glashjs 0.7.0 → 0.7.2

package/README.md

@@ -1,6 +1,6 @@
 # glashjs
 
-The glashdb-native web framework — a **Next.js alternative** with the same file-based routing, SSR, API routes, layouts, and JSX component model you know from Next, rebuilt from scratch on **Preact + esbuild + Node** (zero Next dependency) and made **fast, offline-capable, and hard-to-hack by default**. It ships real features instead of promises.
+The glashdb-native web framework — **a Next.js alternative** with the file-based routing, SSR, API routes, layouts, and JSX component model you know from Next, made **fast, offline-capable, and secure by default**. It ships real features instead of promises.
 
 > **Status:** `0.6.0` — the full framework is here: file-based routing, server-side rendering, API routes, JSX components with client hydration, nested layouts, streaming SSR, a dev/prod server, plus the asset optimizer, offline service worker, animated favicon, and secure-by-default headers. Core installs with zero mandatory dependencies.
 
@@ -24,9 +24,9 @@ security      strict CSP + 11 headers
 
 ## The three pillars
 
-### 1. Asset optimizer — the honest version of "10–20× compression"
-JPG and MP4 are *already* compressed; you can't losslessly shrink them 10–20× and restore them. So glashjs does what actually wins:
-- **Text / SVG / JS / CSS / HTML** → **Brotli + Gzip** (`zlib`, built in). Real 4–8× on text/SVG. The browser decompresses transparently via `Content-Encoding` — *that's* "compress on build, decompress when live," done correctly.
+### 1. Asset optimizer — the smallest payload a browser can decode
+At build time glashjs re-encodes every asset to the leanest format the client supports, then serves the best variant per request — no config, no runtime image server, originals never touched. How each asset type is handled:
+- **Text / SVG / JS / CSS / HTML** → **Brotli + Gzip** (`zlib`, built in). Real 4–8× on text/SVG. The browser decompresses transparently via `Content-Encoding` — compress on build, decompress in the browser.
 - **jpg / png / webp** → **AVIF + WebP** variants (needs optional `sharp`). Typically 3–10× vs unoptimized originals.
 - **mp4 / mov / webm** → **AV1** + poster frame (needs optional `ffmpeg`).
 - Emits `glash-assets.manifest.json` so the glashdb edge (or any server) serves the best variant per client. Originals are never mutated.
@@ -42,8 +42,8 @@ Generates a **Service Worker** (`glash-sw.js`) + PWA manifest that precache the
 - **HTML** → stale-while-revalidate (instant, self-healing)
 - **`/api` `/rest` `/auth` `/live` `/stream`** → **network-first**, so offline mode degrades *exactly* at live/updated data and streaming — the site keeps working, just without fresh data. (Configurable via `dataPrefixes`.)
 
-### 3. Security — "hard to hack," honestly (not "unhackable")
-Nothing is unhackable. glashjs ships strong, opinionated defaults so you're secure unless you loosen them:
+### 3. Security — secure by default
+glashjs ships strong, opinionated defaults so you're secure unless you loosen them:
 - **Strict CSP** with no `'unsafe-inline'` scripts (XSS-via-injection blocked by default)
 - HSTS, `X-Content-Type-Options`, `X-Frame-Options: DENY`, COOP/COEP/CORP isolation, tight `Permissions-Policy` & `Referrer-Policy`
 - **Subresource Integrity** helper (`sri()`) for build assets
@@ -180,4 +180,4 @@ animatedFavicon: true,                         // bundled animated glash mark (d
 - [ ] `glash deploy` → glashdb hosting in one command
 
 ## Design stance
-glashjs is a **Next.js alternative** — it keeps the conventions you know from Next (file-based routing, SSR, layouts, the component model) but is built from scratch on **Preact + esbuild + Node**, with **zero Next.js dependency**. The value is in the **defaults**: every glashjs site is optimized, offline-capable, and hardened out of the box.
+glashjs is **a Next.js alternative** — it keeps the conventions you know from Next (file-based routing, SSR, layouts, the component model) and composes proven primitives rather than reinventing them. The value is in the **defaults**: every glashjs site is optimized, offline-capable, and secure out of the box.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glashjs",
-  "version": "0.7.0",
+  "version": "0.7.2",
   "description": "glashjs — a web framework built on top of Next.js: file-based routing, SSR, API routes, JSX components with client hydration, nested layouts, streaming SSR, a best-in-class build-time asset optimizer, offline PWA layer, animated favicon, and secure-by-default headers. Zero mandatory dependencies.",
   "type": "module",
   "bin": {
@@ -64,5 +64,13 @@
     "esbuild": "^0.28.0",
     "preact": "^10.29.2",
     "preact-render-to-string": "^6.7.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/theChrisJohn/glashjs.git"
+  },
+  "homepage": "https://github.com/theChrisJohn/glashjs#readme",
+  "bugs": {
+    "url": "https://github.com/theChrisJohn/glashjs/issues"
   }
 }