@warlock.js/core 4.16.0 → 5.0.1

package/esm/http/request.d.mts

@@ -1,6 +1,6 @@
 import { UploadedFile } from "./uploaded-file.mjs";
 import { Response } from "./response.mjs";
-import { RequestEvent } from "./types.mjs";
+import { RequestEvent, RequestLocals, RequestUser } from "./types.mjs";
 import { Middleware, RequestHandler, Route } from "../router/types.mjs";
 import { BaseValidator } from "@warlock.js/seal";
 import { trans } from "@mongez/localization";
@@ -44,6 +44,86 @@ declare class Request<RequestValidation = any> {
    * Decoded access token payload (set by auth middleware)
    */
   decodedAccessToken?: any;
+  /**
+   * The authenticated user attached to this request, if any.
+   *
+   * `RequestUser` is empty by default, so ANY shape is assignable here at the
+   * declaration site — the app or auth package declares its real fields via
+   * module augmentation:
+   *
+   * ```typescript
+   * declare module "@warlock.js/core" {
+   *   interface RequestUser {
+   *     id: string | number;
+   *   }
+   * }
+   * ```
+   *
+   * Replaces the v4 `GuardedRequest` convention
+   * (`create-warlock/.../guarded.request.ts` — `Request<T> & { user: User }`,
+   * an intersection type hand-declared per app) with a property core itself
+   * declares and types. `clearCurrentUser()` below is the one place core
+   * writes it directly; auth middleware is expected to do the same after a
+   * successful token resolution.
+   */
+  user?: RequestUser;
+  /**
+   * Private, server-only, per-request data bag.
+   *
+   * Distinct from the input payload (`body` / `query` / `params` / `all()`):
+   * a write here never surfaces in `request.all()`, `request.validated()`, or
+   * `request.input()`. That is the trap `request.set()` sets for private data
+   * — it writes into the payload `all` bag, so anything stored there leaks
+   * into every input accessor and, from there, into the client-facing
+   * payload. `locals` is the correct home for private per-request app data
+   * (a resolved session, a fetched-once model) that must never be mistaken
+   * for client input.
+   *
+   * Augmentable via module augmentation, in the module that OWNS the key:
+   *
+   * ```typescript
+   * declare module "@warlock.js/core" {
+   *   interface RequestLocals {
+   *     session?: { token: string };
+   *   }
+   * }
+   * ```
+   *
+   * A plain class-field initializer is sufficient for "fresh per request":
+   * `router.ts:925` constructs `new Request()` for every incoming request —
+   * `Request` instances are not pooled or reused across requests — so this
+   * initializer runs exactly once per request and no value can leak in from
+   * a prior one.
+   */
+  locals: RequestLocals;
+  /**
+   * Backing field for the lazily-generated CSP nonce. Left `undefined` until
+   * the first `request.nonce` read; see the `nonce` getter below.
+   */
+  protected _nonce?: string;
+  /**
+   * Per-request Content-Security-Policy nonce — a fresh, unguessable value
+   * the web layer hands to `<Scripts nonce={...} />` (the inline payload
+   * script) and to the `Content-Security-Policy` header, so a strict
+   * `script-src 'nonce-...'` allows only the script this request actually
+   * rendered.
+   *
+   * Generated LAZILY on first access, not eagerly in `setRequest()`: most
+   * requests (API routes, anything that isn't rendering HTML) never read it,
+   * and spending a `randomBytes` call on every single request for a value
+   * most of them discard is wasted entropy draw + CPU. Once generated it is
+   * cached in `_nonce`, so every subsequent read within the SAME request
+   * returns the identical value — required, since the header and the inline
+   * `<script>` tag must agree on one nonce. `_nonce` is a plain field on a
+   * per-request `Request` instance (see `locals` above — `router.ts:925`,
+   * no pooling), so the cache can never leak into the next request; a fresh
+   * `Request` means a fresh, unset `_nonce`.
+   *
+   * 16 random bytes, base64-encoded — the size the CSP Level 3 spec's own
+   * examples use, and far more entropy than an attacker could feasibly guess
+   * to defeat the policy.
+   */
+  get nonce(): string;
   /**
    * Current request instance
    */
@@ -57,23 +137,6 @@ declare class Request<RequestValidation = any> {
    * Alias to trans method
    */
   t: ReturnType<typeof trans>;
-  /**
-   * Dynamic properties index signature
-   *
-   * This allows attaching custom properties to the request instance,
-   * commonly used during validation middleware to attach fetched models.
-   *
-   * @example
-   * // In validation middleware:
-   * const post = await Post.find(request.int("id"));
-   * if (!post) return response.notFound();
-   * request.post = post; // Attach the model to the request
-   *
-   * // In route handler:
-   * const post = request.post;
-   * // Work with the pre-fetched model
-   */
-  [key: string]: any;
   /**
    * Locale code
    */
@@ -118,6 +181,20 @@ declare class Request<RequestValidation = any> {
    * Translate from the given locale code
    */
   transFrom(localeCode: string, keyword: string, placeholders?: any): any;
+  /**
+   * Cache one supported locale without coercing request-controlled input.
+   *
+   * The default is the answer for a client that asked for NOTHING. A client
+   * that did ask is only overridden when its value fails a declared
+   * `app.localeCodes` allow-list; with no list declared there is nothing to
+   * fail, so the requested locale passes through unchanged.
+   */
+  protected cacheLocale(candidate: unknown): string;
+  /**
+   * Resolve the first present Mode B source. Unsupported values fail closed to
+   * the configured default instead of widening the application's locale set.
+   */
+  protected resolveLocale(): string;
   /**
    * Get current locale code
    */
@@ -126,18 +203,16 @@ declare class Request<RequestValidation = any> {
    * Set locale code
    */
   set locale(localeCode: string);
-  /**
-   * Get locale code that will be used for translation
-   */
-  get localized(): any;
   /**
    * Set locale code
    */
   setLocaleCode(localeCode: string): this;
   /**
-   * Get current locale code or return default locale code
+   * @deprecated Use `request.locale`. This alias is removed after one version.
+   * The legacy default argument is accepted for source compatibility but the
+   * resolved default is owned exclusively by app configuration.
    */
-  getLocaleCode(defaultLocaleCode?: string): string;
+  getLocaleCode(_legacyDefaultLocaleCode?: string): string;
   /**
    * Get http protocol
    */
@@ -145,11 +220,7 @@ declare class Request<RequestValidation = any> {
   /**
    * Validate the given validation schema
    */
-  validate(validation: BaseValidator, selectedInputs?: string[]): Promise<any>;
-  /**
-   * Clear current user
-   */
-  clearCurrentUser(): void;
+  validate(validation: BaseValidator, selectedInputs?: string[]): Promise<import("@warlock.js/seal").ValidationResult>;
   /**
    * Get value of the given header
    */
@@ -203,6 +274,24 @@ declare class Request<RequestValidation = any> {
   /**
    * Parse the payload and merge it from the request body, params and query string
    */
+  /**
+   * Turn a bracket-notation key into the dotted path `set()` expects.
+   *
+   * `a[b][c]` -> `a.b.c`. Used only for NON-numeric nesting; numeric indices
+   * keep the array-of-objects path in {@link parseBody}, which builds real
+   * arrays rather than objects with numeric keys.
+   */
+  protected bracketKeyToPath(key: string): string;
+  /**
+   * Apply the `key[]` array marker to a parsed value.
+   *
+   * The subtlety this exists to remove: a key declared `[]` should ALWAYS be an
+   * array, but the underlying query/body parser only hands us one when the
+   * caller sent the key more than once. Deciding the TYPE from the number of
+   * occurrences means one selected filter is a string and two are an array —
+   * a shape that changes under the user's hands.
+   */
+  protected arrayValueFor(value: any, isArrayKey: boolean, parse: (value: any) => any): any;
   protected parsePayload(): void;
   /**
    * Parse body payload
@@ -223,7 +312,7 @@ declare class Request<RequestValidation = any> {
   /**
    * Listen to the given event
    */
-  on(eventName: RequestEvent, callback: any): any;
+  on(eventName: RequestEvent, callback: any): import("@mongez/events").EventSubscription;
   /**
    * Make a log message
    */

package/esm/http/request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAkBK,eAAA,iBAGS,mBAAA,mBAAsC,CAAA,0BAE/B,CAAA,WAEb,CAAA,GAAI,mBAAA,CAAoB,CAAA;AAAA,KAG3B,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBU;AAAA;AAAA;EA0BxB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAgBqB;;;EAAA,OAXd,OAAA,EAAS,OAAA;EA6KW;;;;EAvK3B,KAAA,EAAO,UAAA,QAAkB,KAAA;EA+LV;;;EA1Lf,CAAA,EAAG,UAAA,QAAkB,KAAA;EAicI;;;;;;;;;;;;;;;;EAAA,CA/a/B,GAAA;EA2lB+B;;;EAAA,UAtlBtB,OAAA;EAy+BsB;;;EAAA,UAp+BtB,aAAA,GAAgB,iBAAA;EAhEL;;;EAqEd,EAAA;EA3DQ;;;EAgER,SAAA;EAjDgB;;;EAsDhB,OAAA;EA3CA;;;EAgDA,UAAA,CAAW,OAAA,EAAS,cAAA;EAzBjB;;;;;;;;;EAAA,UAgDA,gBAAA;EAwBO;;;;;EAAA,iBAAA,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAYG;;;EAA/C,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAuB3C;;;EAAA,IAhBA,MAAA;EAkCU;;;EAAA,IAzBV,MAAA,CAAO,UAAA;EAuCI;;;EAAA,IAhCX,SAAA;EA8CJ;;;EArCA,aAAA,CAAc,UAAA;EAsCG;;;EA7BjB,aAAA,CAAc,iBAAA;EAsCC;;;EAAA,IA/BX,QAAA;EAmDJ;;;EA5CM,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA;EAiE/D;;;EA1DJ,gBAAA;EA8GI;;;EAvGJ,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAkIkB;;;EAAA,IA1HT,OAAA,IAAW,MAAA;EA6OC;;;EAtOhB,MAAA,CAAO,IAAA,UAAc,YAAA;EAkPb;;;EArOR,SAAA,CAAU,IAAA;EA4OP;;;EAAA,IArOC,MAAA;EA4OqB;;;EAAA,IArOrB,QAAA;EAoQA;;;EAAA,IA7PA,MAAA;EAyQe;;;EAAA,IAlQf,YAAA;EAqSJ;;;EAAA,IAxRI,kBAAA;EAwRkC;;;;;EAAA,IAvQlC,WAAA;EA2RmB;;;EAAA,IA5QnB,aAAA;EAuRS;;;EAAA,IAhRT,MAAA;EAoSsB;;;EAAA,UA7RvB,YAAA;EAsVH;;;EAAA,UAvUG,SAAA,CAAU,IAAA;EA8UP;;;EAAA,UAjPH,UAAA,CAAW,IAAA;EAwPG;;;EAlOjB,QAAA,CAAS,KAAA,EAAO,KAAA;EAgPZ;;;EApOJ,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;EA6OZ;;;EAtOxB,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA;EAiQ5B;;;EA1PA,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;EAsRzB;;;EAAA,IArQI,IAAA;EA+QE;;;EAAA,IAxQF,GAAA;EAsRK;;;EAAA,IA/QL,OAAA;EA+RK;;;;;;;;EAnRH,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;EA0Vb;;;;;EA/TN,UAAA,IAAU,cAAA,CAAA,OAAA;EAsWV;;;;EA9VA,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;EAgX3E;;;EAnWP,eAAA,IAAmB,MAAA,aAAmB,iBAAA;EA4WnB;;;EArWnB,gBAAA,CAAiB,IAAA,EAAM,iBAAA;EA6XnB;;;;;;;EAlXE,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;EA2c0B;;;;;;EAAA,UAvb9B,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA2CvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAwBI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}
+{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAoBK,eAAA,iBAGS,mBAAA,mBAAsC,CAAA,0BAE/B,CAAA,WAEb,CAAA,GAAI,mBAAA,CAAoB,CAAA;AAAA,KAG3B,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBU;AAAA;AAAA;EA0BxB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAqGyB;;;;;;;;;;;;;;;;;;;;;;EA7EzB,IAAA,GAAO,WAAA;EA4rB2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA9pBlF,MAAA,EAAQ,aAAA;EA8BJ;;;;EAAA,UAxBD,MAAA;EAyCsB;;;;;;;;;;;;;;;;;;;;;;EAAA,IAjBrB,KAAA;EA6JD;;;EAAA,OAlJI,OAAA,EAAS,OAAA;EA+KhB;;;;EAzKA,KAAA,EAAO,UAAA,QAAkB,KAAA;EAkMnB;;;EA7LN,CAAA,EAAG,UAAA,QAAkB,KAAA;EA6L8C;;;EAAA,UA9KhE,OAAA;EAqLmC;;;EAAA,UAhLnC,aAAA,GAAgB,iBAAA;EAkLxB;;;EA7KK,EAAA;EA4LO;;;EAvLP,SAAA;EA2MI;;;EAtMJ,OAAA;EAwOI;;;EAnOJ,UAAA,CAAW,OAAA,EAAS,cAAA;EAwRjB;;;;;;;;;EAAA,UA7PA,gBAAA;EAyaA;;;;;EAAA,iBAjZO,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAmbzB;;;EAvanB,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EA8ajC;;;;;;;;EAAA,UAlaX,WAAA,CAAY,SAAA;EAicX;;;;EAAA,UA7aD,aAAA;EAgcgB;;;EAAA,IAnbf,MAAA;EAsdJ;;;EAAA,IA7cI,MAAA,CAAO,UAAA;EA6c2B;;;EAtctC,aAAA,CAAc,UAAA;EAmdwB;;;;;EAxctC,aAAA,CAAc,wBAAA;EA0dD;;;EAAA,IAndT,QAAA;EAuesB;;;EAhepB,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EAyhBnE;;;EAlhBA,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAuhBW;;;EAAA,IA/gBF,OAAA,IAAW,MAAA;EAshBE;;;EA/gBjB,MAAA,CAAO,IAAA,UAAc,YAAA;EA6hBjB;;;EAhhBJ,SAAA,CAAU,IAAA;EAyhBc;;;EAAA,IAlhBpB,MAAA;EA6iBJ;;;EAAA,IAtiBI,QAAA;EAkkBJ;;;EAAA,IA3jBI,MAAA;EAqkBE;;;EAAA,IA9jBF,YAAA;EA4kBK;;;EAAA,IA/jBL,kBAAA;EA+kBK;;;;;EAAA,IA9jBL,WAAA;EA8nBJ;;;EAAA,IA/mBI,aAAA;EAioBJ;;;EAAA,IA1nBI,MAAA;EAioBc;;;EAqBD;;;;;;;EAAA,UAxoBd,gBAAA,CAAiB,GAAA;EA4qBpB;;;;;;;;;EAAA,UA5pBG,aAAA,CAAc,KAAA,OAAY,UAAA,WAAqB,KAAA,GAAQ,KAAA;EAAA,UAMvD,YAAA;EA8vBoC;;;EAAA,UA/uBpC,SAAA,CAAU,IAAA;EAsvBc;;AAAa;EAAb,UA/mBxB,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAiBrB,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;EA2BnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;;;;EAalF,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA2CvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAwBI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}

package/esm/http/request.mjs

@@ -1,4 +1,5 @@
 import { config } from "../config/config-getter.mjs";
+import { resolveLocaleConfiguration } from "../config/locale-configuration.mjs";
 import { createRequestStore } from "./middleware/inject-request-context.mjs";
 import { validateAll } from "../validation/validateAll.mjs";
 import { Response } from "./response.mjs";
@@ -10,11 +11,13 @@ import { isEmpty } from "@mongez/supportive-is";
 import { Random, except, get, only, rtrim, set, unset } from "@mongez/reinforcements";
 import { colors } from "@mongez/copper";
 import events from "@mongez/events";
+import { randomBytes } from "node:crypto";
 
 //#region ../core/src/http/request.ts
 var Request = class Request {
 	constructor() {
 		this.payload = {};
+		this.locals = {};
 		this.trans = trans;
 		this.t = trans;
 		this._locale = "";
@@ -22,14 +25,39 @@ var Request = class Request {
 		this.startTime = Date.now();
 	}
 	/**
+	* Per-request Content-Security-Policy nonce — a fresh, unguessable value
+	* the web layer hands to `<Scripts nonce={...} />` (the inline payload
+	* script) and to the `Content-Security-Policy` header, so a strict
+	* `script-src 'nonce-...'` allows only the script this request actually
+	* rendered.
+	*
+	* Generated LAZILY on first access, not eagerly in `setRequest()`: most
+	* requests (API routes, anything that isn't rendering HTML) never read it,
+	* and spending a `randomBytes` call on every single request for a value
+	* most of them discard is wasted entropy draw + CPU. Once generated it is
+	* cached in `_nonce`, so every subsequent read within the SAME request
+	* returns the identical value — required, since the header and the inline
+	* `<script>` tag must agree on one nonce. `_nonce` is a plain field on a
+	* per-request `Request` instance (see `locals` above — `router.ts:925`,
+	* no pooling), so the cache can never leak into the next request; a fresh
+	* `Request` means a fresh, unset `_nonce`.
+	*
+	* 16 random bytes, base64-encoded — the size the CSP Level 3 spec's own
+	* examples use, and far more entropy than an attacker could feasibly guess
+	* to defeat the policy.
+	*/
+	get nonce() {
+		if (!this._nonce) this._nonce = randomBytes(16).toString("base64");
+		return this._nonce;
+	}
+	/**
 	* Set request handler
 	*/
 	setRequest(request) {
 		this.baseRequest = request;
 		this.resolveRequestId();
 		this.parsePayload();
-		const localeCode = this.getLocaleCode();
-		this.trans = this.t = transFrom.bind(null, localeCode);
+		this.trans = this.t = (keyword, placeholders) => transFrom(this.getLocaleCode(), keyword, placeholders);
 		return this;
 	}
 	/**
@@ -67,37 +95,58 @@ var Request = class Request {
 		return transFrom(localeCode, keyword, placeholders);
 	}
 	/**
+	* Cache one supported locale without coercing request-controlled input.
+	*
+	* The default is the answer for a client that asked for NOTHING. A client
+	* that did ask is only overridden when its value fails a declared
+	* `app.localeCodes` allow-list; with no list declared there is nothing to
+	* fail, so the requested locale passes through unchanged.
+	*/
+	cacheLocale(candidate) {
+		const { defaultLocaleCode, localeCodes } = resolveLocaleConfiguration(config.key("app.localeCode"), config.key("app.localeCodes"));
+		const requested = typeof candidate === "string" && candidate.length > 0 ? candidate : void 0;
+		this._locale = requested !== void 0 && (localeCodes === void 0 || localeCodes.includes(requested)) ? requested : defaultLocaleCode;
+		return this._locale;
+	}
+	/**
+	* Resolve the first present Mode B source. Unsupported values fail closed to
+	* the configured default instead of widening the application's locale set.
+	*/
+	resolveLocale() {
+		const candidate = [
+			this.query["locale"],
+			this.cookies["locale"],
+			this.header("locale")
+		].find((value) => typeof value === "string" && value.length > 0);
+		return this.cacheLocale(candidate);
+	}
+	/**
 	* Get current locale code
 	*/
 	get locale() {
 		if (this._locale) return this._locale;
-		return this.header("translation-locale-code") || this.localized;
+		return this.resolveLocale();
 	}
 	/**
 	* Set locale code
 	*/
 	set locale(localeCode) {
-		this._locale = localeCode;
-	}
-	/**
-	* Get locale code that will be used for translation
-	*/
-	get localized() {
-		if (this._locale) return this._locale;
-		return this._locale = this.header("locale") || this.query["locale"];
+		this.cacheLocale(localeCode);
 	}
 	/**
 	* Set locale code
 	*/
 	setLocaleCode(localeCode) {
-		this._locale = localeCode;
+		this.locale = localeCode;
 		return this;
 	}
 	/**
-	* Get current locale code or return default locale code
+	* @deprecated Use `request.locale`. This alias is removed after one version.
+	* The legacy default argument is accepted for source compatibility but the
+	* resolved default is owned exclusively by app configuration.
 	*/
-	getLocaleCode(defaultLocaleCode = config.key("app.localeCode") || "en") {
-		return this.locale || defaultLocaleCode;
+	getLocaleCode(_legacyDefaultLocaleCode) {
+		return this.locale;
 	}
 	/**
 	* Get http protocol
@@ -112,12 +161,6 @@ var Request = class Request {
 		return await v.validate(validation, selectedInputs ? this.only(selectedInputs) : this.all());
 	}
 	/**
-	* Clear current user
-	*/
-	clearCurrentUser() {
-		this.user = void 0;
-	}
-	/**
 	* Get value of the given header
 	*/
 	header(name, defaultValue = null) {
@@ -209,6 +252,29 @@ var Request = class Request {
 	/**
 	* Parse the payload and merge it from the request body, params and query string
 	*/
+	/**
+	* Turn a bracket-notation key into the dotted path `set()` expects.
+	*
+	* `a[b][c]` -> `a.b.c`. Used only for NON-numeric nesting; numeric indices
+	* keep the array-of-objects path in {@link parseBody}, which builds real
+	* arrays rather than objects with numeric keys.
+	*/
+	bracketKeyToPath(key) {
+		return key.replace(/\]\[/g, ".").replace(/\[/g, ".").replace(/\]/g, "");
+	}
+	/**
+	* Apply the `key[]` array marker to a parsed value.
+	*
+	* The subtlety this exists to remove: a key declared `[]` should ALWAYS be an
+	* array, but the underlying query/body parser only hands us one when the
+	* caller sent the key more than once. Deciding the TYPE from the number of
+	* occurrences means one selected filter is a string and two are an array —
+	* a shape that changes under the user's hands.
+	*/
+	arrayValueFor(value, isArrayKey, parse) {
+		if (Array.isArray(value)) return value.map(parse);
+		return isArrayKey ? [parse(value)] : parse(value);
+	}
 	parsePayload() {
 		this.payload.body = this.parseBody(this.baseRequest.body);
 		this.payload.query = this.parseBody(this.baseRequest.query);
@@ -236,9 +302,13 @@ var Request = class Request {
 					if (key.includes("][")) {
 						const keyParts = key.split("[");
 						const keyName = keyParts[0];
-						if (!arrayOfObjectValues[keyName]) arrayOfObjectValues[keyName] = [];
 						const keyNameParts = keyParts[1].split("]");
 						const index = Number(keyNameParts[0]);
+						if (Number.isNaN(index)) {
+							set(body, this.bracketKeyToPath(key), this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)));
+							continue;
+						}
+						if (!arrayOfObjectValues[keyName]) arrayOfObjectValues[keyName] = [];
 						if (!arrayOfObjectValues[keyName][index]) arrayOfObjectValues[keyName][index] = {};
 						const keyName2 = keyParts[2].split("]")[0];
 						arrayOfObjectValues[keyName][index][keyName2] = this.parseValue(value);
@@ -247,7 +317,7 @@ var Request = class Request {
 					const keyParts = key.split("[");
 					const keyName = keyParts[0];
 					const keyNameParts = keyParts[1].split("]");
-					set(body, keyName + "." + keyNameParts[0], Array.isArray(value) ? value.map(this.parseValue.bind(this)) : this.parseValue(value));
+					set(body, keyName + "." + keyNameParts[0], this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)));
 					continue;
 				}
 				if (Array.isArray(value)) set(body, key, value.map(this.parseValue.bind(this)));
@@ -295,7 +365,7 @@ var Request = class Request {
 	* Listen to the given event
 	*/
 	on(eventName, callback) {
-		return this.subscribe(eventName, callback);
+		return events.subscribe(`request.${eventName}`, callback);
 	}
 	/**
 	* Make a log message
@@ -403,7 +473,10 @@ var Request = class Request {
 		this.trigger("executingMiddleware", middlewares, this.route);
 		for (const middleware of middlewares) {
 			this.log("Executing middleware " + colors.yellowBright(middleware.name));
-			const output = await middleware(this, this.response);
+			const output = await middleware({
+				request: this,
+				response: this.response
+			});
 			this.log("Executed middleware " + colors.yellowBright(middleware.name), "success");
 			if (output !== void 0) {
 				this.log(colors.yellow("request intercepted by middleware ") + colors.cyanBright(middleware.name), "warn");