Rask.Wire 0.21.1-alpha.0.34

Source-generated, reflection-free CQRS/mediator for .NET. Define `IQuery<T>`, `ICommand`, `ICommand<T>` and `INotification` messages with their handlers, then dispatch through `IDispatcher` with the response type inferred — no runtime reflection and no assembly scanning, so it publishes clean under the WASM/AOT trimmer. Pipeline behaviors provide the decorator hook for cross-cutting logging/validation/transactions. Standalone: depends only on Microsoft.Extensions.DependencyInjection.Abstractions.

Call your own API controllers and minimal API endpoints from C# with no URL string at the call site. A source generator reads the endpoint declarations and emits one typed client per controller, with reflection-free JSON codecs, so the route, the verb, the request shape and the response shape cannot drift from the server. Publishes clean under the WASM/AOT trimmer.

Register, sign in and sign out for a Rask app, on by default. Accounts are the app's own User aggregate (PBKDF2 or bcrypt password hashing, passkeys beside the password, one revocable session row per signed-in device, sign-in throttling) and are exposed through Rask's own host-neutral surface — the same IUserProvider, Authorize component and [Authorize] routes work unchanged on the Server, WebAssembly, island, SPA and meta-framework hosts. rask new writes the /login, /register, /logout and /devices pages into the app, and the matching /api/auth endpoints give a TypeScript front end the same flows. Email confirmation and password reset go out through the app's own mail queue, with /confirm-email, /forgot-password and /reset-password pages scaffolded to match. The first account to register becomes the admin.

The browser half of Rask.Auth. Register it and a WebAssembly app gets the same IAuth and IUserProvider a server-rendered one has — register, sign in and sign out are the identical calls, and reading the current user is the identical property. It talks to the app's own /api/auth endpoints over a same-origin cookie, so no token is ever held in JavaScript. Deliberately free of ASP.NET Core Identity and Entity Framework: neither belongs in a trimmed browser publish.

Register, sign in and sign out as JSON endpoints, for an ASP.NET Core app that renders no Rask components — a TypeScript SPA host or a meta-framework host, where the front end owns the UI. Accounts are the app's own User aggregate (PBKDF2 or bcrypt password hashing, passkeys, one revocable session row per device, sign-in throttling) and are exposed at /api/auth, with email confirmation and password reset through the app's own mail queue and optional bearer tokens. The first account to register becomes the admin. This is the host-neutral half of Rask.Auth: no components, no renderer, no Rask.Core. Add Rask.Auth instead when the app IS a Rask app and wants the built-in sign-in pages.