@jk2908/solas 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.4.3 - 2026-05-27
+
+- Updated README docs to show that `dynamic()` must be awaited in request-time deferred `ppr` usage examples.
+- Clarified route docs for `+endpoint.ts`, including that endpoint files can be placed anywhere in `app/` and how GET requests are resolved when `+page.tsx` and `+endpoint.ts` share a route.
+- Tightened README language around experimental status, `url`, and `trustedOrigins`/CSRF guidance.
+
 ## 0.4.2 - 2026-05-22
 
 - Changed `precompress` to default to `false`, so Solas no longer emits precompressed build output unless you opt in.

package/README.md

@@ -2,7 +2,7 @@
 
 Solas is a minimal React meta-framework powered by Vite, created for experimenting with routing, streaming, and prerendering with React Server Components.
 
-It has not been rigorously tested yet (there are currently no automated tests) ... and broken behaviour should be expected.
+Solas is experimental and currently has no automated test suite, so expect rough edges.
 
 Solas currently requires Bun 1.2+ on your `PATH`. You can still manage dependencies with `npm`, `pnpm`, or `yarn`, but the Solas CLI and Vite plugin runtime use Bun APIs directly.
 
@@ -56,7 +56,7 @@ Use these filename conventions:
 
 - `+layout.tsx`: shared layout for a route branch.
 - `+page.tsx`: page component for a route.
-- `+endpoint.ts`: request handler for non-page routes.
+- `+endpoint.ts`: request handler. Can be placed in any folder and responds to all HTTP methods for its route path.
 - `+middleware.ts`: middleware that runs for the current route branch and is inherited by child routes. Parent and child middleware stack together.
 - `+loading.tsx`: loading fallback inherited by child routes.
 - `+401.tsx`: boundary for unauthorised responses in the current route branch and its children.
@@ -68,6 +68,13 @@ Nested folders create nested routes. Dynamic segments use `[param]`, and catch-a
 
 Status boundaries follow the same override pattern as layouts: a child route uses the nearest matching boundary file above it, and a more specific boundary replaces a parent one.
 
+If a route has both `+page.tsx` and `+endpoint.ts`, Solas selects the GET handler by `Accept` header:
+
+- `Accept: text/html` or `text/x-component`: render `+page.tsx`
+- other GET requests (for example `application/json`): run `+endpoint.ts` `GET`
+
+Non-GET methods (`POST`, `PUT`, `PATCH`, `DELETE`) always run `+endpoint.ts`.
+
 ## Config
 
 All Solas options are passed to `solas()` inside `defineConfig`.
@@ -81,14 +88,9 @@ Solas resolves it in this order:
 - the `url` option passed to `solas()`
 - `VITE_APP_URL`
 
-Current behaviour:
+Solas exposes the resolved value as `import.meta.env.VITE_APP_URL`. If `url` is set, prerender also uses it as the request origin for build-time renders.
 
-- Solas reads that value during plugin configuration.
-- Solas exposes the resolved value as `import.meta.env.VITE_APP_URL`.
-- If `url` is set, prerender uses it as the request origin for build-time renders.
-- The runtime router does not otherwise require `config.url` for routing to work.
-
-In practice, you only need `url` if your app code wants to read the public origin from `import.meta.env.VITE_APP_URL`, or if your prerendered output needs a real public origin.
+In practice, you only need `url` if your app reads `import.meta.env.VITE_APP_URL` or your prerendered output needs a real public origin.
 
 If you do want to set it explicitly, this is the shape:
 
@@ -126,9 +128,9 @@ export default defineConfig({
 
 ### `precompress`
 
-Use `precompress` to control whether Solas writes compressed build assets.
+Use `precompress` to control whether Solas writes compressed browser-served build assets (like `.js`, `.css`, etc.).
 
-Default: `true`
+Default: `false`
 
 ```ts
 export default defineConfig({
@@ -208,7 +210,7 @@ export default function Page() {
 }
 
 async function Ts() {
-	dynamic()
+	await dynamic()
 	return <div>{Date.now()}</div>
 }
 ```
@@ -294,12 +296,10 @@ Use `trustedOrigins` to allow specific origins to make cross-origin browser subm
 
 Default: `[]`
 
-Solas protects server actions and `+endpoint` handlers against CSRF.
-
-Server actions are always `POST` requests. `+endpoint` handlers are protected on `POST`, `PUT`, `PATCH`, and `DELETE` requests.
-
 By default, only same-origin browser requests are allowed. Add a trusted origin when a third-party service needs to submit through the user's browser, such as a payment gateway or identity provider.
 
+This setting controls which cross-origin browser sources are allowed for unsafe requests. See Security > CSRF for enforcement details.
+
 Each value must be a complete origin including protocol:
 
 ```ts
@@ -312,7 +312,7 @@ export default defineConfig({
 })
 ```
 
-Only add origins you completely trust. These origins are treated as allowed browser sources for unsafe requests.
+Only add origins you completely trust.
 
 ### `sitemap`
 

package/dist/utils/export-reader.js

@@ -99,7 +99,8 @@ export class ExportReader {
             // capture one supported literal value (string, number, boolean, null)
             '\\s*=\\s*(?<value>(?:"(?:[^"\\\\]|\\\\.)*"|\'(?:[^\'\\\\]|\\\\.)*\'|\\x60(?:[^\\x60\\\\]|\\\\.)*\\x60|true|false|null|-?\\d+(?:\\.\\d+)?))(?=\\s|;|$)';
         // multiline mode lets ^ match the start of each transpiled line, so the
-        // export regex stays anchored to a real statement boundary instead of the file start
+        // export regex stays anchored to a real statement boundary instead of
+        // the file start
         const text = code.match(new RegExp(source, 'm'))?.groups?.value;
         if (!text)
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@jk2908/solas",
-	"version": "0.4.2",
+	"version": "0.4.3",
 	"description": "A Vite + React meta-framework exploring streaming, Server Components, and partial prerendering. Designed for simplicity and lightness",
 	"keywords": [
 		"framework",