@lengkapp/edge 0.0.23 → 0.0.24

package/dist/edge-client.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.23
+ * @lengkapp/edge v0.0.24
  * MIT License
  *
  * LengkApp Edge License

package/dist/edge-server.d.ts

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.23
+ * @lengkapp/edge v0.0.24
  * MIT License
  *
  * LengkApp Edge License
@@ -32,19 +32,30 @@
  */
 // edge-server.d.ts
 
-export function Fragment(props: { children?: any }): JSXNode;
+/* ------------------------------------------------------------------ *
+ *  JSX runtime                                                       *
+ * ------------------------------------------------------------------ */
+
+export const Fragment: unique symbol;
 
 export interface JSXNode {
-  type: unknown;
+  type: string | symbol | ((props: any) => any);
   props: Record<string, any>;
   children: any[];
   __isJSX: true;
 }
 
-export function jsx(type: unknown, props: any, ...children: any[]): JSXNode;
+export function jsx(
+  type: JSXNode['type'],
+  props: Record<string, any> | null,
+  ...children: any[]
+): JSXNode;
+
 export function renderToString(node: any): string;
 
-/* ---------------- Context ---------------- */
+/* ------------------------------------------------------------------ *
+ *  Context                                                           *
+ * ------------------------------------------------------------------ */
 
 export interface CookieOptions {
   path?: string;
@@ -53,137 +64,116 @@ export interface CookieOptions {
   expires?: Date;
   secure?: boolean;
   httpOnly?: boolean;
-  sameSite?: 'Strict' | 'Lax' | 'None';
+  sameSite?: 'Strict' | 'Lax' | 'None' | string;
+}
+
+export interface CorsOptions {
+  origin?: string | string[];
+  methods?: string;
+  headers?: string;
+}
+
+export interface CacheOptions {
+  /** TTL in seconds. Default: 3600 */
+  ttl?: number;
+  /** stale-while-revalidate in seconds. Default: 0 */
+  staleWhileRevalidate?: number;
 }
 
 export interface RouteOptions {
-  auth?: boolean | {
-    role?: string;
-    scopes?: string[];
-  };
-  rateLimit?: boolean | {
-    /** max requests per window (default 100) */
-    max?: number;
-    /** window in seconds (default 60) */
-    window?: number;
-  };
-  cors?: boolean | {
-    origin?: string | string[];
-    methods?: string;
-    headers?: string;
-  };
-  cache?: boolean | {
-    /** seconds (default 3600) */
-    ttl?: number;
-    staleWhileRevalidate?: number;
-  };
+  cors?: boolean | CorsOptions;
+  cache?: boolean | CacheOptions;
   compress?: boolean;
   log?: boolean;
   validate?: (ctx: Context) => boolean | Promise<boolean>;
 }
 
-export type Handler<E = any> = (ctx: Context<E>) => any | Promise<any>;
-
-export class Context<E = any> {
+export class Context {
   constructor(
     request: Request,
-    env: E,
+    env: Record<string, any>,
     executionCtx: ExecutionContext,
     params?: Record<string, string>,
-    parsedUrl?: URL | null,
+    parsedUrl?: URL | null
   );
 
   req: Request;
-  env: E;
+  env: Record<string, any>;
   executionCtx: ExecutionContext;
   params: Record<string, string>;
   status: number;
   headers: Headers;
   url: URL;
 
-  readonly query: URLSearchParams;
-
   getCookie(name: string): string | null;
+  readonly query: URLSearchParams;
   setCookie(name: string, value: string, options?: CookieOptions): void;
   deleteCookie(name: string, options?: CookieOptions): void;
 
   text(data: string, status?: number, headers?: Record<string, string>): Response;
   json(data: any, status?: number, headers?: Record<string, string>): Response;
-
-  /** Accepts a raw HTML string, JSX, or an array of JSX. */
   html(
     data: string | JSXNode | JSXNode[] | null | undefined,
     status?: number,
-    headers?: Record<string, string>,
+    headers?: Record<string, string>
   ): Response;
-
-  /**
-   * Send a redirect. Preserves any `Set-Cookie` headers and other
-   * headers already set on this Context, unlike the global
-   * `Response.redirect()`.
-   *
-   * @param location Absolute or relative URL to redirect to.
-   * @param status   HTTP status code (default 302).
-   */
   redirect(location: string, status?: number): Response;
 }
 
-/* ---------------- Edge ---------------- */
-
-export interface SecurityConfig {
-  hashAuthTokens: boolean;
-  logSecurityEvents: boolean;
-  extraHeaders: Record<string, string> | null;
-  trustedProxies: string[] | null;
+/* ------------------------------------------------------------------ *
+ *  Edge router                                                       *
+ * ------------------------------------------------------------------ */
+
+export type RouteHandler = (ctx: Context) => any | Promise<any>;
+
+export type ScheduledHandler = (
+  event: ScheduledEvent,
+  env: Record<string, any>,
+  ctx: ExecutionContext
+) => void | Promise<void>;
+
+export interface SecurityOptions {
+  /** Emit structured security logs. Default: true */
+  logSecurityEvents?: boolean;
+  /** Extra response headers applied to every route. */
+  extraHeaders?: Record<string, string> | null;
+  /** Trusted proxy list (reserved). */
+  trustedProxies?: string[] | null;
 }
 
-export interface Defaults {
-  cors: { origin: string; methods: string };
+export interface EdgeDefaults {
+  cors: CorsOptions & { methods: string };
 }
 
-export class Edge<E = any> {
+export class Edge {
   constructor();
 
-  authKvBinding: string;
-  rateLimitKvBinding: string;
-  defaults: Defaults;
-  security: SecurityConfig;
-
-  get(path: string, options?: RouteOptions | boolean, handler?: Handler<E>): void;
-  get(path: string, handler: Handler<E>): void;
-
-  post(path: string, options?: RouteOptions | boolean, handler?: Handler<E>): void;
-  post(path: string, handler: Handler<E>): void;
-
-  put(path: string, options?: RouteOptions | boolean, handler?: Handler<E>): void;
-  put(path: string, handler: Handler<E>): void;
-
-  delete(path: string, options?: RouteOptions | boolean, handler?: Handler<E>): void;
-  delete(path: string, handler: Handler<E>): void;
-
-  patch(path: string, options?: RouteOptions | boolean, handler?: Handler<E>): void;
-  patch(path: string, handler: Handler<E>): void;
-
-  options(path: string, options?: RouteOptions | boolean, handler?: Handler<E>): void;
-  options(path: string, handler: Handler<E>): void;
-
-  head(path: string, options?: RouteOptions | boolean, handler?: Handler<E>): void;
-  head(path: string, handler: Handler<E>): void;
-
-  scheduled(
-    handler: (event: ScheduledEvent, env: E, ctx: ExecutionContext) => any | Promise<any>,
-  ): void;
-
-  fetch(request: Request, env: E, executionCtx: ExecutionContext): Promise<Response>;
-}
-
-/* ---------------- JSX typing for this runtime ---------------- */
-
-declare global {
-  namespace JSX {
-    type Element = JSXNode;
-    type ElementType = string | symbol | ((props: any) => JSXNode);
-    interface IntrinsicElements { [elemName: string]: any; }
-    interface ElementChildrenAttribute { children: {}; }
-  }
+  readonly staticRoutes: Map<string, Map<string, { handler: RouteHandler; options: RouteOptions }>>;
+  readonly dynamicTries: Record<string, any>;
+  defaults: EdgeDefaults;
+  scheduledHandler: ScheduledHandler | null;
+  security: SecurityOptions;
+
+  get(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
+  get(path: string, handler: RouteHandler): void;
+  post(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
+  post(path: string, handler: RouteHandler): void;
+  put(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
+  put(path: string, handler: RouteHandler): void;
+  delete(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
+  delete(path: string, handler: RouteHandler): void;
+  patch(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
+  patch(path: string, handler: RouteHandler): void;
+  options(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
+  options(path: string, handler: RouteHandler): void;
+  head(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
+  head(path: string, handler: RouteHandler): void;
+
+  scheduled(handler: ScheduledHandler): void;
+
+  fetch(
+    request: Request,
+    env: Record<string, any>,
+    executionCtx: ExecutionContext
+  ): Promise<Response>;
 }

package/dist/edge-server.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.23
+ * @lengkapp/edge v0.0.24
  * MIT License
  *
  * LengkApp Edge License
@@ -30,4 +30,4 @@
  * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
-var t=Object.defineProperty,e=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,r=Object.prototype.hasOwnProperty,o=(e,n)=>{for(var r in n)t(e,r,{get:n[r],enumerable:!0})},i=(o,i,s,a)=>{if(i&&"object"==typeof i||"function"==typeof i)for(let c of n(i))r.call(o,c)||c===s||t(o,c,{get:()=>i[c],enumerable:!(a=e(i,c))||a.enumerable});return o},s=e=>i(t({},"__esModule",{value:!0}),e),a={};function c(t){const e=[],n=t.length;let r=1;for(let o=1;o<=n;o++)o!==n&&47!==t.charCodeAt(o)||(o>r&&e.push(t.slice(r,o)),r=o+1);return e}function l(t){const e=t.length;return e>1&&47===t.charCodeAt(e-1)?t.slice(0,-1):t}o(a,{Context:()=>T,Edge:()=>Edge,Fragment:()=>Fragment,jsx:()=>jsx,renderToString:()=>renderToString}),module.exports=s(a);var u=new Set(["__proto__","constructor","prototype"]);function f(t){return"string"==typeof t&&!u.has(t)}function h(t){const e=JSON.parse(t);if(e&&"object"==typeof e)for(const t of Object.keys(e))if(!f(t))throw new SyntaxError("Forbidden key in JSON payload");return e}function p(t){const e=t.length;let n=0;for(;n<e;){const e=t.charCodeAt(n);if(38===e||60===e||62===e||34===e||39===e)break;n++}if(n===e)return t;let r=t.slice(0,n),o=n;for(;n<e;n++){const e=t.charCodeAt(n);let i;if(38===e)i="&amp;";else if(60===e)i="&lt;";else if(62===e)i="&gt;";else if(34===e)i="&quot;";else{if(39!==e)continue;i="&#039;"}n>o&&(r+=t.slice(o,n)),r+=i,o=n+1}return o<e&&(r+=t.slice(o)),r}var Fragment=Symbol("Fragment");function jsx(t,e,...n){return{type:t,props:e||{},children:n,__isJSX:!0}}var d=new Set(["area","base","br","col","embed","hr","img","input","link","meta","param","source","track","wbr"]),y=new Set(["allowfullscreen","async","autofocus","autoplay","checked","controls","default","defer","disabled","formnovalidate","hidden","inert","ismap","itemscope","loop","multiple","muted","nomodule","novalidate","open","playsinline","readonly","required","reversed","selected"]),g=new Set(["animation-iteration-count","border-image-outset","border-image-slice","border-image-width","box-flex","box-flex-group","box-ordinal-group","column-count","columns","flex","flex-grow","flex-positive","flex-shrink","flex-negative","flex-order","grid-row","grid-row-end","grid-row-span","grid-row-start","grid-column","grid-column-end","grid-column-span","grid-column-start","font-weight","line-clamp","line-height","opacity","order","orphans","tab-size","widows","z-index","zoom","fill-opacity","flood-opacity","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-miterlimit","stroke-opacity","stroke-width"]),m=new Map,w=2e3;function b(t){const e=m.get(t);if(void 0!==e)return e;const n=t.replace(/([A-Z])/g,"-$1").toLowerCase().replace(/^-/,"");return m.size>=w&&m.clear(),m.set(t,n),n}function A(t){if(!t||"object"!=typeof t)return"";let e="";for(const n in t){if(!Object.prototype.hasOwnProperty.call(t,n))continue;const r=b(n);let o=t[n];"number"!=typeof o||g.has(r)||(o+="px"),e&&(e+=";"),e+=r+":"+o}return e}var C=new Set(["href","src","xlink:href","action","formaction"]);function renderToString(t){if(null==t||"boolean"==typeof t)return"";const e=typeof t;if("string"===e)return p(t);if("number"===e)return p(String(t));if(Array.isArray(t)){let e="";for(let n=0;n<t.length;n++)e+=renderToString(t[n]);return e}if(!t.__isJSX)return p(String(t));const{type:n,props:r,children:o}=t;if(n===Fragment){let t="";for(let e=0;e<o.length;e++)t+=renderToString(o[e]);return t}if("symbol"==typeof n)return"";if("function"==typeof n)return renderToString(n({...r,children:o}));if("string"!=typeof n||!/^[A-Za-z][A-Za-z0-9-]*$/.test(n))return"";const i=d.has(n);let s="";for(const t in r){if(!Object.prototype.hasOwnProperty.call(r,t))continue;if("children"===t||"key"===t||"ref"===t)continue;const e=r[t];if(null==e||!1===e)continue;if("dangerouslySetInnerHTML"===t)continue;let n=t;if("className"===t||"class"===t?n="class":"htmlFor"!==t&&"for"!==t||(n="for"),f(n)&&!/^on/i.test(n)&&/^[A-Za-z_:][A-Za-z0-9_:.-]*$/.test(n)){if(C.has(n)){const t=String(e).replace(/[\u0000-\u0020]/g,"").toLowerCase();if(t.startsWith("javascript:")||t.startsWith("vbscript:")||t.startsWith("data:text/html"))continue}if(y.has(n))!0===e&&(s+=" "+n);else if(!0!==e){if("style"===n&&"object"==typeof e){const t=A(e);t&&(s+=' style="'+p(t)+'"');continue}s+=" "+n+'="'+p(String(e))+'"'}else s+=" "+n+'="true"'}}let a="";const c=r.dangerouslySetInnerHTML;if(c&&null!=c.__html)a=c.__html;else for(let t=0;t<o.length;t++)a+=renderToString(o[t]);return i?"<"+n+s+"/>":"<"+n+s+">"+a+"</"+n+">"}var T=class{constructor(t,e,n,r={},o=null){this.req=t,this.env=e,this.executionCtx=n,this.params=r,this.status=200,this.headers=new Headers,this.headers.set("X-Content-Type-Options","nosniff"),this.headers.set("X-Frame-Options","DENY"),this.headers.set("Referrer-Policy","strict-origin-when-cross-origin"),this.headers.set("Permissions-Policy","geolocation=(), microphone=(), camera=()"),this.t=t.headers.get("Cookie")||"",this.o=null,this.url=o||new URL(t.url)}i(){if(null!==this.o)return this.o;const t=Object.create(null),e=this.t;if(e){let n=0;const r=e.length;for(;n<r;){let o=e.indexOf(";",n);-1===o&&(o=r);let i=n,s=o;for(;i<s&&32===e.charCodeAt(i);)i++;for(;s>i&&32===e.charCodeAt(s-1);)s--;if(s>i){const n=e.indexOf("=",i);if(n>i&&n<s)try{const r=decodeURIComponent(e.slice(i,n));f(r)&&(t[r]=decodeURIComponent(e.slice(n+1,s)))}catch{}}n=o+1}}return this.o=t,t}getCookie(t){const e=this.i()[t];return void 0===e?null:e}get query(){return this.url.searchParams}setCookie(t,e,n={}){if("string"!=typeof t||!f(t)||/[\r\n;=]/.test(t))return;let r=encodeURIComponent(t)+"="+encodeURIComponent(e);n.path&&(r+="; Path="+n.path),n.domain&&(r+="; Domain="+n.domain),void 0!==n.maxAge&&(r+="; Max-Age="+n.maxAge),n.expires&&(r+="; Expires="+n.expires.toUTCString()),n.secure&&(r+="; Secure"),n.httpOnly&&(r+="; HttpOnly"),n.sameSite&&(r+="; SameSite="+n.sameSite),this.headers.append("Set-Cookie",r)}deleteCookie(t,e={}){this.setCookie(t,"",{...e,maxAge:0,expires:new Date(0)})}l(t){if(!t)return this.headers;let e=!1;for(const n in t){e=!0;break}if(!e)return this.headers;const n=new Headers(this.headers);for(const e in t)Object.prototype.hasOwnProperty.call(t,e)&&n.set(e,t[e]);return n}text(t,e=this.status,n={}){const r=this.l(n);return r.has("Content-Type")||r.set("Content-Type","text/plain; charset=utf-8"),new Response(t,{status:e,headers:r})}json(t,e=this.status,n={}){const r=this.l(n);return r.has("Content-Type")||r.set("Content-Type","application/json; charset=utf-8"),new Response(JSON.stringify(t),{status:e,headers:r})}html(t,e=this.status,n={}){const r=this.l(n);r.has("Content-Type")||r.set("Content-Type","text/html; charset=utf-8");const o="string"==typeof t?t:t&&t.__isJSX||Array.isArray(t)?renderToString(t):null==t?"":String(t);return new Response(o,{status:e,headers:r})}redirect(t,e=302){const n=new Headers(this.headers);return n.set("Location",String(t)),n.delete("Content-Type"),new Response(null,{status:e,headers:n})}},_=class{constructor(){this.children=null,this.paramChild=null,this.handler=null}},k=class{constructor(){this.root=new _}add(t,e,n){let r=this.root;const o=[];for(let e=0;e<t.length;e++){const n=t[e];if(58===n.charCodeAt(0)){const t=n.slice(1);o.push(f(t)?t:"_p"+e),r.paramChild||(r.paramChild=new _),r=r.paramChild}else{r.children||(r.children=new Map);let t=r.children.get(n);t||(t=new _,r.children.set(n,t)),r=t}}r.handler={handler:e,options:n,paramNames:o}}match(t){const e=[],n=this.u(this.root,t,0,e);if(!n)return null;const{handler:r,options:o,paramNames:i}=n,s=Object.create(null);for(let t=0;t<i.length;t++)s[i[t]]=e[t];return{handler:r,options:o,params:s}}u(t,e,n,r){if(n===e.length)return t.handler;const o=e[n],i=t.children;if(i){const t=i.get(o);if(t){const o=this.u(t,e,n+1,r);if(o)return o}}const s=t.paramChild;if(s){r.push(o);const t=this.u(s,e,n+1,r);if(t)return t;r.pop()}return null}},S=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD"],O=new Map;function E(t,e,n){const r=t+"|"+(e||"")+"|"+(n||""),o=Date.now(),i=O.get(r);if(i&&o-i<6e4)return!1;if(O.set(r,o),O.size>5e3)for(const[t,e]of O)o-e>6e4&&O.delete(t);return!0}var Edge=class{constructor(){this.staticRoutes=new Map;for(let t=0;t<S.length;t++)this.staticRoutes.set(S[t],new Map);this.dynamicTries={};for(let t=0;t<S.length;t++)this.dynamicTries[S[t]]=new k;this.authKvBinding="AUTH_KV",this.rateLimitKvBinding="RATE_LIMIT_KV",this.defaults={cors:{origin:"*",methods:"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"}},this.scheduledHandler=null,this.security={hashAuthTokens:!1,logSecurityEvents:!0,extraHeaders:null,trustedProxies:null}}h(t,e,n,r){if("boolean"==typeof n?n={auth:n}:"function"==typeof n&&(r=n,n={}),"function"!=typeof r)throw new Error("Handler for "+t+" "+e+" must be a function");const o={...this.defaults,...n||{}};-1===e.indexOf(":")?this.staticRoutes.get(t).set(l(e),{handler:r,options:o}):this.dynamicTries[t].add(c(e),r,o)}get(t,e,n){this.h("GET",t,e,n)}post(t,e,n){this.h("POST",t,e,n)}put(t,e,n){this.h("PUT",t,e,n)}delete(t,e,n){this.h("DELETE",t,e,n)}patch(t,e,n){this.h("PATCH",t,e,n)}options(t,e,n){this.h("OPTIONS",t,e,n)}head(t,e,n){this.h("HEAD",t,e,n)}scheduled(t){this.scheduledHandler=t}p(t,e,n){if(this.security.logSecurityEvents)try{const r=t.req.headers.get("CF-Connecting-IP")||"",o=t.url?t.url.pathname:"";if(!E(e,r,o))return;console.log(JSON.stringify({ts:(new Date).toISOString(),kind:"security",event:e,detail:"string"==typeof n?n:void 0,ip:r||void 0,method:t.req.method,path:o,ua:t.req.headers.get("User-Agent")||void 0}))}catch{}}async m(t,e){if(!e)return{ok:!0};const n=t.getCookie("auth_token")||t.req.headers.get("Authorization")?.replace(/^Bearer\s+/i,"");if(!n)return{ok:!1,reason:"missing_token"};const r=t.env[this.authKvBinding];if(!r)return{ok:!1,reason:"kv_unavailable"};let o,i=n;if(this.security.hashAuthTokens&&globalThis.crypto&&crypto.subtle){const t=await crypto.subtle.digest("SHA-256",(new TextEncoder).encode(n)),e=new Uint8Array(t);let r="";for(let t=0;t<e.length;t++)r+=e[t].toString(16).padStart(2,"0");i="tok:"+r}try{o=await r.get(i)}catch{return{ok:!1,reason:"kv_error"}}if(!o)return{ok:!1,reason:"invalid_token"};if("object"==typeof e&&null!==e){let t;try{t=h(o)}catch{return{ok:!1,reason:"malformed_payload"}}if(t&&"object"==typeof t){if(null!=t.exp&&"number"==typeof t.exp&&t.exp<Date.now()/1e3)return{ok:!1,reason:"expired_token"};if(e.role&&t.role!==e.role)return{ok:!1,reason:"insufficient_role"};if(e.scopes){const n=Array.isArray(t.scopes)?t.scopes:[];for(let t=0;t<e.scopes.length;t++)if(-1===n.indexOf(e.scopes[t]))return{ok:!1,reason:"insufficient_scopes"}}}}return{ok:!0,payload:o}}async A(t,e){if(!e)return!0;const n=!0===e?{}:e,r=n.max??100,o=n.window??60,i="rl:"+(t.req.headers.get("CF-Connecting-IP")||"unknown"),s=t.env[this.rateLimitKvBinding];if(!s)return!0;let a;try{a=await s.get(i,"json")}catch{return!0}if(("number"!=typeof a||!isFinite(a)||a<0)&&(a=0),a>=r)return!1;a++;try{await s.put(i,JSON.stringify(a),{expirationTtl:o})}catch{}return!0}C(t,e){if(!e)return;const n="object"==typeof e?e:this.defaults.cors,r=t.req.headers.get("Origin"),o=n.origin;"*"===o?t.headers.set("Access-Control-Allow-Origin","*"):Array.isArray(o)?r&&-1!==o.indexOf(r)&&(t.headers.set("Access-Control-Allow-Origin",r),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")):"string"==typeof o&&r===o&&(t.headers.set("Access-Control-Allow-Origin",r),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")),t.headers.set("Access-Control-Allow-Methods",n.methods||"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"),t.headers.set("Access-Control-Allow-Headers",n.headers||"Content-Type, Authorization, X-CSRF-Token"),t.headers.set("Access-Control-Max-Age","86400")}T(t,e){e&&console.log(t.req.method+" "+t.req.url+" - "+t.status)}_(t,e){const n=t.headers.get("Accept-Encoding")||"";let r=null;if(-1!==n.indexOf("gzip")?r="gzip":-1!==n.indexOf("deflate")&&(r="deflate"),!r||!e.body)return e;const o=e.body.pipeThrough(new CompressionStream(r)),i=new Headers(e.headers);return i.set("Content-Encoding",r),i.set("Vary","Accept-Encoding"),i.delete("Content-Length"),new Response(o,{status:e.status,statusText:e.statusText,headers:i})}async k(t,e){return!e||"function"!=typeof e||!!await e(t)}async S(t){return await caches.default.match(t)||null}async O(t,e,n){if(!n)return;const r=!0===n?{}:n,o=r.ttl??3600,i=r.staleWhileRevalidate??0,s=e.clone();s.headers.set("Cache-Control","max-age="+o+(i>0?", stale-while-revalidate="+i:"")),s.headers.delete("Set-Cookie"),await caches.default.put(t,s)}async fetch(t,e,n){const r=new URL(t.url),o=l(r.pathname),i=t.method,s=this.staticRoutes.get(i);if(s){const i=s.get(o);if(i)return this.v(i.handler,i.options,t,e,n,Object.create(null),r)}const a=this.dynamicTries[i];if(a){const i=a.match(c(o));if(i)return this.v(i.handler,i.options,t,e,n,i.params,r)}return new Response("Not Found",{status:404})}async v(t,e,n,r,o,i,s){const a=new T(n,r,o,i,s),c=this.security.extraHeaders;if(c)for(const t in c)Object.prototype.hasOwnProperty.call(c,t)&&a.headers.set(t,c[t]);let l,u=!1;try{u=await this.k(a,e.validate)}catch(t){this.p(a,"validation_error",t&&t.message),u=!1}if(!u)return a.text("Validation failed",400);try{l=await this.m(a,e.auth)}catch(t){this.p(a,"auth_error",t&&t.message),l={ok:!1,reason:"auth_error"}}if(!("boolean"==typeof l?l:l&&l.ok))return this.p(a,"auth_failure",l&&l.reason||"denied"),a.text("Unauthorized",401);let f,h=!1;try{h=await this.A(a,e.rateLimit)}catch(t){this.p(a,"rate_limit_error",t&&t.message),h=!1}if(!h)return this.p(a,"rate_limit_exceeded",null),a.text("Too Many Requests",429,{"Retry-After":"60"});if(e.cache&&"GET"===n.method){const t=await this.S(n);if(t)return this.C(a,e.cors),this.T(a,e.log),t}this.C(a,e.cors);try{const e=await t(a);f=e instanceof Response?e:e&&e.__isJSX?a.html(e):a.text("OK"),a.status=f.status}catch(t){this.p(a,"handler_error",t&&t.message),f=a.text("Internal Server Error",500),a.status=500}return e.cache&&"GET"===n.method&&200===f.status&&a.executionCtx.waitUntil(this.O(n,f.clone(),e.cache)),e.compress&&(f=this._(n,f)),this.T(a,e.log),f}};
+var t=Object.defineProperty,e=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,o=Object.prototype.hasOwnProperty,r=(e,n)=>{for(var o in n)t(e,o,{get:n[o],enumerable:!0})},i=(r,i,s,c)=>{if(i&&"object"==typeof i||"function"==typeof i)for(let l of n(i))o.call(r,l)||l===s||t(r,l,{get:()=>i[l],enumerable:!(c=e(i,l))||c.enumerable});return r},s=e=>i(t({},"__esModule",{value:!0}),e),c={};function l(t){const e=[],n=t.length;let o=1;for(let r=1;r<=n;r++)r!==n&&47!==t.charCodeAt(r)||(r>o&&e.push(t.slice(o,r)),o=r+1);return e}function a(t){const e=t.length;return e>1&&47===t.charCodeAt(e-1)?t.slice(0,-1):t}r(c,{Context:()=>T,Edge:()=>Edge,Fragment:()=>Fragment,jsx:()=>jsx,renderToString:()=>renderToString}),module.exports=s(c);var u=new Set(["__proto__","constructor","prototype"]);function f(t){return"string"==typeof t&&!u.has(t)}function h(t){const e=t.length;let n=0;for(;n<e;){const e=t.charCodeAt(n);if(38===e||60===e||62===e||34===e||39===e)break;n++}if(n===e)return t;let o=t.slice(0,n),r=n;for(;n<e;n++){const e=t.charCodeAt(n);let i;if(38===e)i="&amp;";else if(60===e)i="&lt;";else if(62===e)i="&gt;";else if(34===e)i="&quot;";else{if(39!==e)continue;i="&#039;"}n>r&&(o+=t.slice(r,n)),o+=i,r=n+1}return r<e&&(o+=t.slice(r)),o}var Fragment=Symbol("Fragment");function jsx(t,e,...n){return{type:t,props:e||{},children:n,__isJSX:!0}}var p=new Set(["area","base","br","col","embed","hr","img","input","link","meta","param","source","track","wbr"]),d=new Set(["allowfullscreen","async","autofocus","autoplay","checked","controls","default","defer","disabled","formnovalidate","hidden","inert","ismap","itemscope","loop","multiple","muted","nomodule","novalidate","open","playsinline","readonly","required","reversed","selected"]),y=new Set(["animation-iteration-count","border-image-outset","border-image-slice","border-image-width","box-flex","box-flex-group","box-ordinal-group","column-count","columns","flex","flex-grow","flex-positive","flex-shrink","flex-negative","flex-order","grid-row","grid-row-end","grid-row-span","grid-row-start","grid-column","grid-column-end","grid-column-span","grid-column-start","font-weight","line-clamp","line-height","opacity","order","orphans","tab-size","widows","z-index","zoom","fill-opacity","flood-opacity","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-miterlimit","stroke-opacity","stroke-width"]),g=new Map,m=2e3;function w(t){const e=g.get(t);if(void 0!==e)return e;const n=t.replace(/([A-Z])/g,"-$1").toLowerCase().replace(/^-/,"");return g.size>=m&&g.clear(),g.set(t,n),n}function C(t){if(!t||"object"!=typeof t)return"";let e="";for(const n in t){if(!Object.prototype.hasOwnProperty.call(t,n))continue;const o=w(n);let r=t[n];"number"!=typeof r||y.has(o)||(r+="px"),e&&(e+=";"),e+=o+":"+r}return e}var b=new Set(["href","src","xlink:href","action","formaction"]);function renderToString(t){if(null==t||"boolean"==typeof t)return"";const e=typeof t;if("string"===e)return h(t);if("number"===e)return h(String(t));if(Array.isArray(t)){let e="";for(let n=0;n<t.length;n++)e+=renderToString(t[n]);return e}if(!t.__isJSX)return h(String(t));const{type:n,props:o,children:r}=t;if(n===Fragment){let t="";for(let e=0;e<r.length;e++)t+=renderToString(r[e]);return t}if("symbol"==typeof n)return"";if("function"==typeof n)return renderToString(n({...o,children:r}));if("string"!=typeof n||!/^[A-Za-z][A-Za-z0-9-]*$/.test(n))return"";const i=p.has(n);let s="";for(const t in o){if(!Object.prototype.hasOwnProperty.call(o,t))continue;if("children"===t||"key"===t||"ref"===t)continue;const e=o[t];if(null==e||!1===e)continue;if("dangerouslySetInnerHTML"===t)continue;let n=t;if("className"===t||"class"===t?n="class":"htmlFor"!==t&&"for"!==t||(n="for"),f(n)&&!/^on/i.test(n)&&/^[A-Za-z_:][A-Za-z0-9_:.-]*$/.test(n)){if(b.has(n)){const t=String(e).replace(/[\u0000-\u0020]/g,"").toLowerCase();if(t.startsWith("javascript:")||t.startsWith("vbscript:")||t.startsWith("data:text/html"))continue}if(d.has(n))!0===e&&(s+=" "+n);else if(!0!==e){if("style"===n&&"object"==typeof e){const t=C(e);t&&(s+=' style="'+h(t)+'"');continue}s+=" "+n+'="'+h(String(e))+'"'}else s+=" "+n+'="true"'}}let c="";const l=o.dangerouslySetInnerHTML;if(l&&null!=l.__html)c=l.__html;else for(let t=0;t<r.length;t++)c+=renderToString(r[t]);return i?"<"+n+s+"/>":"<"+n+s+">"+c+"</"+n+">"}var T=class{constructor(t,e,n,o={},r=null){this.req=t,this.env=e,this.executionCtx=n,this.params=o,this.status=200,this.headers=new Headers,this.headers.set("X-Content-Type-Options","nosniff"),this.headers.set("X-Frame-Options","DENY"),this.headers.set("Referrer-Policy","strict-origin-when-cross-origin"),this.headers.set("Permissions-Policy","geolocation=(), microphone=(), camera=()"),this.t=t.headers.get("Cookie")||"",this.o=null,this.url=r||new URL(t.url)}i(){if(null!==this.o)return this.o;const t=Object.create(null),e=this.t;if(e){let n=0;const o=e.length;for(;n<o;){let r=e.indexOf(";",n);-1===r&&(r=o);let i=n,s=r;for(;i<s&&32===e.charCodeAt(i);)i++;for(;s>i&&32===e.charCodeAt(s-1);)s--;if(s>i){const n=e.indexOf("=",i);if(n>i&&n<s)try{const o=decodeURIComponent(e.slice(i,n));f(o)&&(t[o]=decodeURIComponent(e.slice(n+1,s)))}catch{}}n=r+1}}return this.o=t,t}getCookie(t){const e=this.i()[t];return void 0===e?null:e}get query(){return this.url.searchParams}setCookie(t,e,n={}){if("string"!=typeof t||!f(t)||/[\r\n;=]/.test(t))return;let o=encodeURIComponent(t)+"="+encodeURIComponent(e);n.path&&(o+="; Path="+n.path),n.domain&&(o+="; Domain="+n.domain),void 0!==n.maxAge&&(o+="; Max-Age="+n.maxAge),n.expires&&(o+="; Expires="+n.expires.toUTCString()),n.secure&&(o+="; Secure"),n.httpOnly&&(o+="; HttpOnly"),n.sameSite&&(o+="; SameSite="+n.sameSite),this.headers.append("Set-Cookie",o)}deleteCookie(t,e={}){this.setCookie(t,"",{...e,maxAge:0,expires:new Date(0)})}l(t){if(!t)return this.headers;let e=!1;for(const n in t){e=!0;break}if(!e)return this.headers;const n=new Headers(this.headers);for(const e in t)Object.prototype.hasOwnProperty.call(t,e)&&n.set(e,t[e]);return n}text(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","text/plain; charset=utf-8"),new Response(t,{status:e,headers:o})}json(t,e=this.status,n={}){const o=this.l(n);return o.has("Content-Type")||o.set("Content-Type","application/json; charset=utf-8"),new Response(JSON.stringify(t),{status:e,headers:o})}html(t,e=this.status,n={}){const o=this.l(n);o.has("Content-Type")||o.set("Content-Type","text/html; charset=utf-8");const r="string"==typeof t?t:t&&t.__isJSX||Array.isArray(t)?renderToString(t):null==t?"":String(t);return new Response(r,{status:e,headers:o})}redirect(t,e=302){const n=new Headers(this.headers);return n.set("Location",String(t)),n.delete("Content-Type"),new Response(null,{status:e,headers:n})}},A=class{constructor(){this.children=null,this.paramChild=null,this.handler=null}},O=class{constructor(){this.root=new A}add(t,e,n){let o=this.root;const r=[];for(let e=0;e<t.length;e++){const n=t[e];if(58===n.charCodeAt(0)){const t=n.slice(1);r.push(f(t)?t:"_p"+e),o.paramChild||(o.paramChild=new A),o=o.paramChild}else{o.children||(o.children=new Map);let t=o.children.get(n);t||(t=new A,o.children.set(n,t)),o=t}}o.handler={handler:e,options:n,paramNames:r}}match(t){const e=[],n=this.u(this.root,t,0,e);if(!n)return null;const{handler:o,options:r,paramNames:i}=n,s=Object.create(null);for(let t=0;t<i.length;t++)s[i[t]]=e[t];return{handler:o,options:r,params:s}}u(t,e,n,o){if(n===e.length)return t.handler;const r=e[n],i=t.children;if(i){const t=i.get(r);if(t){const r=this.u(t,e,n+1,o);if(r)return r}}const s=t.paramChild;if(s){o.push(r);const t=this.u(s,e,n+1,o);if(t)return t;o.pop()}return null}},S=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD"],E=new Map;function v(t,e,n){const o=t+"|"+(e||"")+"|"+(n||""),r=Date.now(),i=E.get(o);if(i&&r-i<6e4)return!1;if(E.set(o,r),E.size>5e3)for(const[t,e]of E)r-e>6e4&&E.delete(t);return!0}var Edge=class{constructor(){this.staticRoutes=new Map;for(let t=0;t<S.length;t++)this.staticRoutes.set(S[t],new Map);this.dynamicTries={};for(let t=0;t<S.length;t++)this.dynamicTries[S[t]]=new O;this.defaults={cors:{origin:"*",methods:"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"}},this.scheduledHandler=null,this.security={logSecurityEvents:!0,extraHeaders:null,trustedProxies:null}}h(t,e,n,o){if("boolean"==typeof n?n={}:"function"==typeof n&&(o=n,n={}),"function"!=typeof o)throw new Error("Handler for "+t+" "+e+" must be a function");const r={...this.defaults,...n||{}};-1===e.indexOf(":")?this.staticRoutes.get(t).set(a(e),{handler:o,options:r}):this.dynamicTries[t].add(l(e),o,r)}get(t,e,n){this.h("GET",t,e,n)}post(t,e,n){this.h("POST",t,e,n)}put(t,e,n){this.h("PUT",t,e,n)}delete(t,e,n){this.h("DELETE",t,e,n)}patch(t,e,n){this.h("PATCH",t,e,n)}options(t,e,n){this.h("OPTIONS",t,e,n)}head(t,e,n){this.h("HEAD",t,e,n)}scheduled(t){this.scheduledHandler=t}p(t,e,n){if(this.security.logSecurityEvents)try{const o=t.req.headers.get("CF-Connecting-IP")||"",r=t.url?t.url.pathname:"";if(!v(e,o,r))return;console.log(JSON.stringify({ts:(new Date).toISOString(),kind:"security",event:e,detail:"string"==typeof n?n:void 0,ip:o||void 0,method:t.req.method,path:r,ua:t.req.headers.get("User-Agent")||void 0}))}catch{}}m(t,e){if(!e)return;const n="object"==typeof e?e:this.defaults.cors,o=t.req.headers.get("Origin"),r=n.origin;"*"===r?t.headers.set("Access-Control-Allow-Origin","*"):Array.isArray(r)?o&&-1!==r.indexOf(o)&&(t.headers.set("Access-Control-Allow-Origin",o),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")):"string"==typeof r&&o===r&&(t.headers.set("Access-Control-Allow-Origin",o),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")),t.headers.set("Access-Control-Allow-Methods",n.methods||"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"),t.headers.set("Access-Control-Allow-Headers",n.headers||"Content-Type, Authorization, X-CSRF-Token"),t.headers.set("Access-Control-Max-Age","86400")}C(t,e){e&&console.log(t.req.method+" "+t.req.url+" - "+t.status)}T(t,e){const n=t.headers.get("Accept-Encoding")||"";let o=null;if(-1!==n.indexOf("gzip")?o="gzip":-1!==n.indexOf("deflate")&&(o="deflate"),!o||!e.body)return e;const r=e.body.pipeThrough(new CompressionStream(o)),i=new Headers(e.headers);return i.set("Content-Encoding",o),i.set("Vary","Accept-Encoding"),i.delete("Content-Length"),new Response(r,{status:e.status,statusText:e.statusText,headers:i})}async A(t,e){return!e||"function"!=typeof e||!!await e(t)}async O(t){return await caches.default.match(t)||null}async S(t,e,n){if(!n)return;const o=!0===n?{}:n,r=o.ttl??3600,i=o.staleWhileRevalidate??0,s=e.clone();s.headers.set("Cache-Control","max-age="+r+(i>0?", stale-while-revalidate="+i:"")),s.headers.delete("Set-Cookie"),await caches.default.put(t,s)}async fetch(t,e,n){const o=new URL(t.url),r=a(o.pathname),i=t.method,s=this.staticRoutes.get(i);if(s){const i=s.get(r);if(i)return this.v(i.handler,i.options,t,e,n,Object.create(null),o)}const c=this.dynamicTries[i];if(c){const i=c.match(l(r));if(i)return this.v(i.handler,i.options,t,e,n,i.params,o)}return new Response("Not Found",{status:404})}async v(t,e,n,o,r,i,s){const c=new T(n,o,r,i,s),l=this.security.extraHeaders;if(l)for(const t in l)Object.prototype.hasOwnProperty.call(l,t)&&c.headers.set(t,l[t]);let a,u=!1;try{u=await this.A(c,e.validate)}catch(t){this.p(c,"validation_error",t&&t.message),u=!1}if(!u)return c.text("Validation failed",400);if(e.cache&&"GET"===n.method){const t=await this.O(n);if(t)return this.m(c,e.cors),this.C(c,e.log),t}this.m(c,e.cors);try{const e=await t(c);a=e instanceof Response?e:e&&e.__isJSX?c.html(e):c.text("OK"),c.status=a.status}catch(t){this.p(c,"handler_error",t&&t.message),a=c.text("Internal Server Error",500),c.status=500}return e.cache&&"GET"===n.method&&200===a.status&&c.executionCtx.waitUntil(this.S(n,a.clone(),e.cache)),e.compress&&(a=this.T(n,a)),this.C(c,e.log),a}};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lengkapp/edge",
-  "version": "0.0.23",
+  "version": "0.0.24",
   "description": "Edge framework used by Lengkapp",
   "main": "dist/edge-server.js",
   "types": "dist/edge-server.d.ts",

package/readme.md

@@ -1,10 +1,10 @@
 # @lengkapp/edge
 
-A minimal, high-performance framework for Cloudflare Workers with built-in server-side rendering, routing, auth, rate limiting, caching, and a declarative client-side partial-update library.
+A minimal, high-performance framework for Cloudflare Workers with built-in server-side rendering, routing, caching, and a declarative client-side partial-update library.
 
 Inspired by Hono, `@lengkapp/edge` aims for the same class of performance while shipping with zero runtime dependencies.
 
-**Security:** The server is hardened against the OWASP Top 10:2025 and ASVS 5.0 Layer 1 controls — prototype-safe params, cookies, JSON bodies and JSX attributes; CSP-friendly response headers; fail-closed middleware; strict CORS allowlist; and structured security logging. See [Security](#security).
+**Security:** The server is hardened against the OWASP Top 10:2025 and ASVS 5.0 Layer 1 controls — prototype-safe params, cookies, JSON bodies and JSX attributes; CSP-friendly response headers; fail-closed middleware; strict CORS allowlist; and structured security logging. See [Security](#security-controls).
 
 ---
 
@@ -15,6 +15,7 @@ Inspired by Hono, `@lengkapp/edge` aims for the same class of performance while
 - [Quick Start](#quick-start)
 - [Server API](#server-api)
 - [JSX Support](#jsx-support)
+- [Full Example](#full-example)
 - [Client (Declarative Partial Updates)](#client-declarative-partial-updates)
 - [CSRF Protection](#csrf-protection)
 - [Security Controls](#security-controls)
@@ -33,7 +34,7 @@ Inspired by Hono, `@lengkapp/edge` aims for the same class of performance while
 
 - **Trie-based routing** – static & dynamic routes (`/users/:id`)
 - **JSX support** – pass JSX straight to `ctx.html(<Card />)`; no build step, no manual `renderToString` call
-- **Middleware** – auth, rate limiting, CORS, logging, caching, compression, validation
+- **Middleware** – CORS, logging, caching, compression, validation
 - **Cookie helpers** with validation
 - **Scheduled tasks** via Cron triggers
 - **Zero dependencies**
@@ -51,9 +52,8 @@ Inspired by Hono, `@lengkapp/edge` aims for the same class of performance while
 
 - **Prototype-pollution safe** – route params, cookies, JSON bodies, JSX attributes
 - **XSS-hardened JSX** – no `on*` attributes, no `javascript:` URLs, no malformed tag names
-- **Structured security logging** – throttled JSON events for auth/rate-limit/handler failures
-- **Fail-closed middleware** – validation, auth, and rate limit errors deny by default
-- **Opt-in token hashing** – SHA-256 before KV lookup
+- **Structured security logging** – throttled JSON events for validation and handler failures
+- **Fail-closed middleware** – validation and handler errors deny by default
 - **Strict CORS allowlist** – per-origin reflection with `Vary: Origin`
 
 ---
@@ -64,11 +64,9 @@ Inspired by Hono, `@lengkapp/edge` aims for the same class of performance while
 npm install @lengkapp/edge
 ```
 
----
-
 ## Quick Start
 
-**`worker.js`:**
+`worker.js`:
 
 ```ts
 import { Edge } from '@lengkapp/edge';
@@ -81,7 +79,7 @@ app.get('/users/:id', (ctx) => ctx.json({ id: ctx.params.id }));
 export default app;
 ```
 
-Or, if you will use JSX, **`worker.tsx`:**
+Or, if you will use JSX, `worker.tsx`:
 
 ```tsx
 import { Edge, jsx, Fragment } from '@lengkapp/edge';
@@ -104,7 +102,7 @@ app.get('/', () => <LandingPage />);
 export default app;
 ```
 
-If you use TypeScript, **`tsconfig.json`:**
+If you use TypeScript, `tsconfig.json`:
 
 ```json
 {
@@ -124,7 +122,7 @@ If you use TypeScript, **`tsconfig.json`:**
 }
 ```
 
-**`wrangler.jsonc`:**
+`wrangler.jsonc`:
 
 ```jsonc
 {
@@ -135,7 +133,7 @@ If you use TypeScript, **`tsconfig.json`:**
 }
 ```
 
-Or **`wrangler.toml`:**
+Or `wrangler.toml`:
 
 ```toml
 name = "my-edge-app"
@@ -149,52 +147,53 @@ Deploy:
 wrangler deploy
 ```
 
----
-
 ## Server API
 
 ### Context
 
 | Member | Description |
-|---|---|
-| `ctx.req` | Incoming `Request` |
+| --- | --- |
+| `ctx.req` | Incoming Request |
 | `ctx.env` | Environment bindings |
-| `ctx.executionCtx` | `ExecutionContext` |
+| `ctx.executionCtx` | ExecutionContext |
 | `ctx.params` | Prototype-safe route params object |
 | `ctx.status` | Default response status (200) |
-| `ctx.headers` | Response `Headers` |
-| `ctx.query` | `URLSearchParams` |
+| `ctx.headers` | Response Headers |
+| `ctx.query` | URLSearchParams |
+| `ctx.url` | Parsed URL object |
 | `ctx.getCookie(name)` | Read a cookie |
 | `ctx.setCookie(name, value, options)` | Set a cookie (name validated) |
 | `ctx.deleteCookie(name, options)` | Delete a cookie |
 | `ctx.text(data, status?, headers?)` | Plain-text response |
 | `ctx.json(data, status?, headers?)` | JSON response |
 | `ctx.html(data, status?, headers?)` | HTML response — accepts a raw string, a JSX element, or an array of JSX elements |
+| `ctx.redirect(location, status?)` | Redirect (default 302), preserving headers already set on the context |
 
 Every response carries `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy: strict-origin-when-cross-origin`, and a restrictive `Permissions-Policy`.
 
 ### Route Options
 
 ```ts
-app.get('/protected', { auth: true }, handler);
-app.get('/admin',     { auth: { role: 'admin' } }, handler);
-app.get('/scoped',    { auth: { scopes: ['read', 'write'] } }, handler);
-app.get('/limited',   { rateLimit: { max: 100, window: 60 } }, handler);
-app.get('/cached',    { cache: { ttl: 60 } }, handler);
-app.get('/api',       { cors: true }, handler);
-app.post('/submit',   { validate: (ctx) => /* ... */ true }, handler);
+app.get('/cached',  { cache: { ttl: 60 } }, handler);
+app.get('/api',     { cors: true }, handler);
+app.get('/gzip',    { compress: true }, handler);
+app.get('/logged',  { log: true }, handler);
+app.post('/submit', { validate: (ctx) => /* ... */ true }, handler);
 ```
 
-- **Auth:** Tokens are looked up in `AUTH_KV`. Send via `Authorization: Bearer <token>` or the `auth_token` cookie. Payloads with an `exp` field (Unix seconds) are rejected when expired.
-- **CORS:** The default is `origin: '*'`. For production, use a strict allowlist:
+**Cache:** `{ ttl, staleWhileRevalidate }` — TTL in seconds, default 3600; only applied to GET responses with status 200. `Set-Cookie` is stripped from cached responses.
 
-  ```ts
-  app.defaults.cors.origin = ['https://app.example.com'];
-  ```
+**CORS:** The default is `origin: '*'`. For production, use a strict allowlist:
 
-- **Rate limit:** `429` responses carry `Retry-After: 60`.
+```ts
+app.defaults.cors.origin = ['https://app.example.com'];
+```
 
----
+**Compress:** Negotiates gzip or deflate from `Accept-Encoding` using the native `CompressionStream`.
+
+**Log:** Logs `METHOD URL - STATUS` to the console.
+
+**Validate:** Receives the Context; return `true` to allow or `false` / a falsy value to reject with `400 Validation failed`. Async validators are awaited. Thrown errors are logged and treated as a rejection.
 
 ## JSX Support
 
@@ -214,6 +213,12 @@ app.get('/list',    (ctx) => ctx.html([<Card title="A" />, <Card title="B" />]))
 app.get('/raw',     (ctx) => ctx.html('<p>pre-rendered</p>'));
 ```
 
+Returning a JSX element directly from a handler is also supported — it is treated as an HTML response:
+
+```tsx
+app.get('/', () => <LandingPage />);
+```
+
 `renderToString` is still exported for advanced use cases (for example, embedding rendered HTML inside another response body or email template):
 
 ```tsx
@@ -230,8 +235,419 @@ const html = renderToString(<Card title="Hello" />);
 - `href` / `src` / `action` / `formaction` / `xlink:href` values beginning with `javascript:`, `vbscript:`, or `data:text/html` are stripped.
 - Prototype keys (`__proto__`, `constructor`, `prototype`) are rejected.
 - All string values are HTML-escaped.
+- **Style objects.** `style={{ backgroundColor: 'tomato', padding: 12 }}` is emitted as `style="background-color:tomato;padding:12px"`. Numeric values are suffixed with `px` unless the property is unitless (`opacity`, `lineHeight`, `zIndex`, `flex`, …).
+- **Aliases.** `className` → `class`, `htmlFor` → `for`.
+- **Boolean attributes.** `checked`, `disabled`, `required`, `readonly`, `multiple`, etc. emit as bare attributes when `true` and are dropped when `false`.
+- **`dangerouslySetInnerHTML`.** Supported via `dangerouslySetInnerHTML={{ __html: '…' }}` — the value is inserted verbatim and is not escaped. Only use it with trusted content.
 
----
+## Full Example
+
+A single file that exercises every server feature.
+
+```tsx
+// sample.tsx
+//
+// Demonstrates every feature of @lengkapp/edge:
+//   - static & dynamic routes, all HTTP methods
+//   - params, query, cookies (get/set/delete)
+//   - ctx.text / ctx.json / ctx.html / ctx.redirect
+//   - JSX rendering (elements, Fragments, function components, arrays)
+//   - style objects, boolean attributes, void elements,
+//     className/htmlFor aliases, dangerouslySetInnerHTML
+//   - route options: cors, cache, compress, log, validate
+//   - security.extraHeaders, security.logSecurityEvents
+//   - scheduled handler
+//   - returning JSX directly from a handler
+
+import {
+  Edge,
+  Context,
+  Fragment,
+  renderToString,
+  type JSXNode,
+  type RouteOptions,
+} from '@lengkapp/edge';
+
+/* ------------------------------------------------------------------ *
+ *  Small helper components (JSX function components)                 *
+ * ------------------------------------------------------------------ */
+
+function Layout(props: { title: string; children?: any }) {
+  return (
+    <html lang="en">
+      <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <title>{props.title}</title>
+      </head>
+      <body>
+        <header>
+          <nav>
+            <a href="/">Home</a>{' · '}
+            <a href="/about">About</a>{' · '}
+            <a href="/users/42">User 42</a>{' · '}
+            <a href="/dashboard">Dashboard</a>
+          </nav>
+        </header>
+        <main>{props.children}</main>
+        <footer>© {new Date().getFullYear()}</footer>
+      </body>
+    </html>
+  );
+}
+
+function UserCard(props: { id: string; name: string; admin?: boolean }) {
+  return (
+    <div class="card" data-id={props.id}>
+      <h2>{props.name}</h2>
+      {props.admin && <span class="badge">admin</span>}
+    </div>
+  );
+}
+
+function TodoList(props: { items: string[] }) {
+  return (
+    <ul>
+      {props.items.map((item, i) => (
+        <li key={i}>{item}</li>
+      ))}
+    </ul>
+  );
+}
+
+/* ------------------------------------------------------------------ *
+ *  App                                                               *
+ * ------------------------------------------------------------------ */
+
+const app = new Edge();
+
+// ---- Security: global extra headers + keep security logging on ------
+app.security.logSecurityEvents = true;
+app.security.extraHeaders = {
+  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
+  'X-Custom-Powered-By': 'edge-server',
+};
+
+/* ================================================================== *
+ *  Basic routes                                                      *
+ * ================================================================== */
+
+// Plain text
+app.get('/health', (ctx) => ctx.text('ok'));
+
+// JSON with a custom status
+app.get('/api/time', (ctx) =>
+  ctx.json({ now: new Date().toISOString() }, 200)
+);
+
+// Returning JSX directly from a handler → automatically becomes
+// a text/html Response.
+app.get('/', () => (
+  <Layout title="Home">
+    <h1>Hello from edge-server</h1>
+    <p>This page was rendered from JSX.</p>
+    <TodoList items={['Write routes', 'Render JSX', 'Ship it']} />
+  </Layout>
+));
+
+// Explicit ctx.html with a JSX tree
+app.get('/about', (ctx) =>
+  ctx.html(
+    <Layout title="About">
+      <h1>About</h1>
+      <p>
+        Fragments, components, arrays — all supported.
+      </p>
+      {/* Array of JSX is allowed inside a fragment */}
+      <Fragment>
+        <UserCard id="1" name="Ada" admin />
+        <UserCard id="2" name="Grace" />
+      </Fragment>
+    </Layout>
+  )
+);
+
+// ctx.html also accepts a raw HTML string (passes through unchanged)
+app.get('/raw', (ctx) =>
+  ctx.html('<h1>Raw HTML</h1><p>Not escaped.</p>')
+);
+
+/* ================================================================== *
+ *  Params, query, cookies                                            *
+ * ================================================================== */
+
+// Dynamic route: /users/:id
+app.get('/users/:id', (ctx) => {
+  const { id } = ctx.params;
+  return ctx.html(
+    <Layout title={`User ${id}`}>
+      <UserCard id={id} name={`User #${id}`} />
+    </Layout>
+  );
+});
+
+// Multiple params: /posts/:year/:slug
+app.get('/posts/:year/:slug', (ctx) => {
+  const { year, slug } = ctx.params;
+  return ctx.json({ year, slug });
+});
+
+// Query strings: /search?q=hello&limit=10
+app.get('/search', (ctx) => {
+  const q = ctx.query.get('q') ?? '';
+  const limit = Number(ctx.query.get('limit') ?? '10');
+  return ctx.json({ q, limit });
+});
+
+// Cookies: read, write, delete
+app.get('/login', (ctx) => {
+  ctx.setCookie('session', 'abc123', {
+    path: '/',
+    httpOnly: true,
+    secure: true,
+    sameSite: 'Lax',
+    maxAge: 3600,
+  });
+  return ctx.redirect('/dashboard');
+});
+
+app.get('/logout', (ctx) => {
+  ctx.deleteCookie('session', { path: '/' });
+  return ctx.redirect('/');
+});
+
+app.get('/dashboard', (ctx) => {
+  const session = ctx.getCookie('session');
+  if (!session) return ctx.redirect('/login');
+  return ctx.html(
+    <Layout title="Dashboard">
+      <h1>Dashboard</h1>
+      <p>Session: {session}</p>
+    </Layout>
+  );
+});
+
+/* ================================================================== *
+ *  All HTTP methods                                                  *
+ * ================================================================== */
+
+app.post('/api/echo', async (ctx) => {
+  const body = await ctx.req.json().catch(() => null);
+  return ctx.json({ received: body }, 201);
+});
+
+app.put('/api/items/:id', async (ctx) => {
+  const body = await ctx.req.json().catch(() => null);
+  return ctx.json({ updated: ctx.params.id, body });
+});
+
+app.patch('/api/items/:id', (ctx) =>
+  ctx.json({ patched: ctx.params.id })
+);
+
+app.delete('/api/items/:id', (ctx) =>
+  ctx.json({ deleted: ctx.params.id }, 200)
+);
+
+app.options('/api/items', (ctx) => ctx.text('', 204));
+
+app.head('/api/items', (ctx) => ctx.text('', 200));
+
+/* ================================================================== *
+ *  Route options: cors, cache, compress, log, validate               *
+ * ================================================================== */
+
+// CORS with a wildcard origin
+app.get(
+  '/cors-open',
+  { cors: true, log: true },
+  (ctx) => ctx.json({ cors: 'wildcard' })
+);
+
+// CORS with an allow-list + credentials
+app.get(
+  '/cors-restricted',
+  {
+    cors: {
+      origin: ['https://app.example.com', 'https://admin.example.com'],
+      methods: 'GET, POST',
+      headers: 'Content-Type, X-CSRF-Token',
+    },
+  },
+  (ctx) => ctx.json({ cors: 'restricted' })
+);
+
+// Caching: cache the GET response for 60s, revalidate in background
+app.get(
+  '/cached',
+  {
+    cache: { ttl: 60, staleWhileRevalidate: 30 },
+    log: true,
+  },
+  (ctx) => ctx.json({ generatedAt: Date.now() })
+);
+
+// Compression (gzip / deflate based on Accept-Encoding)
+app.get(
+  '/big',
+  { compress: true },
+  (ctx) => ctx.html(`<pre>${'x'.repeat(5000)}</pre>`)
+);
+
+// Request validation — return false to get a 400 automatically
+app.post(
+  '/admin',
+  {
+    validate: (ctx) => {
+      const token = ctx.req.headers.get('X-Admin-Token');
+      return token === 'let-me-in';
+    },
+  },
+  (ctx) => ctx.json({ ok: true })
+);
+
+// Everything combined
+const everythingOptions: RouteOptions = {
+  cors: { origin: '*' },
+  cache: { ttl: 120, staleWhileRevalidate: 60 },
+  compress: true,
+  log: true,
+  validate: async (ctx) => ctx.req.method === 'GET',
+};
+
+app.get('/everything', everythingOptions, (ctx) =>
+  ctx.html(
+    <Layout title="Everything">
+      <h1>All options at once</h1>
+    </Layout>
+  )
+);
+
+/* ================================================================== *
+ *  JSX feature gallery                                               *
+ * ================================================================== */
+
+app.get('/jsx/gallery', (ctx) =>
+  ctx.html(
+    <Layout title="JSX Gallery">
+      {/* Style objects → kebab-cased, numbers get px added */}
+      <div
+        style={{
+          backgroundColor: 'tomato',
+          padding: 12,
+          opacity: 0.9,
+          lineHeight: 1.4, // unitless, stays as-is
+        }}
+      >
+        Styled box
+      </div>
+
+      {/* className and htmlFor are aliased to class / for */}
+      <label className="lbl" htmlFor="name">
+        Name
+      </label>
+      <input id="name" type="text" required disabled={false} />
+
+      {/* Boolean attributes: true emits the bare attribute */}
+      <input type="checkbox" checked readOnly />
+      <button disabled>Nope</button>
+
+      {/* Void elements self-close */}
+      <img src="/logo.png" alt="logo" />
+      <br />
+      <hr />
+
+      {/* dangerouslySetInnerHTML */}
+      <div dangerouslySetInnerHTML={{ __html: '<b>trusted</b>' }} />
+
+      {/* Fragments */}
+      <>
+        <p>Fragment child A</p>
+        <p>Fragment child B</p>
+      </>
+
+      {/* Arrays of JSX */}
+      {[<span key="a">A</span>, <span key="b">B</span>, <span key="c">C</span>]}
+
+      {/* Escaping: user-supplied strings are escaped */}
+      <p>{'<script>alert(1)</script>'}</p>
+
+      {/* Dangerous URLs are dropped */}
+      <a href="javascript:alert(1)">nope</a>
+      <a href="https://example.com">ok</a>
+
+      {/* Numbers are stringified and escaped */}
+      <p>Count: {42}</p>
+
+      {/* null / undefined / booleans render nothing */}
+      <p>{null}{undefined}{false}{true}</p>
+    </Layout>
+  )
+);
+
+/* ================================================================== *
+ *  renderToString() standalone                                       *
+ * ================================================================== */
+
+app.get('/jsx/string', (ctx) => {
+  const html = renderToString(
+    <section>
+      <h1>Rendered manually</h1>
+      <p>Via renderToString()</p>
+    </section>
+  );
+  return ctx.html(html);
+});
+
+/* ================================================================== *
+ *  Scheduled handler                                                 *
+ * ================================================================== */
+
+app.scheduled(async (event, env, ctx) => {
+  console.log('cron fired at', new Date(event.scheduledTime).toISOString());
+  // e.g. warm a cache, prune KV entries, etc.
+});
+
+/* ================================================================== *
+ *  Cloudflare Workers entry points                                   *
+ * ================================================================== */
+
+export default {
+  fetch: (req: Request, env: any, ctx: ExecutionContext) =>
+    app.fetch(req, env, ctx),
+  scheduled: (event: ScheduledEvent, env: any, ctx: ExecutionContext) =>
+    app.scheduledHandler?.(event, env, ctx),
+};
+```
+
+### Feature → route cheat-sheet
+
+| Feature | Route / location |
+| --- | --- |
+| `ctx.text` | `GET /health` |
+| `ctx.json` | `GET /api/time`, `POST /api/echo`, … |
+| `ctx.html` with JSX | `GET /` |
+| `ctx.html` with string | `GET /raw` |
+| Returning JSX directly | `GET /` |
+| `ctx.redirect` | `GET /login`, `GET /logout`, `GET /dashboard` |
+| `ctx.params` | `GET /users/:id`, `GET /posts/:year/:slug` |
+| `ctx.query` | `GET /search` |
+| `ctx.getCookie` / `setCookie` / `deleteCookie` | `/login`, `/logout`, `/dashboard` |
+| All HTTP verbs | `/api/echo` (POST), `/api/items/:id` (PUT/PATCH/DELETE), `/api/items` (OPTIONS/HEAD) |
+| `cors` | `/cors-open`, `/cors-restricted`, `/everything` |
+| `cache` | `/cached`, `/everything` |
+| `compress` | `/big`, `/everything` |
+| `log` | `/cors-open`, `/cached`, `/everything` |
+| `validate` | `POST /admin`, `/everything` |
+| `security.extraHeaders` | set once near the top |
+| `security.logSecurityEvents` | set once near the top |
+| Fragments | `GET /about`, `GET /jsx/gallery` |
+| Function components | `Layout`, `UserCard`, `TodoList` |
+| Style objects | `GET /jsx/gallery` |
+| Boolean attrs / void elements | `GET /jsx/gallery` |
+| `dangerouslySetInnerHTML` | `GET /jsx/gallery` |
+| `renderToString()` standalone | `GET /jsx/string` |
+| `scheduled()` | bottom of file |
 
 ## Client (Declarative Partial Updates)
 
@@ -242,8 +658,8 @@ const html = renderToString(<Card title="Hello" />);
 ### Attributes
 
 | Attribute | Description |
-|---|---|
-| `_get` / `_post` | Request URL and HTTP method. Only `GET` and `POST` are supported. |
+| --- | --- |
+| `_get` / `_post` | Request URL and HTTP method. Only GET and POST are supported. |
 | `_in` | Replace the target's children with the response. |
 | `_out` | Replace the target element itself. |
 | `_before` | Insert the response before the target. |
@@ -252,11 +668,11 @@ const html = renderToString(<Card title="Hello" />);
 | `_form` | CSS selector or element ID of a form to serialize as the body. |
 | `_json` | Comma-separated field names to send as a JSON body. |
 | `_loader` | `spinner` (default), `skeleton`, or `none` / `off` / `false` to disable. |
-| `_timeout` | Request timeout in milliseconds (default `20000`). |
+| `_timeout` | Request timeout in milliseconds (default 20000). |
 
 **Targets.** Exactly one placement attribute (`_in`, `_out`, `_before`, `_after`) should be present. Its value is a CSS selector, the literal string `this`, or empty — the last two both resolve to the element that carries the attribute.
 
-**Field scope.** `_json` reads values from the closest enclosing `<form>`, or from the document if there is none. It also accepts fields by `id` first, then by `name` (grouped radio/checkbox inputs are handled).
+**Field scope.** `_json` reads values from the closest enclosing `<form>`, or from the document if there is none. It also accepts fields by id first, then by name (grouped radio/checkbox inputs are handled).
 
 ### Examples
 
@@ -289,15 +705,15 @@ const html = renderToString(<Card title="Hello" />);
 
 ### How Content Is Inserted
 
-1. The request is sent with `credentials: 'same-origin'` and `X-Requested-With: XMLHttpRequest`.
-2. For `_post`, the body is JSON (`_json`), a `FormData` object (`_form`), or empty.
-3. The response text is parsed into a `<template>`.
-4. Any `<script>` elements are lifted out, then re-created and appended to `<head>` so the browser executes them. External scripts are de-duplicated by absolute URL.
-5. Newly inserted `[_get]` / `[_post]` elements are scanned and bound.
-6. Placement depends on the target mode:
-   - `_in` — the target's existing children are removed, then the fragment is appended.
-   - `_out` — the target itself is replaced.
-   - `_before` / `_after` — the fragment is inserted adjacent to the target.
+- The request is sent with `credentials: 'same-origin'` and `X-Requested-With: XMLHttpRequest`.
+- For `_post`, the body is JSON (`_json`), a `FormData` object (`_form`), or empty.
+- The response text is parsed into a `<template>`.
+- Any `<script>` elements are lifted out, then re-created and appended to `<head>` so the browser executes them. External scripts are de-duplicated by absolute URL.
+- Newly inserted `[_get]` / `[_post]` elements are scanned and bound.
+- Placement depends on the target mode:
+  - `_in` — the target's existing children are removed, then the fragment is appended.
+  - `_out` — the target itself is replaced.
+  - `_before` / `_after` — the fragment is inserted adjacent to the target.
 
 > **Note:** No content-type check, HTML sanitization, or CSRF token is applied by the client — it trusts the server's response and inserts it as-is. Treat the partial-HTML endpoints you point `_get` / `_post` at as part of your trusted surface.
 
@@ -314,11 +730,9 @@ const html = renderToString(<Card title="Hello" />);
 
 When `document.startViewTransition` is available, loader → content and loader → error swaps are wrapped in a view transition. The injected stylesheet disables the animation under `prefers-reduced-motion: reduce`.
 
----
-
 ## CSRF Protection
 
-The client does not attach a CSRF token automatically. Include the token as a form field or as part of the JSON payload built by `_json`, then validate it on the server:
+The client does not attach a CSRF token automatically. Include the token as a form field or as part of the JSON payload built by `_json`, then validate it on the server with a `validate` option:
 
 ```ts
 app.post('/submit', {
@@ -331,8 +745,6 @@ app.post('/submit', {
 
 For `_form`-based submissions, read the field from the parsed form data using the same pattern.
 
----
-
 ## Security Controls
 
 ```ts
@@ -340,7 +752,6 @@ const app = new Edge();
 
 app.defaults.cors.origin = ['https://app.example.com'];
 
-app.security.hashAuthTokens = true;    // SHA-256 token keys, migrate first
 app.security.logSecurityEvents = true; // structured JSON events (default on)
 app.security.extraHeaders = {
   'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload',
@@ -352,20 +763,18 @@ app.security.extraHeaders = {
 ## OWASP 2025 Coverage
 
 | Category | Mitigation |
-|---|---|
-| A01 Broken Access Control | Auth reasons, expiry enforcement, scope/role checks, strict target resolution |
+| --- | --- |
+| A01 Broken Access Control | Strict CORS allowlist, strict target resolution, no implicit trust |
 | A02 Security Misconfiguration | Safe default headers, strict CORS allowlist, `Vary: Origin` |
 | A03 Supply Chain | Zero deps |
-| A04 Crypto Failures | Optional SHA-256 token hashing |
+| A04 Crypto Failures | Standard Web Crypto only; no home-grown crypto |
 | A05 Injection / XSS | Prototype-safe objects, JSX attribute sanitization |
-| A06 Insecure Design | Numeric-sanitized rate limiter, `Retry-After` |
-| A07 Auth Failures | Structured failure reasons, no swallowed errors |
+| A06 Insecure Design | Fail-closed validation, explicit response modes |
+| A07 Auth Failures | Validation errors are surfaced, not swallowed |
 | A08 Data Integrity | Prototype-safe JSON, `Set-Cookie` stripped from cache |
 | A09 Logging | Structured JSON security events with 60s dedupe |
 | A10 Exceptional Conditions | Fail-closed middleware, no internal leakage |
 
----
-
 ## Scheduled Tasks
 
 ```ts
@@ -379,69 +788,54 @@ export default {
 };
 ```
 
----
-
 ## Configuration
 
-### KV Namespaces
-
-```bash
-wrangler kv namespace create AUTH_KV
-wrangler kv namespace create RATE_LIMIT_KV
-```
-
-```jsonc
-{
-  "kv_namespaces": [
-    { "binding": "AUTH_KV", "id": "..." },
-    { "binding": "RATE_LIMIT_KV", "id": "..." }
-  ]
-}
-```
+The `Edge` constructor takes no arguments. Behaviour is configured through public properties and route options:
 
-Rename the bindings on the instance:
+| Property | Type | Default |
+| --- | --- | --- |
+| `app.defaults.cors` | `{ origin, methods }` | `origin: '*'`, `methods: 'GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD'` |
+| `app.security.logSecurityEvents` | `boolean` | `true` |
+| `app.security.extraHeaders` | `Record<string, string> | null` | `null` |
+| `app.security.trustedProxies` | `string[] | null` | `null` |
 
 ```ts
-app.authKvBinding = 'CUSTOM_AUTH_KV';
-app.rateLimitKvBinding = 'CUSTOM_RATE_KV';
+app.defaults.cors = { origin: ['https://app.example.com'], methods: 'GET, POST' };
+app.security.extraHeaders = {
+  'Strict-Transport-Security': 'max-age=63072000; includeSubDomains',
+};
 ```
 
----
-
 ## Performance
 
 Zero runtime dependencies. On a local `wrangler dev` benchmark with `autocannon` (10 connections, 10s per route), throughput sits in the same tier as `hono` / `hono/tiny` / a native worker:
 
 | Framework | `/text` req/s | `/json` req/s |
-|---|---|---|
-| `@lengkapp/edge` | 503 | 500 |
+| --- | --- | --- |
+| @lengkapp/edge | 503 | 500 |
 | Hono | 506 | 495 |
 | Hono (tiny) | 505 | 498 |
 | Native Workers | 498 | 500 |
 
 The security hardening adds only cheap operations to the request path: prototype-safe objects, two regex checks per JSX attribute, and a throttled logger. No new async boundaries, no added dependencies, no hashing on the hot path.
 
-The JSX renderer itself is tuned for throughput: single-pass escaping (`charCodeAt` scan with a fast no-op path), direct string concatenation instead of intermediate arrays, cached camelCase → kebab-case conversions for style objects, and a `Set`-based URL-attribute lookup on the hot path. `ctx.html(<Card />)` skips the redundant string-identity check that a manual `renderToString(<Card />)` call would still hit.
+The JSX renderer itself is tuned for throughput: single-pass escaping (`charCodeAt` scan with a fast no-op path), direct string concatenation instead of intermediate arrays, cached camelCase → kebab-case conversions for style objects, and a Set-based URL-attribute lookup on the hot path. `ctx.html(<Card />)` skips the redundant string-identity check that a manual `renderToString(<Card />)` call would still hit.
 
-The client is equally lean: it injects a single stylesheet, binds each element exactly once via a `WeakSet`, and uses one delegated `click` listener for all `_trigger="click"` elements. An in-flight request on an element is aborted when a new one starts, and the loader is deferred by 100ms / held for at least 240ms so fast endpoints never flash UI.
-
----
+The client is equally lean: it injects a single stylesheet, binds each element exactly once via a `WeakSet`, and uses one delegated click listener for all `_trigger="click"` elements. An in-flight request on an element is aborted when a new one starts, and the loader is deferred by 100ms / held for at least 240ms so fast endpoints never flash UI.
 
 ## Security Posture Summary
 
 | Layer | Mechanism |
-|---|---|
+| --- | --- |
 | HTML insertion (client) | Response text parsed into a `<template>`; placement driven by `_in` / `_out` / `_before` / `_after` |
 | Script execution (client) | Extracted `<script>` elements re-created and appended to `<head>`; external scripts de-duplicated by absolute URL |
 | Request hygiene (client) | `credentials: 'same-origin'`, `X-Requested-With: XMLHttpRequest`, abortable via `AbortController`, `_timeout` (default 20s) |
 | Cookies | `credentials: 'same-origin'`; names validated on the server |
 | Server response headers | `nosniff`, `X-Frame-Options: DENY`, `Referrer-Policy`, `Permissions-Policy` |
-| Server middleware | Fail-closed; structured security logs; strict CORS allowlist; optional token hashing |
+| Server middleware | Fail-closed validation; structured security logs; strict CORS allowlist |
 | Prototype pollution | `Object.create(null)` + forbidden-key filtering in params, cookies, JSON, JSX (server) |
 | Build | Reserved exports/properties, `keep_quoted: "strict"`, per-bundle post-minification self-test |
 
----
-
 ## License
 
-See [LICENSE](./LICENSE). © LengkApp — Yasir Haris
+See LICENSE. © LengkApp — Yasir Haris