okengine 0.23.1 → 0.23.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "okengine",
-  "version": "0.23.1",
+  "version": "0.23.2",
   "description": "One law. Eight elements. One contract. The backend model stays small; operational surfaces are derived from it instead of maintained separately.",
   "license": "Apache-2.0",
   "repository": {

package/site/content/docs/ai/mcp.mdx

@@ -52,16 +52,16 @@ Two actions are write-class, and each call needs a **fresh, single-use** confirm
 <Steps>
 
 <Step>
-### Request a confirmation token
+### Ask for confirmation
 
-`oke.action.confirm` with the target `tool`, the exact `args`, and a human `reason` — it returns a single-use token.
+The write returns an opaque `confirmationId`. It does not return a token. Confirm from a **different auth session** (`claims.sid`) than the session that will invoke. The same principal is allowed. A confirmation issued on another process is unknown.
 
 </Step>
 
 <Step>
 ### Call the write tool
 
-Pass the token as `confirmToken` plus the phrase `CONFIRM` in `confirmation`. Token, phrase, args, and principal must all match what was confirmed.
+`oke.action.confirm(confirmationId, reason)` returns a single-use token. Pass it as `confirmToken` plus the phrase `CONFIRM`. The invoking session must be the one that asked, and it must not be the session that confirmed.
 
 </Step>
 

package/site/content/docs/elements/signal/broadcast.mdx

@@ -12,8 +12,10 @@ For developers invalidating caches or syncing in-process state — declare the S
 more `on(signal, flow)` subscribers, emit with `fx.emit`.
 
 <Callout title="The one rule">
-  Broadcast is ephemeral. If a subscriber is offline or restarts during the emit, it does not
-  receive past events. Use [`live`](/docs/elements/signal/live) when clients need replay. Use
+  Broadcast is ephemeral. Each running instance handles a message once. If a subscriber is offline
+  during the emit, it does not receive that event. Postgres delivery is best-effort within `lagMs`
+  (default 30 seconds): a transaction that commits later than that can be missed. Use
+  [`live`](/docs/elements/signal/live) when clients need replay. Use
   [`once`](/docs/elements/signal/once) when exactly one worker must claim the job.
 </Callout>
 

package/site/content/docs/reference/configuration.mdx

@@ -237,6 +237,22 @@ Domain schema sync for `oke db push | generate | migrate` (Drizzle). Unrelated t
 | `console` | `6533`  | Console |
 | `mcp`     | `6535`  | MCP     |
 
+## App options
+
+These sit on `oke({ ... })`, not in `oke.config.ts`.
+
+| Option               | Default   | Meaning                                                                                                                                                                     |
+| -------------------- | --------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `codeVersion`        | unset     | Opt-in durable stamp `app:<version>`. Unset checks nothing. A stored `0.23.1`-style stamp is compatible and restamped. A different `app:` stamp fails the run with OKE1076. |
+| `maxRequestBodySize` | `1048576` | Body cap in bytes. A route `maxBodySize` overrides it. Bun's listen backstop uses the same number.                                                                          |
+| `cache.maxEntries`   | `10000`   | Auto-cache entry cap.                                                                                                                                                       |
+| `cache.defaultTtlMs` | `60000`   | Auto-cache TTL when the flow does not set `cache: "5m"`.                                                                                                                    |
+| `cache.auto`         | on        | `false` turns automatic caching off. A flow can still opt in.                                                                                                               |
+
+Postgres broadcast and live poll with `lagMs`, default `30000`. That window is best-effort, not a gap-free cursor.
+
+A write drops the auto-cache on every instance. With Redis configured, the notice is published on `oke:cache:invalidate`. Otherwise a Postgres app polls `oke_cache_invalidations`. One process does not broadcast.
+
 ## console
 
 | Option         | Type                                 | Default | Meaning                   |

package/site/content/docs/reference/errors.mdx

@@ -117,25 +117,37 @@ The typed client always includes built-in codes. A declared key still wins.
 A bare `404` with body `Not Found` means **no route matched**. `fx.fail.notFound` is a JSON envelope
 at **404**. Clients distinguish by envelope, not status. Domain codes stay **400**.
 
-| Code                                             | Status      | Helper                                                 |
-| ------------------------------------------------ | ----------- | ------------------------------------------------------ |
-| `ValidationError`                                | `422`       | none — failed `in`, `do` never runs                    |
-| `IdempotencyKeyMissing`                          | `400`       | none — `idempotency: "required"` and no header         |
-| `IdempotencyKeyInvalid`                          | `400`       | none — header is not 16–255 printable ASCII            |
-| `IdempotencyKeyReused`                           | `422`       | none — same key, different payload                     |
-| `IdempotencyInProgress`                          | `409`       | none — `Retry-After` until the in-flight call finishes |
-| `Unauthorized`                                   | `401`       | `unauthorized` · also a gate denial                    |
-| `Forbidden`                                      | `403`       | `forbidden` · also a gate denial                       |
-| `NotFound`                                       | `404`       | `notFound`                                             |
-| `Conflict` / `ForeignKey`                        | `409`       | `conflict` / `foreignKey`                              |
-| `UnsupportedMediaType`                           | `415`       | none — QUERY `Content-Type` is not `application/json`  |
-| `RateLimited` / `AuthRateLimited`                | `429`       | `rateLimited` · `AuthRateLimited` has none             |
-| `InvalidQuery`                                   | `400`       | none — QUERY missing `Content-Type` or body isn't JSON |
-| `AuthFailed`                                     | `400`       | none — credentials / policy, not “no session”          |
-| `DatabaseError`                                  | by `reason` | `database`                                             |
-| `ServiceUnavailable`                             | `503`       | `serviceUnavailable`                                   |
-| `InternalError`                                  | `500`       | `internal` — never copies a thrown `message`           |
-| Domain (`OutOfStock`, `FlightFull`, `Duplicate`) | `400`       | `fx.fail("OutOfStock", data)`                          |
+| Code                                             | Status      | Helper                                                                       |
+| ------------------------------------------------ | ----------- | ---------------------------------------------------------------------------- |
+| `ValidationError`                                | `422`       | none — failed `in`, `do` never runs                                          |
+| `IdempotencyKeyMissing`                          | `400`       | none — `idempotency: "required"` and no header                               |
+| `IdempotencyKeyInvalid`                          | `400`       | none — header is not 16–255 printable ASCII                                  |
+| `IdempotencyKeyReused`                           | `422`       | none — same key, different payload                                           |
+| `IdempotencyInProgress`                          | `409`       | none — `Retry-After` until the in-flight call finishes                       |
+| `Unauthorized`                                   | `401`       | `unauthorized` · also a gate denial                                          |
+| `Forbidden`                                      | `403`       | `forbidden` · also a gate denial                                             |
+| `NotFound`                                       | `404`       | `notFound`                                                                   |
+| `Conflict` / `ForeignKey`                        | `409`       | `conflict` / `foreignKey`                                                    |
+| `UnsupportedMediaType`                           | `415`       | none — QUERY, or a JSON-shaped body that is not `application/json` / `+json` |
+| `PayloadTooLarge`                                | `413`       | none — body exceeds `maxRequestBodySize` or the route `maxBodySize`          |
+| `RateLimited` / `AuthRateLimited`                | `429`       | `rateLimited` · `AuthRateLimited` has none                                   |
+| `InvalidQuery`                                   | `400`       | none — QUERY or JSON body that does not parse (`malformed_body`)             |
+| `AuthFailed`                                     | `400`       | none — credentials / policy, not “no session”                                |
+| `DatabaseError`                                  | by `reason` | `database`                                                                   |
+| `ServiceUnavailable`                             | `503`       | `serviceUnavailable`                                                         |
+| `InternalError`                                  | `500`       | `internal` — never copies a thrown `message`                                 |
+| Domain (`OutOfStock`, `FlightFull`, `Duplicate`) | `400`       | `fx.fail("OutOfStock", data)`                                                |
+
+`UnsupportedMediaType` (415) is this rule, for a non-empty body. Let `mt` be the media type before `;`:
+
+1. `application/json` or `application/*+json` is parsed. A parse failure is 400 `InvalidQuery` with reason `malformed_body`.
+2. A route with `jsonContentType: "any"` tries JSON and otherwise keeps the raw string.
+3. `text/plain`, form-urlencoded, multipart, or a missing type, when the trimmed body starts with `{` or `[` and parses as JSON, is 415.
+4. Anything else is the raw string. `curl -d` needs `-H 'content-type: application/json'`.
+
+`OKE1074` means the durable run lost its lease. The step result is not written and compensation does not run. The caller sees a busy lease, not a new failure of the work.
+
+`OKE1076` means `codeVersion` was set and the stored stamp is a different `app:` value. Leave the old value pinned until sleeping runs drain, then change it. Unset `codeVersion` checks nothing. A stored stamp from 0.23.1 (no `app:` prefix) is restamped, not failed.
 
 ### Client chrome
 

package/src/compiler/aot.test.ts

@@ -97,6 +97,7 @@ describe("compileAot", () => {
     const bad = await compiled.parseValidate(
       new Request("http://localhost/bookings", {
         method: "POST",
+        headers: { "content-type": "application/json" },
         body: JSON.stringify({ flightId: "SK1", seats: 0 }),
       }),
       {},
@@ -235,9 +236,9 @@ describe("AoT throughput ≥ 1.5× dynamic", () => {
     }
 
     const iterations = 4_000;
-    // Best of trials — single wall-clock ratio is noisy under full-suite load.
+    // Best of trials — a single wall-clock ratio moves under load.
     let best = 0;
-    for (let trial = 0; trial < 3; trial++) {
+    for (let trial = 0; trial < 8; trial++) {
       const t0 = performance.now();
       for (let i = 0; i < iterations; i++) {
         await aot.parseValidate(makeReq(), {});

package/src/compiler/aot.ts

@@ -6,9 +6,11 @@
  * {@link compileDynamic} / `aot: false` on edge runtimes that ban `eval`.
  */
 
+import { fail } from "../kernel/errors.ts";
 import { validate, type SchemaInput } from "../validation/standard-schema.ts";
 import {
   assembleInput,
+  HttpBodyRejected,
   parseBody,
   parseCookie,
   parseHeaders,
@@ -33,6 +35,8 @@ export interface CompileRouteOptions {
   readonly hooks?: ReadonlyArray<(...args: never[]) => unknown>;
   /** Input schema (Standard Schema when present). */
   readonly schema?: SchemaInput | undefined;
+  /** Body cap and JSON content-type policy. */
+  readonly body?: import("./http-parse.ts").ParseBodyOptions;
 }
 
 /** Bundle returned by the compilers. */
@@ -55,6 +59,16 @@ interface AotHelpers {
   parseCookie: typeof parseCookie;
   assembleInput: typeof assembleInput;
   validate: typeof validate;
+  readonly body?: import("./http-parse.ts").ParseBodyOptions;
+  readBody: (
+    request: Request,
+  ) => Promise<
+    { ok: true; value: unknown } | { ok: false; failure: import("../kernel/errors.ts").FlowFailure }
+  >;
+  bodyFailure: (
+    err: unknown,
+    request: Request,
+  ) => { ok: false; failure: import("../kernel/errors.ts").FlowFailure } | undefined;
 }
 
 /**
@@ -82,6 +96,34 @@ export function compileAot(options: CompileRouteOptions): CompiledRoute {
     parseCookie,
     assembleInput,
     validate,
+    body: options.body,
+    async readBody(request: Request) {
+      try {
+        return { ok: true as const, value: await parseBody(request, options.body) };
+      } catch (err) {
+        const rejected = this.bodyFailure(err, request);
+        if (rejected) return rejected;
+        throw err;
+      }
+    },
+    bodyFailure(err, request) {
+      if (!(err instanceof HttpBodyRejected)) return undefined;
+      if (err.code === "InvalidQuery") {
+        return {
+          ok: false,
+          failure: fail("InvalidQuery", { reason: err.reason ?? "malformed_body" }),
+        };
+      }
+      if (err.code === "UnsupportedMediaType") {
+        return {
+          ok: false,
+          failure: fail("UnsupportedMediaType", {
+            contentType: request.headers.get("content-type") ?? "",
+          }),
+        };
+      }
+      return { ok: false, failure: fail("PayloadTooLarge", {}) };
+    },
   };
 
   try {
@@ -122,7 +164,9 @@ function generateParseValidate(
     lines.push("parts.cookie = helpers.parseCookie(request);");
   }
   if (inference.body) {
-    lines.push("parts.body = await helpers.parseBody(request);");
+    lines.push("const bodyResult = await helpers.readBody(request);");
+    lines.push("if (bodyResult.ok === false) return bodyResult;");
+    lines.push("parts.body = bodyResult.value;");
   }
 
   lines.push("const raw = helpers.assembleInput(parts);");

package/src/compiler/dynamic.ts

@@ -28,7 +28,7 @@ function loadAot(): typeof import("./aot.ts") {
 export function compileDynamic(options: CompileRouteOptions): CompiledRoute {
   return {
     inference: FULL_INFERENCE,
-    parseValidate: createInterpretedParseValidate(FULL_INFERENCE, options.schema),
+    parseValidate: createInterpretedParseValidate(FULL_INFERENCE, options.schema, options.body),
     aot: false,
   };
 }

package/src/compiler/http-parse.test.ts

@@ -0,0 +1,101 @@
+import { describe, expect, test } from "bun:test";
+
+import { assembleInput, HttpBodyRejected, parseBody } from "./http-parse.ts";
+
+function request(body: string, contentType?: string, length?: string): Request {
+  const headers = new Headers();
+  if (contentType) headers.set("content-type", contentType);
+  if (length) headers.set("content-length", length);
+  return new Request("http://localhost/hooks", { method: "POST", body, headers });
+}
+
+describe("request bodies", () => {
+  test("rejects an overstated and an honest body over the cap", async () => {
+    await expect(
+      parseBody(request("{}", "application/json", "99"), { maxBytes: 4 }),
+    ).rejects.toBeInstanceOf(HttpBodyRejected);
+    await expect(
+      parseBody(request("{}", "application/json"), { maxBytes: 1 }),
+    ).rejects.toMatchObject({
+      code: "PayloadTooLarge",
+    });
+  });
+
+  test("sendBeacon text/plain JSON is 415 unless the route opts out", async () => {
+    const beacon = request('{"n":1}', "text/plain;charset=UTF-8");
+    await expect(parseBody(beacon)).rejects.toMatchObject({ code: "UnsupportedMediaType" });
+    await expect(
+      parseBody(request('{"n":1}', "text/plain"), { jsonContentType: "any" }),
+    ).resolves.toEqual({
+      n: 1,
+    });
+  });
+
+  test("a form body that parses as JSON is 415, and a normal form body stays a string", async () => {
+    await expect(
+      parseBody(request("{not json", "application/x-www-form-urlencoded")),
+    ).resolves.toBe("{not json");
+    await expect(
+      parseBody(request('{"a":1}', "application/x-www-form-urlencoded")),
+    ).rejects.toMatchObject({ code: "UnsupportedMediaType" });
+    await expect(parseBody(request("a=1&b=2", "application/x-www-form-urlencoded"))).resolves.toBe(
+      "a=1&b=2",
+    );
+  });
+
+  test("application/json must parse, and +json is accepted", async () => {
+    await expect(parseBody(request("{", "application/json"))).rejects.toMatchObject({
+      code: "InvalidQuery",
+      reason: "malformed_body",
+    });
+    await expect(
+      parseBody(request('{"n":1}', "application/vnd.x+json; charset=utf-8")),
+    ).resolves.toEqual({ n: 1 });
+  });
+
+  test("drops __proto__ and keeps a constructor field", async () => {
+    const parsed = await parseBody(
+      request('{"__proto__":{"isAdmin":true},"constructor":"ok"}', "application/json"),
+    );
+    expect((parsed as { isAdmin?: boolean; constructor?: string }).isAdmin).toBeUndefined();
+    expect((parsed as { constructor?: string }).constructor).toBe("ok");
+    expect(Object.prototype).not.toHaveProperty("isAdmin");
+    const input = assembleInput({ body: parsed });
+    expect((input as { isAdmin?: boolean }).isAdmin).toBeUndefined();
+
+    const escaped = await parseBody(
+      request('{"\\u005f\\u005fproto\\u005f\\u005f":{"isAdmin":true},"a":1}', "application/json"),
+    );
+    expect((escaped as { a?: number; isAdmin?: boolean }).a).toBe(1);
+    expect((escaped as { isAdmin?: boolean }).isAdmin).toBeUndefined();
+  });
+
+  test("a tighter cap cancels a chunked body instead of buffering it", async () => {
+    let pulled = 0;
+    const stream = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        pulled += 1;
+        if (pulled > 4) {
+          controller.close();
+          return;
+        }
+        controller.enqueue(new Uint8Array(8));
+      },
+    });
+    const req = new Request("http://localhost/hooks", {
+      method: "POST",
+      body: stream,
+      headers: { "content-type": "application/octet-stream" },
+    });
+    await expect(parseBody(req, { maxBytes: 8 })).rejects.toMatchObject({
+      code: "PayloadTooLarge",
+    });
+    expect(pulled).toBeLessThan(4);
+  });
+
+  test("an empty body is undefined", async () => {
+    await expect(
+      parseBody(new Request("http://localhost/", { method: "DELETE" })),
+    ).resolves.toBeUndefined();
+  });
+});

package/src/compiler/http-parse.ts

@@ -77,19 +77,193 @@ export function pathParamNames(path: string): string[] {
   return names;
 }
 
+/** Default request body cap (1 MiB). */
+export const DEFAULT_MAX_BODY_BYTES = 1_048_576;
+
+/** A body the route refused before the flow ran. */
+export class HttpBodyRejected extends Error {
+  /** Builtin failure code. */
+  readonly code: "PayloadTooLarge" | "UnsupportedMediaType" | "InvalidQuery";
+  /** `InvalidQuery` reason, when set. */
+  readonly reason?: string;
+
+  /**
+   * @param code - Builtin failure code
+   * @param reason - Optional InvalidQuery reason
+   */
+  constructor(code: "PayloadTooLarge" | "UnsupportedMediaType" | "InvalidQuery", reason?: string) {
+    super(code);
+    this.name = "HttpBodyRejected";
+    this.code = code;
+    if (reason !== undefined) this.reason = reason;
+  }
+}
+
+/** Per-route body policy. */
+export interface ParseBodyOptions {
+  /** Byte cap. Default {@link DEFAULT_MAX_BODY_BYTES}. */
+  readonly maxBytes?: number;
+  /** Default `required`. `any` keeps today's parse-or-raw-string behavior. */
+  readonly jsonContentType?: "required" | "any";
+}
+
+function mediaType(request: Request): string {
+  const raw = request.headers.get("content-type");
+  if (!raw) return "";
+  return (raw.split(";")[0] ?? "").trim().toLowerCase();
+}
+
+function parseJson(text: string): unknown {
+  const value = JSON.parse(text) as unknown;
+  // Own `__proto__` keys are rare. Skip the clone unless the text can name one,
+  // including a `\u` escape of that key.
+  if (!text.includes("__proto__") && !text.includes("\\u")) return value;
+  return dropProto(value);
+}
+
+function dropProto(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map((item) => dropProto(item));
+  if (value !== null && typeof value === "object") {
+    const out: Record<string, unknown> = {};
+    for (const [key, item] of Object.entries(value as Record<string, unknown>)) {
+      if (key === "__proto__") continue;
+      out[key] = dropProto(item);
+    }
+    return out;
+  }
+  return value;
+}
+
+const textDecoder = new TextDecoder();
+
+async function readDeclared(request: Request, max: number): Promise<string> {
+  const text = await request.text();
+  if (byteLength(text) > max) throw new HttpBodyRejected("PayloadTooLarge");
+  return text;
+}
+
+function byteLength(text: string): number {
+  for (let i = 0; i < text.length; i++) {
+    if (text.charCodeAt(i) > 0x7f) return new TextEncoder().encode(text).byteLength;
+  }
+  return text.length;
+}
+
+function decode(bytes: Uint8Array): string {
+  return textDecoder.decode(bytes);
+}
+
 /**
- * Parse JSON / text body. Empty body → `undefined`.
+ * Read a body with no usable Content-Length.
+ *
+ * At the default cap, `Bun.serve` already stops the socket at the same size,
+ * so this uses the native buffered read and then checks the real length.
+ * A tighter per-route cap still counts chunks and cancels the stream.
+ */
+async function readLimited(request: Request, max: number): Promise<string> {
+  if (max >= DEFAULT_MAX_BODY_BYTES) {
+    const text = await request.text();
+    if (byteLength(text) > max) throw new HttpBodyRejected("PayloadTooLarge");
+    return text;
+  }
+  const body = request.body;
+  if (!body) {
+    const text = await request.text();
+    if (byteLength(text) > max) throw new HttpBodyRejected("PayloadTooLarge");
+    return text;
+  }
+  const reader = body.getReader();
+  const first = await reader.read();
+  if (first.done) return "";
+  if (first.value.byteLength > max) {
+    await reader.cancel();
+    throw new HttpBodyRejected("PayloadTooLarge");
+  }
+  const second = await reader.read();
+  if (second.done) return first.value.byteLength === 0 ? "" : decode(first.value);
+
+  const chunks: Uint8Array[] = [first.value, second.value];
+  let total = first.value.byteLength + second.value.byteLength;
+  if (total > max) {
+    await reader.cancel();
+    throw new HttpBodyRejected("PayloadTooLarge");
+  }
+  for (;;) {
+    const step = await reader.read();
+    if (step.done) break;
+    total += step.value.byteLength;
+    if (total > max) {
+      await reader.cancel();
+      throw new HttpBodyRejected("PayloadTooLarge");
+    }
+    chunks.push(step.value);
+  }
+  const bytes = new Uint8Array(total);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return decode(bytes);
+}
+
+/**
+ * Parse a request body.
+ *
+ * Empty bodies are `undefined`. JSON content types must parse. A JSON-shaped
+ * body sent as text, form, or with no content type is 415 unless the route
+ * opts out. `__proto__` keys are dropped.
  *
  * @param request - Incoming request
+ * @param options - Cap and content-type policy
  */
-export async function parseBody(request: Request): Promise<unknown> {
-  const text = await request.text();
+export async function parseBody(request: Request, options?: ParseBodyOptions): Promise<unknown> {
+  const max = options?.maxBytes ?? DEFAULT_MAX_BODY_BYTES;
+  const declared = request.headers.get("content-length");
+  if (declared !== null && declared !== "" && Number(declared) > max) {
+    throw new HttpBodyRejected("PayloadTooLarge");
+  }
+  // A declared length inside the cap is buffered by the platform. Check the
+  // real byte length afterwards so an understated Content-Length is still 413.
+  // A missing length uses the native buffer at the default cap (the serve
+  // socket already stops there) and a cancelling read for a tighter cap.
+  const text =
+    declared !== null && declared !== "" && Number(declared) <= max
+      ? await readDeclared(request, max)
+      : await readLimited(request, max);
   if (text.length === 0) return undefined;
-  try {
-    return JSON.parse(text) as unknown;
-  } catch {
-    return text;
+  const mt = mediaType(request);
+  const jsonType =
+    mt === "application/json" || (mt.endsWith("+json") && mt.length > "+json".length);
+  if (jsonType) {
+    try {
+      return parseJson(text);
+    } catch {
+      throw new HttpBodyRejected("InvalidQuery", "malformed_body");
+    }
+  }
+  if (options?.jsonContentType === "any") {
+    try {
+      return parseJson(text);
+    } catch {
+      return text;
+    }
+  }
+  const loose =
+    mt === "" ||
+    mt === "text/plain" ||
+    mt === "application/x-www-form-urlencoded" ||
+    mt === "multipart/form-data";
+  const trimmed = text.trim();
+  if (loose && (trimmed.startsWith("{") || trimmed.startsWith("["))) {
+    try {
+      JSON.parse(trimmed);
+      throw new HttpBodyRejected("UnsupportedMediaType");
+    } catch (err) {
+      if (err instanceof HttpBodyRejected) throw err;
+    }
   }
+  return text;
 }
 
 /**
@@ -158,7 +332,11 @@ export function assembleInput(parts: InputParts): unknown {
 
   if (parts.body !== undefined) {
     if (typeof parts.body === "object" && parts.body !== null && !Array.isArray(parts.body)) {
-      Object.assign(out, parts.body as Record<string, unknown>);
+      const body = parts.body as Record<string, unknown>;
+      for (const [key, value] of Object.entries(body)) {
+        if (key === "__proto__") continue;
+        out[key] = value;
+      }
     } else {
       out.body = parts.body;
     }
@@ -188,6 +366,7 @@ export async function extractParts(
   request: Request,
   params: Readonly<Record<string, string>>,
   inference: ContextInference,
+  options?: { readonly body?: ParseBodyOptions },
 ): Promise<InputParts> {
   const parts: {
     params?: Record<string, string>;
@@ -201,7 +380,7 @@ export async function extractParts(
   if (inference.query) parts.query = parseQuery(request);
   if (inference.headers) parts.headers = parseHeaders(request);
   if (inference.cookie) parts.cookie = parseCookie(request);
-  if (inference.body) parts.body = await parseBody(request);
+  if (inference.body) parts.body = await parseBody(request, options?.body);
 
   return parts;
 }

package/src/compiler/interpret.ts

@@ -5,13 +5,15 @@
  * requested, so eval-restricted runtimes do not carry the codegen.
  */
 
-import type { FlowFailure } from "../kernel/errors.ts";
+import { fail, type FlowFailure } from "../kernel/errors.ts";
 import { validate, type SchemaInput } from "../validation/standard-schema.ts";
 import {
   assembleInput,
   extractParts,
+  HttpBodyRejected,
   type ContextInference,
   type InputParts,
+  type ParseBodyOptions,
 } from "./http-parse.ts";
 
 /** Result of parse + validate for one request. */
@@ -34,9 +36,30 @@ export type CompiledParseValidate = (
 export function createInterpretedParseValidate(
   inference: ContextInference,
   schema: SchemaInput | undefined,
+  body?: ParseBodyOptions,
 ): CompiledParseValidate {
   return async (request, params) => {
-    const parts: InputParts = await extractParts(request, params, inference);
+    let parts: InputParts;
+    try {
+      parts = await extractParts(request, params, inference, { body });
+    } catch (err) {
+      if (!(err instanceof HttpBodyRejected)) throw err;
+      if (err.code === "InvalidQuery") {
+        return {
+          ok: false,
+          failure: fail("InvalidQuery", { reason: err.reason ?? "malformed_body" }),
+        };
+      }
+      if (err.code === "UnsupportedMediaType") {
+        return {
+          ok: false,
+          failure: fail("UnsupportedMediaType", {
+            contentType: request.headers.get("content-type") ?? "",
+          }),
+        };
+      }
+      return { ok: false, failure: fail("PayloadTooLarge", {}) };
+    }
     const raw = assembleInput(parts);
     const result = await validate(schema, raw);
     if (!result.ok) return { ok: false, failure: result.failure };