",
+    `git status --short
+bunx wrnexus update . --latest --dry-run
+bunx wrnexus update . --latest
+bunx wrnexus typecheck .
+bunx wrnexus build .`,
+  ],
+  troubleshooting: [
+    "Collect deterministic diagnostics without exposing application secrets.",
+    `bun --version
+bunx wrnexus doctor .
+bunx wrnexus config . --explain
+bunx wrnexus inspect routes .
+bunx wrnexus report . --file=app/pages/index.wrn`,
+  ],
+};
 for (const [slug, [title, desc, text]] of Object.entries(guides))
   page(
     `/guides/${slug}`,
     title,
     desc,
-    `
Preview guide · ${version}
${title}
${text.startsWith("<") ? text : `
${text}
`}
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
${code(`bunx wrnexus doctor .
+    `
Preview guide · ${version}
${title}
${text.startsWith("<") ? text : `
${text}
`}${guideExamples[slug] ? `
Practical example
${guideExamples[slug][0]}
${code(guideExamples[slug][1])}
What to verify
Run this against the selected profile, inspect the generated or returned result, and add a test for both the successful path and its most important failure path.
` : ""}
Configuration
Keep configuration in wrnexus.config.ts, select an explicit profile, and store secrets only in validated environment variables. Use wrnexus config . --explain to review the resolved non-secret configuration.
Implementation workflow
${code(`bunx wrnexus doctor .
 bunx wrnexus typecheck .
 bunx wrnexus inspect routes .
 bunx wrnexus build .`)}
Start from the exact installed package page, implement the smallest server-owned contract, and add browser behavior only where interaction requires it. Run the production build because development-only success does not prove deployability.
Verification checklist
  • Inputs are validated at the authoritative server boundary.
  • Authentication and resource authorization are tested independently.
  • Generated routes and application types are current.
  • Error, empty, loading, denied, and success states are documented.
  • The production artifact starts and serves the expected route.
Release scope
This guide describes installed ${version} capabilities. Follow linked package declarations for exact signatures; undocumented behavior is not guaranteed.
Browse package APIs · CLI reference · Troubleshooting · Support
`,
@@ -740,7 +954,21 @@ page(
   "/security",
   "Security",
   "WRNexusJS security defaults, limits, supported release status, and reporting process.",
-  `
Security
WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.
Supported releases
Only the current private-preview release ${version} is documented here. A formal old-release support window is not yet published.
Report a vulnerability
Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.
Deployment controls
Use restrictive CSP and permissions policies, HSTS only on HTTPS production origins, MIME sniffing protection, restrictive referrers, explicit CORS, secure cookies, CSRF validation, request limits, and origin checks. See application security.
`,
+  `
Security
WRNexusJS provides primitives for CSP, CSRF, Trusted Types, sessions, validation, authorization, encryption, upload restrictions, request limits, and WebSocket-origin checks. Applications remain responsible for correct configuration, business authorization, secrets, dependencies, data protection, and operations.
Start with a production policy
The following baseline blocks framing, restricts referrers and cross-origin access, enables CSRF and Trusted Types, and caps request bodies. Replace the example origin with the exact browser origin that calls your application.
${code(`// wrnexus.config.ts
+export default {
+  security: {
+    contentSecurityPolicy: true,
+    csrf: true,
+    trustedTypes: true,
+    frameOptions: "deny",
+    referrerPolicy: "strict-origin-when-cross-origin",
+    cors: { origins: ["https://app.example.com"], credentials: true },
+    requestLimit: { maxBytes: 1_048_576 },
+  },
+};`)}
What you can change
  • Add only required API origins to CORS; never use a wildcard with credentialed requests.
  • Lower request limits for JSON APIs and define separate upload limits for accepted file types.
  • Extend CSP only for origins your application actually loads; avoid unsafe inline script exceptions.
  • Enable HSTS only after HTTPS works on every production hostname and subdomain you include.
  • Set session expiry, rotation, secure, HTTP-only, and SameSite behavior for your authentication flow.
Verify the resolved controls
${code(`bunx wrnexus config . --explain --profile=production
+bunx wrnexus security audit .
+bunx wrnexus typecheck .
+bunx wrnexus build .`)}
Review the resolved production configuration, then test a valid request, an invalid CSRF token, an oversized body, an unapproved origin, an anonymous protected request, and a permission-denied request. Security configuration is complete only when denial behavior is tested.
Supported releases
Only the current private-preview release ${version} is documented here. A formal old-release support window is not yet published.
Report a vulnerability
Use WorkRoot’s approved private contact path at workroot.in. Do not publish exploit details or secrets. Include affected version, impact, reproduction, and a safe contact method. Response targets, encryption key, bounty, audit, and certification are not currently claimed.
Deployment controls
Terminate TLS at a trusted edge, forward only expected proxy headers, store secrets outside source control, apply database migrations before traffic, and monitor rejected requests without logging credentials. Continue with the complete application security guide.
`,
   "Trust",
 );
 page(