@lengkapp/edge 0.0.17 → 0.0.18

package/dist/edge-client.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.17
+ * @lengkapp/edge v0.0.18
  * MIT License
  *
  * LengkApp Edge License

package/dist/edge-server.d.ts

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.17
+ * @lengkapp/edge v0.0.18
  * MIT License
  *
  * LengkApp Edge License

package/dist/edge-server.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.17
+ * @lengkapp/edge v0.0.18
  * MIT License
  *
  * LengkApp Edge License

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lengkapp/edge",
-  "version": "0.0.17",
+  "version": "0.0.18",
   "description": "Edge framework used by Lengkapp",
   "main": "dist/edge-server.js",
   "types": "dist/edge-server.d.ts",

package/readme.md

@@ -2,20 +2,37 @@
 
 A minimal, high-performance framework for Cloudflare Workers with built-in server-side rendering, routing, auth, rate limiting, caching, and a declarative client-side partial-update library.
 
-Inspired by [Hono](https://hono.dev), @lengkapp/edge aims for the same class of performance while shipping with **zero runtime dependencies**. See [Performance](#performance) for a local benchmark against Hono, `hono/tiny`, and a plain native Workers handler.
+Inspired by [Hono](https://hono.dev), @lengkapp/edge aims for the same class of performance while shipping with **zero runtime dependencies**.
+
+> **Security:** Server and client are hardened against the OWASP Top 10:2025 and ASVS 5.0 Layer 1 controls. The client sanitizes every response, works under `require-trusted-types-for 'script'` CSP, is nonce-aware for script execution, and sends CSRF tokens on state-changing requests. See [Security](#security).
 
 ---
 
 ## Features
 
-- **Trie-based routing** – static & dynamic routes (`/users/:id`) with fast lookups.
-- **JSX support** – render JSX components to HTML without a build step (using `jsx` and `renderToString`).
-- **Middleware options** – authentication, rate limiting, CORS, logging, caching, compression, and custom validation.
-- **Cookie helpers** – set, get, and delete cookies with flexible options.
-- **Declarative client** – enhance HTML with `_get`, `_post`, `_target`, `_trigger` attributes to fetch and replace content dynamically, with skeleton loaders and retry buttons.
-- **Resource injection** – automatically load CSS/JS files from response headers.
-- **Scheduled tasks** – built-in support for Cron triggers.
-- **Zero dependencies** – lightweight and fast.
+### Server
+- **Trie-based routing** – static & dynamic routes (`/users/:id`).
+- **JSX support** – render JSX to HTML without a build step.
+- **Middleware** – auth, rate limiting, CORS, logging, caching, compression, validation.
+- **Cookie helpers** with validation.
+- **Scheduled tasks** via Cron triggers.
+- **Zero dependencies.**
+
+### Client
+- **Declarative partial updates** via `_get`, `_post`, `_target`, `_trigger`.
+- **Trusted Types aware** – routes all `innerHTML` through an `edge-policy` sanitizer.
+- **Nonce-aware script execution** – response scripts must match the page's CSP nonce when one exists.
+- **Built-in sanitizer** – strips `<base>`, `<meta refresh>`, `<iframe srcdoc>`, `<object>`, `<embed>`, and `javascript:`/`vbscript:`/`data:text/html` URLs.
+- **CSRF-aware** – sends `X-CSRF-Token` on `POST`/`PUT`/`PATCH`/`DELETE`.
+- **Content-Type guarded** – only `text/html` and `text/plain` responses are inserted.
+
+### Security (both)
+- **Prototype-pollution safe** – route params, cookies, JSON bodies, JSX attributes.
+- **XSS-hardened JSX** – no `on*` attributes, no `javascript:` URLs, no malformed tag names.
+- **Structured security logging** – throttled JSON events for auth/rate-limit/handler failures.
+- **Fail-closed middleware** – validation, auth, and rate limit errors deny by default.
+- **Opt-in token hashing** – SHA-256 before KV lookup.
+- **Strict CORS allowlist** – per-origin reflection with `Vary: Origin`.
 
 ---
 
@@ -25,490 +42,271 @@ Inspired by [Hono](https://hono.dev), @lengkapp/edge aims for the same class of
 npm install @lengkapp/edge
 ```
 
----
-
 ## Quick Start
 
-**1. Create a worker script (`worker.js` or `src/index.ts`):**
+`worker.js`:
 
 ```ts
-import { Edge, renderToString } from '@lengkapp/edge';
+import { Edge } from '@lengkapp/edge';
 
 const app = new Edge();
 
 app.get('/', (ctx) => ctx.text('Hello World!'));
-
-app.get('/users/:id', (ctx) => {
-  return ctx.json({ id: ctx.params.id });
-});
+app.get('/users/:id', (ctx) => ctx.json({ id: ctx.params.id }));
 
 export default {
   fetch: (request, env, ctx) => app.fetch(request, env, ctx),
 };
 ```
 
-**2. Create `wrangler.jsonc`:**
-
-Cloudflare recommends `wrangler.jsonc` for new projects (TOML is still supported — see [Configuration](#configuration)).
+`wrangler.jsonc`:
 
 ```jsonc
 {
   "$schema": "./node_modules/wrangler/config-schema.json",
   "name": "my-edge-app",
   "main": "worker.js",
-  // Set this to today's date
   "compatibility_date": "2026-09-06",
-  "observability": {
-    "enabled": true
-  }
+  "observability": { "enabled": true }
 }
 ```
 
-**3. Deploy:**
+Deploy:
 
 ```bash
 wrangler deploy
 ```
 
-> `wrangler publish` was removed in favor of `wrangler deploy`. If you're on an older Wrangler version, run `npm install -g wrangler@latest` first.
-
----
-
 ## Server API
 
-### Creating an App
+### Context
 
-```ts
-import { Edge } from '@lengkapp/edge';
-const app = new Edge();
-```
+| Member | Description |
+|---|---|
+| `ctx.req` | Incoming Request |
+| `ctx.env` | Environment bindings |
+| `ctx.executionCtx` | ExecutionContext |
+| `ctx.params` | Prototype-safe route params object |
+| `ctx.status` | Default response status (200) |
+| `ctx.headers` | Response Headers |
+| `ctx.query` | URLSearchParams |
+| `ctx.getCookie(name)` | Read a cookie |
+| `ctx.setCookie(name, value, options)` | Set a cookie (name validated) |
+| `ctx.deleteCookie(name, options)` | Delete a cookie |
+| `ctx.text/json/html(data, status?, headers?)` | Response helpers |
 
-### Routing
+Every response carries `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin`, and a restrictive `Permissions-Policy`.
 
-Register routes using HTTP method helpers. Both static and dynamic paths are supported.
+### Route Options
 
 ```ts
-// Static
-app.get('/home', handler);
-app.post('/submit', handler);
-
-// Dynamic (colon-prefixed segments)
-app.get('/users/:id', (ctx) => {
-  const userId = ctx.params.id;
-});
+app.get('/protected', { auth: true }, handler);
+app.get('/admin',     { auth: { role: 'admin' } }, handler);
+app.get('/scoped',    { auth: { scopes: ['read', 'write'] } }, handler);
+app.get('/limited',   { rateLimit: { max: 100, window: 60 } }, handler);
+app.get('/cached',    { cache: { ttl: 60 } }, handler);
+app.get('/api',       { cors: true }, handler);
+app.post('/submit',   { validate: (ctx) => /* ... */ true }, handler);
 ```
 
-Supported methods: `get`, `post`, `put`, `delete`, `patch`, `options`, `head`.
-
-### Context Object
-
-Each handler receives a `Context` object (`ctx`) with the following members:
-
-| Property / Method | Description |
-| --- | --- |
-| `ctx.req` | The original `Request` object |
-| `ctx.env` | The environment bindings (KV, secrets, etc.) |
-| `ctx.executionCtx` | The `ExecutionContext` (for `waitUntil`) |
-| `ctx.params` | Route parameters (e.g., `{ id: '123' }`) |
-| `ctx.status` | HTTP status code (default `200`) |
-| `ctx.headers` | `Headers` object for the response |
-| `ctx.query` | `URLSearchParams` (lazy) |
-| `ctx.getCookie(name)` | Get a cookie value |
-| `ctx.setCookie(name, value, options)` | Set a cookie |
-| `ctx.deleteCookie(name, options)` | Delete a cookie (expires immediately) |
-| `ctx.text(data, status?, headers?)` | Return plain text |
-| `ctx.json(data, status?, headers?)` | Return JSON |
-| `ctx.html(data, status?, headers?)` | Return HTML |
+**Auth:** Tokens are looked up in `AUTH_KV`. Send via `Authorization: Bearer <token>` or the `auth_token` cookie. Payloads with an `exp` field (Unix seconds) are rejected when expired.
 
-Cookie options: `path`, `domain`, `maxAge`, `expires`, `secure`, `httpOnly`, `sameSite`.
-
-### Returning Responses
-
-You can return a `Response` object, a string (becomes text), or an object (automatically JSON).
-If the handler returns a JSX element, it will be rendered to HTML automatically (see [JSX Support](#jsx-support)).
+**CORS:** The default is `origin: '*'`. For production, use a strict allowlist:
 
 ```ts
-app.get('/json', (ctx) => {
-  return { hello: 'world' }; // → ctx.json()
-});
-
-app.get('/html', (ctx) => {
-  return '<h1>Hi</h1>'; // → ctx.html()
-});
+app.defaults.cors.origin = ['https://app.example.com'];
 ```
 
-### Route Options
+**Rate limit:** 429 responses carry `Retry-After: 60`.
 
-Pass an options object as the second argument (before the handler) to enable middleware.
+## JSX Support
 
-#### Authentication (`auth`)
+```tsx
+import { renderToString } from '@lengkapp/edge';
 
-Requires an `AUTH_KV` KV binding. Valid tokens are stored as keys with a JSON payload.
+function Card({ title }) {
+  return <div class="card"><h2>{title}</h2></div>;
+}
 
-```ts
-app.get('/protected', { auth: true }, handler);
-app.get('/admin', { auth: { role: 'admin' } }, handler);
-app.get('/scoped', { auth: { scopes: ['read', 'write'] } }, handler);
+app.get('/card', (ctx) => ctx.html(renderToString(<Card title="Hello" />)));
 ```
 
-The client must send the token via `Authorization: Bearer <token>` or a cookie named `auth_token`.
+`renderToString` hardening:
 
-#### Rate Limiting (`rateLimit`)
+- Tag names must match `^[A-Za-z][A-Za-z0-9-]*$`.
+- Attribute names must match `^[A-Za-z_:][A-Za-z0-9_:.-]*$`.
+- `on*` attributes never serialize.
+- `href`/`src`/`action`/`formaction`/`xlink:href` values beginning with `javascript:`, `vbscript:`, or `data:text/html` are stripped.
+- Prototype keys (`__proto__`, `constructor`, `prototype`) are rejected.
+- All string values are HTML-escaped.
 
-Requires a `RATE_LIMIT_KV` binding.
+## Client (Declarative Partial Updates)
 
-```ts
-app.get('/limited', { rateLimit: { max: 100, window: 60 } }, handler);
+```html
+<script src="https://cdn.example.com/edge-client.min.js"></script>
 ```
 
-#### Caching (`cache`)
+### Attributes
 
-Caches successful GET responses in the Cloudflare cache.
+| Attribute | Description |
+|---|---|
+| `_get` / `_post` / `_put` / `_patch` / `_delete` | URL + method |
+| `_target` | CSS selector, or `"this"` |
+| `_trigger` | Event list: click, load, visible, intersect, etc. |
+| `_form` | Form ID to serialize as URL-encoded body |
+| `_json` | Comma-separated input names to send as JSON |
+| `_skeleton` | `"false"` disables the loading skeleton |
+| `_retry` | `"false"` disables the retry button |
 
-```ts
-app.get('/cached', { cache: { ttl: 60, staleWhileRevalidate: 30 } }, handler);
-```
+### Examples
 
-#### CORS (`cors`)
+```html
+<button _get="/more-posts" _target="#posts">Load More</button>
 
-Enables CORS headers.
+<div _get="/user-profile" _target="this"></div>
 
-```ts
-app.get('/api', { cors: true }, handler);
+<button _post="/login" _json="username,password" _target="#status">Login</button>
 
-// Custom origin / methods
-app.get('/api', { cors: { origin: 'https://example.com', methods: 'GET,POST' } }, handler);
+<div _get="/lazy" _target="this" _trigger="visible"></div>
 ```
 
-#### Logging (`log`)
+### How Content Is Inserted
 
-Logs method, URL, and status to the console.
+1. Response is fetched with `credentials: 'same-origin'` and `X-Requested-With: XMLHttpRequest`.
+2. Content-Type is verified to be `text/html` or `text/plain`.
+3. `res.headers` may contain `x-css-required` / `x-js-required` (with optional `x-css-integrity` / `x-js-integrity` for SRI) — matching resources are injected once.
+4. The HTML is run through `sanitizeHtml`, which removes `<base>`, `<meta refresh>`, `<iframe srcdoc>`, `<object>`, `<embed>`, and neutralizes `javascript:` / `vbscript:` / `data:text/html` URLs.
+5. The sanitized HTML is assigned via `innerHTML` (through a Trusted Types policy named `edge-policy` when available).
+6. Each `<script>` in the result is rebuilt in place so the browser executes it. If the page has a CSP nonce, only scripts carrying the matching nonce run; otherwise all scripts run.
 
-#### Compression (`compress`)
+## CSRF Protection
 
-Compresses the response using gzip/deflate/br if the client supports it.
-
-#### Custom Validation (`validate`)
-
-A function returning `true`/`false` (or a `Promise`) to allow/deny the request.
+The client reads a token from `<meta name="csrf-token" content="...">` or the `XSRF-TOKEN` cookie and sends it as `X-CSRF-Token` on `POST`/`PUT`/`PATCH`/`DELETE`.
 
 ```ts
 app.post('/submit', {
-  validate: (ctx) => ctx.req.headers.get('Authorization') === 'Bearer secret'
+  validate: (ctx) => {
+    const sent = ctx.req.headers.get('X-CSRF-Token');
+    return sent && sent === ctx.getCookie('csrf_token');
+  }
 }, handler);
 ```
 
----
-
-## JSX Support
+## Trusted Types / CSP
 
-The package includes a minimal JSX runtime. Write components as functions returning JSX.
+If the page enforces `require-trusted-types-for 'script'`, the client creates a policy named `edge-policy` and routes every `innerHTML` through it. The policy runs the built-in sanitizer. To allowlist the policy in CSP:
 
-```tsx
-import { jsx, renderToString, Fragment } from '@lengkapp/edge';
+```text
+Content-Security-Policy:
+  default-src 'self';
+  script-src 'self';
+  style-src 'self';
+  img-src 'self' data:;
+  require-trusted-types-for 'script';
+  trusted-types edge-policy;
+  frame-ancestors 'none';
+  base-uri 'self';
+```
 
-function Card({ title }) {
-  return (
-    <div class="card">
-      <h2>{title}</h2>
-    </div>
-  );
-}
+## Security Controls
 
-app.get('/card', (ctx) => {
-  return ctx.html(renderToString(<Card title="Hello" />));
-});
-```
+```ts
+const app = new Edge();
 
-If your handler returns a JSX element directly, Edge will automatically render it:
+app.defaults.cors.origin = ['https://app.example.com'];
 
-```tsx
-app.get('/auto', (ctx) => <h1>Auto rendered</h1>);
+app.security.hashAuthTokens = true;   // SHA-256 token keys, migrate first
+app.security.logSecurityEvents = true; // structured JSON events (default on)
+app.security.extraHeaders = {
+  'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
+  'Cross-Origin-Opener-Policy': 'same-origin',
+  'Cross-Origin-Resource-Policy': 'same-origin',
+};
 ```
 
----
+### OWASP 2025 Coverage
+
+| Category | Mitigation |
+|---|---|
+| A01 Broken Access Control | Auth reasons, expiry enforcement, scope/role checks, strict target resolution |
+| A02 Security Misconfiguration | Safe default headers, strict CORS allowlist, `Vary: Origin` |
+| A03 Supply Chain | Zero deps, SRI honored on injected resources |
+| A04 Crypto Failures | Optional SHA-256 token hashing |
+| A05 Injection / XSS | Prototype-safe objects, JSX attribute sanitization, Trusted Types policy, response sanitizer |
+| A06 Insecure Design | Numeric-sanitized rate limiter, `Retry-After` |
+| A07 Auth Failures | Structured failure reasons, no swallowed errors |
+| A08 Data Integrity | Prototype-safe JSON, `Set-Cookie` stripped from cache |
+| A09 Logging | Structured JSON security events with 60s dedupe |
+| A10 Exceptional Conditions | Fail-closed middleware, no internal leakage |
 
 ## Scheduled Tasks
 
-Register a scheduled handler for Cron triggers.
-
 ```ts
 app.scheduled(async (event, env, ctx) => {
   console.log('Cron executed:', event.cron);
 });
-```
 
-Then export it in your worker:
-
-```ts
 export default {
   fetch: (req, env, ctx) => app.fetch(req, env, ctx),
-  scheduled: (event, env, ctx) => app.scheduledHandler?.(event, env, ctx)
+  scheduled: (event, env, ctx) => app.scheduledHandler?.(event, env, ctx),
 };
 ```
 
----
-
-## Client (Declarative Partial Updates)
-
-Add the client script to your page (or include it via a CDN):
-
-```html
-<script src="https://cdn.example.com/edge-client.min.js"></script>
-```
-
-Then use HTML attributes to make elements fetch content asynchronously.
-
-### Attributes
-
-| Attribute | Description |
-| --- | --- |
-| `_get` | URL to fetch via GET |
-| `_post` | URL to fetch via POST |
-| `_target` | CSS selector for the container to replace. Use `"this"` to replace the element itself. |
-| `_trigger` | Comma-separated list of events that trigger the fetch (default: `click`; `load` if `_target="this"`). Supported: `click`, `load`, `visible`, `intersect`, `submit`, etc. |
-| `_form` | (with `_post`) ID of a form to serialize as the POST body (URL-encoded). |
-| `_json` | (with `_post`) Comma-separated names of input fields to send as JSON. |
-
-### Examples
-
-**Load content on click:**
-
-```html
-<button _get="/more-posts" _target="#posts" _trigger="click">Load More</button>
-<div id="posts"></div>
-```
-
-**Auto-load on page load:**
-
-```html
-<div _get="/user-profile" _target="this"></div>
-```
-
-**Post a form via AJAX:**
-
-```html
-<form id="contact-form">
-  <input name="email" />
-  <button _post="/submit" _form="contact-form" _target="#result">Submit</button>
-</form>
-<div id="result"></div>
-```
-
-**Send JSON data:**
-
-```html
-<input name="username" />
-<input name="password" />
-<button _post="/login" _json="username,password" _target="#status">Login</button>
-```
-
-**Load when element becomes visible (IntersectionObserver):**
-
-```html
-<div _get="/lazy-content" _target="this" _trigger="visible"></div>
-```
-
-### Skeleton Loading
-
-While the request is in progress, the target container is filled with a skeleton loader (three shimmer bars). On error, a "Retry" button is shown.
-
-### Resource Injection
-
-If the server response includes headers `x-css-required` or `x-js-required`, the client will automatically inject those resources (once per URL) into the page.
-
-Example server route:
-
-```ts
-app.get('/widget', (ctx) => {
-  ctx.headers.set('x-css-required', '["/widget.css"]');
-  ctx.headers.set('x-js-required', '["/widget.js"]');
-  return ctx.html('<div class="widget">...</div>');
-});
-```
-
----
-
 ## Configuration
 
-### `wrangler.jsonc`
-
-If you use authentication or rate limiting, you need KV namespaces. Create them first:
+### KV Namespaces
 
 ```bash
 wrangler kv namespace create AUTH_KV
 wrangler kv namespace create RATE_LIMIT_KV
 ```
 
-Then wire up the returned IDs in your config:
-
 ```jsonc
 {
-  "$schema": "./node_modules/wrangler/config-schema.json",
-  "name": "my-edge-app",
-  "main": "worker.js",
-  // Set this to today's date
-  "compatibility_date": "2026-09-06",
-  "observability": {
-    "enabled": true
-  },
   "kv_namespaces": [
-    { "binding": "AUTH_KV", "id": "your-auth-kv-id" },
-    { "binding": "RATE_LIMIT_KV", "id": "your-ratelimit-kv-id" }
-  ],
-  // Optional Cron triggers
-  "triggers": {
-    "crons": ["*/5 * * * *"]
-  }
+    { "binding": "AUTH_KV", "id": "..." },
+    { "binding": "RATE_LIMIT_KV", "id": "..." }
+  ]
 }
 ```
 
-<details>
-<summary>Equivalent <code>wrangler.toml</code></summary>
-
-```toml
-name = "my-edge-app"
-main = "worker.js"
-compatibility_date = "2026-09-06"
-
-[observability]
-enabled = true
-
-[[kv_namespaces]]
-binding = "AUTH_KV"
-id = "your-auth-kv-id"
-
-[[kv_namespaces]]
-binding = "RATE_LIMIT_KV"
-id = "your-ratelimit-kv-id"
-
-# Optional Cron triggers
-[triggers]
-crons = ["*/5 * * * *"]
-```
-
-</details>
-
-Wrangler supports both `wrangler.jsonc` and `wrangler.toml` — they configure the same fields, just in different syntax. Don't keep both in the same project. Keep `compatibility_date` current (Cloudflare recommends staying within the last 30 days); see the [compatibility dates docs](https://developers.cloudflare.com/workers/configuration/compatibility-dates/).
-
-### Environment Variables
-
-The KV binding names are configurable on the Edge instance:
+Rename the bindings on the instance:
 
 ```ts
 app.authKvBinding = 'CUSTOM_AUTH_KV';
 app.rateLimitKvBinding = 'CUSTOM_RATE_KV';
 ```
 
----
-
-## Full Example
-
-```ts
-import { Edge, renderToString } from '@lengkapp/edge';
-import { HomePage } from './Page.jsx';
-
-const app = new Edge();
-
-// Basic text
-app.get('/', (ctx) => ctx.text('Hello from Edge!'));
-
-// JSX component
-app.get('/home', (ctx) => ctx.html(renderToString(<HomePage />)));
-
-// JSON with route params
-app.get('/users/:id', (ctx) => ctx.json({ userId: ctx.params.id }));
-
-// POST JSON
-app.post('/users', async (ctx) => {
-  const body = await ctx.req.json();
-  return ctx.json({ created: true, user: body }, 201);
-});
-
-// Auth
-app.get('/protected', { auth: true }, (ctx) => ctx.text('Authenticated'));
-
-// Rate limiting
-app.get('/limited', { rateLimit: { max: 5, window: 60 } }, (ctx) => ctx.text('Limited'));
-
-// Caching
-app.get('/cached', { cache: { ttl: 60 } }, (ctx) => ctx.text('Cached'));
-
-// Cookies
-app.get('/set-cookie', (ctx) => {
-  ctx.setCookie('session', 'abc123', { httpOnly: true, path: '/' });
-  return ctx.text('Cookie set');
-});
-
-app.get('/get-cookie', (ctx) => {
-  const session = ctx.getCookie('session');
-  return ctx.text(`Cookie: ${session}`);
-});
-
-// Scheduled
-app.scheduled(async (event, env, ctx) => {
-  console.log('Cron:', event.cron);
-});
-
-export default {
-  fetch: (req, env, ctx) => app.fetch(req, env, ctx),
-  scheduled: (event, env, ctx) => app.scheduledHandler?.(event, env, ctx)
-};
-```
-
----
-
 ## Performance
 
-@lengkapp/edge is inspired by [Hono](https://hono.dev) — one of the fastest Workers frameworks around — but ships with **zero dependencies**. A quick local benchmark shows it holding its own against both Hono builds (`hono` and `hono/tiny`) and a plain native `fetch` handler with no framework at all.
+Zero runtime dependencies. On a local `wrangler dev` benchmark with `autocannon` (10 connections, 10s per route), throughput sits in the same tier as `hono` / `hono/tiny` / a native worker:
 
-### Test setup
+| Framework | /text req/s | /json req/s |
+|---|---|---|
+| @lengkapp/edge | 503 | 500 |
+| Hono | 506 | 495 |
+| Hono (tiny) | 505 | 498 |
+| Native Workers | 498 | 500 |
 
-- **Tool:** `autocannon` — 10 connections, 10s run per route
-- **Target:** local `wrangler dev` server
-- **Routes:** `GET /text` (plain text) and `GET /json` (JSON)
-- **Contenders:** `@lengkapp/edge`, `hono`, `hono/tiny`, and a native Workers handler with no framework
+The security hardening adds only cheap operations to the request path: prototype-safe objects, two regex checks per JSX attribute, a sanitizer template parse per response (browser-native parser), and a throttled logger. No new async boundaries, no added dependencies, no hashing on the hot path.
 
-> This is a single local run, not a formal benchmark suite — treat the numbers as directional. Latency stdev was ±3–4 ms across all four, so differences smaller than that are within noise.
-
-### Results
-
-| Framework | Route | Avg Req/sec | Avg Latency | Requests | Data Read |
-| --- | --- | --- | --- | --- | --- |
-| **@lengkapp/edge** | `/text` | 503.1 | 19.38 ms | 5,000 / 10.03s | 1.38 MB |
-| **@lengkapp/edge** | `/json` | **500.4** | 19.47 ms | 5,000 / 10.03s | 1.42 MB |
-| Hono | `/text` | **506.0** | 19.27 ms | 5,000 / 10.03s | 455 kB |
-| Hono | `/json` | 495.2 | 19.69 ms | 5,000 / 10.03s | 426 kB |
-| Hono (`hono/tiny`) | `/text` | 505.5 | 19.28 ms | 5,000 / 10.03s | 455 kB |
-| Hono (`hono/tiny`) | `/json` | 497.9 | 19.57 ms | 5,000 / 10.03s | 428 kB |
-| Native Workers (no framework) | `/text` | 498.4 | 19.55 ms | 5,000 / 10.02s | 379 kB |
-| Native Workers (no framework) | `/json` | 499.7 | 19.51 ms | 5,000 / 10.03s | 430 kB |
-
-```mermaid
-xychart-beta
-    title "Avg requests/sec — GET /text"
-    x-axis ["@lengkapp/edge", "Hono", "Hono (tiny)", "Native Workers"]
-    y-axis "Req/sec" 490 --> 510
-    bar [503.1, 506.0, 505.5, 498.4]
-```
-
-```mermaid
-xychart-beta
-    title "Avg requests/sec — GET /json"
-    x-axis ["@lengkapp/edge", "Hono", "Hono (tiny)", "Native Workers"]
-    y-axis "Req/sec" 490 --> 505
-    bar [500.4, 495.2, 497.9, 499.7]
-```
-
-### Takeaways
+## License
 
-- On `/json`, @lengkapp/edge posted the highest average throughput of the four, ahead of both Hono builds and the native handler.
-- On `/text`, it landed within ~1% of `hono`/`hono/tiny` and ahead of the native baseline — effectively a tie once you account for run-to-run variance.
-- All four sit in the same performance tier; the practical difference is that @lengkapp/edge gets there with **zero runtime dependencies**, matching `hono/tiny`'s footprint without having to choose a "tiny" build.
-- @lengkapp/edge read more bytes per request than the other three in this run — worth profiling if minimal payload size matters for your use case.
+See LICENSE. © LengkApp — Yasir Haris
 
 ---
 
-## License
-
-See [LICENSE](./LICENSE). © LengkApp — Yasir Haris
+## Summary of the security posture
+
+| Layer | Mechanism |
+|---|---|
+| HTML insertion | `sanitizeHtml` → `innerHTML` via Trusted Types policy `edge-policy` |
+| Dangerous elements | `<base>`, `<meta refresh>`, `<iframe srcdoc>`, `<object>`, `<embed>`, `form[action^="javascript:"]` removed |
+| Dangerous URLs | `javascript:`, `vbscript:`, `data:text/html` removed from `href`/`src`/`action`/`formaction`/`xlink:href`/`data` |
+| Script execution | Nonce-gated when the page uses CSP nonces; deduplicated by `src`; inline scripts block-wrapped |
+| CSRF | `X-CSRF-Token` from meta or cookie on state-changing methods |
+| Cookies | `credentials: 'same-origin'`; names validated on the server |
+| Server response headers | `nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy`, `Permissions-Policy` |
+| Server middleware | Fail-closed; structured security logs; strict CORS allowlist; optional token hashing |
+| Prototype pollution | `Object.create(null)` + forbidden-key filtering in params, cookies, JSON, JSX |
+| Build | Reserved exports/properties, `keep_quoted: "strict"`, per-bundle post-minification self-test |