PledgeJS 0.1.1 — Real Type-Checking, RSC Streaming, and a CSRF Hardening Fix

This release is about correctness, not new features. While auditing the framework end to end, we found that the monorepo's own type-checking — both in CI and in pnpm typecheck — was only ever validating two small ambient declaration files, never the ~500 real source files across every package. Once we fixed that gap and ran a real check, 166 pre-existing type errors surfaced at once.

The most serious was in the Cloudflare Workers adapter: it called the edge rate-limiting, bot-detection, and geo-restriction functions with the wrong arguments and didn't even compile against its own edge-security module. It's fixed now, and geo-restriction is exposed as a proper geoRestriction option on defineConfig.

RSC streaming (renderRSCStream) generated a real flight payload and then discarded it, silently falling back to plain HTML — the client now receives flight chunks progressively as they're produced, instead of the whole response waiting on a blob that was never actually sent. The Rust SSR acceleration path in the React renderer also had a broken addon path that meant it could never engage even when the native addon was compiled; that's fixed too.

On the security side, CSRF protection previously treated a request that omitted the Sec-Fetch-Site header as same-site by default — which meant a forged cross-origin request could skip Origin validation just by not sending that header. It now falls through to Origin validation instead, matching the behavior you'd expect.

Smaller fixes: the AWS Lambda adapter now handles both API Gateway payload formats (v1 and v2 — the SAM template we generate uses v2 by default, but the handler was only ever reading v1 fields), create-pledge-app no longer copies React-only starter templates into a Vue/Solid/Svelte scaffold, cdn/cors/csp are now real typed fields on PledgeConfig instead of being read through unchecked casts, and pledge docker --optimized exposes the Rust-addon-aware multi-stage Dockerfile that already existed internally but was never wired into the CLI.

Full details, including every fixed file, are in the CHANGELOG. 90 test files, 810 tests, still all green — plus a workspace type-check that now actually means something.