@warlock.js/core 5.0.2 → 5.2.0

package/esm/http/ready-report.mjs

@@ -0,0 +1,24 @@
+//#region core/src/http/ready-report.ts
+let report;
+/**
+* @internal Called by `HttpConnector.start()` right after a successful listen.
+*/
+function setHttpReadyReport(next) {
+	report = next;
+}
+/**
+* The last recorded bind, or `undefined` for a process with no HTTP surface —
+* a queue worker still boots, and the ready block must render without an app
+* URL rather than invent one.
+*/
+function getHttpReadyReport() {
+	return report;
+}
+/** @internal Test seam — a module-level singleton needs a way back to empty. */
+function resetHttpReadyReport() {
+	report = void 0;
+}
+
+//#endregion
+export { getHttpReadyReport, resetHttpReadyReport, setHttpReadyReport };
+//# sourceMappingURL=ready-report.mjs.map

package/esm/http/ready-report.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ready-report.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/ready-report.ts"],"sourcesContent":["/**\n * What the HTTP connector learned at the moment it finished binding.\n *\n * ## Why this exists rather than another `log.*` call\n *\n * The facts a developer needs on a `warlock dev` boot — the URL, the port, the\n * mode, how many routes registered — are discovered by DIFFERENT components at\n * DIFFERENT times, and each one used to print the instant it knew. The result\n * was a ready \"screen\" assembled by whatever finished first:\n *\n *     ℹ info    [http] [routes] 14 route(s) registered\n *     ✓ success [http] [connection] Server ready at http://[::1]:2030\n *     …          Development Server is ready in 660ms\n *\n * Three lines, three formats, no single place stating where to point a browser.\n *\n * So the connector RECORDS instead of narrating, and one renderer prints one\n * block once boot has actually completed (`dev-server/ready-block.ts`). The\n * split matters: a component that prints cannot be composed, and a boot\n * sequence whose output order is its completion order cannot be read.\n *\n * ## What deliberately does NOT go through here\n *\n * Warnings. A status block is a summary of the healthy case, and folding a\n * warning into a summary is how a warning stops being read. Anything the\n * connector needs to WARN about is still logged the moment it is known, which\n * puts it above the block, where it survives being skimmed.\n *\n * Production is unchanged for the same reason it always was: `warlock start`\n * hands its stdout to a supervisor that greps for known lines, so the existing\n * per-fact log lines stay exactly as they are outside development.\n */\n\nexport type HttpReadyReport = {\n  /** Exactly what `listen()` returned — the bind, not its presentation. */\n  boundAddress?: string;\n  /** The address spelled for a human; safe to paste into a browser. */\n  url: string;\n  /** Whether the bind covers more than loopback. */\n  wildcardBind: boolean;\n  /** The port actually bound. */\n  port: number;\n  /** Routes on the app router at the moment the server started listening. */\n  routeCount: number;\n  /** `app.baseUrl`, when it is a deployment address rather than a local one. */\n  publicUrl?: string;\n};\n\nlet report: HttpReadyReport | undefined;\n\n/**\n * @internal Called by `HttpConnector.start()` right after a successful listen.\n */\nexport function setHttpReadyReport(next: HttpReadyReport): void {\n  report = next;\n}\n\n/**\n * The last recorded bind, or `undefined` for a process with no HTTP surface —\n * a queue worker still boots, and the ready block must render without an app\n * URL rather than invent one.\n */\nexport function getHttpReadyReport(): HttpReadyReport | undefined {\n  return report;\n}\n\n/** @internal Test seam — a module-level singleton needs a way back to empty. */\nexport function resetHttpReadyReport(): void {\n  report = undefined;\n}\n"],"mappings":";AAgDA,IAAI;;;;AAKJ,SAAgB,mBAAmB,MAA6B;CAC9D,SAAS;AACX;;;;;;AAOA,SAAgB,qBAAkD;CAChE,OAAO;AACT;;AAGA,SAAgB,uBAA6B;CAC3C,SAAS;AACX"}

package/esm/http/request-controller.d.mts

@@ -3,7 +3,7 @@ import { Response } from "./response.mjs";
 import { ReturnedResponse } from "./types.mjs";
 import { RequestControllerContract } from "../router/types.mjs";
 
-//#region ../core/src/http/request-controller.d.ts
+//#region core/src/http/request-controller.d.ts
 declare abstract class RequestController implements RequestControllerContract {
   readonly request: Request;
   readonly response: Response;

package/esm/http/request-controller.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request-controller.d.mts","names":[],"sources":["../../../../../../../core/src/http/request-controller.ts"],"mappings":";;;;;;uBAKsB,iBAAA,YAA6B,yBAAA;EAAA,SAE/B,OAAA,EAAS,OAAA;EAAA,SACT,QAAA,EAAU,QAAA;cADV,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA;EAAA,SAKZ,OAAA,IAAW,OAAA,CAAQ,gBAAA;AAAA"}
+{"version":3,"file":"request-controller.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/request-controller.ts"],"mappings":";;;;;;uBAKsB,iBAAA,YAA6B,yBAAA;EAAA,SAE/B,OAAA,EAAS,OAAA;EAAA,SACT,QAAA,EAAU,QAAA;cADV,OAAA,EAAS,OAAA,EACT,QAAA,EAAU,QAAA;EAAA,SAKZ,OAAA,CAAA,GAAW,OAAA,CAAQ,gBAAA;AAAA"}

package/esm/http/request-controller.mjs

@@ -1,4 +1,4 @@
-//#region ../core/src/http/request-controller.ts
+//#region core/src/http/request-controller.ts
 var RequestController = class {
 	constructor(request, response) {
 		this.request = request;

package/esm/http/request-controller.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request-controller.mjs","names":[],"sources":["../../../../../../../core/src/http/request-controller.ts"],"sourcesContent":["import type { RequestControllerContract } from \"./../router/types\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\nimport type { ReturnedResponse } from \"./types\";\n\nexport abstract class RequestController implements RequestControllerContract {\n  public constructor(\n    public readonly request: Request,\n    public readonly response: Response,\n  ) {\n    //\n  }\n\n  public abstract execute(): Promise<ReturnedResponse>;\n}\n"],"mappings":";AAKA,IAAsB,oBAAtB,MAA6E;CAC3E,AAAO,YACL,AAAgB,SAChB,AAAgB,UAChB;EAFgB;EACA;CAGlB;AAGF"}
+{"version":3,"file":"request-controller.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/request-controller.ts"],"sourcesContent":["import type { RequestControllerContract } from \"./../router/types\";\nimport type { Request } from \"./request\";\nimport type { Response } from \"./response\";\nimport type { ReturnedResponse } from \"./types\";\n\nexport abstract class RequestController implements RequestControllerContract {\n  public constructor(\n    public readonly request: Request,\n    public readonly response: Response,\n  ) {\n    //\n  }\n\n  public abstract execute(): Promise<ReturnedResponse>;\n}\n"],"mappings":";AAKA,IAAsB,oBAAtB,MAA6E;CAC3E,AAAO,YACL,AAAgB,SAChB,AAAgB,UAChB;EAFgB;EACA;CAGlB;AAGF"}

package/esm/http/request.d.mts

@@ -8,7 +8,7 @@ import { LogLevel } from "@warlock.js/logger";
 import { FastifyRequest } from "fastify";
 import { IncomingHttpHeaders } from "node:http2";
 
-//#region ../core/src/http/request.d.ts
+//#region core/src/http/request.d.ts
 type StandardHeaders = { [K in keyof IncomingHttpHeaders as string extends K ? never : number extends K ? never : K]: IncomingHttpHeaders[K] };
 type HeaderKeys = keyof StandardHeaders;
 declare class Request<RequestValidation = any> {
@@ -96,6 +96,18 @@ declare class Request<RequestValidation = any> {
    * a prior one.
    */
   locals: RequestLocals;
+  /**
+   * Forget the authenticated user for this request.
+   *
+   * The `user` documentation above already names this as "the one place core
+   * writes it directly", and `@warlock.js/auth`'s middleware already calls it when
+   * a token is forged, malformed, expired, or of the wrong type. It was designed,
+   * documented and called — just never written, so `auth` could not typecheck.
+   *
+   * Clearing rather than leaving a stale value matters: a request that failed
+   * authentication must not carry the identity of whoever this object last held.
+   */
+  clearCurrentUser(): void;
   /**
    * Backing field for the lazily-generated CSP nonce. Left `undefined` until
    * the first `request.nonce` read; see the `nonce` getter below.
@@ -529,10 +541,10 @@ declare class Request<RequestValidation = any> {
    *
    * `X-Real-IP` is NOT part of that resolution — Fastify never looks at it,
    * and unlike `X-Forwarded-For` it carries no chain, so there is nothing to
-   * validate a hop count or proxy allowlist against. It is therefore honoured
+   * validate a proxy allowlist against. It is therefore honoured
    * only under `trustProxy: true` ("everything upstream is mine"), where it is
    * no weaker than the trust already granted. Under a bounded `trustProxy`
-   * (hop count / CIDR list) it is ignored: a trusted-but-passthrough edge that
+   * (CIDR / IP list) it is ignored: a trusted-but-passthrough edge that
    * forwards the client's own `X-Real-IP` verbatim would otherwise hand any
    * client a way around the bound.
    *

package/esm/http/request.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"request.d.mts","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"mappings":";;;;;;;;;;;KAoBK,eAAA,iBAGS,mBAAA,mBAAsC,CAAA,0BAE/B,CAAA,WAEb,CAAA,GAAI,mBAAA,CAAoB,CAAA;AAAA,KAG3B,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBU;AAAA;AAAA;EA0BxB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAqGyB;;;;;;;;;;;;;;;;;;;;;;EA7EzB,IAAA,GAAO,WAAA;EA4rB2E;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA9pBlF,MAAA,EAAQ,aAAA;EA8BJ;;;;EAAA,UAxBD,MAAA;EAyCsB;;;;;;;;;;;;;;;;;;;;;;EAAA,IAjBrB,KAAA;EA6JD;;;EAAA,OAlJI,OAAA,EAAS,OAAA;EA+KhB;;;;EAzKA,KAAA,EAAO,UAAA,QAAkB,KAAA;EAkMnB;;;EA7LN,CAAA,EAAG,UAAA,QAAkB,KAAA;EA6L8C;;;EAAA,UA9KhE,OAAA;EAqLmC;;;EAAA,UAhLnC,aAAA,GAAgB,iBAAA;EAkLxB;;;EA7KK,EAAA;EA4LO;;;EAvLP,SAAA;EA2MI;;;EAtMJ,OAAA;EAwOI;;;EAnOJ,UAAA,CAAW,OAAA,EAAS,cAAA;EAwRjB;;;;;;;;;EAAA,UA7PA,gBAAA;EAyaA;;;;;EAAA,iBAjZO,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EAmbzB;;;EAvanB,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EA8ajC;;;;;;;;EAAA,UAlaX,WAAA,CAAY,SAAA;EAicX;;;;EAAA,UA7aD,aAAA;EAgcgB;;;EAAA,IAnbf,MAAA;EAsdJ;;;EAAA,IA7cI,MAAA,CAAO,UAAA;EA6c2B;;;EAtctC,aAAA,CAAc,UAAA;EAmdwB;;;;;EAxctC,aAAA,CAAc,wBAAA;EA0dD;;;EAAA,IAndT,QAAA;EAuesB;;;EAhepB,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EAyhBnE;;;EAlhBA,MAAA,gCAAsC,UAAA,EAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EAuhBW;;;EAAA,IA/gBF,OAAA,IAAW,MAAA;EAshBE;;;EA/gBjB,MAAA,CAAO,IAAA,UAAc,YAAA;EA6hBjB;;;EAhhBJ,SAAA,CAAU,IAAA;EAyhBc;;;EAAA,IAlhBpB,MAAA;EA6iBJ;;;EAAA,IAtiBI,QAAA;EAkkBJ;;;EAAA,IA3jBI,MAAA;EAqkBE;;;EAAA,IA9jBF,YAAA;EA4kBK;;;EAAA,IA/jBL,kBAAA;EA+kBK;;;;;EAAA,IA9jBL,WAAA;EA8nBJ;;;EAAA,IA/mBI,aAAA;EAioBJ;;;EAAA,IA1nBI,MAAA;EAioBc;;;EAqBD;;;;;;;EAAA,UAxoBd,gBAAA,CAAiB,GAAA;EA4qBpB;;;;;;;;;EAAA,UA5pBG,aAAA,CAAc,KAAA,OAAY,UAAA,WAAqB,KAAA,GAAQ,KAAA;EAAA,UAMvD,YAAA;EA8vBoC;;;EAAA,UA/uBpC,SAAA,CAAU,IAAA;EAsvBc;;AAAa;EAAb,UA/mBxB,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAiBrB,IAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;;;;;;EAYE,aAAA,IAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;EA2BnB,UAAA,IAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,EAAmB,MAAA,UAAgB,MAAA,sBAA4B,MAAA;;;;EAalF,eAAA,IAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,IAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,IAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YA2CvB,kBAAA,IAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,IAAS,IAAA;;;;MASL,IAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA;;;;EAOA,eAAA;;;;EAUA,iBAAA;;;;EAmBA,KAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA;;;;MAwBI,MAAA;;;;MAOA,GAAA;;;;MAOA,OAAA;;;;MAOA,SAAA;;;;MAOA,OAAA,gBAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}
+{"version":3,"file":"request.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/request.ts"],"mappings":";;;;;;;;;;;KA4BK,eAAA,iBAIU,mBAAA,mBAAsC,CAAA,0BAE9B,CAAA,WAEb,CAAA,GACL,mBAAA,CAAoB,CAAA;AAAA,KAGpB,UAAA,SAAmB,eAAe;AAAA,cAE1B,OAAA;;;;;;;;;;;;;;;;EAgBJ,WAAA,EAAc,cAAA;EArBG;AAAA;AAAA;EA0BjB,QAAA,EAAW,QAAA;;;AAvBmB;EA4B9B,KAAA,EAAQ,KAAA;EA1BG;;;EAAA,UA+BR,OAAA;EALK;;;EAUR,kBAAA;EAoHyB;;;;;;;;;;;;;;;;;;;;;;EA5FzB,IAAA,GAAO,WAAA;EAkuBX;;;;;;;;;;;;;;;;;;;;;;;;;;;;EApsBI,MAAA,EAAQ,aAAA;EAqBL;;;;;;;;;;;EARH,gBAAA,CAAA;EA0EmB;;;;EAAA,UAlEhB,MAAA;EAsFiB;;;;;;;;;;;;;;;;;;;;;;EAAA,IA9DhB,KAAA,CAAA;EAuNW;;;EAAA,OA5MR,OAAA,EAAS,OAAA;EAsNhB;;;;EAhNA,KAAA,EAAO,UAAA,QAAkB,KAAA;EAiN9B;;;EA5MK,CAAA,EAAG,UAAA,QAAkB,KAAA;EA4NrB;;;EAAA,UA7MG,OAAA;EA0NO;;;EAAA,UArNP,aAAA,GAAgB,iBAAA;EAiPf;;;EA5OJ,EAAA;EAgSI;;;EA3RJ,SAAA;EAuTL;;;EAlTK,OAAA;EA2TG;;;EAtTH,UAAA,CAAW,OAAA,EAAS,cAAA;EAidN;;;;;;;;;EAAA,UAtbX,gBAAA,CAAA;EA+dA;;;;;EAAA,iBAvcO,gBAAA,CAAiB,KAAA,YAAiB,KAAA;EA8c1B;;;EAlclB,SAAA,CAAU,UAAA,UAAoB,OAAA,UAAiB,YAAA;EAifzC;;;;;;;;EAAA,UAreH,WAAA,CAAY,SAAA;EA4gBI;;;;EAAA,UApfhB,aAAA,CAAA;EAmgBgB;;;EAAA,IAtff,MAAA,CAAA;EA6fa;;;EAAA,IApfb,MAAA,CAAO,UAAA;EA+fE;;;EAxfb,aAAA,CAAc,UAAA;EA4gBY;;;;;EAjgB1B,aAAA,CAAc,wBAAA;EAwkBd;;;EAAA,IAjkBI,QAAA,CAAA;EAwkBA;;;EAjkBE,QAAA,CAAS,UAAA,EAAY,aAAA,EAAe,cAAA,cAAyB,OAAA,4BAAA,gBAAA;EA+kBnE;;;EArkBA,MAAA,gCAAsC,UAAA,CAAA,CAC3C,IAAA,EAAM,aAAA,GAAgB,UAAA,EACtB,YAAA;EA4kBgB;;;EAAA,IApkBP,OAAA,CAAA,GAAW,MAAA;EAwlBX;;;EAjlBJ,MAAA,CAAO,IAAA,UAAc,YAAA;EAimBjB;;;EAplBJ,SAAA,CAAU,IAAA;EAinBV;;;EAAA,IA1mBI,MAAA,CAAA;EAwnBJ;;;EAAA,IAjnBI,QAAA,CAAA;EAioBJ;;;EAAA,IA1nBI,MAAA,CAAA;EA0oBJ;;;EAAA,IAnoBI,YAAA,CAAA;EAmrBC;;;EAAA,IAtqBD,kBAAA,CAAA;EAwrBG;;;;;EAAA,IAvqBH,WAAA,CAAA;EAmsBa;;;EAAA,IAprBb,aAAA,CAAA;EAssBgB;;;EAAA,IA/rBhB,MAAA,CAAA;EAitBJ;;;EAeI;;;;;;;EAAA,UAltBD,gBAAA,CAAiB,GAAA;EAkzBmB;;;;;;AAOC;;;EAPD,UAryBpC,aAAA,CACR,KAAA,OACA,UAAA,WACA,KAAA,GAAQ,KAAA;EAAA,UAOA,YAAA,CAAA;;;;YAeA,SAAA,CAAU,IAAA;;;;YA4IV,UAAA,CAAW,IAAA;;;;EAsBd,QAAA,CAAS,KAAA,EAAO,KAAA;;;;EAYhB,OAAA,CAAQ,SAAA,EAAW,YAAA,KAAiB,IAAA;;;;EAOpC,EAAA,CAAG,SAAA,EAAW,YAAA,EAAc,QAAA,iCAAa,iBAAA;;;;EAOzC,GAAA,CAAI,OAAA,OAAc,KAAA,GAAO,QAAA;;;;MAqBrB,IAAA,CAAA;;;;MAOA,GAAA,CAAA;;;;MAOA,OAAA,CAAA;;;;;;;;;EAYE,aAAA,CAAA,GAAa,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;EA+BnB,UAAA,CAAA,GAAU,cAAA,CAAA,OAAA;;;;;EAQV,SAAA,UAAmB,iBAAA,CAAA,CACxB,MAAA,UAAgB,MAAA,sBACf,MAAA;;;;EAaI,eAAA,CAAA,GAAmB,MAAA,aAAmB,iBAAA;;;;EAOtC,gBAAA,CAAiB,IAAA,EAAM,iBAAA;;;;;;;;EAWjB,OAAA,CAAA,GAAO,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAoBJ,iBAAA,CAAA,GAAiB,OAAA,SAAA,MAAA,gBAAA,QAAA;;;;;;;YAkDvB,kBAAA,CAAA,GAAsB,UAAA;;;;EAczB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EAOnB,KAAA,CAAM,GAAA,WAAuB,YAAA;;;;EAO7B,GAAA,CAAI,GAAA,UAAa,YAAA;;;;EAOjB,GAAA,CAAI,GAAA;;;;EAOJ,GAAA,CAAI,GAAA,UAAa,KAAA;;;;EASjB,UAAA,CAAW,GAAA,UAAa,KAAA;;;;EAWxB,KAAA,CAAA,GAAS,IAAA;;;;MASL,IAAA,CAAA;;;;EAOJ,OAAA,CAAQ,GAAA,UAAa,KAAA;;;;MASjB,UAAA,CAAA;;;;EAmBJ,IAAA,CAAK,GAAA,WAAc,YAAA;;;;;EAUnB,KAAA,CAAM,IAAA,WAAe,YAAA;;;;MAOjB,MAAA,CAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;MASlB,KAAA,CAAA;;;;EAOJ,QAAA,CAAS,GAAA,UAAa,KAAA;;;;EAStB,GAAA,CAAA;;;;EAOA,eAAA,CAAA;;;;EAUA,iBAAA,CAAA;;;;EAmBA,KAAA,CAAA;;;;EAmBA,IAAA,CAAK,IAAA;;;;EAOL,KAAA,CAAM,IAAA;;;;EAWN,MAAA,CAAO,IAAA;;;;EAOP,IAAA,CAAK,GAAA,UAAa,YAAA;;;;EAqBlB,GAAA,CAAI,GAAA,UAAa,YAAA;;;;MAWb,OAAA,CAAA;;;;EAOJ,MAAA,CAAO,GAAA,UAAa,YAAA;;;;EASpB,KAAA,CAAM,GAAA,UAAa,YAAA;;;;EASnB,MAAA,CAAO,GAAA,UAAa,YAAA;;;;;;;;;;MAehB,EAAA,CAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqCJ,QAAA,CAAA;;;;MA+BI,MAAA,CAAA;;;;MAOA,GAAA,CAAA;;;;MAOA,OAAA,CAAA;;;;MAOA,SAAA,CAAA;;;;MAOA,OAAA,CAAA,eAAuB,WAAA,CAAY,OAAA;;;;EAOvC,SAAA,CAAU,GAAA,EAAK,UAAA,EAAY,KAAA;AAAA"}

package/esm/http/request.mjs

@@ -13,7 +13,7 @@ import { colors } from "@mongez/copper";
 import events from "@mongez/events";
 import { randomBytes } from "node:crypto";
 
-//#region ../core/src/http/request.ts
+//#region core/src/http/request.ts
 var Request = class Request {
 	constructor() {
 		this.payload = {};
@@ -25,6 +25,20 @@ var Request = class Request {
 		this.startTime = Date.now();
 	}
 	/**
+	* Forget the authenticated user for this request.
+	*
+	* The `user` documentation above already names this as "the one place core
+	* writes it directly", and `@warlock.js/auth`'s middleware already calls it when
+	* a token is forged, malformed, expired, or of the wrong type. It was designed,
+	* documented and called — just never written, so `auth` could not typecheck.
+	*
+	* Clearing rather than leaving a stale value matters: a request that failed
+	* authentication must not carry the identity of whoever this object last held.
+	*/
+	clearCurrentUser() {
+		this.user = void 0;
+	}
+	/**
 	* Per-request Content-Security-Policy nonce — a fresh, unguessable value
 	* the web layer hands to `<Scripts nonce={...} />` (the inline payload
 	* script) and to the `Content-Security-Policy` header, so a strict
@@ -751,10 +765,10 @@ var Request = class Request {
 	*
 	* `X-Real-IP` is NOT part of that resolution — Fastify never looks at it,
 	* and unlike `X-Forwarded-For` it carries no chain, so there is nothing to
-	* validate a hop count or proxy allowlist against. It is therefore honoured
+	* validate a proxy allowlist against. It is therefore honoured
 	* only under `trustProxy: true` ("everything upstream is mine"), where it is
 	* no weaker than the trust already granted. Under a bounded `trustProxy`
-	* (hop count / CIDR list) it is ignored: a trusted-but-passthrough edge that
+	* (CIDR / IP list) it is ignored: a trusted-but-passthrough edge that
 	* forwards the client's own `X-Real-IP` verbatim would otherwise hand any
 	* client a way around the bound.
 	*

package/esm/http/request.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport events from \"@mongez/events\";\nimport { trans, transFrom } from \"@mongez/localization\";\nimport { Random, except, get, only, rtrim, set, unset } from \"@mongez/reinforcements\";\nimport { isEmpty } from \"@mongez/supportive-is\";\nimport type { LogLevel } from \"@warlock.js/logger\";\nimport { log } from \"@warlock.js/logger\";\nimport { BaseValidator, v } from \"@warlock.js/seal\";\nimport type { FastifyRequest } from \"fastify\";\nimport { randomBytes } from \"node:crypto\";\nimport { type IncomingHttpHeaders } from \"node:http2\";\nimport { config } from \"../config/config-getter\";\nimport { resolveLocaleConfiguration } from \"../config/locale-configuration\";\nimport type { Middleware, Route } from \"../router\";\nimport { validateAll } from \"../validation/validateAll\";\nimport { createRequestStore } from \"./middleware/inject-request-context\";\nimport { Response } from \"./response\";\nimport type { RequestEvent, RequestLocals, RequestUser } from \"./types\";\nimport { UploadedFile } from \"./uploaded-file\";\n\ntype StandardHeaders = {\n  // copy every declared property from http.IncomingHttpHeaders\n  // but remove index signatures\n  [K in keyof IncomingHttpHeaders as string extends K\n    ? never\n    : number extends K\n      ? never\n      : K]: IncomingHttpHeaders[K];\n};\n\ntype HeaderKeys = keyof StandardHeaders;\n\nexport class Request<RequestValidation = any> {\n  /**\n   * Underlying Fastify request — a public escape hatch to capabilities the\n   * framework's high-level helpers don't yet cover.\n   *\n   * **Prefer framework methods first**: `request.input()`, `request.header()`,\n   * `request.body`, `request.query`, `request.params`, `request.file()`,\n   * `request.user`, `request.detectIp()`, etc. They handle locale, parsing,\n   * trust-proxy, and validation pipeline integration correctly.\n   *\n   * **Reach for `baseRequest` only** when the framework genuinely lacks a\n   * helper for what you need — and when you do, file an issue so we can add\n   * it. The escape hatch is the release valve that lets consumers move\n   * faster than the framework, but every long-term reach here is a missing\n   * helper waiting to be added.\n   */\n  public baseRequest!: FastifyRequest;\n\n  /**\n   * Response Object\n   */\n  public response!: Response;\n\n  /**\n   * Route Object\n   */\n  public route!: Route;\n\n  /**\n   * Parsed Request Payload\n   */\n  protected payload: any = {};\n\n  /**\n   * Decoded access token payload (set by auth middleware)\n   */\n  public decodedAccessToken?: any;\n\n  /**\n   * The authenticated user attached to this request, if any.\n   *\n   * `RequestUser` is empty by default, so ANY shape is assignable here at the\n   * declaration site — the app or auth package declares its real fields via\n   * module augmentation:\n   *\n   * ```typescript\n   * declare module \"@warlock.js/core\" {\n   *   interface RequestUser {\n   *     id: string | number;\n   *   }\n   * }\n   * ```\n   *\n   * Replaces the v4 `GuardedRequest` convention\n   * (`create-warlock/.../guarded.request.ts` — `Request<T> & { user: User }`,\n   * an intersection type hand-declared per app) with a property core itself\n   * declares and types. `clearCurrentUser()` below is the one place core\n   * writes it directly; auth middleware is expected to do the same after a\n   * successful token resolution.\n   */\n  public user?: RequestUser;\n\n  /**\n   * Private, server-only, per-request data bag.\n   *\n   * Distinct from the input payload (`body` / `query` / `params` / `all()`):\n   * a write here never surfaces in `request.all()`, `request.validated()`, or\n   * `request.input()`. That is the trap `request.set()` sets for private data\n   * — it writes into the payload `all` bag, so anything stored there leaks\n   * into every input accessor and, from there, into the client-facing\n   * payload. `locals` is the correct home for private per-request app data\n   * (a resolved session, a fetched-once model) that must never be mistaken\n   * for client input.\n   *\n   * Augmentable via module augmentation, in the module that OWNS the key:\n   *\n   * ```typescript\n   * declare module \"@warlock.js/core\" {\n   *   interface RequestLocals {\n   *     session?: { token: string };\n   *   }\n   * }\n   * ```\n   *\n   * A plain class-field initializer is sufficient for \"fresh per request\":\n   * `router.ts:925` constructs `new Request()` for every incoming request —\n   * `Request` instances are not pooled or reused across requests — so this\n   * initializer runs exactly once per request and no value can leak in from\n   * a prior one.\n   */\n  public locals: RequestLocals = {};\n\n  /**\n   * Backing field for the lazily-generated CSP nonce. Left `undefined` until\n   * the first `request.nonce` read; see the `nonce` getter below.\n   */\n  protected _nonce?: string;\n\n  /**\n   * Per-request Content-Security-Policy nonce — a fresh, unguessable value\n   * the web layer hands to `<Scripts nonce={...} />` (the inline payload\n   * script) and to the `Content-Security-Policy` header, so a strict\n   * `script-src 'nonce-...'` allows only the script this request actually\n   * rendered.\n   *\n   * Generated LAZILY on first access, not eagerly in `setRequest()`: most\n   * requests (API routes, anything that isn't rendering HTML) never read it,\n   * and spending a `randomBytes` call on every single request for a value\n   * most of them discard is wasted entropy draw + CPU. Once generated it is\n   * cached in `_nonce`, so every subsequent read within the SAME request\n   * returns the identical value — required, since the header and the inline\n   * `<script>` tag must agree on one nonce. `_nonce` is a plain field on a\n   * per-request `Request` instance (see `locals` above — `router.ts:925`,\n   * no pooling), so the cache can never leak into the next request; a fresh\n   * `Request` means a fresh, unset `_nonce`.\n   *\n   * 16 random bytes, base64-encoded — the size the CSP Level 3 spec's own\n   * examples use, and far more entropy than an attacker could feasibly guess\n   * to defeat the policy.\n   */\n  public get nonce(): string {\n    if (!this._nonce) {\n      this._nonce = randomBytes(16).toString(\"base64\");\n    }\n\n    return this._nonce;\n  }\n\n  /**\n   * Current request instance\n   */\n  public static current: Request;\n\n  /**\n   * Translation method\n   * Type of it is the same as the type of trans function\n   */\n  public trans: ReturnType<typeof trans> = trans;\n\n  /**\n   * Alias to trans method\n   */\n  public t: ReturnType<typeof trans> = trans;\n\n  /*\n   * v5 removed the `[key: string]: any` index signature (eed20184). Attaching\n   * arbitrary properties compiled silently and hid real bugs behind `any`.\n   * The sanctioned extension paths are:\n   * - `request.locals` (augment `RequestLocals` via module augmentation) for\n   *   per-request attached data, e.g. models fetched in validation middleware.\n   * - `requestMemo(key, fn)` for per-request memoized computation.\n   * - Module augmentation of the `Request` class itself for new typed members.\n   */\n\n  /**\n   * Locale code\n   */\n  protected _locale = \"\";\n\n  /**\n   * Validated data\n   */\n  protected validatedData?: RequestValidation;\n\n  /**\n   * Request id\n   */\n  public id = Random.string(32);\n\n  /**\n   * Start Time\n   */\n  public startTime = Date.now();\n\n  /**\n   * End Time\n   */\n  public endTime?: undefined | number;\n\n  /**\n   * Set request handler\n   */\n  public setRequest(request: FastifyRequest) {\n    this.baseRequest = request;\n\n    this.resolveRequestId();\n\n    this.parsePayload();\n\n    // Resolve the locale at CALL time, never at bind time. `setRequest` runs\n    // before routing, so a locale set later (path locale, `setLocaleCode`, the\n    // web layer's C3 derivation) must steer translations too — the old\n    // `transFrom.bind(null, localeCode)` snapshot made `request.locale` and\n    // `request.trans()` silently disagree for the rest of the request.\n    this.trans = this.t = (keyword: string, placeholders?: any) =>\n      transFrom(this.getLocaleCode(), keyword, placeholders);\n\n    return this;\n  }\n\n  /**\n   * Inherit `X-Request-Id` from the incoming request, fall back to a custom\n   * generator, then to the field-init default (`Random.string(32)`).\n   *\n   * Inherited values are validated (length cap + printable-ASCII) to prevent\n   * log-injection from a malicious client. Disable the whole behavior by\n   * setting `http.requestId.enabled = false` — in which case the field-init\n   * default is used regardless of any incoming header.\n   */\n  protected resolveRequestId() {\n    const requestIdConfig = config.key(\"http.requestId\") || {};\n\n    if (requestIdConfig.enabled === false) return;\n\n    const headerName = (requestIdConfig.header || \"x-request-id\").toLowerCase();\n    const incoming = this.baseRequest.headers[headerName];\n\n    if (Request.isValidRequestId(incoming)) {\n      this.id = incoming;\n\n      return;\n    }\n\n    if (typeof requestIdConfig.generator === \"function\") {\n      this.id = requestIdConfig.generator();\n    }\n  }\n\n  /**\n   * Validate a candidate request-id value. Accepts non-empty printable ASCII\n   * up to 128 characters — tight enough to reject newline / control-character\n   * log-injection, loose enough to accept UUIDs, ULIDs, snowflakes, etc.\n   */\n  protected static isValidRequestId(value: unknown): value is string {\n    return (\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= 128 &&\n      /^[\\x21-\\x7e]+$/.test(value)\n    );\n  }\n\n  /**\n   * Translate from the given locale code\n   */\n  public transFrom(localeCode: string, keyword: string, placeholders?: any) {\n    return transFrom(localeCode, keyword, placeholders);\n  }\n\n  /**\n   * Cache one supported locale without coercing request-controlled input.\n   *\n   * The default is the answer for a client that asked for NOTHING. A client\n   * that did ask is only overridden when its value fails a declared\n   * `app.localeCodes` allow-list; with no list declared there is nothing to\n   * fail, so the requested locale passes through unchanged.\n   */\n  protected cacheLocale(candidate: unknown): string {\n    const { defaultLocaleCode, localeCodes } = resolveLocaleConfiguration(\n      config.key(\"app.localeCode\"),\n      config.key(\"app.localeCodes\"),\n    );\n\n    const requested = typeof candidate === \"string\" && candidate.length > 0 ? candidate : undefined;\n\n    this._locale =\n      requested !== undefined && (localeCodes === undefined || localeCodes.includes(requested))\n        ? requested\n        : defaultLocaleCode;\n\n    return this._locale;\n  }\n\n  /**\n   * Resolve the first present Mode B source. Unsupported values fail closed to\n   * the configured default instead of widening the application's locale set.\n   */\n  protected resolveLocale(): string {\n    const candidate = [\n      this.query[\"locale\"],\n      this.cookies[\"locale\"],\n      this.header(\"locale\"),\n    ].find((value) => typeof value === \"string\" && value.length > 0);\n\n    return this.cacheLocale(candidate);\n  }\n\n  /**\n   * Get current locale code\n   */\n  public get locale(): string {\n    if (this._locale) return this._locale;\n\n    return this.resolveLocale();\n  }\n\n  /**\n   * Set locale code\n   */\n  public set locale(localeCode: string) {\n    this.cacheLocale(localeCode);\n  }\n\n  /**\n   * Set locale code\n   */\n  public setLocaleCode(localeCode: string) {\n    this.locale = localeCode;\n\n    return this;\n  }\n\n  /**\n   * @deprecated Use `request.locale`. This alias is removed after one version.\n   * The legacy default argument is accepted for source compatibility but the\n   * resolved default is owned exclusively by app configuration.\n   */\n  public getLocaleCode(_legacyDefaultLocaleCode?: string): string {\n    return this.locale;\n  }\n\n  /**\n   * Get http protocol\n   */\n  public get protocol() {\n    return this.baseRequest.protocol;\n  }\n\n  /**\n   * Validate the given validation schema\n   */\n  public async validate(validation: BaseValidator, selectedInputs?: string[]) {\n    return await v.validate(validation, selectedInputs ? this.only(selectedInputs) : this.all());\n  }\n\n  /**\n   * Get value of the given header\n   */\n  public header<TCustomHeader extends string = HeaderKeys>(\n    name: TCustomHeader | HeaderKeys,\n    defaultValue: any = null,\n  ) {\n    return this.baseRequest.headers[name.toLocaleLowerCase()] ?? defaultValue;\n  }\n\n  /**\n   * Get all cookies from the current request\n   */\n  public get cookies(): Record<string, string | undefined> {\n    return this.baseRequest.cookies || {};\n  }\n\n  /**\n   * Get a particular cookie value or fallback to default\n   */\n  public cookie(name: string, defaultValue?: any): string | any {\n    const value = this.cookies[name] ?? defaultValue;\n\n    try {\n      return JSON.parse(value);\n    } catch (error) {\n      return value;\n    }\n  }\n\n  /**\n   * Determine if the request has the specified cookie\n   */\n  public hasCookie(name: string): boolean {\n    return this.cookies[name] !== undefined;\n  }\n\n  /**\n   * Get the current request domain\n   */\n  public get domain() {\n    return this.baseRequest.hostname.replace(/^www\\./, \"\");\n  }\n\n  /**\n   * Get hostname\n   */\n  public get hostname() {\n    return this.domain;\n  }\n\n  /**\n   * Get request origin\n   */\n  public get origin() {\n    return this.baseRequest.headers.origin as string;\n  }\n\n  /**\n   * Get the domain of the origin\n   */\n  public get originDomain() {\n    const domain = this.origin ? new URL(this.origin).hostname : null;\n\n    if (domain?.startsWith(\"www.\")) {\n      return domain.replace(/^www\\./, \"\");\n    }\n\n    return domain;\n  }\n\n  /**\n   * Get authorization header value\n   */\n  public get authorizationValue(): string {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return \"\";\n\n    const [type, value] = authorization.split(\" \");\n\n    if (![\"bearer\", \"key\"].includes(type.toLowerCase())) return \"\";\n\n    return value || \"\";\n  }\n\n  /**\n   * Get access token from Authorization header\n   *\n   * If the Authorization header does not start with `Bearer` value then return null\n   */\n  public get accessToken(): string | undefined {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return;\n\n    const [type, value] = authorization.split(\" \");\n\n    if (type.toLowerCase() !== \"bearer\") return;\n\n    return value;\n  }\n\n  /**\n   * Get the authorization header\n   */\n  public get authorization() {\n    return this.header(\"authorization\");\n  }\n\n  /**\n   * Get current request method\n   */\n  public get method(): string {\n    return this.baseRequest.method;\n  }\n\n  /**\n   * Parse the payload and merge it from the request body, params and query string\n   */\n  /**\n   * Turn a bracket-notation key into the dotted path `set()` expects.\n   *\n   * `a[b][c]` -> `a.b.c`. Used only for NON-numeric nesting; numeric indices\n   * keep the array-of-objects path in {@link parseBody}, which builds real\n   * arrays rather than objects with numeric keys.\n   */\n  protected bracketKeyToPath(key: string): string {\n    return key\n      .replace(/\\]\\[/g, \".\")\n      .replace(/\\[/g, \".\")\n      .replace(/\\]/g, \"\");\n  }\n\n  /**\n   * Apply the `key[]` array marker to a parsed value.\n   *\n   * The subtlety this exists to remove: a key declared `[]` should ALWAYS be an\n   * array, but the underlying query/body parser only hands us one when the\n   * caller sent the key more than once. Deciding the TYPE from the number of\n   * occurrences means one selected filter is a string and two are an array —\n   * a shape that changes under the user's hands.\n   */\n  protected arrayValueFor(value: any, isArrayKey: boolean, parse: (value: any) => any) {\n    if (Array.isArray(value)) return value.map(parse);\n\n    return isArrayKey ? [parse(value)] : parse(value);\n  }\n\n  protected parsePayload() {\n    this.payload.body = this.parseBody(this.baseRequest.body);\n\n    this.payload.query = this.parseBody(this.baseRequest.query);\n    this.payload.params = { ...(this.baseRequest.params || {}) };\n    this.payload.all = {\n      ...this.payload.body,\n      ...this.payload.query,\n      ...this.payload.params,\n    };\n  }\n\n  /**\n   * Parse body payload\n   */\n  protected parseBody(data: any) {\n    try {\n      if (!data) return {};\n\n      const body: any = {};\n\n      const arrayOfObjectValues: any = {};\n\n      for (let key in data) {\n        const value = data[key];\n\n        let isArrayKey = false;\n\n        if (key.endsWith(\"[]\")) {\n          isArrayKey = true;\n        }\n\n        key = rtrim(key, \"[]\");\n\n        // check if the key is has a square brackets, then convert it into object\n        // i.e user[email] => user: {email: \"value\"}\n        // also check if its an array of objects\n\n        if (key.includes(\"[\")) {\n          // check if its an array of objects\n          if (key.includes(\"][\")) {\n            const keyParts = key.split(\"[\");\n\n            const keyName = keyParts[0];\n\n            const keyNameParts = keyParts[1].split(\"]\");\n\n            const index = Number(keyNameParts[0]);\n\n            /*\n              A NON-NUMERIC first segment is not an array index — it is a deeper\n              nested object. `a[b][c]=x` reaches this branch because it contains\n              \"][\", but `Number(\"b\")` is NaN, and the code below used to write to\n              `[NaN]`: that sets a \"NaN\" PROPERTY on an array whose length stays\n              0, so the request arrived as `{a: []}` and the value was gone. No\n              error, no warning — the caller simply never got `x`.\n\n              Deciding between refusing (4xx) and interpreting: a doubly-nested\n              key is unambiguous and is exactly what every bracket-notation\n              parser means by it, so we interpret. Refusing would reject a URL\n              shape that is standard elsewhere and that we ourselves already\n              honour one level shallower, five lines below. What was definitely\n              wrong was answering with a shape the caller did not send.\n\n              Numeric indices keep the array-of-objects path below unchanged —\n              `items[0][name]` is still an array.\n            */\n            if (Number.isNaN(index)) {\n              set(\n                body,\n                this.bracketKeyToPath(key),\n                this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n              );\n\n              continue;\n            }\n\n            if (!arrayOfObjectValues[keyName]) {\n              arrayOfObjectValues[keyName] = [];\n            }\n\n            if (!arrayOfObjectValues[keyName][index]) {\n              arrayOfObjectValues[keyName][index] = {};\n            }\n\n            // now get the key after the index\n            const keyNameParts2 = keyParts[2].split(\"]\");\n            const keyName2 = keyNameParts2[0];\n\n            arrayOfObjectValues[keyName][index][keyName2] = this.parseValue(value);\n\n            continue;\n          }\n\n          const keyParts = key.split(\"[\");\n          const keyName = keyParts[0];\n          const keyNameParts = keyParts[1].split(\"]\");\n\n          /*\n            `isArrayKey` is honoured HERE, and used not to be. `filter[tags][]=a`\n            sets the flag at the top of the loop, but this branch only wrapped\n            when the underlying value was ALREADY an array — which it is for two\n            or more occurrences and is not for one. So `filter[tags][]=a` arrived\n            as `{filter:{tags:\"a\"}}` while `…=a&…=b` arrived as `{tags:[\"a\",\"b\"]}`:\n            the same declared shape, two different types, decided by how many\n            times the caller happened to send it.\n\n            That single-element case is the one a UI hits first — one filter\n            chip selected — and `@warlock.js/web`'s decoder reads it as an array,\n            so the page and the server disagreed about the same URL.\n          */\n          set(\n            body,\n            keyName + \".\" + keyNameParts[0],\n            this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n          );\n\n          continue;\n        }\n\n        if (Array.isArray(value)) {\n          set(body, key, value.map(this.parseValue.bind(this)));\n        } else if (isArrayKey) {\n          if (body[key]) {\n            body[key].push(this.parseValue(value));\n          } else {\n            body[key] = [this.parseValue(value)];\n\n            continue;\n          }\n        } else {\n          set(body, key, this.parseValue(value));\n        }\n      }\n\n      // now merge the array of objects into the body\n      for (const key in arrayOfObjectValues) {\n        body[key] = arrayOfObjectValues[key];\n      }\n\n      return body;\n    } catch (error) {\n      console.log(error);\n      this.log(error, \"error\");\n    }\n  }\n\n  /**\n   * Parse the given data\n   */\n  protected parseValue(data: any) {\n    // data.value appears only in the multipart form data\n    // if it json, then just return the data\n    if (data?.file) return new UploadedFile(data);\n    if (data?.value !== undefined && data?.fields && data?.type) {\n      data = data.value;\n    }\n\n    if (data === \"false\") return false;\n\n    if (data === \"true\") return true;\n\n    if (data === \"null\") return null;\n\n    if (typeof data === \"string\") return data.trim();\n\n    return data;\n  }\n\n  /**\n   * Set route handler\n   */\n  public setRoute(route: Route) {\n    this.route = route;\n\n    // pass the route to the response object\n    this.response.setRoute(route);\n\n    return this;\n  }\n\n  /**\n   * Trigger an http event\n   */\n  public trigger(eventName: RequestEvent, ...args: any[]) {\n    return events.trigger(`request.${eventName}`, ...args, this);\n  }\n\n  /**\n   * Listen to the given event\n   */\n  public on(eventName: RequestEvent, callback: any) {\n    return events.subscribe(`request.${eventName}`, callback);\n  }\n\n  /**\n   * Make a log message\n   */\n  public log(message: any, level: LogLevel = \"info\") {\n    if (!config.key(\"http.log\")) return;\n\n    log.log({\n      module: \"request\",\n      action: this.route.method + \" \" + this.route.path.replace(\"/*\", \"\") + `:${this.id}`,\n      message,\n      type: level,\n      context: {\n        request: this,\n      },\n    });\n  }\n\n  /**\n   * Get current request path\n   */\n  public get path() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * {@alias}\n   */\n  public get url() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * Get full url\n   */\n  public get fullUrl() {\n    return this.protocol + \"://\" + this.hostname + this.path;\n  }\n\n  /**\n   * Drive the middleware chain for the current route, then defer to the\n   * controller. Returns the first response value any middleware short-circuits\n   * with, or `undefined` to continue into validation + handler.\n   *\n   * @internal Framework orchestration — do not call from app code. Will move\n   * to a dedicated controller dispatcher in a future refactor.\n   */\n  public async runMiddleware() {\n    // measure request time\n    // check for middleware first\n    const middlewareOutput = await this.executeMiddleware();\n\n    if (middlewareOutput !== undefined) {\n      // 👇🏻 make sure first its not a response instance\n      if (middlewareOutput instanceof Response) return middlewareOutput;\n      // 👇🏻 send the response\n      return this.response.send(middlewareOutput);\n    }\n\n    const handler = this.route.handler;\n\n    if (!handler.validation) return;\n\n    // 👇🏻 check for validation using validateAll helper function\n    const validationOutput = await validateAll(handler.validation, this, this.response);\n\n    return validationOutput;\n  }\n\n  /**\n   * Return the request handler attached to the current route.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  public getHandler() {\n    return this.route.handler;\n  }\n\n  /**\n   * Get inputs that has been validated only\n   * You can also pass an array of inputs to get only the validated inputs\n   */\n  public validated<Output = RequestValidation>(inputs?: (keyof Output | (string & {}))[]): Output {\n    if (this.validatedData) {\n      return inputs\n        ? only(this.validatedData as Output, inputs as string[])\n        : (this.validatedData as Output);\n    }\n\n    return {} as Output;\n  }\n\n  /**\n   * Get inputs that has been validated except the given inputs\n   */\n  public validatedExcept(...inputs: string[]): RequestValidation {\n    return except(this.validated(), inputs);\n  }\n\n  /**\n   * Set validated data\n   */\n  public setValidatedData(data: RequestValidation) {\n    this.validatedData = data;\n  }\n\n  /**\n   * Top-level entry into the request lifecycle — opens the context store,\n   * runs middleware, drives the handler, handles errors.\n   *\n   * @internal Framework orchestration — do not call from app code. Wired\n   * from the Fastify route handler in `router.scan()`.\n   */\n  public async execute() {\n    try {\n      // call executingAction event\n\n      this.log(\"Executing the request\");\n\n      return await createRequestStore(this, this.response);\n    } catch (error) {\n      this.log(error, \"error\");\n\n      throw error;\n    }\n  }\n\n  /**\n   * Iterate the collected middlewares in order; return the first short-circuit\n   * value or `undefined` when every middleware passes through.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected async executeMiddleware() {\n    // collect all middlewares for current route\n    const middlewares = this.collectMiddlewares();\n\n    // check if there are no middlewares, then return\n    if (middlewares.length === 0) return;\n\n    this.log(\"About to execute request middlewares\");\n\n    // trigger the executingMiddleware event\n    this.trigger(\"executingMiddleware\", middlewares, this.route);\n\n    for (const middleware of middlewares) {\n      this.log(\"Executing middleware \" + colors.yellowBright(middleware.name));\n      const output = await middleware({ request: this, response: this.response });\n      this.log(\"Executed middleware \" + colors.yellowBright(middleware.name), \"success\");\n\n      if (output !== undefined) {\n        this.log(\n          colors.yellow(\"request intercepted by middleware \") + colors.cyanBright(middleware.name),\n          \"warn\",\n        );\n\n        this.trigger(\"executedMiddleware\");\n\n        this.log(\"Request middlewares executed\", \"success\");\n\n        return output;\n      }\n    }\n\n    this.log(\"Request middlewares executed\", \"success\");\n\n    // trigger the executedMiddleware event\n    this.trigger(\"executedMiddleware\", middlewares, this.route);\n  }\n\n  /**\n   * Gather the middleware list for the current route — today just the\n   * route-level array; future extraction may merge group + app-wide layers.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected collectMiddlewares(): Middleware[] {\n    const middlewaresList: Middleware[] = [];\n\n    // collect route middlewares\n    if (this.route.middleware) {\n      middlewaresList.push(...this.route.middleware);\n    }\n\n    return middlewaresList;\n  }\n\n  /**\n   * Get request input value from query string, params or body\n   */\n  public input(key: string, defaultValue?: any) {\n    return get(this.payload.all, key, defaultValue);\n  }\n\n  /**\n   * Get email input value, this will lowercase the value\n   */\n  public email(key: string = \"email\", defaultValue: string = \"\"): string {\n    return this.input(key, defaultValue)?.toLowerCase() || defaultValue;\n  }\n\n  /**\n   * @alias input\n   */\n  public get(key: string, defaultValue?: any) {\n    return this.input(key, defaultValue);\n  }\n\n  /**\n   * Determine if request has input value\n   */\n  public has(key: string) {\n    return get(this.payload.all, key, undefined) !== undefined;\n  }\n\n  /**\n   * Set request input value\n   */\n  public set(key: string, value: any) {\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Set the given value if the request does not have the input\n   */\n  public setDefault(key: string, value: any) {\n    if (this.has(key)) return this;\n\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Unset request payload keys\n   */\n  public unset(...keys: string[]) {\n    this.payload.all = unset(this.payload.all, keys);\n\n    return this;\n  }\n\n  /**\n   * Get request body\n   */\n  public get body() {\n    return this.payload.body;\n  }\n\n  /**\n   * Set request body value\n   */\n  public setBody(key: string, value: any) {\n    set(this.payload.body, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get body inputs except files\n   */\n  public get bodyInputs() {\n    const inputs = this.payload.body;\n\n    const bodyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (value.file && value.fieldname) continue;\n\n      bodyInputs[key] = value;\n    }\n\n    return bodyInputs;\n  }\n\n  /**\n   * Get request file in UploadedFile instance\n   */\n  public file(key: string): UploadedFile | undefined {\n    const file = this.input(key);\n\n    return file;\n  }\n\n  /**\n   * Get uploaded files from the request for the given name\n   * If the given name is not present in the request, return an empty array\n   */\n  public files(name: string): UploadedFile[] {\n    return this.input(name) || [];\n  }\n\n  /**\n   * Get request params\n   */\n  public get params() {\n    return this.payload.params;\n  }\n\n  /**\n   * Set request params value\n   */\n  public setParam(key: string, value: any) {\n    set(this.payload.params, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get request query\n   */\n  public get query() {\n    return this.payload.query;\n  }\n\n  /**\n   * Set request query value\n   */\n  public setQuery(key: string, value: any) {\n    set(this.payload.query, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get all inputs\n   */\n  public all() {\n    return this.payload.all;\n  }\n\n  /**\n   * Get all inputs except params\n   */\n  public allExceptParams() {\n    return {\n      ...this.payload.query,\n      ...this.payload.body,\n    };\n  }\n\n  /**\n   * Get all heavy inputs except params\n   */\n  public heavyExceptParams() {\n    const inputs = this.allExceptParams();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only heavy inputs, the input with a value\n   */\n  public heavy() {\n    const inputs = this.all();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only the given keys from the request data\n   */\n  public only(keys: string[]) {\n    return only(this.all(), keys);\n  }\n\n  /**\n   * Pluck the given keys from the request data\n   */\n  public pluck(keys: string[]) {\n    const data = this.only(keys);\n\n    this.unset(...keys);\n\n    return data;\n  }\n\n  /**\n   * Get all request inputs except the given keys\n   */\n  public except(keys: string[]) {\n    return except(this.all(), keys);\n  }\n\n  /**\n   * Get boolean input value\n   */\n  public bool(key: string, defaultValue = false) {\n    const value = this.input(key, defaultValue);\n\n    if (value === \"true\") {\n      return true;\n    }\n\n    if (value === \"false\") {\n      return false;\n    }\n\n    if (value === 0) {\n      return false;\n    }\n\n    return Boolean(value);\n  }\n\n  /**\n   * Get integer input value\n   */\n  public int(key: string, defaultValue: number = 0): number | undefined {\n    const value = this.input(key, defaultValue);\n\n    if (!value && value !== 0) return undefined;\n\n    return parseInt(value);\n  }\n\n  /**\n   * Shorthand getter to get id param\n   */\n  public get idParam() {\n    return this.int(\"id\");\n  }\n\n  /**\n   * Get string input value\n   */\n  public string(key: string, defaultValue: string = \"\"): string {\n    const value = this.input(key, defaultValue);\n\n    return String(value);\n  }\n\n  /**\n   * Get float input value\n   */\n  public float(key: string, defaultValue: number = 0): number {\n    const value = this.input(key, defaultValue);\n\n    return parseFloat(value) || 0;\n  }\n\n  /**\n   * Get number input value\n   */\n  public number(key: string, defaultValue: number = 0): number {\n    const value = Number(this.input(key, defaultValue));\n\n    return isNaN(value) ? defaultValue : value;\n  }\n\n  /**\n   * Immediate-peer IP as Fastify reports it — the address that connected to\n   * the server socket, with `trustProxy` resolution applied. Use this when\n   * you specifically need the peer address (rate-limit-by-direct-connection,\n   * health-check origin verification).\n   *\n   * **For most use cases prefer `request.detectIp()`** — behind any proxy\n   * (load balancer, CDN, sidecar) `ip` reports the proxy, not the real client.\n   */\n  public get ip() {\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * Best-effort real client IP — the value everything IP-scoped keys on\n   * (ip-filter allowlists, rate-limit buckets, idempotency scoping).\n   *\n   * `X-Forwarded-For` resolution is **delegated to Fastify**: `baseRequest.ip`\n   * is already the client address Fastify's `trustProxy` machinery picked out\n   * of the chain, so every shape `http.trustProxy` accepts is honoured here\n   * with exactly the semantics Fastify documents:\n   *\n   * - `false` (default) — no header is trusted; the socket peer address wins.\n   *   Both forwarding headers are client-settable, so without a trusted edge\n   *   that rewrites them any client could otherwise forge its own IP.\n   * - `true` — the whole chain is trusted; the leftmost hop (original client)\n   *   wins.\n   * - `number` — that many rightmost hops are trusted, so an edge that\n   *   APPENDS to `X-Forwarded-For` yields the real client rather than whatever\n   *   the client prepended.\n   * - CIDR / IP list (string, comma-separated string, or array) or a custom\n   *   predicate — the chain is walked right-to-left and stops at the first hop\n   *   that isn't a trusted proxy.\n   *\n   * `X-Real-IP` is NOT part of that resolution — Fastify never looks at it,\n   * and unlike `X-Forwarded-For` it carries no chain, so there is nothing to\n   * validate a hop count or proxy allowlist against. It is therefore honoured\n   * only under `trustProxy: true` (\"everything upstream is mine\"), where it is\n   * no weaker than the trust already granted. Under a bounded `trustProxy`\n   * (hop count / CIDR list) it is ignored: a trusted-but-passthrough edge that\n   * forwards the client's own `X-Real-IP` verbatim would otherwise hand any\n   * client a way around the bound.\n   *\n   * **Prefer this over `request.ip` for any caller behind a proxy** (load\n   * balancer, CDN, reverse proxy, k8s ingress).\n   */\n  public detectIp() {\n    // Trusting `X-Real-IP` is only sound when the config trusts the entire\n    // upstream chain; bounded shapes get chain-aware resolution instead.\n    if (config.get(\"http.trustProxy\", false) === true) {\n      const realIp = this.header(\"x-real-ip\");\n\n      if (realIp) {\n        const address = String(realIp).split(\",\")[0].trim();\n\n        if (address) return address;\n      }\n    }\n\n    // Fastify resolved this against the configured `trustProxy` already:\n    // socket peer when trust is off, the correct hop of `X-Forwarded-For`\n    // when it is on. Re-parsing the header here would mean a second, weaker\n    // trust model that could disagree with `request.ip` and with the plugins\n    // (rate limit, proxy) that key on it.\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * An alias to detectIp\n   */\n  public get realIp() {\n    return this.detectIp();\n  }\n\n  /**\n   * Get request ips\n   */\n  public get ips() {\n    return this.baseRequest.ips;\n  }\n\n  /**\n   * Get request referer\n   */\n  public get referer() {\n    return this.baseRequest.headers.referer;\n  }\n\n  /**\n   * Get user agent\n   */\n  public get userAgent() {\n    return this.baseRequest.headers[\"user-agent\"];\n  }\n\n  /**\n   * Get request headers\n   */\n  public get headers(): typeof this.baseRequest.headers {\n    return this.baseRequest.headers;\n  }\n\n  /**\n   * Set the given header\n   */\n  public setHeader(key: HeaderKeys, value: string) {\n    this.baseRequest.headers[key.toLowerCase()] = value;\n\n    return this;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAgCA,IAAa,UAAb,MAAa,QAAiC;;iBA+BnB,CAAC;gBA2DK,CAAC;eA+CS;WAKJ;iBAejB;YAUR,OAAO,OAAO,EAAE;mBAKT,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;;;;CApD5B,IAAW,QAAgB;EACzB,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAGjD,OAAO,KAAK;CACd;;;;CAwDA,AAAO,WAAW,SAAyB;EACzC,KAAK,cAAc;EAEnB,KAAK,iBAAiB;EAEtB,KAAK,aAAa;EAOlB,KAAK,QAAQ,KAAK,KAAK,SAAiB,iBACtC,UAAU,KAAK,cAAc,GAAG,SAAS,YAAY;EAEvD,OAAO;CACT;;;;;;;;;;CAWA,AAAU,mBAAmB;EAC3B,MAAM,kBAAkB,OAAO,IAAI,gBAAgB,KAAK,CAAC;EAEzD,IAAI,gBAAgB,YAAY,OAAO;EAEvC,MAAM,cAAc,gBAAgB,UAAU,eAAc,CAAE,YAAY;EAC1E,MAAM,WAAW,KAAK,YAAY,QAAQ;EAE1C,IAAI,QAAQ,iBAAiB,QAAQ,GAAG;GACtC,KAAK,KAAK;GAEV;EACF;EAEA,IAAI,OAAO,gBAAgB,cAAc,YACvC,KAAK,KAAK,gBAAgB,UAAU;CAExC;;;;;;CAOA,OAAiB,iBAAiB,OAAiC;EACjE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,OAChB,iBAAiB,KAAK,KAAK;CAE/B;;;;CAKA,AAAO,UAAU,YAAoB,SAAiB,cAAoB;EACxE,OAAO,UAAU,YAAY,SAAS,YAAY;CACpD;;;;;;;;;CAUA,AAAU,YAAY,WAA4B;EAChD,MAAM,EAAE,mBAAmB,gBAAgB,2BACzC,OAAO,IAAI,gBAAgB,GAC3B,OAAO,IAAI,iBAAiB,CAC9B;EAEA,MAAM,YAAY,OAAO,cAAc,YAAY,UAAU,SAAS,IAAI,YAAY;EAEtF,KAAK,UACH,cAAc,WAAc,gBAAgB,UAAa,YAAY,SAAS,SAAS,KACnF,YACA;EAEN,OAAO,KAAK;CACd;;;;;CAMA,AAAU,gBAAwB;EAChC,MAAM,YAAY;GAChB,KAAK,MAAM;GACX,KAAK,QAAQ;GACb,KAAK,OAAO,QAAQ;EACtB,CAAC,CAAC,MAAM,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;EAE/D,OAAO,KAAK,YAAY,SAAS;CACnC;;;;CAKA,IAAW,SAAiB;EAC1B,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAO,KAAK,cAAc;CAC5B;;;;CAKA,IAAW,OAAO,YAAoB;EACpC,KAAK,YAAY,UAAU;CAC7B;;;;CAKA,AAAO,cAAc,YAAoB;EACvC,KAAK,SAAS;EAEd,OAAO;CACT;;;;;;CAOA,AAAO,cAAc,0BAA2C;EAC9D,OAAO,KAAK;CACd;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,MAAa,SAAS,YAA2B,gBAA2B;EAC1E,OAAO,MAAM,EAAE,SAAS,YAAY,iBAAiB,KAAK,KAAK,cAAc,IAAI,KAAK,IAAI,CAAC;CAC7F;;;;CAKA,AAAO,OACL,MACA,eAAoB,MACpB;EACA,OAAO,KAAK,YAAY,QAAQ,KAAK,kBAAkB,MAAM;CAC/D;;;;CAKA,IAAW,UAA8C;EACvD,OAAO,KAAK,YAAY,WAAW,CAAC;CACtC;;;;CAKA,AAAO,OAAO,MAAc,cAAkC;EAC5D,MAAM,QAAQ,KAAK,QAAQ,SAAS;EAEpC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,SAAS,OAAO;GACd,OAAO;EACT;CACF;;;;CAKA,AAAO,UAAU,MAAuB;EACtC,OAAO,KAAK,QAAQ,UAAU;CAChC;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,SAAS,QAAQ,UAAU,EAAE;CACvD;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK;CACd;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,eAAe;EACxB,MAAM,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,WAAW;EAE7D,IAAI,QAAQ,WAAW,MAAM,GAC3B,OAAO,OAAO,QAAQ,UAAU,EAAE;EAGpC,OAAO;CACT;;;;CAKA,IAAW,qBAA6B;EACtC,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe,OAAO;EAE3B,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG,OAAO;EAE5D,OAAO,SAAS;CAClB;;;;;;CAOA,IAAW,cAAkC;EAC3C,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe;EAEpB,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,KAAK,YAAY,MAAM,UAAU;EAErC,OAAO;CACT;;;;CAKA,IAAW,gBAAgB;EACzB,OAAO,KAAK,OAAO,eAAe;CACpC;;;;CAKA,IAAW,SAAiB;EAC1B,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;CAYA,AAAU,iBAAiB,KAAqB;EAC9C,OAAO,IACJ,QAAQ,SAAS,GAAG,CAAC,CACrB,QAAQ,OAAO,GAAG,CAAC,CACnB,QAAQ,OAAO,EAAE;CACtB;;;;;;;;;;CAWA,AAAU,cAAc,OAAY,YAAqB,OAA4B;EACnF,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,KAAK;EAEhD,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK;CAClD;CAEA,AAAU,eAAe;EACvB,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,YAAY,IAAI;EAExD,KAAK,QAAQ,QAAQ,KAAK,UAAU,KAAK,YAAY,KAAK;EAC1D,KAAK,QAAQ,SAAS,EAAE,GAAI,KAAK,YAAY,UAAU,CAAC,EAAG;EAC3D,KAAK,QAAQ,MAAM;GACjB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAU,UAAU,MAAW;EAC7B,IAAI;GACF,IAAI,CAAC,MAAM,OAAO,CAAC;GAEnB,MAAM,OAAY,CAAC;GAEnB,MAAM,sBAA2B,CAAC;GAElC,KAAK,IAAI,OAAO,MAAM;IACpB,MAAM,QAAQ,KAAK;IAEnB,IAAI,aAAa;IAEjB,IAAI,IAAI,SAAS,IAAI,GACnB,aAAa;IAGf,MAAM,MAAM,KAAK,IAAI;IAMrB,IAAI,IAAI,SAAS,GAAG,GAAG;KAErB,IAAI,IAAI,SAAS,IAAI,GAAG;MACtB,MAAM,WAAW,IAAI,MAAM,GAAG;MAE9B,MAAM,UAAU,SAAS;MAEzB,MAAM,eAAe,SAAS,EAAE,CAAC,MAAM,GAAG;MAE1C,MAAM,QAAQ,OAAO,aAAa,EAAE;MAoBpC,IAAI,OAAO,MAAM,KAAK,GAAG;OACvB,IACE,MACA,KAAK,iBAAiB,GAAG,GACzB,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;OAEA;MACF;MAEA,IAAI,CAAC,oBAAoB,UACvB,oBAAoB,WAAW,CAAC;MAGlC,IAAI,CAAC,oBAAoB,QAAQ,CAAC,QAChC,oBAAoB,QAAQ,CAAC,SAAS,CAAC;MAKzC,MAAM,WADgB,SAAS,EAAE,CAAC,MAAM,GACX,CAAC,CAAC;MAE/B,oBAAoB,QAAQ,CAAC,MAAM,CAAC,YAAY,KAAK,WAAW,KAAK;MAErE;KACF;KAEA,MAAM,WAAW,IAAI,MAAM,GAAG;KAC9B,MAAM,UAAU,SAAS;KACzB,MAAM,eAAe,SAAS,EAAE,CAAC,MAAM,GAAG;KAe1C,IACE,MACA,UAAU,MAAM,aAAa,IAC7B,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;KAEA;IACF;IAEA,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,CAAC;SAC/C,IAAI,YACT,IAAI,KAAK,MACP,KAAK,IAAI,CAAC,KAAK,KAAK,WAAW,KAAK,CAAC;SAChC;KACL,KAAK,OAAO,CAAC,KAAK,WAAW,KAAK,CAAC;KAEnC;IACF;SAEA,IAAI,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;GAEzC;GAGA,KAAK,MAAM,OAAO,qBAChB,KAAK,OAAO,oBAAoB;GAGlC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,KAAK;GACjB,KAAK,IAAI,OAAO,OAAO;EACzB;CACF;;;;CAKA,AAAU,WAAW,MAAW;EAG9B,IAAI,MAAM,MAAM,OAAO,IAAI,aAAa,IAAI;EAC5C,IAAI,MAAM,UAAU,UAAa,MAAM,UAAU,MAAM,MACrD,OAAO,KAAK;EAGd,IAAI,SAAS,SAAS,OAAO;EAE7B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,OAAO,SAAS,UAAU,OAAO,KAAK,KAAK;EAE/C,OAAO;CACT;;;;CAKA,AAAO,SAAS,OAAc;EAC5B,KAAK,QAAQ;EAGb,KAAK,SAAS,SAAS,KAAK;EAE5B,OAAO;CACT;;;;CAKA,AAAO,QAAQ,WAAyB,GAAG,MAAa;EACtD,OAAO,OAAO,QAAQ,WAAW,aAAa,GAAG,MAAM,IAAI;CAC7D;;;;CAKA,AAAO,GAAG,WAAyB,UAAe;EAChD,OAAO,OAAO,UAAU,WAAW,aAAa,QAAQ;CAC1D;;;;CAKA,AAAO,IAAI,SAAc,QAAkB,QAAQ;EACjD,IAAI,CAAC,OAAO,IAAI,UAAU,GAAG;EAE7B,IAAI,IAAI;GACN,QAAQ;GACR,QAAQ,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK,QAAQ,MAAM,EAAE,IAAI,IAAI,KAAK;GAC/E;GACA,MAAM;GACN,SAAS,EACP,SAAS,KACX;EACF,CAAC;CACH;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,KAAK;CACtD;;;;;;;;;CAUA,MAAa,gBAAgB;EAG3B,MAAM,mBAAmB,MAAM,KAAK,kBAAkB;EAEtD,IAAI,qBAAqB,QAAW;GAElC,IAAI,4BAA4B,UAAU,OAAO;GAEjD,OAAO,KAAK,SAAS,KAAK,gBAAgB;EAC5C;EAEA,MAAM,UAAU,KAAK,MAAM;EAE3B,IAAI,CAAC,QAAQ,YAAY;EAKzB,OAAO,MAFwB,YAAY,QAAQ,YAAY,MAAM,KAAK,QAAQ;CAGpF;;;;;;CAOA,AAAO,aAAa;EAClB,OAAO,KAAK,MAAM;CACpB;;;;;CAMA,AAAO,UAAsC,QAAmD;EAC9F,IAAI,KAAK,eACP,OAAO,SACH,KAAK,KAAK,eAAyB,MAAkB,IACpD,KAAK;EAGZ,OAAO,CAAC;CACV;;;;CAKA,AAAO,gBAAgB,GAAG,QAAqC;EAC7D,OAAO,OAAO,KAAK,UAAU,GAAG,MAAM;CACxC;;;;CAKA,AAAO,iBAAiB,MAAyB;EAC/C,KAAK,gBAAgB;CACvB;;;;;;;;CASA,MAAa,UAAU;EACrB,IAAI;GAGF,KAAK,IAAI,uBAAuB;GAEhC,OAAO,MAAM,mBAAmB,MAAM,KAAK,QAAQ;EACrD,SAAS,OAAO;GACd,KAAK,IAAI,OAAO,OAAO;GAEvB,MAAM;EACR;CACF;;;;;;;CAQA,MAAgB,oBAAoB;EAElC,MAAM,cAAc,KAAK,mBAAmB;EAG5C,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,IAAI,sCAAsC;EAG/C,KAAK,QAAQ,uBAAuB,aAAa,KAAK,KAAK;EAE3D,KAAK,MAAM,cAAc,aAAa;GACpC,KAAK,IAAI,0BAA0B,OAAO,aAAa,WAAW,IAAI,CAAC;GACvE,MAAM,SAAS,MAAM,WAAW;IAAE,SAAS;IAAM,UAAU,KAAK;GAAS,CAAC;GAC1E,KAAK,IAAI,yBAAyB,OAAO,aAAa,WAAW,IAAI,GAAG,SAAS;GAEjF,IAAI,WAAW,QAAW;IACxB,KAAK,IACH,OAAO,OAAO,oCAAoC,IAAI,OAAO,WAAW,WAAW,IAAI,GACvF,MACF;IAEA,KAAK,QAAQ,oBAAoB;IAEjC,KAAK,IAAI,gCAAgC,SAAS;IAElD,OAAO;GACT;EACF;EAEA,KAAK,IAAI,gCAAgC,SAAS;EAGlD,KAAK,QAAQ,sBAAsB,aAAa,KAAK,KAAK;CAC5D;;;;;;;CAQA,AAAU,qBAAmC;EAC3C,MAAM,kBAAgC,CAAC;EAGvC,IAAI,KAAK,MAAM,YACb,gBAAgB,KAAK,GAAG,KAAK,MAAM,UAAU;EAG/C,OAAO;CACT;;;;CAKA,AAAO,MAAM,KAAa,cAAoB;EAC5C,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY;CAChD;;;;CAKA,AAAO,MAAM,MAAc,SAAS,eAAuB,IAAY;EACrE,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC,EAAE,YAAY,KAAK;CACzD;;;;CAKA,AAAO,IAAI,KAAa,cAAoB;EAC1C,OAAO,KAAK,MAAM,KAAK,YAAY;CACrC;;;;CAKA,AAAO,IAAI,KAAa;EACtB,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,MAAS,MAAM;CACnD;;;;CAKA,AAAO,IAAI,KAAa,OAAY;EAClC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,WAAW,KAAa,OAAY;EACzC,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAE1B,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,MAAM,GAAG,MAAgB;EAC9B,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EAE/C,OAAO;CACT;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,QAAQ,KAAa,OAAY;EACtC,IAAI,KAAK,QAAQ,MAAM,KAAK,KAAK;EAEjC,OAAO;CACT;;;;CAKA,IAAW,aAAa;EACtB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAM,aAAkB,CAAC;EAEzB,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,QAAQ,MAAM,WAAW;GAEnC,WAAW,OAAO;EACpB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,KAAuC;EAGjD,OAFa,KAAK,MAAM,GAEd;CACZ;;;;;CAMA,AAAO,MAAM,MAA8B;EACzC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC;CAC9B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,QAAQ,KAAK,KAAK;EAEnC,OAAO;CACT;;;;CAKA,IAAW,QAAQ;EACjB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK,KAAK;EAElC,OAAO;CACT;;;;CAKA,AAAO,MAAM;EACX,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,kBAAkB;EACvB,OAAO;GACL,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAO,oBAAoB;EACzB,MAAM,SAAS,KAAK,gBAAgB;EAEpC,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,QAAQ;EACb,MAAM,SAAS,KAAK,IAAI;EAExB,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAgB;EAC1B,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;CAC9B;;;;CAKA,AAAO,MAAM,MAAgB;EAC3B,MAAM,OAAO,KAAK,KAAK,IAAI;EAE3B,KAAK,MAAM,GAAG,IAAI;EAElB,OAAO;CACT;;;;CAKA,AAAO,OAAO,MAAgB;EAC5B,OAAO,OAAO,KAAK,IAAI,GAAG,IAAI;CAChC;;;;CAKA,AAAO,KAAK,KAAa,eAAe,OAAO;EAC7C,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,UAAU,QACZ,OAAO;EAGT,IAAI,UAAU,SACZ,OAAO;EAGT,IAAI,UAAU,GACZ,OAAO;EAGT,OAAO,QAAQ,KAAK;CACtB;;;;CAKA,AAAO,IAAI,KAAa,eAAuB,GAAuB;EACpE,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,CAAC,SAAS,UAAU,GAAG,OAAO;EAElC,OAAO,SAAS,KAAK;CACvB;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,IAAI,IAAI;CACtB;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,IAAY;EAC5D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,OAAO,KAAK;CACrB;;;;CAKA,AAAO,MAAM,KAAa,eAAuB,GAAW;EAC1D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,WAAW,KAAK,KAAK;CAC9B;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,GAAW;EAC3D,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;EAElD,OAAO,MAAM,KAAK,IAAI,eAAe;CACvC;;;;;;;;;;CAWA,IAAW,KAAK;EACd,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCA,AAAO,WAAW;EAGhB,IAAI,OAAO,IAAI,mBAAmB,KAAK,MAAM,MAAM;GACjD,MAAM,SAAS,KAAK,OAAO,WAAW;GAEtC,IAAI,QAAQ;IACV,MAAM,UAAU,OAAO,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,KAAK;IAElD,IAAI,SAAS,OAAO;GACtB;EACF;EAOA,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,SAAS;CACvB;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,YAAY;EACrB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,UAA2C;EACpD,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAO,UAAU,KAAiB,OAAe;EAC/C,KAAK,YAAY,QAAQ,IAAI,YAAY,KAAK;EAE9C,OAAO;CACT;AACF"}
+{"version":3,"file":"request.mjs","names":[],"sources":["C:/Work/Warlock.js/core/src/http/request.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport events from \"@mongez/events\";\nimport { trans, transFrom } from \"@mongez/localization\";\nimport {\n  Random,\n  except,\n  get,\n  only,\n  rtrim,\n  set,\n  unset,\n} from \"@mongez/reinforcements\";\nimport { isEmpty } from \"@mongez/supportive-is\";\nimport type { LogLevel } from \"@warlock.js/logger\";\nimport { log } from \"@warlock.js/logger\";\nimport { BaseValidator, v } from \"@warlock.js/seal\";\nimport type { FastifyRequest } from \"fastify\";\nimport { randomBytes } from \"node:crypto\";\nimport { type IncomingHttpHeaders } from \"node:http2\";\nimport { config } from \"../config/config-getter\";\nimport { resolveLocaleConfiguration } from \"../config/locale-configuration\";\nimport type { Middleware, Route } from \"../router\";\nimport { validateAll } from \"../validation/validateAll\";\nimport { createRequestStore } from \"./middleware/inject-request-context\";\nimport { Response } from \"./response\";\nimport type { RequestEvent, RequestLocals, RequestUser } from \"./types\";\nimport { UploadedFile } from \"./uploaded-file\";\n\ntype StandardHeaders = {\n  // copy every declared property from http.IncomingHttpHeaders\n  // but remove index signatures\n  [\n    K in keyof IncomingHttpHeaders as string extends K\n      ? never\n      : number extends K\n        ? never\n        : K\n  ]: IncomingHttpHeaders[K];\n};\n\ntype HeaderKeys = keyof StandardHeaders;\n\nexport class Request<RequestValidation = any> {\n  /**\n   * Underlying Fastify request — a public escape hatch to capabilities the\n   * framework's high-level helpers don't yet cover.\n   *\n   * **Prefer framework methods first**: `request.input()`, `request.header()`,\n   * `request.body`, `request.query`, `request.params`, `request.file()`,\n   * `request.user`, `request.detectIp()`, etc. They handle locale, parsing,\n   * trust-proxy, and validation pipeline integration correctly.\n   *\n   * **Reach for `baseRequest` only** when the framework genuinely lacks a\n   * helper for what you need — and when you do, file an issue so we can add\n   * it. The escape hatch is the release valve that lets consumers move\n   * faster than the framework, but every long-term reach here is a missing\n   * helper waiting to be added.\n   */\n  public baseRequest!: FastifyRequest;\n\n  /**\n   * Response Object\n   */\n  public response!: Response;\n\n  /**\n   * Route Object\n   */\n  public route!: Route;\n\n  /**\n   * Parsed Request Payload\n   */\n  protected payload: any = {};\n\n  /**\n   * Decoded access token payload (set by auth middleware)\n   */\n  public decodedAccessToken?: any;\n\n  /**\n   * The authenticated user attached to this request, if any.\n   *\n   * `RequestUser` is empty by default, so ANY shape is assignable here at the\n   * declaration site — the app or auth package declares its real fields via\n   * module augmentation:\n   *\n   * ```typescript\n   * declare module \"@warlock.js/core\" {\n   *   interface RequestUser {\n   *     id: string | number;\n   *   }\n   * }\n   * ```\n   *\n   * Replaces the v4 `GuardedRequest` convention\n   * (`create-warlock/.../guarded.request.ts` — `Request<T> & { user: User }`,\n   * an intersection type hand-declared per app) with a property core itself\n   * declares and types. `clearCurrentUser()` below is the one place core\n   * writes it directly; auth middleware is expected to do the same after a\n   * successful token resolution.\n   */\n  public user?: RequestUser;\n\n  /**\n   * Private, server-only, per-request data bag.\n   *\n   * Distinct from the input payload (`body` / `query` / `params` / `all()`):\n   * a write here never surfaces in `request.all()`, `request.validated()`, or\n   * `request.input()`. That is the trap `request.set()` sets for private data\n   * — it writes into the payload `all` bag, so anything stored there leaks\n   * into every input accessor and, from there, into the client-facing\n   * payload. `locals` is the correct home for private per-request app data\n   * (a resolved session, a fetched-once model) that must never be mistaken\n   * for client input.\n   *\n   * Augmentable via module augmentation, in the module that OWNS the key:\n   *\n   * ```typescript\n   * declare module \"@warlock.js/core\" {\n   *   interface RequestLocals {\n   *     session?: { token: string };\n   *   }\n   * }\n   * ```\n   *\n   * A plain class-field initializer is sufficient for \"fresh per request\":\n   * `router.ts:925` constructs `new Request()` for every incoming request —\n   * `Request` instances are not pooled or reused across requests — so this\n   * initializer runs exactly once per request and no value can leak in from\n   * a prior one.\n   */\n  public locals: RequestLocals = {};\n\n  /**\n   * Forget the authenticated user for this request.\n   *\n   * The `user` documentation above already names this as \"the one place core\n   * writes it directly\", and `@warlock.js/auth`'s middleware already calls it when\n   * a token is forged, malformed, expired, or of the wrong type. It was designed,\n   * documented and called — just never written, so `auth` could not typecheck.\n   *\n   * Clearing rather than leaving a stale value matters: a request that failed\n   * authentication must not carry the identity of whoever this object last held.\n   */\n  public clearCurrentUser(): void {\n    this.user = undefined;\n  }\n\n  /**\n   * Backing field for the lazily-generated CSP nonce. Left `undefined` until\n   * the first `request.nonce` read; see the `nonce` getter below.\n   */\n  protected _nonce?: string;\n\n  /**\n   * Per-request Content-Security-Policy nonce — a fresh, unguessable value\n   * the web layer hands to `<Scripts nonce={...} />` (the inline payload\n   * script) and to the `Content-Security-Policy` header, so a strict\n   * `script-src 'nonce-...'` allows only the script this request actually\n   * rendered.\n   *\n   * Generated LAZILY on first access, not eagerly in `setRequest()`: most\n   * requests (API routes, anything that isn't rendering HTML) never read it,\n   * and spending a `randomBytes` call on every single request for a value\n   * most of them discard is wasted entropy draw + CPU. Once generated it is\n   * cached in `_nonce`, so every subsequent read within the SAME request\n   * returns the identical value — required, since the header and the inline\n   * `<script>` tag must agree on one nonce. `_nonce` is a plain field on a\n   * per-request `Request` instance (see `locals` above — `router.ts:925`,\n   * no pooling), so the cache can never leak into the next request; a fresh\n   * `Request` means a fresh, unset `_nonce`.\n   *\n   * 16 random bytes, base64-encoded — the size the CSP Level 3 spec's own\n   * examples use, and far more entropy than an attacker could feasibly guess\n   * to defeat the policy.\n   */\n  public get nonce(): string {\n    if (!this._nonce) {\n      this._nonce = randomBytes(16).toString(\"base64\");\n    }\n\n    return this._nonce;\n  }\n\n  /**\n   * Current request instance\n   */\n  public static current: Request;\n\n  /**\n   * Translation method\n   * Type of it is the same as the type of trans function\n   */\n  public trans: ReturnType<typeof trans> = trans;\n\n  /**\n   * Alias to trans method\n   */\n  public t: ReturnType<typeof trans> = trans;\n\n  /*\n   * v5 removed the `[key: string]: any` index signature (eed20184). Attaching\n   * arbitrary properties compiled silently and hid real bugs behind `any`.\n   * The sanctioned extension paths are:\n   * - `request.locals` (augment `RequestLocals` via module augmentation) for\n   *   per-request attached data, e.g. models fetched in validation middleware.\n   * - `requestMemo(key, fn)` for per-request memoized computation.\n   * - Module augmentation of the `Request` class itself for new typed members.\n   */\n\n  /**\n   * Locale code\n   */\n  protected _locale = \"\";\n\n  /**\n   * Validated data\n   */\n  protected validatedData?: RequestValidation;\n\n  /**\n   * Request id\n   */\n  public id = Random.string(32);\n\n  /**\n   * Start Time\n   */\n  public startTime = Date.now();\n\n  /**\n   * End Time\n   */\n  public endTime?: undefined | number;\n\n  /**\n   * Set request handler\n   */\n  public setRequest(request: FastifyRequest) {\n    this.baseRequest = request;\n\n    this.resolveRequestId();\n\n    this.parsePayload();\n\n    // Resolve the locale at CALL time, never at bind time. `setRequest` runs\n    // before routing, so a locale set later (path locale, `setLocaleCode`, the\n    // web layer's C3 derivation) must steer translations too — the old\n    // `transFrom.bind(null, localeCode)` snapshot made `request.locale` and\n    // `request.trans()` silently disagree for the rest of the request.\n    this.trans = this.t = (keyword: string, placeholders?: any) =>\n      transFrom(this.getLocaleCode(), keyword, placeholders);\n\n    return this;\n  }\n\n  /**\n   * Inherit `X-Request-Id` from the incoming request, fall back to a custom\n   * generator, then to the field-init default (`Random.string(32)`).\n   *\n   * Inherited values are validated (length cap + printable-ASCII) to prevent\n   * log-injection from a malicious client. Disable the whole behavior by\n   * setting `http.requestId.enabled = false` — in which case the field-init\n   * default is used regardless of any incoming header.\n   */\n  protected resolveRequestId() {\n    const requestIdConfig = config.key(\"http.requestId\") || {};\n\n    if (requestIdConfig.enabled === false) return;\n\n    const headerName = (requestIdConfig.header || \"x-request-id\").toLowerCase();\n    const incoming = this.baseRequest.headers[headerName];\n\n    if (Request.isValidRequestId(incoming)) {\n      this.id = incoming;\n\n      return;\n    }\n\n    if (typeof requestIdConfig.generator === \"function\") {\n      this.id = requestIdConfig.generator();\n    }\n  }\n\n  /**\n   * Validate a candidate request-id value. Accepts non-empty printable ASCII\n   * up to 128 characters — tight enough to reject newline / control-character\n   * log-injection, loose enough to accept UUIDs, ULIDs, snowflakes, etc.\n   */\n  protected static isValidRequestId(value: unknown): value is string {\n    return (\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= 128 &&\n      /^[\\x21-\\x7e]+$/.test(value)\n    );\n  }\n\n  /**\n   * Translate from the given locale code\n   */\n  public transFrom(localeCode: string, keyword: string, placeholders?: any) {\n    return transFrom(localeCode, keyword, placeholders);\n  }\n\n  /**\n   * Cache one supported locale without coercing request-controlled input.\n   *\n   * The default is the answer for a client that asked for NOTHING. A client\n   * that did ask is only overridden when its value fails a declared\n   * `app.localeCodes` allow-list; with no list declared there is nothing to\n   * fail, so the requested locale passes through unchanged.\n   */\n  protected cacheLocale(candidate: unknown): string {\n    const { defaultLocaleCode, localeCodes } = resolveLocaleConfiguration(\n      config.key(\"app.localeCode\"),\n      config.key(\"app.localeCodes\"),\n    );\n\n    const requested =\n      typeof candidate === \"string\" && candidate.length > 0\n        ? candidate\n        : undefined;\n\n    this._locale =\n      requested !== undefined &&\n      (localeCodes === undefined || localeCodes.includes(requested))\n        ? requested\n        : defaultLocaleCode;\n\n    return this._locale;\n  }\n\n  /**\n   * Resolve the first present Mode B source. Unsupported values fail closed to\n   * the configured default instead of widening the application's locale set.\n   */\n  protected resolveLocale(): string {\n    const candidate = [\n      this.query[\"locale\"],\n      this.cookies[\"locale\"],\n      this.header(\"locale\"),\n    ].find((value) => typeof value === \"string\" && value.length > 0);\n\n    return this.cacheLocale(candidate);\n  }\n\n  /**\n   * Get current locale code\n   */\n  public get locale(): string {\n    if (this._locale) return this._locale;\n\n    return this.resolveLocale();\n  }\n\n  /**\n   * Set locale code\n   */\n  public set locale(localeCode: string) {\n    this.cacheLocale(localeCode);\n  }\n\n  /**\n   * Set locale code\n   */\n  public setLocaleCode(localeCode: string) {\n    this.locale = localeCode;\n\n    return this;\n  }\n\n  /**\n   * @deprecated Use `request.locale`. This alias is removed after one version.\n   * The legacy default argument is accepted for source compatibility but the\n   * resolved default is owned exclusively by app configuration.\n   */\n  public getLocaleCode(_legacyDefaultLocaleCode?: string): string {\n    return this.locale;\n  }\n\n  /**\n   * Get http protocol\n   */\n  public get protocol() {\n    return this.baseRequest.protocol;\n  }\n\n  /**\n   * Validate the given validation schema\n   */\n  public async validate(validation: BaseValidator, selectedInputs?: string[]) {\n    return await v.validate(\n      validation,\n      selectedInputs ? this.only(selectedInputs) : this.all(),\n    );\n  }\n\n  /**\n   * Get value of the given header\n   */\n  public header<TCustomHeader extends string = HeaderKeys>(\n    name: TCustomHeader | HeaderKeys,\n    defaultValue: any = null,\n  ) {\n    return this.baseRequest.headers[name.toLocaleLowerCase()] ?? defaultValue;\n  }\n\n  /**\n   * Get all cookies from the current request\n   */\n  public get cookies(): Record<string, string | undefined> {\n    return this.baseRequest.cookies || {};\n  }\n\n  /**\n   * Get a particular cookie value or fallback to default\n   */\n  public cookie(name: string, defaultValue?: any): string | any {\n    const value = this.cookies[name] ?? defaultValue;\n\n    try {\n      return JSON.parse(value);\n    } catch (error) {\n      return value;\n    }\n  }\n\n  /**\n   * Determine if the request has the specified cookie\n   */\n  public hasCookie(name: string): boolean {\n    return this.cookies[name] !== undefined;\n  }\n\n  /**\n   * Get the current request domain\n   */\n  public get domain() {\n    return this.baseRequest.hostname.replace(/^www\\./, \"\");\n  }\n\n  /**\n   * Get hostname\n   */\n  public get hostname() {\n    return this.domain;\n  }\n\n  /**\n   * Get request origin\n   */\n  public get origin() {\n    return this.baseRequest.headers.origin as string;\n  }\n\n  /**\n   * Get the domain of the origin\n   */\n  public get originDomain() {\n    const domain = this.origin ? new URL(this.origin).hostname : null;\n\n    if (domain?.startsWith(\"www.\")) {\n      return domain.replace(/^www\\./, \"\");\n    }\n\n    return domain;\n  }\n\n  /**\n   * Get authorization header value\n   */\n  public get authorizationValue(): string {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return \"\";\n\n    const [type, value] = authorization.split(\" \");\n\n    if (![\"bearer\", \"key\"].includes(type.toLowerCase())) return \"\";\n\n    return value || \"\";\n  }\n\n  /**\n   * Get access token from Authorization header\n   *\n   * If the Authorization header does not start with `Bearer` value then return null\n   */\n  public get accessToken(): string | undefined {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return;\n\n    const [type, value] = authorization.split(\" \");\n\n    if (type.toLowerCase() !== \"bearer\") return;\n\n    return value;\n  }\n\n  /**\n   * Get the authorization header\n   */\n  public get authorization() {\n    return this.header(\"authorization\");\n  }\n\n  /**\n   * Get current request method\n   */\n  public get method(): string {\n    return this.baseRequest.method;\n  }\n\n  /**\n   * Parse the payload and merge it from the request body, params and query string\n   */\n  /**\n   * Turn a bracket-notation key into the dotted path `set()` expects.\n   *\n   * `a[b][c]` -> `a.b.c`. Used only for NON-numeric nesting; numeric indices\n   * keep the array-of-objects path in {@link parseBody}, which builds real\n   * arrays rather than objects with numeric keys.\n   */\n  protected bracketKeyToPath(key: string): string {\n    return key.replace(/\\]\\[/g, \".\").replace(/\\[/g, \".\").replace(/\\]/g, \"\");\n  }\n\n  /**\n   * Apply the `key[]` array marker to a parsed value.\n   *\n   * The subtlety this exists to remove: a key declared `[]` should ALWAYS be an\n   * array, but the underlying query/body parser only hands us one when the\n   * caller sent the key more than once. Deciding the TYPE from the number of\n   * occurrences means one selected filter is a string and two are an array —\n   * a shape that changes under the user's hands.\n   */\n  protected arrayValueFor(\n    value: any,\n    isArrayKey: boolean,\n    parse: (value: any) => any,\n  ) {\n    if (Array.isArray(value)) return value.map(parse);\n\n    return isArrayKey ? [parse(value)] : parse(value);\n  }\n\n  protected parsePayload() {\n    this.payload.body = this.parseBody(this.baseRequest.body);\n\n    this.payload.query = this.parseBody(this.baseRequest.query);\n    this.payload.params = { ...(this.baseRequest.params || {}) };\n    this.payload.all = {\n      ...this.payload.body,\n      ...this.payload.query,\n      ...this.payload.params,\n    };\n  }\n\n  /**\n   * Parse body payload\n   */\n  protected parseBody(data: any) {\n    try {\n      if (!data) return {};\n\n      const body: any = {};\n\n      const arrayOfObjectValues: any = {};\n\n      for (let key in data) {\n        const value = data[key];\n\n        let isArrayKey = false;\n\n        if (key.endsWith(\"[]\")) {\n          isArrayKey = true;\n        }\n\n        key = rtrim(key, \"[]\");\n\n        // check if the key is has a square brackets, then convert it into object\n        // i.e user[email] => user: {email: \"value\"}\n        // also check if its an array of objects\n\n        if (key.includes(\"[\")) {\n          // check if its an array of objects\n          if (key.includes(\"][\")) {\n            const keyParts = key.split(\"[\");\n\n            const keyName = keyParts[0];\n\n            const keyNameParts = keyParts[1].split(\"]\");\n\n            const index = Number(keyNameParts[0]);\n\n            /*\n              A NON-NUMERIC first segment is not an array index — it is a deeper\n              nested object. `a[b][c]=x` reaches this branch because it contains\n              \"][\", but `Number(\"b\")` is NaN, and the code below used to write to\n              `[NaN]`: that sets a \"NaN\" PROPERTY on an array whose length stays\n              0, so the request arrived as `{a: []}` and the value was gone. No\n              error, no warning — the caller simply never got `x`.\n\n              Deciding between refusing (4xx) and interpreting: a doubly-nested\n              key is unambiguous and is exactly what every bracket-notation\n              parser means by it, so we interpret. Refusing would reject a URL\n              shape that is standard elsewhere and that we ourselves already\n              honour one level shallower, five lines below. What was definitely\n              wrong was answering with a shape the caller did not send.\n\n              Numeric indices keep the array-of-objects path below unchanged —\n              `items[0][name]` is still an array.\n            */\n            if (Number.isNaN(index)) {\n              set(\n                body,\n                this.bracketKeyToPath(key),\n                this.arrayValueFor(\n                  value,\n                  isArrayKey,\n                  this.parseValue.bind(this),\n                ),\n              );\n\n              continue;\n            }\n\n            if (!arrayOfObjectValues[keyName]) {\n              arrayOfObjectValues[keyName] = [];\n            }\n\n            if (!arrayOfObjectValues[keyName][index]) {\n              arrayOfObjectValues[keyName][index] = {};\n            }\n\n            // now get the key after the index\n            const keyNameParts2 = keyParts[2].split(\"]\");\n            const keyName2 = keyNameParts2[0];\n\n            arrayOfObjectValues[keyName][index][keyName2] =\n              this.parseValue(value);\n\n            continue;\n          }\n\n          const keyParts = key.split(\"[\");\n          const keyName = keyParts[0];\n          const keyNameParts = keyParts[1].split(\"]\");\n\n          /*\n            `isArrayKey` is honoured HERE, and used not to be. `filter[tags][]=a`\n            sets the flag at the top of the loop, but this branch only wrapped\n            when the underlying value was ALREADY an array — which it is for two\n            or more occurrences and is not for one. So `filter[tags][]=a` arrived\n            as `{filter:{tags:\"a\"}}` while `…=a&…=b` arrived as `{tags:[\"a\",\"b\"]}`:\n            the same declared shape, two different types, decided by how many\n            times the caller happened to send it.\n\n            That single-element case is the one a UI hits first — one filter\n            chip selected — and `@warlock.js/web`'s decoder reads it as an array,\n            so the page and the server disagreed about the same URL.\n          */\n          set(\n            body,\n            keyName + \".\" + keyNameParts[0],\n            this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n          );\n\n          continue;\n        }\n\n        if (Array.isArray(value)) {\n          set(body, key, value.map(this.parseValue.bind(this)));\n        } else if (isArrayKey) {\n          if (body[key]) {\n            body[key].push(this.parseValue(value));\n          } else {\n            body[key] = [this.parseValue(value)];\n\n            continue;\n          }\n        } else {\n          set(body, key, this.parseValue(value));\n        }\n      }\n\n      // now merge the array of objects into the body\n      for (const key in arrayOfObjectValues) {\n        body[key] = arrayOfObjectValues[key];\n      }\n\n      return body;\n    } catch (error) {\n      console.log(error);\n      this.log(error, \"error\");\n    }\n  }\n\n  /**\n   * Parse the given data\n   */\n  protected parseValue(data: any) {\n    // data.value appears only in the multipart form data\n    // if it json, then just return the data\n    if (data?.file) return new UploadedFile(data);\n    if (data?.value !== undefined && data?.fields && data?.type) {\n      data = data.value;\n    }\n\n    if (data === \"false\") return false;\n\n    if (data === \"true\") return true;\n\n    if (data === \"null\") return null;\n\n    if (typeof data === \"string\") return data.trim();\n\n    return data;\n  }\n\n  /**\n   * Set route handler\n   */\n  public setRoute(route: Route) {\n    this.route = route;\n\n    // pass the route to the response object\n    this.response.setRoute(route);\n\n    return this;\n  }\n\n  /**\n   * Trigger an http event\n   */\n  public trigger(eventName: RequestEvent, ...args: any[]) {\n    return events.trigger(`request.${eventName}`, ...args, this);\n  }\n\n  /**\n   * Listen to the given event\n   */\n  public on(eventName: RequestEvent, callback: any) {\n    return events.subscribe(`request.${eventName}`, callback);\n  }\n\n  /**\n   * Make a log message\n   */\n  public log(message: any, level: LogLevel = \"info\") {\n    if (!config.key(\"http.log\")) return;\n\n    log.log({\n      module: \"request\",\n      action:\n        this.route.method +\n        \" \" +\n        this.route.path.replace(\"/*\", \"\") +\n        `:${this.id}`,\n      message,\n      type: level,\n      context: {\n        request: this,\n      },\n    });\n  }\n\n  /**\n   * Get current request path\n   */\n  public get path() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * {@alias}\n   */\n  public get url() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * Get full url\n   */\n  public get fullUrl() {\n    return this.protocol + \"://\" + this.hostname + this.path;\n  }\n\n  /**\n   * Drive the middleware chain for the current route, then defer to the\n   * controller. Returns the first response value any middleware short-circuits\n   * with, or `undefined` to continue into validation + handler.\n   *\n   * @internal Framework orchestration — do not call from app code. Will move\n   * to a dedicated controller dispatcher in a future refactor.\n   */\n  public async runMiddleware() {\n    // measure request time\n    // check for middleware first\n    const middlewareOutput = await this.executeMiddleware();\n\n    if (middlewareOutput !== undefined) {\n      // 👇🏻 make sure first its not a response instance\n      if (middlewareOutput instanceof Response) return middlewareOutput;\n      // 👇🏻 send the response\n      return this.response.send(middlewareOutput);\n    }\n\n    const handler = this.route.handler;\n\n    if (!handler.validation) return;\n\n    // 👇🏻 check for validation using validateAll helper function\n    const validationOutput = await validateAll(\n      handler.validation,\n      this,\n      this.response,\n    );\n\n    return validationOutput;\n  }\n\n  /**\n   * Return the request handler attached to the current route.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  public getHandler() {\n    return this.route.handler;\n  }\n\n  /**\n   * Get inputs that has been validated only\n   * You can also pass an array of inputs to get only the validated inputs\n   */\n  public validated<Output = RequestValidation>(\n    inputs?: (keyof Output | (string & {}))[],\n  ): Output {\n    if (this.validatedData) {\n      return inputs\n        ? only(this.validatedData as Output, inputs as string[])\n        : (this.validatedData as Output);\n    }\n\n    return {} as Output;\n  }\n\n  /**\n   * Get inputs that has been validated except the given inputs\n   */\n  public validatedExcept(...inputs: string[]): RequestValidation {\n    return except(this.validated(), inputs);\n  }\n\n  /**\n   * Set validated data\n   */\n  public setValidatedData(data: RequestValidation) {\n    this.validatedData = data;\n  }\n\n  /**\n   * Top-level entry into the request lifecycle — opens the context store,\n   * runs middleware, drives the handler, handles errors.\n   *\n   * @internal Framework orchestration — do not call from app code. Wired\n   * from the Fastify route handler in `router.scan()`.\n   */\n  public async execute() {\n    try {\n      // call executingAction event\n\n      this.log(\"Executing the request\");\n\n      return await createRequestStore(this, this.response);\n    } catch (error) {\n      this.log(error, \"error\");\n\n      throw error;\n    }\n  }\n\n  /**\n   * Iterate the collected middlewares in order; return the first short-circuit\n   * value or `undefined` when every middleware passes through.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected async executeMiddleware() {\n    // collect all middlewares for current route\n    const middlewares = this.collectMiddlewares();\n\n    // check if there are no middlewares, then return\n    if (middlewares.length === 0) return;\n\n    this.log(\"About to execute request middlewares\");\n\n    // trigger the executingMiddleware event\n    this.trigger(\"executingMiddleware\", middlewares, this.route);\n\n    for (const middleware of middlewares) {\n      this.log(\"Executing middleware \" + colors.yellowBright(middleware.name));\n      const output = await middleware({\n        request: this,\n        response: this.response,\n      });\n      this.log(\n        \"Executed middleware \" + colors.yellowBright(middleware.name),\n        \"success\",\n      );\n\n      if (output !== undefined) {\n        this.log(\n          colors.yellow(\"request intercepted by middleware \") +\n            colors.cyanBright(middleware.name),\n          \"warn\",\n        );\n\n        this.trigger(\"executedMiddleware\");\n\n        this.log(\"Request middlewares executed\", \"success\");\n\n        return output;\n      }\n    }\n\n    this.log(\"Request middlewares executed\", \"success\");\n\n    // trigger the executedMiddleware event\n    this.trigger(\"executedMiddleware\", middlewares, this.route);\n  }\n\n  /**\n   * Gather the middleware list for the current route — today just the\n   * route-level array; future extraction may merge group + app-wide layers.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected collectMiddlewares(): Middleware[] {\n    const middlewaresList: Middleware[] = [];\n\n    // collect route middlewares\n    if (this.route.middleware) {\n      middlewaresList.push(...this.route.middleware);\n    }\n\n    return middlewaresList;\n  }\n\n  /**\n   * Get request input value from query string, params or body\n   */\n  public input(key: string, defaultValue?: any) {\n    return get(this.payload.all, key, defaultValue);\n  }\n\n  /**\n   * Get email input value, this will lowercase the value\n   */\n  public email(key: string = \"email\", defaultValue: string = \"\"): string {\n    return this.input(key, defaultValue)?.toLowerCase() || defaultValue;\n  }\n\n  /**\n   * @alias input\n   */\n  public get(key: string, defaultValue?: any) {\n    return this.input(key, defaultValue);\n  }\n\n  /**\n   * Determine if request has input value\n   */\n  public has(key: string) {\n    return get(this.payload.all, key, undefined) !== undefined;\n  }\n\n  /**\n   * Set request input value\n   */\n  public set(key: string, value: any) {\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Set the given value if the request does not have the input\n   */\n  public setDefault(key: string, value: any) {\n    if (this.has(key)) return this;\n\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Unset request payload keys\n   */\n  public unset(...keys: string[]) {\n    this.payload.all = unset(this.payload.all, keys);\n\n    return this;\n  }\n\n  /**\n   * Get request body\n   */\n  public get body() {\n    return this.payload.body;\n  }\n\n  /**\n   * Set request body value\n   */\n  public setBody(key: string, value: any) {\n    set(this.payload.body, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get body inputs except files\n   */\n  public get bodyInputs() {\n    const inputs = this.payload.body;\n\n    const bodyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (value.file && value.fieldname) continue;\n\n      bodyInputs[key] = value;\n    }\n\n    return bodyInputs;\n  }\n\n  /**\n   * Get request file in UploadedFile instance\n   */\n  public file(key: string): UploadedFile | undefined {\n    const file = this.input(key);\n\n    return file;\n  }\n\n  /**\n   * Get uploaded files from the request for the given name\n   * If the given name is not present in the request, return an empty array\n   */\n  public files(name: string): UploadedFile[] {\n    return this.input(name) || [];\n  }\n\n  /**\n   * Get request params\n   */\n  public get params() {\n    return this.payload.params;\n  }\n\n  /**\n   * Set request params value\n   */\n  public setParam(key: string, value: any) {\n    set(this.payload.params, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get request query\n   */\n  public get query() {\n    return this.payload.query;\n  }\n\n  /**\n   * Set request query value\n   */\n  public setQuery(key: string, value: any) {\n    set(this.payload.query, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get all inputs\n   */\n  public all() {\n    return this.payload.all;\n  }\n\n  /**\n   * Get all inputs except params\n   */\n  public allExceptParams() {\n    return {\n      ...this.payload.query,\n      ...this.payload.body,\n    };\n  }\n\n  /**\n   * Get all heavy inputs except params\n   */\n  public heavyExceptParams() {\n    const inputs = this.allExceptParams();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only heavy inputs, the input with a value\n   */\n  public heavy() {\n    const inputs = this.all();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only the given keys from the request data\n   */\n  public only(keys: string[]) {\n    return only(this.all(), keys);\n  }\n\n  /**\n   * Pluck the given keys from the request data\n   */\n  public pluck(keys: string[]) {\n    const data = this.only(keys);\n\n    this.unset(...keys);\n\n    return data;\n  }\n\n  /**\n   * Get all request inputs except the given keys\n   */\n  public except(keys: string[]) {\n    return except(this.all(), keys);\n  }\n\n  /**\n   * Get boolean input value\n   */\n  public bool(key: string, defaultValue = false) {\n    const value = this.input(key, defaultValue);\n\n    if (value === \"true\") {\n      return true;\n    }\n\n    if (value === \"false\") {\n      return false;\n    }\n\n    if (value === 0) {\n      return false;\n    }\n\n    return Boolean(value);\n  }\n\n  /**\n   * Get integer input value\n   */\n  public int(key: string, defaultValue: number = 0): number | undefined {\n    const value = this.input(key, defaultValue);\n\n    if (!value && value !== 0) return undefined;\n\n    return parseInt(value);\n  }\n\n  /**\n   * Shorthand getter to get id param\n   */\n  public get idParam() {\n    return this.int(\"id\");\n  }\n\n  /**\n   * Get string input value\n   */\n  public string(key: string, defaultValue: string = \"\"): string {\n    const value = this.input(key, defaultValue);\n\n    return String(value);\n  }\n\n  /**\n   * Get float input value\n   */\n  public float(key: string, defaultValue: number = 0): number {\n    const value = this.input(key, defaultValue);\n\n    return parseFloat(value) || 0;\n  }\n\n  /**\n   * Get number input value\n   */\n  public number(key: string, defaultValue: number = 0): number {\n    const value = Number(this.input(key, defaultValue));\n\n    return isNaN(value) ? defaultValue : value;\n  }\n\n  /**\n   * Immediate-peer IP as Fastify reports it — the address that connected to\n   * the server socket, with `trustProxy` resolution applied. Use this when\n   * you specifically need the peer address (rate-limit-by-direct-connection,\n   * health-check origin verification).\n   *\n   * **For most use cases prefer `request.detectIp()`** — behind any proxy\n   * (load balancer, CDN, sidecar) `ip` reports the proxy, not the real client.\n   */\n  public get ip() {\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * Best-effort real client IP — the value everything IP-scoped keys on\n   * (ip-filter allowlists, rate-limit buckets, idempotency scoping).\n   *\n   * `X-Forwarded-For` resolution is **delegated to Fastify**: `baseRequest.ip`\n   * is already the client address Fastify's `trustProxy` machinery picked out\n   * of the chain, so every shape `http.trustProxy` accepts is honoured here\n   * with exactly the semantics Fastify documents:\n   *\n   * - `false` (default) — no header is trusted; the socket peer address wins.\n   *   Both forwarding headers are client-settable, so without a trusted edge\n   *   that rewrites them any client could otherwise forge its own IP.\n   * - `true` — the whole chain is trusted; the leftmost hop (original client)\n   *   wins.\n   * - `number` — that many rightmost hops are trusted, so an edge that\n   *   APPENDS to `X-Forwarded-For` yields the real client rather than whatever\n   *   the client prepended.\n   * - CIDR / IP list (string, comma-separated string, or array) or a custom\n   *   predicate — the chain is walked right-to-left and stops at the first hop\n   *   that isn't a trusted proxy.\n   *\n   * `X-Real-IP` is NOT part of that resolution — Fastify never looks at it,\n   * and unlike `X-Forwarded-For` it carries no chain, so there is nothing to\n   * validate a proxy allowlist against. It is therefore honoured\n   * only under `trustProxy: true` (\"everything upstream is mine\"), where it is\n   * no weaker than the trust already granted. Under a bounded `trustProxy`\n   * (CIDR / IP list) it is ignored: a trusted-but-passthrough edge that\n   * forwards the client's own `X-Real-IP` verbatim would otherwise hand any\n   * client a way around the bound.\n   *\n   * **Prefer this over `request.ip` for any caller behind a proxy** (load\n   * balancer, CDN, reverse proxy, k8s ingress).\n   */\n  public detectIp() {\n    // Trusting `X-Real-IP` is only sound when the config trusts the entire\n    // upstream chain; bounded shapes get chain-aware resolution instead.\n    // Typed as `unknown`: config.get(key, fallback) infers the FALLBACK's type, so\n    // the literal `false` narrowed this to `false` and TypeScript called the\n    // comparison unreachable. The stored value is genuinely unconstrained at compile\n    // time - trustProxy accepts a boolean, a CIDR list or a predicate - so `unknown`\n    // is what it actually is, and the === true check is the narrowing.\n    const trustProxy: unknown = config.get(\"http.trustProxy\", false);\n\n    if (trustProxy === true) {\n      const realIp = this.header(\"x-real-ip\");\n\n      if (realIp) {\n        const address = String(realIp).split(\",\")[0].trim();\n\n        if (address) return address;\n      }\n    }\n\n    // Fastify resolved this against the configured `trustProxy` already:\n    // socket peer when trust is off, the correct hop of `X-Forwarded-For`\n    // when it is on. Re-parsing the header here would mean a second, weaker\n    // trust model that could disagree with `request.ip` and with the plugins\n    // (rate limit, proxy) that key on it.\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * An alias to detectIp\n   */\n  public get realIp() {\n    return this.detectIp();\n  }\n\n  /**\n   * Get request ips\n   */\n  public get ips() {\n    return this.baseRequest.ips;\n  }\n\n  /**\n   * Get request referer\n   */\n  public get referer() {\n    return this.baseRequest.headers.referer;\n  }\n\n  /**\n   * Get user agent\n   */\n  public get userAgent() {\n    return this.baseRequest.headers[\"user-agent\"];\n  }\n\n  /**\n   * Get request headers\n   */\n  public get headers(): typeof this.baseRequest.headers {\n    return this.baseRequest.headers;\n  }\n\n  /**\n   * Set the given header\n   */\n  public setHeader(key: HeaderKeys, value: string) {\n    this.baseRequest.headers[key.toLowerCase()] = value;\n\n    return this;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA0CA,IAAa,UAAb,MAAa,QAAiC;;iBA+BnB,CAAC;gBA2DK,CAAC;eA8DS;WAKJ;iBAejB;YAUR,OAAO,OAAO,EAAE;mBAKT,KAAK,IAAI;;;;;;;;;;;;;CApF5B,AAAO,mBAAyB;EAC9B,KAAK,OAAO;CACd;;;;;;;;;;;;;;;;;;;;;;;CA8BA,IAAW,QAAgB;EACzB,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,YAAY,EAAE,EAAE,SAAS,QAAQ;EAGjD,OAAO,KAAK;CACd;;;;CAwDA,AAAO,WAAW,SAAyB;EACzC,KAAK,cAAc;EAEnB,KAAK,iBAAiB;EAEtB,KAAK,aAAa;EAOlB,KAAK,QAAQ,KAAK,KAAK,SAAiB,iBACtC,UAAU,KAAK,cAAc,GAAG,SAAS,YAAY;EAEvD,OAAO;CACT;;;;;;;;;;CAWA,AAAU,mBAAmB;EAC3B,MAAM,kBAAkB,OAAO,IAAI,gBAAgB,KAAK,CAAC;EAEzD,IAAI,gBAAgB,YAAY,OAAO;EAEvC,MAAM,cAAc,gBAAgB,UAAU,gBAAgB,YAAY;EAC1E,MAAM,WAAW,KAAK,YAAY,QAAQ;EAE1C,IAAI,QAAQ,iBAAiB,QAAQ,GAAG;GACtC,KAAK,KAAK;GAEV;EACF;EAEA,IAAI,OAAO,gBAAgB,cAAc,YACvC,KAAK,KAAK,gBAAgB,UAAU;CAExC;;;;;;CAOA,OAAiB,iBAAiB,OAAiC;EACjE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,OAChB,iBAAiB,KAAK,KAAK;CAE/B;;;;CAKA,AAAO,UAAU,YAAoB,SAAiB,cAAoB;EACxE,OAAO,UAAU,YAAY,SAAS,YAAY;CACpD;;;;;;;;;CAUA,AAAU,YAAY,WAA4B;EAChD,MAAM,EAAE,mBAAmB,gBAAgB,2BACzC,OAAO,IAAI,gBAAgB,GAC3B,OAAO,IAAI,iBAAiB,CAC9B;EAEA,MAAM,YACJ,OAAO,cAAc,YAAY,UAAU,SAAS,IAChD,YACA;EAEN,KAAK,UACH,cAAc,WACb,gBAAgB,UAAa,YAAY,SAAS,SAAS,KACxD,YACA;EAEN,OAAO,KAAK;CACd;;;;;CAMA,AAAU,gBAAwB;EAChC,MAAM,YAAY;GAChB,KAAK,MAAM;GACX,KAAK,QAAQ;GACb,KAAK,OAAO,QAAQ;EACtB,EAAE,MAAM,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;EAE/D,OAAO,KAAK,YAAY,SAAS;CACnC;;;;CAKA,IAAW,SAAiB;EAC1B,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAO,KAAK,cAAc;CAC5B;;;;CAKA,IAAW,OAAO,YAAoB;EACpC,KAAK,YAAY,UAAU;CAC7B;;;;CAKA,AAAO,cAAc,YAAoB;EACvC,KAAK,SAAS;EAEd,OAAO;CACT;;;;;;CAOA,AAAO,cAAc,0BAA2C;EAC9D,OAAO,KAAK;CACd;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,MAAa,SAAS,YAA2B,gBAA2B;EAC1E,OAAO,MAAM,EAAE,SACb,YACA,iBAAiB,KAAK,KAAK,cAAc,IAAI,KAAK,IAAI,CACxD;CACF;;;;CAKA,AAAO,OACL,MACA,eAAoB,MACpB;EACA,OAAO,KAAK,YAAY,QAAQ,KAAK,kBAAkB,MAAM;CAC/D;;;;CAKA,IAAW,UAA8C;EACvD,OAAO,KAAK,YAAY,WAAW,CAAC;CACtC;;;;CAKA,AAAO,OAAO,MAAc,cAAkC;EAC5D,MAAM,QAAQ,KAAK,QAAQ,SAAS;EAEpC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,SAAS,OAAO;GACd,OAAO;EACT;CACF;;;;CAKA,AAAO,UAAU,MAAuB;EACtC,OAAO,KAAK,QAAQ,UAAU;CAChC;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,SAAS,QAAQ,UAAU,EAAE;CACvD;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK;CACd;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,eAAe;EACxB,MAAM,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,EAAE,WAAW;EAE7D,IAAI,QAAQ,WAAW,MAAM,GAC3B,OAAO,OAAO,QAAQ,UAAU,EAAE;EAGpC,OAAO;CACT;;;;CAKA,IAAW,qBAA6B;EACtC,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe,OAAO;EAE3B,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,CAAC,CAAC,UAAU,KAAK,EAAE,SAAS,KAAK,YAAY,CAAC,GAAG,OAAO;EAE5D,OAAO,SAAS;CAClB;;;;;;CAOA,IAAW,cAAkC;EAC3C,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe;EAEpB,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,KAAK,YAAY,MAAM,UAAU;EAErC,OAAO;CACT;;;;CAKA,IAAW,gBAAgB;EACzB,OAAO,KAAK,OAAO,eAAe;CACpC;;;;CAKA,IAAW,SAAiB;EAC1B,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;CAYA,AAAU,iBAAiB,KAAqB;EAC9C,OAAO,IAAI,QAAQ,SAAS,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;CACxE;;;;;;;;;;CAWA,AAAU,cACR,OACA,YACA,OACA;EACA,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,KAAK;EAEhD,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK;CAClD;CAEA,AAAU,eAAe;EACvB,KAAK,QAAQ,OAAO,KAAK,UAAU,KAAK,YAAY,IAAI;EAExD,KAAK,QAAQ,QAAQ,KAAK,UAAU,KAAK,YAAY,KAAK;EAC1D,KAAK,QAAQ,SAAS,EAAE,GAAI,KAAK,YAAY,UAAU,CAAC,EAAG;EAC3D,KAAK,QAAQ,MAAM;GACjB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAU,UAAU,MAAW;EAC7B,IAAI;GACF,IAAI,CAAC,MAAM,OAAO,CAAC;GAEnB,MAAM,OAAY,CAAC;GAEnB,MAAM,sBAA2B,CAAC;GAElC,KAAK,IAAI,OAAO,MAAM;IACpB,MAAM,QAAQ,KAAK;IAEnB,IAAI,aAAa;IAEjB,IAAI,IAAI,SAAS,IAAI,GACnB,aAAa;IAGf,MAAM,MAAM,KAAK,IAAI;IAMrB,IAAI,IAAI,SAAS,GAAG,GAAG;KAErB,IAAI,IAAI,SAAS,IAAI,GAAG;MACtB,MAAM,WAAW,IAAI,MAAM,GAAG;MAE9B,MAAM,UAAU,SAAS;MAEzB,MAAM,eAAe,SAAS,GAAG,MAAM,GAAG;MAE1C,MAAM,QAAQ,OAAO,aAAa,EAAE;MAoBpC,IAAI,OAAO,MAAM,KAAK,GAAG;OACvB,IACE,MACA,KAAK,iBAAiB,GAAG,GACzB,KAAK,cACH,OACA,YACA,KAAK,WAAW,KAAK,IAAI,CAC3B,CACF;OAEA;MACF;MAEA,IAAI,CAAC,oBAAoB,UACvB,oBAAoB,WAAW,CAAC;MAGlC,IAAI,CAAC,oBAAoB,SAAS,QAChC,oBAAoB,SAAS,SAAS,CAAC;MAKzC,MAAM,WADgB,SAAS,GAAG,MAAM,GACX,EAAE;MAE/B,oBAAoB,SAAS,OAAO,YAClC,KAAK,WAAW,KAAK;MAEvB;KACF;KAEA,MAAM,WAAW,IAAI,MAAM,GAAG;KAC9B,MAAM,UAAU,SAAS;KACzB,MAAM,eAAe,SAAS,GAAG,MAAM,GAAG;KAe1C,IACE,MACA,UAAU,MAAM,aAAa,IAC7B,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;KAEA;IACF;IAEA,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,CAAC;SAC/C,IAAI,YACT,IAAI,KAAK,MACP,KAAK,KAAK,KAAK,KAAK,WAAW,KAAK,CAAC;SAChC;KACL,KAAK,OAAO,CAAC,KAAK,WAAW,KAAK,CAAC;KAEnC;IACF;SAEA,IAAI,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;GAEzC;GAGA,KAAK,MAAM,OAAO,qBAChB,KAAK,OAAO,oBAAoB;GAGlC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,KAAK;GACjB,KAAK,IAAI,OAAO,OAAO;EACzB;CACF;;;;CAKA,AAAU,WAAW,MAAW;EAG9B,IAAI,MAAM,MAAM,OAAO,IAAI,aAAa,IAAI;EAC5C,IAAI,MAAM,UAAU,UAAa,MAAM,UAAU,MAAM,MACrD,OAAO,KAAK;EAGd,IAAI,SAAS,SAAS,OAAO;EAE7B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,OAAO,SAAS,UAAU,OAAO,KAAK,KAAK;EAE/C,OAAO;CACT;;;;CAKA,AAAO,SAAS,OAAc;EAC5B,KAAK,QAAQ;EAGb,KAAK,SAAS,SAAS,KAAK;EAE5B,OAAO;CACT;;;;CAKA,AAAO,QAAQ,WAAyB,GAAG,MAAa;EACtD,OAAO,OAAO,QAAQ,WAAW,aAAa,GAAG,MAAM,IAAI;CAC7D;;;;CAKA,AAAO,GAAG,WAAyB,UAAe;EAChD,OAAO,OAAO,UAAU,WAAW,aAAa,QAAQ;CAC1D;;;;CAKA,AAAO,IAAI,SAAc,QAAkB,QAAQ;EACjD,IAAI,CAAC,OAAO,IAAI,UAAU,GAAG;EAE7B,IAAI,IAAI;GACN,QAAQ;GACR,QACE,KAAK,MAAM,SACX,MACA,KAAK,MAAM,KAAK,QAAQ,MAAM,EAAE,IAChC,IAAI,KAAK;GACX;GACA,MAAM;GACN,SAAS,EACP,SAAS,KACX;EACF,CAAC;CACH;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,KAAK;CACtD;;;;;;;;;CAUA,MAAa,gBAAgB;EAG3B,MAAM,mBAAmB,MAAM,KAAK,kBAAkB;EAEtD,IAAI,qBAAqB,QAAW;GAElC,IAAI,4BAA4B,UAAU,OAAO;GAEjD,OAAO,KAAK,SAAS,KAAK,gBAAgB;EAC5C;EAEA,MAAM,UAAU,KAAK,MAAM;EAE3B,IAAI,CAAC,QAAQ,YAAY;EASzB,OAAO,MANwB,YAC7B,QAAQ,YACR,MACA,KAAK,QACP;CAGF;;;;;;CAOA,AAAO,aAAa;EAClB,OAAO,KAAK,MAAM;CACpB;;;;;CAMA,AAAO,UACL,QACQ;EACR,IAAI,KAAK,eACP,OAAO,SACH,KAAK,KAAK,eAAyB,MAAkB,IACpD,KAAK;EAGZ,OAAO,CAAC;CACV;;;;CAKA,AAAO,gBAAgB,GAAG,QAAqC;EAC7D,OAAO,OAAO,KAAK,UAAU,GAAG,MAAM;CACxC;;;;CAKA,AAAO,iBAAiB,MAAyB;EAC/C,KAAK,gBAAgB;CACvB;;;;;;;;CASA,MAAa,UAAU;EACrB,IAAI;GAGF,KAAK,IAAI,uBAAuB;GAEhC,OAAO,MAAM,mBAAmB,MAAM,KAAK,QAAQ;EACrD,SAAS,OAAO;GACd,KAAK,IAAI,OAAO,OAAO;GAEvB,MAAM;EACR;CACF;;;;;;;CAQA,MAAgB,oBAAoB;EAElC,MAAM,cAAc,KAAK,mBAAmB;EAG5C,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,IAAI,sCAAsC;EAG/C,KAAK,QAAQ,uBAAuB,aAAa,KAAK,KAAK;EAE3D,KAAK,MAAM,cAAc,aAAa;GACpC,KAAK,IAAI,0BAA0B,OAAO,aAAa,WAAW,IAAI,CAAC;GACvE,MAAM,SAAS,MAAM,WAAW;IAC9B,SAAS;IACT,UAAU,KAAK;GACjB,CAAC;GACD,KAAK,IACH,yBAAyB,OAAO,aAAa,WAAW,IAAI,GAC5D,SACF;GAEA,IAAI,WAAW,QAAW;IACxB,KAAK,IACH,OAAO,OAAO,oCAAoC,IAChD,OAAO,WAAW,WAAW,IAAI,GACnC,MACF;IAEA,KAAK,QAAQ,oBAAoB;IAEjC,KAAK,IAAI,gCAAgC,SAAS;IAElD,OAAO;GACT;EACF;EAEA,KAAK,IAAI,gCAAgC,SAAS;EAGlD,KAAK,QAAQ,sBAAsB,aAAa,KAAK,KAAK;CAC5D;;;;;;;CAQA,AAAU,qBAAmC;EAC3C,MAAM,kBAAgC,CAAC;EAGvC,IAAI,KAAK,MAAM,YACb,gBAAgB,KAAK,GAAG,KAAK,MAAM,UAAU;EAG/C,OAAO;CACT;;;;CAKA,AAAO,MAAM,KAAa,cAAoB;EAC5C,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY;CAChD;;;;CAKA,AAAO,MAAM,MAAc,SAAS,eAAuB,IAAY;EACrE,OAAO,KAAK,MAAM,KAAK,YAAY,GAAG,YAAY,KAAK;CACzD;;;;CAKA,AAAO,IAAI,KAAa,cAAoB;EAC1C,OAAO,KAAK,MAAM,KAAK,YAAY;CACrC;;;;CAKA,AAAO,IAAI,KAAa;EACtB,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,MAAS,MAAM;CACnD;;;;CAKA,AAAO,IAAI,KAAa,OAAY;EAClC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,WAAW,KAAa,OAAY;EACzC,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAE1B,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,MAAM,GAAG,MAAgB;EAC9B,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EAE/C,OAAO;CACT;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,QAAQ,KAAa,OAAY;EACtC,IAAI,KAAK,QAAQ,MAAM,KAAK,KAAK;EAEjC,OAAO;CACT;;;;CAKA,IAAW,aAAa;EACtB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAM,aAAkB,CAAC;EAEzB,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,QAAQ,MAAM,WAAW;GAEnC,WAAW,OAAO;EACpB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,KAAuC;EAGjD,OAFa,KAAK,MAAM,GAEd;CACZ;;;;;CAMA,AAAO,MAAM,MAA8B;EACzC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC;CAC9B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,QAAQ,KAAK,KAAK;EAEnC,OAAO;CACT;;;;CAKA,IAAW,QAAQ;EACjB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK,KAAK;EAElC,OAAO;CACT;;;;CAKA,AAAO,MAAM;EACX,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,kBAAkB;EACvB,OAAO;GACL,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAO,oBAAoB;EACzB,MAAM,SAAS,KAAK,gBAAgB;EAEpC,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,QAAQ;EACb,MAAM,SAAS,KAAK,IAAI;EAExB,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAgB;EAC1B,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;CAC9B;;;;CAKA,AAAO,MAAM,MAAgB;EAC3B,MAAM,OAAO,KAAK,KAAK,IAAI;EAE3B,KAAK,MAAM,GAAG,IAAI;EAElB,OAAO;CACT;;;;CAKA,AAAO,OAAO,MAAgB;EAC5B,OAAO,OAAO,KAAK,IAAI,GAAG,IAAI;CAChC;;;;CAKA,AAAO,KAAK,KAAa,eAAe,OAAO;EAC7C,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,UAAU,QACZ,OAAO;EAGT,IAAI,UAAU,SACZ,OAAO;EAGT,IAAI,UAAU,GACZ,OAAO;EAGT,OAAO,QAAQ,KAAK;CACtB;;;;CAKA,AAAO,IAAI,KAAa,eAAuB,GAAuB;EACpE,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,CAAC,SAAS,UAAU,GAAG,OAAO;EAElC,OAAO,SAAS,KAAK;CACvB;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,IAAI,IAAI;CACtB;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,IAAY;EAC5D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,OAAO,KAAK;CACrB;;;;CAKA,AAAO,MAAM,KAAa,eAAuB,GAAW;EAC1D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,WAAW,KAAK,KAAK;CAC9B;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,GAAW;EAC3D,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;EAElD,OAAO,MAAM,KAAK,IAAI,eAAe;CACvC;;;;;;;;;;CAWA,IAAW,KAAK;EACd,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCA,AAAO,WAAW;EAUhB,IAF4B,OAAO,IAAI,mBAAmB,KAE7C,MAAM,MAAM;GACvB,MAAM,SAAS,KAAK,OAAO,WAAW;GAEtC,IAAI,QAAQ;IACV,MAAM,UAAU,OAAO,MAAM,EAAE,MAAM,GAAG,EAAE,GAAG,KAAK;IAElD,IAAI,SAAS,OAAO;GACtB;EACF;EAOA,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,SAAS;CACvB;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,YAAY;EACrB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,UAA2C;EACpD,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAO,UAAU,KAAiB,OAAe;EAC/C,KAAK,YAAY,QAAQ,IAAI,YAAY,KAAK;EAE9C,OAAO;CACT;AACF"}

package/esm/http/response.d.mts

@@ -9,7 +9,7 @@ import { FastifyReply } from "fastify";
 import { CookieSerializeOptions } from "@fastify/cookie";
 import React from "react";
 
-//#region ../core/src/http/response.d.ts
+//#region core/src/http/response.d.ts
 type CookieValue = string | number | boolean | Record<string, any> | Array<any>;
 /**
  * Cookie options accepted by `response.cookie()`.
@@ -115,7 +115,7 @@ declare class Response {
   /**
    * Get raw response
    */
-  get raw(): import("node:http").ServerResponse<import("node:http").IncomingMessage>;
+  get raw(): import("http").ServerResponse<import("http").IncomingMessage>;
   /**
    * Get Current response body
    */
@@ -398,7 +398,7 @@ declare class Response {
   /**
    * Send a no content response with status code 204
    */
-  noContent(): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("node:http").ServerResponse<import("node:http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
+  noContent(): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
   /**
    * Send an accepted response with status code 202
    * Used for async operations that have been accepted but not yet processed
@@ -442,7 +442,7 @@ declare class Response {
    * Send buffer as a response
    * Useful for dynamically generated content (e.g., resized images, generated PDFs)
    */
-  sendBuffer(buffer: Buffer, options?: number | SendBufferOptions): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("node:http").IncomingMessage, import("node:http").ServerResponse<import("node:http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
+  sendBuffer(buffer: Buffer, options?: number | SendBufferOptions): FastifyReply<import("fastify").RouteGenericInterface, import("fastify").RawServerDefault, import("http").IncomingMessage, import("http").ServerResponse<import("http").IncomingMessage>, unknown, import("fastify").FastifySchema, import("fastify").FastifyTypeProviderDefault, unknown>;
   /**
    * Send an Image instance as a response
    * Automatically detects image format and sets content type

package/esm/http/response.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"response.d.mts","names":[],"sources":["../../../../../../../core/src/http/response.ts"],"mappings":";;;;;;;;;;;;KAsBK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFoB;;;;AAEpB;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AAAA,cAqBW,QAAA;EAAQ;;;EAAA,UAIT,KAAA,EAAQ,KAAA;EAiCD;;;;;;;;;;;;;;;;EAfV,YAAA,EAAe,YAAA;EAsauB;;;EAAA,UAjanC,iBAAA;EAwamE;;;EAAA,UAnanE,WAAA;EAibmC;;;EA5atC,OAAA,EAAU,OAAA;EA0vBA;;;EAAA,UArvBP,MAAA,EAAM,GAAA;EA6zB2B;;;;;EAtzBpC,UAAA;EAy1B4B;;;EAAA,IAp1BxB,GAAA,wBAAG,cAAA,qBAAA,eAAA;EAy2BX;;;EAAA,IAl2BQ,IAAA;EAi3BqB;;;EAAA,IA12BrB,IAAA,CAAK,IAAA;EAw3B4B;;;EAj3BrC,SAAA,CAAU,QAAA;EAu4ByC;;;EA93BnD,MAAA,CAAO,QAAA;EA64BsB;;;EAp4B7B,WAAA,CAAY,QAAA,EAAU,YAAA;EA29B2D;;;EA58BjF,KAAA;EAkiC+D;;;EAzhC/D,QAAA,CAAS,KAAA,EAAO,KAAA;EAolCc;;;EAAA,IA3kC1B,WAAA;EAklCoC;;;EA3kCxC,cAAA,CAAe,WAAA;EA0oCsB;;;EAAA,IAjoCjC,UAAA;EA1ID;;;EAAA,IAiJC,IAAA;EA1HD;;;EAAA,IAiIC,IAAA;EAlHD;;;EAAA,OAyHI,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAhHW;;;EAAA,iBAuHS,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EAzGnD;;;EAAA,UAsHA,SAAA,IAAS,OAAA;EAtGX;;;EA6GD,KAAA,CAAM,KAAA,QAAa,OAAA;EArFzB;;;EA4HA,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EA1GxB;;;EAAA,IA4HA,MAAA;EArGA;;;;;;EA+GE,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EA/FhF;;;;;;;;;;;;;;;;;;;EA+PK,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAHV;;;EAsBK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAxB/B;;;EA+BP,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EAPjE;;;EAcL,GAAA,CAAI,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAPrC;;;EAcA,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAdK;;;;;;;;;;;;;;;;;;;EAqC3C,MAAA,CAAO,WAAA,YAA6B,wBAAA;EAqQpC;;;;;;;;;;;;;;;;;;;;;;;;EAtIA,GAAA,IAAO,qBAAA;EA4O2C;;;EAtGlD,aAAA,CAAc,UAAA;EA0HsB;;;EAjHpC,QAAA,CAAS,GAAA,UAAa,UAAA;EA2HC;;;EAlHvB,iBAAA,CAAkB,GAAA;EAyHG;;;EAhHrB,eAAA;EA0HJ;;;EAnHI,YAAA,CAAa,GAAA;EA2He;;;EAlH5B,SAAA,CAAU,GAAA;EA4Hd;;;EArHI,UAAA,IAAU,MAAA,+BAAA,UAAA;EAgId;;;EAzHI,OAAA,CAAQ,OAAA,EAAS,MAAA;EAiIG;;;EAxHpB,MAAA,CAAO,GAAA,UAAa,KAAA;EA+HK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA3FzB,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA8I9B;;;;;;EA1HpB,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EAiNrB;;;EAvMf,SAAA,CAAU,GAAA,UAAa,KAAA;EAuM0D;;;EAhMjF,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;EAsRyB;;;EA/Q9C,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA4QmE;;;EApQ/D,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;EAoQmC;;;EA7P/D,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA8QmB;;;EAtQf,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EAmQqF;;;EA3PjF,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;EAkSuB;;;EA3R3C,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EAkShB;;;EA3RT,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;EAkSjB;;;EA3RN,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;EA2RiB;;;EApRtD,SAAA,IAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EA4UY;;;;EApUrB,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;EAoU9B;;;EA7TrC,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;;;;EAOnD,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;EAQzB,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;;;;;;;;;;;;UAmB5B,kBAAA;EAAA,QA2BA,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EAsFjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,sBAAA,eAAA,sBAAA,cAAA,qBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAgDtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}
+{"version":3,"file":"response.d.mts","names":[],"sources":["C:/Work/Warlock.js/core/src/http/response.ts"],"mappings":";;;;;;;;;;;;KAsBK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFoB;;;;AAEpB;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AAAA,cAqBW,QAAA;EAAQ;;;EAAA,UAIT,KAAA,EAAQ,KAAA;EAiCD;;;;;;;;;;;;;;;;EAfV,YAAA,EAAe,YAAA;EAsauB;;;EAAA,UAjanC,iBAAA;EAwamE;;;EAAA,UAnanE,WAAA;EAibmC;;;EA5atC,OAAA,EAAU,OAAA;EA0vBA;;;EAAA,UArvBP,MAAA,EAAM,GAAA;EA6zB2B;;;;;EAtzBpC,UAAA;EAy1B4B;;;EAAA,IAp1BxB,GAAA,CAAA,kBAAG,cAAA,gBAAA,eAAA;EAy2BX;;;EAAA,IAl2BQ,IAAA,CAAA;EAi3BqB;;;EAAA,IA12BrB,IAAA,CAAK,IAAA;EAw3B4B;;;EAj3BrC,SAAA,CAAU,QAAA;EAu4ByC;;;EA93BnD,MAAA,CAAO,QAAA;EA64BsB;;;EAp4B7B,WAAA,CAAY,QAAA,EAAU,YAAA;EA29B2D;;;EA58BjF,KAAA,CAAA;EAkiC+D;;;EAzhC/D,QAAA,CAAS,KAAA,EAAO,KAAA;EAolCc;;;EAAA,IA3kC1B,WAAA,CAAA;EAklCoC;;;EA3kCxC,cAAA,CAAe,WAAA;EA0oCsB;;;EAAA,IAjoCjC,UAAA,CAAA;EA1ID;;;EAAA,IAiJC,IAAA,CAAA;EA1HD;;;EAAA,IAiIC,IAAA,CAAA;EAlHD;;;EAAA,OAyHI,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAhHW;;;EAAA,iBAuHS,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EAzGnD;;;EAAA,UAsHA,SAAA,CAAA,GAAS,OAAA;EAtGX;;;EA6GD,KAAA,CAAM,KAAA,QAAa,OAAA;EArFzB;;;EA4HA,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EA1GxB;;;EAAA,IA4HA,MAAA,CAAA;EArGA;;;;;;EA+GE,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EA/FhF;;;;;;;;;;;;;;;;;;;EA+PK,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAHV;;;EAsBK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAxB/B;;;EA+BP,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EAPjE;;;EAcL,GAAA,CAAI,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAPrC;;;EAcA,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAdK;;;;;;;;;;;;;;;;;;;EAqC3C,MAAA,CAAO,WAAA,YAA6B,wBAAA;EAqQpC;;;;;;;;;;;;;;;;;;;;;;;;EAtIA,GAAA,CAAA,GAAO,qBAAA;EA4O2C;;;EAtGlD,aAAA,CAAc,UAAA;EA0HsB;;;EAjHpC,QAAA,CAAS,GAAA,UAAa,UAAA;EA2HC;;;EAlHvB,iBAAA,CAAkB,GAAA;EAyHG;;;EAhHrB,eAAA,CAAA;EA0HJ;;;EAnHI,YAAA,CAAa,GAAA;EA2He;;;EAlH5B,SAAA,CAAU,GAAA;EA4Hd;;;EArHI,UAAA,CAAA,GAAU,MAAA,+BAAA,UAAA;EAgId;;;EAzHI,OAAA,CAAQ,OAAA,EAAS,MAAA;EAiIG;;;EAxHpB,MAAA,CAAO,GAAA,UAAa,KAAA;EA+HK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA3FzB,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA8I9B;;;;;;EA1HpB,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EAiNrB;;;EAvMf,SAAA,CAAU,GAAA,UAAa,KAAA;EAuM0D;;;EAhMjF,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;EAsRyB;;;EA/Q9C,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA4QmE;;;EApQ/D,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;EAoQmC;;;EA7P/D,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EA8QmB;;;EAtQf,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;EAmQqF;;;EA3PjF,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;EAkSuB;;;EA3R3C,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;EAkShB;;;EA3RT,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;EAkSjB;;;EA3RN,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;EA2RiB;;;EApRtD,SAAA,CAAA,GAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EA4UY;;;;EApUrB,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;EAoU9B;;;EA7TrC,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;;;;EAOnD,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;EAQzB,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;;;;;;;;;;;;UAmB5B,kBAAA;EAAA,QA2BA,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EAsFjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAgDtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}

package/esm/http/response.mjs

@@ -11,7 +11,7 @@ import { fileExistsAsync } from "@warlock.js/fs";
 import fs from "fs";
 import mime from "mime";
 
-//#region ../core/src/http/response.ts
+//#region core/src/http/response.ts
 let ResponseStatus = /* @__PURE__ */ function(ResponseStatus) {
 	ResponseStatus[ResponseStatus["OK"] = 200] = "OK";
 	ResponseStatus[ResponseStatus["CREATED"] = 201] = "CREATED";