@lengkapp/edge 0.0.12 → 0.0.13

package/dist/edge-client.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.12
+ * @lengkapp/edge v0.0.13
  * MIT License
  *
  * LengkApp Edge License

package/dist/edge-server.d.ts

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.12
+ * @lengkapp/edge v0.0.13
  * MIT License
  *
  * LengkApp Edge License
@@ -109,7 +109,15 @@ interface RateLimitOptions {
 }
 
 interface CorsOptions {
-  origin?: string;
+  /**
+   * Allowed origin(s).
+   * - `'*'` (default) preserves legacy wildcard behavior.
+   * - A specific string matches that origin and enables
+   *   `Access-Control-Allow-Credentials: true`.
+   * - An array is treated as a strict allowlist; the request `Origin`
+   *   is reflected back only when it matches, and `Vary: Origin` is set.
+   */
+  origin?: string | string[];
   methods?: string;
   headers?: string;
 }
@@ -129,14 +137,75 @@ interface RouteOptions {
   log?: boolean;
 }
 
+/**
+ * Security controls for the Edge instance. All fields are optional and
+ * default to values that preserve legacy runtime behavior.
+ */
+interface SecurityOptions {
+  /**
+   * When `true`, tokens are SHA-256 hashed (hex, prefixed with `tok:`) before
+   * being used as the KV key in `_processAuth`. Enable only after migrating
+   * existing tokens to hashed keys.
+   *
+   * @default false
+   */
+  hashAuthTokens?: boolean;
+
+  /**
+   * When `true`, structured JSON security events (auth failures, rate limit
+   * hits, handler errors, etc.) are emitted to `console.log`. Events are
+   * deduplicated per `(event, ip, path)` over a 60-second window to avoid
+   * log flooding.
+   *
+   * @default true
+   */
+  logSecurityEvents?: boolean;
+
+  /**
+   * Additional response headers applied to every `Context` before the
+   * handler runs. Useful for HSTS, COOP/COEP, CORP, etc.
+   *
+   * @default null
+   */
+  extraHeaders?: Record<string, string> | null;
+
+  /**
+   * Reserved for future IP-trust configuration. Currently unused.
+   *
+   * @default null
+   */
+  trustedProxies?: string[] | null;
+}
+
 type RouteHandler = (ctx: Context) => Response | JSXElement | void | Promise<Response | JSXElement | void>;
 
+type ScheduledHandler = (
+  controller: ScheduledController,
+  env: any,
+  ctx: ExecutionContext
+) => void | Promise<void>;
+
 export class Edge {
   constructor();
 
   authKvBinding: string;
   rateLimitKvBinding: string;
-  scheduledHandler: ((controller: ScheduledController, env: any, ctx: ExecutionContext) => void | Promise<void>) | null;
+
+  /**
+   * Defaults applied to every route unless overridden at registration time.
+   * `cors.origin` accepts a string or string[] — see `CorsOptions`.
+   */
+  defaults: {
+    cors: CorsOptions;
+  };
+
+  scheduledHandler: ScheduledHandler | null;
+
+  /**
+   * Security controls. Mutate after construction to opt into hardened
+   * behavior; see `SecurityOptions`.
+   */
+  security: Required<SecurityOptions>;
 
   get(path: string, handler: RouteHandler): void;
   get(path: string, options: boolean | RouteOptions, handler: RouteHandler): void;
@@ -159,7 +228,7 @@ export class Edge {
   head(path: string, handler: RouteHandler): void;
   head(path: string, options: boolean | RouteOptions, handler: RouteHandler): void;
 
-  scheduled(handler: (controller: ScheduledController, env: any, ctx: ExecutionContext) => void | Promise<void>): void;
+  scheduled(handler: ScheduledHandler): void;
 
   fetch(request: Request, env: any, executionCtx: ExecutionContext): Promise<Response>;
 }

package/dist/edge-server.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.12
+ * @lengkapp/edge v0.0.13
  * MIT License
  *
  * LengkApp Edge License
@@ -30,4 +30,4 @@
  * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
-var t=Object.defineProperty,e=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,o=Object.prototype.hasOwnProperty,r=(e,n)=>{for(var o in n)t(e,o,{get:n[o],enumerable:!0})},s=(r,s,i,c)=>{if(s&&"object"==typeof s||"function"==typeof s)for(let a of n(s))o.call(r,a)||a===i||t(r,a,{get:()=>s[a],enumerable:!(c=e(s,a))||c.enumerable});return r},i=e=>s(t({},"__esModule",{value:!0}),e),c={};function a(t){const e=[],n=t.length;let o=1;for(let r=1;r<=n;r++)r!==n&&47!==t.charCodeAt(r)||(r>o&&e.push(t.slice(o,r)),o=r+1);return e}function l(t){const e=t.length;return e>1&&47===t.charCodeAt(e-1)?t.slice(0,-1):t}r(c,{Edge:()=>Edge,Fragment:()=>Fragment,jsx:()=>jsx,renderToString:()=>renderToString}),module.exports=i(c);var u=class{constructor(t,e,n,o={},r=null){this.req=t,this.env=e,this.executionCtx=n,this.params=o,this.status=200,this.headers=new Headers,this.t=t.headers.get("Cookie")||"",this.o=null,this.url=r||new URL(t.url)}i(){if(null===this.o){const t=Object.create(null);if(this.t)for(const e of this.t.split(";")){const n=e.trim();if(!n)continue;const o=n.indexOf("=");if(o>0){const e=decodeURIComponent(n.slice(0,o)),r=decodeURIComponent(n.slice(o+1));t[e]=r}}this.o=t}return this.o}getCookie(t){return this.i()[t]??null}get query(){return this.url.searchParams}setCookie(t,e,n={}){let o=`${encodeURIComponent(t)}=${encodeURIComponent(e)}`;n.path&&(o+=`; Path=${n.path}`),n.domain&&(o+=`; Domain=${n.domain}`),void 0!==n.maxAge&&(o+=`; Max-Age=${n.maxAge}`),n.expires&&(o+=`; Expires=${n.expires.toUTCString()}`),n.secure&&(o+="; Secure"),n.httpOnly&&(o+="; HttpOnly"),n.sameSite&&(o+=`; SameSite=${n.sameSite}`),this.headers.append("Set-Cookie",o)}deleteCookie(t,e={}){this.setCookie(t,"",{...e,maxAge:0,expires:new Date(0)})}text(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","text/plain"),new Response(t,{status:e,headers:o})}json(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","application/json"),new Response(JSON.stringify(t),{status:e,headers:o})}html(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","text/html"),new Response(t,{status:e,headers:o})}l(t){if(0===Object.keys(t).length)return this.headers;const e=new Headers(this.headers);for(const n in t)Object.prototype.hasOwnProperty.call(t,n)&&e.set(n,t[n]);return e}},Fragment=Symbol("Fragment");function jsx(t,e,...n){return{type:t,props:e||{},children:n.flat(1/0),__isJSX:!0}}var f=new Set(["area","base","br","col","embed","hr","img","input","link","meta","param","source","track","wbr"]),h=new Set(["allowfullscreen","async","autofocus","autoplay","checked","controls","default","defer","disabled","formnovalidate","hidden","inert","ismap","itemscope","loop","multiple","muted","nomodule","novalidate","open","playsinline","readonly","required","reversed","selected"]),d=new Set(["animation-iteration-count","border-image-outset","border-image-slice","border-image-width","box-flex","box-flex-group","box-ordinal-group","column-count","columns","flex","flex-grow","flex-positive","flex-shrink","flex-negative","flex-order","grid-row","grid-row-end","grid-row-span","grid-row-start","grid-column","grid-column-end","grid-column-span","grid-column-start","font-weight","line-clamp","line-height","opacity","order","orphans","tab-size","widows","z-index","zoom","fill-opacity","flood-opacity","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-miterlimit","stroke-opacity","stroke-width"]),p={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#039;"},m=/[&<>"']/g;function w(t){return m.lastIndex=0,m.test(t)?t.replace(m,t=>p[t]):t}var y=new Map,g=2e3;function T(t){const e=y.get(t);if(void 0!==e)return e;const n=t.replace(/([A-Z])/g,"-$1").toLowerCase().replace(/^-/,"");return y.size>=g&&y.clear(),y.set(t,n),n}function b(t){if(!t||"object"!=typeof t)return"";const e=Object.entries(t);return 0===e.length?"":e.map(([t,e])=>{let n=T(t);return"number"!=typeof e||d.has(n)||(e=`${e}px`),`${n}:${e}`}).join(";")}function renderToString(t){if(null==t||"boolean"==typeof t)return"";if("string"==typeof t||"number"==typeof t)return w(String(t));if(Array.isArray(t)){const e=[];for(let n=0;n<t.length;n++)e.push(renderToString(t[n]));return e.join("")}if(!t.__isJSX)return w(String(t));const{type:e,props:n,children:o}=t;if(e===Fragment){const t=[];for(let e=0;e<o.length;e++)t.push(renderToString(o[e]));return t.join("")}if("symbol"==typeof e)return"";if("function"==typeof e)return renderToString(e({...n,children:o}));const r=f.has(e),s=[];for(const t in n){if(!Object.prototype.hasOwnProperty.call(n,t))continue;if("children"===t||"key"===t||"ref"===t)continue;const e=n[t];if(null==e||!1===e)continue;if("dangerouslySetInnerHTML"===t)continue;let o=t;if("className"===t||"class"===t?o="class":"htmlFor"!==t&&"for"!==t||(o="for"),h.has(o))!0===e&&s.push(` ${o}`);else if(!0!==e){if("style"===o&&"object"==typeof e){const t=b(e);t&&s.push(` style="${w(t)}"`);continue}s.push(` ${o}="${w(String(e))}"`)}else s.push(` ${o}="true"`)}const i=s.join("");let c="";if(n&&n.dangerouslySetInnerHTML&&null!=n.dangerouslySetInnerHTML.__html)c=n.dangerouslySetInnerHTML.__html;else{const t=[];for(let e=0;e<o.length;e++)t.push(renderToString(o[e]));c=t.join("")}return r?`<${e}${i}/>`:`<${e}${i}>${c}</${e}>`}var C=class{constructor(){this.children=null,this.paramChild=null,this.handler=null}},$=class{constructor(){this.root=new C}add(t,e,n){let o=this.root;const r=[];for(let e=0;e<t.length;e++){const n=t[e];if(58===n.charCodeAt(0))r.push(n.slice(1)),o.paramChild||(o.paramChild=new C),o=o.paramChild;else{o.children||(o.children=new Map);let t=o.children.get(n);t||(t=new C,o.children.set(n,t)),o=t}}o.handler={handler:e,options:n,paramNames:r}}match(t){const e=[],n=this.u(this.root,t,0,e);if(!n)return null;const{handler:o,options:r,paramNames:s}=n,i={};for(let t=0;t<s.length;t++)i[s[t]]=e[t];return{handler:o,options:r,params:i}}u(t,e,n,o){if(n===e.length)return t.handler;const r=e[n];if(t.children){const s=t.children.get(r);if(s){const t=this.u(s,e,n+1,o);if(t)return t}}if(t.paramChild){o.push(r);const s=this.u(t.paramChild,e,n+1,o);if(s)return s;o.pop()}return null}},E=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD"],Edge=class{constructor(){this.staticRoutes=new Map;for(const t of E)this.staticRoutes.set(t,new Map);this.dynamicTries={};for(const t of E)this.dynamicTries[t]=new $;this.authKvBinding="AUTH_KV",this.rateLimitKvBinding="RATE_LIMIT_KV",this.defaults={cors:{origin:"*",methods:"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"}},this.scheduledHandler=null}h(t,e,n,o){if("boolean"==typeof n&&(n={auth:n}),"function"==typeof n&&(o=n,n={}),"function"!=typeof o)throw new Error(`Handler for ${t} ${e} must be a function`);const r={...this.defaults,...n||{}};if(-1===e.indexOf(":")){const n=l(e);this.staticRoutes.get(t).set(n,{handler:o,options:r})}else{const n=a(e);this.dynamicTries[t].add(n,o,r)}}get(t,e,n){this.h("GET",t,e,n)}post(t,e,n){this.h("POST",t,e,n)}put(t,e,n){this.h("PUT",t,e,n)}delete(t,e,n){this.h("DELETE",t,e,n)}patch(t,e,n){this.h("PATCH",t,e,n)}options(t,e,n){this.h("OPTIONS",t,e,n)}head(t,e,n){this.h("HEAD",t,e,n)}scheduled(t){this.scheduledHandler=t}async p(t,e){if(!e)return!0;const n=t.getCookie("auth_token")||t.req.headers.get("Authorization")?.replace(/^Bearer\s+/i,"");if(!n)return!1;const o=t.env[this.authKvBinding];if(!o)return!1;const r=await o.get(n);if(!r)return!1;if("object"==typeof e)try{const t=JSON.parse(r);if(e.role&&t.role!==e.role)return!1;if(e.scopes){const n=t.scopes||[];if(!e.scopes.every(t=>n.includes(t)))return!1}}catch{}return!0}async m(t,e){if(!e)return!0;const n=!0===e?{}:e,{max:o=100,window:r=60}=n,s=`rl:${t.req.headers.get("CF-Connecting-IP")||"unknown"}`,i=t.env[this.rateLimitKvBinding];if(!i)return!0;let c=await i.get(s,"json")||0;return!(c>=o||(c++,await i.put(s,JSON.stringify(c),{expirationTtl:r}),0))}T(t,e){if(!e)return;const n="object"==typeof e?e:this.defaults.cors;t.headers.set("Access-Control-Allow-Origin",n.origin||"*"),t.headers.set("Access-Control-Allow-Methods",n.methods||"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"),t.headers.set("Access-Control-Allow-Headers",n.headers||"Content-Type, Authorization"),t.headers.set("Access-Control-Max-Age","86400")}C(t,e){e&&console.log(`${t.req.method} ${t.req.url} - ${t.status}`)}$(t,e){const n=t.headers.get("Accept-Encoding")||"";let o=null;if(n.includes("gzip")?o="gzip":n.includes("deflate")&&(o="deflate"),!o||!e.body)return e;const r=e.body.pipeThrough(new CompressionStream(o)),s=new Headers(e.headers);return s.set("Content-Encoding",o),s.set("Vary","Accept-Encoding"),s.delete("Content-Length"),new Response(r,{status:e.status,statusText:e.statusText,headers:s})}async S(t,e){if(!e)return!0;if("function"==typeof e)try{return!!await e(t)}catch{return!1}return!0}async A(t){const e=caches.default;return await e.match(t)||null}async O(t,e,n){if(!n)return;const o=!0===n?{}:n,{ttl:r=3600,staleWhileRevalidate:s=0}=o,i=caches.default,c=e.clone();c.headers.set("Cache-Control",`max-age=${r}${s>0?`, stale-while-revalidate=${s}`:""}`),c.headers.delete("Set-Cookie"),await i.put(t,c)}async fetch(t,e,n){const o=new URL(t.url),r=l(o.pathname),s=t.method,i=this.staticRoutes.get(s);if(i){const s=i.get(r);if(s)return this._(s.handler,s.options,t,e,n,{},o)}const c=this.dynamicTries[s];if(c){const s=a(r),i=c.match(s);if(i)return this._(i.handler,i.options,t,e,n,i.params,o)}return new Response("Not Found",{status:404})}async _(t,e,n,o,r,s,i){const c=new u(n,o,r,s,i);if(!await this.S(c,e.validate))return c.text("Validation failed",400);if(!await this.p(c,e.auth))return c.text("Unauthorized",401);if(!await this.m(c,e.rateLimit))return c.text("Too Many Requests",429);let a,l=null;if(e.cache&&"GET"===n.method&&(l=await this.A(n),l))return this.T(c,e.cors),this.C(c,e.log),l;this.T(c,e.cors);try{const e=await t(c);a=e&&e.__isJSX?c.html(renderToString(e)):e instanceof Response?e:c.text("OK"),c.status=a.status}catch(t){console.error(t),a=c.text("Internal Server Error",500),c.status=500}return e.cache&&"GET"===n.method&&200===a.status&&c.executionCtx.waitUntil(this.O(n,a.clone(),e.cache)),e.compress&&(a=this.$(n,a)),this.C(c,e.log),a}};
+var t=Object.defineProperty,e=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,o=Object.prototype.hasOwnProperty,r=(e,n)=>{for(var o in n)t(e,o,{get:n[o],enumerable:!0})},i=(r,i,s,a)=>{if(i&&"object"==typeof i||"function"==typeof i)for(let c of n(i))o.call(r,c)||c===s||t(r,c,{get:()=>i[c],enumerable:!(a=e(i,c))||a.enumerable});return r},s=e=>i(t({},"__esModule",{value:!0}),e),a={};function c(t){const e=[],n=t.length;let o=1;for(let r=1;r<=n;r++)r!==n&&47!==t.charCodeAt(r)||(r>o&&e.push(t.slice(o,r)),o=r+1);return e}function l(t){const e=t.length;return e>1&&47===t.charCodeAt(e-1)?t.slice(0,-1):t}r(a,{Edge:()=>Edge,Fragment:()=>Fragment,jsx:()=>jsx,renderToString:()=>renderToString}),module.exports=s(a);var u=new Set(["__proto__","constructor","prototype"]);function f(t){return"string"==typeof t&&!u.has(t)}function h(t){const e=JSON.parse(t);if(e&&"object"==typeof e)for(const t of Object.keys(e))if(!f(t))throw new SyntaxError("Forbidden key in JSON payload");return e}var p=class{constructor(t,e,n,o={},r=null){this.req=t,this.env=e,this.executionCtx=n,this.params=o,this.status=200,this.headers=new Headers,this.headers.set("X-Content-Type-Options","nosniff"),this.headers.set("Referrer-Policy","strict-origin-when-cross-origin"),this.t=t.headers.get("Cookie")||"",this.o=null,this.url=r||new URL(t.url)}i(){if(null===this.o){const t=Object.create(null);if(this.t)for(const e of this.t.split(";")){const n=e.trim();if(!n)continue;const o=n.indexOf("=");if(o>0)try{const e=decodeURIComponent(n.slice(0,o)),r=decodeURIComponent(n.slice(o+1));f(e)&&(t[e]=r)}catch{}}this.o=t}return this.o}getCookie(t){return this.i()[t]??null}get query(){return this.url.searchParams}setCookie(t,e,n={}){if("string"!=typeof t||!f(t)||/[\r\n;=]/.test(t))return;let o=`${encodeURIComponent(t)}=${encodeURIComponent(e)}`;n.path&&(o+=`; Path=${n.path}`),n.domain&&(o+=`; Domain=${n.domain}`),void 0!==n.maxAge&&(o+=`; Max-Age=${n.maxAge}`),n.expires&&(o+=`; Expires=${n.expires.toUTCString()}`),n.secure&&(o+="; Secure"),n.httpOnly&&(o+="; HttpOnly"),n.sameSite&&(o+=`; SameSite=${n.sameSite}`),this.headers.append("Set-Cookie",o)}deleteCookie(t,e={}){this.setCookie(t,"",{...e,maxAge:0,expires:new Date(0)})}text(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","text/plain; charset=utf-8"),new Response(t,{status:e,headers:o})}json(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","application/json; charset=utf-8"),new Response(JSON.stringify(t),{status:e,headers:o})}html(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","text/html; charset=utf-8"),new Response(t,{status:e,headers:o})}l(t){if(0===Object.keys(t).length)return this.headers;const e=new Headers(this.headers);for(const n in t)Object.prototype.hasOwnProperty.call(t,n)&&e.set(n,t[n]);return e}},Fragment=Symbol("Fragment");function jsx(t,e,...n){return{type:t,props:e||{},children:n.flat(1/0),__isJSX:!0}}var d=new Set(["area","base","br","col","embed","hr","img","input","link","meta","param","source","track","wbr"]),y=new Set(["allowfullscreen","async","autofocus","autoplay","checked","controls","default","defer","disabled","formnovalidate","hidden","inert","ismap","itemscope","loop","multiple","muted","nomodule","novalidate","open","playsinline","readonly","required","reversed","selected"]),w=new Set(["animation-iteration-count","border-image-outset","border-image-slice","border-image-width","box-flex","box-flex-group","box-ordinal-group","column-count","columns","flex","flex-grow","flex-positive","flex-shrink","flex-negative","flex-order","grid-row","grid-row-end","grid-row-span","grid-row-start","grid-column","grid-column-end","grid-column-span","grid-column-start","font-weight","line-clamp","line-height","opacity","order","orphans","tab-size","widows","z-index","zoom","fill-opacity","flood-opacity","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-miterlimit","stroke-opacity","stroke-width"]),g={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#039;"},m=/[&<>"']/g;function b(t){return m.lastIndex=0,m.test(t)?t.replace(m,t=>g[t]):t}var A=new Map,_=2e3;function T(t){const e=A.get(t);if(void 0!==e)return e;const n=t.replace(/([A-Z])/g,"-$1").toLowerCase().replace(/^-/,"");return A.size>=_&&A.clear(),A.set(t,n),n}function C(t){if(!t||"object"!=typeof t)return"";const e=Object.entries(t);return 0===e.length?"":e.map(([t,e])=>{let n=T(t);return"number"!=typeof e||w.has(n)||(e=`${e}px`),`${n}:${e}`}).join(";")}function renderToString(t){if(null==t||"boolean"==typeof t)return"";if("string"==typeof t||"number"==typeof t)return b(String(t));if(Array.isArray(t)){const e=[];for(let n=0;n<t.length;n++)e.push(renderToString(t[n]));return e.join("")}if(!t.__isJSX)return b(String(t));const{type:e,props:n,children:o}=t;if(e===Fragment){const t=[];for(let e=0;e<o.length;e++)t.push(renderToString(o[e]));return t.join("")}if("symbol"==typeof e)return"";if("function"==typeof e)return renderToString(e({...n,children:o}));if("string"!=typeof e||!/^[A-Za-z][A-Za-z0-9-]*$/.test(e))return"";const r=d.has(e),i=[];for(const t in n){if(!Object.prototype.hasOwnProperty.call(n,t))continue;if("children"===t||"key"===t||"ref"===t)continue;const e=n[t];if(null==e||!1===e)continue;if("dangerouslySetInnerHTML"===t)continue;let o=t;if("className"===t||"class"===t?o="class":"htmlFor"!==t&&"for"!==t||(o="for"),f(o)&&!/^on/i.test(o)&&/^[A-Za-z_:][A-Za-z0-9_:.-]*$/.test(o)){if("href"===o||"src"===o||"xlink:href"===o||"action"===o||"formaction"===o){const t=String(e).replace(/[\u0000-\u0020]/g,"").toLowerCase();if(t.startsWith("javascript:")||t.startsWith("vbscript:")||t.startsWith("data:text/html"))continue}if(y.has(o))!0===e&&i.push(` ${o}`);else if(!0!==e){if("style"===o&&"object"==typeof e){const t=C(e);t&&i.push(` style="${b(t)}"`);continue}i.push(` ${o}="${b(String(e))}"`)}else i.push(` ${o}="true"`)}}const s=i.join("");let a="";if(n&&n.dangerouslySetInnerHTML&&null!=n.dangerouslySetInnerHTML.__html)a=n.dangerouslySetInnerHTML.__html;else{const t=[];for(let e=0;e<o.length;e++)t.push(renderToString(o[e]));a=t.join("")}return r?`<${e}${s}/>`:`<${e}${s}>${a}</${e}>`}var k=class{constructor(){this.children=null,this.paramChild=null,this.handler=null}},O=class{constructor(){this.root=new k}add(t,e,n){let o=this.root;const r=[];for(let e=0;e<t.length;e++){const n=t[e];if(58===n.charCodeAt(0)){const t=n.slice(1);r.push(f(t)?t:`_p${e}`),o.paramChild||(o.paramChild=new k),o=o.paramChild}else{o.children||(o.children=new Map);let t=o.children.get(n);t||(t=new k,o.children.set(n,t)),o=t}}o.handler={handler:e,options:n,paramNames:r}}match(t){const e=[],n=this.u(this.root,t,0,e);if(!n)return null;const{handler:o,options:r,paramNames:i}=n,s=Object.create(null);for(let t=0;t<i.length;t++)s[i[t]]=e[t];return{handler:o,options:r,params:s}}u(t,e,n,o){if(n===e.length)return t.handler;const r=e[n];if(t.children){const i=t.children.get(r);if(i){const t=this.u(i,e,n+1,o);if(t)return t}}if(t.paramChild){o.push(r);const i=this.u(t.paramChild,e,n+1,o);if(i)return i;o.pop()}return null}},$=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD"],S=new Map;function x(t,e,n){const o=`${t}|${e||""}|${n||""}`,r=Date.now(),i=S.get(o);if(i&&r-i<6e4)return!1;if(S.set(o,r),S.size>5e3)for(const[t,e]of S)r-e>6e4&&S.delete(t);return!0}var Edge=class{constructor(){this.staticRoutes=new Map;for(const t of $)this.staticRoutes.set(t,new Map);this.dynamicTries={};for(const t of $)this.dynamicTries[t]=new O;this.authKvBinding="AUTH_KV",this.rateLimitKvBinding="RATE_LIMIT_KV",this.defaults={cors:{origin:"*",methods:"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"}},this.scheduledHandler=null,this.security={hashAuthTokens:!1,logSecurityEvents:!0,extraHeaders:null,trustedProxies:null}}h(t,e,n,o){if("boolean"==typeof n&&(n={auth:n}),"function"==typeof n&&(o=n,n={}),"function"!=typeof o)throw new Error(`Handler for ${t} ${e} must be a function`);const r={...this.defaults,...n||{}};if(-1===e.indexOf(":")){const n=l(e);this.staticRoutes.get(t).set(n,{handler:o,options:r})}else{const n=c(e);this.dynamicTries[t].add(n,o,r)}}get(t,e,n){this.h("GET",t,e,n)}post(t,e,n){this.h("POST",t,e,n)}put(t,e,n){this.h("PUT",t,e,n)}delete(t,e,n){this.h("DELETE",t,e,n)}patch(t,e,n){this.h("PATCH",t,e,n)}options(t,e,n){this.h("OPTIONS",t,e,n)}head(t,e,n){this.h("HEAD",t,e,n)}scheduled(t){this.scheduledHandler=t}p(t,e,n){if(this.security.logSecurityEvents)try{const o=t.req.headers.get("CF-Connecting-IP")||"",r=t.url?t.url.pathname:"";if(!x(e,o,r))return;const i={ts:(new Date).toISOString(),kind:"security",event:e,detail:"string"==typeof n?n:void 0,ip:o||void 0,method:t.req.method,path:r,ua:t.req.headers.get("User-Agent")||void 0};console.log(JSON.stringify(i))}catch{}}async m(t,e){if(!e)return{ok:!0};const n=t.getCookie("auth_token")||t.req.headers.get("Authorization")?.replace(/^Bearer\s+/i,"");if(!n)return{ok:!1,reason:"missing_token"};const o=t.env[this.authKvBinding];if(!o)return{ok:!1,reason:"kv_unavailable"};let r,i=n;if(this.security.hashAuthTokens&&globalThis.crypto&&crypto.subtle){const t=await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(n)),e=new Uint8Array(t);let o="";for(let t=0;t<e.length;t++)o+=e[t].toString(16).padStart(2,"0");i="tok:"+o}try{r=await o.get(i)}catch(t){return{ok:!1,reason:"kv_error"}}if(!r)return{ok:!1,reason:"invalid_token"};if("object"==typeof e&&null!==e){let t;try{t=h(r)}catch{return{ok:!1,reason:"malformed_payload"}}if(t&&"object"==typeof t){if(null!=t.exp){const e=Date.now()/1e3;if("number"==typeof t.exp&&t.exp<e)return{ok:!1,reason:"expired_token"}}if(e.role&&t.role!==e.role)return{ok:!1,reason:"insufficient_role"};if(e.scopes){const n=Array.isArray(t.scopes)?t.scopes:[];for(let t=0;t<e.scopes.length;t++)if(-1===n.indexOf(e.scopes[t]))return{ok:!1,reason:"insufficient_scopes"}}}}return{ok:!0,payload:r}}async A(t,e){if(!e)return!0;const n=!0===e?{}:e,{max:o=100,window:r=60}=n,i=`rl:${t.req.headers.get("CF-Connecting-IP")||"unknown"}`,s=t.env[this.rateLimitKvBinding];if(!s)return!0;let a;try{a=await s.get(i,"json")}catch{return!0}if(("number"!=typeof a||!isFinite(a)||a<0)&&(a=0),a>=o)return!1;a++;try{await s.put(i,JSON.stringify(a),{expirationTtl:r})}catch{}return!0}_(t,e){if(!e)return;const n="object"==typeof e?e:this.defaults.cors,o=t.req.headers.get("Origin"),r=n.origin;"*"===r?t.headers.set("Access-Control-Allow-Origin","*"):Array.isArray(r)?o&&-1!==r.indexOf(o)&&(t.headers.set("Access-Control-Allow-Origin",o),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")):"string"==typeof r&&o===r&&(t.headers.set("Access-Control-Allow-Origin",o),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")),t.headers.set("Access-Control-Allow-Methods",n.methods||"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"),t.headers.set("Access-Control-Allow-Headers",n.headers||"Content-Type, Authorization"),t.headers.set("Access-Control-Max-Age","86400")}T(t,e){e&&console.log(`${t.req.method} ${t.req.url} - ${t.status}`)}C(t,e){const n=t.headers.get("Accept-Encoding")||"";let o=null;if(n.includes("gzip")?o="gzip":n.includes("deflate")&&(o="deflate"),!o||!e.body)return e;const r=e.body.pipeThrough(new CompressionStream(o)),i=new Headers(e.headers);return i.set("Content-Encoding",o),i.set("Vary","Accept-Encoding"),i.delete("Content-Length"),new Response(r,{status:e.status,statusText:e.statusText,headers:i})}async k(t,e){return!e||("function"!=typeof e||!!await e(t))}async O(t){const e=caches.default;return await e.match(t)||null}async $(t,e,n){if(!n)return;const o=!0===n?{}:n,{ttl:r=3600,staleWhileRevalidate:i=0}=o,s=caches.default,a=e.clone();a.headers.set("Cache-Control",`max-age=${r}${i>0?`, stale-while-revalidate=${i}`:""}`),a.headers.delete("Set-Cookie"),await s.put(t,a)}async fetch(t,e,n){const o=new URL(t.url),r=l(o.pathname),i=t.method,s=this.staticRoutes.get(i);if(s){const i=s.get(r);if(i)return this.S(i.handler,i.options,t,e,n,Object.create(null),o)}const a=this.dynamicTries[i];if(a){const i=c(r),s=a.match(i);if(s)return this.S(s.handler,s.options,t,e,n,s.params,o)}return new Response("Not Found",{status:404})}async S(t,e,n,o,r,i,s){const a=new p(n,o,r,i,s);if(this.security.extraHeaders)for(const t in this.security.extraHeaders)Object.prototype.hasOwnProperty.call(this.security.extraHeaders,t)&&a.headers.set(t,this.security.extraHeaders[t]);let c,l=!1;try{l=await this.k(a,e.validate)}catch(t){this.p(a,"validation_error",t&&t.message),l=!1}if(!l)return a.text("Validation failed",400);try{c=await this.m(a,e.auth)}catch(t){this.p(a,"auth_error",t&&t.message),c={ok:!1,reason:"auth_error"}}if(!("boolean"==typeof c?c:c&&c.ok)){const t=c&&c.reason||"denied";return this.p(a,"auth_failure",t),a.text("Unauthorized",401)}let u=!1;try{u=await this.A(a,e.rateLimit)}catch(t){this.p(a,"rate_limit_error",t&&t.message),u=!1}if(!u)return this.p(a,"rate_limit_exceeded",null),a.text("Too Many Requests",429,{"Retry-After":"60"});let f,h=null;if(e.cache&&"GET"===n.method&&(h=await this.O(n),h))return this._(a,e.cors),this.T(a,e.log),h;this._(a,e.cors);try{const e=await t(a);f=e&&e.__isJSX?a.html(renderToString(e)):e instanceof Response?e:a.text("OK"),a.status=f.status}catch(t){this.p(a,"handler_error",t&&t.message),f=a.text("Internal Server Error",500),a.status=500}return e.cache&&"GET"===n.method&&200===f.status&&a.executionCtx.waitUntil(this.$(n,f.clone(),e.cache)),e.compress&&(f=this.C(n,f)),this.T(a,e.log),f}};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lengkapp/edge",
-  "version": "0.0.12",
+  "version": "0.0.13",
   "description": "Edge framework used by Lengkapp",
   "main": "dist/edge-server.js",
   "types": "dist/edge-server.d.ts",

package/readme.md

@@ -4,19 +4,35 @@ A minimal, high-performance framework for Cloudflare Workers with built-in serve
 
 Inspired by [Hono](https://hono.dev), @lengkapp/edge aims for the same class of performance while shipping with **zero runtime dependencies**. See [Performance](#performance) for a local benchmark against Hono, `hono/tiny`, and a plain native Workers handler.
 
+> **Security:** This release hardens both the server and the client against the OWASP Top 10:2025 and ASVS 5.0 Layer 1 controls. See [Security](#security-controls) for the full breakdown of what's protected and how to opt into the strongest settings.
+
 ---
 
 ## Features
 
+### Server
 - **Trie-based routing** – static & dynamic routes (`/users/:id`) with fast lookups.
 - **JSX support** – render JSX components to HTML without a build step (using `jsx` and `renderToString`).
 - **Middleware options** – authentication, rate limiting, CORS, logging, caching, compression, and custom validation.
 - **Cookie helpers** – set, get, and delete cookies with flexible options.
-- **Declarative client** – enhance HTML with `_get`, `_post`, `_target`, `_trigger` attributes to fetch and replace content dynamically, with skeleton loaders and retry buttons.
-- **Resource injection** – automatically load CSS/JS files from response headers.
 - **Scheduled tasks** – built-in support for Cron triggers.
 - **Zero dependencies** – lightweight and fast.
 
+### Client
+- **Declarative partial updates** – enhance HTML with `_get`, `_post`, `_target`, `_trigger` attributes to fetch and replace content dynamically.
+- **Skeleton loaders & retry UI** – built-in loading and error states.
+- **Safe DOM updates** – server responses are parsed with `DOMParser` and inserted via `importNode`; scripts are stripped and never re-executed.
+- **CSRF-aware** – state-changing requests automatically send `X-CSRF-Token` from a `<meta name="csrf-token">` tag or an `XSRF-TOKEN` cookie.
+- **Trusted Types aware** – plays nicely with a `require-trusted-types-for 'script'` CSP.
+
+### Security (both)
+- **Prototype-pollution safe** – route params, cookies, JSON payloads, and JSX attributes all use forbidden-key filtering.
+- **XSS-hardened JSX** – event handlers (`on*`), malformed tag/attr names, and `javascript:`/`data:text/html` URIs are blocked.
+- **Structured security logging** – auth failures, rate-limit hits, and handler errors emit throttled JSON events.
+- **Fail-closed middleware** – validation, auth, and rate-limit errors deny by default.
+- **Opt-in token hashing** – SHA-256 hash auth tokens before KV lookup.
+- **Strict CORS allowlist** – supports per-origin reflection with `Vary: Origin` and credentials.
+
 ---
 
 ## Installation
@@ -25,11 +41,9 @@ Inspired by [Hono](https://hono.dev), @lengkapp/edge aims for the same class of
 npm install @lengkapp/edge
 ```
 
----
-
 ## Quick Start
 
-**1. Create a worker script (`worker.js` or `src/index.ts`):**
+**1. Create a worker script** (`worker.js` or `src/index.ts`):
 
 ```ts
 import { Edge, renderToString } from '@lengkapp/edge';
@@ -49,7 +63,7 @@ export default {
 
 **2. Create `wrangler.jsonc`:**
 
-Cloudflare recommends `wrangler.jsonc` for new projects (TOML is still supported — see [Configuration](#configuration)).
+> Cloudflare recommends `wrangler.jsonc` for new projects (TOML is still supported — see [Configuration](#configuration)).
 
 ```jsonc
 {
@@ -105,16 +119,16 @@ Supported methods: `get`, `post`, `put`, `delete`, `patch`, `options`, `head`.
 Each handler receives a `Context` object (`ctx`) with the following members:
 
 | Property / Method | Description |
-| --- | --- |
+|---|---|
 | `ctx.req` | The original `Request` object |
 | `ctx.env` | The environment bindings (KV, secrets, etc.) |
 | `ctx.executionCtx` | The `ExecutionContext` (for `waitUntil`) |
-| `ctx.params` | Route parameters (e.g., `{ id: '123' }`) |
-| `ctx.status` | HTTP status code (default `200`) |
+| `ctx.params` | Route parameters (prototype-safe object) |
+| `ctx.status` | HTTP status code (default 200) |
 | `ctx.headers` | `Headers` object for the response |
 | `ctx.query` | `URLSearchParams` (lazy) |
 | `ctx.getCookie(name)` | Get a cookie value |
-| `ctx.setCookie(name, value, options)` | Set a cookie |
+| `ctx.setCookie(name, value, options)` | Set a cookie (name is validated) |
 | `ctx.deleteCookie(name, options)` | Delete a cookie (expires immediately) |
 | `ctx.text(data, status?, headers?)` | Return plain text |
 | `ctx.json(data, status?, headers?)` | Return JSON |
@@ -122,6 +136,13 @@ Each handler receives a `Context` object (`ctx`) with the following members:
 
 Cookie options: `path`, `domain`, `maxAge`, `expires`, `secure`, `httpOnly`, `sameSite`.
 
+Every response automatically includes these safe headers:
+
+- `X-Content-Type-Options: nosniff`
+- `Referrer-Policy: strict-origin-when-cross-origin`
+
+You can add more via `app.security.extraHeaders` (see [Security Controls](#security-controls)).
+
 ### Returning Responses
 
 You can return a `Response` object, a string (becomes text), or an object (automatically JSON).
@@ -153,9 +174,11 @@ app.get('/scoped', { auth: { scopes: ['read', 'write'] } }, handler);
 
 The client must send the token via `Authorization: Bearer <token>` or a cookie named `auth_token`.
 
+If the KV payload includes an `exp` field (Unix seconds), expired tokens are rejected with a `401`. Malformed JSON payloads are rejected with `401` and logged as a security event.
+
 #### Rate Limiting (`rateLimit`)
 
-Requires a `RATE_LIMIT_KV` binding.
+Requires a `RATE_LIMIT_KV` binding. Rate-limit responses include a `Retry-After: 60` header.
 
 ```ts
 app.get('/limited', { rateLimit: { max: 100, window: 60 } }, handler);
@@ -171,26 +194,36 @@ app.get('/cached', { cache: { ttl: 60, staleWhileRevalidate: 30 } }, handler);
 
 #### CORS (`cors`)
 
-Enables CORS headers.
+Enables CORS headers. The default (`origin: '*'`) preserves legacy behavior. For production, use a strict allowlist:
 
 ```ts
+// Legacy wildcard (default)
 app.get('/api', { cors: true }, handler);
 
-// Custom origin / methods
+// Single origin
 app.get('/api', { cors: { origin: 'https://example.com', methods: 'GET,POST' } }, handler);
+
+// Strict allowlist — reflects matching Origin, sets Vary: Origin and credentials
+app.get('/api', {
+  cors: {
+    origin: ['https://app.example.com', 'https://admin.example.com'],
+    methods: 'GET,POST,PUT,DELETE',
+    headers: 'Content-Type, Authorization, X-CSRF-Token',
+  },
+}, handler);
 ```
 
 #### Logging (`log`)
 
-Logs method, URL, and status to the console.
+Logs method, URL, and status to the console. Separately, security events (auth failures, rate-limit hits, handler errors) are logged as structured JSON when `app.security.logSecurityEvents` is `true` (the default). Events are deduplicated per `(event, IP, path)` over a 60-second window to prevent log flooding.
 
 #### Compression (`compress`)
 
-Compresses the response using gzip/deflate/br if the client supports it.
+Compresses the response using gzip/deflate if the client supports it.
 
 #### Custom Validation (`validate`)
 
-A function returning `true`/`false` (or a `Promise`) to allow/deny the request.
+A function returning `true`/`false` (or a `Promise`) to allow/deny the request. Validation errors fail closed.
 
 ```ts
 app.post('/submit', {
@@ -200,6 +233,48 @@ app.post('/submit', {
 
 ---
 
+## Security Controls
+
+All controls are optional and default to behavior that preserves previous releases. Enable them after construction:
+
+```ts
+const app = new Edge();
+
+// 1. Strict CORS allowlist (replaces the default '*')
+app.defaults.cors.origin = ['https://app.example.com', 'https://admin.example.com'];
+
+// 2. Hash auth tokens with SHA-256 before KV lookup.
+//    Only enable after migrating existing tokens to `tok:<sha256-hex>` keys.
+app.security.hashAuthTokens = true;
+
+// 3. Add HSTS, COOP, COEP, CORP at the edge.
+app.security.extraHeaders = {
+  'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
+  'Cross-Origin-Opener-Policy': 'same-origin',
+  'Cross-Origin-Resource-Policy': 'same-origin',
+};
+
+// 4. Disable structured security logs if you ship logs elsewhere.
+// app.security.logSecurityEvents = false;
+```
+
+### What's Protected
+
+| OWASP 2025 Category | Protection in @lengkapp/edge |
+|---|---|
+| A01: Broken Access Control | Structured auth result with reasons; expiry enforcement when `exp` is present; role/scope checks; strict target resolution on the client. |
+| A02: Security Misconfiguration | Safe default headers (`nosniff`, `Referrer-Policy`); strict CORS allowlist support; per-origin reflection with `Vary: Origin`. |
+| A03: Software Supply Chain | Zero runtime dependencies; SRI attributes honored on the client for `x-js-required` / `x-css-required`. |
+| A04: Cryptographic Failures | Optional SHA-256 token hashing before KV lookup (`app.security.hashAuthTokens`). |
+| A05: Injection / XSS / Prototype Pollution | `Object.create(null)` for params, cookies, and JSON; forbidden-key filtering in route segments, JSON payloads, cookie names, and JSX attributes; event-handler attributes blocked; `javascript:`/`data:text/html` URIs rejected; client uses `DOMParser` + `importNode` and never executes inline scripts. |
+| A06: Insecure Design | Numeric-sanitized rate limiter; `Retry-After` on 429; sliding counter per IP. |
+| A07: Authentication Failures | Specific failure reasons logged; no swallowed catches in the auth path. |
+| A08: Data Integrity | Prototype-safe JSON parsing for KV payloads; `Set-Cookie` stripped from cached responses. |
+| A09: Logging Failures | Structured JSON security events with 60-second dedupe window. |
+| A10: Exceptional Conditions | Validation, auth, and rate-limit middleware fail closed on errors; handler errors never leak internals. |
+
+---
+
 ## JSX Support
 
 The package includes a minimal JSX runtime. Write components as functions returning JSX.
@@ -226,6 +301,17 @@ If your handler returns a JSX element directly, Edge will automatically render i
 app.get('/auto', (ctx) => <h1>Auto rendered</h1>);
 ```
 
+### JSX Hardening
+
+`renderToString` applies the following protections automatically:
+
+- Tag names must match `^[A-Za-z][A-Za-z0-9-]*$` — anything else is dropped.
+- Attribute names must match `^[A-Za-z_:][A-Za-z0-9_:.-]*$` and are rejected if they start with `on` (event handlers never serialize).
+- `href`, `src`, `xlink:href`, `action`, and `formaction` values beginning with `javascript:`, `vbscript:`, or `data:text/html` are stripped.
+- All string values are HTML-escaped (`&`, `<`, `>`, `"`, `'`).
+- Prototype keys (`__proto__`, `constructor`, `prototype`) are rejected as attribute names.
+- `dangerouslySetInnerHTML` remains available but is opt-in and never applied to attribute values.
+
 ---
 
 ## Scheduled Tasks
@@ -262,30 +348,33 @@ Then use HTML attributes to make elements fetch content asynchronously.
 ### Attributes
 
 | Attribute | Description |
-| --- | --- |
+|---|---|
 | `_get` | URL to fetch via GET |
 | `_post` | URL to fetch via POST |
-| `_target` | CSS selector for the container to replace. Use `"this"` to replace the element itself. |
+| `_put`, `_patch`, `_delete` | Other HTTP methods |
+| `_target` | CSS selector for the container to replace. Use `"this"` to replace the element itself. Only simple selectors (`#id`, `.class`, `tag`) are accepted for safety. |
 | `_trigger` | Comma-separated list of events that trigger the fetch (default: `click`; `load` if `_target="this"`). Supported: `click`, `load`, `visible`, `intersect`, `submit`, etc. |
 | `_form` | (with `_post`) ID of a form to serialize as the POST body (URL-encoded). |
 | `_json` | (with `_post`) Comma-separated names of input fields to send as JSON. |
+| `_skeleton` | Set to `"false"` to disable the loading skeleton. |
+| `_retry` | Set to `"false"` to disable the retry button on error. |
 
 ### Examples
 
-**Load content on click:**
+Load content on click:
 
 ```html
 <button _get="/more-posts" _target="#posts" _trigger="click">Load More</button>
 <div id="posts"></div>
 ```
 
-**Auto-load on page load:**
+Auto-load on page load:
 
 ```html
 <div _get="/user-profile" _target="this"></div>
 ```
 
-**Post a form via AJAX:**
+Post a form via AJAX:
 
 ```html
 <form id="contact-form">
@@ -295,7 +384,7 @@ Then use HTML attributes to make elements fetch content asynchronously.
 <div id="result"></div>
 ```
 
-**Send JSON data:**
+Send JSON data:
 
 ```html
 <input name="username" />
@@ -303,7 +392,7 @@ Then use HTML attributes to make elements fetch content asynchronously.
 <button _post="/login" _json="username,password" _target="#status">Login</button>
 ```
 
-**Load when element becomes visible (IntersectionObserver):**
+Load when element becomes visible (IntersectionObserver):
 
 ```html
 <div _get="/lazy-content" _target="this" _trigger="visible"></div>
@@ -311,11 +400,40 @@ Then use HTML attributes to make elements fetch content asynchronously.
 
 ### Skeleton Loading
 
-While the request is in progress, the target container is filled with a skeleton loader (three shimmer bars). On error, a "Retry" button is shown.
+While the request is in progress, the target container is filled with a skeleton loader (a pulsing ring icon). On error, a "Retry" button is shown; clicking it re-runs the same request once.
+
+### Safe DOM Updates
+
+Server responses are handled as follows:
+
+- Fetched with `credentials: 'same-origin'` and `X-Requested-With: XMLHttpRequest`.
+- `Content-Type` is validated — only `text/html` and `text/plain` are accepted.
+- The HTML is parsed in a detached `DOMParser` document.
+- All `<script>` elements are removed before insertion.
+- Nodes are imported with `document.importNode()` — never `innerHTML`.
+- Any new AJAX-enabled elements in the response are bound to the same delegation system.
+
+### CSRF Protection
+
+For state-changing methods (POST, PUT, PATCH, DELETE), the client reads a CSRF token from:
+
+1. `<meta name="csrf-token" content="...">` (preferred), or
+2. The `XSRF-TOKEN` cookie.
+
+The token is sent as `X-CSRF-Token` on the request. Your server handler can verify it:
+
+```ts
+app.post('/submit', {
+  validate: (ctx) => {
+    const sent = ctx.req.headers.get('X-CSRF-Token');
+    return sent && sent === ctx.getCookie('csrf_token');
+  }
+}, handler);
+```
 
 ### Resource Injection
 
-If the server response includes headers `x-css-required` or `x-js-required`, the client will automatically inject those resources (once per URL) into the page.
+If the server response includes headers `x-css-required` or `x-js-required`, the client will automatically inject those resources (once per URL) into the page. Each URL can optionally include a matching `x-css-integrity` or `x-js-integrity` header containing a Subresource Integrity hash.
 
 Example server route:
 
@@ -323,15 +441,21 @@ Example server route:
 app.get('/widget', (ctx) => {
   ctx.headers.set('x-css-required', '["/widget.css"]');
   ctx.headers.set('x-js-required', '["/widget.js"]');
+  // Optional SRI — applies to every URL in the corresponding list
+  ctx.headers.set('x-js-integrity', 'sha384-...');
   return ctx.html('<div class="widget">...</div>');
 });
 ```
 
+### Trusted Types
+
+If your page enforces `require-trusted-types-for 'script'`, the client detects `window.trustedTypes` and creates an `aj-policy`. Only hardcoded UI strings (skeleton, retry) pass through the policy; server content never does.
+
 ---
 
 ## Configuration
 
-### `wrangler.jsonc`
+### wrangler.jsonc
 
 If you use authentication or rate limiting, you need KV namespaces. Create them first:
 
@@ -389,7 +513,7 @@ crons = ["*/5 * * * *"]
 
 </details>
 
-Wrangler supports both `wrangler.jsonc` and `wrangler.toml` — they configure the same fields, just in different syntax. Don't keep both in the same project. Keep `compatibility_date` current (Cloudflare recommends staying within the last 30 days); see the [compatibility dates docs](https://developers.cloudflare.com/workers/configuration/compatibility-dates/).
+> Wrangler supports both `wrangler.jsonc` and `wrangler.toml` — they configure the same fields, just in different syntax. Don't keep both in the same project. Keep `compatibility_date` current (Cloudflare recommends staying within the last 30 days); see the [compatibility dates docs](https://developers.cloudflare.com/workers/configuration/compatibility-dates/).
 
 ### Environment Variables
 
@@ -400,6 +524,23 @@ app.authKvBinding = 'CUSTOM_AUTH_KV';
 app.rateLimitKvBinding = 'CUSTOM_RATE_KV';
 ```
 
+### Recommended CSP
+
+The client and JSX runtime are compatible with a strict Content Security Policy. A reasonable starting point:
+
+```text
+Content-Security-Policy:
+  default-src 'self';
+  script-src 'self';
+  style-src 'self';
+  img-src 'self' data:;
+  require-trusted-types-for 'script';
+  frame-ancestors 'none';
+  base-uri 'self';
+```
+
+Set this via `app.security.extraHeaders` or at your edge/CDN layer.
+
 ---
 
 ## Full Example
@@ -410,6 +551,16 @@ import { HomePage } from './Page.jsx';
 
 const app = new Edge();
 
+// Strict CORS allowlist for production
+app.defaults.cors.origin = ['https://app.example.com'];
+
+// HSTS + isolation headers
+app.security.extraHeaders = {
+  'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
+  'Cross-Origin-Opener-Policy': 'same-origin',
+  'Cross-Origin-Resource-Policy': 'same-origin',
+};
+
 // Basic text
 app.get('/', (ctx) => ctx.text('Hello from Edge!'));
 
@@ -436,7 +587,7 @@ app.get('/cached', { cache: { ttl: 60 } }, (ctx) => ctx.text('Cached'));
 
 // Cookies
 app.get('/set-cookie', (ctx) => {
-  ctx.setCookie('session', 'abc123', { httpOnly: true, path: '/' });
+  ctx.setCookie('session', 'abc123', { httpOnly: true, secure: true, sameSite: 'Lax', path: '/' });
   return ctx.text('Cookie set');
 });
 
@@ -460,52 +611,60 @@ export default {
 
 ## Performance
 
-@lengkapp/edge is inspired by [Hono](https://hono.dev) — one of the fastest Workers frameworks around — but ships with **zero dependencies**. A quick local benchmark shows it holding its own against both Hono builds (`hono` and `hono/tiny`) and a plain native `fetch` handler with no framework at all.
+@lengkapp/edge is inspired by Hono — one of the fastest Workers frameworks around — but ships with zero dependencies. A quick local benchmark shows it holding its own against both Hono builds (`hono` and `hono/tiny`) and a plain native `fetch` handler with no framework at all.
 
 ### Test setup
 
-- **Tool:** `autocannon` — 10 connections, 10s run per route
+- **Tool:** autocannon — 10 connections, 10s run per route
 - **Target:** local `wrangler dev` server
 - **Routes:** `GET /text` (plain text) and `GET /json` (JSON)
-- **Contenders:** `@lengkapp/edge`, `hono`, `hono/tiny`, and a native Workers handler with no framework
+- **Contenders:** @lengkapp/edge, hono, hono/tiny, and a native Workers handler with no framework
 
 > This is a single local run, not a formal benchmark suite — treat the numbers as directional. Latency stdev was ±3–4 ms across all four, so differences smaller than that are within noise.
 
 ### Results
 
 | Framework | Route | Avg Req/sec | Avg Latency | Requests | Data Read |
-| --- | --- | --- | --- | --- | --- |
-| **@lengkapp/edge** | `/text` | 503.1 | 19.38 ms | 5,000 / 10.03s | 1.38 MB |
-| **@lengkapp/edge** | `/json` | **500.4** | 19.47 ms | 5,000 / 10.03s | 1.42 MB |
-| Hono | `/text` | **506.0** | 19.27 ms | 5,000 / 10.03s | 455 kB |
+|---|---|---|---|---|---|
+| @lengkapp/edge | `/text` | 503.1 | 19.38 ms | 5,000 / 10.03s | 1.38 MB |
+| @lengkapp/edge | `/json` | 500.4 | 19.47 ms | 5,000 / 10.03s | 1.42 MB |
+| Hono | `/text` | 506.0 | 19.27 ms | 5,000 / 10.03s | 455 kB |
 | Hono | `/json` | 495.2 | 19.69 ms | 5,000 / 10.03s | 426 kB |
 | Hono (`hono/tiny`) | `/text` | 505.5 | 19.28 ms | 5,000 / 10.03s | 455 kB |
 | Hono (`hono/tiny`) | `/json` | 497.9 | 19.57 ms | 5,000 / 10.03s | 428 kB |
 | Native Workers (no framework) | `/text` | 498.4 | 19.55 ms | 5,000 / 10.02s | 379 kB |
 | Native Workers (no framework) | `/json` | 499.7 | 19.51 ms | 5,000 / 10.03s | 430 kB |
 
-```mermaid
-xychart-beta
-    title "Avg requests/sec — GET /text"
-    x-axis ["@lengkapp/edge", "Hono", "Hono (tiny)", "Native Workers"]
-    y-axis "Req/sec" 490 --> 510
-    bar [503.1, 506.0, 505.5, 498.4]
-```
-
-```mermaid
-xychart-beta
-    title "Avg requests/sec — GET /json"
-    x-axis ["@lengkapp/edge", "Hono", "Hono (tiny)", "Native Workers"]
-    y-axis "Req/sec" 490 --> 505
-    bar [500.4, 495.2, 497.9, 499.7]
-```
-
 ### Takeaways
 
 - On `/json`, @lengkapp/edge posted the highest average throughput of the four, ahead of both Hono builds and the native handler.
 - On `/text`, it landed within ~1% of `hono`/`hono/tiny` and ahead of the native baseline — effectively a tie once you account for run-to-run variance.
-- All four sit in the same performance tier; the practical difference is that @lengkapp/edge gets there with **zero runtime dependencies**, matching `hono/tiny`'s footprint without having to choose a "tiny" build.
+- All four sit in the same performance tier; the practical difference is that @lengkapp/edge gets there with zero runtime dependencies, matching `hono/tiny`'s footprint without having to choose a "tiny" build.
 - @lengkapp/edge read more bytes per request than the other three in this run — worth profiling if minimal payload size matters for your use case.
+- The 2025 security hardening adds only cheap operations to the request path: prototype-safe objects (`Object.create(null)`), two regex checks per JSX attribute, and a throttled logger that skips duplicate events within 60 seconds. No new async boundaries, no hashing on the hot path (`hashAuthTokens` defaults to `false`), and no added dependencies.
+
+---
+
+## Migration Notes
+
+### Upgrading from ≤ 0.x
+
+The security release is backward-compatible. Existing apps continue to work without code changes. New defaults:
+
+- Every response now includes `X-Content-Type-Options: nosniff` and `Referrer-Policy: strict-origin-when-cross-origin`.
+- Rate-limited responses include `Retry-After: 60`.
+- Route params, cookie stores, and JSON payloads use prototype-safe objects. If you were relying on `ctx.params.hasOwnProperty(...)`, use `Object.prototype.hasOwnProperty.call(ctx.params, ...)` or `'x' in ctx.params`.
+- The JSX renderer now drops `on*` attributes. Handlers relying on server-rendered inline event handlers must be moved to the client.
+- Security events are logged as JSON. To disable: `app.security.logSecurityEvents = false`.
+
+### Client upgrade
+
+If you were using the old client that executed `<script>` tags in responses, replace those scripts with either:
+
+- DOM-based initialization (event delegation, `IntersectionObserver`, etc.), or
+- An explicit `<script src="...">` injected via `x-js-required` on the response.
+
+The new client refuses to run inline scripts for security reasons and will not execute `<script>` elements found in response bodies.
 
 ---