@kudzujs/core 0.12.1 → 0.12.2

package/PERFORMANCE.md

@@ -6,6 +6,27 @@ Reproducibility classes: `npm run benchmark`, `npm run benchmark:keyed`, `npm ru
 
 The maintained 2026-08-13 comparison used Node 24.14.0 and an Intel Core i5-9500 Linux x64 host, one warm-up, and seven alternating fresh-process samples against clean `v0.8.44`. A narrow fast path skips Kudzu semantic transformation for 450 plain `.ts` modules whose runtime edges are exclusively resolvable relative TypeScript imports or exports; all other modules retain the existing transformer. Compile median fell from 2,323.9 ms to 1,413.2 ms (39.2%) and clean-build median from 3,325.3 ms to 2,382.4 ms (28.4%); every paired sample improved. Compile peak-RSS median fell from 571.2 MiB to 552.6 MiB, while build peak RSS was 570.9 MiB versus 568.8 MiB. Compiler scratch fell from 7,328,390 to 1,971,061 bytes. Both targets emitted the same 50 static HTML files, 10,980 bytes, and deploy SHA-256 `e107d78a7f55bc8a1af0ea6e53efeffa19b3d44d21c892484d103fa346e7ba7b`. This is a source-scale compiler comparison, not a cross-framework result.
 
+## 0.12.2 Authentication And Permission Boundary
+
+Measured 2026-08-23 on macOS arm64 with Node 25.6.1 and Chrome
+151.0.7922.172. Required Chrome proves invalid and valid login, token-backed
+reload restoration, anonymous and rejected direct entry, role-aware controls,
+server-enforced API and admin authorization, token clearing, and logout.
+
+The two-route session uses 16 JavaScript files totaling 60,767 raw / 22,561
+aggregate gzip bytes, an increase of 1,793 raw / 432 gzip bytes from `0.12.1`
+for authored session state, restoration, and authorization headers. Navigation
+samples are `[1.3, 1.5, 1.5, 1.2, 1.3, 1.4, 1.4]` ms, with a 1.4 ms median and
+1.2/1.5 ms minimum/maximum. The range overlaps `0.12.1`, so no latency change
+is claimed.
+
+The application emits 43 files totaling 123,476 raw / 45,305 aggregate gzip
+bytes with deploy SHA-256
+`81d0b3c5e0d1d1f72f29d219647601463f5317f215274e14a45fe5ba92eb033e`.
+The login route uses 12,093 raw / 5,795 aggregate gzip JavaScript bytes. Core
+semantic LOC remains 5,682 with no pass, primitive, production compiler/runtime
+change, or runtime-concept change. `/help` remains 0 B JavaScript.
+
 ## 0.12.1 Shared Layout, History, Focus, And Scroll
 
 Measured 2026-08-23 on macOS arm64 with Node 25.6.1 and Chrome

package/README.md

@@ -14,7 +14,7 @@ Kudzu compiles ordinary React-shaped TypeScript and TSX into complete static HTM
 
 > Experimental `0.12.x`: the compiler API and supported TSX surface may change.
 
-**Latest release: 0.12.1 - Shared layout, history, focus, and scroll.** Enhanced route groups now prove retained layout state, route cleanup, back/forward history, titles, live announcements, hash and heading focus, explicit scroll policy, and native navigation outside the group. Read the [release notes](./RELEASES.md#0121---shared-layout-history-focus-and-scroll), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.12.1), or follow the [architecture packet](./docs/next-architecture/README.md).
+**Latest release: 0.12.2 - Authentication and permission boundary.** Native login, token restoration, role-aware controls, server-enforced 401/403 responses, token clearing, and logout now compose from existing application primitives without an auth runtime. Read the [release notes](./RELEASES.md#0122---authentication-and-permission-boundary), open the [release page](https://github.com/kudzujs/kudzu/releases/tag/v0.12.2), or follow the [architecture packet](./docs/next-architecture/README.md).
 
 - [Documentation](https://kudzujs.cloud/docs)
 - [Installation guide](https://kudzujs.cloud/docs#install)

package/RELEASES.md

@@ -1,5 +1,57 @@
 # Kudzu Releases
 
+## 0.12.2 - Authentication And Permission Boundary
+
+Kudzu 0.12.2 completes the project application's login, restoration,
+permission-aware UI, server rejection, and logout journey using existing
+application primitives.
+
+### Changed in 0.12.2
+
+- Replaced the placeholder login route with a native constrained form and one
+  application-owned async submit handler.
+- Added layout-owned token restoration, session validation, authenticated user
+  state, role-aware admin controls, and explicit logout.
+- Added bearer authorization to project reads and mutations; the deterministic
+  server rejects missing tokens with 401 and member mutations with 403.
+- Proved that protected static HTML is a UX shell while server authorization is
+  the security boundary.
+- Updated `create-kudzu@0.1.115` to generate projects on
+  `@kudzujs/core@^0.12.2`.
+
+### Output Evidence
+
+- The application emits 43 files, 123,476 raw / 45,305 aggregate gzip bytes,
+  and deploy digest
+  `81d0b3c5e0d1d1f72f29d219647601463f5317f215274e14a45fe5ba92eb033e`.
+- The maintained enhanced session uses 16 JavaScript files totaling 60,767 raw
+  / 22,561 aggregate gzip bytes, 1,793 raw / 432 gzip bytes above `0.12.1`.
+- The login route uses 12,093 raw / 5,795 aggregate gzip JavaScript bytes, while
+  `/help` remains complete HTML with 0 B JavaScript.
+- No semantic primitive, compiler pass, core compiler line, runtime concept,
+  public API, auth runtime, or server was added to Kudzu.
+
+### Validation
+
+- Required Chrome proves invalid and valid login, reload restoration, direct
+  anonymous and rejected entry, member/admin UI, server 401/403 responses,
+  token clearing, and logout.
+- Seven fresh Chrome profiles record a 1.4 ms navigation median with a 1.2-1.5
+  ms range. The range overlaps `0.12.1`, so no latency change is claimed.
+- The full suite, package smoke, registry metadata, and fresh installation are
+  release gates.
+
+### Limits
+
+Client conditional rendering only controls presentation. Applications and
+deployment hosts remain responsible for authorizing protected data and actions.
+
+### Upgrade
+
+```sh
+npm install @kudzujs/core@^0.12.2
+```
+
 ## 0.12.1 - Shared Layout, History, Focus, And Scroll
 
 Kudzu 0.12.1 completes the accepted same-document project route group with

package/docs/next-architecture/application-capability-release-plan.md

@@ -594,6 +594,29 @@ no measured AI-delivery cost effect.
 - **Done condition:** server authorization and client UX responsibilities are
   executable and explicit.
 
+**Completion evidence:** the project application replaces its placeholder login
+route with a native constrained form and one async handler. The shared layout
+restores a stored token, validates the current user, exposes authenticated
+identity and role state, and clears local state before replacement navigation on
+rejection or logout. Required Chrome proves invalid and valid login, reload
+restoration, anonymous and rejected direct protected entry, member/admin control
+visibility, server 401/403 enforcement, token clearing, and logout. Client
+conditions are recorded as presentation only; the deterministic API server
+authorizes every protected read and mutation.
+
+Existing native forms, state, layout ownership, effects, storage, fetch, and
+native navigation are sufficient. This packet adds zero semantic primitives,
+ModuleIR kinds, compiler passes, production compiler/runtime lines, runtime
+concepts, normalization rules, adapter rules, public APIs, auth runtimes, or
+servers. The fixture emits 43 files totaling 123,476 raw / 45,305 aggregate gzip
+bytes with deploy SHA-256
+`81d0b3c5e0d1d1f72f29d219647601463f5317f215274e14a45fe5ba92eb033e`.
+The login route uses 12,093 raw / 5,795 gzip JavaScript bytes. The two-route
+session uses 16 JavaScript files totaling 60,767 raw / 22,561 aggregate gzip
+bytes. Seven fresh Chrome profiles record a 1.4 ms navigation median with a
+1.2/1.5 ms range; the range overlaps `0.12.1`, so no latency change is claimed.
+`/help` remains 0 B JavaScript.
+
 ### `0.12.3`: Route Failure And Restoration Policy
 
 - **Purpose:** decide application-visible handling of navigation/data failures.
@@ -1150,5 +1173,6 @@ release transaction where possible or document and publish a forward-fix patch.
 | `0.11.3` | Released | Preserve the published optimistic rollback, duplicate prevention, navigation, and retry evidence. | None |
 | `0.11.4` | Released | Preserve the published bounded pagination, history, refresh, polling cleanup, and exact request-count evidence. | None |
 | `0.12.0` | Released | Preserve direct runtime entry, reload, rewrite, and native fallback evidence. | None |
-| `0.12.1` | Active | Release the completed layout/history/focus/scroll evidence. | None |
-| `0.12.2` onward | Blocked | Complete the `0.12.1` release transaction first. | Ordered patch boundary |
+| `0.12.1` | Released | Preserve the published layout/history/focus/scroll evidence. | None |
+| `0.12.2` | Active | Release the completed authentication and permission evidence. | None |
+| `0.12.3` onward | Blocked | Complete the `0.12.2` release transaction first. | Ordered patch boundary |

package/docs/next-architecture/versioning.md

@@ -66,7 +66,7 @@ Keep each patch behavior-preserving and independently reviewable. If a boundary
 
 ## Generator Versions
 
-`create-kudzu@0.1.114` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.12.1`.
+`create-kudzu@0.1.115` retains the explicit install instructions and generates projects with `@kudzujs/core@^0.12.2`.
 
 ## Release Boundary
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kudzujs/core",
-  "version": "0.12.1",
+  "version": "0.12.2",
   "description": "HTML-first TSX framework with synchronous state semantics and no virtual DOM",
   "type": "module",
   "license": "MIT",