trellis_shelf 0.10.2

Shelf integration for the Trellis template engine — middleware, HTMX helpers, and security defaults.

Changelog

0.10.2

Changed

• Lockstep version bump to keep all Trellis SDK packages on a single shared version. No functional changes in this package.

0.10.1

Changed

• Lockstep version bump to keep all Trellis SDK packages on a single shared version. No functional changes in this package.

0.10.0

Changed

• Lockstep version bump to keep all Trellis SDK packages on a single shared version. No functional changes in this package.

0.9.1

Changed

• Lockstep version bump to keep all Trellis SDK packages on a single shared version. No functional changes in this package.

0.9.0

Changed

• Lockstep version bump to keep all Trellis SDK packages on a single shared version. No functional changes in this package.

0.8.2

Changed

• Lockstep version bump to keep all Trellis SDK packages on a single shared version. No functional changes in this package.

0.8.1

Changed

• Lockstep version bump to keep all Trellis SDK packages on a single shared version. No functional changes in this package.

0.8.0

Changed

• Version aligned to the unified Trellis SDK lockstep versioning scheme — all SDK packages now share a single version number and are released together. No functional changes since 0.1.0.

0.1.0

Added

• trellisEngine() middleware for injecting a Trellis engine into the Shelf request context.
• getEngine() for retrieving the engine from request context inside handlers and utilities.
• renderPage(), renderFragment(), and renderOobFragments() response helpers that merge request-scoped values like csrfToken.
• HTMX request helpers: isHtmxRequest(), htmxTarget(), htmxTrigger(), and isHtmxBoosted().
• htmlResponse() for text/html; charset=utf-8 responses.

Security

• trellisSecurityHeaders() middleware with configurable X-Content-Type-Options, X-Frame-Options, Referrer-Policy, X-XSS-Protection, and Content-Security-Policy.
• CspBuilder for composing Content-Security-Policy directives with sensible defaults.
• trellisCsrf() middleware implementing HMAC-SHA256 double-submit cookie CSRF protection.
• csrfToken() for reading the current request token in handlers or templates.