caspian-utils 0.0.26 → 0.0.28

package/dist/docs/fetch-data.md

@@ -12,10 +12,10 @@ related:
     - /docs/database
     - /docs/file-uploads
     - /docs/cache
-    - /docs/routing
-    - /docs/pulsepoint
-    - /docs/pulsepoint-runtime-map
-    - /docs/project-structure
+    - /docs/routing
+    - /docs/pulsepoint
+    - /docs/pulsepoint-runtime-map
+    - /docs/project-structure
     - /docs/index
 ---
 
@@ -140,11 +140,11 @@ Validate incoming form and mutation payloads before persisting them. See [valida
 
 If an RPC action needs transient request-scoped success or error state beyond its direct return payload, read [state.md](./state.md) and verify the current wire-request lifecycle before depending on persistence across navigations or full-page reloads.
 
-Important:
-
-- `pp.rpc()` posts to the current route RPC bridge.
-- Older docs may refer to `pp.fetchFunction()`. In this repo's current runtime, the supported helper is `pp.rpc()`.
-- Use [pulsepoint-runtime-map.md](./pulsepoint-runtime-map.md) when debugging browser-side RPC options such as streaming, upload progress, abort behavior, redirects, or SPA interaction.
+Important:
+
+- `pp.rpc()` posts to the current route RPC bridge.
+- Older docs may refer to `pp.fetchFunction()`. In this repo's current runtime, the supported helper is `pp.rpc()`.
+- Use [pulsepoint-runtime-map.md](./pulsepoint-runtime-map.md) when debugging browser-side RPC options such as streaming, upload progress, abort behavior, redirects, or SPA interaction.
 
 ## Streaming Responses
 
@@ -276,6 +276,8 @@ Use [auth.md](./auth.md) when the action should also participate in centralized
 
 According to the upstream Caspian RPC docs, actions are private by default until decorated with `@rpc()`, and the framework includes CSRF protection plus origin validation for exposed actions.
 
+For reverse-proxy deployments, RPC origin validation can also resolve the public app origin from `APP_BASE_URL`, `PUBLIC_BASE_URL`, or `SITE_URL`, and otherwise falls back to forwarded host and protocol headers when they are present.
+
 ## Serialization Rules
 
 For RPC responses, Caspian can automatically serialize common Python return types such as:

package/dist/docs/routing.md

@@ -10,10 +10,10 @@ related:
     - /docs/components
     - /docs/cache
     - /docs/file-uploads
-    - /docs/metadata
-    - /docs/pulsepoint
-    - /docs/pulsepoint-runtime-map
-    - /docs/index
+    - /docs/metadata
+    - /docs/pulsepoint
+    - /docs/pulsepoint-runtime-map
+    - /docs/index
 ---
 
 Caspian follows the same mental model as the Next.js App Router: routes live under `src/app`, folders define URL segments, layouts nest automatically, and special folder names control grouping and dynamic matching.
@@ -228,7 +228,7 @@ Also bad:
 </section>
 ```
 
-Use [pulsepoint.md](./pulsepoint.md) when you need the full authored-vs-rendered example instead of this routing-focused reminder. Use [pulsepoint-runtime-map.md](./pulsepoint-runtime-map.md) when a route task names a specific PulsePoint directive or SPA behavior and you need the owning runtime file quickly.
+Use [pulsepoint.md](./pulsepoint.md) when you need the full authored-vs-rendered example instead of this routing-focused reminder. Use [pulsepoint-runtime-map.md](./pulsepoint-runtime-map.md) when a route task names a specific PulsePoint directive or SPA behavior and you need the owning runtime file quickly.
 
 ### `index.py`
 
@@ -236,6 +236,8 @@ Use `index.py` as the backend companion when a route needs metadata or async ser
 
 Use `index.py` by itself only for non-visual routes such as redirects or action-only handlers. Because Caspian runs on FastAPI, the page entry should be async when it performs async work.
 
+When `page()` calls `render_page(__file__, ...)`, root-validation errors are attributed to the sibling `index.html` because that file is the authored template. If `page()` returns a raw HTML string directly, Caspian treats that value as a runtime fragment instead of an authored template and wraps it in a runtime host root when needed.
+
 Example:
 
 ```python
@@ -391,20 +393,22 @@ Example root layout:
 
 If a layout needs shared synchronous props or metadata, add a `layout.py` file next to the HTML layout. Treat it as the backend companion for the layout, not as the place to author visible wrapper markup.
 
+When `layout()` calls `render_layout(__file__, ...)`, root-validation errors are attributed to the sibling `layout.html` because that file is the authored template. If `layout()` returns a raw HTML string directly, Caspian treats that value as a runtime fragment instead of an authored template and wraps it in a runtime host root when needed.
+
 Example:
 
 ```python
 from casp.auth import auth
 
-def layout(context_data):
-    user = auth.get_payload()
-
-    return {
-        "user": user,
-        "dashboard_body_class": "w-screen h-screen overflow-hidden",
-        "theme": "dark",
-    }
-```
+def layout(context_data):
+    user = auth.get_payload()
+
+    return {
+        "user": user,
+        "dashboard_body_class": "w-screen h-screen overflow-hidden",
+        "theme": "dark",
+    }
+```
 
 `context_data` includes URL parameters such as dynamic route values.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "caspian-utils",
-  "version": "0.0.26",
+  "version": "0.0.28",
   "description": "Caspian tooling",
   "main": "index.js",
   "scripts": {