@daloyjs/core 1.0.0-rc.3 → 1.0.0-rc.5

package/dist/bot-guard.js

@@ -76,8 +76,14 @@ function matchesUserAgent(ua, patterns) {
             if (pattern && lower.includes(pattern.toLowerCase()))
                 return true;
         }
-        else if (pattern.test(ua)) {
-            return true;
+        else {
+            // Reset lastIndex so caller-supplied /g or /y regexes cannot flip-flop
+            // between match and miss across requests (intermittent allowlist bypass).
+            pattern.lastIndex = 0;
+            const hit = pattern.test(ua);
+            pattern.lastIndex = 0;
+            if (hit)
+                return true;
         }
     }
     return false;
@@ -225,12 +231,28 @@ export function botGuard(opts = {}) {
     };
     const writeCache = (key, verified) => {
         const now = Date.now();
+        // Move this key to the newest insertion slot on every (re)write. Eviction
+        // below is therefore FIFO over WRITE-recency (Map preserves insertion
+        // order), not true LRU: cache *reads* on the verification path do not
+        // reorder entries, so a frequently-read-but-never-rewritten key can still
+        // be evicted. That is intentional — reordering on read would add a Map
+        // delete+set to the hot lookup path for no security benefit.
+        if (cache.has(key))
+            cache.delete(key);
         cache.set(key, { verified, expiresMs: now + cacheTtlMs });
         if (cache.size > cacheMax) {
             for (const [k, v] of cache)
                 if (v.expiresMs <= now)
                     cache.delete(k);
         }
+        // Still over the cap after pruning expired entries: evict the
+        // oldest-written live keys (front of insertion order) until within cacheMax.
+        while (cache.size > cacheMax) {
+            const oldest = cache.keys().next().value;
+            if (oldest === undefined)
+                break;
+            cache.delete(oldest);
+        }
     };
     const reject = (event) => {
         opts.onBlock?.(event);
@@ -252,7 +274,12 @@ export function botGuard(opts = {}) {
                 reject({ reason: "blocked-user-agent", userAgent: ua });
                 return undefined;
             }
-            const rule = verifiedBots.find((r) => r.userAgent.test(ua));
+            const rule = verifiedBots.find((r) => {
+                r.userAgent.lastIndex = 0;
+                const hit = r.userAgent.test(ua);
+                r.userAgent.lastIndex = 0;
+                return hit;
+            });
             if (!rule)
                 return undefined;
             const ip = resolveIp(ctx);

package/dist/cli.js

@@ -704,6 +704,44 @@ async function runDoctor(opts, io) {
                     "header-count amplification defence.",
             });
         }
+        // JSON structural limits audit. The new jsonMaxKeys / jsonMaxDepth
+        // guards protect against hash-flood / deep-nesting DoS inside the byte
+        // limit. Surface when disabled (0) or raised to an implausibly high
+        // value.
+        const jsonMaxKeys = o.jsonMaxKeys;
+        if (jsonMaxKeys === 0) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxKeys.disabled",
+                message: "jsonMaxKeys is 0 — the wide-object / hash-flood structural limit " +
+                    "is disabled. An attacker can send tens or hundreds of thousands " +
+                    "of keys in a body that still fits under bodyLimitBytes.",
+            });
+        }
+        else if (typeof jsonMaxKeys === "number" && jsonMaxKeys > 100_000) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxKeys.blanket",
+                message: `jsonMaxKeys is ${jsonMaxKeys} (> 100k). A cap this high weakens ` +
+                    "protection against wide-object DoS payloads.",
+            });
+        }
+        const jsonMaxDepth = o.jsonMaxDepth;
+        if (jsonMaxDepth === 0) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxDepth.disabled",
+                message: "jsonMaxDepth is 0 — deep nesting DoS protection is disabled.",
+            });
+        }
+        else if (typeof jsonMaxDepth === "number" && jsonMaxDepth > 200) {
+            findings.push({
+                level: "warn",
+                code: "audit.jsonMaxDepth.blanket",
+                message: `jsonMaxDepth is ${jsonMaxDepth} (> 200). Extremely deep JSON is ` +
+                    "almost never legitimate and can amplify CPU during validation.",
+            });
+        }
         // Idle-timeout / request-timeout audit. Reaffirms the
         // existing requestTimeoutMs check; also surface an explicit zero
         // idleTimeoutMs in production. The framework also keeps adapter
@@ -921,7 +959,9 @@ function aiResponses(responses) {
     for (const [status, spec] of Object.entries(responses)) {
         if (!spec)
             continue;
-        const entry = { description: spec.description };
+        const entry = {
+            description: spec.description ?? `HTTP ${status} response`,
+        };
         if (spec.body)
             entry.body = aiSchema(spec.body);
         if (spec.examples)

package/dist/client.d.ts

@@ -10,38 +10,58 @@
  * can still be generated from the OpenAPI doc for non-TS clients).
  */
 import type { App } from "./app.js";
-import type { HandlerReturn, InferRequest, RequestSchemas, ResponsesMap, RouteDefinition } from "./types.js";
+import type { HandlerReturn, InferRequest, ParamsOf, RequestSchemas, ResponsesMap, RouteDefinition } from "./types.js";
 /** Union of every {@link RouteDefinition} registered on an `App`. */
 export type RoutesOf<A extends App> = A["routes"][number];
 /**
  * Typed client surface generated from an `App`. The result is a record keyed
  * by each route's `operationId` whose values are async methods inferred from
- * the route's request and response schemas.
+ * the route's request and response schemas. Required query and header fields
+ * remain required on the client input, while schemas that accept an empty
+ * object keep their corresponding client field optional.
  *
  * The per-method types are recovered from the `App`'s accumulated route tuple,
- * which is built up as you **chain** `app.route(...)` calls. If the `App` type
- * is widened back to its bare default — e.g. a `const app: App` annotation, a
- * `: App` factory return type, or registering routes as separate statements
- * rather than a chain — the tuple is erased and this type collapses to an
- * untyped, string-indexed record.
+ * built by chained registrations or `app.registerRoutes([...])`. If the result
+ * is widened back to a bare `App` annotation, the tuple is intentionally erased
+ * and this type becomes a string-indexed record.
  */
 export type ClientFor<A extends App> = {
     [R in Extract<RoutesOf<A>, {
         operationId: string;
     }> as R["operationId"]]: ClientMethod<R>;
 };
-type ClientMethod<R> = R extends RouteDefinition<infer P, infer _M, infer Req, infer Res> ? (input: ClientInput<P, Req>) => Promise<ClientOutput<Res>> : never;
-type ClientInput<P extends string, Req extends RequestSchemas | undefined> = {
+type ClientMethod<R> = R extends RouteDefinition<infer P, infer _M, infer Req, infer Res> ? {} extends ClientInput<P, Req> ? (input?: ClientInput<P, Req>) => Promise<ClientOutput<Res>> : (input: ClientInput<P, Req>) => Promise<ClientOutput<Res>> : never;
+type ClientInput<P extends string, Req extends RequestSchemas | undefined> = ([
+    ParamsOf<P>
+] extends [never] ? {
+    params?: Record<string, never>;
+} : {
     params: InferRequest<Req, P>["params"];
-    query?: Partial<InferRequest<Req, P>["query"]>;
-    headers?: Record<string, string>;
-} & (Req extends {
+}) & ClientQueryInput<P, Req> & ClientHeadersInput<P, Req> & (Req extends {
     body: infer _B;
 } ? {
     body: InferRequest<Req, P>["body"];
 } : {
     body?: undefined;
 });
+type ClientQueryInput<P extends string, Req extends RequestSchemas | undefined> = Req extends {
+    query: infer _Query;
+} ? {} extends NonNullable<InferRequest<Req, P>["query"]> ? {
+    query?: NonNullable<InferRequest<Req, P>["query"]>;
+} : {
+    query: NonNullable<InferRequest<Req, P>["query"]>;
+} : {
+    query?: Record<string, string | string[] | number | boolean | undefined>;
+};
+type ClientHeadersInput<P extends string, Req extends RequestSchemas | undefined> = Req extends {
+    headers: infer _Headers;
+} ? {} extends NonNullable<InferRequest<Req, P>["headers"]> ? {
+    headers?: NonNullable<InferRequest<Req, P>["headers"]>;
+} : {
+    headers: NonNullable<InferRequest<Req, P>["headers"]>;
+} : {
+    headers?: Record<string, string>;
+};
 type ClientOutput<Res extends ResponsesMap> = HandlerReturn<Res>;
 /** Options for {@link createClient}. */
 export interface ClientOptions {
@@ -52,11 +72,21 @@ export interface ClientOptions {
     /** Default headers merged into every request (per-call `input.headers` wins). */
     headers?: Record<string, string>;
 }
+/** Options for {@link createInProcessClient}. */
+export interface InProcessClientOptions {
+    /** Synthetic absolute origin used while constructing requests. Default: `http://daloy.local`. */
+    baseUrl?: string;
+    /** Default headers merged into every request. Per-call headers win. */
+    headers?: Record<string, string>;
+}
 /**
- * Build a typed, in-process fetch client whose methods are keyed by
+ * Build a typed fetch client whose methods are keyed by
  * `operationId`. Parameters and response types are inferred from the same
  * route definitions registered on `app`, so the client and server cannot
  * drift apart at the type level.
+ * Required `params`, `query`, `headers`, and `body` inputs are preserved from
+ * the route contract; query or header schemas that accept an empty object keep
+ * those top-level fields optional.
  *
  * The returned object is a plain `Record<operationId, (input) => Promise<...>>`
  * — each call serializes `params`/`query`/`headers`/`body` and dispatches
@@ -64,13 +94,14 @@ export interface ClientOptions {
  *
  * For non-TypeScript consumers, run `pnpm gen` to emit a fully-typed SDK
  * from the OpenAPI document instead.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
  *
  * @remarks
- * The method signatures are inferred from the `App`'s accumulated route tuple,
- * so chain your `app.route(...)` registrations and let TypeScript infer the
- * variable's type. A widening `const app: App` annotation, a `: App` factory
- * return type, or registering routes as separate statements erases the
- * per-route types and yields an untyped client.
+ * The method signatures are inferred from the `App`'s accumulated route tuple.
+ * Chain registrations or compose independently exported contracts with
+ * `app.registerRoutes([...])`, and avoid widening the result to a bare `App`
+ * annotation because that deliberately discards the per-route tuple.
  *
  * @example
  * ```ts
@@ -96,4 +127,19 @@ export interface ClientOptions {
  * @since 0.1.0
  */
 export declare function createClient<A extends App>(app: A, opts: ClientOptions): ClientFor<A>;
+/**
+ * Build a typed client that dispatches directly through an App without
+ * opening a socket or binding a port.
+ *
+ * Requests still traverse the complete validation, middleware, security, and
+ * serialization pipeline through {@link "./app.js".App.fetch}.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
+ *
+ * @param app - App whose registered route tuple drives the client surface.
+ * @param opts - Optional synthetic origin and default request headers.
+ * @returns A typed operation-id client backed by in-process dispatch.
+ * @since 1.0.0
+ */
+export declare function createInProcessClient<A extends App>(app: A, opts?: InProcessClientOptions): ClientFor<A>;
 export {};

package/dist/client.js

@@ -10,10 +10,13 @@
  * can still be generated from the OpenAPI doc for non-TS clients).
  */
 /**
- * Build a typed, in-process fetch client whose methods are keyed by
+ * Build a typed fetch client whose methods are keyed by
  * `operationId`. Parameters and response types are inferred from the same
  * route definitions registered on `app`, so the client and server cannot
  * drift apart at the type level.
+ * Required `params`, `query`, `headers`, and `body` inputs are preserved from
+ * the route contract; query or header schemas that accept an empty object keep
+ * those top-level fields optional.
  *
  * The returned object is a plain `Record<operationId, (input) => Promise<...>>`
  * — each call serializes `params`/`query`/`headers`/`body` and dispatches
@@ -21,13 +24,14 @@
  *
  * For non-TypeScript consumers, run `pnpm gen` to emit a fully-typed SDK
  * from the OpenAPI document instead.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
  *
  * @remarks
- * The method signatures are inferred from the `App`'s accumulated route tuple,
- * so chain your `app.route(...)` registrations and let TypeScript infer the
- * variable's type. A widening `const app: App` annotation, a `: App` factory
- * return type, or registering routes as separate statements erases the
- * per-route types and yields an untyped client.
+ * The method signatures are inferred from the `App`'s accumulated route tuple.
+ * Chain registrations or compose independently exported contracts with
+ * `app.registerRoutes([...])`, and avoid widening the result to a bare `App`
+ * annotation because that deliberately discards the per-route tuple.
  *
  * @example
  * ```ts
@@ -93,6 +97,32 @@ export function createClient(app, opts) {
     }
     return out;
 }
+/**
+ * Build a typed client that dispatches directly through an App without
+ * opening a socket or binding a port.
+ *
+ * Requests still traverse the complete validation, middleware, security, and
+ * serialization pipeline through {@link "./app.js".App.fetch}.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
+ *
+ * @param app - App whose registered route tuple drives the client surface.
+ * @param opts - Optional synthetic origin and default request headers.
+ * @returns A typed operation-id client backed by in-process dispatch.
+ * @since 1.0.0
+ */
+export function createInProcessClient(app, opts = {}) {
+    const clientOptions = {
+        baseUrl: opts.baseUrl ?? "http://daloy.local",
+        fetch: (input, init) => {
+            const request = input instanceof Request ? input : new Request(input, init);
+            return app.fetch(request);
+        },
+    };
+    if (opts.headers)
+        clientOptions.headers = opts.headers;
+    return createClient(app, clientOptions);
+}
 function safeJson(text) {
     try {
         return JSON.parse(text);

package/dist/combine.d.ts

@@ -5,7 +5,7 @@
  *
  * @since 0.19.0
  */
-import type { Hooks, BaseContext } from "./types.js";
+import type { Hooks, BaseContext, PreBodyContext } from "./types.js";
 /**
  * Run every supplied {@link Hooks} bundle in order, pipeline-style.
  * Equivalent to passing the bundles to `app.use(...)` one after another,
@@ -13,7 +13,7 @@ import type { Hooks, BaseContext } from "./types.js";
  * stack for the admin section"). All lifecycle phases compose:
  *
  * - `onRequest` / `onResponse` run in registration order.
- * - `beforeHandle` / `onError` short-circuit on the first `Response`.
+ * - `preBody` / `beforeHandle` / `onError` short-circuit on the first `Response`.
  * - `afterHandle` / `onSend` thread the value through every bundle.
  *
  * Symbol-keyed security markers (CORS / CSRF / session / secure-headers)
@@ -35,14 +35,14 @@ import type { Hooks, BaseContext } from "./types.js";
  */
 export declare function every(...layers: Hooks[]): Hooks;
 /**
- * Run the supplied bundles until one of them passes its `beforeHandle`
+ * Run the supplied bundles until one of them passes its auth gate
  * check without throwing. Useful for "this route accepts a bearer token
  * OR a signed cookie OR an API key" patterns where any single proof of
  * identity is enough.
  *
  * Semantics:
  *
- * - The bundles' `beforeHandle` hooks are awaited in order. The first one
+ * - The bundles' `preBody` or `beforeHandle` hooks are awaited in order. The first one
  *   that resolves without throwing wins; its `ctx` mutations (headers,
  *   `ctx.state`, etc.) are preserved.
  * - When a bundle returns a `Response`, that response is treated as a
@@ -52,7 +52,7 @@ export declare function every(...layers: Hooks[]): Hooks;
  *   client gets a deterministic status code. Place the auth method whose
  *   `WWW-Authenticate` challenge you want clients to see first.
  * - `afterHandle`, `onSend`, `onResponse`, and `onError` from every bundle
- *   still compose normally — `some()` only changes the `beforeHandle`
+ *   still compose normally — `some()` only changes the auth-gate
  *   evaluation strategy.
  *
  * @example
@@ -63,8 +63,8 @@ export declare function every(...layers: Hooks[]): Hooks;
  * ));
  * ```
  *
- * @param layers Candidate hook bundles; the first `beforeHandle` that passes wins.
- * @returns A merged {@link Hooks} bundle with the OR-style `beforeHandle` strategy.
+ * @param layers Candidate hook bundles; the first auth gate that passes wins.
+ * @returns A merged {@link Hooks} bundle with an OR-style auth-gate strategy.
  * @since 0.19.0
  */
 export declare function some(...layers: Hooks[]): Hooks;
@@ -76,7 +76,7 @@ export declare function some(...layers: Hooks[]): Hooks;
  *
  * @since 0.19.0
  */
-export type ExceptPredicate = string | string[] | ((ctx: BaseContext<any, any>) => boolean | Promise<boolean>);
+export type ExceptPredicate = string | string[] | ((ctx: PreBodyContext<any> | BaseContext<any, any>) => boolean | Promise<boolean>);
 /**
  * Run a hook bundle on every request EXCEPT those matching `when`. The
  * canonical use is "apply auth everywhere except the public endpoints":
@@ -89,15 +89,15 @@ export type ExceptPredicate = string | string[] | ((ctx: BaseContext<any, any>)
  * ));
  * ```
  *
- * Only the `beforeHandle` phase is gated — the surrounding
+ * The `preBody` and `beforeHandle` phases are gated — the surrounding
  * `onRequest`/`afterHandle`/`onSend`/`onResponse` phases still run so
  * shared concerns like request-id propagation are not accidentally
  * exempted. Wrap each bundle with {@link except} individually when you
  * need to gate other phases.
  *
  * @param when Paths or predicate ({@link ExceptPredicate}) that exempt a request.
- * @param hooks The hook bundle whose `beforeHandle` is skipped on a match.
- * @returns A {@link Hooks} bundle whose `beforeHandle` is gated by `when`.
+ * @param hooks The hook bundle whose `preBody` and `beforeHandle` gates are skipped on a match.
+ * @returns A {@link Hooks} bundle whose request gates are controlled by `when`.
  * @throws Error at composition time if a string pattern does not start with `/`.
  * @since 0.19.0
  */

package/dist/combine.js

@@ -5,6 +5,7 @@
  *
  * @since 0.19.0
  */
+import { _mergePreBodyWithEarlyRejections, EARLY_REJECTION_HOOK_MARKER } from "./middleware.js";
 /**
  * Run every supplied {@link Hooks} bundle in order, pipeline-style.
  * Equivalent to passing the bundles to `app.use(...)` one after another,
@@ -12,7 +13,7 @@
  * stack for the admin section"). All lifecycle phases compose:
  *
  * - `onRequest` / `onResponse` run in registration order.
- * - `beforeHandle` / `onError` short-circuit on the first `Response`.
+ * - `preBody` / `beforeHandle` / `onError` short-circuit on the first `Response`.
  * - `afterHandle` / `onSend` thread the value through every bundle.
  *
  * Symbol-keyed security markers (CORS / CSRF / session / secure-headers)
@@ -36,14 +37,14 @@ export function every(...layers) {
     return mergeCombineHooks(layers);
 }
 /**
- * Run the supplied bundles until one of them passes its `beforeHandle`
+ * Run the supplied bundles until one of them passes its auth gate
  * check without throwing. Useful for "this route accepts a bearer token
  * OR a signed cookie OR an API key" patterns where any single proof of
  * identity is enough.
  *
  * Semantics:
  *
- * - The bundles' `beforeHandle` hooks are awaited in order. The first one
+ * - The bundles' `preBody` or `beforeHandle` hooks are awaited in order. The first one
  *   that resolves without throwing wins; its `ctx` mutations (headers,
  *   `ctx.state`, etc.) are preserved.
  * - When a bundle returns a `Response`, that response is treated as a
@@ -53,7 +54,7 @@ export function every(...layers) {
  *   client gets a deterministic status code. Place the auth method whose
  *   `WWW-Authenticate` challenge you want clients to see first.
  * - `afterHandle`, `onSend`, `onResponse`, and `onError` from every bundle
- *   still compose normally — `some()` only changes the `beforeHandle`
+ *   still compose normally — `some()` only changes the auth-gate
  *   evaluation strategy.
  *
  * @example
@@ -64,45 +65,65 @@ export function every(...layers) {
  * ));
  * ```
  *
- * @param layers Candidate hook bundles; the first `beforeHandle` that passes wins.
- * @returns A merged {@link Hooks} bundle with the OR-style `beforeHandle` strategy.
+ * @param layers Candidate hook bundles; the first auth gate that passes wins.
+ * @returns A merged {@link Hooks} bundle with an OR-style auth-gate strategy.
  * @since 0.19.0
  */
 export function some(...layers) {
     if (layers.length === 0)
         return {};
-    const stripped = layers.map(({ beforeHandle: _b, ...rest }) => rest);
+    const stripped = layers.map(({ preBody: _p, beforeHandle: _b, ...rest }) => rest);
     const base = mergeCombineHooks(stripped);
-    const candidates = layers
+    const preBodyCandidates = layers
+        .map((h) => h.preBody)
+        .filter((f) => typeof f === "function");
+    const beforeHandleCandidates = layers
         .map((h) => h.beforeHandle)
         .filter((f) => typeof f === "function");
+    const usePreBody = preBodyCandidates.length > 0 && beforeHandleCandidates.length === 0;
+    const candidates = usePreBody
+        ? preBodyCandidates
+        : layers.flatMap((hooks) => {
+            if (hooks.preBody && hooks.beforeHandle) {
+                return [
+                    async (ctx) => {
+                        const early = await hooks.preBody(ctx);
+                        return early instanceof Response ? early : hooks.beforeHandle(ctx);
+                    },
+                ];
+            }
+            const gate = hooks.preBody ?? hooks.beforeHandle;
+            return gate ? [gate] : [];
+        });
     if (candidates.length === 0)
         return base;
-    return {
-        ...base,
-        async beforeHandle(ctx) {
-            let firstFailure;
-            for (const fn of candidates) {
-                try {
-                    const r = await fn(ctx);
-                    if (r instanceof Response) {
-                        // Treat as a denial — try the next layer.
-                        if (!firstFailure)
-                            firstFailure = { kind: "response", res: r };
-                        continue;
-                    }
-                    // Undefined = pass; bundle accepts the request.
-                    return undefined;
-                }
-                catch (err) {
+    const runCandidates = async (ctx) => {
+        let firstFailure;
+        for (const fn of candidates) {
+            try {
+                const r = await fn(ctx);
+                if (r instanceof Response) {
                     if (!firstFailure)
-                        firstFailure = { kind: "throw", err };
+                        firstFailure = { kind: "response", res: r };
+                    continue;
                 }
+                return undefined;
+            }
+            catch (err) {
+                if (!firstFailure)
+                    firstFailure = { kind: "throw", err };
             }
-            if (firstFailure?.kind === "response")
-                return firstFailure.res;
-            throw firstFailure.err;
-        },
+        }
+        if (firstFailure?.kind === "response")
+            return firstFailure.res;
+        throw firstFailure.err;
+    };
+    if (usePreBody) {
+        return { ...base, preBody: runCandidates };
+    }
+    return {
+        ...base,
+        beforeHandle: runCandidates,
     };
 }
 /**
@@ -117,31 +138,41 @@ export function some(...layers) {
  * ));
  * ```
  *
- * Only the `beforeHandle` phase is gated — the surrounding
+ * The `preBody` and `beforeHandle` phases are gated — the surrounding
  * `onRequest`/`afterHandle`/`onSend`/`onResponse` phases still run so
  * shared concerns like request-id propagation are not accidentally
  * exempted. Wrap each bundle with {@link except} individually when you
  * need to gate other phases.
  *
  * @param when Paths or predicate ({@link ExceptPredicate}) that exempt a request.
- * @param hooks The hook bundle whose `beforeHandle` is skipped on a match.
- * @returns A {@link Hooks} bundle whose `beforeHandle` is gated by `when`.
+ * @param hooks The hook bundle whose `preBody` and `beforeHandle` gates are skipped on a match.
+ * @returns A {@link Hooks} bundle whose request gates are controlled by `when`.
  * @throws Error at composition time if a string pattern does not start with `/`.
  * @since 0.19.0
  */
 export function except(when, hooks) {
-    const matches = compileExceptMatcher(when);
-    const original = hooks.beforeHandle;
-    if (!original)
+    const earlyRejectionHooks = hooks[EARLY_REJECTION_HOOK_MARKER];
+    if (!hooks.preBody && !hooks.beforeHandle && !Array.isArray(earlyRejectionHooks))
         return hooks;
-    return {
-        ...hooks,
-        async beforeHandle(ctx) {
-            if (await matches(ctx))
-                return undefined;
-            return original(ctx);
-        },
-    };
+    const matches = compileExceptMatcher(when);
+    const wrapped = { ...hooks };
+    if (Array.isArray(earlyRejectionHooks)) {
+        wrapped[EARLY_REJECTION_HOOK_MARKER] =
+            earlyRejectionHooks.map((hook) => {
+                if (typeof hook !== "function")
+                    return hook;
+                return async (ctx) => (await matches(ctx)) ? undefined : hook(ctx);
+            });
+    }
+    if (hooks.preBody) {
+        const original = hooks.preBody;
+        wrapped.preBody = async (ctx) => ((await matches(ctx)) ? undefined : original(ctx));
+    }
+    if (hooks.beforeHandle) {
+        const original = hooks.beforeHandle;
+        wrapped.beforeHandle = async (ctx) => ((await matches(ctx)) ? undefined : original(ctx));
+    }
+    return wrapped;
 }
 function compileExceptMatcher(when) {
     if (typeof when === "function") {
@@ -175,9 +206,7 @@ function compilePathPattern(pattern) {
     return (path) => regex.test(path);
 }
 function mergeCombineHooks(layers) {
-    const pick = (key) => layers
-        .map((h) => h[key])
-        .filter((f) => typeof f === "function");
+    const pick = (key) => layers.map((h) => h[key]).filter((f) => typeof f === "function");
     const merged = {};
     const onRequest = pick("onRequest");
     if (onRequest.length > 0) {
@@ -186,6 +215,9 @@ function mergeCombineHooks(layers) {
                 await fn(req);
         };
     }
+    const preBody = _mergePreBodyWithEarlyRejections(layers);
+    if (preBody !== undefined)
+        merged.preBody = preBody;
     const beforeHandle = pick("beforeHandle");
     if (beforeHandle.length > 0) {
         merged.beforeHandle = async (ctx) => {
@@ -245,6 +277,17 @@ function mergeCombineHooks(layers) {
     for (const hooks of layers) {
         const record = hooks;
         for (const key of Object.getOwnPropertySymbols(record)) {
+            if (key === EARLY_REJECTION_HOOK_MARKER && merged.preBody !== undefined)
+                continue;
+            if (key === EARLY_REJECTION_HOOK_MARKER) {
+                const existing = merged[key];
+                const incoming = record[key];
+                merged[key] = [
+                    ...(Array.isArray(existing) ? existing : []),
+                    ...(Array.isArray(incoming) ? incoming : []),
+                ];
+                continue;
+            }
             if (!(key in merged)) {
                 merged[key] = record[key];
             }

package/dist/compression.d.ts

@@ -38,6 +38,15 @@ export interface CompressionOptions {
      * below `0` or above `2 ** 31 - 1` are refused at construction.
      */
     minimumSize?: number;
+    /**
+     * Maximum response body size (in bytes) the middleware will buffer for
+     * compression. Larger (or unknown-and-growing) bodies are left uncompressed
+     * so a large GET cannot force unbounded heap growth. Default: `1_048_576`
+     * (1 MiB). Must be a positive integer.
+     *
+     * @since 1.0.0
+     */
+    maxCompressibleBytes?: number;
     /**
      * Allowed encodings, in caller-preferred order. Defaults to
      * `["br", "gzip", "deflate"]` — the middleware will pick the