redweb 0.16.3 → 0.16.4

package/CHANGELOG.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 0.16.4
+
+- Highlight JavaScript, TypeScript and TSX code blocks by default, including object and handler references inside `rw-*={...}` bindings. Export the safe `highlightCode()` helper and optional `redweb/code-highlight.css` palette for applications that render documentation.
+- Keep custom highlighters, already-composed HTML fragments, and `highlight: false` available. Verify escaping and tokenization with 100% unit coverage and a real HTTP page test.
+
 ## 0.16.3
 
 - Add explicit `defineApp({ providers })` dependencies through `@inject`, keyed `liveResource()` and `@resource()` projections, and bounded streaming `@upload()` actions for Live HTML pages and components.

package/README.md

@@ -11,12 +11,12 @@ Use the same package for a live site, static HTML, Express HTTP endpoints, or ro
 Start with a neutral, tested application foundation:
 
 <!-- redweb:setup:start -->
-> Documentation for Redweb 0.16.3. Install that exact version when following these examples.
+> Documentation for Redweb 0.16.4. Install that exact version when following these examples.
 
 ```sh
-npx --yes redweb@0.16.3 init my-app
+npx --yes redweb@0.16.4 init my-app
 cd my-app
-npm install --save-exact redweb@0.16.3
+npm install --save-exact redweb@0.16.4
 npm test
 npm run dev
 ```

package/docs/CLI.md

@@ -4,7 +4,7 @@ Use the version installed in your project (`npx --no-install redweb`) when troub
 
 ## Add pages, components, and socket routes
 
-These commands are available in `redweb@0.16.3`.
+These commands are available in `redweb@0.16.4`.
 
 ```sh
 npx --no-install redweb add page dashboard

package/docs/DEVELOPMENT.md

@@ -1,6 +1,6 @@
 # Development refresh and inspection
 
-This API is available in `redweb@0.16.3`. Use documentation matching the installed package before enabling it.
+This API is available in `redweb@0.16.4`. Use documentation matching the installed package before enabling it.
 
 ## Browser refresh
 

package/docs/GETTING_STARTED.md

@@ -9,9 +9,9 @@ It is not React, a browser component framework, a database, an identity provider
 Create the same neutral foundation whether you are following a tutorial or starting your own application:
 
 ```sh
-npx --yes redweb@0.16.3 init my-app
+npx --yes redweb@0.16.4 init my-app
 cd my-app
-npm install --save-exact redweb@0.16.3
+npm install --save-exact redweb@0.16.4
 npm test
 npm run dev
 ```
@@ -19,7 +19,7 @@ npm run dev
 Add capability dependencies without importing example-domain code:
 
 ```sh
-npx --yes redweb@0.16.3 init my-game --with auth,multiplayer
+npx --yes redweb@0.16.4 init my-game --with auth,multiplayer
 ```
 
 The default includes its real tests. `--bare` omits only the test directory, test scripts, and test-only coverage dependency; it retains the runnable application, CSS, compiler configuration, build scripts, and development watcher.
@@ -67,7 +67,7 @@ For private raw socket subscriptions, see [room authorization and shared request
 
 Build first. Deploy `dist/`, the package manifest, and the lockfile, then install runtime dependencies with `npm ci --omit=dev`. The starters are tested with `src/` unavailable after compilation. Configure HTTPS/WSS and a proxy that supports WebSocket upgrades when using a reverse proxy.
 
-These deployment commands require a verified release pair. `redweb@0.16.3` installs published `redweb-client@0.3.1` automatically through its dependency. Future unreleased Redweb changes require their matching tested tarball until a release containing them is published. The `npm link` workflow is local development only: a clean production install does not preserve that link.
+These deployment commands require a verified release pair. `redweb@0.16.4` installs published `redweb-client@0.3.1` automatically through its dependency. Future unreleased Redweb changes require their matching tested tarball until a release containing them is published. The `npm link` workflow is local development only: a clean production install does not preserve that link.
 
 Before public access, add authentication, authorization, trusted-origin policy, input/rate limits, application persistence where needed, and bounded shutdown. Treat reconnect/session tokens as credentials. Do not promise exactly-once delivery or durable sessions from an in-memory starter. See [operations](MULTIPLAYER_OPERATIONS.md) and [guarantees and limits](PRODUCTION_READINESS.md).
 

package/docs/LIVE_HTML.md

@@ -205,7 +205,7 @@ const reference = <>{apiSections.map(section =>
 )}</>;
 ```
 
-`codeBlock()` escapes strings by default. It may also receive an explicit `HtmlFragment`, or a `highlight(source, language)` callback that returns one, allowing a server-side highlighter to compose safe token spans without accepting arbitrary HTML strings.
+`codeBlock()` escapes strings by default. JavaScript, TypeScript, and TSX strings are highlighted automatically, including identifiers inside `rw-*={...}` action bindings. The built-in `highlightCode(source, language)` is also available when composing custom code UI. Both emit escaped `token-keyword`, `token-literal`, `token-number`, `token-string`, `token-comment`, and `token-reference` spans. Copy or import `redweb/code-highlight.css` for a default dark palette, or style those classes in your own CSS. Other languages remain escaped plain text. An explicit `HtmlFragment` remains untouched, `highlight: false` opts out, and a custom `highlight(source, language)` callback overrides the built-in highlighter. A custom callback must return a safe fragment, not arbitrary HTML.
 
 An `HtmlFragment` returned from `render()` is already fully composed and is never reparsed for `{{ bindings }}` or directives. This keeps code samples literal and prevents escaped documentation text from becoming executable template syntax. Return a string or use `template` when Redweb should process declarative bindings.
 

package/docs/MIGRATION.md

@@ -1,6 +1,6 @@
 # Upgrade an existing Redweb application
 
-Match the installed package to its versioned documentation. Redweb 0.16.3 contains the capabilities described by the 0.16.3 guides; a later development checkout may not match that release. See [release verification](RELEASE_TRUST.md) and the changelog shipped with your selected package. Keep your lockfile and rollback artifact, and run your own real HTTP/WebSocket/browser tests after upgrading.
+Match the installed package to its versioned documentation. Redweb 0.16.4 contains the capabilities described by the 0.16.4 guides; a later development checkout may not match that release. See [release verification](RELEASE_TRUST.md) and the changelog shipped with your selected package. Keep your lockfile and rollback artifact, and run your own real HTTP/WebSocket/browser tests after upgrading.
 
 ## 0.8 migration notes
 

package/docs/RELEASE_TRUST.md

@@ -41,18 +41,18 @@ An ordinary installation without this root policy can still select affected
 dependencies. No Express 5 migration, bundled fork or published shrinkwrap is
 introduced. Audit results remain time-sensitive and application-specific.
 
-For a published application, select an exact release, commit its lockfile, and use `npm ci` in CI/deployment. This guide is versioned for 0.16.3. Before registry publication, verify the packed candidate; after publication, repeat these registry checks from a clean application:
+For a published application, select an exact release, commit its lockfile, and use `npm ci` in CI/deployment. This guide is versioned for 0.16.4. Before registry publication, verify the packed candidate; after publication, repeat these registry checks from a clean application:
 
 ```sh
-npm view redweb@0.16.3 version engines dist.integrity dist.signatures dist.attestations gitHead --json
-npm install --save-exact redweb@0.16.3
+npm view redweb@0.16.4 version engines dist.integrity dist.signatures dist.attestations gitHead --json
+npm install --save-exact redweb@0.16.4
 npm audit signatures
 npm audit --omit=dev
 ```
 
 The signature command must run in the installed application directory. Keep TLS verification enabled and use a current npm CLI; a certificate/trust-store failure is not a reason to disable verification. A lockfile's integrity value detects changed package bytes; registry signatures authenticate registry metadata; provenance, when present and verified, links an artifact to a build/source identity. Vulnerability audit is a separate check against known advisories, not an application penetration test.
 
-Redweb 0.16.3 contains neutral composable initialization, socket-bound TSX controls and connection-owned page state, unified application startup, server-rendered TSX, reactive state/actions, explicit providers, keyed live resources, bounded streaming uploads, complete starters, shared socket contracts, authorization, diagnostics, lifecycle work, and bounded heartbeat grace described by these versioned guides. Keep the package and documentation version aligned; do not mix a development guide or a future checkout with 0.16.3 and assume newer APIs exist.
+Redweb 0.16.4 contains neutral composable initialization, socket-bound TSX controls and connection-owned page state, unified application startup, server-rendered TSX, reactive state/actions, explicit providers, keyed live resources, bounded streaming uploads, built-in code highlighting, complete starters, shared socket contracts, authorization, diagnostics, lifecycle work, and bounded heartbeat grace described by these versioned guides. Keep the package and documentation version aligned; do not mix a development guide or a future checkout with 0.16.4 and assume newer APIs exist.
 
 Redweb is pre-1.0. Consult the changelog and versioned guide before upgrading, run your own real HTTP/WebSocket/browser tests, and keep a rollback artifact. Patch/minor numbers and a compatible TypeScript build alone do not prove wire compatibility, preserved sessions, database compatibility or application authorization. HTTP-created live-page sessions are process-owned; a restart or rolling replacement does not migrate them automatically. Raw socket protocol versions are negotiated only when the route opts in, and application payload compatibility remains your contract.
 

package/docs/SOCKET_CONTRACTS.md

@@ -4,7 +4,7 @@ Status: included since `redweb@0.16.2`.
 
 A contract declares message payloads once. The same schema supplies runtime validation and inferred TypeScript types for senders and handlers. The URL still selects the route (`/match`), and the envelope's `type` selects an individual handler (`join`, `move`, `resume`). No socket decorators or second action dispatcher are required.
 
-Start with `npx --yes redweb@0.16.3 init my-match --template socket`. The complete maintained example lives in [the socket recipe](../recipes/socket/README.md): [contract](../recipes/socket/contract.ts), [handlers](../recipes/socket/handlers.ts), [server](../recipes/socket/app.tsx), and [real-network tests](../recipes/socket/app.test.cjs).
+Start with `npx --yes redweb@0.16.4 init my-match --template socket`. The complete maintained example lives in [the socket recipe](../recipes/socket/README.md): [contract](../recipes/socket/contract.ts), [handlers](../recipes/socket/handlers.ts), [server](../recipes/socket/app.tsx), and [real-network tests](../recipes/socket/app.test.cjs).
 
 Session ownership is separate from room fan-out. For authenticated group delivery,
 see [room authorization](ROOM_AUTHORIZATION.md) and the complete