@daloyjs/core 1.0.0-rc.4 → 1.0.0-rc.6

package/dist/app.js

@@ -1,8 +1,8 @@
 import { Router } from "./router.js";
 import { WebSocketRegistry, normalizeWebSocketOptions, } from "./websocket.js";
 import { BadRequestError, ForbiddenError, HttpError, InternalError, MethodNotAllowedError, NotFoundError, PayloadTooLargeError, RequestTimeoutError, TooManyRequestsError, UnsupportedMediaTypeError, ValidationError, } from "./errors.js";
-import { readBodyLimited, safeJsonParseLimited, randomId, assertNoDuplicateSingletonHeaders, assertNoReservedInternalHeaders, assertHeaderCountWithinLimit, DEFAULT_MAX_HEADER_COUNT, assertStrongSecret, timingSafeEqual, isForbiddenObjectKey, } from "./security.js";
-import { createLogger, noopLogger } from "./logger.js";
+import { readBodyLimited, safeJsonParseLimited, randomId, assertInboundHeaderGuards, DEFAULT_MAX_HEADER_COUNT, assertStrongSecret, timingSafeEqual, isForbiddenObjectKey, } from "./security.js";
+import { createLogger, noopLogger, sanitizeUrlForLog } from "./logger.js";
 import { generateOpenAPI, openapiToYAML, } from "./openapi.js";
 import { isSchemaValidatedResponse } from "./internal-response.js";
 import { asyncapiHtml, docsContentSecurityPolicy, redocHtml, scalarHtml, swaggerUiHtml, } from "./docs.js";
@@ -127,6 +127,15 @@ const CANONICAL_HTTP_METHODS = new Set([
  * `App` bundle. Must match the string used in `mcpRoutes`.
  */
 const MCP_ROUTE_MARKER = Symbol.for("daloyjs.mcp.route");
+/**
+ * Global-registry symbols stamped by `responseCache()` and `tenancy()` on the
+ * `Hooks` bundles they return. Read here — rather than imported from
+ * `response-cache.ts` / `tenancy.ts` — so neither module is pulled into the core
+ * `App` bundle (which would cost every serverless cold start). Must match the
+ * strings used in those modules.
+ */
+const RESPONSE_CACHE_HOOK_MARKER = Symbol.for("daloyjs.response-cache.hook");
+const TENANCY_HOOK_MARKER = Symbol.for("daloyjs.tenancy.hook");
 /**
  * Apply a topology-aware security preset on top of caller-supplied
  * options. Returns a new options object where preset defaults fill in
@@ -196,6 +205,23 @@ export const DALOY_RAW_BODY = Symbol.for("daloyjs.response.rawBody");
  * so first-party adapters can opt in; not part of the userland API surface.
  */
 export const DALOY_REQUEST_RAW_BODY = Symbol.for("daloyjs.request.rawBody");
+/**
+ * Internal Symbol an adapter sets (on its request shim) to expose the request's
+ * abort hook: a `(reason: unknown) => void` that aborts the `AbortController`
+ * backing `request.signal`. The core invokes it when a request exceeds
+ * {@link AppOptions.requestTimeoutMs} so a handler that forwarded
+ * `ctx.request.signal` to downstream I/O (`fetch`, a DB driver) sees those
+ * calls cancel — cooperative teardown, since single-threaded JS cannot preempt
+ * a running handler.
+ *
+ * The hook is invoked as a method on the request (`this` stays bound to the
+ * shim) so it can reach the shim's private controller. Absent on runtimes
+ * whose `Request.signal` is managed by the platform (Bun / Deno / Workers) and
+ * on direct `app.fetch()` callers, where {@link abortRequest} is a safe no-op
+ * and the timeout still resolves as a `408`. Module-public so first-party
+ * adapters can opt in; not part of the userland API surface.
+ */
+export const DALOY_REQUEST_ABORT = Symbol.for("daloyjs.request.abort");
 /**
  * Internal Symbol set by handlers/serializers to attach a raw stream
  * (Node `Readable` or Web `ReadableStream`) to a `Response`. The Node
@@ -932,7 +958,11 @@ export class App {
      *    auth hook unless it opted out with `mcpRoutes(path, handler, { public: true })`.
      *    MCP tools are model-controlled and side-effecting, so a public one is a
      *    high-impact default.
-     * 3. **Missing CSRF** — when `session()` is installed and any route accepts a
+     * 3. **Cache ahead of tenancy** — a `responseCache()` that runs before
+     *    `tenancy()` builds its key before the tenant exists in `ctx.state`, so
+     *    every tenant collides on one entry and one tenant's response is served to
+     *    the next caller (CWE-524).
+     * 4. **Missing CSRF** — when `session()` is installed and any route accepts a
      *    state-changing method (`POST`/`PUT`/`PATCH`/`DELETE`), a `csrf()` hook
      *    (or third-party equivalent stamped with {@link CSRF_HOOK_MARKER}) must
      *    also be present. Skipped when `app({ csrf: "off" })`.
@@ -981,7 +1011,24 @@ export class App {
             this.bootGuard.error = err;
             throw err;
         }
-        // Guard 3: session() + state-changing route without csrf().
+        // Guard 3: responseCache() mounted ahead of tenancy(). The cache partitions
+        // on the tenant automatically, but only if the tenant is already in
+        // ctx.state when the key is built. Mounted first, it would key every
+        // tenant's response identically and serve one tenant's private body to the
+        // next caller (CWE-524) — silently, with a normal-looking cache HIT.
+        const cacheBeforeTenancy = this.routeSecurityMarkers.find((r) => r.cacheBeforeTenancy);
+        if (cacheBeforeTenancy) {
+            const err = new Error(`Route ${cacheBeforeTenancy.method} ${cacheBeforeTenancy.path} runs responseCache() ` +
+                `before tenancy() in its effective hook chain. The cache key is built before the tenant ` +
+                `is resolved, so every tenant would share one cache entry and one tenant's response ` +
+                `would be served to the next caller (CWE-524 cross-tenant cached-response disclosure). ` +
+                `Register tenancy() first — as a global hook (new App({ hooks: tenancy(...) })) or an ` +
+                `earlier app.use(...) — so the tenant is in ctx.state before the cache reads it. ` +
+                `See https://daloyjs.dev/docs/security/boot-guards.`);
+            this.bootGuard.error = err;
+            throw err;
+        }
+        // Guard 4: session() + state-changing route without csrf().
         if (this.options.csrf === "off")
             return;
         const stateChanging = this.routeSecurityMarkers.find((r) => isStateChangingMethod(r.method) && r.hasSession && !r.hasCsrf);
@@ -1051,13 +1098,21 @@ export class App {
             this.trustProxyWarned = true;
             this.log.warn({ event: "trust-proxy.unconfigured", header: found }, `Request carried ${found} but app({ trustProxy }) is unset; refusing to honour spoofable proxy headers.`);
         }
-        throw new InternalError(`Refusing to dispatch request: ${found} header is present but app({ trustProxy }) is unconfigured. ` +
+        const refusal = new InternalError(`Refusing to dispatch request: ${found} header is present but app({ trustProxy }) is unconfigured. ` +
             `Honouring a spoofable forwarded header would let a client forge its source IP for the rate ` +
             `limiter, audit log, and request-id propagation. ` +
             `Pass app({ trustProxy: true }) when running behind a trusted reverse proxy, ` +
             `or app({ trustProxy: false }) to ignore forwarded headers, ` +
             `or app({ secureDefaults: false }) to disable this guard. ` +
             `See https://daloyjs.dev/docs/security/boot-guards.`);
+        // Every refused request throws from this one line, so the stack is
+        // identical each time and names framework internals rather than anything
+        // an operator can act on. Keep the 500 and keep a line per request — the
+        // refusal must stay visible — but drop the stack, so a client cannot
+        // multiply the bytes it pushes into the error tier by replaying the header.
+        // The actionable message is logged once per process by the warn above.
+        refusal[OMIT_STACK_IN_LOG] = true;
+        throw refusal;
     }
     /**
      * Resolve the {@link AppOptions.docs} option and, when enabled, register
@@ -1701,6 +1756,7 @@ export class App {
         }));
         this._coldPathHooksCache = undefined;
         const buckets = rateLimitConfig ? new Map() : null;
+        const trustProxyHeaders = appTrustsProxyHeaders(this.options);
         this.route({
             method: "GET",
             path,
@@ -1711,7 +1767,7 @@ export class App {
             acknowledgeNoResponseBodySchema: true,
             handler: async ({ request }) => {
                 if (buckets && rateLimitConfig) {
-                    const key = healthRouteKey(request);
+                    const key = healthRouteKey(request, trustProxyHeaders);
                     const now = Date.now();
                     const entry = buckets.get(key);
                     if (!entry || entry.resetMs <= now) {
@@ -1821,6 +1877,7 @@ export class App {
                 `to acknowledge that this probe is reachable without credentials.`);
         }
         const buckets = rateLimitConfig ? new Map() : null;
+        const trustProxyHeaders = appTrustsProxyHeaders(this.options);
         this.route({
             method: "GET",
             path,
@@ -1831,7 +1888,7 @@ export class App {
             acknowledgeNoResponseBodySchema: true,
             handler: async ({ request }) => {
                 if (buckets && rateLimitConfig) {
-                    const key = healthRouteKey(request);
+                    const key = healthRouteKey(request, trustProxyHeaders);
                     const now = Date.now();
                     const entry = buckets.get(key);
                     if (!entry || entry.resetMs <= now) {
@@ -1895,6 +1952,7 @@ export class App {
         }
         const rateLimitConfig = opts.rateLimit === false ? null : { limit: 60, windowMs: 60_000, ...(opts.rateLimit ?? {}) };
         const buckets = rateLimitConfig ? new Map() : null;
+        const trustProxyHeaders = appTrustsProxyHeaders(this.options);
         const log = this.log;
         // Only log report bodies when explicitly enabled. In
         // production this is opt-in; in development the body is included by
@@ -1908,7 +1966,7 @@ export class App {
             summary: "CSP / Reporting API violation receiver",
             handler: async ({ request }) => {
                 if (buckets && rateLimitConfig) {
-                    const key = healthRouteKey(request);
+                    const key = healthRouteKey(request, trustProxyHeaders);
                     const now = Date.now();
                     const entry = buckets.get(key);
                     if (!entry || entry.resetMs <= now) {
@@ -1944,7 +2002,7 @@ export class App {
                 if (parsed === undefined) {
                     throw new BadRequestError("Invalid JSON report body");
                 }
-                const ip = healthRouteKey(request);
+                const ip = healthRouteKey(request, trustProxyHeaders);
                 const userAgent = request.headers.get("user-agent");
                 try {
                     if (opts.onReport) {
@@ -2385,7 +2443,11 @@ export class App {
             : baseLog.child({
                 requestId,
                 method: request.method,
-                url: request.url,
+                // Never bind the raw request URL: query strings commonly carry
+                // OAuth codes, API keys, and signed-URL tokens. sanitizeUrlForLog
+                // keeps origin+path and redacts sensitive query values so 4xx/5xx
+                // lines cannot become a credential sink under the field name `url`.
+                url: sanitizeUrlForLog(request.url),
             });
         const stripFingerprint = this.options.stripServerHeaders !== false;
         let ctx;
@@ -2394,9 +2456,10 @@ export class App {
         let activeResponseHook = globalHooks.onResponse;
         let activeSendHook = globalHooks.onSend;
         try {
-            assertNoDuplicateSingletonHeaders(request.headers);
-            assertNoReservedInternalHeaders(request.headers);
-            assertHeaderCountWithinLimit(request.headers, this.options.maxHeaderCount ?? DEFAULT_MAX_HEADER_COUNT);
+            // Singleton-duplicate + reserved-prefix + header-count cap share ONE
+            // Headers.forEach walk (assertInboundHeaderGuards) instead of a
+            // three-Headers.get() pass plus a separate walk.
+            assertInboundHeaderGuards(request.headers, this.options.maxHeaderCount ?? DEFAULT_MAX_HEADER_COUNT);
             this.assertTrustProxyConfigured(request);
             this.assertBootGuards();
             if (globalHooks.onRequest !== undefined) {
@@ -2862,8 +2925,8 @@ export class App {
      * "draining" signal); then the app waits up to `timeoutMs` for in-flight
      * requests to settle; finally, {@link App.onClose} cleanups run.
      *
-     * Both Node and Bun adapters call this automatically on `SIGINT` / `SIGTERM`.
-     * Call it manually from custom runtimes or integration tests.
+     * The Node, Bun, and Deno adapters call this automatically on `SIGINT` /
+     * `SIGTERM`. Call it manually from custom runtimes or integration tests.
      *
      * @param timeoutMs - Maximum time (ms) to wait for inflight requests. Default: `10_000`.
      * @param reason - Optional human-readable reason forwarded to listeners.
@@ -2954,14 +3017,30 @@ function joinPath(a, b) {
     const joined = `${left}${right}`;
     return joined === "" ? "/" : joined;
 }
-function healthRouteKey(request) {
-    // The probe rate limit deliberately does NOT honour `X-Forwarded-For` —
-    // health probes typically arrive directly from a sidecar / orchestrator,
-    // so even apps that trust forwarded headers should not let an attacker
-    // bypass the per-IP cap by spoofing the header. Fall back to a constant
-    // key when no proxy header is available (single shared bucket).
+/**
+ * Rate-limit / attribution key for built-in observability routes
+ * (`/healthz`, `/readyz`, `/metrics`, CSP report).
+ *
+ * Secure default: a single shared `"global"` bucket. Spoofable platform
+ * headers (`X-Real-IP`, `Fly-Client-IP`) are only read when the app has an
+ * explicit trusted-proxy posture (`trustProxy: true` or `behindProxy` set).
+ * `X-Forwarded-For` is never used here — probes and scrapers often hit the
+ * process directly, and a free-form XFF chain would let an attacker rotate
+ * identities to bypass the cap.
+ *
+ * @param request - Inbound request.
+ * @param trustProxyHeaders - When true, platform client-IP headers may be used.
+ * @returns A stable string key for the in-memory rate-limit map.
+ */
+function healthRouteKey(request, trustProxyHeaders) {
+    if (!trustProxyHeaders)
+        return "global";
     return request.headers.get("x-real-ip") ?? request.headers.get("fly-client-ip") ?? "global";
 }
+/** True when the app declared a trusted reverse-proxy posture. */
+function appTrustsProxyHeaders(options) {
+    return options.trustProxy === true || options.behindProxy !== undefined;
+}
 function corsOriginAllowsFromHooks(layers) {
     const allows = [];
     for (const hooks of layers) {
@@ -3102,16 +3181,29 @@ function securityMarkersFromHooks(layers) {
     let hasSession = false;
     let hasCsrf = false;
     let hasAuth = false;
-    for (const hooks of layers) {
-        const record = hooks;
+    // `layers` is in execution order, so the first index of each marker is enough
+    // to tell whether the cache reads state before tenancy has written it.
+    let cacheIndex = -1;
+    let tenancyIndex = -1;
+    for (let i = 0; i < layers.length; i++) {
+        const record = layers[i];
         if (record[SESSION_HOOK_MARKER] === true)
             hasSession = true;
         if (record[CSRF_HOOK_MARKER] === true)
             hasCsrf = true;
         if (record[AUTH_HOOK_MARKER] === true)
             hasAuth = true;
+        if (cacheIndex === -1 && record[RESPONSE_CACHE_HOOK_MARKER] === true)
+            cacheIndex = i;
+        if (tenancyIndex === -1 && record[TENANCY_HOOK_MARKER] === true)
+            tenancyIndex = i;
     }
-    return { hasSession, hasCsrf, hasAuth };
+    return {
+        hasSession,
+        hasCsrf,
+        hasAuth,
+        cacheBeforeTenancy: cacheIndex !== -1 && tenancyIndex !== -1 && cacheIndex < tenancyIndex,
+    };
 }
 function isStateChangingMethod(method) {
     return method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE";
@@ -3335,34 +3427,32 @@ function scalarConfigurationWithPreferredAuth(configuration, schemes) {
 }
 function finalizeResponse(res, ctx, hooks, stripFingerprint = true) {
     let final = res;
-    const finish = (f) => {
-        if (stripFingerprint) {
-            f.headers.delete("server");
-            f.headers.delete("x-powered-by");
-        }
-        if (hooks.onResponse !== undefined) {
-            const onResponseResult = hooks.onResponse(f);
-            if (isPromiseLike(onResponseResult)) {
-                return onResponseResult.then(() => f);
-            }
-        }
-        return f;
-    };
     if (hooks.onSend !== undefined) {
         const sentResult = hooks.onSend(res, ctx);
         if (isPromiseLike(sentResult)) {
             return sentResult.then((sent) => {
                 if (sent instanceof Response)
                     final = sent;
-                return finish(final);
+                return finishFinalize(final, hooks, stripFingerprint);
             });
         }
-        else {
-            if (sentResult instanceof Response)
-                final = sentResult;
+        if (sentResult instanceof Response)
+            final = sentResult;
+    }
+    return finishFinalize(final, hooks, stripFingerprint);
+}
+function finishFinalize(res, hooks, stripFingerprint) {
+    if (stripFingerprint) {
+        res.headers.delete("server");
+        res.headers.delete("x-powered-by");
+    }
+    if (hooks.onResponse !== undefined) {
+        const onResponseResult = hooks.onResponse(res);
+        if (isPromiseLike(onResponseResult)) {
+            return onResponseResult.then(() => res);
         }
     }
-    return finish(final);
+    return res;
 }
 function isPromiseLike(value) {
     return value !== null && typeof value === "object" && typeof value.then === "function";
@@ -3991,11 +4081,46 @@ function runHandler(def, ctx, requestTimeoutMs) {
     if (requestTimeoutMs === 0 || !isPromiseLike(result)) {
         return result;
     }
-    return withTimeout(result, requestTimeoutMs);
+    return withTimeout(result, requestTimeoutMs, ctx.request);
+}
+/**
+ * Fire an adapter's request abort hook (see {@link DALOY_REQUEST_ABORT}) if the
+ * request shim exposes one. Called as a method so `this` stays bound to the
+ * request. A no-op when the hook is absent (platform-managed `Request.signal`
+ * or a direct `app.fetch()` caller), so the caller must not depend on the
+ * signal actually firing.
+ *
+ * @param request - The in-flight request whose signal should be aborted.
+ * @param reason - Abort reason surfaced on `request.signal.reason`.
+ */
+function abortRequest(request, reason) {
+    const hooked = request;
+    hooked[DALOY_REQUEST_ABORT]?.(reason);
 }
-function withTimeout(p, ms) {
+/**
+ * Race a handler promise against the per-request timeout.
+ *
+ * On timeout the request's {@link DALOY_REQUEST_ABORT} hook is fired first —
+ * aborting `request.signal` with a `TimeoutError` `DOMException` (the same
+ * reason shape as `AbortSignal.timeout()`) so cooperative downstream I/O the
+ * handler forwarded the signal to unwinds — and then the returned promise
+ * rejects with a {@link RequestTimeoutError} so the client receives a `408`.
+ * The handler promise itself keeps a rejection handler attached, so a late
+ * settle (including the `AbortError` from the work it just cancelled) never
+ * surfaces as an unhandled rejection.
+ *
+ * @typeParam T - The handler's resolved value type.
+ * @param p - The handler (or hook chain) promise to bound.
+ * @param ms - Timeout in milliseconds; assumed non-zero by the caller.
+ * @param request - The in-flight request, used to fire the abort hook.
+ * @returns A promise that settles with the handler result or a 408 timeout.
+ */
+function withTimeout(p, ms, request) {
     return new Promise((resolve, reject) => {
-        const t = setTimeout(() => reject(new RequestTimeoutError(ms)), ms);
+        const t = setTimeout(() => {
+            abortRequest(request, new DOMException(`Request exceeded ${ms}ms`, "TimeoutError"));
+            reject(new RequestTimeoutError(ms));
+        }, ms);
         p.then((v) => {
             clearTimeout(t);
             resolve(v);
@@ -4005,8 +4130,25 @@ function withTimeout(p, ms) {
         });
     });
 }
+/**
+ * Marker set on an error whose stack carries no incident information because
+ * the same framework line throws it for every offending request — a rejected
+ * *configuration* or *request shape*, not a fault in the app's code.
+ *
+ * `serializeErr` omits the stack for these. The stack is byte-identical on every
+ * occurrence and points at framework internals, so logging it per request just
+ * multiplies the volume an unauthenticated client can push into the error tier
+ * (the expensive, alerting one) without telling an operator anything the
+ * message does not already say.
+ *
+ * @internal
+ */
+const OMIT_STACK_IN_LOG = Symbol.for("daloyjs.error.omitStackInLog");
 function serializeErr(err) {
     if (err instanceof Error) {
+        if (err[OMIT_STACK_IN_LOG] === true) {
+            return { name: err.name, message: err.message };
+        }
         return { name: err.name, message: err.message, stack: err.stack };
     }
     return { value: String(err) };

package/dist/auto-ban.js

@@ -207,9 +207,7 @@ export function autoBan(opts = {}) {
             opts.onStrike?.({ key, strikes, status: res.status });
             if (strikes >= maxStrikes) {
                 banCount += 1;
-                const duration = escalate
-                    ? Math.min(maxBanMs, banMs * 2 ** (banCount - 1))
-                    : banMs;
+                const duration = escalate ? Math.min(maxBanMs, banMs * 2 ** (banCount - 1)) : banMs;
                 bannedUntilMs = now + duration;
                 strikes = 0;
                 opts.onBan?.({ key, banCount, banDurationMs: duration, bannedUntilMs });

package/dist/bot-guard.js

@@ -76,8 +76,14 @@ function matchesUserAgent(ua, patterns) {
             if (pattern && lower.includes(pattern.toLowerCase()))
                 return true;
         }
-        else if (pattern.test(ua)) {
-            return true;
+        else {
+            // Reset lastIndex so caller-supplied /g or /y regexes cannot flip-flop
+            // between match and miss across requests (intermittent allowlist bypass).
+            pattern.lastIndex = 0;
+            const hit = pattern.test(ua);
+            pattern.lastIndex = 0;
+            if (hit)
+                return true;
         }
     }
     return false;
@@ -225,12 +231,28 @@ export function botGuard(opts = {}) {
     };
     const writeCache = (key, verified) => {
         const now = Date.now();
+        // Move this key to the newest insertion slot on every (re)write. Eviction
+        // below is therefore FIFO over WRITE-recency (Map preserves insertion
+        // order), not true LRU: cache *reads* on the verification path do not
+        // reorder entries, so a frequently-read-but-never-rewritten key can still
+        // be evicted. That is intentional — reordering on read would add a Map
+        // delete+set to the hot lookup path for no security benefit.
+        if (cache.has(key))
+            cache.delete(key);
         cache.set(key, { verified, expiresMs: now + cacheTtlMs });
         if (cache.size > cacheMax) {
             for (const [k, v] of cache)
                 if (v.expiresMs <= now)
                     cache.delete(k);
         }
+        // Still over the cap after pruning expired entries: evict the
+        // oldest-written live keys (front of insertion order) until within cacheMax.
+        while (cache.size > cacheMax) {
+            const oldest = cache.keys().next().value;
+            if (oldest === undefined)
+                break;
+            cache.delete(oldest);
+        }
     };
     const reject = (event) => {
         opts.onBlock?.(event);
@@ -252,7 +274,12 @@ export function botGuard(opts = {}) {
                 reject({ reason: "blocked-user-agent", userAgent: ua });
                 return undefined;
             }
-            const rule = verifiedBots.find((r) => r.userAgent.test(ua));
+            const rule = verifiedBots.find((r) => {
+                r.userAgent.lastIndex = 0;
+                const hit = r.userAgent.test(ua);
+                r.userAgent.lastIndex = 0;
+                return hit;
+            });
             if (!rule)
                 return undefined;
             const ip = resolveIp(ctx);

package/dist/cli.js

@@ -274,7 +274,11 @@ export function parseArgs(argv) {
     };
     let command = "inspect";
     let i = 0;
-    if (argv[0] === "inspect" || argv[0] === "dev" || argv[0] === "help" || argv[0] === "doctor" || argv[0] === "diff") {
+    if (argv[0] === "inspect" ||
+        argv[0] === "dev" ||
+        argv[0] === "help" ||
+        argv[0] === "doctor" ||
+        argv[0] === "diff") {
         command = argv[0];
         i = 1;
     }
@@ -593,7 +597,8 @@ async function runDoctor(opts, io) {
     const o = app.options;
     const isProd = o.env === "production" ||
         o.production === true ||
-        globalThis.process?.env?.NODE_ENV === "production";
+        globalThis.process?.env?.NODE_ENV ===
+            "production";
     if (opts.noAuditDefaults !== true) {
         if (isProd && o.trustProxy === undefined && o.behindProxy === undefined) {
             findings.push({
@@ -907,10 +912,8 @@ export function buildAiDump(app, opts) {
             method: def.method,
             path: def.path,
             ...(def.operationId ? { operationId: def.operationId } : {}),
-            ...(def.summary ?? meta?.summary
-                ? { summary: def.summary ?? meta?.summary }
-                : {}),
-            ...(def.description ?? meta?.description
+            ...((def.summary ?? meta?.summary) ? { summary: def.summary ?? meta?.summary } : {}),
+            ...((def.description ?? meta?.description)
                 ? { description: def.description ?? meta?.description }
                 : {}),
             tags: dedupeTags(def.tags, meta?.tags),

package/dist/client.d.ts

@@ -10,13 +10,15 @@
  * can still be generated from the OpenAPI doc for non-TS clients).
  */
 import type { App } from "./app.js";
-import type { HandlerReturn, InferRequest, RequestSchemas, ResponsesMap, RouteDefinition } from "./types.js";
+import type { HandlerReturn, InferRequest, ParamsOf, RequestSchemas, ResponsesMap, RouteDefinition } from "./types.js";
 /** Union of every {@link RouteDefinition} registered on an `App`. */
 export type RoutesOf<A extends App> = A["routes"][number];
 /**
  * Typed client surface generated from an `App`. The result is a record keyed
  * by each route's `operationId` whose values are async methods inferred from
- * the route's request and response schemas.
+ * the route's request and response schemas. Required query and header fields
+ * remain required on the client input, while schemas that accept an empty
+ * object keep their corresponding client field optional.
  *
  * The per-method types are recovered from the `App`'s accumulated route tuple,
  * built by chained registrations or `app.registerRoutes([...])`. If the result
@@ -28,18 +30,38 @@ export type ClientFor<A extends App> = {
         operationId: string;
     }> as R["operationId"]]: ClientMethod<R>;
 };
-type ClientMethod<R> = R extends RouteDefinition<infer P, infer _M, infer Req, infer Res> ? (input: ClientInput<P, Req>) => Promise<ClientOutput<Res>> : never;
-type ClientInput<P extends string, Req extends RequestSchemas | undefined> = {
+type ClientMethod<R> = R extends RouteDefinition<infer P, infer _M, infer Req, infer Res> ? {} extends ClientInput<P, Req> ? (input?: ClientInput<P, Req>) => Promise<ClientOutput<Res>> : (input: ClientInput<P, Req>) => Promise<ClientOutput<Res>> : never;
+type ClientInput<P extends string, Req extends RequestSchemas | undefined> = ([
+    ParamsOf<P>
+] extends [never] ? {
+    params?: Record<string, never>;
+} : {
     params: InferRequest<Req, P>["params"];
-    query?: Partial<InferRequest<Req, P>["query"]>;
-    headers?: Record<string, string>;
-} & (Req extends {
+}) & ClientQueryInput<P, Req> & ClientHeadersInput<P, Req> & (Req extends {
     body: infer _B;
 } ? {
     body: InferRequest<Req, P>["body"];
 } : {
     body?: undefined;
 });
+type ClientQueryInput<P extends string, Req extends RequestSchemas | undefined> = Req extends {
+    query: infer _Query;
+} ? {} extends NonNullable<InferRequest<Req, P>["query"]> ? {
+    query?: NonNullable<InferRequest<Req, P>["query"]>;
+} : {
+    query: NonNullable<InferRequest<Req, P>["query"]>;
+} : {
+    query?: Record<string, string | string[] | number | boolean | undefined>;
+};
+type ClientHeadersInput<P extends string, Req extends RequestSchemas | undefined> = Req extends {
+    headers: infer _Headers;
+} ? {} extends NonNullable<InferRequest<Req, P>["headers"]> ? {
+    headers?: NonNullable<InferRequest<Req, P>["headers"]>;
+} : {
+    headers: NonNullable<InferRequest<Req, P>["headers"]>;
+} : {
+    headers?: Record<string, string>;
+};
 type ClientOutput<Res extends ResponsesMap> = HandlerReturn<Res>;
 /** Options for {@link createClient}. */
 export interface ClientOptions {
@@ -62,6 +84,9 @@ export interface InProcessClientOptions {
  * `operationId`. Parameters and response types are inferred from the same
  * route definitions registered on `app`, so the client and server cannot
  * drift apart at the type level.
+ * Required `params`, `query`, `headers`, and `body` inputs are preserved from
+ * the route contract; query or header schemas that accept an empty object keep
+ * those top-level fields optional.
  *
  * The returned object is a plain `Record<operationId, (input) => Promise<...>>`
  * — each call serializes `params`/`query`/`headers`/`body` and dispatches
@@ -69,6 +94,8 @@ export interface InProcessClientOptions {
  *
  * For non-TypeScript consumers, run `pnpm gen` to emit a fully-typed SDK
  * from the OpenAPI document instead.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
  *
  * @remarks
  * The method signatures are inferred from the `App`'s accumulated route tuple.
@@ -106,6 +133,8 @@ export declare function createClient<A extends App>(app: A, opts: ClientOptions)
  *
  * Requests still traverse the complete validation, middleware, security, and
  * serialization pipeline through {@link "./app.js".App.fetch}.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
  *
  * @param app - App whose registered route tuple drives the client surface.
  * @param opts - Optional synthetic origin and default request headers.

package/dist/client.js

@@ -14,6 +14,9 @@
  * `operationId`. Parameters and response types are inferred from the same
  * route definitions registered on `app`, so the client and server cannot
  * drift apart at the type level.
+ * Required `params`, `query`, `headers`, and `body` inputs are preserved from
+ * the route contract; query or header schemas that accept an empty object keep
+ * those top-level fields optional.
  *
  * The returned object is a plain `Record<operationId, (input) => Promise<...>>`
  * — each call serializes `params`/`query`/`headers`/`body` and dispatches
@@ -21,6 +24,8 @@
  *
  * For non-TypeScript consumers, run `pnpm gen` to emit a fully-typed SDK
  * from the OpenAPI document instead.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
  *
  * @remarks
  * The method signatures are inferred from the `App`'s accumulated route tuple.
@@ -98,6 +103,8 @@ export function createClient(app, opts) {
  *
  * Requests still traverse the complete validation, middleware, security, and
  * serialization pipeline through {@link "./app.js".App.fetch}.
+ * Routes without path parameters omit the `params` input, and routes with no
+ * required request inputs may be called without an argument.
  *
  * @param app - App whose registered route tuple drives the client surface.
  * @param opts - Optional synthetic origin and default request headers.

package/dist/compression.d.ts

@@ -38,6 +38,15 @@ export interface CompressionOptions {
      * below `0` or above `2 ** 31 - 1` are refused at construction.
      */
     minimumSize?: number;
+    /**
+     * Maximum response body size (in bytes) the middleware will buffer for
+     * compression. Larger (or unknown-and-growing) bodies are left uncompressed
+     * so a large GET cannot force unbounded heap growth. Default: `1_048_576`
+     * (1 MiB). Must be a positive integer.
+     *
+     * @since 1.0.0
+     */
+    maxCompressibleBytes?: number;
     /**
      * Allowed encodings, in caller-preferred order. Defaults to
      * `["br", "gzip", "deflate"]` — the middleware will pick the