@kudzujs/core 0.12.0 → 0.12.2

package/PERFORMANCE.md

@@ -6,6 +6,48 @@ Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm ru
 
 The maintained 2026-08-13 comparison used Node 24.14.0 and an Intel Core i5-9500 Linux x64 host, one warm-up, and seven alternating fresh-process samples against clean `v0.8.44`. A narrow fast path skips Kudzu semantic transformation for 450 plain `.ts` modules whose runtime edges are exclusively resolvable relative TypeScript imports or exports; all other modules retain the existing transformer. Compile median fell from 2,323.9 ms to 1,413.2 ms (39.2%) and clean-build median from 3,325.3 ms to 2,382.4 ms (28.4%); every paired sample improved. Compile peak-RSS median fell from 571.2 MiB to 552.6 MiB, while build peak RSS was 570.9 MiB versus 568.8 MiB. Compiler scratch fell from 7,328,390 to 1,971,061 bytes. Both targets emitted the same 50 static HTML files, 10,980 bytes, and deploy SHA-256 `e107d78a7f55bc8a1af0ea6e53efeffa19b3d44d21c892484d103fa346e7ba7b`. This is a source-scale compiler comparison, not a cross-framework result.
 
+## 0.12.2 Authentication And Permission Boundary
+
+Measured 2026-08-23 on macOS arm64 with Node 25.6.1 and Chrome
+151.0.7922.172. Required Chrome proves invalid and valid login, token-backed
+reload restoration, anonymous and rejected direct entry, role-aware controls,
+server-enforced API and admin authorization, token clearing, and logout.
+
+The two-route session uses 16 JavaScript files totaling 60,767 raw / 22,561
+aggregate gzip bytes, an increase of 1,793 raw / 432 gzip bytes from `0.12.1`
+for authored session state, restoration, and authorization headers. Navigation
+samples are `[1.3, 1.5, 1.5, 1.2, 1.3, 1.4, 1.4]` ms, with a 1.4 ms median and
+1.2/1.5 ms minimum/maximum. The range overlaps `0.12.1`, so no latency change
+is claimed.
+
+The application emits 43 files totaling 123,476 raw / 45,305 aggregate gzip
+bytes with deploy SHA-256
+`81d0b3c5e0d1d1f72f29d219647601463f5317f215274e14a45fe5ba92eb033e`.
+The login route uses 12,093 raw / 5,795 aggregate gzip JavaScript bytes. Core
+semantic LOC remains 5,682 with no pass, primitive, production compiler/runtime
+change, or runtime-concept change. `/help` remains 0 B JavaScript.
+
+## 0.12.1 Shared Layout, History, Focus, And Scroll
+
+Measured 2026-08-23 on macOS arm64 with Node 25.6.1 and Chrome
+151.0.7922.172. `RUNS=7 npm run benchmark:project-navigation` uses fresh Chrome
+profiles after the required browser journey proves hash and non-hash focus,
+explicit hash/top scroll, title/live announcements, back/forward, retained
+layout state, fresh route state, and native navigation outside the route group.
+
+The two-route session uses 16 JavaScript files totaling 58,974 raw / 22,129
+aggregate gzip bytes, an increase of 4 raw / 5 gzip bytes from `0.12.0` for the
+correct non-hash focus fallback. Navigation samples are
+`[1.5, 1.4, 1.3, 1.3, 1.3, 1.3, 1.4]` ms, with a 1.3 ms median and 1.3/1.5 ms
+minimum/maximum. The range overlaps `0.12.0`, so no latency change is claimed.
+
+The application emits 36 files totaling 106,096 raw / 38,201 aggregate gzip
+bytes with deploy SHA-256
+`4f1ce541af0794fcb17458ad37db7b32beb434f3a83cb7f949f13b3e4536fe1c`.
+Core semantic LOC remains 5,682 with no pass, primitive, or runtime-concept
+change. `/help` remains 0 B JavaScript. No AI-delivery cost comparison applies
+to this browser correctness patch.
+
 ## 0.12.0 Project Route Shell And Runtime Parameters
 
 Measured 2026-08-23 on macOS arm64 with Node 25.6.1 and Chrome

package/README.md

@@ -12,9 +12,9 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 *Watch: React-shaped TSX to static HTML and route-specific ESM in 22 seconds.*
 
-> Experimental `0.11.x`: the compiler API and supported TSX surface may change.
+> Experimental `0.12.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.12.0 - Project route shell and runtime parameters.** Directly addressable project and issue routes now reuse bracket file routes, pathname parameters, complete fallback HTML, generated host rewrites, and native anchors without an SPA router. Read the [release notes](./RELEASES.md#0120---project-route-shell-and-runtime-parameters), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.12.0), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.12.2 - Authentication and permission boundary.** Native login, token restoration, role-aware controls, server-enforced 401/403 responses, token clearing, and logout now compose from existing application primitives without an auth runtime. Read the [release notes](./RELEASES.md#0122---authentication-and-permission-boundary), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.12.2), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,107 @@
 # Kudzu Releases
 
+## 0.12.2 - Authentication And Permission Boundary
+
+Kudzu 0.12.2 completes the project application's login, restoration,
+permission-aware UI, server rejection, and logout journey using existing
+application primitives.
+
+### Changed in 0.12.2
+
+- Replaced the placeholder login route with a native constrained form and one
+  application-owned async submit handler.
+- Added layout-owned token restoration, session validation, authenticated user
+  state, role-aware admin controls, and explicit logout.
+- Added bearer authorization to project reads and mutations; the deterministic
+  server rejects missing tokens with 401 and member mutations with 403.
+- Proved that protected static HTML is a UX shell while server authorization is
+  the security boundary.
+- Updated `create-kudzu@0.1.115` to generate projects on
+  `@kudzujs/core@^0.12.2`.
+
+### Output Evidence
+
+- The application emits 43 files, 123,476 raw / 45,305 aggregate gzip bytes,
+  and deploy digest
+  `81d0b3c5e0d1d1f72f29d219647601463f5317f215274e14a45fe5ba92eb033e`.
+- The maintained enhanced session uses 16 JavaScript files totaling 60,767 raw
+  / 22,561 aggregate gzip bytes, 1,793 raw / 432 gzip bytes above `0.12.1`.
+- The login route uses 12,093 raw / 5,795 aggregate gzip JavaScript bytes, while
+  `/help` remains complete HTML with 0 B JavaScript.
+- No semantic primitive, compiler pass, core compiler line, runtime concept,
+  public API, auth runtime, or server was added to Kudzu.
+
+### Validation
+
+- Required Chrome proves invalid and valid login, reload restoration, direct
+  anonymous and rejected entry, member/admin UI, server 401/403 responses,
+  token clearing, and logout.
+- Seven fresh Chrome profiles record a 1.4 ms navigation median with a 1.2-1.5
+  ms range. The range overlaps `0.12.1`, so no latency change is claimed.
+- The full suite, package smoke, registry metadata, and fresh installation are
+  release gates.
+
+### Limits
+
+Client conditional rendering only controls presentation. Applications and
+deployment hosts remain responsible for authorizing protected data and actions.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.12.2
+```
+
+## 0.12.1 - Shared Layout, History, Focus, And Scroll
+
+Kudzu 0.12.1 completes the accepted same-document project route group with
+explicit history, focus, announcement, and scroll behavior.
+
+### Changed in 0.12.1
+
+- Fixed non-hash enhanced navigation so the existing heading/main focus
+  fallback runs instead of treating an empty hash as a target.
+- Proved push, back, and forward navigation with retained layout state and
+  freshly recreated route state.
+- Added route titles, a native hash anchor, and an intrinsic hash destination to
+  the maintained project application.
+- Proved polite navigation announcements, hash scrolling, top scrolling, and
+  browser-native links outside the configured route group.
+- Updated `create-kudzu@0.1.114` to generate projects on
+  `@kudzujs/core@^0.12.1`.
+
+### Output Evidence
+
+- The application emits 36 files, 106,096 raw / 38,201 aggregate gzip bytes,
+  and deploy digest
+  `4f1ce541af0794fcb17458ad37db7b32beb434f3a83cb7f949f13b3e4536fe1c`.
+- The maintained enhanced session uses 16 JavaScript files totaling 58,974 raw
+  / 22,129 aggregate gzip bytes, 4 raw / 5 gzip bytes above `0.12.0`.
+- `/help` remains complete HTML with 0 B JavaScript.
+- No semantic primitive, compiler pass, core compiler line, runtime concept,
+  public API, or browser route registry was added.
+
+### Validation
+
+- Required Chrome proves focused anchor activation, back/forward, layout
+  retention, route cleanup/reset, title/live updates, hash/heading focus, and
+  hash/top scroll behavior.
+- Seven fresh Chrome profiles record a 1.3 ms navigation median with a 1.3-1.5
+  ms range. The range overlaps `0.12.0`, so no latency change is claimed.
+- The full suite, package smoke, registry metadata, and fresh installation are
+  release gates.
+
+### Limits
+
+Enhanced navigation remains explicit and route-group scoped. Routes outside the
+group use browser-native document navigation.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.12.1
+```
+
 ## 0.12.0 - Project Route Shell And Runtime Parameters
 
 Kudzu 0.12.0 opens the routing and application-lifetime train with directly

package/docs/next-architecture/application-capability-release-plan.md

@@ -557,6 +557,31 @@ overlaps `0.11.4`, so no latency change is claimed.
 - **Done condition:** keyboard and browser-history journeys pass with native
   recovery.
 
+**Completion evidence:** the project application adds route titles, one native
+hash anchor, and one intrinsic hash destination. Required Chrome activates the
+focused anchor, retains the layout and workspace state through push, back, and
+forward navigation, releases and recreates dirty route state, updates the title
+and polite live status, focuses hash and heading destinations, applies explicit
+hash and top scroll policies, and leaves `/help` browser-native outside the
+approved route group.
+
+The journey exposed one existing JavaScript value bug: an absent hash produced
+the empty string and prevented the nullish heading/main focus fallback. The
+navigation runtime now produces `null` for that case. This packet adds zero
+semantic primitives, ModuleIR kinds, compiler passes, core compiler lines,
+runtime concepts, normalization rules, adapter rules, or public APIs. Runtime
+source remains 351 lines. One positive application fixture gains the complete
+acceptance journey; `/help` remains 0 B JavaScript.
+
+The fixture emits 36 files totaling 106,096 raw / 38,201 aggregate gzip bytes
+with deploy SHA-256
+`4f1ce541af0794fcb17458ad37db7b32beb434f3a83cb7f949f13b3e4536fe1c`.
+The two-route session uses 16 JavaScript files totaling 58,974 raw / 22,129
+aggregate gzip bytes, 4 raw / 5 gzip bytes above `0.12.0`. Seven fresh Chrome
+profiles record a 1.3 ms navigation median with a 1.3/1.5 ms range. The range
+overlaps `0.12.0`, so no latency change is claimed. This correctness packet has
+no measured AI-delivery cost effect.
+
 ### `0.12.2`: Authentication And Permission Boundary
 
 - **Purpose:** complete login, restore, 401, logout, and permission-aware UI.
@@ -569,6 +594,29 @@ overlaps `0.11.4`, so no latency change is claimed.
 - **Done condition:** server authorization and client UX responsibilities are
   executable and explicit.
 
+**Completion evidence:** the project application replaces its placeholder login
+route with a native constrained form and one async handler. The shared layout
+restores a stored token, validates the current user, exposes authenticated
+identity and role state, and clears local state before replacement navigation on
+rejection or logout. Required Chrome proves invalid and valid login, reload
+restoration, anonymous and rejected direct protected entry, member/admin control
+visibility, server 401/403 enforcement, token clearing, and logout. Client
+conditions are recorded as presentation only; the deterministic API server
+authorizes every protected read and mutation.
+
+Existing native forms, state, layout ownership, effects, storage, fetch, and
+native navigation are sufficient. This packet adds zero semantic primitives,
+ModuleIR kinds, compiler passes, production compiler/runtime lines, runtime
+concepts, normalization rules, adapter rules, public APIs, auth runtimes, or
+servers. The fixture emits 43 files totaling 123,476 raw / 45,305 aggregate gzip
+bytes with deploy SHA-256
+`81d0b3c5e0d1d1f72f29d219647601463f5317f215274e14a45fe5ba92eb033e`.
+The login route uses 12,093 raw / 5,795 gzip JavaScript bytes. The two-route
+session uses 16 JavaScript files totaling 60,767 raw / 22,561 aggregate gzip
+bytes. Seven fresh Chrome profiles record a 1.4 ms navigation median with a
+1.2/1.5 ms range; the range overlaps `0.12.1`, so no latency change is claimed.
+`/help` remains 0 B JavaScript.
+
 ### `0.12.3`: Route Failure And Restoration Policy
 
 - **Purpose:** decide application-visible handling of navigation/data failures.
@@ -1124,5 +1172,7 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.11.2` | Released | Preserve the published no-new-primitive architecture decision and zero-byte result. | None |
 | `0.11.3` | Released | Preserve the published optimistic rollback, duplicate prevention, navigation, and retry evidence. | None |
 | `0.11.4` | Released | Preserve the published bounded pagination, history, refresh, polling cleanup, and exact request-count evidence. | None |
-| `0.12.0` | Active | Release the completed runtime project/issue route-shell evidence. | None |
-| `0.12.1` onward | Blocked | Wait for explicit approval after the minor-version entry release. | User-directed minor-version boundary |
+| `0.12.0` | Released | Preserve direct runtime entry, reload, rewrite, and native fallback evidence. | None |
+| `0.12.1` | Released | Preserve the published layout/history/focus/scroll evidence. | None |
+| `0.12.2` | Active | Release the completed authentication and permission evidence. | None |
+| `0.12.3` onward | Blocked | Complete the `0.12.2` release transaction first. | Ordered patch boundary |

package/docs/next-architecture/versioning.md

@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.113` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.12.0`.
+`create-kudzu@0.1.115` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.12.2`.
 
 ## Release Boundary
 

package/framework/navigation-runtime.js

@@ -330,7 +330,7 @@ function updateHead(incoming) {
 }
 
 function focusAndScroll(url) {
-  const hashTarget = url.hash && document.getElementById(decodeURIComponent(url.hash.slice(1)))
+  const hashTarget = url.hash ? document.getElementById(decodeURIComponent(url.hash.slice(1))) : null
   const target = hashTarget ?? routeElement("h1") ?? routeElement("main")
   if (target) {
     if (!target.hasAttribute("tabindex")) target.setAttribute("tabindex", "-1")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.12.0",
+  "version": "0.12.2",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",