@lengkapp/edge 0.0.48 → 0.0.49

package/README.md

@@ -1,6 +1,6 @@
 # @lengkapp/edge
 
-A minimal, high-performance framework for Cloudflare Workers with built-in server-side rendering, routing, caching, compression, and a declarative client-side partial-update library.
+A minimal, high-performance framework for Cloudflare Workers with built-in server-side rendering, routing, and a declarative client-side partial-update library.
 
 Inspired by [Hono](https://hono.dev), `@lengkapp/edge` targets the same class of performance while shipping with **zero runtime dependencies**.
 
@@ -13,10 +13,6 @@ Inspired by [Hono](https://hono.dev), `@lengkapp/edge` targets the same class of
 - [Routing](#routing)
 - [Context API](#context-api)
 - [JSX & Server-Side Rendering](#jsx--server-side-rendering)
-- [Route Options](#route-options)
-- [Caching](#caching)
-- [Compression](#compression)
-- [CORS](#cors)
 - [Security](#security)
 - [Scheduled Handler](#scheduled-handler)
 - [Client-Side Partial Updates](#client-side-partial-updates)
@@ -30,9 +26,6 @@ Inspired by [Hono](https://hono.dev), `@lengkapp/edge` targets the same class of
 | ⚡ | **Fast router** | Static routes in a `Map`, dynamic routes in a trie — O(1) for static, O(segments) for params |
 | 🧩 | **Async JSX SSR** | `renderToString` supports async function components and streams nothing it doesn't need |
 | 🔒 | **Secure by default** | `nosniff`, `DENY` framing, strict referrer policy, permissions policy, URL/attribute sanitisation |
-| 🗄️ | **Edge caching** | `caches.default` integration with `ttl` and `stale-while-revalidate` |
-| 🗜️ | **Compression** | gzip / deflate via `CompressionStream`, content-type aware |
-| 🌐 | **CORS** | Per-route, wildcard / allow-list / exact-match |
 | 🍪 | **Cookies** | Lazy parsing, safe keys, full `Set-Cookie` option support |
 | 🪶 | **Client runtime** | ~2 KB IIFE: fetch + swap HTML from HTML attributes. No build step |
 | 📦 | **Zero deps** | Nothing but the platform |
@@ -107,8 +100,9 @@ npm run dev      # http://localhost:8787
 npm run deploy
 ```
 
-> **Why `export default app`?**
-> The `Edge` instance exposes a `fetch(request, env, executionCtx)` method, which is exactly the Workers module-syntax contract.
+### Why `export default app`?
+
+The `Edge` instance exposes a `fetch(request, env, executionCtx)` method, which is exactly the Workers module-syntax contract.
 
 ### JSX pragma
 
@@ -125,20 +119,18 @@ That's all the configuration required — no Babel, no tsconfig, no plugin.
 ## Routing
 
 ```js
-app.get(path, [options], handler);
-app.post(path, [options], handler);
-app.put(path, [options], handler);
-app.delete(path, [options], handler);
-app.patch(path, [options], handler);
-app.options(path, [options], handler);
-app.head(path, [options], handler);
+app.get(path, handler);
+app.post(path, handler);
+app.put(path, handler);
+app.delete(path, handler);
+app.patch(path, handler);
+app.options(path, handler);
+app.head(path, handler);
 ```
 
-`options` may be omitted entirely, or passed as the second argument:
-
 ```js
 app.get('/health', (c) => c.text('ok'));
-app.get('/api/users/:id', { cache: { ttl: 60 } }, (c) => c.json({ id: c.params.id }));
+app.get('/api/users/:id', (c) => c.json({ id: c.params.id }));
 ```
 
 ### Static vs. dynamic paths
@@ -161,6 +153,20 @@ app.get('/users/:id', (c) => {
 
 Unmatched requests receive `404 Not Found` as `text/plain`.
 
+### Mounting sub-apps
+
+Assign an `Edge` (or array of `Edge`s) to `app.routes` to merge its routes into the parent, prefixed with the parent's own prefix:
+
+```js
+const signIn = new Edge('/sign-in');
+signIn.get('/login', handler);       // → /sign-in/login
+
+const app = new Edge();
+app.routes = [signIn];
+```
+
+> **Note:** The merge is eager and one-way: routes registered on a sub-app *after* it was mounted do not propagate.
+
 ## Context API
 
 Every handler receives a `Context` instance.
@@ -171,7 +177,6 @@ Every handler receives a `Context` instance.
 |---|---|---|
 | `c.req` | `Request` | The incoming request |
 | `c.env` | `object` | Worker bindings / environment |
-| `c.executionCtx` | `ExecutionContext` | For `waitUntil()` |
 | `c.params` | `object` | Route parameters |
 | `c.url` | `URL` | Parsed request URL |
 | `c.query` | `URLSearchParams` | `c.url.searchParams` |
@@ -195,7 +200,7 @@ c.redirect('https://example.com', 301);
 - a JSX node or array of nodes (rendered with `renderToString`)
 - anything else (`String(data)`)
 
-Both are async because component trees may contain async components.
+Both are `async` because component trees may contain async components.
 
 ### Headers
 
@@ -352,108 +357,9 @@ This bypasses escaping. **Only use it with content you fully control.**
 - `href`, `src`, `xlink:href`, `action`, `formaction` are rejected if they resolve to `javascript:`, `vbscript:`, or `data:text/html` (whitespace and control characters are stripped before the check).
 - Props named `__proto__`, `constructor`, or `prototype` are ignored.
 
-## Route Options
-
-```js
-app.get('/path', {
-  cors: true,
-  validate: async (c) => true,
-  cache: { ttl: 300, staleWhileRevalidate: 60 },
-  compress: true,
-  log: true,
-}, handler);
-```
-
-| Option | Type | Description |
-|---|---|---|
-| `cors` | `boolean \| object` | Enable CORS. `true` uses the global default (`origin: '*'`). |
-| `validate` | `async (c) => boolean` | Runs before the handler. Returning falsy yields `400 Validation failed`. |
-| `cache` | `boolean \| { ttl, staleWhileRevalidate }` | Cache successful GET responses in `caches.default`. Defaults: `ttl = 3600`, `swr = 0`. |
-| `compress` | `boolean` | gzip / deflate the response when the client accepts it. |
-| `log` | `boolean` | Log `METHOD URL - STATUS` to the console. |
-
-### `validate` example
-
-```js
-app.post('/api/items', {
-  validate: async (c) => {
-    const auth = c.req.headers.get('Authorization');
-    return auth === `Bearer ${c.env.API_TOKEN}`;
-  },
-}, async (c) => {
-  const body = await c.req.json();
-  return c.json({ created: true, body }, 201);
-});
-```
-
-A thrown error inside `validate` is treated as a failure (and logged as a security event).
-
-## Caching
-
-```js
-app.get('/expensive', { cache: { ttl: 600, staleWhileRevalidate: 120 } }, async (c) => {
-  const data = await computeSomethingSlow();
-  return c.json(data);
-});
-```
-
-- Only `GET` requests are cached.
-- Only `200` responses are stored.
-- The cache key is the full `Request` (URL + method).
-- `Set-Cookie` is stripped from the cached response.
-- A `Cache-Control: max-age=<ttl>[, stale-while-revalidate=<swr>]` header is written.
-- Writes happen in `ctx.executionCtx.waitUntil(...)`, so they never block the response.
-- On a hit, the stored response is returned directly (with CORS and log processing still applied).
-
-## Compression
-
-```js
-app.get('/big', { compress: true }, (c) => c.html(hugeMarkup));
-```
-
-- Skipped when `Content-Type` is not compressible (`text/*`, `application/json`, `application/xml`, `application/javascript`, `application/xhtml`, `application/ld+json`, `application/manifest+json`, `image/svg*`).
-- Skipped when `Content-Length` is known and `< 1024`.
-- Chooses `gzip` first, then `deflate`, based on `Accept-Encoding`.
-- Sets `Content-Encoding` and `Vary: Accept-Encoding`, removes `Content-Length`.
-
-## CORS
-
-Global default (used when `cors: true`):
-
-```js
-app.defaults.cors = {
-  origin: '*',
-  methods: 'GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD',
-};
-```
-
-Per-route:
-
-```js
-app.get('/api/public', { cors: true }, handler);
-
-app.get('/api/private', {
-  cors: {
-    origin: ['https://app.example.com', 'https://admin.example.com'],
-    methods: 'GET, POST',
-    headers: 'Content-Type, Authorization',
-  },
-}, handler);
-
-app.get('/api/exact', { cors: { origin: 'https://example.com' } }, handler);
-```
-
-| `origin` value | Result |
-|---|---|
-| `'*'` | `Access-Control-Allow-Origin: *` |
-| `string` | Echoes the request origin only if it matches exactly, plus `Vary: Origin` and `Allow-Credentials: true` |
-| `string[]` | Echoes the request origin only if it is in the list, plus `Vary: Origin` and `Allow-Credentials: true` |
-
-`Access-Control-Max-Age: 86400` is always set. Remember to register an `OPTIONS` route if you need preflight handling.
-
 ## Security
 
-### Base headers (always applied)
+Base headers are applied to every response:
 
 ```text
 X-Content-Type-Options: nosniff
@@ -462,24 +368,7 @@ Referrer-Policy: strict-origin-when-cross-origin
 Permissions-Policy: geolocation=(), microphone=(), camera=()
 ```
 
-### Extra headers
-
-```js
-app.security.extraHeaders = {
-  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
-  'Content-Security-Policy': "default-src 'self'",
-};
-```
-
-### Security event logging
-
-Enabled by default. Events are sampled to at most one per `(event, ip, path)` per 60 seconds.
-
-```js
-app.security.logSecurityEvents = false;   // disable
-```
-
-Logged events: `validation_error`, `handler_error`. Each entry is a JSON line containing timestamp, event, detail, IP (`CF-Connecting-IP`), method, path, and user agent.
+Add or override headers per-response via `c.headers` or the third argument to `c.text` / `c.json` / `c.html` / `c.page`.
 
 ## Scheduled Handler
 
@@ -522,7 +411,7 @@ Serve it as a static asset:
 |---|---|---|
 | `_get` | URL | Perform a `GET` request to this URL. |
 | `_post` | URL | Perform a `POST` request to this URL. |
-| `_trigger` | `load` \| `visible` \| `click` \| `submit` \| `change` \| `input` \| `keyup` \| `dblclick` | When to fire. Default: `submit` on a `<form>`, `click` on anything else. |
+| `_trigger` | `load`, `visible`, `click`, `submit`, `change`, `input`, `keyup`, `dblclick` | When to fire. Default: `submit` on a `<form>`, `click` on anything else. |
 | `_in` | CSS selector | Element whose `innerHTML` receives the response. Default: the element itself. |
 | `_form` | CSS selector | A `<form>` whose `FormData` becomes the URL-encoded POST body. |
 | `_json` | CSS selector | A `<form>` or input whose values become a JSON POST body. |
@@ -747,16 +636,12 @@ app.post('/todos', async (c) => {
   return c.html(<TodoList />);
 });
 
-/* Dynamic params + JSON + caching */
-app.get(
-  '/api/todos/:id',
-  { cache: { ttl: 30, staleWhileRevalidate: 300 }, cors: true, log: true },
-  (c) => {
-    const todo = todos.get(c.params.id);
-    if (!todo) return c.json({ error: 'Not found' }, 404);
-    return c.json(todo);
-  }
-);
+/* Dynamic params + JSON */
+app.get('/api/todos/:id', (c) => {
+  const todo = todos.get(c.params.id);
+  if (!todo) return c.json({ error: 'Not found' }, 404);
+  return c.json(todo);
+});
 
 /* Cookie round-trip */
 app.get('/theme/:name', (c) => {
@@ -772,17 +657,6 @@ app.get('/theme/:name', (c) => {
 
 app.get('/api/theme', (c) => c.json({ theme: c.getCookie('theme') || 'light' }));
 
-/* Compressed, validated, cached API */
-app.get(
-  '/api/large',
-  {
-    compress: true,
-    cache: { ttl: 120 },
-    validate: async (c) => c.req.headers.get('X-Api-Key') === c.env.API_KEY,
-  },
-  (c) => c.json({ items: Array.from({ length: 500 }, (_, i) => ({ i })) })
-);
-
 /* ------------------------------------------------------------------ *
  *  Export                                                            *
  * ------------------------------------------------------------------ */

package/dist/README.md

@@ -1,6 +1,6 @@
 # @lengkapp/edge
 
-A minimal, high-performance framework for Cloudflare Workers with built-in server-side rendering, routing, caching, compression, and a declarative client-side partial-update library.
+A minimal, high-performance framework for Cloudflare Workers with built-in server-side rendering, routing, and a declarative client-side partial-update library.
 
 Inspired by [Hono](https://hono.dev), `@lengkapp/edge` targets the same class of performance while shipping with **zero runtime dependencies**.
 
@@ -13,10 +13,6 @@ Inspired by [Hono](https://hono.dev), `@lengkapp/edge` targets the same class of
 - [Routing](#routing)
 - [Context API](#context-api)
 - [JSX & Server-Side Rendering](#jsx--server-side-rendering)
-- [Route Options](#route-options)
-- [Caching](#caching)
-- [Compression](#compression)
-- [CORS](#cors)
 - [Security](#security)
 - [Scheduled Handler](#scheduled-handler)
 - [Client-Side Partial Updates](#client-side-partial-updates)
@@ -30,9 +26,6 @@ Inspired by [Hono](https://hono.dev), `@lengkapp/edge` targets the same class of
 | ⚡ | **Fast router** | Static routes in a `Map`, dynamic routes in a trie — O(1) for static, O(segments) for params |
 | 🧩 | **Async JSX SSR** | `renderToString` supports async function components and streams nothing it doesn't need |
 | 🔒 | **Secure by default** | `nosniff`, `DENY` framing, strict referrer policy, permissions policy, URL/attribute sanitisation |
-| 🗄️ | **Edge caching** | `caches.default` integration with `ttl` and `stale-while-revalidate` |
-| 🗜️ | **Compression** | gzip / deflate via `CompressionStream`, content-type aware |
-| 🌐 | **CORS** | Per-route, wildcard / allow-list / exact-match |
 | 🍪 | **Cookies** | Lazy parsing, safe keys, full `Set-Cookie` option support |
 | 🪶 | **Client runtime** | ~2 KB IIFE: fetch + swap HTML from HTML attributes. No build step |
 | 📦 | **Zero deps** | Nothing but the platform |
@@ -107,8 +100,9 @@ npm run dev      # http://localhost:8787
 npm run deploy
 ```
 
-> **Why `export default app`?**
-> The `Edge` instance exposes a `fetch(request, env, executionCtx)` method, which is exactly the Workers module-syntax contract.
+### Why `export default app`?
+
+The `Edge` instance exposes a `fetch(request, env, executionCtx)` method, which is exactly the Workers module-syntax contract.
 
 ### JSX pragma
 
@@ -125,20 +119,18 @@ That's all the configuration required — no Babel, no tsconfig, no plugin.
 ## Routing
 
 ```js
-app.get(path, [options], handler);
-app.post(path, [options], handler);
-app.put(path, [options], handler);
-app.delete(path, [options], handler);
-app.patch(path, [options], handler);
-app.options(path, [options], handler);
-app.head(path, [options], handler);
+app.get(path, handler);
+app.post(path, handler);
+app.put(path, handler);
+app.delete(path, handler);
+app.patch(path, handler);
+app.options(path, handler);
+app.head(path, handler);
 ```
 
-`options` may be omitted entirely, or passed as the second argument:
-
 ```js
 app.get('/health', (c) => c.text('ok'));
-app.get('/api/users/:id', { cache: { ttl: 60 } }, (c) => c.json({ id: c.params.id }));
+app.get('/api/users/:id', (c) => c.json({ id: c.params.id }));
 ```
 
 ### Static vs. dynamic paths
@@ -161,6 +153,20 @@ app.get('/users/:id', (c) => {
 
 Unmatched requests receive `404 Not Found` as `text/plain`.
 
+### Mounting sub-apps
+
+Assign an `Edge` (or array of `Edge`s) to `app.routes` to merge its routes into the parent, prefixed with the parent's own prefix:
+
+```js
+const signIn = new Edge('/sign-in');
+signIn.get('/login', handler);       // → /sign-in/login
+
+const app = new Edge();
+app.routes = [signIn];
+```
+
+> **Note:** The merge is eager and one-way: routes registered on a sub-app *after* it was mounted do not propagate.
+
 ## Context API
 
 Every handler receives a `Context` instance.
@@ -171,7 +177,6 @@ Every handler receives a `Context` instance.
 |---|---|---|
 | `c.req` | `Request` | The incoming request |
 | `c.env` | `object` | Worker bindings / environment |
-| `c.executionCtx` | `ExecutionContext` | For `waitUntil()` |
 | `c.params` | `object` | Route parameters |
 | `c.url` | `URL` | Parsed request URL |
 | `c.query` | `URLSearchParams` | `c.url.searchParams` |
@@ -195,7 +200,7 @@ c.redirect('https://example.com', 301);
 - a JSX node or array of nodes (rendered with `renderToString`)
 - anything else (`String(data)`)
 
-Both are async because component trees may contain async components.
+Both are `async` because component trees may contain async components.
 
 ### Headers
 
@@ -352,108 +357,9 @@ This bypasses escaping. **Only use it with content you fully control.**
 - `href`, `src`, `xlink:href`, `action`, `formaction` are rejected if they resolve to `javascript:`, `vbscript:`, or `data:text/html` (whitespace and control characters are stripped before the check).
 - Props named `__proto__`, `constructor`, or `prototype` are ignored.
 
-## Route Options
-
-```js
-app.get('/path', {
-  cors: true,
-  validate: async (c) => true,
-  cache: { ttl: 300, staleWhileRevalidate: 60 },
-  compress: true,
-  log: true,
-}, handler);
-```
-
-| Option | Type | Description |
-|---|---|---|
-| `cors` | `boolean \| object` | Enable CORS. `true` uses the global default (`origin: '*'`). |
-| `validate` | `async (c) => boolean` | Runs before the handler. Returning falsy yields `400 Validation failed`. |
-| `cache` | `boolean \| { ttl, staleWhileRevalidate }` | Cache successful GET responses in `caches.default`. Defaults: `ttl = 3600`, `swr = 0`. |
-| `compress` | `boolean` | gzip / deflate the response when the client accepts it. |
-| `log` | `boolean` | Log `METHOD URL - STATUS` to the console. |
-
-### `validate` example
-
-```js
-app.post('/api/items', {
-  validate: async (c) => {
-    const auth = c.req.headers.get('Authorization');
-    return auth === `Bearer ${c.env.API_TOKEN}`;
-  },
-}, async (c) => {
-  const body = await c.req.json();
-  return c.json({ created: true, body }, 201);
-});
-```
-
-A thrown error inside `validate` is treated as a failure (and logged as a security event).
-
-## Caching
-
-```js
-app.get('/expensive', { cache: { ttl: 600, staleWhileRevalidate: 120 } }, async (c) => {
-  const data = await computeSomethingSlow();
-  return c.json(data);
-});
-```
-
-- Only `GET` requests are cached.
-- Only `200` responses are stored.
-- The cache key is the full `Request` (URL + method).
-- `Set-Cookie` is stripped from the cached response.
-- A `Cache-Control: max-age=<ttl>[, stale-while-revalidate=<swr>]` header is written.
-- Writes happen in `ctx.executionCtx.waitUntil(...)`, so they never block the response.
-- On a hit, the stored response is returned directly (with CORS and log processing still applied).
-
-## Compression
-
-```js
-app.get('/big', { compress: true }, (c) => c.html(hugeMarkup));
-```
-
-- Skipped when `Content-Type` is not compressible (`text/*`, `application/json`, `application/xml`, `application/javascript`, `application/xhtml`, `application/ld+json`, `application/manifest+json`, `image/svg*`).
-- Skipped when `Content-Length` is known and `< 1024`.
-- Chooses `gzip` first, then `deflate`, based on `Accept-Encoding`.
-- Sets `Content-Encoding` and `Vary: Accept-Encoding`, removes `Content-Length`.
-
-## CORS
-
-Global default (used when `cors: true`):
-
-```js
-app.defaults.cors = {
-  origin: '*',
-  methods: 'GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD',
-};
-```
-
-Per-route:
-
-```js
-app.get('/api/public', { cors: true }, handler);
-
-app.get('/api/private', {
-  cors: {
-    origin: ['https://app.example.com', 'https://admin.example.com'],
-    methods: 'GET, POST',
-    headers: 'Content-Type, Authorization',
-  },
-}, handler);
-
-app.get('/api/exact', { cors: { origin: 'https://example.com' } }, handler);
-```
-
-| `origin` value | Result |
-|---|---|
-| `'*'` | `Access-Control-Allow-Origin: *` |
-| `string` | Echoes the request origin only if it matches exactly, plus `Vary: Origin` and `Allow-Credentials: true` |
-| `string[]` | Echoes the request origin only if it is in the list, plus `Vary: Origin` and `Allow-Credentials: true` |
-
-`Access-Control-Max-Age: 86400` is always set. Remember to register an `OPTIONS` route if you need preflight handling.
-
 ## Security
 
-### Base headers (always applied)
+Base headers are applied to every response:
 
 ```text
 X-Content-Type-Options: nosniff
@@ -462,24 +368,7 @@ Referrer-Policy: strict-origin-when-cross-origin
 Permissions-Policy: geolocation=(), microphone=(), camera=()
 ```
 
-### Extra headers
-
-```js
-app.security.extraHeaders = {
-  'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
-  'Content-Security-Policy': "default-src 'self'",
-};
-```
-
-### Security event logging
-
-Enabled by default. Events are sampled to at most one per `(event, ip, path)` per 60 seconds.
-
-```js
-app.security.logSecurityEvents = false;   // disable
-```
-
-Logged events: `validation_error`, `handler_error`. Each entry is a JSON line containing timestamp, event, detail, IP (`CF-Connecting-IP`), method, path, and user agent.
+Add or override headers per-response via `c.headers` or the third argument to `c.text` / `c.json` / `c.html` / `c.page`.
 
 ## Scheduled Handler
 
@@ -522,7 +411,7 @@ Serve it as a static asset:
 |---|---|---|
 | `_get` | URL | Perform a `GET` request to this URL. |
 | `_post` | URL | Perform a `POST` request to this URL. |
-| `_trigger` | `load` \| `visible` \| `click` \| `submit` \| `change` \| `input` \| `keyup` \| `dblclick` | When to fire. Default: `submit` on a `<form>`, `click` on anything else. |
+| `_trigger` | `load`, `visible`, `click`, `submit`, `change`, `input`, `keyup`, `dblclick` | When to fire. Default: `submit` on a `<form>`, `click` on anything else. |
 | `_in` | CSS selector | Element whose `innerHTML` receives the response. Default: the element itself. |
 | `_form` | CSS selector | A `<form>` whose `FormData` becomes the URL-encoded POST body. |
 | `_json` | CSS selector | A `<form>` or input whose values become a JSON POST body. |
@@ -747,16 +636,12 @@ app.post('/todos', async (c) => {
   return c.html(<TodoList />);
 });
 
-/* Dynamic params + JSON + caching */
-app.get(
-  '/api/todos/:id',
-  { cache: { ttl: 30, staleWhileRevalidate: 300 }, cors: true, log: true },
-  (c) => {
-    const todo = todos.get(c.params.id);
-    if (!todo) return c.json({ error: 'Not found' }, 404);
-    return c.json(todo);
-  }
-);
+/* Dynamic params + JSON */
+app.get('/api/todos/:id', (c) => {
+  const todo = todos.get(c.params.id);
+  if (!todo) return c.json({ error: 'Not found' }, 404);
+  return c.json(todo);
+});
 
 /* Cookie round-trip */
 app.get('/theme/:name', (c) => {
@@ -772,17 +657,6 @@ app.get('/theme/:name', (c) => {
 
 app.get('/api/theme', (c) => c.json({ theme: c.getCookie('theme') || 'light' }));
 
-/* Compressed, validated, cached API */
-app.get(
-  '/api/large',
-  {
-    compress: true,
-    cache: { ttl: 120 },
-    validate: async (c) => c.req.headers.get('X-Api-Key') === c.env.API_KEY,
-  },
-  (c) => c.json({ items: Array.from({ length: 500 }, (_, i) => ({ i })) })
-);
-
 /* ------------------------------------------------------------------ *
  *  Export                                                            *
  * ------------------------------------------------------------------ */

package/dist/edge-client.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.48
+ * @lengkapp/edge v0.0.49
  * MIT License
  *
  * LengkApp Edge License

package/dist/edge-server.d.ts

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.48
+ * @lengkapp/edge v0.0.49
  * MIT License
  *
  * LengkApp Edge License
@@ -94,27 +94,6 @@ export interface CookieOptions {
   sameSite?: 'Strict' | 'Lax' | 'None' | string;
 }
 
-export interface CorsOptions {
-  origin?: string | string[];
-  methods?: string;
-  headers?: string;
-}
-
-export interface CacheOptions {
-  /** TTL in seconds. Default: 3600 */
-  ttl?: number;
-  /** stale-while-revalidate in seconds. Default: 0 */
-  staleWhileRevalidate?: number;
-}
-
-export interface RouteOptions {
-  cors?: boolean | CorsOptions;
-  cache?: boolean | CacheOptions;
-  compress?: boolean;
-  log?: boolean;
-  validate?: (ctx: Context) => boolean | Promise<boolean>;
-}
-
 export class Context {
   constructor(
     request: Request,
@@ -126,7 +105,6 @@ export class Context {
 
   req: Request;
   env: Record<string, any>;
-  executionCtx: ExecutionContext;
   params: Record<string, string>;
   status: number;
   headers: Headers;
@@ -192,16 +170,6 @@ export type ErrorHandler = (
   err: unknown
 ) => any | Promise<any>;
 
-export interface SecurityOptions {
-  logSecurityEvents?: boolean;
-  extraHeaders?: Record<string, string> | null;
-  trustedProxies?: string[] | null;
-}
-
-export interface EdgeDefaults {
-  cors: CorsOptions & { methods: string };
-}
-
 export class Edge {
   /**
    * @param prefix Optional mount prefix for this Edge. `''` and `'/'`
@@ -218,11 +186,15 @@ export class Edge {
    */
   prefix: string;
 
-  readonly staticRoutes: Map<string, Map<string, { handler: RouteHandler; options: RouteOptions }>>;
+  readonly staticRoutes: Map<string, Map<string, RouteHandler>>;
   readonly dynamicTries: Record<string, any>;
-  defaults: EdgeDefaults;
+
+  /**
+   * Set via `.scheduled()`. Not initialized in the constructor — read
+   * it only from the Worker entry (`export default { fetch, scheduled }`)
+   * if you wire that up yourself.
+   */
   scheduledHandler: ScheduledHandler | null;
-  security: SecurityOptions;
 
   /* ---- Fallback handlers ------------------------------------------ *
    * Exposed as public fields to mirror the runtime shape; normally  *
@@ -234,8 +206,6 @@ export class Edge {
   /* ---- Sub-app mounting ------------------------------------------- */
 
   /**
-   * Sub-apps mounted into this Edge.
-   *
    * Assigning runs a one-time merge: every route on each sub-app is
    * copied into this Edge's own tables, prefixed with `this.prefix`
    * combined with the sub-app's own prefix. After the merge the hot
@@ -249,7 +219,6 @@ export class Edge {
    * Non-`Edge` entries throw. Mount is eager and one-way: routes
    * registered on a sub-app *after* it was mounted do not propagate.
    */
-  get routes(): Edge[];
   set routes(apps: Edge | Edge[]);
 
   /* ---- Route registration ----------------------------------------- *
@@ -257,19 +226,12 @@ export class Edge {
    * registration time; the resulting full path is what the router    *
    * matches against on each request.                                 */
 
-  get(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
   get(path: string, handler: RouteHandler): void;
-  post(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
   post(path: string, handler: RouteHandler): void;
-  put(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
   put(path: string, handler: RouteHandler): void;
-  delete(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
   delete(path: string, handler: RouteHandler): void;
-  patch(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
   patch(path: string, handler: RouteHandler): void;
-  options(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
   options(path: string, handler: RouteHandler): void;
-  head(path: string, options: RouteOptions | boolean, handler: RouteHandler): void;
   head(path: string, handler: RouteHandler): void;
 
   /* ---- Scheduled handler ------------------------------------------ */
@@ -280,8 +242,7 @@ export class Edge {
   /**
    * Register a handler invoked when no route matches the incoming
    * request. The handler runs with a full Context (headers, cookies,
-   * `c.page`, `c.html`) but with empty route options — no CORS,
-   * compression, or caching. Its own errors flow into `onError`.
+   * `c.page`, `c.html`).
    *
    * `OPTIONS` requests are short-circuited to a 204 (with base security
    * headers, no body) before this handler runs, so preflights never

package/dist/edge-server.js

@@ -1,5 +1,5 @@
 /*!
- * @lengkapp/edge v0.0.48
+ * @lengkapp/edge v0.0.49
  * MIT License
  *
  * LengkApp Edge License
@@ -30,4 +30,4 @@
  * OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
  * WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  */
-var t=Object.defineProperty,e=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,r=Object.prototype.hasOwnProperty,o=(e,n)=>{for(var r in n)t(e,r,{get:n[r],enumerable:!0})},s=(o,s,i,c)=>{if(s&&"object"==typeof s||"function"==typeof s)for(let a of n(s))r.call(o,a)||a===i||t(o,a,{get:()=>s[a],enumerable:!(c=e(s,a))||c.enumerable});return o},i=e=>s(t({},"__esModule",{value:!0}),e),c={};function a(t){const e=[],n=t.length;let r=1;for(let o=1;o<=n;o++)o!==n&&47!==t.charCodeAt(o)||(o>r&&e.push(t.slice(r,o)),r=o+1);return e}function l(t){const e=t.length;return e>1&&47===t.charCodeAt(e-1)?t.slice(0,-1):t}function u(t,e){if(!e)return t||"/";if(!t||"/"===t)return 47===e.charCodeAt(0)?e:"/"+e;const n=t.charCodeAt(t.length-1),r=e.charCodeAt(0);let o;o=47===n?47===r?t+e.slice(1):t+e:47===r?t+e:t+"/"+e;const s=o.length;return s>1&&47===o.charCodeAt(s-1)?o.slice(0,-1):o}o(c,{Context:()=>k,Edge:()=>Edge,Fragment:()=>Fragment,default:()=>M,jsx:()=>jsx,renderToString:()=>renderToString,useCtx:()=>useCtx}),module.exports=i(c);var f=new Set(["__proto__","constructor","prototype"]);function h(t){return"string"==typeof t&&!f.has(t)}function p(t){const e=t.length;let n=0;for(;n<e;){const e=t.charCodeAt(n);if(38===e||60===e||62===e||34===e||39===e)break;n++}if(n===e)return t;let r=t.slice(0,n),o=n;for(;n<e;n++){const e=t.charCodeAt(n);let s;if(38===e)s="&amp;";else if(60===e)s="&lt;";else if(62===e)s="&gt;";else if(34===e)s="&quot;";else{if(39!==e)continue;s="&#039;"}n>o&&(r+=t.slice(o,n)),r+=s,o=n+1}return o<e&&(r+=t.slice(o)),r}function d(t){return t>=65&&t<=90||t>=97&&t<=122}function y(t){return t>=48&&t<=57}function w(t){const e=t.length;if(0===e||!d(t.charCodeAt(0)))return!1;for(let n=1;n<e;n++){const e=t.charCodeAt(n);if(!d(e)&&!y(e)&&45!==e)return!1}return!0}function g(t){const e=t.length;if(0===e)return!1;const n=t.charCodeAt(0);if(!d(n)&&95!==n&&58!==n)return!1;for(let n=1;n<e;n++){const e=t.charCodeAt(n);if(!d(e)&&!y(e)&&95!==e&&58!==e&&46!==e&&45!==e)return!1}return!0}function m(t){const e=t.charCodeAt(0),n=t.charCodeAt(1);return!(111!==e&&79!==e||110!==n&&78!==n)}var Fragment=Symbol("Fragment");function jsx(t,e,...n){return{type:t,props:e||{},children:n,__isJSX:!0}}var C=new Set(["area","base","br","col","embed","hr","img","input","link","meta","param","source","track","wbr"]),b=new Set(["allowfullscreen","async","autofocus","autoplay","checked","controls","default","defer","disabled","formnovalidate","hidden","inert","ismap","itemscope","loop","multiple","muted","nomodule","novalidate","open","playsinline","readonly","required","reversed","selected"]),T=new Set(["animation-iteration-count","border-image-outset","border-image-slice","border-image-width","box-flex","box-flex-group","box-ordinal-group","column-count","columns","flex","flex-grow","flex-positive","flex-shrink","flex-negative","flex-order","grid-row","grid-row-end","grid-row-span","grid-row-start","grid-column","grid-column-end","grid-column-span","grid-column-start","font-weight","line-clamp","line-height","opacity","order","orphans","tab-size","widows","z-index","zoom","fill-opacity","flood-opacity","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-miterlimit","stroke-opacity","stroke-width"]),S=new Map,O=2e3;function E(t){const e=S.get(t);if(void 0!==e)return e;const n=t.replace(/([A-Z])/g,"-$1").toLowerCase().replace(/^-/,"");return S.size>=O&&S.clear(),S.set(t,n),n}function x(t){if(!t||"object"!=typeof t)return"";let e="";for(const n in t){if(!Object.prototype.hasOwnProperty.call(t,n))continue;const r=E(n);let o=t[n];"number"!=typeof o||T.has(r)||(o+="px"),e&&(e+=";"),e+=r+":"+o}return e}var A=new Set(["href","src","xlink:href","action","formaction"]),v=[];function useCtx(){const t=v[v.length-1];if(!t)throw new Error("useCtx() must be called synchronously at the top of a component (before any await). It is not available after an await, nor outside a render.");return t}async function renderToString(t,e){if(void 0===e&&(e=v[v.length-1]),null==t||"boolean"==typeof t)return"";const n=typeof t;if("string"===n)return p(t);if("number"===n)return p(String(t));if("object"===n&&"function"==typeof t.then)return renderToString(await t,e);if(Array.isArray(t)){let n="";for(let r=0;r<t.length;r++)n+=await renderToString(t[r],e);return n}if(!t.__isJSX)return p(String(t));const{type:r,props:o,children:s}=t;if(r===Fragment){let t="";for(let n=0;n<s.length;n++)t+=await renderToString(s[n],e);return t}if("symbol"==typeof r)return"";if("function"==typeof r){let t;if(e){v.push(e);try{t=r({...o,children:s})}finally{v.pop()}}else t=r({...o,children:s});return renderToString(await t,e)}if("string"!=typeof r||!w(r))return"";const i=C.has(r);let c="";for(const t in o){if(!Object.prototype.hasOwnProperty.call(o,t))continue;if("children"===t||"key"===t||"ref"===t)continue;const e=o[t];if(null==e||!1===e)continue;if("dangerouslySetInnerHTML"===t)continue;let n=t;if("className"===t||"class"===t?n="class":"htmlFor"!==t&&"for"!==t||(n="for"),h(n)&&!m(n)&&g(n)){if(A.has(n)){const t=String(e).replace(/[\u0000-\u0020]/g,"").toLowerCase();if(t.startsWith("javascript:")||t.startsWith("vbscript:")||t.startsWith("data:text/html"))continue}if(b.has(n))!0===e&&(c+=" "+n);else if(!0!==e){if("style"===n&&"object"==typeof e){const t=x(e);t&&(c+=' style="'+p(t)+'"');continue}c+=" "+n+'="'+p(String(e))+'"'}else c+=" "+n+'="true"'}}let a="";const l=o.dangerouslySetInnerHTML;if(l&&null!=l.__html)a=l.__html;else for(let t=0;t<s.length;t++)a+=await renderToString(s[t],e);return i?"<"+r+c+"/>":"<"+r+c+">"+a+"</"+r+">"}var j=Object.freeze([["X-Content-Type-Options","nosniff"],["X-Frame-Options","DENY"],["Referrer-Policy","strict-origin-when-cross-origin"],["Permissions-Policy","geolocation=(), microphone=(), camera=()"]]),_=Object.freeze(Object.create(null)),k=class{constructor(t,e,n,r={},o=null){this.req=t,this.env=e,this.executionCtx=n,this.params=r,this.status=200,this.headers=new Headers(j),this.t=null,this.url=o||new URL(t.url)}o(){if(null!==this.t)return this.t;const t=this.req.headers.get("Cookie");if(!t)return this.t=_,_;const e=Object.create(null);let n=0;const r=t.length;for(;n<r;){let o=t.indexOf(";",n);-1===o&&(o=r);let s=n,i=o;for(;s<i&&32===t.charCodeAt(s);)s++;for(;i>s&&32===t.charCodeAt(i-1);)i--;if(i>s){const n=t.indexOf("=",s);if(n>s&&n<i)try{const r=decodeURIComponent(t.slice(s,n));h(r)&&(e[r]=decodeURIComponent(t.slice(n+1,i)))}catch{}}n=o+1}return this.t=e,e}getCookie(t){const e=this.o()[t];return void 0===e?null:e}get query(){return this.url.searchParams}setCookie(t,e,n={}){if("string"!=typeof t||!h(t)||/[\r\n;=]/.test(t))return;let r=encodeURIComponent(t)+"="+encodeURIComponent(e);n.path&&(r+="; Path="+n.path),n.domain&&(r+="; Domain="+n.domain),void 0!==n.maxAge&&(r+="; Max-Age="+n.maxAge),n.expires&&(r+="; Expires="+n.expires.toUTCString()),n.secure&&(r+="; Secure"),n.httpOnly&&(r+="; HttpOnly"),n.sameSite&&(r+="; SameSite="+n.sameSite),this.headers.append("Set-Cookie",r)}deleteCookie(t,e={}){this.setCookie(t,"",{...e,maxAge:0,expires:new Date(0)})}i(t){if(!t)return this.headers;const e=Object.keys(t);if(0===e.length)return this.headers;const n=new Headers(this.headers);for(let r=0;r<e.length;r++)n.set(e[r],t[e[r]]);return n}text(t,e=this.status,n={}){const r=this.i(n);return r.has("Content-Type")||r.set("Content-Type","text/plain; charset=utf-8"),new Response(t,{status:e,headers:r})}json(t,e=this.status,n={}){const r=this.i(n);return r.has("Content-Type")||r.set("Content-Type","application/json; charset=utf-8"),new Response(JSON.stringify(t),{status:e,headers:r})}async html(t,e=this.status,n={}){const r=this.i(n);let o;return r.has("Content-Type")||r.set("Content-Type","text/html; charset=utf-8"),o="string"==typeof t?t:t&&t.__isJSX||Array.isArray(t)?await renderToString(t,this):null==t?"":String(t),new Response(o,{status:e,headers:r})}async page(t,e=this.status,n={}){const r=this.i(n);let o;return r.has("Content-Type")||r.set("Content-Type","text/html; charset=utf-8"),o="string"==typeof t?t:t&&t.__isJSX||Array.isArray(t)?await renderToString(t,this):null==t?"":String(t),/^\s*<!doctype\s/i.test(o)||(o="<!DOCTYPE html>"+o),new Response(o,{status:e,headers:r})}redirect(t,e=302){const n=new Headers(this.headers);return n.set("Location",String(t)),n.delete("Content-Type"),new Response(null,{status:e,headers:n})}},P=class{constructor(){this.children=null,this.paramChild=null,this.handler=null}},R=class{constructor(){this.root=new P}add(t,e,n){let r=this.root;const o=[];for(let e=0;e<t.length;e++){const n=t[e];if(58===n.charCodeAt(0)){const t=n.slice(1);o.push(h(t)?t:"_p"+e),r.paramChild||(r.paramChild=new P),r=r.paramChild}else{r.children||(r.children=new Map);let t=r.children.get(n);t||(t=new P,r.children.set(n,t)),r=t}}r.handler={handler:e,options:n,paramNames:o}}match(t){const e=[],n=this.l(this.root,t,0,e);if(!n)return null;const{handler:r,options:o,paramNames:s}=n,i=Object.create(null);for(let t=0;t<s.length;t++)i[s[t]]=e[t];return{handler:r,options:o,params:i}}l(t,e,n,r){if(n===e.length)return t.handler;const o=e[n],s=t.children;if(s){const t=s.get(o);if(t){const o=this.l(t,e,n+1,r);if(o)return o}}const i=t.paramChild;if(i){r.push(o);const t=this.l(i,e,n+1,r);if(t)return t;r.pop()}return null}},H=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD"],I=["text/","application/json","application/xml","application/javascript","application/xhtml","application/ld+json","application/manifest+json","image/svg"];function D(t){if(!t)return!0;const e=t.toLowerCase();for(let t=0;t<I.length;t++)if(e.startsWith(I[t]))return!0;return!1}var N=new Map,L=0;function U(t,e,n){const r=t+"|"+(e||"")+"|"+(n||""),o=Date.now(),s=N.get(r);if(s&&o-s<6e4)return!1;if(N.set(r,o),o-L>3e4){L=o;for(const[t,e]of N)o-e>6e4&&N.delete(t)}return!0}var Edge=class t{constructor(t=""){this.prefix=t&&"/"!==t?l(t):"",this.staticRoutes=new Map;for(let t=0;t<H.length;t++)this.staticRoutes.set(H[t],new Map);this.dynamicTries={};for(let t=0;t<H.length;t++)this.dynamicTries[H[t]]=new R;this.u=[],this.h=[],this.defaults={cors:{origin:"*",methods:"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"}},this.scheduledHandler=null,this.security={logSecurityEvents:!0,extraHeaders:null,trustedProxies:null},this.notFoundHandler=null,this.errorHandler=null}get routes(){return this.h}set routes(e){const n=Array.isArray(e)?e:e?[e]:[];this.h=n;for(let e=0;e<n.length;e++){const r=n[e];if(!(r instanceof t))throw new Error("app.routes entries must be Edge instances");this.p(r)}}p(t){const e=t.u,n=this.prefix;for(let t=0;t<e.length;t++){const r=e[t],o=u(n,r.path);this.u.push({method:r.method,path:o,options:r.options,handler:r.handler}),this.m(r.method,o,r.options,r.handler)}}C(t,e,n,r){if("boolean"==typeof n?n={}:"function"==typeof n&&(r=n,n={}),"function"!=typeof r)throw new Error("Handler for "+t+" "+e+" must be a function");const o={...this.defaults,...n||{}},s=u(this.prefix,e);this.u.push({method:t,path:s,options:o,handler:r}),this.m(t,s,o,r)}m(t,e,n,r){-1===e.indexOf(":")?this.staticRoutes.get(t).set(e,{handler:r,options:n}):this.dynamicTries[t].add(a(e),r,n)}get(t,e,n){this.C("GET",t,e,n)}post(t,e,n){this.C("POST",t,e,n)}put(t,e,n){this.C("PUT",t,e,n)}delete(t,e,n){this.C("DELETE",t,e,n)}patch(t,e,n){this.C("PATCH",t,e,n)}options(t,e,n){this.C("OPTIONS",t,e,n)}head(t,e,n){this.C("HEAD",t,e,n)}scheduled(t){this.scheduledHandler=t}notFound(t){if("function"!=typeof t)throw new Error("notFound(handler) requires a function");this.notFoundHandler=t}onError(t){if("function"!=typeof t)throw new Error("onError(handler) requires a function");this.errorHandler=t}T(t,e){const n=new Headers(e.headers);t.headers.forEach((t,e)=>{"set-cookie"!==e.toLowerCase()&&(n.has(e)||n.set(e,t))});const r="function"==typeof t.headers.getSetCookie?t.headers.getSetCookie():t.headers.get("Set-Cookie")?[t.headers.get("Set-Cookie")]:[];if(r.length){const t="function"==typeof n.getSetCookie?n.getSetCookie():n.get("Set-Cookie")?[n.get("Set-Cookie")]:[],e=new Set(t);for(let t=0;t<r.length;t++){const o=r[t];e.has(o)||(n.append("Set-Cookie",o),e.add(o))}}const o=204===e.status||304===e.status?null:e.body;return new Response(o,{status:e.status,statusText:e.statusText,headers:n})}S(t,e,n){if(this.security.logSecurityEvents)try{const r=t.req.headers.get("CF-Connecting-IP")||"",o=t.url?t.url.pathname:"";if(!U(e,r,o))return;console.log(JSON.stringify({ts:(new Date).toISOString(),kind:"security",event:e,detail:"string"==typeof n?n:void 0,ip:r||void 0,method:t.req.method,path:o,ua:t.req.headers.get("User-Agent")||void 0}))}catch{}}O(t,e){if(!e)return;const n="object"==typeof e?e:this.defaults.cors,r=t.req.headers.get("Origin"),o=n.origin;"*"===o?t.headers.set("Access-Control-Allow-Origin","*"):Array.isArray(o)?r&&-1!==o.indexOf(r)&&(t.headers.set("Access-Control-Allow-Origin",r),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")):"string"==typeof o&&r===o&&(t.headers.set("Access-Control-Allow-Origin",r),t.headers.set("Vary","Origin"),t.headers.set("Access-Control-Allow-Credentials","true")),t.headers.set("Access-Control-Allow-Methods",n.methods||"GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD"),t.headers.set("Access-Control-Allow-Headers",n.headers||"Content-Type, Authorization, X-CSRF-Token"),t.headers.set("Access-Control-Max-Age","86400")}A(t,e){e&&console.log(t.req.method+" "+t.req.url+" - "+t.status)}v(t,e){if(!D(e.headers.get("Content-Type")))return e;const n=e.headers.get("Content-Length");if(null!==n&&+n<1024)return e;const r=t.headers.get("Accept-Encoding")||"";let o=null;if(-1!==r.indexOf("gzip")?o="gzip":-1!==r.indexOf("deflate")&&(o="deflate"),!o||!e.body)return e;const s=e.body.pipeThrough(new CompressionStream(o)),i=new Headers(e.headers);return i.set("Content-Encoding",o),i.set("Vary","Accept-Encoding"),i.delete("Content-Length"),new Response(s,{status:e.status,statusText:e.statusText,headers:i})}async j(t,e){return!e||"function"!=typeof e||!!await e(t)}async _(t){return await caches.default.match(t)||null}async k(t,e,n){if(!n)return;const r=!0===n?{}:n,o=r.ttl??3600,s=r.staleWhileRevalidate??0,i=new Headers(e.headers);i.set("Cache-Control","max-age="+o+(s>0?", stale-while-revalidate="+s:"")),i.delete("Set-Cookie"),await caches.default.put(t,new Response(e.body,{status:e.status,statusText:e.statusText,headers:i}))}async fetch(t,e,n){const r=new URL(t.url),o=l(r.pathname),s=t.method,i=this.staticRoutes.get(s);if(i){const s=i.get(o);if(s)return this.P(s.handler,s.options,t,e,n,Object.create(null),r)}const c=this.dynamicTries[s];if(c){const s=c.match(a(o));if(s)return this.P(s.handler,s.options,t,e,n,s.params,r)}if("OPTIONS"===s){const o=new k(t,e,n,Object.create(null),r);return this.T(o,new Response(null,{status:204}))}if(this.notFoundHandler)return this.P(this.notFoundHandler,{},t,e,n,Object.create(null),r);const u=new k(t,e,n,Object.create(null),r);return this.T(u,new Response("Not Found",{status:404}))}async R(t,e){const n=this.errorHandler;if(!n)return t.text("Internal Server Error",500);try{const r=await n(t,e);return r instanceof Response?this.T(t,r):r&&r.__isJSX||Array.isArray(r)?t.html(r,500):t.text("Internal Server Error",500)}catch(e){return this.S(t,"error_handler_failure",e&&e.message),t.text("Internal Server Error",500)}}async P(t,e,n,r,o,s,i){const c=new k(n,r,o,s,i),a=this.security.extraHeaders;if(a)for(const t in a)Object.prototype.hasOwnProperty.call(a,t)&&c.headers.set(t,a[t]);let l,u=!1;try{u=await this.j(c,e.validate)}catch(t){this.S(c,"validation_error",t&&t.message),u=!1}if(!u)return this.T(c,c.text("Validation failed",400));if(e.cache&&"GET"===n.method){const t=await this._(n);if(t)return this.O(c,e.cors),this.A(c,e.log),this.T(c,t)}this.O(c,e.cors);try{const e=await t(c);l=e instanceof Response?this.T(c,e):e&&e.__isJSX?await c.html(e):c.text("OK")}catch(t){this.S(c,"handler_error",t&&t.message),l=await this.R(c,t)}return e.cache&&"GET"===n.method&&200===l.status&&c.executionCtx.waitUntil(this.k(n,l.clone(),e.cache)),e.compress&&(l=this.v(n,l)),this.A(c,e.log),l}},M=Edge;
+var t=Object.defineProperty,e=Object.getOwnPropertyDescriptor,n=Object.getOwnPropertyNames,r=Object.prototype.hasOwnProperty,o=(e,n)=>{for(var r in n)t(e,r,{get:n[r],enumerable:!0})},s=(o,s,i,c)=>{if(s&&"object"==typeof s||"function"==typeof s)for(let a of n(s))r.call(o,a)||a===i||t(o,a,{get:()=>s[a],enumerable:!(c=e(s,a))||c.enumerable});return o},i=e=>s(t({},"__esModule",{value:!0}),e),c={};function a(t){const e=[],n=t.length;let r=1;for(let o=1;o<=n;o++)o!==n&&47!==t.charCodeAt(o)||(o>r&&e.push(t.slice(r,o)),r=o+1);return e}function l(t){const e=t.length;return e>1&&47===t.charCodeAt(e-1)?t.slice(0,-1):t}function u(t,e){if(!e)return t||"/";if(!t||"/"===t)return 47===e.charCodeAt(0)?e:"/"+e;const n=t.charCodeAt(t.length-1),r=e.charCodeAt(0);let o;o=47===n?47===r?t+e.slice(1):t+e:47===r?t+e:t+"/"+e;const s=o.length;return s>1&&47===o.charCodeAt(s-1)?o.slice(0,-1):o}o(c,{Context:()=>Context,Edge:()=>Edge,Fragment:()=>Fragment,default:()=>H,jsx:()=>jsx,renderToString:()=>renderToString,useCtx:()=>useCtx}),module.exports=i(c);var f=new Set(["__proto__","constructor","prototype"]);function h(t){return"string"==typeof t&&!f.has(t)}function p(t){const e=t.length;let n=0;for(;n<e;){const e=t.charCodeAt(n);if(38===e||60===e||62===e||34===e||39===e)break;n++}if(n===e)return t;let r=t.slice(0,n),o=n;for(;n<e;n++){const e=t.charCodeAt(n);let s;if(38===e)s="&amp;";else if(60===e)s="&lt;";else if(62===e)s="&gt;";else if(34===e)s="&quot;";else{if(39!==e)continue;s="&#039;"}n>o&&(r+=t.slice(o,n)),r+=s,o=n+1}return o<e&&(r+=t.slice(o)),r}function d(t){return t>=65&&t<=90||t>=97&&t<=122}function y(t){return t>=48&&t<=57}function w(t){const e=t.length;if(0===e||!d(t.charCodeAt(0)))return!1;for(let n=1;n<e;n++){const e=t.charCodeAt(n);if(!d(e)&&!y(e)&&45!==e)return!1}return!0}function m(t){const e=t.length;if(0===e)return!1;const n=t.charCodeAt(0);if(!d(n)&&95!==n&&58!==n)return!1;for(let n=1;n<e;n++){const e=t.charCodeAt(n);if(!d(e)&&!y(e)&&95!==e&&58!==e&&46!==e&&45!==e)return!1}return!0}function g(t){const e=t.charCodeAt(0),n=t.charCodeAt(1);return!(111!==e&&79!==e||110!==n&&78!==n)}var Fragment=Symbol("Fragment");function jsx(t,e,...n){return{type:t,props:e||{},children:n,__isJSX:!0}}var b=new Set(["area","base","br","col","embed","hr","img","input","link","meta","param","source","track","wbr"]),S=new Set(["allowfullscreen","async","autofocus","autoplay","checked","controls","default","defer","disabled","formnovalidate","hidden","inert","ismap","itemscope","loop","multiple","muted","nomodule","novalidate","open","playsinline","readonly","required","reversed","selected"]),C=new Set(["animation-iteration-count","border-image-outset","border-image-slice","border-image-width","box-flex","box-flex-group","box-ordinal-group","column-count","columns","flex","flex-grow","flex-positive","flex-shrink","flex-negative","flex-order","grid-row","grid-row-end","grid-row-span","grid-row-start","grid-column","grid-column-end","grid-column-span","grid-column-start","font-weight","line-clamp","line-height","opacity","order","orphans","tab-size","widows","z-index","zoom","fill-opacity","flood-opacity","stop-opacity","stroke-dasharray","stroke-dashoffset","stroke-miterlimit","stroke-opacity","stroke-width"]),O=new Map,x=2e3;function T(t){const e=O.get(t);if(void 0!==e)return e;const n=t.replace(/([A-Z])/g,"-$1").toLowerCase().replace(/^-/,"");return O.size>=x&&O.clear(),O.set(t,n),n}function E(t){if(!t||"object"!=typeof t)return"";let e="";for(const n in t){if(!Object.prototype.hasOwnProperty.call(t,n))continue;const r=T(n);let o=t[n];"number"!=typeof o||C.has(r)||(o+="px"),e&&(e+=";"),e+=r+":"+o}return e}var k=new Set(["href","src","xlink:href","action","formaction"]),j=[];function useCtx(){const t=j[j.length-1];if(!t)throw new Error("useCtx() must be called synchronously at the top of a component (before any await). It is not available after an await, nor outside a render.");return t}async function renderToString(t,e){if(void 0===e&&(e=j[j.length-1]),null==t||"boolean"==typeof t)return"";const n=typeof t;if("string"===n)return p(t);if("number"===n)return p(String(t));if("object"===n&&"function"==typeof t.then)return renderToString(await t,e);if(Array.isArray(t)){let n="";for(let r=0;r<t.length;r++)n+=await renderToString(t[r],e);return n}if(!t.__isJSX)return p(String(t));const{type:r,props:o,children:s}=t;if(r===Fragment){let t="";for(let n=0;n<s.length;n++)t+=await renderToString(s[n],e);return t}if("symbol"==typeof r)return"";if("function"==typeof r){let t;if(e){j.push(e);try{t=r({...o,children:s})}finally{j.pop()}}else t=r({...o,children:s});return renderToString(await t,e)}if("string"!=typeof r||!w(r))return"";const i=b.has(r);let c="";for(const t in o){if(!Object.prototype.hasOwnProperty.call(o,t))continue;if("children"===t||"key"===t||"ref"===t)continue;const e=o[t];if(null==e||!1===e)continue;if("dangerouslySetInnerHTML"===t)continue;let n=t;if("className"===t||"class"===t?n="class":"htmlFor"!==t&&"for"!==t||(n="for"),h(n)&&!g(n)&&m(n)){if(k.has(n)){const t=String(e).replace(/[\u0000-\u0020]/g,"").toLowerCase();if(t.startsWith("javascript:")||t.startsWith("vbscript:")||t.startsWith("data:text/html"))continue}if(S.has(n))!0===e&&(c+=" "+n);else if(!0!==e){if("style"===n&&"object"==typeof e){const t=E(e);t&&(c+=' style="'+p(t)+'"');continue}c+=" "+n+'="'+p(String(e))+'"'}else c+=" "+n+'="true"'}}let a="";const l=o.dangerouslySetInnerHTML;if(l&&null!=l.__html)a=l.__html;else for(let t=0;t<s.length;t++)a+=await renderToString(s[t],e);return i?"<"+r+c+"/>":"<"+r+c+">"+a+"</"+r+">"}var v=Object.freeze([["X-Content-Type-Options","nosniff"],["X-Frame-Options","DENY"],["Referrer-Policy","strict-origin-when-cross-origin"],["Permissions-Policy","geolocation=(), microphone=(), camera=()"]]),R=Object.freeze(Object.create(null)),Context=class{constructor(t,e,n,r={},o=null){this.req=t,this.env=e,this.params=r,this.status=200,this.headers=new Headers(v),this.t=null,this.url=o||new URL(t.url)}o(){if(null!==this.t)return this.t;const t=this.req.headers.get("Cookie");if(!t)return this.t=R,R;const e=Object.create(null);let n=0;const r=t.length;for(;n<r;){let o=t.indexOf(";",n);-1===o&&(o=r);let s=n,i=o;for(;s<i&&32===t.charCodeAt(s);)s++;for(;i>s&&32===t.charCodeAt(i-1);)i--;if(i>s){const n=t.indexOf("=",s);if(n>s&&n<i)try{const r=decodeURIComponent(t.slice(s,n));h(r)&&(e[r]=decodeURIComponent(t.slice(n+1,i)))}catch{}}n=o+1}return this.t=e,e}getCookie(t){const e=this.o()[t];return void 0===e?null:e}get query(){return this.url.searchParams}setCookie(t,e,n={}){if("string"!=typeof t||!h(t)||/[\r\n;=]/.test(t))return;let r=encodeURIComponent(t)+"="+encodeURIComponent(e);n.path&&(r+="; Path="+n.path),n.domain&&(r+="; Domain="+n.domain),void 0!==n.maxAge&&(r+="; Max-Age="+n.maxAge),n.expires&&(r+="; Expires="+n.expires.toUTCString()),n.secure&&(r+="; Secure"),n.httpOnly&&(r+="; HttpOnly"),n.sameSite&&(r+="; SameSite="+n.sameSite),this.headers.append("Set-Cookie",r)}deleteCookie(t,e={}){this.setCookie(t,"",{...e,maxAge:0,expires:new Date(0)})}i(t){if(!t)return this.headers;const e=Object.keys(t);if(0===e.length)return this.headers;const n=new Headers(this.headers);for(let r=0;r<e.length;r++)n.set(e[r],t[e[r]]);return n}text(t,e=this.status,n={}){const r=this.i(n);return r.has("Content-Type")||r.set("Content-Type","text/plain; charset=utf-8"),new Response(t,{status:e,headers:r})}json(t,e=this.status,n={}){const r=this.i(n);return r.has("Content-Type")||r.set("Content-Type","application/json; charset=utf-8"),new Response(JSON.stringify(t),{status:e,headers:r})}async html(t,e=this.status,n={}){const r=this.i(n);let o;return r.has("Content-Type")||r.set("Content-Type","text/html; charset=utf-8"),o="string"==typeof t?t:t&&t.__isJSX||Array.isArray(t)?await renderToString(t,this):null==t?"":String(t),new Response(o,{status:e,headers:r})}async page(t,e=this.status,n={}){const r=this.i(n);let o;return r.has("Content-Type")||r.set("Content-Type","text/html; charset=utf-8"),o="string"==typeof t?t:t&&t.__isJSX||Array.isArray(t)?await renderToString(t,this):null==t?"":String(t),/^\s*<!doctype\s/i.test(o)||(o="<!DOCTYPE html>"+o),new Response(o,{status:e,headers:r})}redirect(t,e=302){const n=new Headers(this.headers);return n.set("Location",String(t)),n.delete("Content-Type"),new Response(null,{status:e,headers:n})}},_=class{constructor(){this.children=null,this.paramChild=null,this.handler=null}},P=class{constructor(){this.root=new _}add(t,e){let n=this.root;const r=[];for(let e=0;e<t.length;e++){const o=t[e];if(58===o.charCodeAt(0)){const t=o.slice(1);r.push(h(t)?t:"_p"+e),n.paramChild||(n.paramChild=new _),n=n.paramChild}else{n.children||(n.children=new Map);let t=n.children.get(o);t||(t=new _,n.children.set(o,t)),n=t}}n.handler={handler:e,paramNames:r}}match(t){const e=[],n=this.l(this.root,t,0,e);if(!n)return null;const{handler:r,paramNames:o}=n,s=Object.create(null);for(let t=0;t<o.length;t++)s[o[t]]=e[t];return{handler:r,params:s}}l(t,e,n,r){if(n===e.length)return t.handler;const o=e[n],s=t.children;if(s){const t=s.get(o);if(t){const o=this.l(t,e,n+1,r);if(o)return o}}const i=t.paramChild;if(i){r.push(o);const t=this.l(i,e,n+1,r);if(t)return t;r.pop()}return null}},A=["GET","POST","PUT","DELETE","PATCH","OPTIONS","HEAD"],Edge=class t{constructor(t=""){this.prefix=t&&"/"!==t?l(t):"",this.staticRoutes=new Map;for(let t=0;t<A.length;t++)this.staticRoutes.set(A[t],new Map);this.dynamicTries={};for(let t=0;t<A.length;t++)this.dynamicTries[A[t]]=new P;this.u=[],this.notFoundHandler=null,this.errorHandler=null}set routes(e){const n=Array.isArray(e)?e:e?[e]:[];for(let e=0;e<n.length;e++){const r=n[e];if(!(r instanceof t))throw new Error("app.routes entries must be Edge instances");this.h(r)}}h(t){const e=t.u,n=this.prefix;for(let t=0;t<e.length;t++){const r=e[t],o=u(n,r.path);this.u.push({method:r.method,path:o,handler:r.handler}),this.p(r.method,o,r.handler)}}m(t,e,n,r){if("function"==typeof n&&(r=n),"function"!=typeof r)throw new Error("Handler for "+t+" "+e+" must be a function");const o=u(this.prefix,e);this.u.push({method:t,path:o,handler:r}),this.p(t,o,r)}p(t,e,n){-1===e.indexOf(":")?this.staticRoutes.get(t).set(e,n):this.dynamicTries[t].add(a(e),n)}get(t,e,n){this.m("GET",t,e,n)}post(t,e,n){this.m("POST",t,e,n)}put(t,e,n){this.m("PUT",t,e,n)}delete(t,e,n){this.m("DELETE",t,e,n)}patch(t,e,n){this.m("PATCH",t,e,n)}options(t,e,n){this.m("OPTIONS",t,e,n)}head(t,e,n){this.m("HEAD",t,e,n)}scheduled(t){this.scheduledHandler=t}notFound(t){if("function"!=typeof t)throw new Error("notFound(handler) requires a function");this.notFoundHandler=t}onError(t){if("function"!=typeof t)throw new Error("onError(handler) requires a function");this.errorHandler=t}S(t,e){const n=new Headers(e.headers);t.headers.forEach((t,e)=>{"set-cookie"!==e.toLowerCase()&&(n.has(e)||n.set(e,t))});const r="function"==typeof t.headers.getSetCookie?t.headers.getSetCookie():t.headers.get("Set-Cookie")?[t.headers.get("Set-Cookie")]:[];if(r.length){const t="function"==typeof n.getSetCookie?n.getSetCookie():n.get("Set-Cookie")?[n.get("Set-Cookie")]:[],e=new Set(t);for(let t=0;t<r.length;t++){const o=r[t];e.has(o)||(n.append("Set-Cookie",o),e.add(o))}}const o=204===e.status||304===e.status?null:e.body;return new Response(o,{status:e.status,statusText:e.statusText,headers:n})}async fetch(t,e,n){const r=new URL(t.url),o=l(r.pathname),s=t.method,i=this.staticRoutes.get(s);if(i){const s=i.get(o);if(s)return this.C(s,t,e,n,Object.create(null),r)}const c=this.dynamicTries[s];if(c){const s=c.match(a(o));if(s)return this.C(s.handler,t,e,n,s.params,r)}if("OPTIONS"===s){const o=new Context(t,e,n,Object.create(null),r);return this.S(o,new Response(null,{status:204}))}if(this.notFoundHandler)return this.C(this.notFoundHandler,t,e,n,Object.create(null),r);const u=new Context(t,e,n,Object.create(null),r);return this.S(u,new Response("Not Found",{status:404}))}async O(t,e){const n=this.errorHandler;if(!n)return t.text("Internal Server Error",500);try{const r=await n(t,e);return r instanceof Response?this.S(t,r):r&&r.__isJSX||Array.isArray(r)?t.html(r,500):t.text("Internal Server Error",500)}catch{return t.text("Internal Server Error",500)}}async C(t,e,n,r,o,s){const i=new Context(e,n,r,o,s);let c;try{const e=await t(i);c=e instanceof Response?this.S(i,e):e&&e.__isJSX?await i.html(e):i.text("OK")}catch(t){c=await this.O(i,t)}return c}},H=Edge;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lengkapp/edge",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "description": "Edge framework used by Lengkapp",
   "main": "dist/edge-server.js",
   "types": "dist/edge-server.d.ts",