@warlock.js/core 4.3.0 → 4.5.0

package/esm/http/middleware/maintenance.middleware.mjs

@@ -1,6 +1,6 @@
 import { t } from "./inject-request-context.mjs";
 import { HttpErrorCodes } from "../error-codes.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 
 //#region ../@warlock.js/core/src/http/middleware/maintenance.middleware.ts
 function isAllowlisted(path, patterns) {
@@ -31,10 +31,11 @@ function isAllowlisted(path, patterns) {
 */
 function maintenanceMiddleware(options = {}) {
 	return (request, response) => {
-		if (!config.get("http.maintenance.enabled", false)) return;
-		const allowlist = options.allowlist || config.get("http.maintenance.allowlist", ["/health"]);
-		if (isAllowlisted(request.path, allowlist)) return;
-		const retryAfter = options.retryAfter || config.get("http.maintenance.retryAfter", 60);
+		if (!baseConfig.get("http.maintenance.enabled", false)) return;
+		const allowlist = options.allowlist || baseConfig.get("http.maintenance.allowlist", ["/health"]);
+		const pathname = request.path.split("?")[0];
+		if (isAllowlisted(pathname, allowlist)) return;
+		const retryAfter = options.retryAfter || baseConfig.get("http.maintenance.retryAfter", 60);
 		response.header("Retry-After", retryAfter);
 		return response.serviceUnavailable({
 			error: options.errorMessage || t("http.maintenance"),

package/esm/http/middleware/maintenance.middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"maintenance.middleware.mjs","names":[],"sources":["../../../../../../../../@warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return (request, response) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    if (isAllowlisted(request.path, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,SAAS,aAAa;EAG5B,IAAI,CAFY,OAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAa,OAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAE3E,IAAI,cAAc,QAAQ,MAAM,SAAS,GAAG;EAE5C,MAAM,aACJ,QAAQ,cAAc,OAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"maintenance.middleware.mjs","names":["config"],"sources":["../../../../../../../../@warlock.js/core/src/http/middleware/maintenance.middleware.ts"],"sourcesContent":["import config from \"@mongez/config\";\nimport type { Middleware } from \"../../router\";\nimport { HttpErrorCodes } from \"../error-codes\";\nimport { t } from \"./inject-request-context\";\n\n/**\n * Options for the maintenance middleware.\n */\nexport type MaintenanceOptions = {\n  /**\n   * Path prefixes (ending in `*`) or exact paths to bypass even when\n   * maintenance is on. Falls back to `http.maintenance.allowlist`, then\n   * `[\"/health\"]`.\n   *\n   * @example\n   * allowlist: [\"/health\", \"/admin/*\", \"/webhooks/stripe\"]\n   */\n  allowlist?: string[];\n  /**\n   * Seconds advertised in the `Retry-After` header. Falls back to\n   * `http.maintenance.retryAfter`, then `60`.\n   */\n  retryAfter?: number;\n  /**\n   * Override the default error message.\n   */\n  errorMessage?: string;\n};\n\nfunction isAllowlisted(path: string, patterns: string[]) {\n  return patterns.some((pattern) => {\n    if (pattern.endsWith(\"*\")) {\n      return path.startsWith(pattern.slice(0, -1));\n    }\n\n    return path === pattern;\n  });\n}\n\n/**\n * Return 503 + `Retry-After` for every request when `http.maintenance.enabled`\n * is true, except for paths matching the allowlist.\n *\n * Designed for app-wide registration via `http.middleware.all`. Toggled via\n * config — flipping the flag requires a restart (no runtime hot-flip yet).\n * Allowlist defaults to `[\"/health\"]` so health checks still pass during\n * planned downtime.\n *\n * @example\n * // src/config/http.ts\n * import { middleware } from \"@warlock.js/core\";\n *\n * export default {\n *   maintenance: { enabled: env(\"MAINTENANCE_MODE\") === \"true\" },\n *   middleware: {\n *     all: [middleware.maintenance({ allowlist: [\"/health\", \"/admin/*\"] })],\n *   },\n * };\n */\nexport function maintenanceMiddleware(options: MaintenanceOptions = {}): Middleware {\n  return (request, response) => {\n    const enabled = config.get(\"http.maintenance.enabled\", false);\n\n    if (!enabled) return;\n\n    const allowlist =\n      options.allowlist || config.get(\"http.maintenance.allowlist\", [\"/health\"]);\n\n    // `request.path` includes the query string, but allowlist entries are\n    // path-only (\"/webhooks/stripe\"), so strip the query before matching —\n    // otherwise \"/webhooks/stripe?sig=...\" never matches its exact entry.\n    const pathname = request.path.split(\"?\")[0];\n\n    if (isAllowlisted(pathname, allowlist)) return;\n\n    const retryAfter =\n      options.retryAfter || config.get(\"http.maintenance.retryAfter\", 60);\n\n    response.header(\"Retry-After\", retryAfter);\n\n    return response.serviceUnavailable({\n      error: options.errorMessage || t(\"http.maintenance\"),\n      errorCode: HttpErrorCodes.Maintenance,\n    });\n  };\n}\n"],"mappings":";;;;;AA6BA,SAAS,cAAc,MAAc,UAAoB;CACvD,OAAO,SAAS,MAAM,YAAY;EAChC,IAAI,QAAQ,SAAS,GAAG,GACtB,OAAO,KAAK,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC;EAG7C,OAAO,SAAS;CAClB,CAAC;AACH;;;;;;;;;;;;;;;;;;;;;AAsBA,SAAgB,sBAAsB,UAA8B,CAAC,GAAe;CAClF,QAAQ,SAAS,aAAa;EAG5B,IAAI,CAFYA,WAAO,IAAI,4BAA4B,KAE5C,GAAG;EAEd,MAAM,YACJ,QAAQ,aAAaA,WAAO,IAAI,8BAA8B,CAAC,SAAS,CAAC;EAK3E,MAAM,WAAW,QAAQ,KAAK,MAAM,GAAG,CAAC,CAAC;EAEzC,IAAI,cAAc,UAAU,SAAS,GAAG;EAExC,MAAM,aACJ,QAAQ,cAAcA,WAAO,IAAI,+BAA+B,EAAE;EAEpE,SAAS,OAAO,eAAe,UAAU;EAEzC,OAAO,SAAS,mBAAmB;GACjC,OAAO,QAAQ,gBAAgB,EAAE,kBAAkB;GACnD;EACF,CAAC;CACH;AACF"}

package/esm/http/plugins.mjs

@@ -1,6 +1,6 @@
 import { rootPath } from "../utils/paths.mjs";
 import "../utils/index.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import fastifyMultipart from "@fastify/multipart";
 
 //#region ../@warlock.js/core/src/http/plugins.ts
@@ -10,25 +10,25 @@ const defaultCorsOptions = {
 };
 async function registerHttpPlugins(server) {
 	server.register(import("@fastify/rate-limit"), {
-		max: config.get("http.rateLimit.max", 60),
-		timeWindow: config.get("http.rateLimit.duration", 60 * 1e3)
+		max: baseConfig.get("http.rateLimit.max", 60),
+		timeWindow: baseConfig.get("http.rateLimit.duration", 60 * 1e3)
 	});
 	const corsOptions = {
-		...config.get("http.cors", {}),
+		...baseConfig.get("http.cors", {}),
 		...defaultCorsOptions
 	};
 	server.register(import("@fastify/cors"), corsOptions);
 	server.register(fastifyMultipart, {
 		attachFieldsToBody: true,
-		limits: { fileSize: config.get("http.fileUploadLimit", 10 * 1024 * 1024) }
+		limits: { fileSize: baseConfig.get("http.fileUploadLimit", 10 * 1024 * 1024) }
 	});
 	server.register(import("@fastify/static"), {
-		root: config.get("storage.publicRoot", rootPath("public")),
-		prefix: config.get("storage.publicPrefix", "/public/")
+		root: baseConfig.get("storage.publicRoot", rootPath("public")),
+		prefix: baseConfig.get("storage.publicPrefix", "/public/")
 	});
 	server.register(import("@fastify/cookie"), {
-		secret: config.get("http.cookies.secret"),
-		parseOptions: config.get("http.cookies.options", {})
+		secret: baseConfig.get("http.cookies.secret"),
+		parseOptions: baseConfig.get("http.cookies.options", {})
 	});
 }
 

package/esm/http/plugins.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugins.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/plugins.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport fastifyMultipart from \"@fastify/multipart\";\nimport config from \"@mongez/config\";\nimport { rootPath } from \"../utils\";\nimport type { FastifyInstance } from \"./server\";\n\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\nexport async function registerHttpPlugins(server: FastifyInstance) {\n  // 👇🏻 register rate-limit plugin\n  server.register(import(\"@fastify/rate-limit\"), {\n    // max requests per time window\n    max: config.get(\"http.rateLimit.max\", 60),\n    // maximum time that is will allow max requests\n    timeWindow: config.get(\"http.rateLimit.duration\", 60 * 1000),\n  });\n\n  // 👇🏻 register cors plugin\n  const corsOptions: FastifyCorsOptions | undefined = {\n    ...config.get(\"http.cors\", {}),\n    ...defaultCorsOptions,\n  };\n\n  server.register(import(\"@fastify/cors\"), corsOptions);\n\n  // 👇🏻 import multipart plugin\n  server.register(fastifyMultipart, {\n    attachFieldsToBody: true,\n    limits: {\n      // file size could be up to 10MB\n      fileSize: config.get(\"http.fileUploadLimit\", 10 * 1024 * 1024),\n    },\n  });\n\n  server.register(import(\"@fastify/static\"), {\n    root: config.get(\"storage.publicRoot\", rootPath(\"public\")),\n    prefix: config.get(\"storage.publicPrefix\", \"/public/\"),\n  });\n\n  // 👇🏻 register cookie plugin\n  server.register(import(\"@fastify/cookie\"), {\n    secret: config.get(\"http.cookies.secret\"), // Optional: allow signed cookies\n    parseOptions: config.get(\"http.cookies.options\", {}),\n  });\n}\n"],"mappings":";;;;;;AAMA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;AAEA,eAAsB,oBAAoB,QAAyB;CAEjE,OAAO,SAAS,OAAO,wBAAwB;EAE7C,KAAK,OAAO,IAAI,sBAAsB,EAAE;EAExC,YAAY,OAAO,IAAI,2BAA2B,KAAK,GAAI;CAC7D,CAAC;CAGD,MAAM,cAA8C;EAClD,GAAG,OAAO,IAAI,aAAa,CAAC,CAAC;EAC7B,GAAG;CACL;CAEA,OAAO,SAAS,OAAO,kBAAkB,WAAW;CAGpD,OAAO,SAAS,kBAAkB;EAChC,oBAAoB;EACpB,QAAQ,EAEN,UAAU,OAAO,IAAI,wBAAwB,KAAK,OAAO,IAAI,EAC/D;CACF,CAAC;CAED,OAAO,SAAS,OAAO,oBAAoB;EACzC,MAAM,OAAO,IAAI,sBAAsB,SAAS,QAAQ,CAAC;EACzD,QAAQ,OAAO,IAAI,wBAAwB,UAAU;CACvD,CAAC;CAGD,OAAO,SAAS,OAAO,oBAAoB;EACzC,QAAQ,OAAO,IAAI,qBAAqB;EACxC,cAAc,OAAO,IAAI,wBAAwB,CAAC,CAAC;CACrD,CAAC;AACH"}
+{"version":3,"file":"plugins.mjs","names":["config"],"sources":["../../../../../../../@warlock.js/core/src/http/plugins.ts"],"sourcesContent":["import type { FastifyCorsOptions } from \"@fastify/cors\";\nimport fastifyMultipart from \"@fastify/multipart\";\nimport config from \"@mongez/config\";\nimport { rootPath } from \"../utils\";\nimport type { FastifyInstance } from \"./server\";\n\nconst defaultCorsOptions: FastifyCorsOptions = {\n  origin: \"*\",\n  methods: \"*\",\n};\n\nexport async function registerHttpPlugins(server: FastifyInstance) {\n  // 👇🏻 register rate-limit plugin\n  server.register(import(\"@fastify/rate-limit\"), {\n    // max requests per time window\n    max: config.get(\"http.rateLimit.max\", 60),\n    // maximum time that is will allow max requests\n    timeWindow: config.get(\"http.rateLimit.duration\", 60 * 1000),\n  });\n\n  // 👇🏻 register cors plugin\n  const corsOptions: FastifyCorsOptions | undefined = {\n    ...config.get(\"http.cors\", {}),\n    ...defaultCorsOptions,\n  };\n\n  server.register(import(\"@fastify/cors\"), corsOptions);\n\n  // 👇🏻 import multipart plugin\n  server.register(fastifyMultipart, {\n    attachFieldsToBody: true,\n    limits: {\n      // file size could be up to 10MB\n      fileSize: config.get(\"http.fileUploadLimit\", 10 * 1024 * 1024),\n    },\n  });\n\n  server.register(import(\"@fastify/static\"), {\n    root: config.get(\"storage.publicRoot\", rootPath(\"public\")),\n    prefix: config.get(\"storage.publicPrefix\", \"/public/\"),\n  });\n\n  // 👇🏻 register cookie plugin\n  server.register(import(\"@fastify/cookie\"), {\n    secret: config.get(\"http.cookies.secret\"), // Optional: allow signed cookies\n    parseOptions: config.get(\"http.cookies.options\", {}),\n  });\n}\n"],"mappings":";;;;;;AAMA,MAAM,qBAAyC;CAC7C,QAAQ;CACR,SAAS;AACX;AAEA,eAAsB,oBAAoB,QAAyB;CAEjE,OAAO,SAAS,OAAO,wBAAwB;EAE7C,KAAKA,WAAO,IAAI,sBAAsB,EAAE;EAExC,YAAYA,WAAO,IAAI,2BAA2B,KAAK,GAAI;CAC7D,CAAC;CAGD,MAAM,cAA8C;EAClD,GAAGA,WAAO,IAAI,aAAa,CAAC,CAAC;EAC7B,GAAG;CACL;CAEA,OAAO,SAAS,OAAO,kBAAkB,WAAW;CAGpD,OAAO,SAAS,kBAAkB;EAChC,oBAAoB;EACpB,QAAQ,EAEN,UAAUA,WAAO,IAAI,wBAAwB,KAAK,OAAO,IAAI,EAC/D;CACF,CAAC;CAED,OAAO,SAAS,OAAO,oBAAoB;EACzC,MAAMA,WAAO,IAAI,sBAAsB,SAAS,QAAQ,CAAC;EACzD,QAAQA,WAAO,IAAI,wBAAwB,UAAU;CACvD,CAAC;CAGD,OAAO,SAAS,OAAO,oBAAoB;EACzC,QAAQA,WAAO,IAAI,qBAAqB;EACxC,cAAcA,WAAO,IAAI,wBAAwB,CAAC,CAAC;CACrD,CAAC;AACH"}

package/esm/http/request.d.mts

@@ -421,11 +421,18 @@ declare class Request<RequestValidation = any> {
    * Best-effort real client IP — checks `X-Real-IP` and `X-Forwarded-For`
    * headers first, falls back to `baseRequest.ip` when neither is present.
    *
+   * For a multi-hop `X-Forwarded-For` (`client, proxy1, proxy2`) only the
+   * FIRST entry is returned (the original client), comma-split and trimmed.
+   * Without this, downstream scoping (ip-filter, rate-limit, idempotency)
+   * would key off the whole header string and break behind chained proxies.
+   *
    * **Prefer this over `request.ip` for any caller behind a proxy** (load
    * balancer, CDN, reverse proxy, k8s ingress). Only trust the result as
    * far as you trust the upstream proxy chain — `X-Forwarded-For` is
-   * client-settable; verify the request came through your trusted edge
-   * before treating the value as authoritative.
+   * client-settable, so the leftmost entry is spoofable by the immediate
+   * client when the request did NOT pass through a trusted edge that
+   * appends/overwrites the header. Verify the request came through your
+   * trusted edge before treating the value as authoritative.
    */
   detectIp(): any;
   /**

package/esm/http/request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAkBK,eAAA,iBAGS,mBAAA,mBAAsC,CAAA,0BAE/B,CAAA,WAEb,CAAA,GAAI,mBAAA,CAAoB,CAAA;AAAA,KAG3B,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBU;AAAA;AAAA;EA0BxB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAgBqB;;;EAAA,OAXd,OAAA,EAAS,OAAA;EA6KW;;;;EAvK3B,KAAA,EAAO,UAAA,QAAkB,KAAA;EA+LV;;;EA1Lf,CAAA,EAAG,UAAA,QAAkB,KAAA;EAicI;;;;;;;;;;;;;;;;EAAA,CA/a/B,GAAA;EA2lB+B;;;EAAA,UAtlBtB,OAAA;EA28BsB;;;EAAA,UAt8BtB,aAAA,GAAgB,iBAAA;EAhEL;;;EAqEd,EAAA;EA3DQ;;;EAgER,SAAA;EAjDgB;;;EAsDhB,OAAA;EA3CA;;;EAgDA,UAAA,CAAW,OAAA,EAAS,cAAA;EAzBjB;;;;;;;;;EAAA,UAgDA,gBAAA;EAwBO;;;;;EAAA,iBAAA,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAYG;;;EAA/C,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAuB3C;;;EAAA,IAhBA,MAAA;EAkCU;;;EAAA,IAzBV,MAAA,CAAO,UAAA;EAuCI;;;EAAA,IAhCX,SAAA;EA8CJ;;;EArCA,aAAA,CAAc,UAAA;EAsCG;;;EA7BjB,aAAA,CAAc,iBAAA;EAsCC;;;EAAA,IA/BX,QAAA;EAmDJ;;;EA5CM,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA;EAiE/D;;;EA1DJ,gBAAA;EA8GI;;;EAvGJ,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAkIkB;;;EAAA,IA1HT,OAAA,IAAW,MAAA;EA6OC;;;EAtOhB,MAAA,CAAO,IAAA,UAAc,YAAA;EAkPb;;;EArOR,SAAA,CAAU,IAAA;EA4OP;;;EAAA,IArOC,MAAA;EA4OqB;;;EAAA,IArOrB,QAAA;EAoQA;;;EAAA,IA7PA,MAAA;EAyQe;;;EAAA,IAlQf,YAAA;EAqSJ;;;EAAA,IAxRI,kBAAA;EAwRkC;;;;;EAAA,IAvQlC,WAAA;EA2RmB;;;EAAA,IA5QnB,aAAA;EAuRS;;;EAAA,IAhRT,MAAA;EAoSsB;;;EAAA,UA7RvB,YAAA;EAsVH;;;EAAA,UAvUG,SAAA,CAAU,IAAA;EA8UP;;;EAAA,UAjPH,UAAA,CAAW,IAAA;EAwPG;;;EAlOjB,QAAA,CAAS,KAAA,EAAO,KAAA;EAgPZ;;;EApOJ,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;EA6OZ;;;EAtOxB,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA;EAiQ5B;;;EA1PA,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;EAsRzB;;;EAAA,IArQI,IAAA;EA+QE;;;EAAA,IAxQF,GAAA;EAsRK;;;EAAA,IA/QL,OAAA;EA+RK;;;;;;;;EAnRH,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;EA0Vb;;;;;EA/TN,UAAA,IAAU,cAAA,CAAA,OAAA;EAsWV;;;;EA9VA,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;EAgX3E;;;EAnWP,eAAA,IAAmB,MAAA,aAAmB,iBAAA;EA4WnB;;;EArWnB,gBAAA,CAAiB,IAAA,EAAM,iBAAA;EA6XnB;;;;;;;EAlXE,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;EA6a0B;;;;;;EAAA,UAzZ9B,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA2CvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;EAcJ,QAAA;;;;MAiBI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}
+{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAkBK,eAAA,iBAGS,mBAAA,mBAAsC,CAAA,0BAE/B,CAAA,WAEb,CAAA,GAAI,mBAAA,CAAoB,CAAA;AAAA,KAG3B,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBU;AAAA;AAAA;EA0BxB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAgBqB;;;EAAA,OAXd,OAAA,EAAS,OAAA;EA6KW;;;;EAvK3B,KAAA,EAAO,UAAA,QAAkB,KAAA;EA+LV;;;EA1Lf,CAAA,EAAG,UAAA,QAAkB,KAAA;EAicI;;;;;;;;;;;;;;;;EAAA,CA/a/B,GAAA;EA2lB+B;;;EAAA,UAtlBtB,OAAA;EA29BsB;;;EAAA,UAt9BtB,aAAA,GAAgB,iBAAA;EAhEL;;;EAqEd,EAAA;EA3DQ;;;EAgER,SAAA;EAjDgB;;;EAsDhB,OAAA;EA3CA;;;EAgDA,UAAA,CAAW,OAAA,EAAS,cAAA;EAzBjB;;;;;;;;;EAAA,UAgDA,gBAAA;EAwBO;;;;;EAAA,iBAAA,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAYG;;;EAA/C,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAuB3C;;;EAAA,IAhBA,MAAA;EAkCU;;;EAAA,IAzBV,MAAA,CAAO,UAAA;EAuCI;;;EAAA,IAhCX,SAAA;EA8CJ;;;EArCA,aAAA,CAAc,UAAA;EAsCG;;;EA7BjB,aAAA,CAAc,iBAAA;EAsCC;;;EAAA,IA/BX,QAAA;EAmDJ;;;EA5CM,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA;EAiE/D;;;EA1DJ,gBAAA;EA8GI;;;EAvGJ,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAkIkB;;;EAAA,IA1HT,OAAA,IAAW,MAAA;EA6OC;;;EAtOhB,MAAA,CAAO,IAAA,UAAc,YAAA;EAkPb;;;EArOR,SAAA,CAAU,IAAA;EA4OP;;;EAAA,IArOC,MAAA;EA4OqB;;;EAAA,IArOrB,QAAA;EAoQA;;;EAAA,IA7PA,MAAA;EAyQe;;;EAAA,IAlQf,YAAA;EAqSJ;;;EAAA,IAxRI,kBAAA;EAwRkC;;;;;EAAA,IAvQlC,WAAA;EA2RmB;;;EAAA,IA5QnB,aAAA;EAuRS;;;EAAA,IAhRT,MAAA;EAoSsB;;;EAAA,UA7RvB,YAAA;EAsVH;;;EAAA,UAvUG,SAAA,CAAU,IAAA;EA8UP;;;EAAA,UAjPH,UAAA,CAAW,IAAA;EAwPG;;;EAlOjB,QAAA,CAAS,KAAA,EAAO,KAAA;EAgPZ;;;EApOJ,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;EA6OZ;;;EAtOxB,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA;EAiQ5B;;;EA1PA,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;EAsRzB;;;EAAA,IArQI,IAAA;EA+QE;;;EAAA,IAxQF,GAAA;EAsRK;;;EAAA,IA/QL,OAAA;EA+RK;;;;;;;;EAnRH,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;EA0Vb;;;;;EA/TN,UAAA,IAAU,cAAA,CAAA,OAAA;EAsWV;;;;EA9VA,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;EAgX3E;;;EAnWP,eAAA,IAAmB,MAAA,aAAmB,iBAAA;EA4WnB;;;EArWnB,gBAAA,CAAiB,IAAA,EAAM,iBAAA;EA6XnB;;;;;;;EAlXE,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;EA6b0B;;;;;;EAAA,UAza9B,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA2CvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;EAqBJ,QAAA;;;;MA0BI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}

package/esm/http/request.mjs

@@ -659,16 +659,28 @@ var Request = class Request {
 	* Best-effort real client IP — checks `X-Real-IP` and `X-Forwarded-For`
 	* headers first, falls back to `baseRequest.ip` when neither is present.
 	*
+	* For a multi-hop `X-Forwarded-For` (`client, proxy1, proxy2`) only the
+	* FIRST entry is returned (the original client), comma-split and trimmed.
+	* Without this, downstream scoping (ip-filter, rate-limit, idempotency)
+	* would key off the whole header string and break behind chained proxies.
+	*
 	* **Prefer this over `request.ip` for any caller behind a proxy** (load
 	* balancer, CDN, reverse proxy, k8s ingress). Only trust the result as
 	* far as you trust the upstream proxy chain — `X-Forwarded-For` is
-	* client-settable; verify the request came through your trusted edge
-	* before treating the value as authoritative.
+	* client-settable, so the leftmost entry is spoofable by the immediate
+	* client when the request did NOT pass through a trusted edge that
+	* appends/overwrites the header. Verify the request came through your
+	* trusted edge before treating the value as authoritative.
 	*/
 	detectIp() {
 		const realIp = this.header("x-real-ip");
 		if (realIp) return realIp;
-		return this.header("x-forwarded-for") || this.baseRequest.ip;
+		const forwardedIp = this.header("x-forwarded-for");
+		if (forwardedIp) {
+			const firstHop = String(forwardedIp).split(",")[0].trim();
+			if (firstHop) return firstHop;
+		}
+		return this.baseRequest.ip;
 	}
 	/**
 	* An alias to detectIp

package/esm/http/request.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/request.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\r\nimport events from \"@mongez/events\";\r\nimport { trans, transFrom } from \"@mongez/localization\";\r\nimport { Random, except, get, only, rtrim, set, unset } from \"@mongez/reinforcements\";\r\nimport { isEmpty } from \"@mongez/supportive-is\";\r\nimport type { LogLevel } from \"@warlock.js/logger\";\r\nimport { log } from \"@warlock.js/logger\";\r\nimport { BaseValidator, v } from \"@warlock.js/seal\";\r\nimport type { FastifyRequest } from \"fastify\";\r\nimport { type IncomingHttpHeaders } from \"node:http2\";\r\nimport { config } from \"../config/config-getter\";\r\nimport type { Middleware, Route } from \"../router\";\r\nimport { validateAll } from \"../validation/validateAll\";\r\nimport { createRequestStore } from \"./middleware/inject-request-context\";\r\nimport { Response } from \"./response\";\r\nimport type { RequestEvent } from \"./types\";\r\nimport { UploadedFile } from \"./uploaded-file\";\r\n\r\ntype StandardHeaders = {\r\n  // copy every declared property from http.IncomingHttpHeaders\r\n  // but remove index signatures\r\n  [K in keyof IncomingHttpHeaders as string extends K\r\n    ? never\r\n    : number extends K\r\n      ? never\r\n      : K]: IncomingHttpHeaders[K];\r\n};\r\n\r\ntype HeaderKeys = keyof StandardHeaders;\r\n\r\nexport class Request<RequestValidation = any> {\r\n  /**\r\n   * Underlying Fastify request — a public escape hatch to capabilities the\r\n   * framework's high-level helpers don't yet cover.\r\n   *\r\n   * **Prefer framework methods first**: `request.input()`, `request.header()`,\r\n   * `request.body`, `request.query`, `request.params`, `request.file()`,\r\n   * `request.user`, `request.detectIp()`, etc. They handle locale, parsing,\r\n   * trust-proxy, and validation pipeline integration correctly.\r\n   *\r\n   * **Reach for `baseRequest` only** when the framework genuinely lacks a\r\n   * helper for what you need — and when you do, file an issue so we can add\r\n   * it. The escape hatch is the release valve that lets consumers move\r\n   * faster than the framework, but every long-term reach here is a missing\r\n   * helper waiting to be added.\r\n   */\r\n  public baseRequest!: FastifyRequest;\r\n\r\n  /**\r\n   * Response Object\r\n   */\r\n  public response!: Response;\r\n\r\n  /**\r\n   * Route Object\r\n   */\r\n  public route!: Route;\r\n\r\n  /**\r\n   * Parsed Request Payload\r\n   */\r\n  protected payload: any = {};\r\n\r\n  /**\r\n   * Decoded access token payload (set by auth middleware)\r\n   */\r\n  public decodedAccessToken?: any;\r\n\r\n  /**\r\n   * Current request instance\r\n   */\r\n  public static current: Request;\r\n\r\n  /**\r\n   * Translation method\r\n   * Type of it is the same as the type of trans function\r\n   */\r\n  public trans: ReturnType<typeof trans> = trans;\r\n\r\n  /**\r\n   * Alias to trans method\r\n   */\r\n  public t: ReturnType<typeof trans> = trans;\r\n\r\n  /**\r\n   * Dynamic properties index signature\r\n   *\r\n   * This allows attaching custom properties to the request instance,\r\n   * commonly used during validation middleware to attach fetched models.\r\n   *\r\n   * @example\r\n   * // In validation middleware:\r\n   * const post = await Post.find(request.int(\"id\"));\r\n   * if (!post) return response.notFound();\r\n   * request.post = post; // Attach the model to the request\r\n   *\r\n   * // In route handler:\r\n   * const post = request.post;\r\n   * // Work with the pre-fetched model\r\n   */\r\n  [key: string]: any;\r\n\r\n  /**\r\n   * Locale code\r\n   */\r\n  protected _locale = \"\";\r\n\r\n  /**\r\n   * Validated data\r\n   */\r\n  protected validatedData?: RequestValidation;\r\n\r\n  /**\r\n   * Request id\r\n   */\r\n  public id = Random.string(32);\r\n\r\n  /**\r\n   * Start Time\r\n   */\r\n  public startTime = Date.now();\r\n\r\n  /**\r\n   * End Time\r\n   */\r\n  public endTime?: undefined | number;\r\n\r\n  /**\r\n   * Set request handler\r\n   */\r\n  public setRequest(request: FastifyRequest) {\r\n    this.baseRequest = request;\r\n\r\n    this.resolveRequestId();\r\n\r\n    this.parsePayload();\r\n\r\n    const localeCode = this.getLocaleCode();\r\n\r\n    this.trans = this.t = transFrom.bind(null, localeCode);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Inherit `X-Request-Id` from the incoming request, fall back to a custom\r\n   * generator, then to the field-init default (`Random.string(32)`).\r\n   *\r\n   * Inherited values are validated (length cap + printable-ASCII) to prevent\r\n   * log-injection from a malicious client. Disable the whole behavior by\r\n   * setting `http.requestId.enabled = false` — in which case the field-init\r\n   * default is used regardless of any incoming header.\r\n   */\r\n  protected resolveRequestId() {\r\n    const requestIdConfig = config.key(\"http.requestId\") || {};\r\n\r\n    if (requestIdConfig.enabled === false) return;\r\n\r\n    const headerName = (requestIdConfig.header || \"x-request-id\").toLowerCase();\r\n    const incoming = this.baseRequest.headers[headerName];\r\n\r\n    if (Request.isValidRequestId(incoming)) {\r\n      this.id = incoming;\r\n\r\n      return;\r\n    }\r\n\r\n    if (typeof requestIdConfig.generator === \"function\") {\r\n      this.id = requestIdConfig.generator();\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Validate a candidate request-id value. Accepts non-empty printable ASCII\r\n   * up to 128 characters — tight enough to reject newline / control-character\r\n   * log-injection, loose enough to accept UUIDs, ULIDs, snowflakes, etc.\r\n   */\r\n  protected static isValidRequestId(value: unknown): value is string {\r\n    return (\r\n      typeof value === \"string\" &&\r\n      value.length > 0 &&\r\n      value.length <= 128 &&\r\n      /^[\\x21-\\x7e]+$/.test(value)\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Translate from the given locale code\r\n   */\r\n  public transFrom(localeCode: string, keyword: string, placeholders?: any) {\r\n    return transFrom(localeCode, keyword, placeholders);\r\n  }\r\n\r\n  /**\r\n   * Get current locale code\r\n   */\r\n  public get locale() {\r\n    if (this._locale) return this._locale;\r\n\r\n    return this.header(\"translation-locale-code\") || this.localized;\r\n  }\r\n\r\n  /**\r\n   * Set locale code\r\n   */\r\n  public set locale(localeCode: string) {\r\n    this._locale = localeCode;\r\n  }\r\n\r\n  /**\r\n   * Get locale code that will be used for translation\r\n   */\r\n  public get localized() {\r\n    if (this._locale) return this._locale;\r\n\r\n    return (this._locale = this.header(\"locale\") || this.query[\"locale\"]);\r\n  }\r\n\r\n  /**\r\n   * Set locale code\r\n   */\r\n  public setLocaleCode(localeCode: string) {\r\n    this._locale = localeCode;\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Get current locale code or return default locale code\r\n   */\r\n  public getLocaleCode(defaultLocaleCode: string = config.key(\"app.localeCode\") || \"en\") {\r\n    return this.locale || defaultLocaleCode;\r\n  }\r\n\r\n  /**\r\n   * Get http protocol\r\n   */\r\n  public get protocol() {\r\n    return this.baseRequest.protocol;\r\n  }\r\n\r\n  /**\r\n   * Validate the given validation schema\r\n   */\r\n  public async validate(validation: BaseValidator, selectedInputs?: string[]) {\r\n    return await v.validate(validation, selectedInputs ? this.only(selectedInputs) : this.all());\r\n  }\r\n\r\n  /**\r\n   * Clear current user\r\n   */\r\n  public clearCurrentUser() {\r\n    this.user = undefined;\r\n  }\r\n\r\n  /**\r\n   * Get value of the given header\r\n   */\r\n  public header<TCustomHeader extends string = HeaderKeys>(\r\n    name: TCustomHeader | HeaderKeys,\r\n    defaultValue: any = null,\r\n  ) {\r\n    return this.baseRequest.headers[name.toLocaleLowerCase()] ?? defaultValue;\r\n  }\r\n\r\n  /**\r\n   * Get all cookies from the current request\r\n   */\r\n  public get cookies(): Record<string, string | undefined> {\r\n    return this.baseRequest.cookies || {};\r\n  }\r\n\r\n  /**\r\n   * Get a particular cookie value or fallback to default\r\n   */\r\n  public cookie(name: string, defaultValue?: any): string | any {\r\n    const value = this.cookies[name] ?? defaultValue;\r\n\r\n    try {\r\n      return JSON.parse(value);\r\n    } catch (error) {\r\n      return value;\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Determine if the request has the specified cookie\r\n   */\r\n  public hasCookie(name: string): boolean {\r\n    return this.cookies[name] !== undefined;\r\n  }\r\n\r\n  /**\r\n   * Get the current request domain\r\n   */\r\n  public get domain() {\r\n    return this.baseRequest.hostname.replace(/^www\\./, \"\");\r\n  }\r\n\r\n  /**\r\n   * Get hostname\r\n   */\r\n  public get hostname() {\r\n    return this.domain;\r\n  }\r\n\r\n  /**\r\n   * Get request origin\r\n   */\r\n  public get origin() {\r\n    return this.baseRequest.headers.origin as string;\r\n  }\r\n\r\n  /**\r\n   * Get the domain of the origin\r\n   */\r\n  public get originDomain() {\r\n    const domain = this.origin ? new URL(this.origin).hostname : null;\r\n\r\n    if (domain?.startsWith(\"www.\")) {\r\n      return domain.replace(/^www\\./, \"\");\r\n    }\r\n\r\n    return domain;\r\n  }\r\n\r\n  /**\r\n   * Get authorization header value\r\n   */\r\n  public get authorizationValue(): string {\r\n    const authorization = this.header(\"authorization\");\r\n\r\n    if (!authorization) return \"\";\r\n\r\n    const [type, value] = authorization.split(\" \");\r\n\r\n    if (![\"bearer\", \"key\"].includes(type.toLowerCase())) return \"\";\r\n\r\n    return value || \"\";\r\n  }\r\n\r\n  /**\r\n   * Get access token from Authorization header\r\n   *\r\n   * If the Authorization header does not start with `Bearer` value then return null\r\n   */\r\n  public get accessToken(): string | undefined {\r\n    const authorization = this.header(\"authorization\");\r\n\r\n    if (!authorization) return;\r\n\r\n    const [type, value] = authorization.split(\" \");\r\n\r\n    if (type.toLowerCase() !== \"bearer\") return;\r\n\r\n    return value;\r\n  }\r\n\r\n  /**\r\n   * Get the authorization header\r\n   */\r\n  public get authorization() {\r\n    return this.header(\"authorization\");\r\n  }\r\n\r\n  /**\r\n   * Get current request method\r\n   */\r\n  public get method(): string {\r\n    return this.baseRequest.method;\r\n  }\r\n\r\n  /**\r\n   * Parse the payload and merge it from the request body, params and query string\r\n   */\r\n  protected parsePayload() {\r\n    this.payload.body = this.parseBody(this.baseRequest.body);\r\n\r\n    this.payload.query = this.parseBody(this.baseRequest.query);\r\n    this.payload.params = { ...(this.baseRequest.params || {}) };\r\n    this.payload.all = {\r\n      ...this.payload.body,\r\n      ...this.payload.query,\r\n      ...this.payload.params,\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Parse body payload\r\n   */\r\n  protected parseBody(data: any) {\r\n    try {\r\n      if (!data) return {};\r\n\r\n      const body: any = {};\r\n\r\n      const arrayOfObjectValues: any = {};\r\n\r\n      for (let key in data) {\r\n        const value = data[key];\r\n\r\n        let isArrayKey = false;\r\n\r\n        if (key.endsWith(\"[]\")) {\r\n          isArrayKey = true;\r\n        }\r\n\r\n        key = rtrim(key, \"[]\");\r\n\r\n        // check if the key is has a square brackets, then convert it into object\r\n        // i.e user[email] => user: {email: \"value\"}\r\n        // also check if its an array of objects\r\n\r\n        if (key.includes(\"[\")) {\r\n          // check if its an array of objects\r\n          if (key.includes(\"][\")) {\r\n            const keyParts = key.split(\"[\");\r\n\r\n            const keyName = keyParts[0];\r\n            if (!arrayOfObjectValues[keyName]) {\r\n              arrayOfObjectValues[keyName] = [];\r\n            }\r\n\r\n            const keyNameParts = keyParts[1].split(\"]\");\r\n\r\n            const index = Number(keyNameParts[0]);\r\n\r\n            if (!arrayOfObjectValues[keyName][index]) {\r\n              arrayOfObjectValues[keyName][index] = {};\r\n            }\r\n\r\n            // now get the key after the index\r\n            const keyNameParts2 = keyParts[2].split(\"]\");\r\n            const keyName2 = keyNameParts2[0];\r\n\r\n            arrayOfObjectValues[keyName][index][keyName2] = this.parseValue(value);\r\n\r\n            continue;\r\n          }\r\n\r\n          const keyParts = key.split(\"[\");\r\n          const keyName = keyParts[0];\r\n          const keyNameParts = keyParts[1].split(\"]\");\r\n\r\n          set(\r\n            body,\r\n            keyName + \".\" + keyNameParts[0],\r\n            Array.isArray(value) ? value.map(this.parseValue.bind(this)) : this.parseValue(value),\r\n          );\r\n\r\n          continue;\r\n        }\r\n\r\n        if (Array.isArray(value)) {\r\n          set(body, key, value.map(this.parseValue.bind(this)));\r\n        } else if (isArrayKey) {\r\n          if (body[key]) {\r\n            body[key].push(this.parseValue(value));\r\n          } else {\r\n            body[key] = [this.parseValue(value)];\r\n\r\n            continue;\r\n          }\r\n        } else {\r\n          set(body, key, this.parseValue(value));\r\n        }\r\n      }\r\n\r\n      // now merge the array of objects into the body\r\n      for (const key in arrayOfObjectValues) {\r\n        body[key] = arrayOfObjectValues[key];\r\n      }\r\n\r\n      return body;\r\n    } catch (error) {\r\n      console.log(error);\r\n      this.log(error, \"error\");\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Parse the given data\r\n   */\r\n  protected parseValue(data: any) {\r\n    // data.value appears only in the multipart form data\r\n    // if it json, then just return the data\r\n    if (data?.file) return new UploadedFile(data);\r\n    if (data?.value !== undefined && data?.fields && data?.type) {\r\n      data = data.value;\r\n    }\r\n\r\n    if (data === \"false\") return false;\r\n\r\n    if (data === \"true\") return true;\r\n\r\n    if (data === \"null\") return null;\r\n\r\n    if (typeof data === \"string\") return data.trim();\r\n\r\n    return data;\r\n  }\r\n\r\n  /**\r\n   * Set route handler\r\n   */\r\n  public setRoute(route: Route) {\r\n    this.route = route;\r\n\r\n    // pass the route to the response object\r\n    this.response.setRoute(route);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Trigger an http event\r\n   */\r\n  public trigger(eventName: RequestEvent, ...args: any[]) {\r\n    return events.trigger(`request.${eventName}`, ...args, this);\r\n  }\r\n\r\n  /**\r\n   * Listen to the given event\r\n   */\r\n  public on(eventName: RequestEvent, callback: any) {\r\n    return this.subscribe(eventName, callback);\r\n  }\r\n\r\n  /**\r\n   * Make a log message\r\n   */\r\n  public log(message: any, level: LogLevel = \"info\") {\r\n    if (!config.key(\"http.log\")) return;\r\n\r\n    log.log({\r\n      module: \"request\",\r\n      action: this.route.method + \" \" + this.route.path.replace(\"/*\", \"\") + `:${this.id}`,\r\n      message,\r\n      type: level,\r\n      context: {\r\n        request: this,\r\n      },\r\n    });\r\n  }\r\n\r\n  /**\r\n   * Get current request path\r\n   */\r\n  public get path() {\r\n    return this.baseRequest.url;\r\n  }\r\n\r\n  /**\r\n   * {@alias}\r\n   */\r\n  public get url() {\r\n    return this.baseRequest.url;\r\n  }\r\n\r\n  /**\r\n   * Get full url\r\n   */\r\n  public get fullUrl() {\r\n    return this.protocol + \"://\" + this.hostname + this.path;\r\n  }\r\n\r\n  /**\r\n   * Drive the middleware chain for the current route, then defer to the\r\n   * controller. Returns the first response value any middleware short-circuits\r\n   * with, or `undefined` to continue into validation + handler.\r\n   *\r\n   * @internal Framework orchestration — do not call from app code. Will move\r\n   * to a dedicated controller dispatcher in a future refactor.\r\n   */\r\n  public async runMiddleware() {\r\n    // measure request time\r\n    // check for middleware first\r\n    const middlewareOutput = await this.executeMiddleware();\r\n\r\n    if (middlewareOutput !== undefined) {\r\n      // 👇🏻 make sure first its not a response instance\r\n      if (middlewareOutput instanceof Response) return middlewareOutput;\r\n      // 👇🏻 send the response\r\n      return this.response.send(middlewareOutput);\r\n    }\r\n\r\n    const handler = this.route.handler;\r\n\r\n    if (!handler.validation) return;\r\n\r\n    // 👇🏻 check for validation using validateAll helper function\r\n    const validationOutput = await validateAll(handler.validation, this, this.response);\r\n\r\n    return validationOutput;\r\n  }\r\n\r\n  /**\r\n   * Return the request handler attached to the current route.\r\n   *\r\n   * @internal Framework orchestration — do not call from app code.\r\n   */\r\n  public getHandler() {\r\n    return this.route.handler;\r\n  }\r\n\r\n  /**\r\n   * Get inputs that has been validated only\r\n   * You can also pass an array of inputs to get only the validated inputs\r\n   */\r\n  public validated<Output = RequestValidation>(inputs?: (keyof Output | (string & {}))[]): Output {\r\n    if (this.validatedData) {\r\n      return inputs\r\n        ? only(this.validatedData as Output, inputs as string[])\r\n        : (this.validatedData as Output);\r\n    }\r\n\r\n    return {} as Output;\r\n  }\r\n\r\n  /**\r\n   * Get inputs that has been validated except the given inputs\r\n   */\r\n  public validatedExcept(...inputs: string[]): RequestValidation {\r\n    return except(this.validated(), inputs);\r\n  }\r\n\r\n  /**\r\n   * Set validated data\r\n   */\r\n  public setValidatedData(data: RequestValidation) {\r\n    this.validatedData = data;\r\n  }\r\n\r\n  /**\r\n   * Top-level entry into the request lifecycle — opens the context store,\r\n   * runs middleware, drives the handler, handles errors.\r\n   *\r\n   * @internal Framework orchestration — do not call from app code. Wired\r\n   * from the Fastify route handler in `router.scan()`.\r\n   */\r\n  public async execute() {\r\n    try {\r\n      // call executingAction event\r\n\r\n      this.log(\"Executing the request\");\r\n\r\n      return await createRequestStore(this, this.response);\r\n    } catch (error) {\r\n      this.log(error, \"error\");\r\n\r\n      throw error;\r\n    }\r\n  }\r\n\r\n  /**\r\n   * Iterate the collected middlewares in order; return the first short-circuit\r\n   * value or `undefined` when every middleware passes through.\r\n   *\r\n   * @internal Framework orchestration — do not call from app code.\r\n   */\r\n  protected async executeMiddleware() {\r\n    // collect all middlewares for current route\r\n    const middlewares = this.collectMiddlewares();\r\n\r\n    // check if there are no middlewares, then return\r\n    if (middlewares.length === 0) return;\r\n\r\n    this.log(\"About to execute request middlewares\");\r\n\r\n    // trigger the executingMiddleware event\r\n    this.trigger(\"executingMiddleware\", middlewares, this.route);\r\n\r\n    for (const middleware of middlewares) {\r\n      this.log(\"Executing middleware \" + colors.yellowBright(middleware.name));\r\n      const output = await middleware(this, this.response);\r\n      this.log(\"Executed middleware \" + colors.yellowBright(middleware.name), \"success\");\r\n\r\n      if (output !== undefined) {\r\n        this.log(\r\n          colors.yellow(\"request intercepted by middleware \") + colors.cyanBright(middleware.name),\r\n          \"warn\",\r\n        );\r\n\r\n        this.trigger(\"executedMiddleware\");\r\n\r\n        this.log(\"Request middlewares executed\", \"success\");\r\n\r\n        return output;\r\n      }\r\n    }\r\n\r\n    this.log(\"Request middlewares executed\", \"success\");\r\n\r\n    // trigger the executedMiddleware event\r\n    this.trigger(\"executedMiddleware\", middlewares, this.route);\r\n  }\r\n\r\n  /**\r\n   * Gather the middleware list for the current route — today just the\r\n   * route-level array; future extraction may merge group + app-wide layers.\r\n   *\r\n   * @internal Framework orchestration — do not call from app code.\r\n   */\r\n  protected collectMiddlewares(): Middleware[] {\r\n    const middlewaresList: Middleware[] = [];\r\n\r\n    // collect route middlewares\r\n    if (this.route.middleware) {\r\n      middlewaresList.push(...this.route.middleware);\r\n    }\r\n\r\n    return middlewaresList;\r\n  }\r\n\r\n  /**\r\n   * Get request input value from query string, params or body\r\n   */\r\n  public input(key: string, defaultValue?: any) {\r\n    return get(this.payload.all, key, defaultValue);\r\n  }\r\n\r\n  /**\r\n   * Get email input value, this will lowercase the value\r\n   */\r\n  public email(key: string = \"email\", defaultValue: string = \"\"): string {\r\n    return this.input(key, defaultValue)?.toLowerCase() || defaultValue;\r\n  }\r\n\r\n  /**\r\n   * @alias input\r\n   */\r\n  public get(key: string, defaultValue?: any) {\r\n    return this.input(key, defaultValue);\r\n  }\r\n\r\n  /**\r\n   * Determine if request has input value\r\n   */\r\n  public has(key: string) {\r\n    return get(this.payload.all, key, undefined) !== undefined;\r\n  }\r\n\r\n  /**\r\n   * Set request input value\r\n   */\r\n  public set(key: string, value: any) {\r\n    set(this.payload.all, key, value);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Set the given value if the request does not have the input\r\n   */\r\n  public setDefault(key: string, value: any) {\r\n    if (this.has(key)) return this;\r\n\r\n    set(this.payload.all, key, value);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Unset request payload keys\r\n   */\r\n  public unset(...keys: string[]) {\r\n    this.payload.all = unset(this.payload.all, keys);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Get request body\r\n   */\r\n  public get body() {\r\n    return this.payload.body;\r\n  }\r\n\r\n  /**\r\n   * Set request body value\r\n   */\r\n  public setBody(key: string, value: any) {\r\n    set(this.payload.body, key, value);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Get body inputs except files\r\n   */\r\n  public get bodyInputs() {\r\n    const inputs = this.payload.body;\r\n\r\n    const bodyInputs: any = {};\r\n\r\n    for (const key in inputs) {\r\n      const value = inputs[key];\r\n\r\n      if (value.file && value.fieldname) continue;\r\n\r\n      bodyInputs[key] = value;\r\n    }\r\n\r\n    return bodyInputs;\r\n  }\r\n\r\n  /**\r\n   * Get request file in UploadedFile instance\r\n   */\r\n  public file(key: string): UploadedFile | undefined {\r\n    const file = this.input(key);\r\n\r\n    return file;\r\n  }\r\n\r\n  /**\r\n   * Get uploaded files from the request for the given name\r\n   * If the given name is not present in the request, return an empty array\r\n   */\r\n  public files(name: string): UploadedFile[] {\r\n    return this.input(name) || [];\r\n  }\r\n\r\n  /**\r\n   * Get request params\r\n   */\r\n  public get params() {\r\n    return this.payload.params;\r\n  }\r\n\r\n  /**\r\n   * Set request params value\r\n   */\r\n  public setParam(key: string, value: any) {\r\n    set(this.payload.params, key, value);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Get request query\r\n   */\r\n  public get query() {\r\n    return this.payload.query;\r\n  }\r\n\r\n  /**\r\n   * Set request query value\r\n   */\r\n  public setQuery(key: string, value: any) {\r\n    set(this.payload.query, key, value);\r\n\r\n    return this;\r\n  }\r\n\r\n  /**\r\n   * Get all inputs\r\n   */\r\n  public all() {\r\n    return this.payload.all;\r\n  }\r\n\r\n  /**\r\n   * Get all inputs except params\r\n   */\r\n  public allExceptParams() {\r\n    return {\r\n      ...this.payload.query,\r\n      ...this.payload.body,\r\n    };\r\n  }\r\n\r\n  /**\r\n   * Get all heavy inputs except params\r\n   */\r\n  public heavyExceptParams() {\r\n    const inputs = this.allExceptParams();\r\n\r\n    const heavyInputs: any = {};\r\n\r\n    for (const key in inputs) {\r\n      const value = inputs[key];\r\n\r\n      if (isEmpty(value) && value !== null) continue;\r\n\r\n      heavyInputs[key] = value;\r\n    }\r\n\r\n    return heavyInputs;\r\n  }\r\n\r\n  /**\r\n   * Get only heavy inputs, the input with a value\r\n   */\r\n  public heavy() {\r\n    const inputs = this.all();\r\n\r\n    const heavyInputs: any = {};\r\n\r\n    for (const key in inputs) {\r\n      const value = inputs[key];\r\n\r\n      if (isEmpty(value) && value !== null) continue;\r\n\r\n      heavyInputs[key] = value;\r\n    }\r\n\r\n    return heavyInputs;\r\n  }\r\n\r\n  /**\r\n   * Get only the given keys from the request data\r\n   */\r\n  public only(keys: string[]) {\r\n    return only(this.all(), keys);\r\n  }\r\n\r\n  /**\r\n   * Pluck the given keys from the request data\r\n   */\r\n  public pluck(keys: string[]) {\r\n    const data = this.only(keys);\r\n\r\n    this.unset(...keys);\r\n\r\n    return data;\r\n  }\r\n\r\n  /**\r\n   * Get all request inputs except the given keys\r\n   */\r\n  public except(keys: string[]) {\r\n    return except(this.all(), keys);\r\n  }\r\n\r\n  /**\r\n   * Get boolean input value\r\n   */\r\n  public bool(key: string, defaultValue = false) {\r\n    const value = this.input(key, defaultValue);\r\n\r\n    if (value === \"true\") {\r\n      return true;\r\n    }\r\n\r\n    if (value === \"false\") {\r\n      return false;\r\n    }\r\n\r\n    if (value === 0) {\r\n      return false;\r\n    }\r\n\r\n    return Boolean(value);\r\n  }\r\n\r\n  /**\r\n   * Get integer input value\r\n   */\r\n  public int(key: string, defaultValue: number = 0): number | undefined {\r\n    const value = this.input(key, defaultValue);\r\n\r\n    if (!value && value !== 0) return undefined;\r\n\r\n    return parseInt(value);\r\n  }\r\n\r\n  /**\r\n   * Shorthand getter to get id param\r\n   */\r\n  public get idParam() {\r\n    return this.int(\"id\");\r\n  }\r\n\r\n  /**\r\n   * Get string input value\r\n   */\r\n  public string(key: string, defaultValue: string = \"\"): string {\r\n    const value = this.input(key, defaultValue);\r\n\r\n    return String(value);\r\n  }\r\n\r\n  /**\r\n   * Get float input value\r\n   */\r\n  public float(key: string, defaultValue: number = 0): number {\r\n    const value = this.input(key, defaultValue);\r\n\r\n    return parseFloat(value) || 0;\r\n  }\r\n\r\n  /**\r\n   * Get number input value\r\n   */\r\n  public number(key: string, defaultValue: number = 0): number {\r\n    const value = Number(this.input(key, defaultValue));\r\n\r\n    return isNaN(value) ? defaultValue : value;\r\n  }\r\n\r\n  /**\r\n   * Immediate-peer IP as Fastify reports it — the address that connected to\r\n   * the server socket, with `trustProxy` resolution applied. Use this when\r\n   * you specifically need the peer address (rate-limit-by-direct-connection,\r\n   * health-check origin verification).\r\n   *\r\n   * **For most use cases prefer `request.detectIp()`** — behind any proxy\r\n   * (load balancer, CDN, sidecar) `ip` reports the proxy, not the real client.\r\n   */\r\n  public get ip() {\r\n    return this.baseRequest.ip;\r\n  }\r\n\r\n  /**\r\n   * Best-effort real client IP — checks `X-Real-IP` and `X-Forwarded-For`\r\n   * headers first, falls back to `baseRequest.ip` when neither is present.\r\n   *\r\n   * **Prefer this over `request.ip` for any caller behind a proxy** (load\r\n   * balancer, CDN, reverse proxy, k8s ingress). Only trust the result as\r\n   * far as you trust the upstream proxy chain — `X-Forwarded-For` is\r\n   * client-settable; verify the request came through your trusted edge\r\n   * before treating the value as authoritative.\r\n   */\r\n  public detectIp() {\r\n    // as the server maybe used behind a proxy\r\n    // then we need to check first if there is a forwarded ip\r\n    // check for the real-ip header\r\n\r\n    const realIp = this.header(\"x-real-ip\");\r\n\r\n    if (realIp) return realIp;\r\n\r\n    const forwardedIp = this.header(\"x-forwarded-for\");\r\n\r\n    return forwardedIp || this.baseRequest.ip;\r\n  }\r\n\r\n  /**\r\n   * An alias to detectIp\r\n   */\r\n  public get realIp() {\r\n    return this.detectIp();\r\n  }\r\n\r\n  /**\r\n   * Get request ips\r\n   */\r\n  public get ips() {\r\n    return this.baseRequest.ips;\r\n  }\r\n\r\n  /**\r\n   * Get request referer\r\n   */\r\n  public get referer() {\r\n    return this.baseRequest.headers.referer;\r\n  }\r\n\r\n  /**\r\n   * Get user agent\r\n   */\r\n  public get userAgent() {\r\n    return this.baseRequest.headers[\"user-agent\"];\r\n  }\r\n\r\n  /**\r\n   * Get request headers\r\n   */\r\n  public get headers(): typeof this.baseRequest.headers {\r\n    return this.baseRequest.headers;\r\n  }\r\n\r\n  /**\r\n   * Set the given header\r\n   */\r\n  public setHeader(key: HeaderKeys, value: string) {\r\n    this.baseRequest.headers[key.toLowerCase()] = value;\r\n\r\n    return this;\r\n  }\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;AA8BA,IAAa,UAAb,MAAa,QAAiC;;iBA+BnB,CAAC;eAgBe;WAKJ;iBAuBjB;YAUR,OAAO,OAAO,EAAE;mBAKT,KAAK,IAAI;;;;;CAU5B,AAAO,WAAW,SAAyB;EACzC,KAAK,cAAc;EAEnB,KAAK,iBAAiB;EAEtB,KAAK,aAAa;EAElB,MAAM,aAAa,KAAK,cAAc;EAEtC,KAAK,QAAQ,KAAK,IAAI,UAAU,KAAK,MAAM,UAAU;EAErD,OAAO;CACT;;;;;;;;;;CAWA,AAAU,mBAAmB;EAC3B,MAAM,kBAAkB,OAAO,IAAI,gBAAgB,KAAK,CAAC;EAEzD,IAAI,gBAAgB,YAAY,OAAO;EAEvC,MAAM,cAAc,gBAAgB,UAAU,eAAc,CAAE,YAAY;EAC1E,MAAM,WAAW,KAAK,YAAY,QAAQ;EAE1C,IAAI,QAAQ,iBAAiB,QAAQ,GAAG;GACtC,KAAK,KAAK;GAEV;EACF;EAEA,IAAI,OAAO,gBAAgB,cAAc,YACvC,KAAK,KAAK,gBAAgB,UAAU;CAExC;;;;;;CAOA,OAAiB,iBAAiB,OAAiC;EACjE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,OAChB,iBAAiB,KAAK,KAAK;CAE/B;;;;CAKA,AAAO,UAAU,YAAoB,SAAiB,cAAoB;EACxE,OAAO,UAAU,YAAY,SAAS,YAAY;CACpD;;;;CAKA,IAAW,SAAS;EAClB,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAO,KAAK,OAAO,yBAAyB,KAAK,KAAK;CACxD;;;;CAKA,IAAW,OAAO,YAAoB;EACpC,KAAK,UAAU;CACjB;;;;CAKA,IAAW,YAAY;EACrB,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAQ,KAAK,UAAU,KAAK,OAAO,QAAQ,KAAK,KAAK,MAAM;CAC7D;;;;CAKA,AAAO,cAAc,YAAoB;EACvC,KAAK,UAAU;EAEf,OAAO;CACT;;;;CAKA,AAAO,cAAc,oBAA4B,OAAO,IAAI,gBAAgB,KAAK,MAAM;EACrF,OAAO,KAAK,UAAU;CACxB;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,MAAa,SAAS,YAA2B,gBAA2B;EAC1E,OAAO,MAAM,EAAE,SAAS,YAAY,iBAAiB,KAAK,KAAK,cAAc,IAAI,KAAK,IAAI,CAAC;CAC7F;;;;CAKA,AAAO,mBAAmB;EACxB,KAAK,OAAO;CACd;;;;CAKA,AAAO,OACL,MACA,eAAoB,MACpB;EACA,OAAO,KAAK,YAAY,QAAQ,KAAK,kBAAkB,MAAM;CAC/D;;;;CAKA,IAAW,UAA8C;EACvD,OAAO,KAAK,YAAY,WAAW,CAAC;CACtC;;;;CAKA,AAAO,OAAO,MAAc,cAAkC;EAC5D,MAAM,QAAQ,KAAK,QAAQ,SAAS;EAEpC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,SAAS,OAAO;GACd,OAAO;EACT;CACF;;;;CAKA,AAAO,UAAU,MAAuB;EACtC,OAAO,KAAK,QAAQ,UAAU;CAChC;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,SAAS,QAAQ,UAAU,EAAE;CACvD;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK;CACd;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,eAAe;EACxB,MAAM,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,WAAW;EAE7D,IAAI,QAAQ,WAAW,MAAM,GAC3B,OAAO,OAAO,QAAQ,UAAU,EAAE;EAGpC,OAAO;CACT;;;;CAKA,IAAW,qBAA6B;EACtC,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe,OAAO;EAE3B,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG,OAAO;EAE5D,OAAO,SAAS;CAClB;;;;;;CAOA,IAAW,cAAkC;EAC3C,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe;EAEpB,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,KAAK,YAAY,MAAM,UAAU;EAErC,OAAO;CACT;;;;CAKA,IAAW,gBAAgB;EACzB,OAAO,KAAK,OAAO,eAAe;CACpC;;;;CAKA,IAAW,SAAiB;EAC1B,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAU,eAAe;EACvB,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,YAAY,IAAI;EAExD,KAAK,QAAQ,QAAQ,KAAK,UAAU,KAAK,YAAY,KAAK;EAC1D,KAAK,QAAQ,SAAS,EAAE,GAAI,KAAK,YAAY,UAAU,CAAC,EAAG;EAC3D,KAAK,QAAQ,MAAM;GACjB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAU,UAAU,MAAW;EAC7B,IAAI;GACF,IAAI,CAAC,MAAM,OAAO,CAAC;GAEnB,MAAM,OAAY,CAAC;GAEnB,MAAM,sBAA2B,CAAC;GAElC,KAAK,IAAI,OAAO,MAAM;IACpB,MAAM,QAAQ,KAAK;IAEnB,IAAI,aAAa;IAEjB,IAAI,IAAI,SAAS,IAAI,GACnB,aAAa;IAGf,MAAM,MAAM,KAAK,IAAI;IAMrB,IAAI,IAAI,SAAS,GAAG,GAAG;KAErB,IAAI,IAAI,SAAS,IAAI,GAAG;MACtB,MAAM,WAAW,IAAI,MAAM,GAAG;MAE9B,MAAM,UAAU,SAAS;MACzB,IAAI,CAAC,oBAAoB,UACvB,oBAAoB,WAAW,CAAC;MAGlC,MAAM,eAAe,SAAS,EAAE,CAAC,MAAM,GAAG;MAE1C,MAAM,QAAQ,OAAO,aAAa,EAAE;MAEpC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,QAChC,oBAAoB,QAAQ,CAAC,SAAS,CAAC;MAKzC,MAAM,WADgB,SAAS,EAAE,CAAC,MAAM,GACX,CAAC,CAAC;MAE/B,oBAAoB,QAAQ,CAAC,MAAM,CAAC,YAAY,KAAK,WAAW,KAAK;MAErE;KACF;KAEA,MAAM,WAAW,IAAI,MAAM,GAAG;KAC9B,MAAM,UAAU,SAAS;KACzB,MAAM,eAAe,SAAS,EAAE,CAAC,MAAM,GAAG;KAE1C,IACE,MACA,UAAU,MAAM,aAAa,IAC7B,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,IAAI,KAAK,WAAW,KAAK,CACtF;KAEA;IACF;IAEA,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,CAAC;SAC/C,IAAI,YACT,IAAI,KAAK,MACP,KAAK,IAAI,CAAC,KAAK,KAAK,WAAW,KAAK,CAAC;SAChC;KACL,KAAK,OAAO,CAAC,KAAK,WAAW,KAAK,CAAC;KAEnC;IACF;SAEA,IAAI,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;GAEzC;GAGA,KAAK,MAAM,OAAO,qBAChB,KAAK,OAAO,oBAAoB;GAGlC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,KAAK;GACjB,KAAK,IAAI,OAAO,OAAO;EACzB;CACF;;;;CAKA,AAAU,WAAW,MAAW;EAG9B,IAAI,MAAM,MAAM,OAAO,IAAI,aAAa,IAAI;EAC5C,IAAI,MAAM,UAAU,UAAa,MAAM,UAAU,MAAM,MACrD,OAAO,KAAK;EAGd,IAAI,SAAS,SAAS,OAAO;EAE7B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,OAAO,SAAS,UAAU,OAAO,KAAK,KAAK;EAE/C,OAAO;CACT;;;;CAKA,AAAO,SAAS,OAAc;EAC5B,KAAK,QAAQ;EAGb,KAAK,SAAS,SAAS,KAAK;EAE5B,OAAO;CACT;;;;CAKA,AAAO,QAAQ,WAAyB,GAAG,MAAa;EACtD,OAAO,OAAO,QAAQ,WAAW,aAAa,GAAG,MAAM,IAAI;CAC7D;;;;CAKA,AAAO,GAAG,WAAyB,UAAe;EAChD,OAAO,KAAK,UAAU,WAAW,QAAQ;CAC3C;;;;CAKA,AAAO,IAAI,SAAc,QAAkB,QAAQ;EACjD,IAAI,CAAC,OAAO,IAAI,UAAU,GAAG;EAE7B,IAAI,IAAI;GACN,QAAQ;GACR,QAAQ,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK,QAAQ,MAAM,EAAE,IAAI,IAAI,KAAK;GAC/E;GACA,MAAM;GACN,SAAS,EACP,SAAS,KACX;EACF,CAAC;CACH;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,KAAK;CACtD;;;;;;;;;CAUA,MAAa,gBAAgB;EAG3B,MAAM,mBAAmB,MAAM,KAAK,kBAAkB;EAEtD,IAAI,qBAAqB,QAAW;GAElC,IAAI,4BAA4B,UAAU,OAAO;GAEjD,OAAO,KAAK,SAAS,KAAK,gBAAgB;EAC5C;EAEA,MAAM,UAAU,KAAK,MAAM;EAE3B,IAAI,CAAC,QAAQ,YAAY;EAKzB,OAAO,MAFwB,YAAY,QAAQ,YAAY,MAAM,KAAK,QAAQ;CAGpF;;;;;;CAOA,AAAO,aAAa;EAClB,OAAO,KAAK,MAAM;CACpB;;;;;CAMA,AAAO,UAAsC,QAAmD;EAC9F,IAAI,KAAK,eACP,OAAO,SACH,KAAK,KAAK,eAAyB,MAAkB,IACpD,KAAK;EAGZ,OAAO,CAAC;CACV;;;;CAKA,AAAO,gBAAgB,GAAG,QAAqC;EAC7D,OAAO,OAAO,KAAK,UAAU,GAAG,MAAM;CACxC;;;;CAKA,AAAO,iBAAiB,MAAyB;EAC/C,KAAK,gBAAgB;CACvB;;;;;;;;CASA,MAAa,UAAU;EACrB,IAAI;GAGF,KAAK,IAAI,uBAAuB;GAEhC,OAAO,MAAM,mBAAmB,MAAM,KAAK,QAAQ;EACrD,SAAS,OAAO;GACd,KAAK,IAAI,OAAO,OAAO;GAEvB,MAAM;EACR;CACF;;;;;;;CAQA,MAAgB,oBAAoB;EAElC,MAAM,cAAc,KAAK,mBAAmB;EAG5C,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,IAAI,sCAAsC;EAG/C,KAAK,QAAQ,uBAAuB,aAAa,KAAK,KAAK;EAE3D,KAAK,MAAM,cAAc,aAAa;GACpC,KAAK,IAAI,0BAA0B,OAAO,aAAa,WAAW,IAAI,CAAC;GACvE,MAAM,SAAS,MAAM,WAAW,MAAM,KAAK,QAAQ;GACnD,KAAK,IAAI,yBAAyB,OAAO,aAAa,WAAW,IAAI,GAAG,SAAS;GAEjF,IAAI,WAAW,QAAW;IACxB,KAAK,IACH,OAAO,OAAO,oCAAoC,IAAI,OAAO,WAAW,WAAW,IAAI,GACvF,MACF;IAEA,KAAK,QAAQ,oBAAoB;IAEjC,KAAK,IAAI,gCAAgC,SAAS;IAElD,OAAO;GACT;EACF;EAEA,KAAK,IAAI,gCAAgC,SAAS;EAGlD,KAAK,QAAQ,sBAAsB,aAAa,KAAK,KAAK;CAC5D;;;;;;;CAQA,AAAU,qBAAmC;EAC3C,MAAM,kBAAgC,CAAC;EAGvC,IAAI,KAAK,MAAM,YACb,gBAAgB,KAAK,GAAG,KAAK,MAAM,UAAU;EAG/C,OAAO;CACT;;;;CAKA,AAAO,MAAM,KAAa,cAAoB;EAC5C,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY;CAChD;;;;CAKA,AAAO,MAAM,MAAc,SAAS,eAAuB,IAAY;EACrE,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC,EAAE,YAAY,KAAK;CACzD;;;;CAKA,AAAO,IAAI,KAAa,cAAoB;EAC1C,OAAO,KAAK,MAAM,KAAK,YAAY;CACrC;;;;CAKA,AAAO,IAAI,KAAa;EACtB,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,MAAS,MAAM;CACnD;;;;CAKA,AAAO,IAAI,KAAa,OAAY;EAClC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,WAAW,KAAa,OAAY;EACzC,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAE1B,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,MAAM,GAAG,MAAgB;EAC9B,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EAE/C,OAAO;CACT;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,QAAQ,KAAa,OAAY;EACtC,IAAI,KAAK,QAAQ,MAAM,KAAK,KAAK;EAEjC,OAAO;CACT;;;;CAKA,IAAW,aAAa;EACtB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAM,aAAkB,CAAC;EAEzB,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,QAAQ,MAAM,WAAW;GAEnC,WAAW,OAAO;EACpB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,KAAuC;EAGjD,OAFa,KAAK,MAAM,GAEd;CACZ;;;;;CAMA,AAAO,MAAM,MAA8B;EACzC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC;CAC9B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,QAAQ,KAAK,KAAK;EAEnC,OAAO;CACT;;;;CAKA,IAAW,QAAQ;EACjB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK,KAAK;EAElC,OAAO;CACT;;;;CAKA,AAAO,MAAM;EACX,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,kBAAkB;EACvB,OAAO;GACL,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAO,oBAAoB;EACzB,MAAM,SAAS,KAAK,gBAAgB;EAEpC,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,QAAQ;EACb,MAAM,SAAS,KAAK,IAAI;EAExB,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAgB;EAC1B,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;CAC9B;;;;CAKA,AAAO,MAAM,MAAgB;EAC3B,MAAM,OAAO,KAAK,KAAK,IAAI;EAE3B,KAAK,MAAM,GAAG,IAAI;EAElB,OAAO;CACT;;;;CAKA,AAAO,OAAO,MAAgB;EAC5B,OAAO,OAAO,KAAK,IAAI,GAAG,IAAI;CAChC;;;;CAKA,AAAO,KAAK,KAAa,eAAe,OAAO;EAC7C,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,UAAU,QACZ,OAAO;EAGT,IAAI,UAAU,SACZ,OAAO;EAGT,IAAI,UAAU,GACZ,OAAO;EAGT,OAAO,QAAQ,KAAK;CACtB;;;;CAKA,AAAO,IAAI,KAAa,eAAuB,GAAuB;EACpE,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,CAAC,SAAS,UAAU,GAAG,OAAO;EAElC,OAAO,SAAS,KAAK;CACvB;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,IAAI,IAAI;CACtB;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,IAAY;EAC5D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,OAAO,KAAK;CACrB;;;;CAKA,AAAO,MAAM,KAAa,eAAuB,GAAW;EAC1D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,WAAW,KAAK,KAAK;CAC9B;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,GAAW;EAC3D,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;EAElD,OAAO,MAAM,KAAK,IAAI,eAAe;CACvC;;;;;;;;;;CAWA,IAAW,KAAK;EACd,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;CAYA,AAAO,WAAW;EAKhB,MAAM,SAAS,KAAK,OAAO,WAAW;EAEtC,IAAI,QAAQ,OAAO;EAInB,OAFoB,KAAK,OAAO,iBAEf,KAAK,KAAK,YAAY;CACzC;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,SAAS;CACvB;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,YAAY;EACrB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,UAA2C;EACpD,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAO,UAAU,KAAiB,OAAe;EAC/C,KAAK,YAAY,QAAQ,IAAI,YAAY,KAAK;EAE9C,OAAO;CACT;AACF"}
+{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/request.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport events from \"@mongez/events\";\nimport { trans, transFrom } from \"@mongez/localization\";\nimport { Random, except, get, only, rtrim, set, unset } from \"@mongez/reinforcements\";\nimport { isEmpty } from \"@mongez/supportive-is\";\nimport type { LogLevel } from \"@warlock.js/logger\";\nimport { log } from \"@warlock.js/logger\";\nimport { BaseValidator, v } from \"@warlock.js/seal\";\nimport type { FastifyRequest } from \"fastify\";\nimport { type IncomingHttpHeaders } from \"node:http2\";\nimport { config } from \"../config/config-getter\";\nimport type { Middleware, Route } from \"../router\";\nimport { validateAll } from \"../validation/validateAll\";\nimport { createRequestStore } from \"./middleware/inject-request-context\";\nimport { Response } from \"./response\";\nimport type { RequestEvent } from \"./types\";\nimport { UploadedFile } from \"./uploaded-file\";\n\ntype StandardHeaders = {\n  // copy every declared property from http.IncomingHttpHeaders\n  // but remove index signatures\n  [K in keyof IncomingHttpHeaders as string extends K\n    ? never\n    : number extends K\n      ? never\n      : K]: IncomingHttpHeaders[K];\n};\n\ntype HeaderKeys = keyof StandardHeaders;\n\nexport class Request<RequestValidation = any> {\n  /**\n   * Underlying Fastify request — a public escape hatch to capabilities the\n   * framework's high-level helpers don't yet cover.\n   *\n   * **Prefer framework methods first**: `request.input()`, `request.header()`,\n   * `request.body`, `request.query`, `request.params`, `request.file()`,\n   * `request.user`, `request.detectIp()`, etc. They handle locale, parsing,\n   * trust-proxy, and validation pipeline integration correctly.\n   *\n   * **Reach for `baseRequest` only** when the framework genuinely lacks a\n   * helper for what you need — and when you do, file an issue so we can add\n   * it. The escape hatch is the release valve that lets consumers move\n   * faster than the framework, but every long-term reach here is a missing\n   * helper waiting to be added.\n   */\n  public baseRequest!: FastifyRequest;\n\n  /**\n   * Response Object\n   */\n  public response!: Response;\n\n  /**\n   * Route Object\n   */\n  public route!: Route;\n\n  /**\n   * Parsed Request Payload\n   */\n  protected payload: any = {};\n\n  /**\n   * Decoded access token payload (set by auth middleware)\n   */\n  public decodedAccessToken?: any;\n\n  /**\n   * Current request instance\n   */\n  public static current: Request;\n\n  /**\n   * Translation method\n   * Type of it is the same as the type of trans function\n   */\n  public trans: ReturnType<typeof trans> = trans;\n\n  /**\n   * Alias to trans method\n   */\n  public t: ReturnType<typeof trans> = trans;\n\n  /**\n   * Dynamic properties index signature\n   *\n   * This allows attaching custom properties to the request instance,\n   * commonly used during validation middleware to attach fetched models.\n   *\n   * @example\n   * // In validation middleware:\n   * const post = await Post.find(request.int(\"id\"));\n   * if (!post) return response.notFound();\n   * request.post = post; // Attach the model to the request\n   *\n   * // In route handler:\n   * const post = request.post;\n   * // Work with the pre-fetched model\n   */\n  [key: string]: any;\n\n  /**\n   * Locale code\n   */\n  protected _locale = \"\";\n\n  /**\n   * Validated data\n   */\n  protected validatedData?: RequestValidation;\n\n  /**\n   * Request id\n   */\n  public id = Random.string(32);\n\n  /**\n   * Start Time\n   */\n  public startTime = Date.now();\n\n  /**\n   * End Time\n   */\n  public endTime?: undefined | number;\n\n  /**\n   * Set request handler\n   */\n  public setRequest(request: FastifyRequest) {\n    this.baseRequest = request;\n\n    this.resolveRequestId();\n\n    this.parsePayload();\n\n    const localeCode = this.getLocaleCode();\n\n    this.trans = this.t = transFrom.bind(null, localeCode);\n\n    return this;\n  }\n\n  /**\n   * Inherit `X-Request-Id` from the incoming request, fall back to a custom\n   * generator, then to the field-init default (`Random.string(32)`).\n   *\n   * Inherited values are validated (length cap + printable-ASCII) to prevent\n   * log-injection from a malicious client. Disable the whole behavior by\n   * setting `http.requestId.enabled = false` — in which case the field-init\n   * default is used regardless of any incoming header.\n   */\n  protected resolveRequestId() {\n    const requestIdConfig = config.key(\"http.requestId\") || {};\n\n    if (requestIdConfig.enabled === false) return;\n\n    const headerName = (requestIdConfig.header || \"x-request-id\").toLowerCase();\n    const incoming = this.baseRequest.headers[headerName];\n\n    if (Request.isValidRequestId(incoming)) {\n      this.id = incoming;\n\n      return;\n    }\n\n    if (typeof requestIdConfig.generator === \"function\") {\n      this.id = requestIdConfig.generator();\n    }\n  }\n\n  /**\n   * Validate a candidate request-id value. Accepts non-empty printable ASCII\n   * up to 128 characters — tight enough to reject newline / control-character\n   * log-injection, loose enough to accept UUIDs, ULIDs, snowflakes, etc.\n   */\n  protected static isValidRequestId(value: unknown): value is string {\n    return (\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= 128 &&\n      /^[\\x21-\\x7e]+$/.test(value)\n    );\n  }\n\n  /**\n   * Translate from the given locale code\n   */\n  public transFrom(localeCode: string, keyword: string, placeholders?: any) {\n    return transFrom(localeCode, keyword, placeholders);\n  }\n\n  /**\n   * Get current locale code\n   */\n  public get locale() {\n    if (this._locale) return this._locale;\n\n    return this.header(\"translation-locale-code\") || this.localized;\n  }\n\n  /**\n   * Set locale code\n   */\n  public set locale(localeCode: string) {\n    this._locale = localeCode;\n  }\n\n  /**\n   * Get locale code that will be used for translation\n   */\n  public get localized() {\n    if (this._locale) return this._locale;\n\n    return (this._locale = this.header(\"locale\") || this.query[\"locale\"]);\n  }\n\n  /**\n   * Set locale code\n   */\n  public setLocaleCode(localeCode: string) {\n    this._locale = localeCode;\n\n    return this;\n  }\n\n  /**\n   * Get current locale code or return default locale code\n   */\n  public getLocaleCode(defaultLocaleCode: string = config.key(\"app.localeCode\") || \"en\") {\n    return this.locale || defaultLocaleCode;\n  }\n\n  /**\n   * Get http protocol\n   */\n  public get protocol() {\n    return this.baseRequest.protocol;\n  }\n\n  /**\n   * Validate the given validation schema\n   */\n  public async validate(validation: BaseValidator, selectedInputs?: string[]) {\n    return await v.validate(validation, selectedInputs ? this.only(selectedInputs) : this.all());\n  }\n\n  /**\n   * Clear current user\n   */\n  public clearCurrentUser() {\n    this.user = undefined;\n  }\n\n  /**\n   * Get value of the given header\n   */\n  public header<TCustomHeader extends string = HeaderKeys>(\n    name: TCustomHeader | HeaderKeys,\n    defaultValue: any = null,\n  ) {\n    return this.baseRequest.headers[name.toLocaleLowerCase()] ?? defaultValue;\n  }\n\n  /**\n   * Get all cookies from the current request\n   */\n  public get cookies(): Record<string, string | undefined> {\n    return this.baseRequest.cookies || {};\n  }\n\n  /**\n   * Get a particular cookie value or fallback to default\n   */\n  public cookie(name: string, defaultValue?: any): string | any {\n    const value = this.cookies[name] ?? defaultValue;\n\n    try {\n      return JSON.parse(value);\n    } catch (error) {\n      return value;\n    }\n  }\n\n  /**\n   * Determine if the request has the specified cookie\n   */\n  public hasCookie(name: string): boolean {\n    return this.cookies[name] !== undefined;\n  }\n\n  /**\n   * Get the current request domain\n   */\n  public get domain() {\n    return this.baseRequest.hostname.replace(/^www\\./, \"\");\n  }\n\n  /**\n   * Get hostname\n   */\n  public get hostname() {\n    return this.domain;\n  }\n\n  /**\n   * Get request origin\n   */\n  public get origin() {\n    return this.baseRequest.headers.origin as string;\n  }\n\n  /**\n   * Get the domain of the origin\n   */\n  public get originDomain() {\n    const domain = this.origin ? new URL(this.origin).hostname : null;\n\n    if (domain?.startsWith(\"www.\")) {\n      return domain.replace(/^www\\./, \"\");\n    }\n\n    return domain;\n  }\n\n  /**\n   * Get authorization header value\n   */\n  public get authorizationValue(): string {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return \"\";\n\n    const [type, value] = authorization.split(\" \");\n\n    if (![\"bearer\", \"key\"].includes(type.toLowerCase())) return \"\";\n\n    return value || \"\";\n  }\n\n  /**\n   * Get access token from Authorization header\n   *\n   * If the Authorization header does not start with `Bearer` value then return null\n   */\n  public get accessToken(): string | undefined {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return;\n\n    const [type, value] = authorization.split(\" \");\n\n    if (type.toLowerCase() !== \"bearer\") return;\n\n    return value;\n  }\n\n  /**\n   * Get the authorization header\n   */\n  public get authorization() {\n    return this.header(\"authorization\");\n  }\n\n  /**\n   * Get current request method\n   */\n  public get method(): string {\n    return this.baseRequest.method;\n  }\n\n  /**\n   * Parse the payload and merge it from the request body, params and query string\n   */\n  protected parsePayload() {\n    this.payload.body = this.parseBody(this.baseRequest.body);\n\n    this.payload.query = this.parseBody(this.baseRequest.query);\n    this.payload.params = { ...(this.baseRequest.params || {}) };\n    this.payload.all = {\n      ...this.payload.body,\n      ...this.payload.query,\n      ...this.payload.params,\n    };\n  }\n\n  /**\n   * Parse body payload\n   */\n  protected parseBody(data: any) {\n    try {\n      if (!data) return {};\n\n      const body: any = {};\n\n      const arrayOfObjectValues: any = {};\n\n      for (let key in data) {\n        const value = data[key];\n\n        let isArrayKey = false;\n\n        if (key.endsWith(\"[]\")) {\n          isArrayKey = true;\n        }\n\n        key = rtrim(key, \"[]\");\n\n        // check if the key is has a square brackets, then convert it into object\n        // i.e user[email] => user: {email: \"value\"}\n        // also check if its an array of objects\n\n        if (key.includes(\"[\")) {\n          // check if its an array of objects\n          if (key.includes(\"][\")) {\n            const keyParts = key.split(\"[\");\n\n            const keyName = keyParts[0];\n            if (!arrayOfObjectValues[keyName]) {\n              arrayOfObjectValues[keyName] = [];\n            }\n\n            const keyNameParts = keyParts[1].split(\"]\");\n\n            const index = Number(keyNameParts[0]);\n\n            if (!arrayOfObjectValues[keyName][index]) {\n              arrayOfObjectValues[keyName][index] = {};\n            }\n\n            // now get the key after the index\n            const keyNameParts2 = keyParts[2].split(\"]\");\n            const keyName2 = keyNameParts2[0];\n\n            arrayOfObjectValues[keyName][index][keyName2] = this.parseValue(value);\n\n            continue;\n          }\n\n          const keyParts = key.split(\"[\");\n          const keyName = keyParts[0];\n          const keyNameParts = keyParts[1].split(\"]\");\n\n          set(\n            body,\n            keyName + \".\" + keyNameParts[0],\n            Array.isArray(value) ? value.map(this.parseValue.bind(this)) : this.parseValue(value),\n          );\n\n          continue;\n        }\n\n        if (Array.isArray(value)) {\n          set(body, key, value.map(this.parseValue.bind(this)));\n        } else if (isArrayKey) {\n          if (body[key]) {\n            body[key].push(this.parseValue(value));\n          } else {\n            body[key] = [this.parseValue(value)];\n\n            continue;\n          }\n        } else {\n          set(body, key, this.parseValue(value));\n        }\n      }\n\n      // now merge the array of objects into the body\n      for (const key in arrayOfObjectValues) {\n        body[key] = arrayOfObjectValues[key];\n      }\n\n      return body;\n    } catch (error) {\n      console.log(error);\n      this.log(error, \"error\");\n    }\n  }\n\n  /**\n   * Parse the given data\n   */\n  protected parseValue(data: any) {\n    // data.value appears only in the multipart form data\n    // if it json, then just return the data\n    if (data?.file) return new UploadedFile(data);\n    if (data?.value !== undefined && data?.fields && data?.type) {\n      data = data.value;\n    }\n\n    if (data === \"false\") return false;\n\n    if (data === \"true\") return true;\n\n    if (data === \"null\") return null;\n\n    if (typeof data === \"string\") return data.trim();\n\n    return data;\n  }\n\n  /**\n   * Set route handler\n   */\n  public setRoute(route: Route) {\n    this.route = route;\n\n    // pass the route to the response object\n    this.response.setRoute(route);\n\n    return this;\n  }\n\n  /**\n   * Trigger an http event\n   */\n  public trigger(eventName: RequestEvent, ...args: any[]) {\n    return events.trigger(`request.${eventName}`, ...args, this);\n  }\n\n  /**\n   * Listen to the given event\n   */\n  public on(eventName: RequestEvent, callback: any) {\n    return this.subscribe(eventName, callback);\n  }\n\n  /**\n   * Make a log message\n   */\n  public log(message: any, level: LogLevel = \"info\") {\n    if (!config.key(\"http.log\")) return;\n\n    log.log({\n      module: \"request\",\n      action: this.route.method + \" \" + this.route.path.replace(\"/*\", \"\") + `:${this.id}`,\n      message,\n      type: level,\n      context: {\n        request: this,\n      },\n    });\n  }\n\n  /**\n   * Get current request path\n   */\n  public get path() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * {@alias}\n   */\n  public get url() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * Get full url\n   */\n  public get fullUrl() {\n    return this.protocol + \"://\" + this.hostname + this.path;\n  }\n\n  /**\n   * Drive the middleware chain for the current route, then defer to the\n   * controller. Returns the first response value any middleware short-circuits\n   * with, or `undefined` to continue into validation + handler.\n   *\n   * @internal Framework orchestration — do not call from app code. Will move\n   * to a dedicated controller dispatcher in a future refactor.\n   */\n  public async runMiddleware() {\n    // measure request time\n    // check for middleware first\n    const middlewareOutput = await this.executeMiddleware();\n\n    if (middlewareOutput !== undefined) {\n      // 👇🏻 make sure first its not a response instance\n      if (middlewareOutput instanceof Response) return middlewareOutput;\n      // 👇🏻 send the response\n      return this.response.send(middlewareOutput);\n    }\n\n    const handler = this.route.handler;\n\n    if (!handler.validation) return;\n\n    // 👇🏻 check for validation using validateAll helper function\n    const validationOutput = await validateAll(handler.validation, this, this.response);\n\n    return validationOutput;\n  }\n\n  /**\n   * Return the request handler attached to the current route.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  public getHandler() {\n    return this.route.handler;\n  }\n\n  /**\n   * Get inputs that has been validated only\n   * You can also pass an array of inputs to get only the validated inputs\n   */\n  public validated<Output = RequestValidation>(inputs?: (keyof Output | (string & {}))[]): Output {\n    if (this.validatedData) {\n      return inputs\n        ? only(this.validatedData as Output, inputs as string[])\n        : (this.validatedData as Output);\n    }\n\n    return {} as Output;\n  }\n\n  /**\n   * Get inputs that has been validated except the given inputs\n   */\n  public validatedExcept(...inputs: string[]): RequestValidation {\n    return except(this.validated(), inputs);\n  }\n\n  /**\n   * Set validated data\n   */\n  public setValidatedData(data: RequestValidation) {\n    this.validatedData = data;\n  }\n\n  /**\n   * Top-level entry into the request lifecycle — opens the context store,\n   * runs middleware, drives the handler, handles errors.\n   *\n   * @internal Framework orchestration — do not call from app code. Wired\n   * from the Fastify route handler in `router.scan()`.\n   */\n  public async execute() {\n    try {\n      // call executingAction event\n\n      this.log(\"Executing the request\");\n\n      return await createRequestStore(this, this.response);\n    } catch (error) {\n      this.log(error, \"error\");\n\n      throw error;\n    }\n  }\n\n  /**\n   * Iterate the collected middlewares in order; return the first short-circuit\n   * value or `undefined` when every middleware passes through.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected async executeMiddleware() {\n    // collect all middlewares for current route\n    const middlewares = this.collectMiddlewares();\n\n    // check if there are no middlewares, then return\n    if (middlewares.length === 0) return;\n\n    this.log(\"About to execute request middlewares\");\n\n    // trigger the executingMiddleware event\n    this.trigger(\"executingMiddleware\", middlewares, this.route);\n\n    for (const middleware of middlewares) {\n      this.log(\"Executing middleware \" + colors.yellowBright(middleware.name));\n      const output = await middleware(this, this.response);\n      this.log(\"Executed middleware \" + colors.yellowBright(middleware.name), \"success\");\n\n      if (output !== undefined) {\n        this.log(\n          colors.yellow(\"request intercepted by middleware \") + colors.cyanBright(middleware.name),\n          \"warn\",\n        );\n\n        this.trigger(\"executedMiddleware\");\n\n        this.log(\"Request middlewares executed\", \"success\");\n\n        return output;\n      }\n    }\n\n    this.log(\"Request middlewares executed\", \"success\");\n\n    // trigger the executedMiddleware event\n    this.trigger(\"executedMiddleware\", middlewares, this.route);\n  }\n\n  /**\n   * Gather the middleware list for the current route — today just the\n   * route-level array; future extraction may merge group + app-wide layers.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected collectMiddlewares(): Middleware[] {\n    const middlewaresList: Middleware[] = [];\n\n    // collect route middlewares\n    if (this.route.middleware) {\n      middlewaresList.push(...this.route.middleware);\n    }\n\n    return middlewaresList;\n  }\n\n  /**\n   * Get request input value from query string, params or body\n   */\n  public input(key: string, defaultValue?: any) {\n    return get(this.payload.all, key, defaultValue);\n  }\n\n  /**\n   * Get email input value, this will lowercase the value\n   */\n  public email(key: string = \"email\", defaultValue: string = \"\"): string {\n    return this.input(key, defaultValue)?.toLowerCase() || defaultValue;\n  }\n\n  /**\n   * @alias input\n   */\n  public get(key: string, defaultValue?: any) {\n    return this.input(key, defaultValue);\n  }\n\n  /**\n   * Determine if request has input value\n   */\n  public has(key: string) {\n    return get(this.payload.all, key, undefined) !== undefined;\n  }\n\n  /**\n   * Set request input value\n   */\n  public set(key: string, value: any) {\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Set the given value if the request does not have the input\n   */\n  public setDefault(key: string, value: any) {\n    if (this.has(key)) return this;\n\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Unset request payload keys\n   */\n  public unset(...keys: string[]) {\n    this.payload.all = unset(this.payload.all, keys);\n\n    return this;\n  }\n\n  /**\n   * Get request body\n   */\n  public get body() {\n    return this.payload.body;\n  }\n\n  /**\n   * Set request body value\n   */\n  public setBody(key: string, value: any) {\n    set(this.payload.body, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get body inputs except files\n   */\n  public get bodyInputs() {\n    const inputs = this.payload.body;\n\n    const bodyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (value.file && value.fieldname) continue;\n\n      bodyInputs[key] = value;\n    }\n\n    return bodyInputs;\n  }\n\n  /**\n   * Get request file in UploadedFile instance\n   */\n  public file(key: string): UploadedFile | undefined {\n    const file = this.input(key);\n\n    return file;\n  }\n\n  /**\n   * Get uploaded files from the request for the given name\n   * If the given name is not present in the request, return an empty array\n   */\n  public files(name: string): UploadedFile[] {\n    return this.input(name) || [];\n  }\n\n  /**\n   * Get request params\n   */\n  public get params() {\n    return this.payload.params;\n  }\n\n  /**\n   * Set request params value\n   */\n  public setParam(key: string, value: any) {\n    set(this.payload.params, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get request query\n   */\n  public get query() {\n    return this.payload.query;\n  }\n\n  /**\n   * Set request query value\n   */\n  public setQuery(key: string, value: any) {\n    set(this.payload.query, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get all inputs\n   */\n  public all() {\n    return this.payload.all;\n  }\n\n  /**\n   * Get all inputs except params\n   */\n  public allExceptParams() {\n    return {\n      ...this.payload.query,\n      ...this.payload.body,\n    };\n  }\n\n  /**\n   * Get all heavy inputs except params\n   */\n  public heavyExceptParams() {\n    const inputs = this.allExceptParams();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only heavy inputs, the input with a value\n   */\n  public heavy() {\n    const inputs = this.all();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only the given keys from the request data\n   */\n  public only(keys: string[]) {\n    return only(this.all(), keys);\n  }\n\n  /**\n   * Pluck the given keys from the request data\n   */\n  public pluck(keys: string[]) {\n    const data = this.only(keys);\n\n    this.unset(...keys);\n\n    return data;\n  }\n\n  /**\n   * Get all request inputs except the given keys\n   */\n  public except(keys: string[]) {\n    return except(this.all(), keys);\n  }\n\n  /**\n   * Get boolean input value\n   */\n  public bool(key: string, defaultValue = false) {\n    const value = this.input(key, defaultValue);\n\n    if (value === \"true\") {\n      return true;\n    }\n\n    if (value === \"false\") {\n      return false;\n    }\n\n    if (value === 0) {\n      return false;\n    }\n\n    return Boolean(value);\n  }\n\n  /**\n   * Get integer input value\n   */\n  public int(key: string, defaultValue: number = 0): number | undefined {\n    const value = this.input(key, defaultValue);\n\n    if (!value && value !== 0) return undefined;\n\n    return parseInt(value);\n  }\n\n  /**\n   * Shorthand getter to get id param\n   */\n  public get idParam() {\n    return this.int(\"id\");\n  }\n\n  /**\n   * Get string input value\n   */\n  public string(key: string, defaultValue: string = \"\"): string {\n    const value = this.input(key, defaultValue);\n\n    return String(value);\n  }\n\n  /**\n   * Get float input value\n   */\n  public float(key: string, defaultValue: number = 0): number {\n    const value = this.input(key, defaultValue);\n\n    return parseFloat(value) || 0;\n  }\n\n  /**\n   * Get number input value\n   */\n  public number(key: string, defaultValue: number = 0): number {\n    const value = Number(this.input(key, defaultValue));\n\n    return isNaN(value) ? defaultValue : value;\n  }\n\n  /**\n   * Immediate-peer IP as Fastify reports it — the address that connected to\n   * the server socket, with `trustProxy` resolution applied. Use this when\n   * you specifically need the peer address (rate-limit-by-direct-connection,\n   * health-check origin verification).\n   *\n   * **For most use cases prefer `request.detectIp()`** — behind any proxy\n   * (load balancer, CDN, sidecar) `ip` reports the proxy, not the real client.\n   */\n  public get ip() {\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * Best-effort real client IP — checks `X-Real-IP` and `X-Forwarded-For`\n   * headers first, falls back to `baseRequest.ip` when neither is present.\n   *\n   * For a multi-hop `X-Forwarded-For` (`client, proxy1, proxy2`) only the\n   * FIRST entry is returned (the original client), comma-split and trimmed.\n   * Without this, downstream scoping (ip-filter, rate-limit, idempotency)\n   * would key off the whole header string and break behind chained proxies.\n   *\n   * **Prefer this over `request.ip` for any caller behind a proxy** (load\n   * balancer, CDN, reverse proxy, k8s ingress). Only trust the result as\n   * far as you trust the upstream proxy chain — `X-Forwarded-For` is\n   * client-settable, so the leftmost entry is spoofable by the immediate\n   * client when the request did NOT pass through a trusted edge that\n   * appends/overwrites the header. Verify the request came through your\n   * trusted edge before treating the value as authoritative.\n   */\n  public detectIp() {\n    // as the server maybe used behind a proxy\n    // then we need to check first if there is a forwarded ip\n    // check for the real-ip header\n\n    const realIp = this.header(\"x-real-ip\");\n\n    if (realIp) return realIp;\n\n    const forwardedIp = this.header(\"x-forwarded-for\");\n\n    if (forwardedIp) {\n      // `X-Forwarded-For` may carry the full proxy chain (\"client, proxy1, ...\").\n      // The original client is the leftmost entry; split + trim so multi-hop\n      // values don't leak the whole header string into IP-scoped logic.\n      const firstHop = String(forwardedIp).split(\",\")[0].trim();\n\n      if (firstHop) return firstHop;\n    }\n\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * An alias to detectIp\n   */\n  public get realIp() {\n    return this.detectIp();\n  }\n\n  /**\n   * Get request ips\n   */\n  public get ips() {\n    return this.baseRequest.ips;\n  }\n\n  /**\n   * Get request referer\n   */\n  public get referer() {\n    return this.baseRequest.headers.referer;\n  }\n\n  /**\n   * Get user agent\n   */\n  public get userAgent() {\n    return this.baseRequest.headers[\"user-agent\"];\n  }\n\n  /**\n   * Get request headers\n   */\n  public get headers(): typeof this.baseRequest.headers {\n    return this.baseRequest.headers;\n  }\n\n  /**\n   * Set the given header\n   */\n  public setHeader(key: HeaderKeys, value: string) {\n    this.baseRequest.headers[key.toLowerCase()] = value;\n\n    return this;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AA8BA,IAAa,UAAb,MAAa,QAAiC;;iBA+BnB,CAAC;eAgBe;WAKJ;iBAuBjB;YAUR,OAAO,OAAO,EAAE;mBAKT,KAAK,IAAI;;;;;CAU5B,AAAO,WAAW,SAAyB;EACzC,KAAK,cAAc;EAEnB,KAAK,iBAAiB;EAEtB,KAAK,aAAa;EAElB,MAAM,aAAa,KAAK,cAAc;EAEtC,KAAK,QAAQ,KAAK,IAAI,UAAU,KAAK,MAAM,UAAU;EAErD,OAAO;CACT;;;;;;;;;;CAWA,AAAU,mBAAmB;EAC3B,MAAM,kBAAkB,OAAO,IAAI,gBAAgB,KAAK,CAAC;EAEzD,IAAI,gBAAgB,YAAY,OAAO;EAEvC,MAAM,cAAc,gBAAgB,UAAU,eAAc,CAAE,YAAY;EAC1E,MAAM,WAAW,KAAK,YAAY,QAAQ;EAE1C,IAAI,QAAQ,iBAAiB,QAAQ,GAAG;GACtC,KAAK,KAAK;GAEV;EACF;EAEA,IAAI,OAAO,gBAAgB,cAAc,YACvC,KAAK,KAAK,gBAAgB,UAAU;CAExC;;;;;;CAOA,OAAiB,iBAAiB,OAAiC;EACjE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,OAChB,iBAAiB,KAAK,KAAK;CAE/B;;;;CAKA,AAAO,UAAU,YAAoB,SAAiB,cAAoB;EACxE,OAAO,UAAU,YAAY,SAAS,YAAY;CACpD;;;;CAKA,IAAW,SAAS;EAClB,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAO,KAAK,OAAO,yBAAyB,KAAK,KAAK;CACxD;;;;CAKA,IAAW,OAAO,YAAoB;EACpC,KAAK,UAAU;CACjB;;;;CAKA,IAAW,YAAY;EACrB,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAQ,KAAK,UAAU,KAAK,OAAO,QAAQ,KAAK,KAAK,MAAM;CAC7D;;;;CAKA,AAAO,cAAc,YAAoB;EACvC,KAAK,UAAU;EAEf,OAAO;CACT;;;;CAKA,AAAO,cAAc,oBAA4B,OAAO,IAAI,gBAAgB,KAAK,MAAM;EACrF,OAAO,KAAK,UAAU;CACxB;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,MAAa,SAAS,YAA2B,gBAA2B;EAC1E,OAAO,MAAM,EAAE,SAAS,YAAY,iBAAiB,KAAK,KAAK,cAAc,IAAI,KAAK,IAAI,CAAC;CAC7F;;;;CAKA,AAAO,mBAAmB;EACxB,KAAK,OAAO;CACd;;;;CAKA,AAAO,OACL,MACA,eAAoB,MACpB;EACA,OAAO,KAAK,YAAY,QAAQ,KAAK,kBAAkB,MAAM;CAC/D;;;;CAKA,IAAW,UAA8C;EACvD,OAAO,KAAK,YAAY,WAAW,CAAC;CACtC;;;;CAKA,AAAO,OAAO,MAAc,cAAkC;EAC5D,MAAM,QAAQ,KAAK,QAAQ,SAAS;EAEpC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,SAAS,OAAO;GACd,OAAO;EACT;CACF;;;;CAKA,AAAO,UAAU,MAAuB;EACtC,OAAO,KAAK,QAAQ,UAAU;CAChC;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,SAAS,QAAQ,UAAU,EAAE;CACvD;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK;CACd;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,eAAe;EACxB,MAAM,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,WAAW;EAE7D,IAAI,QAAQ,WAAW,MAAM,GAC3B,OAAO,OAAO,QAAQ,UAAU,EAAE;EAGpC,OAAO;CACT;;;;CAKA,IAAW,qBAA6B;EACtC,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe,OAAO;EAE3B,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG,OAAO;EAE5D,OAAO,SAAS;CAClB;;;;;;CAOA,IAAW,cAAkC;EAC3C,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe;EAEpB,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,KAAK,YAAY,MAAM,UAAU;EAErC,OAAO;CACT;;;;CAKA,IAAW,gBAAgB;EACzB,OAAO,KAAK,OAAO,eAAe;CACpC;;;;CAKA,IAAW,SAAiB;EAC1B,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAU,eAAe;EACvB,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,YAAY,IAAI;EAExD,KAAK,QAAQ,QAAQ,KAAK,UAAU,KAAK,YAAY,KAAK;EAC1D,KAAK,QAAQ,SAAS,EAAE,GAAI,KAAK,YAAY,UAAU,CAAC,EAAG;EAC3D,KAAK,QAAQ,MAAM;GACjB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAU,UAAU,MAAW;EAC7B,IAAI;GACF,IAAI,CAAC,MAAM,OAAO,CAAC;GAEnB,MAAM,OAAY,CAAC;GAEnB,MAAM,sBAA2B,CAAC;GAElC,KAAK,IAAI,OAAO,MAAM;IACpB,MAAM,QAAQ,KAAK;IAEnB,IAAI,aAAa;IAEjB,IAAI,IAAI,SAAS,IAAI,GACnB,aAAa;IAGf,MAAM,MAAM,KAAK,IAAI;IAMrB,IAAI,IAAI,SAAS,GAAG,GAAG;KAErB,IAAI,IAAI,SAAS,IAAI,GAAG;MACtB,MAAM,WAAW,IAAI,MAAM,GAAG;MAE9B,MAAM,UAAU,SAAS;MACzB,IAAI,CAAC,oBAAoB,UACvB,oBAAoB,WAAW,CAAC;MAGlC,MAAM,eAAe,SAAS,EAAE,CAAC,MAAM,GAAG;MAE1C,MAAM,QAAQ,OAAO,aAAa,EAAE;MAEpC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,QAChC,oBAAoB,QAAQ,CAAC,SAAS,CAAC;MAKzC,MAAM,WADgB,SAAS,EAAE,CAAC,MAAM,GACX,CAAC,CAAC;MAE/B,oBAAoB,QAAQ,CAAC,MAAM,CAAC,YAAY,KAAK,WAAW,KAAK;MAErE;KACF;KAEA,MAAM,WAAW,IAAI,MAAM,GAAG;KAC9B,MAAM,UAAU,SAAS;KACzB,MAAM,eAAe,SAAS,EAAE,CAAC,MAAM,GAAG;KAE1C,IACE,MACA,UAAU,MAAM,aAAa,IAC7B,MAAM,QAAQ,KAAK,IAAI,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,IAAI,KAAK,WAAW,KAAK,CACtF;KAEA;IACF;IAEA,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,CAAC;SAC/C,IAAI,YACT,IAAI,KAAK,MACP,KAAK,IAAI,CAAC,KAAK,KAAK,WAAW,KAAK,CAAC;SAChC;KACL,KAAK,OAAO,CAAC,KAAK,WAAW,KAAK,CAAC;KAEnC;IACF;SAEA,IAAI,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;GAEzC;GAGA,KAAK,MAAM,OAAO,qBAChB,KAAK,OAAO,oBAAoB;GAGlC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,KAAK;GACjB,KAAK,IAAI,OAAO,OAAO;EACzB;CACF;;;;CAKA,AAAU,WAAW,MAAW;EAG9B,IAAI,MAAM,MAAM,OAAO,IAAI,aAAa,IAAI;EAC5C,IAAI,MAAM,UAAU,UAAa,MAAM,UAAU,MAAM,MACrD,OAAO,KAAK;EAGd,IAAI,SAAS,SAAS,OAAO;EAE7B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,OAAO,SAAS,UAAU,OAAO,KAAK,KAAK;EAE/C,OAAO;CACT;;;;CAKA,AAAO,SAAS,OAAc;EAC5B,KAAK,QAAQ;EAGb,KAAK,SAAS,SAAS,KAAK;EAE5B,OAAO;CACT;;;;CAKA,AAAO,QAAQ,WAAyB,GAAG,MAAa;EACtD,OAAO,OAAO,QAAQ,WAAW,aAAa,GAAG,MAAM,IAAI;CAC7D;;;;CAKA,AAAO,GAAG,WAAyB,UAAe;EAChD,OAAO,KAAK,UAAU,WAAW,QAAQ;CAC3C;;;;CAKA,AAAO,IAAI,SAAc,QAAkB,QAAQ;EACjD,IAAI,CAAC,OAAO,IAAI,UAAU,GAAG;EAE7B,IAAI,IAAI;GACN,QAAQ;GACR,QAAQ,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK,QAAQ,MAAM,EAAE,IAAI,IAAI,KAAK;GAC/E;GACA,MAAM;GACN,SAAS,EACP,SAAS,KACX;EACF,CAAC;CACH;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,KAAK;CACtD;;;;;;;;;CAUA,MAAa,gBAAgB;EAG3B,MAAM,mBAAmB,MAAM,KAAK,kBAAkB;EAEtD,IAAI,qBAAqB,QAAW;GAElC,IAAI,4BAA4B,UAAU,OAAO;GAEjD,OAAO,KAAK,SAAS,KAAK,gBAAgB;EAC5C;EAEA,MAAM,UAAU,KAAK,MAAM;EAE3B,IAAI,CAAC,QAAQ,YAAY;EAKzB,OAAO,MAFwB,YAAY,QAAQ,YAAY,MAAM,KAAK,QAAQ;CAGpF;;;;;;CAOA,AAAO,aAAa;EAClB,OAAO,KAAK,MAAM;CACpB;;;;;CAMA,AAAO,UAAsC,QAAmD;EAC9F,IAAI,KAAK,eACP,OAAO,SACH,KAAK,KAAK,eAAyB,MAAkB,IACpD,KAAK;EAGZ,OAAO,CAAC;CACV;;;;CAKA,AAAO,gBAAgB,GAAG,QAAqC;EAC7D,OAAO,OAAO,KAAK,UAAU,GAAG,MAAM;CACxC;;;;CAKA,AAAO,iBAAiB,MAAyB;EAC/C,KAAK,gBAAgB;CACvB;;;;;;;;CASA,MAAa,UAAU;EACrB,IAAI;GAGF,KAAK,IAAI,uBAAuB;GAEhC,OAAO,MAAM,mBAAmB,MAAM,KAAK,QAAQ;EACrD,SAAS,OAAO;GACd,KAAK,IAAI,OAAO,OAAO;GAEvB,MAAM;EACR;CACF;;;;;;;CAQA,MAAgB,oBAAoB;EAElC,MAAM,cAAc,KAAK,mBAAmB;EAG5C,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,IAAI,sCAAsC;EAG/C,KAAK,QAAQ,uBAAuB,aAAa,KAAK,KAAK;EAE3D,KAAK,MAAM,cAAc,aAAa;GACpC,KAAK,IAAI,0BAA0B,OAAO,aAAa,WAAW,IAAI,CAAC;GACvE,MAAM,SAAS,MAAM,WAAW,MAAM,KAAK,QAAQ;GACnD,KAAK,IAAI,yBAAyB,OAAO,aAAa,WAAW,IAAI,GAAG,SAAS;GAEjF,IAAI,WAAW,QAAW;IACxB,KAAK,IACH,OAAO,OAAO,oCAAoC,IAAI,OAAO,WAAW,WAAW,IAAI,GACvF,MACF;IAEA,KAAK,QAAQ,oBAAoB;IAEjC,KAAK,IAAI,gCAAgC,SAAS;IAElD,OAAO;GACT;EACF;EAEA,KAAK,IAAI,gCAAgC,SAAS;EAGlD,KAAK,QAAQ,sBAAsB,aAAa,KAAK,KAAK;CAC5D;;;;;;;CAQA,AAAU,qBAAmC;EAC3C,MAAM,kBAAgC,CAAC;EAGvC,IAAI,KAAK,MAAM,YACb,gBAAgB,KAAK,GAAG,KAAK,MAAM,UAAU;EAG/C,OAAO;CACT;;;;CAKA,AAAO,MAAM,KAAa,cAAoB;EAC5C,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY;CAChD;;;;CAKA,AAAO,MAAM,MAAc,SAAS,eAAuB,IAAY;EACrE,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC,EAAE,YAAY,KAAK;CACzD;;;;CAKA,AAAO,IAAI,KAAa,cAAoB;EAC1C,OAAO,KAAK,MAAM,KAAK,YAAY;CACrC;;;;CAKA,AAAO,IAAI,KAAa;EACtB,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,MAAS,MAAM;CACnD;;;;CAKA,AAAO,IAAI,KAAa,OAAY;EAClC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,WAAW,KAAa,OAAY;EACzC,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAE1B,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,MAAM,GAAG,MAAgB;EAC9B,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EAE/C,OAAO;CACT;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,QAAQ,KAAa,OAAY;EACtC,IAAI,KAAK,QAAQ,MAAM,KAAK,KAAK;EAEjC,OAAO;CACT;;;;CAKA,IAAW,aAAa;EACtB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAM,aAAkB,CAAC;EAEzB,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,QAAQ,MAAM,WAAW;GAEnC,WAAW,OAAO;EACpB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,KAAuC;EAGjD,OAFa,KAAK,MAAM,GAEd;CACZ;;;;;CAMA,AAAO,MAAM,MAA8B;EACzC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC;CAC9B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,QAAQ,KAAK,KAAK;EAEnC,OAAO;CACT;;;;CAKA,IAAW,QAAQ;EACjB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK,KAAK;EAElC,OAAO;CACT;;;;CAKA,AAAO,MAAM;EACX,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,kBAAkB;EACvB,OAAO;GACL,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAO,oBAAoB;EACzB,MAAM,SAAS,KAAK,gBAAgB;EAEpC,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,QAAQ;EACb,MAAM,SAAS,KAAK,IAAI;EAExB,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAgB;EAC1B,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;CAC9B;;;;CAKA,AAAO,MAAM,MAAgB;EAC3B,MAAM,OAAO,KAAK,KAAK,IAAI;EAE3B,KAAK,MAAM,GAAG,IAAI;EAElB,OAAO;CACT;;;;CAKA,AAAO,OAAO,MAAgB;EAC5B,OAAO,OAAO,KAAK,IAAI,GAAG,IAAI;CAChC;;;;CAKA,AAAO,KAAK,KAAa,eAAe,OAAO;EAC7C,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,UAAU,QACZ,OAAO;EAGT,IAAI,UAAU,SACZ,OAAO;EAGT,IAAI,UAAU,GACZ,OAAO;EAGT,OAAO,QAAQ,KAAK;CACtB;;;;CAKA,AAAO,IAAI,KAAa,eAAuB,GAAuB;EACpE,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,CAAC,SAAS,UAAU,GAAG,OAAO;EAElC,OAAO,SAAS,KAAK;CACvB;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,IAAI,IAAI;CACtB;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,IAAY;EAC5D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,OAAO,KAAK;CACrB;;;;CAKA,AAAO,MAAM,KAAa,eAAuB,GAAW;EAC1D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,WAAW,KAAK,KAAK;CAC9B;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,GAAW;EAC3D,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;EAElD,OAAO,MAAM,KAAK,IAAI,eAAe;CACvC;;;;;;;;;;CAWA,IAAW,KAAK;EACd,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;;;;;;;;CAmBA,AAAO,WAAW;EAKhB,MAAM,SAAS,KAAK,OAAO,WAAW;EAEtC,IAAI,QAAQ,OAAO;EAEnB,MAAM,cAAc,KAAK,OAAO,iBAAiB;EAEjD,IAAI,aAAa;GAIf,MAAM,WAAW,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;GAExD,IAAI,UAAU,OAAO;EACvB;EAEA,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,SAAS;CACvB;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,YAAY;EACrB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,UAA2C;EACpD,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAO,UAAU,KAAiB,OAAe;EAC/C,KAAK,YAAY,QAAQ,IAAI,YAAY,KAAK;EAE9C,OAAO;CACT;AACF"}

package/esm/http/response.d.mts

@@ -406,6 +406,18 @@ declare class Response {
    * Apply response options (cache, disposition, etag)
    * Shared helper for sendFile and sendBuffer
    */
+  /**
+   * Build an RFC 6266–safe `Content-Disposition` value for a file name.
+   *
+   * HTTP header values must be ISO-8859-1; Node's `setHeader` throws
+   * `ERR_INVALID_CHAR` on any other byte, so a raw `filename="تقرير.pdf"` would
+   * crash the response (a 500 the moment the name is non-ASCII). RFC 6266 solves
+   * this with two parameters emitted together:
+   *   - `filename="<ascii>"`     — sanitised ASCII fallback for legacy clients
+   *   - `filename*=UTF-8''<pct>` — RFC 5987 ext-value; modern browsers restore
+   *                                the real (e.g. Arabic) name.
+   */
+  private contentDisposition;
   private applyResponseOptions;
   /**
    * Send a file as a response

package/esm/http/response.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"response.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/response.ts"],"mappings":";;;;;;;;;;;;KAqBK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFoB;;;;AAEpB;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AAAA,cAGW,QAAA;EAAQ;;;EAAA,UAIT,KAAA,EAAQ,KAAA;EAiCD;;;;;;;;;;;;;;;;EAfV,YAAA,EAAe,YAAA;EAsauB;;;EAAA,UAjanC,iBAAA;EAwamE;;;EAAA,UAnanE,WAAA;EAibmC;;;EA5atC,OAAA,EAAU,OAAA;EA0vBA;;;EAAA,UArvBP,MAAA,EAAM,GAAA;EA6yB2B;;;;;EAtyBpC,UAAA;EAy0B4B;;;EAAA,IAp0BxB,GAAA,wBAAG,cAAA,qBAAA,eAAA;EAy1BX;;;EAAA,IAl1BQ,IAAA;EAi2BqB;;;EAAA,IA11BrB,IAAA,CAAK,IAAA;EAw2B4B;;;EAj2BrC,SAAA,CAAU,QAAA;EAu3ByC;;;EA92BnD,MAAA,CAAO,QAAA;EA63BsB;;;EAp3B7B,WAAA,CAAY,QAAA,EAAU,YAAA;EAq6B2D;;;EAt5BjF,KAAA;EA4+B+D;;;EAn+B/D,QAAA,CAAS,KAAA,EAAO,KAAA;EA8hCc;;;EAAA,IArhC1B,WAAA;EA4hCoC;;;EArhCxC,cAAA,CAAe,WAAA;EAilCsB;;;EAAA,IAxkCjC,UAAA;EA1ID;;;EAAA,IAiJC,IAAA;EA1HD;;;EAAA,IAiIC,IAAA;EAlHD;;;EAAA,OAyHI,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAhHW;;;EAAA,iBAuHS,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EAzGnD;;;EAAA,UAsHA,SAAA,IAAS,OAAA;EAtGX;;;EA6GD,KAAA,CAAM,KAAA,QAAa,OAAA;EArFzB;;;EA4HA,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EA1GxB;;;EAAA,IA4HA,MAAA;EArGA;;;;;;EA+GE,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EA/FhF;;;;;;;;;;;;;;;;;;;EA+PK,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAHV;;;EAsBK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAxB/B;;;EA+BP,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EAPjE;;;EAcL,GAAA,CAAI,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAPrC;;;EAcA,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAdK;;;;;;;;;;;;;;;;;;;EAqC3C,MAAA,CAAO,WAAA,YAA6B,wBAAA;EAqQpC;;;;;;;;;;;;;;;;;;;;;;;;EAtIA,GAAA,IAAO,qBAAA;EA6N2C;;;EAvFlD,aAAA,CAAc,UAAA;EA0GsB;;;EAjGpC,QAAA,CAAS,GAAA,UAAa,UAAA;EA2GC;;;EAlGvB,iBAAA,CAAkB,GAAA;EAyGG;;;EAhGrB,eAAA;EA0GJ;;;EAnGI,YAAA,CAAa,GAAA;EA2Ge;;;EAlG5B,SAAA,CAAU,GAAA;EA4Gd;;;EArGI,UAAA,IAAU,MAAA,+BAAA,UAAA;EAgHd;;;EAzGI,OAAA,CAAQ,OAAA,EAAS,MAAA;EAiHG;;;EAxGpB,MAAA,CAAO,GAAA,UAAa,KAAA;EA+GK;;;;;;;;;;;;;;;EA1FzB,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA+GzC;;;;;;EA5FT,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EA2G3B;;;EAjGT,SAAA,CAAU,GAAA,UAAa,KAAA;EAwGP;;;EAjGhB,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;EAyGD;;;EAlGpB,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EAgJU;;;EAxIN,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;EAwImB;;;EAjI/C,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EAoNuB;;;EA5MnB,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EAyMmE;;;EAjM/D,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;EAiM2C;;;EA1L/D,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EA4MnB;;;EArMN,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;EAuMmC;;;EAhM1D,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;EAuOP;;;EAhO9B,SAAA,IAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EAgOsD;;;;EAxN/D,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;EA+N3B;;;EAxNxC,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;EA+NG;;;EAxNtD,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EA6QzB;;;;EArQA,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;EAqQQ;AAAA;;;EAAA,QA7PpC,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EAsFjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EA6CtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}
+{"version":3,"file":"response.d.mts","names":[],"sources":["../../../../../../../@warlock.js/core/src/http/response.ts"],"mappings":";;;;;;;;;;;;KAqBK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFoB;;;;AAEpB;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AAAA,cAGW,QAAA;EAAQ;;;EAAA,UAIT,KAAA,EAAQ,KAAA;EAiCD;;;;;;;;;;;;;;;;EAfV,YAAA,EAAe,YAAA;EAsauB;;;EAAA,UAjanC,iBAAA;EAwamE;;;EAAA,UAnanE,WAAA;EAibmC;;;EA5atC,OAAA,EAAU,OAAA;EA0vBA;;;EAAA,UArvBP,MAAA,EAAM,GAAA;EA6yB2B;;;;;EAtyBpC,UAAA;EAy0B4B;;;EAAA,IAp0BxB,GAAA,wBAAG,cAAA,qBAAA,eAAA;EAy1BX;;;EAAA,IAl1BQ,IAAA;EAi2BqB;;;EAAA,IA11BrB,IAAA,CAAK,IAAA;EAw2B4B;;;EAj2BrC,SAAA,CAAU,QAAA;EAu3ByC;;;EA92BnD,MAAA,CAAO,QAAA;EA63BsB;;;EAp3B7B,WAAA,CAAY,QAAA,EAAU,YAAA;EA28B2D;;;EA57BjF,KAAA;EAkhC+D;;;EAzgC/D,QAAA,CAAS,KAAA,EAAO,KAAA;EAokCc;;;EAAA,IA3jC1B,WAAA;EAkkCoC;;;EA3jCxC,cAAA,CAAe,WAAA;EA0nCsB;;;EAAA,IAjnCjC,UAAA;EA1ID;;;EAAA,IAiJC,IAAA;EA1HD;;;EAAA,IAiIC,IAAA;EAlHD;;;EAAA,OAyHI,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAhHW;;;EAAA,iBAuHS,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EAzGnD;;;EAAA,UAsHA,SAAA,IAAS,OAAA;EAtGX;;;EA6GD,KAAA,CAAM,KAAA,QAAa,OAAA;EArFzB;;;EA4HA,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EA1GxB;;;EAAA,IA4HA,MAAA;EArGA;;;;;;EA+GE,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EA/FhF;;;;;;;;;;;;;;;;;;;EA+PK,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAHV;;;EAsBK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAxB/B;;;EA+BP,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EAPjE;;;EAcL,GAAA,CAAI,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAPrC;;;EAcA,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAdK;;;;;;;;;;;;;;;;;;;EAqC3C,MAAA,CAAO,WAAA,YAA6B,wBAAA;EAqQpC;;;;;;;;;;;;;;;;;;;;;;;;EAtIA,GAAA,IAAO,qBAAA;EA6N2C;;;EAvFlD,aAAA,CAAc,UAAA;EA0GsB;;;EAjGpC,QAAA,CAAS,GAAA,UAAa,UAAA;EA2GC;;;EAlGvB,iBAAA,CAAkB,GAAA;EAyGG;;;EAhGrB,eAAA;EA0GJ;;;EAnGI,YAAA,CAAa,GAAA;EA2Ge;;;EAlG5B,SAAA,CAAU,GAAA;EA4Gd;;;EArGI,UAAA,IAAU,MAAA,+BAAA,UAAA;EAgHd;;;EAzGI,OAAA,CAAQ,OAAA,EAAS,MAAA;EAiHG;;;EAxGpB,MAAA,CAAO,GAAA,UAAa,KAAA;EA+GK;;;;;;;;;;;;;;;EA1FzB,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA+GzC;;;;;;EA5FT,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EA2G3B;;;EAjGT,SAAA,CAAU,GAAA,UAAa,KAAA;EAwGP;;;EAjGhB,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;EAyGD;;;EAlGpB,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA6IK;;;EArID,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;EA8KsC;;;EAvKlE,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA0PI;;;EAlPA,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA+O+B;;;EAvO3B,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;EAuO2C;;;EAhO/D,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EAgOsC;;;EAzN/D,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;EA6OH;;;EAtOpB,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;EA6QrC;;;EAtQA,SAAA,IAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EAsQsD;;;;EA9P/D,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;EAqQ3B;;;EA9PxC,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;EAqQd;;;EA9PrC,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EA8SN;;;;EAtSnB,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;EA8SQ;;AAAA;;;;;;;;;;;;;UA3RpC,kBAAA;EAAA,QA2BA,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EAsFjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAgDtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}

package/esm/http/response.mjs

@@ -1,7 +1,7 @@
 import { StorageFile } from "../storage/storage-file.mjs";
 import "../storage/index.mjs";
 import { renderReact } from "../react/index.mjs";
-import config from "@mongez/config";
+import baseConfig from "@mongez/config";
 import { log } from "@warlock.js/logger";
 import path from "path";
 import { isIterable, isPlainObject, isScalar } from "@mongez/supportive-is";
@@ -175,7 +175,7 @@ var Response = class Response {
 	* Make a log message
 	*/
 	log(message, level = "info") {
-		if (!config.get("http.log")) return;
+		if (!baseConfig.get("http.log")) return;
 		log.log({
 			module: "response",
 			action: this.route.method + " " + this.route.path.replace("/*", "") + `:${this.request.id}`,
@@ -561,7 +561,7 @@ var Response = class Response {
 	*/
 	cookie(name, value, options = {}) {
 		const { raw, ...cookieOptions } = options;
-		const defaultOptions = config.get("http.cookies.options", {});
+		const defaultOptions = baseConfig.get("http.cookies.options", {});
 		const serializedValue = raw ? String(value) : JSON.stringify(value);
 		this.baseResponse.setCookie(name, serializedValue, {
 			...defaultOptions,
@@ -576,7 +576,7 @@ var Response = class Response {
 	* response.clearCookie('token', { path: '/' });
 	*/
 	clearCookie(name, options) {
-		const defaultOptions = config.get("http.cookies.options", {});
+		const defaultOptions = baseConfig.get("http.cookies.options", {});
 		this.baseResponse.clearCookie(name, {
 			...defaultOptions,
 			...options
@@ -679,6 +679,23 @@ var Response = class Response {
 	* Apply response options (cache, disposition, etag)
 	* Shared helper for sendFile and sendBuffer
 	*/
+	/**
+	* Build an RFC 6266–safe `Content-Disposition` value for a file name.
+	*
+	* HTTP header values must be ISO-8859-1; Node's `setHeader` throws
+	* `ERR_INVALID_CHAR` on any other byte, so a raw `filename="تقرير.pdf"` would
+	* crash the response (a 500 the moment the name is non-ASCII). RFC 6266 solves
+	* this with two parameters emitted together:
+	*   - `filename="<ascii>"`     — sanitised ASCII fallback for legacy clients
+	*   - `filename*=UTF-8''<pct>` — RFC 5987 ext-value; modern browsers restore
+	*                                the real (e.g. Arabic) name.
+	*/
+	contentDisposition(type, rawName) {
+		const name = (rawName || "file").replace(/[\r\n]/g, "");
+		const ascii = name.replace(/["\\]/g, "_").replace(/[^\x20-\x7E]/g, "_").trim() || "file";
+		if (!/[^\x20-\x7E]/.test(name)) return `${type}; filename="${ascii}"`;
+		return `${type}; filename="${ascii}"; filename*=UTF-8''${encodeURIComponent(name).replace(/['()*]/g, (char) => "%" + char.charCodeAt(0).toString(16).toUpperCase())}`;
+	}
 	applyResponseOptions(options, defaultFilename) {
 		if (options.contentType) this.baseResponse.type(options.contentType);
 		if (options.cacheTime) {
@@ -698,7 +715,7 @@ var Response = class Response {
 		if (options.inline !== void 0 || options.filename) {
 			const disposition = options.inline ? "inline" : "attachment";
 			const filename = options.filename || defaultFilename || "file";
-			this.header("Content-Disposition", `${disposition}; filename=\"${filename}\"`);
+			this.header("Content-Disposition", this.contentDisposition(disposition, filename));
 		}
 		return false;
 	}
@@ -803,7 +820,7 @@ var Response = class Response {
 		if (!await fileExistsAsync(filePath)) return this.notFound({ error: "File Not Found" });
 		try {
 			if (!filename) filename = path.basename(filePath);
-			this.baseResponse.header("Content-Disposition", `attachment; filename="${filename}"`);
+			this.baseResponse.header("Content-Disposition", this.contentDisposition("attachment", filename));
 			this.baseResponse.header("Content-Type", "application/octet-stream");
 			const stream = fs.createReadStream(filePath);
 			stream.on("error", (error) => {
@@ -832,7 +849,7 @@ var Response = class Response {
 	* Mark the response as failed
 	*/
 	failedSchema(result) {
-		const { errors, inputKey, inputError, status } = config.get("validation.response", {
+		const { errors, inputKey, inputError, status } = baseConfig.get("validation.response", {
 			errors: "errors",
 			inputKey: "input",
 			inputError: "error",