# Extension points — koajs/koa

> Canonical page: https://codevetter.com/unpack/koa/extension-points

# Extension points — koajs/koa

Scanned commit 824c1cf8de9a91a2941973b25dc8a3d3029b9e4f (2026-09-18). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Middleware registration is the principal extension mechanism, supported by configurable composition and application-specific prototypes. Transport integration and error instrumentation are explicit API boundaries. Consumer services and parsers plug into those boundaries rather than a central route or provider registry.
- app.use(fn) is the ordered extension registry: it validates a function, appends it to middleware, and returns the application for chaining. — [lib/application.js#L167-171](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L167-L171)
- options.compose replaces koa-compose and receives the middleware array when callback() is created; handleRequest expects the resulting middleware invocation to return a promise. — [lib/application.js#L95-97](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L95-L97) [lib/application.js#L182-183](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L182-L183) [lib/application.js#L213-219](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L213-L219) [__tests__/application/compose.test.js#L34-47](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/application/compose.test.js#L34-L47)
- app.context supports application-wide helpers such as a database reference, while createContext() supplies per-request objects inheriting that prototype. — [docs/api/index.md#L195-210](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/api/index.md#L195-L210) [lib/application.js#L228-234](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L228-L234)
- app.request and app.response are application-specific prototypes; new shortcut APIs must also account for the explicit delegates table on the context prototype. — [lib/application.js#L98-100](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L98-L100) [lib/application.js#L230-234](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L230-L234) [lib/context.js#L195-248](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/context.js#L195-L248)
- callback() is the transport adapter for consumer-created HTTP/HTTPS servers and documented Connect/Express mounting. — [lib/application.js#L182-198](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L182-L198) [docs/api/index.md#L135-152](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/api/index.md#L135-L152)
- Custom error behavior can use upstream try/catch middleware or app.on('error'); a caught error that is not rethrown does not reach the default error event path. — [docs/error-handling.md#L35-60](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/error-handling.md#L35-L60) [lib/application.js#L185-185](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L185-L185) [lib/context.js#L125-126](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/context.js#L125-L126)
- Consumers can supply their own AsyncLocalStorage instance or replace ctx.cookies; the source and tests expose both customization seams. — [lib/application.js#L59-64](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/application.js#L59-L64) [__tests__/application/currentContext.test.js#L105-115](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/application/currentContext.test.js#L105-L115) [lib/context.js#L174-175](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/lib/context.js#L174-L175) [__tests__/context/cookies.test.js#L91-108](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/__tests__/context/cookies.test.js#L91-L108)
- The middleware guide recommends option-taking factories and named middleware; independent middleware groups can be combined with koa-compose, and handlers can terminate downstream dispatch by omitting next(). — [docs/guide.md#L64-106](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/guide.md#L64-L106) [docs/guide.md#L108-110](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/guide.md#L108-L110) [docs/guide.md#L143-145](https://github.com/koajs/koa/blob/824c1cf8de9a91a2941973b25dc8a3d3029b9e4f/docs/guide.md#L143-L145)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)