@warlock.js/core 5.28.0 → 5.30.0

package/esm/http/request.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../../core/src/http/request.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport events from \"@mongez/events\";\nimport { trans, transFrom } from \"@mongez/localization\";\nimport { Random, except, get, only, rtrim, set, unset } from \"@mongez/reinforcements\";\nimport { isEmpty } from \"@mongez/supportive-is\";\nimport type { LogLevel } from \"@warlock.js/logger\";\nimport { log } from \"@warlock.js/logger\";\nimport { BaseValidator, v } from \"@warlock.js/seal\";\nimport type { FastifyRequest } from \"fastify\";\nimport { randomBytes } from \"node:crypto\";\nimport { type IncomingHttpHeaders } from \"node:http2\";\nimport { Application } from \"../application/application\";\nimport { config } from \"../config/config-getter\";\nimport {\n  LOCALE_COOKIE_NAME,\n  LOCALE_PREFERENCE_COOKIE_NAME,\n  resolveLocaleConfiguration,\n} from \"../config/locale-configuration\";\nimport type { Middleware, Route } from \"../router\";\nimport { validateAll } from \"../validation/validateAll\";\nimport { CookieJarUnavailableError } from \"./errors\";\nimport { createRequestStore } from \"./middleware/inject-request-context\";\nimport { Response } from \"./response\";\nimport { buildTracingContext, deriveTraceId, dispatchPhase, isTracingEnabled } from \"./tracing\";\nimport type {\n  DecodedAccessToken,\n  HttpConfigurations,\n  PartialMiddleware,\n  RequestEvent,\n  RequestLocals,\n} from \"./types\";\nimport { UploadedFile } from \"./uploaded-file\";\n\ntype StandardHeaders = {\n  // copy every declared property from http.IncomingHttpHeaders\n  // but remove index signatures\n  [\n    K in keyof IncomingHttpHeaders as string extends K ? never : number extends K ? never : K\n  ]: IncomingHttpHeaders[K];\n};\n\ntype HeaderKeys = keyof StandardHeaders;\n\n/** A request-bound translator: keyword in, translated string out. */\nexport type RequestTranslator = (keyword: string, placeholders?: Record<string, unknown>) => string;\n\nexport class Request<RequestValidation = any> {\n  /**\n   * Underlying Fastify request — a public escape hatch to capabilities the\n   * framework's high-level helpers don't yet cover.\n   *\n   * **Prefer framework methods first**: `request.input()`, `request.header()`,\n   * `request.body`, `request.query`, `request.params`, `request.file()`,\n   * `request.locals.user` (set by `@warlock.js/auth`), `request.detectIp()`,\n   * etc. They handle locale, parsing,\n   * trust-proxy, and validation pipeline integration correctly.\n   *\n   * **Reach for `baseRequest` only** when the framework genuinely lacks a\n   * helper for what you need — and when you do, file an issue so we can add\n   * it. The escape hatch is the release valve that lets consumers move\n   * faster than the framework, but every long-term reach here is a missing\n   * helper waiting to be added.\n   */\n  public baseRequest!: FastifyRequest;\n\n  /**\n   * Response Object\n   */\n  public response!: Response;\n\n  /**\n   * Route Object\n   */\n  public route!: Route;\n\n  /**\n   * Parsed Request Payload\n   */\n  protected payload: any = {};\n\n  /**\n   * Backing field for `decodedAccessToken` — see the accessor below.\n   */\n  private _decodedAccessToken?: DecodedAccessToken;\n\n  /**\n   * Decoded access token payload (set by auth middleware).\n   *\n   * A prototype accessor, not a plain field, so assignment can mark the\n   * request `authDerived` (see the setter below and `RequestLocals` in\n   * `types.ts`) without every call site remembering to do so itself.\n   */\n  public get decodedAccessToken(): DecodedAccessToken | undefined {\n    return this._decodedAccessToken;\n  }\n\n  public set decodedAccessToken(value: DecodedAccessToken | undefined) {\n    this._decodedAccessToken = value;\n    this.locals.authDerived = true;\n  }\n\n  /**\n   * Private, server-only, per-request data bag.\n   *\n   * Distinct from the input payload (`body` / `query` / `params` / `all()`):\n   * a write here never surfaces in `request.all()`, `request.validated()`, or\n   * `request.input()`. That is the trap `request.set()` sets for private data\n   * — it writes into the payload `all` bag, so anything stored there leaks\n   * into every input accessor and, from there, into the client-facing\n   * payload. `locals` is the correct home for private per-request app data\n   * (a resolved session, a fetched-once model) that must never be mistaken\n   * for client input.\n   *\n   * Augmentable via module augmentation, in the module that OWNS the key:\n   *\n   * ```typescript\n   * declare module \"@warlock.js/core\" {\n   *   interface RequestLocals {\n   *     session?: { token: string };\n   *   }\n   * }\n   * ```\n   *\n   * A plain class-field initializer is sufficient for \"fresh per request\":\n   * `router.ts:925` constructs `new Request()` for every incoming request —\n   * `Request` instances are not pooled or reused across requests — so this\n   * initializer runs exactly once per request and no value can leak in from\n   * a prior one.\n   */\n  public locals: RequestLocals = {};\n\n  /**\n   * Backing field for the lazily-generated CSP nonce. Left `undefined` until\n   * the first `request.nonce` read; see the `nonce` getter below.\n   */\n  protected _nonce?: string;\n\n  /**\n   * Per-request Content-Security-Policy nonce — a fresh, unguessable value\n   * the web layer hands to `<Scripts nonce={...} />` (the inline payload\n   * script) and to the `Content-Security-Policy` header, so a strict\n   * `script-src 'nonce-...'` allows only the script this request actually\n   * rendered.\n   *\n   * Generated LAZILY on first access, not eagerly in `setRequest()`: most\n   * requests (API routes, anything that isn't rendering HTML) never read it,\n   * and spending a `randomBytes` call on every single request for a value\n   * most of them discard is wasted entropy draw + CPU. Once generated it is\n   * cached in `_nonce`, so every subsequent read within the SAME request\n   * returns the identical value — required, since the header and the inline\n   * `<script>` tag must agree on one nonce. `_nonce` is a plain field on a\n   * per-request `Request` instance (see `locals` above — `router.ts:925`,\n   * no pooling), so the cache can never leak into the next request; a fresh\n   * `Request` means a fresh, unset `_nonce`.\n   *\n   * 16 random bytes, base64-encoded — the size the CSP Level 3 spec's own\n   * examples use, and far more entropy than an attacker could feasibly guess\n   * to defeat the policy.\n   */\n  public get nonce(): string {\n    if (!this._nonce) {\n      this._nonce = randomBytes(16).toString(\"base64\");\n    }\n\n    return this._nonce;\n  }\n\n  /**\n   * Current request instance\n   */\n  public static current: Request;\n\n  /**\n   * Translate a keyword in this request's locale. Returns the translated\n   * string, or the keyword itself when no translation exists.\n   */\n  public trans: RequestTranslator = trans;\n\n  /**\n   * Alias to trans method\n   */\n  public t: RequestTranslator = trans;\n\n  /*\n   * v5 removed the `[key: string]: any` index signature (eed20184). Attaching\n   * arbitrary properties compiled silently and hid real bugs behind `any`.\n   * The sanctioned extension paths are:\n   * - `request.locals` (augment `RequestLocals` via module augmentation) for\n   *   per-request attached data, e.g. models fetched in validation middleware.\n   * - `requestMemo(key, fn)` for per-request memoized computation.\n   * - Module augmentation of the `Request` class itself for new typed members.\n   */\n\n  /**\n   * Locale code\n   */\n  protected _locale = \"\";\n\n  /**\n   * Validated data\n   */\n  protected validatedData?: RequestValidation;\n\n  /**\n   * Request id\n   */\n  public id = Random.string(32);\n\n  /**\n   * Trace id. The inbound `traceparent` header's trace id\n   * when valid, otherwise `id`. Resolved once in `setRequest`, alongside\n   * `id` itself — see `resolveTraceId`.\n   */\n  public traceId = \"\";\n\n  /**\n   * Start Time\n   */\n  public startTime = Date.now();\n\n  /**\n   * End Time\n   */\n  public endTime?: undefined | number;\n\n  /**\n   * Set request handler\n   */\n  public setRequest(request: FastifyRequest) {\n    this.baseRequest = request;\n\n    this.resolveRequestId();\n\n    this.resolveTraceId();\n\n    this.parsePayload();\n\n    // Resolve the locale at CALL time, never at bind time. `setRequest` runs\n    // before routing, so a locale set later (path locale, `setLocaleCode`, the\n    // web layer's C3 derivation) must steer translations too — the old\n    // `transFrom.bind(null, localeCode)` snapshot made `request.locale` and\n    // `request.trans()` silently disagree for the rest of the request.\n    this.trans = this.t = (keyword: string, placeholders?: any) =>\n      transFrom(this.getLocaleCode(), keyword, placeholders);\n\n    return this;\n  }\n\n  /**\n   * Inherit `X-Request-Id` from the incoming request, fall back to a custom\n   * generator, then to the field-init default (`Random.string(32)`).\n   *\n   * Inherited values are validated (length cap + printable-ASCII) to prevent\n   * log-injection from a malicious client. Disable the whole behavior by\n   * setting `http.requestId.enabled = false` — in which case the field-init\n   * default is used regardless of any incoming header.\n   */\n  protected resolveRequestId() {\n    const requestIdConfig = config.key(\"http.requestId\") || {};\n\n    if (requestIdConfig.enabled === false) return;\n\n    const headerName = (requestIdConfig.header || \"x-request-id\").toLowerCase();\n    const incoming = this.baseRequest.headers[headerName];\n\n    if (Request.isValidRequestId(incoming)) {\n      this.id = incoming;\n\n      return;\n    }\n\n    if (typeof requestIdConfig.generator === \"function\") {\n      this.id = requestIdConfig.generator();\n    }\n  }\n\n  /**\n   * Derive `traceId`: the inbound\n   * `traceparent` header's trace id when it is a valid W3C traceparent,\n   * otherwise `id`. Always runs — unlike request-id inheritance this has no\n   * `enabled: false` escape hatch, since `traceId` is only ever read when\n   * tracing hooks are enabled (see `./tracing`).\n   */\n  protected resolveTraceId() {\n    const header = this.baseRequest.headers.traceparent;\n    const traceparent = Array.isArray(header) ? header[0] : header;\n\n    this.traceId = deriveTraceId(traceparent, this.id);\n  }\n\n  /**\n   * Validate a candidate request-id value. Accepts non-empty printable ASCII\n   * up to 128 characters — tight enough to reject newline / control-character\n   * log-injection, loose enough to accept UUIDs, ULIDs, snowflakes, etc.\n   */\n  protected static isValidRequestId(value: unknown): value is string {\n    return (\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= 128 &&\n      /^[\\x21-\\x7e]+$/.test(value)\n    );\n  }\n\n  /**\n   * Translate from the given locale code\n   */\n  public transFrom(localeCode: string, keyword: string, placeholders?: any) {\n    return transFrom(localeCode, keyword, placeholders);\n  }\n\n  /**\n   * Cache one supported locale without coercing request-controlled input.\n   *\n   * The default is the answer for a client that asked for NOTHING. A client\n   * that did ask is only overridden when its value fails a declared\n   * `app.localeCodes` allow-list; with no list declared there is nothing to\n   * fail, so the requested locale passes through unchanged.\n   */\n  protected cacheLocale(candidate: unknown): string {\n    const { defaultLocaleCode, localeCodes } = resolveLocaleConfiguration(\n      config.key(\"app.localeCode\"),\n      config.key(\"app.localeCodes\"),\n    );\n\n    const requested = typeof candidate === \"string\" && candidate.length > 0 ? candidate : undefined;\n\n    this._locale =\n      requested !== undefined && (localeCodes === undefined || localeCodes.includes(requested))\n        ? requested\n        : defaultLocaleCode;\n\n    return this._locale;\n  }\n\n  /**\n   * Resolve the first present Mode B source, skipping unsupported browser\n   * preferences. Other unsupported values resolve to the configured default.\n   */\n  protected resolveLocale(): string {\n    const { localeCodes } = resolveLocaleConfiguration(\n      config.key(\"app.localeCode\"),\n      config.key(\"app.localeCodes\"),\n    );\n    const preference = this.cookies[LOCALE_PREFERENCE_COOKIE_NAME];\n    // A stale browser preference must not hide the server's legacy cookie or\n    // header after an application removes a supported locale.\n    const supportedPreference =\n      typeof preference === \"string\" &&\n      (localeCodes === undefined || localeCodes.includes(preference))\n        ? preference\n        : undefined;\n    const candidate = [\n      this.query[\"locale\"],\n      supportedPreference,\n      this.cookies[LOCALE_COOKIE_NAME],\n      this.header(\"locale\"),\n    ].find((value) => typeof value === \"string\" && value.length > 0);\n\n    return this.cacheLocale(candidate);\n  }\n\n  /**\n   * Get current locale code\n   */\n  public get locale(): string {\n    if (this._locale) return this._locale;\n\n    return this.resolveLocale();\n  }\n\n  /**\n   * Set locale code\n   */\n  public set locale(localeCode: string) {\n    this.cacheLocale(localeCode);\n  }\n\n  /**\n   * Set locale code\n   */\n  public setLocaleCode(localeCode: string) {\n    this.locale = localeCode;\n\n    return this;\n  }\n\n  /**\n   * @deprecated Use `request.locale`. This alias is removed after one version.\n   * The legacy default argument is accepted for source compatibility but the\n   * resolved default is owned exclusively by app configuration.\n   */\n  public getLocaleCode(_legacyDefaultLocaleCode?: string): string {\n    return this.locale;\n  }\n\n  /**\n   * Get http protocol\n   */\n  public get protocol() {\n    return this.baseRequest.protocol;\n  }\n\n  /**\n   * Validate the given validation schema\n   */\n  public async validate(validation: BaseValidator, selectedInputs?: string[]) {\n    return await v.validate(validation, selectedInputs ? this.only(selectedInputs) : this.all());\n  }\n\n  /**\n   * Get value of the given header\n   */\n  public header<TCustomHeader extends string = HeaderKeys>(\n    name: TCustomHeader | HeaderKeys,\n    defaultValue: any = null,\n  ) {\n    return this.baseRequest.headers[name.toLocaleLowerCase()] ?? defaultValue;\n  }\n\n  /**\n   * Get all cookies from the current request\n   */\n  public get cookies(): Record<string, string | undefined> {\n    return this.baseRequest.cookies || {};\n  }\n\n  /**\n   * Assert the cookie jar exists before a by-name read. `get cookies()` stays\n   * lenient (returns `{}`) for the framework's own opportunistic reads, but a\n   * deliberate by-name read from application code must fail loudly when\n   * `@fastify/cookie` was never registered, rather than being indistinguishable\n   * from \"the caller sent no such cookie\".\n   */\n  private assertCookieJarAvailable(name: string): void {\n    if (this.baseRequest.cookies === undefined) {\n      throw new CookieJarUnavailableError(name);\n    }\n  }\n\n  /**\n   * Get a particular cookie value or fallback to default\n   */\n  public cookie(name: string, defaultValue?: any): string | any {\n    this.assertCookieJarAvailable(name);\n\n    const value = this.cookies[name] ?? defaultValue;\n\n    try {\n      return JSON.parse(value);\n    } catch (error) {\n      return value;\n    }\n  }\n\n  /**\n   * Determine if the request has the specified cookie\n   */\n  public hasCookie(name: string): boolean {\n    this.assertCookieJarAvailable(name);\n\n    return this.cookies[name] !== undefined;\n  }\n\n  /**\n   * Get the current request domain\n   */\n  public get domain() {\n    return this.baseRequest.hostname.replace(/^www\\./, \"\");\n  }\n\n  /**\n   * Get hostname\n   */\n  public get hostname() {\n    return this.domain;\n  }\n\n  /**\n   * Get request origin\n   */\n  public get origin() {\n    return this.baseRequest.headers.origin as string;\n  }\n\n  /**\n   * Get the domain of the origin\n   */\n  public get originDomain() {\n    let domain: string | null = null;\n\n    try {\n      domain = this.origin ? new URL(this.origin).hostname : null;\n    } catch {\n      // `Origin: null` (sandboxed iframes) or any unparsable value\n      domain = null;\n    }\n\n    if (domain?.startsWith(\"www.\")) {\n      return domain.replace(/^www\\./, \"\");\n    }\n\n    return domain;\n  }\n\n  /**\n   * Get authorization header value\n   */\n  public get authorizationValue(): string {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return \"\";\n\n    const [type, value] = authorization.split(\" \");\n\n    if (![\"bearer\", \"key\"].includes(type.toLowerCase())) return \"\";\n\n    return value || \"\";\n  }\n\n  /**\n   * Get access token from Authorization header\n   *\n   * If the Authorization header does not start with `Bearer` value then return null\n   */\n  public get accessToken(): string | undefined {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return;\n\n    const [type, value] = authorization.split(\" \");\n\n    if (type.toLowerCase() !== \"bearer\") return;\n\n    return value;\n  }\n\n  /**\n   * Get the authorization header\n   */\n  public get authorization() {\n    return this.header(\"authorization\");\n  }\n\n  /**\n   * Get current request method\n   */\n  public get method(): string {\n    return this.baseRequest.method;\n  }\n\n  /**\n   * Parse the payload and merge it from the request body, params and query string\n   */\n  /**\n   * Turn a bracket-notation key into the dotted path `set()` expects.\n   *\n   * `a[b][c]` -> `a.b.c`. Used only for NON-numeric nesting; numeric indices\n   * keep the array-of-objects path in {@link parseBody}, which builds real\n   * arrays rather than objects with numeric keys.\n   */\n  protected bracketKeyToPath(key: string): string {\n    return key.replace(/\\]\\[/g, \".\").replace(/\\[/g, \".\").replace(/\\]/g, \"\");\n  }\n\n  /**\n   * True when any path segment of a bracket/dot key could reach a prototype\n   * (`__proto__`, `constructor`, `prototype`). Such keys are dropped before\n   * any branch of {@link parseBody} writes them.\n   */\n  protected hasUnsafeSegment(key: string): boolean {\n    return key\n      .split(/[[\\].]+/)\n      .some(\n        (segment) =>\n          segment === \"__proto__\" || segment === \"constructor\" || segment === \"prototype\",\n      );\n  }\n\n  /**\n   * Apply the `key[]` array marker to a parsed value.\n   *\n   * The subtlety this exists to remove: a key declared `[]` should ALWAYS be an\n   * array, but the underlying query/body parser only hands us one when the\n   * caller sent the key more than once. Deciding the TYPE from the number of\n   * occurrences means one selected filter is a string and two are an array —\n   * a shape that changes under the user's hands.\n   */\n  protected arrayValueFor(value: any, isArrayKey: boolean, parse: (value: any) => any) {\n    if (Array.isArray(value)) return value.map(parse);\n\n    return isArrayKey ? [parse(value)] : parse(value);\n  }\n\n  protected parsePayload() {\n    this.payload.body = this.isJsonBody()\n      ? (this.baseRequest.body ?? {})\n      : this.parseBody(this.baseRequest.body);\n\n    this.payload.query = this.parseBody(this.baseRequest.query);\n    this.payload.params = { ...(this.baseRequest.params || {}) };\n    // same precedence as `allExceptParams()`: body over query, params last\n    this.payload.all = {\n      ...this.payload.query,\n      ...this.payload.body,\n      ...this.payload.params,\n    };\n  }\n\n  /**\n   * JSON bodies are already typed by the client, so they skip the\n   * bracket/coercion parsing meant for querystring, urlencoded and multipart.\n   */\n  protected isJsonBody() {\n    const contentType = this.baseRequest.headers?.[\"content-type\"];\n\n    return typeof contentType === \"string\" && /json/i.test(contentType);\n  }\n\n  /**\n   * Parse body payload\n   */\n  protected parseBody(data: any) {\n    try {\n      if (!data) return {};\n\n      const body: any = {};\n\n      const arrayOfObjectValues: any = {};\n\n      for (let key in data) {\n        const value = data[key];\n\n        let isArrayKey = false;\n\n        if (key.endsWith(\"[]\")) {\n          isArrayKey = true;\n        }\n\n        key = rtrim(key, \"[]\");\n\n        // every path segment this key can write must be safe, whichever\n        // branch below ends up writing it (set(), bucket, entry or body)\n        if (this.hasUnsafeSegment(key)) continue;\n\n        // check if the key is has a square brackets, then convert it into object\n        // i.e user[email] => user: {email: \"value\"}\n        // also check if its an array of objects\n\n        if (key.includes(\"[\")) {\n          // check if its an array of objects\n          if (key.includes(\"][\")) {\n            const keyParts = key.split(\"[\");\n\n            const keyName = keyParts[0];\n            const firstBracket = keyParts[1];\n            const secondBracket = keyParts[2];\n\n            /*\n              `key.includes(\"][\")` guarantees all three segments — but that is a\n              property of the string test above, not of these reads, so each is\n              `string | undefined`.\n\n              When the shape is not what this branch assumes, fall through to\n              the generic bracket path rather than skipping the key. That is the\n              same choice the NaN branch below makes, and for the same reason\n              spelled out there: the failure this code has already been bitten\n              by is answering with a shape the caller did not send. Dropping the\n              pair silently would be that bug again, in a new place.\n            */\n            if (\n              keyName === undefined ||\n              firstBracket === undefined ||\n              secondBracket === undefined\n            ) {\n              set(\n                body,\n                this.bracketKeyToPath(key),\n                this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n              );\n\n              continue;\n            }\n\n            const keyNameParts = firstBracket.split(\"]\");\n\n            const index = Number(keyNameParts[0]);\n\n            // a crafted huge index would allocate a giant sparse array\n            if (Number.isInteger(index) && index > 1000) continue;\n\n            /*\n              A NON-NUMERIC first segment is not an array index — it is a deeper\n              nested object. `a[b][c]=x` reaches this branch because it contains\n              \"][\", but `Number(\"b\")` is NaN, and the code below used to write to\n              `[NaN]`: that sets a \"NaN\" PROPERTY on an array whose length stays\n              0, so the request arrived as `{a: []}` and the value was gone. No\n              error, no warning — the caller simply never got `x`.\n\n              Deciding between refusing (4xx) and interpreting: a doubly-nested\n              key is unambiguous and is exactly what every bracket-notation\n              parser means by it, so we interpret. Refusing would reject a URL\n              shape that is standard elsewhere and that we ourselves already\n              honour one level shallower, five lines below. What was definitely\n              wrong was answering with a shape the caller did not send.\n\n              Numeric indices keep the array-of-objects path below unchanged —\n              `items[0][name]` is still an array.\n            */\n            if (Number.isNaN(index)) {\n              set(\n                body,\n                this.bracketKeyToPath(key),\n                this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n              );\n\n              continue;\n            }\n\n            const bucket = (arrayOfObjectValues[keyName] ??= []);\n\n            const entry = (bucket[index] ??= {});\n\n            // now get the key after the index\n            const keyNameParts2 = secondBracket.split(\"]\");\n            const keyName2 = keyNameParts2[0];\n\n            // `split` always yields a first element, so this holds — but an\n            // undefined key here would write a property literally named\n            // \"undefined\" onto the entry, which is the same silent-wrong-shape\n            // outcome the comment above describes.\n            if (keyName2 === undefined) continue;\n\n            entry[keyName2] = this.parseValue(value);\n\n            continue;\n          }\n\n          const keyParts = key.split(\"[\");\n          const keyName = keyParts[0];\n          // `key.includes(\"[\")` puts at least two segments here. Falling back\n          // to the whole key rather than asserting keeps the parse total: an\n          // undefined segment would make `keyNameParts[0]` undefined too, and\n          // this branch writes that straight into the body shape.\n          const keyNameParts = (keyParts[1] ?? key).split(\"]\");\n\n          /*\n            `isArrayKey` is honoured HERE, and used not to be. `filter[tags][]=a`\n            sets the flag at the top of the loop, but this branch only wrapped\n            when the underlying value was ALREADY an array — which it is for two\n            or more occurrences and is not for one. So `filter[tags][]=a` arrived\n            as `{filter:{tags:\"a\"}}` while `…=a&…=b` arrived as `{tags:[\"a\",\"b\"]}`:\n            the same declared shape, two different types, decided by how many\n            times the caller happened to send it.\n\n            That single-element case is the one a UI hits first — one filter\n            chip selected — and `@warlock.js/web`'s decoder reads it as an array,\n            so the page and the server disagreed about the same URL.\n          */\n          set(\n            body,\n            keyName + \".\" + keyNameParts[0],\n            this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n          );\n\n          continue;\n        }\n\n        if (Array.isArray(value)) {\n          set(body, key, value.map(this.parseValue.bind(this)));\n        } else if (isArrayKey) {\n          if (body[key]) {\n            body[key].push(this.parseValue(value));\n          } else {\n            body[key] = [this.parseValue(value)];\n\n            continue;\n          }\n        } else {\n          set(body, key, this.parseValue(value));\n        }\n      }\n\n      // now merge the array of objects into the body\n      for (const key in arrayOfObjectValues) {\n        body[key] = arrayOfObjectValues[key];\n      }\n\n      return body;\n    } catch (error) {\n      console.log(error);\n      this.log(error, \"error\");\n\n      return {};\n    }\n  }\n\n  /**\n   * Parse the given data\n   */\n  protected parseValue(data: any) {\n    // data.value appears only in the multipart form data\n    // if it json, then just return the data\n    if (data?.file) return new UploadedFile(data);\n    if (data?.value !== undefined && data?.fields && data?.type) {\n      data = data.value;\n    }\n\n    if (data === \"false\") return false;\n\n    if (data === \"true\") return true;\n\n    if (data === \"null\") return null;\n\n    if (typeof data === \"string\") return data.trim();\n\n    return data;\n  }\n\n  /**\n   * Set route handler\n   */\n  public setRoute(route: Route) {\n    this.route = route;\n\n    // pass the route to the response object\n    this.response.setRoute(route);\n\n    return this;\n  }\n\n  /**\n   * Trigger an http event\n   */\n  public trigger(eventName: RequestEvent, ...args: any[]) {\n    return events.trigger(`request.${eventName}`, ...args, this);\n  }\n\n  /**\n   * Listen to the given event\n   */\n  public on(eventName: RequestEvent, callback: any) {\n    return events.subscribe(`request.${eventName}`, callback);\n  }\n\n  /**\n   * Make a log message\n   */\n  public log(message: any, level: LogLevel = \"info\") {\n    if (!config.key(\"http.log\")) return;\n\n    log.log({\n      module: \"request\",\n      action: this.route.method + \" \" + this.route.path.replace(\"/*\", \"\") + `:${this.id}`,\n      message,\n      type: level,\n      context: {\n        request: this,\n      },\n    });\n  }\n\n  /**\n   * Get current request path\n   */\n  public get path() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * {@alias}\n   */\n  public get url() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * Get full url\n   */\n  public get fullUrl() {\n    return this.protocol + \"://\" + this.hostname + this.path;\n  }\n\n  /**\n   * Drive the middleware chain for the current route, then defer to the\n   * controller. Returns the first response value any middleware short-circuits\n   * with, or `undefined` to continue into validation + handler.\n   *\n   * @internal Framework orchestration — do not call from app code. Will move\n   * to a dedicated controller dispatcher in a future refactor.\n   */\n  public async runMiddleware() {\n    // measure request time\n    // check for middleware first\n    const middlewareOutput = await this.executeMiddleware();\n\n    if (middlewareOutput !== undefined) {\n      // 👇🏻 make sure first its not a response instance\n      if (middlewareOutput instanceof Response) return middlewareOutput;\n      // 👇🏻 send the response\n      return this.response.send(middlewareOutput);\n    }\n\n    const handler = this.route.handler;\n\n    if (!handler.validation) return;\n\n    // 👇🏻 check for validation using validateAll helper function — timed as\n    // the \"validation\" tracing phase when tracing is\n    // enabled; a single boolean check and zero allocation otherwise.\n    const tracingEnabled = isTracingEnabled();\n    const validationStartedAt = tracingEnabled ? performance.now() : 0;\n\n    const validationOutput = await validateAll(handler.validation, this, this.response);\n\n    if (tracingEnabled) {\n      dispatchPhase(buildTracingContext(this), {\n        name: \"validation\",\n        durationMs: performance.now() - validationStartedAt,\n      });\n    }\n\n    return validationOutput;\n  }\n\n  /**\n   * Return the request handler attached to the current route.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  public getHandler() {\n    return this.route.handler;\n  }\n\n  /**\n   * Get inputs that has been validated only\n   * You can also pass an array of inputs to get only the validated inputs\n   */\n  public validated<Output = RequestValidation>(inputs?: (keyof Output | (string & {}))[]): Output {\n    if (this.validatedData) {\n      return inputs\n        ? only(this.validatedData as Output, inputs as string[])\n        : (this.validatedData as Output);\n    }\n\n    return {} as Output;\n  }\n\n  /**\n   * Get inputs that has been validated except the given inputs\n   */\n  public validatedExcept(...inputs: string[]): RequestValidation {\n    return except(this.validated(), inputs);\n  }\n\n  /**\n   * Set validated data\n   */\n  public setValidatedData(data: RequestValidation) {\n    this.validatedData = data;\n  }\n\n  /**\n   * Top-level entry into the request lifecycle — opens the context store,\n   * runs middleware, drives the handler, handles errors.\n   *\n   * @internal Framework orchestration — do not call from app code. Wired\n   * from the Fastify route handler in `router.scan()`.\n   */\n  public async execute() {\n    try {\n      // call executingAction event\n\n      this.log(\"Executing the request\");\n\n      return await createRequestStore(this, this.response);\n    } catch (error) {\n      this.log(error, \"error\");\n\n      throw error;\n    }\n  }\n\n  /**\n   * Iterate the collected middlewares in order; return the first short-circuit\n   * value or `undefined` when every middleware passes through.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected async executeMiddleware() {\n    // collect all middlewares for current route\n    const middlewares = this.collectMiddlewares();\n\n    // check if there are no middlewares, then return\n    if (middlewares.length === 0) return;\n\n    this.log(\"About to execute request middlewares\");\n\n    // trigger the executingMiddleware event\n    this.trigger(\"executingMiddleware\", middlewares, this.route);\n\n    const tracingEnabled = isTracingEnabled();\n\n    for (const [index, middleware] of middlewares.entries()) {\n      this.log(\"Executing middleware \" + colors.yellowBright(middleware.name));\n\n      const middlewareStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await middleware({\n        request: this,\n        response: this.response,\n      });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(this), {\n          name: \"middleware\",\n          durationMs: performance.now() - middlewareStartedAt,\n          attrs: { name: middleware.name, index },\n        });\n      }\n\n      this.log(\"Executed middleware \" + colors.yellowBright(middleware.name), \"success\");\n\n      if (output !== undefined) {\n        this.log(\n          colors.yellow(\"request intercepted by middleware \") + colors.cyanBright(middleware.name),\n          \"warn\",\n        );\n\n        this.trigger(\"executedMiddleware\");\n\n        this.log(\"Request middlewares executed\", \"success\");\n\n        return output;\n      }\n    }\n\n    this.log(\"Request middlewares executed\", \"success\");\n\n    // trigger the executedMiddleware event\n    this.trigger(\"executedMiddleware\", middlewares, this.route);\n  }\n\n  /**\n   * Gather the middleware list for the current route — today just the\n   * route-level array; future extraction may merge group + app-wide layers.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected collectMiddlewares(): Middleware[] {\n    const route = this.route;\n    const configured = config.key(\"http.middleware\") as HttpConfigurations[\"middleware\"];\n\n    const matchesRoute = (target?: PartialMiddleware) =>\n      Boolean(\n        target &&\n        ((route.path && target.routes?.includes(route.path)) ||\n          (route.name && target.namedRoutes?.includes(route.name))),\n      );\n\n    // app-wide middlewares first, then the `only` ones matching this route\n    const global: Middleware[] = [...(configured?.all || [])];\n\n    if (matchesRoute(configured?.only)) {\n      global.push(...(configured?.only?.middleware || []));\n    }\n\n    // `except` removes app-wide middlewares from the matching routes\n    const excluded = matchesRoute(configured?.except) ? configured?.except?.middleware || [] : [];\n\n    // global first, then route middlewares, deduplicated by reference\n    return [\n      ...new Set([\n        ...global.filter((middleware) => !excluded.includes(middleware)),\n        ...(route.middleware || []),\n      ]),\n    ];\n  }\n\n  /**\n   * Get request input value from query string, params or body\n   */\n  public input(key: string, defaultValue?: any) {\n    return get(this.payload.all, key, defaultValue);\n  }\n\n  /**\n   * Get email input value, this will lowercase the value\n   */\n  public email(key: string = \"email\", defaultValue: string = \"\"): string {\n    return this.input(key, defaultValue)?.toLowerCase() || defaultValue;\n  }\n\n  /**\n   * @alias input\n   */\n  public get(key: string, defaultValue?: any) {\n    return this.input(key, defaultValue);\n  }\n\n  /**\n   * Determine if request has input value\n   */\n  public has(key: string) {\n    return get(this.payload.all, key, undefined) !== undefined;\n  }\n\n  /**\n   * Set request input value\n   */\n  public set(key: string, value: any) {\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Set the given value if the request does not have the input\n   */\n  public setDefault(key: string, value: any) {\n    if (this.has(key)) return this;\n\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Unset request payload keys\n   */\n  public unset(...keys: string[]) {\n    this.payload.all = unset(this.payload.all, keys);\n\n    return this;\n  }\n\n  /**\n   * Get request body\n   */\n  public get body() {\n    return this.payload.body;\n  }\n\n  /**\n   * Set request body value\n   */\n  public setBody(key: string, value: any) {\n    set(this.payload.body, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get body inputs except files\n   */\n  public get bodyInputs() {\n    const inputs = this.payload.body;\n\n    const bodyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (value.file && value.fieldname) continue;\n\n      bodyInputs[key] = value;\n    }\n\n    return bodyInputs;\n  }\n\n  /**\n   * Get request file in UploadedFile instance\n   */\n  public file(key: string): UploadedFile | undefined {\n    const file = this.input(key);\n\n    return file;\n  }\n\n  /**\n   * Get uploaded files from the request for the given name\n   * If the given name is not present in the request, return an empty array\n   */\n  public files(name: string): UploadedFile[] {\n    return this.input(name) || [];\n  }\n\n  /**\n   * Get request params\n   */\n  public get params() {\n    return this.payload.params;\n  }\n\n  /**\n   * Set request params value\n   *\n   * Keeps `payload.all` in sync using the same precedence `parsePayload()`\n   * gives route params: `{ ...query, ...body, ...params }`, i.e. params\n   * always win. Without this, a param set after parsing (e.g. by a\n   * catch-all route dispatcher decoding dynamic segments itself) would be\n   * visible on `request.params` but not through `input()`/`get()`, since\n   * those read the once-computed `payload.all`.\n   */\n  public setParam(key: string, value: any) {\n    set(this.payload.params, key, value);\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get request query\n   */\n  public get query() {\n    return this.payload.query;\n  }\n\n  /**\n   * Set request query value\n   */\n  public setQuery(key: string, value: any) {\n    set(this.payload.query, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get all inputs\n   */\n  public all() {\n    return this.payload.all;\n  }\n\n  /**\n   * Get all inputs except params\n   */\n  public allExceptParams() {\n    return {\n      ...this.payload.query,\n      ...this.payload.body,\n    };\n  }\n\n  /**\n   * Get all heavy inputs except params\n   */\n  public heavyExceptParams() {\n    const inputs = this.allExceptParams();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only heavy inputs, the input with a value\n   */\n  public heavy() {\n    const inputs = this.all();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only the given keys from the request data\n   */\n  public only(keys: string[]) {\n    return only(this.all(), keys);\n  }\n\n  /**\n   * Pluck the given keys from the request data\n   */\n  public pluck(keys: string[]) {\n    const data = this.only(keys);\n\n    this.unset(...keys);\n\n    return data;\n  }\n\n  /**\n   * Get all request inputs except the given keys\n   */\n  public except(keys: string[]) {\n    return except(this.all(), keys);\n  }\n\n  /**\n   * Get boolean input value\n   */\n  public bool(key: string, defaultValue = false) {\n    const value = this.input(key, defaultValue);\n\n    if (value === \"true\") {\n      return true;\n    }\n\n    if (value === \"false\") {\n      return false;\n    }\n\n    if (value === 0) {\n      return false;\n    }\n\n    return Boolean(value);\n  }\n\n  /**\n   * Get integer input value\n   */\n  public int(key: string, defaultValue: number = 0): number | undefined {\n    const value = this.input(key, defaultValue);\n\n    if (!value && value !== 0) return undefined;\n\n    return parseInt(value);\n  }\n\n  /**\n   * Shorthand getter to get id param\n   */\n  public get idParam() {\n    return this.int(\"id\");\n  }\n\n  /**\n   * Get string input value\n   */\n  public string(key: string, defaultValue: string = \"\"): string {\n    const value = this.input(key, defaultValue);\n\n    return String(value);\n  }\n\n  /**\n   * Get float input value\n   */\n  public float(key: string, defaultValue: number = 0): number {\n    const value = this.input(key, defaultValue);\n\n    return parseFloat(value) || 0;\n  }\n\n  /**\n   * Get number input value\n   */\n  public number(key: string, defaultValue: number = 0): number {\n    const value = Number(this.input(key, defaultValue));\n\n    return isNaN(value) ? defaultValue : value;\n  }\n\n  /**\n   * Immediate-peer IP as Fastify reports it — the address that connected to\n   * the server socket, with `trustProxy` resolution applied. Use this when\n   * you specifically need the peer address (rate-limit-by-direct-connection,\n   * health-check origin verification).\n   *\n   * **For most use cases prefer `request.detectIp()`** — behind any proxy\n   * (load balancer, CDN, sidecar) `ip` reports the proxy, not the real client.\n   */\n  public get ip() {\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * Best-effort real client IP — the value everything IP-scoped keys on\n   * (ip-filter allowlists, rate-limit buckets, idempotency scoping).\n   *\n   * `X-Forwarded-For` resolution is **delegated to Fastify**: `baseRequest.ip`\n   * is already the client address Fastify's `trustProxy` machinery picked out\n   * of the chain, so every shape `http.trustProxy` accepts is honoured here\n   * with exactly the semantics Fastify documents:\n   *\n   * - `false` (default) — no header is trusted; the socket peer address wins.\n   *   Both forwarding headers are client-settable, so without a trusted edge\n   *   that rewrites them any client could otherwise forge its own IP.\n   * - `true` — the whole chain is trusted; the leftmost hop (original client)\n   *   wins.\n   * - `number` — that many rightmost hops are trusted, so an edge that\n   *   APPENDS to `X-Forwarded-For` yields the real client rather than whatever\n   *   the client prepended.\n   * - CIDR / IP list (string, comma-separated string, or array) or a custom\n   *   predicate — the chain is walked right-to-left and stops at the first hop\n   *   that isn't a trusted proxy.\n   *\n   * `X-Real-IP` is NOT part of that resolution — Fastify never looks at it,\n   * and unlike `X-Forwarded-For` it carries no chain, so there is nothing to\n   * validate a proxy allowlist against. It is therefore honoured\n   * only under `trustProxy: true` (\"everything upstream is mine\"), where it is\n   * no weaker than the trust already granted. Under a bounded `trustProxy`\n   * (CIDR / IP list) it is ignored: a trusted-but-passthrough edge that\n   * forwards the client's own `X-Real-IP` verbatim would otherwise hand any\n   * client a way around the bound.\n   *\n   * **Prefer this over `request.ip` for any caller behind a proxy** (load\n   * balancer, CDN, reverse proxy, k8s ingress).\n   */\n  public detectIp() {\n    // Trusting `X-Real-IP` is only sound when the config trusts the entire\n    // upstream chain; bounded shapes get chain-aware resolution instead.\n    // Typed as `unknown`: config.get(key, fallback) infers the FALLBACK's type, so\n    // the literal `false` narrowed this to `false` and TypeScript called the\n    // comparison unreachable. The stored value is genuinely unconstrained at compile\n    // time - trustProxy accepts a boolean, a CIDR list or a predicate - so `unknown`\n    // is what it actually is, and the === true check is the narrowing.\n    const trustProxy: unknown = config.get(\"http.trustProxy\", false);\n\n    if (trustProxy === true) {\n      const realIp = this.header(\"x-real-ip\");\n\n      if (realIp) {\n        // `split` always yields a first element, so `?? \"\"` changes nothing —\n        // and an empty address is already falsy, so it falls through to the\n        // next source exactly as a blank header does. This is the CLIENT IP\n        // used for rate limiting and logging; it must never become the string\n        // \"undefined\".\n        const address = (String(realIp).split(\",\")[0] ?? \"\").trim();\n\n        if (address) return address;\n      }\n    }\n\n    // Fastify resolved this against the configured `trustProxy` already:\n    // socket peer when trust is off, the correct hop of `X-Forwarded-For`\n    // when it is on. Re-parsing the header here would mean a second, weaker\n    // trust model that could disagree with `request.ip` and with the plugins\n    // (rate limit, proxy) that key on it.\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * An alias to detectIp\n   */\n  public get realIp() {\n    return this.detectIp();\n  }\n\n  /**\n   * Get request ips\n   */\n  public get ips() {\n    return this.baseRequest.ips;\n  }\n\n  /**\n   * Get request referer\n   */\n  public get referer() {\n    return this.baseRequest.headers.referer;\n  }\n\n  /**\n   * Get user agent\n   */\n  public get userAgent() {\n    return this.baseRequest.headers[\"user-agent\"];\n  }\n\n  /**\n   * Get request headers\n   */\n  public get headers(): typeof this.baseRequest.headers {\n    return this.baseRequest.headers;\n  }\n\n  /**\n   * Set the given header\n   */\n  public setHeader(key: HeaderKeys, value: string) {\n    this.baseRequest.headers[key.toLowerCase()] = value;\n\n    return this;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AA8CA,IAAa,UAAb,MAAa,QAAiC;;iBAgCnB,CAAC;gBAmDK,CAAC;eA+CE;WAKJ;iBAeV;YAUR,OAAO,OAAO,EAAE;iBAOX;mBAKE,KAAK,IAAI;;;;;;;;;CA9H5B,IAAW,qBAAqD;EAC9D,OAAO,KAAK;CACd;CAEA,IAAW,mBAAmB,OAAuC;EACnE,KAAK,sBAAsB;EAC3B,KAAK,OAAO,cAAc;CAC5B;;;;;;;;;;;;;;;;;;;;;;;CA4DA,IAAW,QAAgB;EACzB,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAGjD,OAAO,KAAK;CACd;;;;CA+DA,AAAO,WAAW,SAAyB;EACzC,KAAK,cAAc;EAEnB,KAAK,iBAAiB;EAEtB,KAAK,eAAe;EAEpB,KAAK,aAAa;EAOlB,KAAK,QAAQ,KAAK,KAAK,SAAiB,iBACtC,UAAU,KAAK,cAAc,GAAG,SAAS,YAAY;EAEvD,OAAO;CACT;;;;;;;;;;CAWA,AAAU,mBAAmB;EAC3B,MAAM,kBAAkB,OAAO,IAAI,gBAAgB,KAAK,CAAC;EAEzD,IAAI,gBAAgB,YAAY,OAAO;EAEvC,MAAM,cAAc,gBAAgB,UAAU,eAAc,CAAE,YAAY;EAC1E,MAAM,WAAW,KAAK,YAAY,QAAQ;EAE1C,IAAI,QAAQ,iBAAiB,QAAQ,GAAG;GACtC,KAAK,KAAK;GAEV;EACF;EAEA,IAAI,OAAO,gBAAgB,cAAc,YACvC,KAAK,KAAK,gBAAgB,UAAU;CAExC;;;;;;;;CASA,AAAU,iBAAiB;EACzB,MAAM,SAAS,KAAK,YAAY,QAAQ;EACxC,MAAM,cAAc,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;EAExD,KAAK,UAAU,cAAc,aAAa,KAAK,EAAE;CACnD;;;;;;CAOA,OAAiB,iBAAiB,OAAiC;EACjE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,OAChB,iBAAiB,KAAK,KAAK;CAE/B;;;;CAKA,AAAO,UAAU,YAAoB,SAAiB,cAAoB;EACxE,OAAO,UAAU,YAAY,SAAS,YAAY;CACpD;;;;;;;;;CAUA,AAAU,YAAY,WAA4B;EAChD,MAAM,EAAE,mBAAmB,gBAAgB,2BACzC,OAAO,IAAI,gBAAgB,GAC3B,OAAO,IAAI,iBAAiB,CAC9B;EAEA,MAAM,YAAY,OAAO,cAAc,YAAY,UAAU,SAAS,IAAI,YAAY;EAEtF,KAAK,UACH,cAAc,WAAc,gBAAgB,UAAa,YAAY,SAAS,SAAS,KACnF,YACA;EAEN,OAAO,KAAK;CACd;;;;;CAMA,AAAU,gBAAwB;EAChC,MAAM,EAAE,gBAAgB,2BACtB,OAAO,IAAI,gBAAgB,GAC3B,OAAO,IAAI,iBAAiB,CAC9B;EACA,MAAM,aAAa,KAAK,QAAQ;EAGhC,MAAM,sBACJ,OAAO,eAAe,aACrB,gBAAgB,UAAa,YAAY,SAAS,UAAU,KACzD,aACA;EACN,MAAM,YAAY;GAChB,KAAK,MAAM;GACX;GACA,KAAK,QAAQ;GACb,KAAK,OAAO,QAAQ;EACtB,CAAC,CAAC,MAAM,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;EAE/D,OAAO,KAAK,YAAY,SAAS;CACnC;;;;CAKA,IAAW,SAAiB;EAC1B,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAO,KAAK,cAAc;CAC5B;;;;CAKA,IAAW,OAAO,YAAoB;EACpC,KAAK,YAAY,UAAU;CAC7B;;;;CAKA,AAAO,cAAc,YAAoB;EACvC,KAAK,SAAS;EAEd,OAAO;CACT;;;;;;CAOA,AAAO,cAAc,0BAA2C;EAC9D,OAAO,KAAK;CACd;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,MAAa,SAAS,YAA2B,gBAA2B;EAC1E,OAAO,MAAM,EAAE,SAAS,YAAY,iBAAiB,KAAK,KAAK,cAAc,IAAI,KAAK,IAAI,CAAC;CAC7F;;;;CAKA,AAAO,OACL,MACA,eAAoB,MACpB;EACA,OAAO,KAAK,YAAY,QAAQ,KAAK,kBAAkB,MAAM;CAC/D;;;;CAKA,IAAW,UAA8C;EACvD,OAAO,KAAK,YAAY,WAAW,CAAC;CACtC;;;;;;;;CASA,AAAQ,yBAAyB,MAAoB;EACnD,IAAI,KAAK,YAAY,YAAY,QAC/B,MAAM,IAAI,0BAA0B,IAAI;CAE5C;;;;CAKA,AAAO,OAAO,MAAc,cAAkC;EAC5D,KAAK,yBAAyB,IAAI;EAElC,MAAM,QAAQ,KAAK,QAAQ,SAAS;EAEpC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,SAAS,OAAO;GACd,OAAO;EACT;CACF;;;;CAKA,AAAO,UAAU,MAAuB;EACtC,KAAK,yBAAyB,IAAI;EAElC,OAAO,KAAK,QAAQ,UAAU;CAChC;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,SAAS,QAAQ,UAAU,EAAE;CACvD;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK;CACd;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,eAAe;EACxB,IAAI,SAAwB;EAE5B,IAAI;GACF,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,WAAW;EACzD,QAAQ;GAEN,SAAS;EACX;EAEA,IAAI,QAAQ,WAAW,MAAM,GAC3B,OAAO,OAAO,QAAQ,UAAU,EAAE;EAGpC,OAAO;CACT;;;;CAKA,IAAW,qBAA6B;EACtC,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe,OAAO;EAE3B,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG,OAAO;EAE5D,OAAO,SAAS;CAClB;;;;;;CAOA,IAAW,cAAkC;EAC3C,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe;EAEpB,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,KAAK,YAAY,MAAM,UAAU;EAErC,OAAO;CACT;;;;CAKA,IAAW,gBAAgB;EACzB,OAAO,KAAK,OAAO,eAAe;CACpC;;;;CAKA,IAAW,SAAiB;EAC1B,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;CAYA,AAAU,iBAAiB,KAAqB;EAC9C,OAAO,IAAI,QAAQ,SAAS,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;CACxE;;;;;;CAOA,AAAU,iBAAiB,KAAsB;EAC/C,OAAO,IACJ,MAAM,SAAS,CAAC,CAChB,MACE,YACC,YAAY,eAAe,YAAY,iBAAiB,YAAY,WACxE;CACJ;;;;;;;;;;CAWA,AAAU,cAAc,OAAY,YAAqB,OAA4B;EACnF,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,KAAK;EAEhD,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK;CAClD;CAEA,AAAU,eAAe;EACvB,KAAK,QAAQ,OAAO,KAAK,WAAW,IAC/B,KAAK,YAAY,QAAQ,CAAC,IAC3B,KAAK,UAAU,KAAK,YAAY,IAAI;EAExC,KAAK,QAAQ,QAAQ,KAAK,UAAU,KAAK,YAAY,KAAK;EAC1D,KAAK,QAAQ,SAAS,EAAE,GAAI,KAAK,YAAY,UAAU,CAAC,EAAG;EAE3D,KAAK,QAAQ,MAAM;GACjB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;;CAMA,AAAU,aAAa;EACrB,MAAM,cAAc,KAAK,YAAY,UAAU;EAE/C,OAAO,OAAO,gBAAgB,YAAY,QAAQ,KAAK,WAAW;CACpE;;;;CAKA,AAAU,UAAU,MAAW;EAC7B,IAAI;GACF,IAAI,CAAC,MAAM,OAAO,CAAC;GAEnB,MAAM,OAAY,CAAC;GAEnB,MAAM,sBAA2B,CAAC;GAElC,KAAK,IAAI,OAAO,MAAM;IACpB,MAAM,QAAQ,KAAK;IAEnB,IAAI,aAAa;IAEjB,IAAI,IAAI,SAAS,IAAI,GACnB,aAAa;IAGf,MAAM,MAAM,KAAK,IAAI;IAIrB,IAAI,KAAK,iBAAiB,GAAG,GAAG;IAMhC,IAAI,IAAI,SAAS,GAAG,GAAG;KAErB,IAAI,IAAI,SAAS,IAAI,GAAG;MACtB,MAAM,WAAW,IAAI,MAAM,GAAG;MAE9B,MAAM,UAAU,SAAS;MACzB,MAAM,eAAe,SAAS;MAC9B,MAAM,gBAAgB,SAAS;MAc/B,IACE,YAAY,UACZ,iBAAiB,UACjB,kBAAkB,QAClB;OACA,IACE,MACA,KAAK,iBAAiB,GAAG,GACzB,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;OAEA;MACF;MAEA,MAAM,eAAe,aAAa,MAAM,GAAG;MAE3C,MAAM,QAAQ,OAAO,aAAa,EAAE;MAGpC,IAAI,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAM;MAoB7C,IAAI,OAAO,MAAM,KAAK,GAAG;OACvB,IACE,MACA,KAAK,iBAAiB,GAAG,GACzB,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;OAEA;MACF;MAEA,MAAM,SAAU,oBAAoB,aAAa,CAAC;MAElD,MAAM,QAAS,OAAO,WAAW,CAAC;MAIlC,MAAM,WADgB,cAAc,MAAM,GACb,CAAC,CAAC;MAM/B,IAAI,aAAa,QAAW;MAE5B,MAAM,YAAY,KAAK,WAAW,KAAK;MAEvC;KACF;KAEA,MAAM,WAAW,IAAI,MAAM,GAAG;KAC9B,MAAM,UAAU,SAAS;KAKzB,MAAM,gBAAgB,SAAS,MAAM,IAAG,CAAE,MAAM,GAAG;KAenD,IACE,MACA,UAAU,MAAM,aAAa,IAC7B,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;KAEA;IACF;IAEA,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,CAAC;SAC/C,IAAI,YACT,IAAI,KAAK,MACP,KAAK,IAAI,CAAC,KAAK,KAAK,WAAW,KAAK,CAAC;SAChC;KACL,KAAK,OAAO,CAAC,KAAK,WAAW,KAAK,CAAC;KAEnC;IACF;SAEA,IAAI,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;GAEzC;GAGA,KAAK,MAAM,OAAO,qBAChB,KAAK,OAAO,oBAAoB;GAGlC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,KAAK;GACjB,KAAK,IAAI,OAAO,OAAO;GAEvB,OAAO,CAAC;EACV;CACF;;;;CAKA,AAAU,WAAW,MAAW;EAG9B,IAAI,MAAM,MAAM,OAAO,IAAI,aAAa,IAAI;EAC5C,IAAI,MAAM,UAAU,UAAa,MAAM,UAAU,MAAM,MACrD,OAAO,KAAK;EAGd,IAAI,SAAS,SAAS,OAAO;EAE7B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,OAAO,SAAS,UAAU,OAAO,KAAK,KAAK;EAE/C,OAAO;CACT;;;;CAKA,AAAO,SAAS,OAAc;EAC5B,KAAK,QAAQ;EAGb,KAAK,SAAS,SAAS,KAAK;EAE5B,OAAO;CACT;;;;CAKA,AAAO,QAAQ,WAAyB,GAAG,MAAa;EACtD,OAAO,OAAO,QAAQ,WAAW,aAAa,GAAG,MAAM,IAAI;CAC7D;;;;CAKA,AAAO,GAAG,WAAyB,UAAe;EAChD,OAAO,OAAO,UAAU,WAAW,aAAa,QAAQ;CAC1D;;;;CAKA,AAAO,IAAI,SAAc,QAAkB,QAAQ;EACjD,IAAI,CAAC,OAAO,IAAI,UAAU,GAAG;EAE7B,IAAI,IAAI;GACN,QAAQ;GACR,QAAQ,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK,QAAQ,MAAM,EAAE,IAAI,IAAI,KAAK;GAC/E;GACA,MAAM;GACN,SAAS,EACP,SAAS,KACX;EACF,CAAC;CACH;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,KAAK;CACtD;;;;;;;;;CAUA,MAAa,gBAAgB;EAG3B,MAAM,mBAAmB,MAAM,KAAK,kBAAkB;EAEtD,IAAI,qBAAqB,QAAW;GAElC,IAAI,4BAA4B,UAAU,OAAO;GAEjD,OAAO,KAAK,SAAS,KAAK,gBAAgB;EAC5C;EAEA,MAAM,UAAU,KAAK,MAAM;EAE3B,IAAI,CAAC,QAAQ,YAAY;EAKzB,MAAM,iBAAiB,iBAAiB;EACxC,MAAM,sBAAsB,iBAAiB,YAAY,IAAI,IAAI;EAEjE,MAAM,mBAAmB,MAAM,YAAY,QAAQ,YAAY,MAAM,KAAK,QAAQ;EAElF,IAAI,gBACF,cAAc,oBAAoB,IAAI,GAAG;GACvC,MAAM;GACN,YAAY,YAAY,IAAI,IAAI;EAClC,CAAC;EAGH,OAAO;CACT;;;;;;CAOA,AAAO,aAAa;EAClB,OAAO,KAAK,MAAM;CACpB;;;;;CAMA,AAAO,UAAsC,QAAmD;EAC9F,IAAI,KAAK,eACP,OAAO,SACH,KAAK,KAAK,eAAyB,MAAkB,IACpD,KAAK;EAGZ,OAAO,CAAC;CACV;;;;CAKA,AAAO,gBAAgB,GAAG,QAAqC;EAC7D,OAAO,OAAO,KAAK,UAAU,GAAG,MAAM;CACxC;;;;CAKA,AAAO,iBAAiB,MAAyB;EAC/C,KAAK,gBAAgB;CACvB;;;;;;;;CASA,MAAa,UAAU;EACrB,IAAI;GAGF,KAAK,IAAI,uBAAuB;GAEhC,OAAO,MAAM,mBAAmB,MAAM,KAAK,QAAQ;EACrD,SAAS,OAAO;GACd,KAAK,IAAI,OAAO,OAAO;GAEvB,MAAM;EACR;CACF;;;;;;;CAQA,MAAgB,oBAAoB;EAElC,MAAM,cAAc,KAAK,mBAAmB;EAG5C,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,IAAI,sCAAsC;EAG/C,KAAK,QAAQ,uBAAuB,aAAa,KAAK,KAAK;EAE3D,MAAM,iBAAiB,iBAAiB;EAExC,KAAK,MAAM,CAAC,OAAO,eAAe,YAAY,QAAQ,GAAG;GACvD,KAAK,IAAI,0BAA0B,OAAO,aAAa,WAAW,IAAI,CAAC;GAEvE,MAAM,sBAAsB,iBAAiB,YAAY,IAAI,IAAI;GAEjE,MAAM,SAAS,MAAM,WAAW;IAC9B,SAAS;IACT,UAAU,KAAK;GACjB,CAAC;GAED,IAAI,gBACF,cAAc,oBAAoB,IAAI,GAAG;IACvC,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;IAChC,OAAO;KAAE,MAAM,WAAW;KAAM;IAAM;GACxC,CAAC;GAGH,KAAK,IAAI,yBAAyB,OAAO,aAAa,WAAW,IAAI,GAAG,SAAS;GAEjF,IAAI,WAAW,QAAW;IACxB,KAAK,IACH,OAAO,OAAO,oCAAoC,IAAI,OAAO,WAAW,WAAW,IAAI,GACvF,MACF;IAEA,KAAK,QAAQ,oBAAoB;IAEjC,KAAK,IAAI,gCAAgC,SAAS;IAElD,OAAO;GACT;EACF;EAEA,KAAK,IAAI,gCAAgC,SAAS;EAGlD,KAAK,QAAQ,sBAAsB,aAAa,KAAK,KAAK;CAC5D;;;;;;;CAQA,AAAU,qBAAmC;EAC3C,MAAM,QAAQ,KAAK;EACnB,MAAM,aAAa,OAAO,IAAI,iBAAiB;EAE/C,MAAM,gBAAgB,WACpB,QACE,WACE,MAAM,QAAQ,OAAO,QAAQ,SAAS,MAAM,IAAI,KAC/C,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,IAAI,EAC1D;EAGF,MAAM,SAAuB,CAAC,GAAI,YAAY,OAAO,CAAC,CAAE;EAExD,IAAI,aAAa,YAAY,IAAI,GAC/B,OAAO,KAAK,GAAI,YAAY,MAAM,cAAc,CAAC,CAAE;EAIrD,MAAM,WAAW,aAAa,YAAY,MAAM,IAAI,YAAY,QAAQ,cAAc,CAAC,IAAI,CAAC;EAG5F,OAAO,CACL,GAAG,IAAI,IAAI,CACT,GAAG,OAAO,QAAQ,eAAe,CAAC,SAAS,SAAS,UAAU,CAAC,GAC/D,GAAI,MAAM,cAAc,CAAC,CAC3B,CAAC,CACH;CACF;;;;CAKA,AAAO,MAAM,KAAa,cAAoB;EAC5C,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY;CAChD;;;;CAKA,AAAO,MAAM,MAAc,SAAS,eAAuB,IAAY;EACrE,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC,EAAE,YAAY,KAAK;CACzD;;;;CAKA,AAAO,IAAI,KAAa,cAAoB;EAC1C,OAAO,KAAK,MAAM,KAAK,YAAY;CACrC;;;;CAKA,AAAO,IAAI,KAAa;EACtB,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,MAAS,MAAM;CACnD;;;;CAKA,AAAO,IAAI,KAAa,OAAY;EAClC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,WAAW,KAAa,OAAY;EACzC,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAE1B,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,MAAM,GAAG,MAAgB;EAC9B,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EAE/C,OAAO;CACT;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,QAAQ,KAAa,OAAY;EACtC,IAAI,KAAK,QAAQ,MAAM,KAAK,KAAK;EAEjC,OAAO;CACT;;;;CAKA,IAAW,aAAa;EACtB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAM,aAAkB,CAAC;EAEzB,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,QAAQ,MAAM,WAAW;GAEnC,WAAW,OAAO;EACpB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,KAAuC;EAGjD,OAFa,KAAK,MAAM,GAEd;CACZ;;;;;CAMA,AAAO,MAAM,MAA8B;EACzC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC;CAC9B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,QAAQ;CACtB;;;;;;;;;;;CAYA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,QAAQ,KAAK,KAAK;EACnC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,IAAW,QAAQ;EACjB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK,KAAK;EAElC,OAAO;CACT;;;;CAKA,AAAO,MAAM;EACX,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,kBAAkB;EACvB,OAAO;GACL,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAO,oBAAoB;EACzB,MAAM,SAAS,KAAK,gBAAgB;EAEpC,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,QAAQ;EACb,MAAM,SAAS,KAAK,IAAI;EAExB,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAgB;EAC1B,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;CAC9B;;;;CAKA,AAAO,MAAM,MAAgB;EAC3B,MAAM,OAAO,KAAK,KAAK,IAAI;EAE3B,KAAK,MAAM,GAAG,IAAI;EAElB,OAAO;CACT;;;;CAKA,AAAO,OAAO,MAAgB;EAC5B,OAAO,OAAO,KAAK,IAAI,GAAG,IAAI;CAChC;;;;CAKA,AAAO,KAAK,KAAa,eAAe,OAAO;EAC7C,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,UAAU,QACZ,OAAO;EAGT,IAAI,UAAU,SACZ,OAAO;EAGT,IAAI,UAAU,GACZ,OAAO;EAGT,OAAO,QAAQ,KAAK;CACtB;;;;CAKA,AAAO,IAAI,KAAa,eAAuB,GAAuB;EACpE,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,CAAC,SAAS,UAAU,GAAG,OAAO;EAElC,OAAO,SAAS,KAAK;CACvB;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,IAAI,IAAI;CACtB;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,IAAY;EAC5D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,OAAO,KAAK;CACrB;;;;CAKA,AAAO,MAAM,KAAa,eAAuB,GAAW;EAC1D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,WAAW,KAAK,KAAK;CAC9B;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,GAAW;EAC3D,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;EAElD,OAAO,MAAM,KAAK,IAAI,eAAe;CACvC;;;;;;;;;;CAWA,IAAW,KAAK;EACd,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCA,AAAO,WAAW;EAUhB,IAF4B,OAAO,IAAI,mBAAmB,KAE7C,MAAM,MAAM;GACvB,MAAM,SAAS,KAAK,OAAO,WAAW;GAEtC,IAAI,QAAQ;IAMV,MAAM,WAAW,OAAO,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAE,CAAE,KAAK;IAE1D,IAAI,SAAS,OAAO;GACtB;EACF;EAOA,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,SAAS;CACvB;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,YAAY;EACrB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,UAA2C;EACpD,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAO,UAAU,KAAiB,OAAe;EAC/C,KAAK,YAAY,QAAQ,IAAI,YAAY,KAAK;EAE9C,OAAO;CACT;AACF"}
+{"version":3,"file":"request.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/request.ts"],"sourcesContent":["import { colors } from \"@mongez/copper\";\nimport events from \"@mongez/events\";\nimport { trans, transFrom } from \"@mongez/localization\";\nimport { Random, except, get, only, rtrim, set, unset } from \"@mongez/reinforcements\";\nimport { isEmpty } from \"@mongez/supportive-is\";\nimport type { LogLevel } from \"@warlock.js/logger\";\nimport { log } from \"@warlock.js/logger\";\nimport { BaseValidator, v } from \"@warlock.js/seal\";\nimport type { FastifyRequest } from \"fastify\";\nimport { randomBytes } from \"node:crypto\";\nimport { type IncomingHttpHeaders } from \"node:http2\";\nimport { Application } from \"../application/application\";\nimport { config } from \"../config/config-getter\";\nimport {\n  LOCALE_COOKIE_NAME,\n  LOCALE_PREFERENCE_COOKIE_NAME,\n  resolveLocaleConfiguration,\n} from \"../config/locale-configuration\";\nimport type { Middleware, Route } from \"../router\";\nimport { validateAll } from \"../validation/validateAll\";\nimport { CookieJarUnavailableError } from \"./errors\";\nimport { createRequestStore } from \"./middleware/inject-request-context\";\nimport { buildRequestLogSnapshot, type RequestLogSnapshot } from \"./request-log-snapshot\";\nimport { Response } from \"./response\";\nimport { buildTracingContext, deriveTraceId, dispatchPhase, isTracingEnabled } from \"./tracing\";\nimport type {\n  DecodedAccessToken,\n  HttpConfigurations,\n  PartialMiddleware,\n  RequestEvent,\n  RequestLocals,\n} from \"./types\";\nimport { UploadedFile } from \"./uploaded-file\";\n\ntype StandardHeaders = {\n  // copy every declared property from http.IncomingHttpHeaders\n  // but remove index signatures\n  [\n    K in keyof IncomingHttpHeaders as string extends K ? never : number extends K ? never : K\n  ]: IncomingHttpHeaders[K];\n};\n\ntype HeaderKeys = keyof StandardHeaders;\n\n/** A request-bound translator: keyword in, translated string out. */\nexport type RequestTranslator = (keyword: string, placeholders?: Record<string, unknown>) => string;\n\nexport class Request<RequestValidation = any> {\n  /**\n   * Underlying Fastify request — a public escape hatch to capabilities the\n   * framework's high-level helpers don't yet cover.\n   *\n   * **Prefer framework methods first**: `request.input()`, `request.header()`,\n   * `request.body`, `request.query`, `request.params`, `request.file()`,\n   * `request.locals.user` (set by `@warlock.js/auth`), `request.detectIp()`,\n   * etc. They handle locale, parsing,\n   * trust-proxy, and validation pipeline integration correctly.\n   *\n   * **Reach for `baseRequest` only** when the framework genuinely lacks a\n   * helper for what you need — and when you do, file an issue so we can add\n   * it. The escape hatch is the release valve that lets consumers move\n   * faster than the framework, but every long-term reach here is a missing\n   * helper waiting to be added.\n   */\n  public baseRequest!: FastifyRequest;\n\n  /**\n   * Response Object\n   */\n  public response!: Response;\n\n  /**\n   * Route Object\n   */\n  public route!: Route;\n\n  /**\n   * Backing controller for `signal` — created on first access, so requests\n   * that never ask for it attach no listeners.\n   */\n  private disconnectController?: AbortController;\n\n  /**\n   * An `AbortSignal` that aborts when the client disconnects before the\n   * response has finished. Pass it to long-running work (`fetch`, database\n   * cursors, child processes) so that work stops when nobody is waiting:\n   *\n   * ```ts\n   * const report = await buildReport({ signal: request.signal });\n   * ```\n   *\n   * It follows the RESPONSE, not the request stream: reading the request body\n   * to the end does not abort it, and a response that finishes normally never\n   * aborts it. The abort reason is a `DOMException` named `\"AbortError\"`.\n   * The listener is attached on first access and removed when the response\n   * closes. Combine with a deadline via\n   * `AbortSignal.any([request.signal, AbortSignal.timeout(ms)])`.\n   *\n   * A request with no bound response (a hand-built `Request` in a test) gets\n   * a signal that never aborts.\n   */\n  public get signal(): AbortSignal {\n    if (this.disconnectController) return this.disconnectController.signal;\n\n    const controller = new AbortController();\n\n    this.disconnectController = controller;\n\n    const raw = this.response?.baseResponse?.raw;\n\n    if (!raw || typeof raw.once !== \"function\") return controller.signal;\n\n    const abortUnlessFinished = () => {\n      if (raw.writableFinished) return;\n\n      controller.abort(\n        new DOMException(\"The client disconnected before the response finished\", \"AbortError\"),\n      );\n    };\n\n    if (raw.writableFinished) return controller.signal;\n\n    if (raw.destroyed) {\n      abortUnlessFinished();\n\n      return controller.signal;\n    }\n\n    raw.once(\"close\", abortUnlessFinished);\n\n    return controller.signal;\n  }\n\n  /**\n   * Parsed Request Payload\n   */\n  protected payload: any = {};\n\n  /**\n   * Backing field for `decodedAccessToken` — see the accessor below.\n   */\n  private _decodedAccessToken?: DecodedAccessToken;\n\n  /**\n   * Decoded access token payload (set by auth middleware).\n   *\n   * A prototype accessor, not a plain field, so assignment can mark the\n   * request `authDerived` (see the setter below and `RequestLocals` in\n   * `types.ts`) without every call site remembering to do so itself.\n   */\n  public get decodedAccessToken(): DecodedAccessToken | undefined {\n    return this._decodedAccessToken;\n  }\n\n  public set decodedAccessToken(value: DecodedAccessToken | undefined) {\n    this._decodedAccessToken = value;\n    this.locals.authDerived = true;\n  }\n\n  /**\n   * Private, server-only, per-request data bag.\n   *\n   * Distinct from the input payload (`body` / `query` / `params` / `all()`):\n   * a write here never surfaces in `request.all()`, `request.validated()`, or\n   * `request.input()`. That is the trap `request.set()` sets for private data\n   * — it writes into the payload `all` bag, so anything stored there leaks\n   * into every input accessor and, from there, into the client-facing\n   * payload. `locals` is the correct home for private per-request app data\n   * (a resolved session, a fetched-once model) that must never be mistaken\n   * for client input.\n   *\n   * Augmentable via module augmentation, in the module that OWNS the key:\n   *\n   * ```typescript\n   * declare module \"@warlock.js/core\" {\n   *   interface RequestLocals {\n   *     session?: { token: string };\n   *   }\n   * }\n   * ```\n   *\n   * A plain class-field initializer is sufficient for \"fresh per request\":\n   * `router.ts:925` constructs `new Request()` for every incoming request —\n   * `Request` instances are not pooled or reused across requests — so this\n   * initializer runs exactly once per request and no value can leak in from\n   * a prior one.\n   */\n  public locals: RequestLocals = {};\n\n  /**\n   * Backing field for the lazily-generated CSP nonce. Left `undefined` until\n   * the first `request.nonce` read; see the `nonce` getter below.\n   */\n  protected _nonce?: string;\n\n  /**\n   * Per-request Content-Security-Policy nonce — a fresh, unguessable value\n   * the web layer hands to `<Scripts nonce={...} />` (the inline payload\n   * script) and to the `Content-Security-Policy` header, so a strict\n   * `script-src 'nonce-...'` allows only the script this request actually\n   * rendered.\n   *\n   * Generated LAZILY on first access, not eagerly in `setRequest()`: most\n   * requests (API routes, anything that isn't rendering HTML) never read it,\n   * and spending a `randomBytes` call on every single request for a value\n   * most of them discard is wasted entropy draw + CPU. Once generated it is\n   * cached in `_nonce`, so every subsequent read within the SAME request\n   * returns the identical value — required, since the header and the inline\n   * `<script>` tag must agree on one nonce. `_nonce` is a plain field on a\n   * per-request `Request` instance (see `locals` above — `router.ts:925`,\n   * no pooling), so the cache can never leak into the next request; a fresh\n   * `Request` means a fresh, unset `_nonce`.\n   *\n   * 16 random bytes, base64-encoded — the size the CSP Level 3 spec's own\n   * examples use, and far more entropy than an attacker could feasibly guess\n   * to defeat the policy.\n   */\n  public get nonce(): string {\n    if (!this._nonce) {\n      this._nonce = randomBytes(16).toString(\"base64\");\n    }\n\n    return this._nonce;\n  }\n\n  /**\n   * Current request instance\n   */\n  public static current: Request;\n\n  /**\n   * Translate a keyword in this request's locale. Returns the translated\n   * string, or the keyword itself when no translation exists.\n   */\n  public trans: RequestTranslator = trans;\n\n  /**\n   * Alias to trans method\n   */\n  public t: RequestTranslator = trans;\n\n  /*\n   * v5 removed the `[key: string]: any` index signature (eed20184). Attaching\n   * arbitrary properties compiled silently and hid real bugs behind `any`.\n   * The sanctioned extension paths are:\n   * - `request.locals` (augment `RequestLocals` via module augmentation) for\n   *   per-request attached data, e.g. models fetched in validation middleware.\n   * - `requestMemo(key, fn)` for per-request memoized computation.\n   * - Module augmentation of the `Request` class itself for new typed members.\n   */\n\n  /**\n   * Locale code\n   */\n  protected _locale = \"\";\n\n  /**\n   * Validated data\n   */\n  protected validatedData?: RequestValidation;\n\n  /**\n   * Request id\n   */\n  public id = Random.string(32);\n\n  /**\n   * Trace id. The inbound `traceparent` header's trace id\n   * when valid, otherwise `id`. Resolved once in `setRequest`, alongside\n   * `id` itself — see `resolveTraceId`.\n   */\n  public traceId = \"\";\n\n  /**\n   * Start Time\n   */\n  public startTime = Date.now();\n\n  /**\n   * End Time\n   */\n  public endTime?: undefined | number;\n\n  /**\n   * Set request handler\n   */\n  public setRequest(request: FastifyRequest) {\n    this.baseRequest = request;\n\n    this.resolveRequestId();\n\n    this.resolveTraceId();\n\n    this.parsePayload();\n\n    // Resolve the locale at CALL time, never at bind time. `setRequest` runs\n    // before routing, so a locale set later (path locale, `setLocaleCode`, the\n    // web layer's C3 derivation) must steer translations too — the old\n    // `transFrom.bind(null, localeCode)` snapshot made `request.locale` and\n    // `request.trans()` silently disagree for the rest of the request.\n    this.trans = this.t = (keyword: string, placeholders?: any) =>\n      transFrom(this.getLocaleCode(), keyword, placeholders);\n\n    return this;\n  }\n\n  /**\n   * Inherit `X-Request-Id` from the incoming request, fall back to a custom\n   * generator, then to the field-init default (`Random.string(32)`).\n   *\n   * Inherited values are validated (length cap + printable-ASCII) to prevent\n   * log-injection from a malicious client. Disable the whole behavior by\n   * setting `http.requestId.enabled = false` — in which case the field-init\n   * default is used regardless of any incoming header.\n   */\n  protected resolveRequestId() {\n    const requestIdConfig = config.key(\"http.requestId\") || {};\n\n    if (requestIdConfig.enabled === false) return;\n\n    const headerName = (requestIdConfig.header || \"x-request-id\").toLowerCase();\n    const incoming = this.baseRequest.headers[headerName];\n\n    if (Request.isValidRequestId(incoming)) {\n      this.id = incoming;\n\n      return;\n    }\n\n    if (typeof requestIdConfig.generator === \"function\") {\n      this.id = requestIdConfig.generator();\n    }\n  }\n\n  /**\n   * Derive `traceId`: the inbound\n   * `traceparent` header's trace id when it is a valid W3C traceparent,\n   * otherwise `id`. Always runs — unlike request-id inheritance this has no\n   * `enabled: false` escape hatch, since `traceId` is only ever read when\n   * tracing hooks are enabled (see `./tracing`).\n   */\n  protected resolveTraceId() {\n    const header = this.baseRequest.headers.traceparent;\n    const traceparent = Array.isArray(header) ? header[0] : header;\n\n    this.traceId = deriveTraceId(traceparent, this.id);\n  }\n\n  /**\n   * Validate a candidate request-id value. Accepts non-empty printable ASCII\n   * up to 128 characters — tight enough to reject newline / control-character\n   * log-injection, loose enough to accept UUIDs, ULIDs, snowflakes, etc.\n   */\n  protected static isValidRequestId(value: unknown): value is string {\n    return (\n      typeof value === \"string\" &&\n      value.length > 0 &&\n      value.length <= 128 &&\n      /^[\\x21-\\x7e]+$/.test(value)\n    );\n  }\n\n  /**\n   * Translate from the given locale code\n   */\n  public transFrom(localeCode: string, keyword: string, placeholders?: any) {\n    return transFrom(localeCode, keyword, placeholders);\n  }\n\n  /**\n   * Cache one supported locale without coercing request-controlled input.\n   *\n   * The default is the answer for a client that asked for NOTHING. A client\n   * that did ask is only overridden when its value fails a declared\n   * `app.localeCodes` allow-list; with no list declared there is nothing to\n   * fail, so the requested locale passes through unchanged.\n   */\n  protected cacheLocale(candidate: unknown): string {\n    const { defaultLocaleCode, localeCodes } = resolveLocaleConfiguration(\n      config.key(\"app.localeCode\"),\n      config.key(\"app.localeCodes\"),\n    );\n\n    const requested = typeof candidate === \"string\" && candidate.length > 0 ? candidate : undefined;\n\n    this._locale =\n      requested !== undefined && (localeCodes === undefined || localeCodes.includes(requested))\n        ? requested\n        : defaultLocaleCode;\n\n    return this._locale;\n  }\n\n  /**\n   * Resolve the first present Mode B source, skipping unsupported browser\n   * preferences. Other unsupported values resolve to the configured default.\n   */\n  protected resolveLocale(): string {\n    const { localeCodes } = resolveLocaleConfiguration(\n      config.key(\"app.localeCode\"),\n      config.key(\"app.localeCodes\"),\n    );\n    const preference = this.cookies[LOCALE_PREFERENCE_COOKIE_NAME];\n    // A stale browser preference must not hide the server's legacy cookie or\n    // header after an application removes a supported locale.\n    const supportedPreference =\n      typeof preference === \"string\" &&\n      (localeCodes === undefined || localeCodes.includes(preference))\n        ? preference\n        : undefined;\n    const candidate = [\n      this.query[\"locale\"],\n      supportedPreference,\n      this.cookies[LOCALE_COOKIE_NAME],\n      this.header(\"locale\"),\n    ].find((value) => typeof value === \"string\" && value.length > 0);\n\n    return this.cacheLocale(candidate);\n  }\n\n  /**\n   * Get current locale code\n   */\n  public get locale(): string {\n    if (this._locale) return this._locale;\n\n    return this.resolveLocale();\n  }\n\n  /**\n   * Set locale code\n   */\n  public set locale(localeCode: string) {\n    this.cacheLocale(localeCode);\n  }\n\n  /**\n   * Set locale code\n   */\n  public setLocaleCode(localeCode: string) {\n    this.locale = localeCode;\n\n    return this;\n  }\n\n  /**\n   * @deprecated Use `request.locale`. This alias is removed after one version.\n   * The legacy default argument is accepted for source compatibility but the\n   * resolved default is owned exclusively by app configuration.\n   */\n  public getLocaleCode(_legacyDefaultLocaleCode?: string): string {\n    return this.locale;\n  }\n\n  /**\n   * Get http protocol\n   */\n  public get protocol() {\n    return this.baseRequest.protocol;\n  }\n\n  /**\n   * Validate the given validation schema\n   */\n  public async validate(validation: BaseValidator, selectedInputs?: string[]) {\n    return await v.validate(validation, selectedInputs ? this.only(selectedInputs) : this.all());\n  }\n\n  /**\n   * Get value of the given header\n   */\n  public header<TCustomHeader extends string = HeaderKeys>(\n    name: TCustomHeader | HeaderKeys,\n    defaultValue: any = null,\n  ) {\n    return this.baseRequest.headers[name.toLocaleLowerCase()] ?? defaultValue;\n  }\n\n  /**\n   * Get all cookies from the current request\n   */\n  public get cookies(): Record<string, string | undefined> {\n    return this.baseRequest.cookies || {};\n  }\n\n  /**\n   * Assert the cookie jar exists before a by-name read. `get cookies()` stays\n   * lenient (returns `{}`) for the framework's own opportunistic reads, but a\n   * deliberate by-name read from application code must fail loudly when\n   * `@fastify/cookie` was never registered, rather than being indistinguishable\n   * from \"the caller sent no such cookie\".\n   */\n  private assertCookieJarAvailable(name: string): void {\n    if (this.baseRequest.cookies === undefined) {\n      throw new CookieJarUnavailableError(name);\n    }\n  }\n\n  /**\n   * Get a particular cookie value or fallback to default\n   */\n  public cookie(name: string, defaultValue?: any): string | any {\n    this.assertCookieJarAvailable(name);\n\n    const value = this.cookies[name] ?? defaultValue;\n\n    try {\n      return JSON.parse(value);\n    } catch (error) {\n      return value;\n    }\n  }\n\n  /**\n   * Determine if the request has the specified cookie\n   */\n  public hasCookie(name: string): boolean {\n    this.assertCookieJarAvailable(name);\n\n    return this.cookies[name] !== undefined;\n  }\n\n  /**\n   * Get the current request domain\n   */\n  public get domain() {\n    return this.baseRequest.hostname.replace(/^www\\./, \"\");\n  }\n\n  /**\n   * Get hostname\n   */\n  public get hostname() {\n    return this.domain;\n  }\n\n  /**\n   * Get request origin\n   */\n  public get origin() {\n    return this.baseRequest.headers.origin as string;\n  }\n\n  /**\n   * Get the domain of the origin\n   */\n  public get originDomain() {\n    let domain: string | null = null;\n\n    try {\n      domain = this.origin ? new URL(this.origin).hostname : null;\n    } catch {\n      // `Origin: null` (sandboxed iframes) or any unparsable value\n      domain = null;\n    }\n\n    if (domain?.startsWith(\"www.\")) {\n      return domain.replace(/^www\\./, \"\");\n    }\n\n    return domain;\n  }\n\n  /**\n   * Get authorization header value\n   */\n  public get authorizationValue(): string {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return \"\";\n\n    const [type, value] = authorization.split(\" \");\n\n    if (![\"bearer\", \"key\"].includes(type.toLowerCase())) return \"\";\n\n    return value || \"\";\n  }\n\n  /**\n   * Get access token from Authorization header\n   *\n   * If the Authorization header does not start with `Bearer` value then return null\n   */\n  public get accessToken(): string | undefined {\n    const authorization = this.header(\"authorization\");\n\n    if (!authorization) return;\n\n    const [type, value] = authorization.split(\" \");\n\n    if (type.toLowerCase() !== \"bearer\") return;\n\n    return value;\n  }\n\n  /**\n   * Get the authorization header\n   */\n  public get authorization() {\n    return this.header(\"authorization\");\n  }\n\n  /**\n   * Get current request method\n   */\n  public get method(): string {\n    return this.baseRequest.method;\n  }\n\n  /**\n   * Parse the payload and merge it from the request body, params and query string\n   */\n  /**\n   * Turn a bracket-notation key into the dotted path `set()` expects.\n   *\n   * `a[b][c]` -> `a.b.c`. Used only for NON-numeric nesting; numeric indices\n   * keep the array-of-objects path in {@link parseBody}, which builds real\n   * arrays rather than objects with numeric keys.\n   */\n  protected bracketKeyToPath(key: string): string {\n    return key.replace(/\\]\\[/g, \".\").replace(/\\[/g, \".\").replace(/\\]/g, \"\");\n  }\n\n  /**\n   * True when any path segment of a bracket/dot key could reach a prototype\n   * (`__proto__`, `constructor`, `prototype`). Such keys are dropped before\n   * any branch of {@link parseBody} writes them.\n   */\n  protected hasUnsafeSegment(key: string): boolean {\n    return key\n      .split(/[[\\].]+/)\n      .some(\n        (segment) =>\n          segment === \"__proto__\" || segment === \"constructor\" || segment === \"prototype\",\n      );\n  }\n\n  /**\n   * Apply the `key[]` array marker to a parsed value.\n   *\n   * The subtlety this exists to remove: a key declared `[]` should ALWAYS be an\n   * array, but the underlying query/body parser only hands us one when the\n   * caller sent the key more than once. Deciding the TYPE from the number of\n   * occurrences means one selected filter is a string and two are an array —\n   * a shape that changes under the user's hands.\n   */\n  protected arrayValueFor(value: any, isArrayKey: boolean, parse: (value: any) => any) {\n    if (Array.isArray(value)) return value.map(parse);\n\n    return isArrayKey ? [parse(value)] : parse(value);\n  }\n\n  protected parsePayload() {\n    this.payload.body = this.isJsonBody()\n      ? (this.baseRequest.body ?? {})\n      : this.parseBody(this.baseRequest.body);\n\n    this.payload.query = this.parseBody(this.baseRequest.query);\n    this.payload.params = { ...(this.baseRequest.params || {}) };\n    // same precedence as `allExceptParams()`: body over query, params last\n    this.payload.all = {\n      ...this.payload.query,\n      ...this.payload.body,\n      ...this.payload.params,\n    };\n  }\n\n  /**\n   * JSON bodies are already typed by the client, so they skip the\n   * bracket/coercion parsing meant for querystring, urlencoded and multipart.\n   */\n  protected isJsonBody() {\n    const contentType = this.baseRequest.headers?.[\"content-type\"];\n\n    return typeof contentType === \"string\" && /json/i.test(contentType);\n  }\n\n  /**\n   * Parse body payload\n   */\n  protected parseBody(data: any) {\n    try {\n      if (!data) return {};\n\n      const body: any = {};\n\n      const arrayOfObjectValues: any = {};\n\n      for (let key in data) {\n        const value = data[key];\n\n        let isArrayKey = false;\n\n        if (key.endsWith(\"[]\")) {\n          isArrayKey = true;\n        }\n\n        key = rtrim(key, \"[]\");\n\n        // every path segment this key can write must be safe, whichever\n        // branch below ends up writing it (set(), bucket, entry or body)\n        if (this.hasUnsafeSegment(key)) continue;\n\n        // check if the key is has a square brackets, then convert it into object\n        // i.e user[email] => user: {email: \"value\"}\n        // also check if its an array of objects\n\n        if (key.includes(\"[\")) {\n          // check if its an array of objects\n          if (key.includes(\"][\")) {\n            const keyParts = key.split(\"[\");\n\n            const keyName = keyParts[0];\n            const firstBracket = keyParts[1];\n            const secondBracket = keyParts[2];\n\n            /*\n              `key.includes(\"][\")` guarantees all three segments — but that is a\n              property of the string test above, not of these reads, so each is\n              `string | undefined`.\n\n              When the shape is not what this branch assumes, fall through to\n              the generic bracket path rather than skipping the key. That is the\n              same choice the NaN branch below makes, and for the same reason\n              spelled out there: the failure this code has already been bitten\n              by is answering with a shape the caller did not send. Dropping the\n              pair silently would be that bug again, in a new place.\n            */\n            if (\n              keyName === undefined ||\n              firstBracket === undefined ||\n              secondBracket === undefined\n            ) {\n              set(\n                body,\n                this.bracketKeyToPath(key),\n                this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n              );\n\n              continue;\n            }\n\n            const keyNameParts = firstBracket.split(\"]\");\n\n            const index = Number(keyNameParts[0]);\n\n            // a crafted huge index would allocate a giant sparse array\n            if (Number.isInteger(index) && index > 1000) continue;\n\n            /*\n              A NON-NUMERIC first segment is not an array index — it is a deeper\n              nested object. `a[b][c]=x` reaches this branch because it contains\n              \"][\", but `Number(\"b\")` is NaN, and the code below used to write to\n              `[NaN]`: that sets a \"NaN\" PROPERTY on an array whose length stays\n              0, so the request arrived as `{a: []}` and the value was gone. No\n              error, no warning — the caller simply never got `x`.\n\n              Deciding between refusing (4xx) and interpreting: a doubly-nested\n              key is unambiguous and is exactly what every bracket-notation\n              parser means by it, so we interpret. Refusing would reject a URL\n              shape that is standard elsewhere and that we ourselves already\n              honour one level shallower, five lines below. What was definitely\n              wrong was answering with a shape the caller did not send.\n\n              Numeric indices keep the array-of-objects path below unchanged —\n              `items[0][name]` is still an array.\n            */\n            if (Number.isNaN(index)) {\n              set(\n                body,\n                this.bracketKeyToPath(key),\n                this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n              );\n\n              continue;\n            }\n\n            const bucket = (arrayOfObjectValues[keyName] ??= []);\n\n            const entry = (bucket[index] ??= {});\n\n            // now get the key after the index\n            const keyNameParts2 = secondBracket.split(\"]\");\n            const keyName2 = keyNameParts2[0];\n\n            // `split` always yields a first element, so this holds — but an\n            // undefined key here would write a property literally named\n            // \"undefined\" onto the entry, which is the same silent-wrong-shape\n            // outcome the comment above describes.\n            if (keyName2 === undefined) continue;\n\n            entry[keyName2] = this.parseValue(value);\n\n            continue;\n          }\n\n          const keyParts = key.split(\"[\");\n          const keyName = keyParts[0];\n          // `key.includes(\"[\")` puts at least two segments here. Falling back\n          // to the whole key rather than asserting keeps the parse total: an\n          // undefined segment would make `keyNameParts[0]` undefined too, and\n          // this branch writes that straight into the body shape.\n          const keyNameParts = (keyParts[1] ?? key).split(\"]\");\n\n          /*\n            `isArrayKey` is honoured HERE, and used not to be. `filter[tags][]=a`\n            sets the flag at the top of the loop, but this branch only wrapped\n            when the underlying value was ALREADY an array — which it is for two\n            or more occurrences and is not for one. So `filter[tags][]=a` arrived\n            as `{filter:{tags:\"a\"}}` while `…=a&…=b` arrived as `{tags:[\"a\",\"b\"]}`:\n            the same declared shape, two different types, decided by how many\n            times the caller happened to send it.\n\n            That single-element case is the one a UI hits first — one filter\n            chip selected — and `@warlock.js/web`'s decoder reads it as an array,\n            so the page and the server disagreed about the same URL.\n          */\n          set(\n            body,\n            keyName + \".\" + keyNameParts[0],\n            this.arrayValueFor(value, isArrayKey, this.parseValue.bind(this)),\n          );\n\n          continue;\n        }\n\n        if (Array.isArray(value)) {\n          set(body, key, value.map(this.parseValue.bind(this)));\n        } else if (isArrayKey) {\n          if (body[key]) {\n            body[key].push(this.parseValue(value));\n          } else {\n            body[key] = [this.parseValue(value)];\n\n            continue;\n          }\n        } else {\n          set(body, key, this.parseValue(value));\n        }\n      }\n\n      // now merge the array of objects into the body\n      for (const key in arrayOfObjectValues) {\n        body[key] = arrayOfObjectValues[key];\n      }\n\n      return body;\n    } catch (error) {\n      console.log(error);\n      this.log(error, \"error\");\n\n      return {};\n    }\n  }\n\n  /**\n   * Parse the given data\n   */\n  protected parseValue(data: any) {\n    // data.value appears only in the multipart form data\n    // if it json, then just return the data\n    if (data?.file) return new UploadedFile(data);\n    if (data?.value !== undefined && data?.fields && data?.type) {\n      data = data.value;\n    }\n\n    if (data === \"false\") return false;\n\n    if (data === \"true\") return true;\n\n    if (data === \"null\") return null;\n\n    if (typeof data === \"string\") return data.trim();\n\n    return data;\n  }\n\n  /**\n   * Set route handler\n   */\n  public setRoute(route: Route) {\n    this.route = route;\n\n    // pass the route to the response object\n    this.response.setRoute(route);\n\n    return this;\n  }\n\n  /**\n   * Trigger an http event\n   */\n  public trigger(eventName: RequestEvent, ...args: any[]) {\n    return events.trigger(`request.${eventName}`, ...args, this);\n  }\n\n  /**\n   * Listen to the given event\n   */\n  public on(eventName: RequestEvent, callback: any) {\n    return events.subscribe(`request.${eventName}`, callback);\n  }\n\n  /**\n   * Make a log message\n   */\n  public log(message: any, level: LogLevel = \"info\") {\n    if (!config.key(\"http.log\")) return;\n\n    log.log({\n      module: \"request\",\n      action: this.route.method + \" \" + this.route.path.replace(\"/*\", \"\") + `:${this.id}`,\n      message,\n      type: level,\n      context: {\n        request: this.toLogSnapshot(),\n      },\n    });\n  }\n\n  /**\n   * The bounded, plain-data view of this request that log entries carry:\n   * id, method, URL (credential-bearing query values masked), route, client\n   * IP, user agent, and the query and body unless `http.logging` or the\n   * route's `logging` option omits them. Never the native request, reply or\n   * socket.\n   *\n   * Use it in your own log calls instead of passing the request itself.\n   *\n   * @example\n   * log.warn(\"billing\", \"charge\", \"declined\", { request: request.toLogSnapshot() });\n   */\n  public toLogSnapshot(): RequestLogSnapshot {\n    const baseRequest = this.baseRequest as FastifyRequest | undefined;\n\n    return buildRequestLogSnapshot({\n      id: this.id,\n      method: baseRequest?.method ?? this.route?.method ?? \"\",\n      url: baseRequest?.url ?? \"\",\n      ip: baseRequest ? this.detectIp() : undefined,\n      userAgent: baseRequest?.headers?.[\"user-agent\"],\n      query: this.payload?.query,\n      body: this.payload?.body,\n      route: this.route,\n    });\n  }\n\n  /**\n   * Get current request path\n   */\n  public get path() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * {@alias}\n   */\n  public get url() {\n    return this.baseRequest.url;\n  }\n\n  /**\n   * Get full url\n   */\n  public get fullUrl() {\n    return this.protocol + \"://\" + this.hostname + this.path;\n  }\n\n  /**\n   * Drive the middleware chain for the current route, then defer to the\n   * controller. Returns the first response value any middleware short-circuits\n   * with, or `undefined` to continue into validation + handler.\n   *\n   * @internal Framework orchestration — do not call from app code. Will move\n   * to a dedicated controller dispatcher in a future refactor.\n   */\n  public async runMiddleware() {\n    // measure request time\n    // check for middleware first\n    const middlewareOutput = await this.executeMiddleware();\n\n    if (middlewareOutput !== undefined) {\n      // 👇🏻 make sure first its not a response instance\n      if (middlewareOutput instanceof Response) return middlewareOutput;\n      // 👇🏻 send the response\n      return this.response.send(middlewareOutput);\n    }\n\n    const handler = this.route.handler;\n\n    if (!handler.validation) return;\n\n    // 👇🏻 check for validation using validateAll helper function — timed as\n    // the \"validation\" tracing phase when tracing is\n    // enabled; a single boolean check and zero allocation otherwise.\n    const tracingEnabled = isTracingEnabled();\n    const validationStartedAt = tracingEnabled ? performance.now() : 0;\n\n    const validationOutput = await validateAll(handler.validation, this, this.response);\n\n    if (tracingEnabled) {\n      dispatchPhase(buildTracingContext(this), {\n        name: \"validation\",\n        durationMs: performance.now() - validationStartedAt,\n      });\n    }\n\n    return validationOutput;\n  }\n\n  /**\n   * Return the request handler attached to the current route.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  public getHandler() {\n    return this.route.handler;\n  }\n\n  /**\n   * Get inputs that has been validated only\n   * You can also pass an array of inputs to get only the validated inputs\n   */\n  public validated<Output = RequestValidation>(inputs?: (keyof Output | (string & {}))[]): Output {\n    if (this.validatedData) {\n      return inputs\n        ? only(this.validatedData as Output, inputs as string[])\n        : (this.validatedData as Output);\n    }\n\n    return {} as Output;\n  }\n\n  /**\n   * Get inputs that has been validated except the given inputs\n   */\n  public validatedExcept(...inputs: string[]): RequestValidation {\n    return except(this.validated(), inputs);\n  }\n\n  /**\n   * Set validated data\n   */\n  public setValidatedData(data: RequestValidation) {\n    this.validatedData = data;\n  }\n\n  /**\n   * Top-level entry into the request lifecycle — opens the context store,\n   * runs middleware, drives the handler, handles errors.\n   *\n   * @internal Framework orchestration — do not call from app code. Wired\n   * from the Fastify route handler in `router.scan()`.\n   */\n  public async execute() {\n    try {\n      // call executingAction event\n\n      this.log(\"Executing the request\");\n\n      return await createRequestStore(this, this.response);\n    } catch (error) {\n      this.log(error, \"error\");\n\n      throw error;\n    }\n  }\n\n  /**\n   * Iterate the collected middlewares in order; return the first short-circuit\n   * value or `undefined` when every middleware passes through.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected async executeMiddleware() {\n    // collect all middlewares for current route\n    const middlewares = this.collectMiddlewares();\n\n    // check if there are no middlewares, then return\n    if (middlewares.length === 0) return;\n\n    this.log(\"About to execute request middlewares\");\n\n    // trigger the executingMiddleware event\n    this.trigger(\"executingMiddleware\", middlewares, this.route);\n\n    const tracingEnabled = isTracingEnabled();\n\n    for (const [index, middleware] of middlewares.entries()) {\n      this.log(\"Executing middleware \" + colors.yellowBright(middleware.name));\n\n      const middlewareStartedAt = tracingEnabled ? performance.now() : 0;\n\n      const output = await middleware({\n        request: this,\n        response: this.response,\n      });\n\n      if (tracingEnabled) {\n        dispatchPhase(buildTracingContext(this), {\n          name: \"middleware\",\n          durationMs: performance.now() - middlewareStartedAt,\n          attrs: { name: middleware.name, index },\n        });\n      }\n\n      this.log(\"Executed middleware \" + colors.yellowBright(middleware.name), \"success\");\n\n      if (output !== undefined) {\n        this.log(\n          colors.yellow(\"request intercepted by middleware \") + colors.cyanBright(middleware.name),\n          \"warn\",\n        );\n\n        this.trigger(\"executedMiddleware\");\n\n        this.log(\"Request middlewares executed\", \"success\");\n\n        return output;\n      }\n    }\n\n    this.log(\"Request middlewares executed\", \"success\");\n\n    // trigger the executedMiddleware event\n    this.trigger(\"executedMiddleware\", middlewares, this.route);\n  }\n\n  /**\n   * Gather the middleware list for the current route — today just the\n   * route-level array; future extraction may merge group + app-wide layers.\n   *\n   * @internal Framework orchestration — do not call from app code.\n   */\n  protected collectMiddlewares(): Middleware[] {\n    const route = this.route;\n    const configured = config.key(\"http.middleware\") as HttpConfigurations[\"middleware\"];\n\n    const matchesRoute = (target?: PartialMiddleware) =>\n      Boolean(\n        target &&\n        ((route.path && target.routes?.includes(route.path)) ||\n          (route.name && target.namedRoutes?.includes(route.name))),\n      );\n\n    // app-wide middlewares first, then the `only` ones matching this route\n    const global: Middleware[] = [...(configured?.all || [])];\n\n    if (matchesRoute(configured?.only)) {\n      global.push(...(configured?.only?.middleware || []));\n    }\n\n    // `except` removes app-wide middlewares from the matching routes\n    const excluded = matchesRoute(configured?.except) ? configured?.except?.middleware || [] : [];\n\n    // global first, then route middlewares, deduplicated by reference\n    return [\n      ...new Set([\n        ...global.filter((middleware) => !excluded.includes(middleware)),\n        ...(route.middleware || []),\n      ]),\n    ];\n  }\n\n  /**\n   * Get request input value from query string, params or body\n   */\n  public input(key: string, defaultValue?: any) {\n    return get(this.payload.all, key, defaultValue);\n  }\n\n  /**\n   * Get email input value, this will lowercase the value\n   */\n  public email(key: string = \"email\", defaultValue: string = \"\"): string {\n    return this.input(key, defaultValue)?.toLowerCase() || defaultValue;\n  }\n\n  /**\n   * @alias input\n   */\n  public get(key: string, defaultValue?: any) {\n    return this.input(key, defaultValue);\n  }\n\n  /**\n   * Determine if request has input value\n   */\n  public has(key: string) {\n    return get(this.payload.all, key, undefined) !== undefined;\n  }\n\n  /**\n   * Set request input value\n   */\n  public set(key: string, value: any) {\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Set the given value if the request does not have the input\n   */\n  public setDefault(key: string, value: any) {\n    if (this.has(key)) return this;\n\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Unset request payload keys\n   */\n  public unset(...keys: string[]) {\n    this.payload.all = unset(this.payload.all, keys);\n\n    return this;\n  }\n\n  /**\n   * Get request body\n   */\n  public get body() {\n    return this.payload.body;\n  }\n\n  /**\n   * Set request body value\n   */\n  public setBody(key: string, value: any) {\n    set(this.payload.body, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get body inputs except files\n   */\n  public get bodyInputs() {\n    const inputs = this.payload.body;\n\n    const bodyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (value.file && value.fieldname) continue;\n\n      bodyInputs[key] = value;\n    }\n\n    return bodyInputs;\n  }\n\n  /**\n   * Get request file in UploadedFile instance\n   */\n  public file(key: string): UploadedFile | undefined {\n    const file = this.input(key);\n\n    return file;\n  }\n\n  /**\n   * Get uploaded files from the request for the given name\n   * If the given name is not present in the request, return an empty array\n   */\n  public files(name: string): UploadedFile[] {\n    return this.input(name) || [];\n  }\n\n  /**\n   * Get request params\n   */\n  public get params() {\n    return this.payload.params;\n  }\n\n  /**\n   * Set request params value\n   *\n   * Keeps `payload.all` in sync using the same precedence `parsePayload()`\n   * gives route params: `{ ...query, ...body, ...params }`, i.e. params\n   * always win. Without this, a param set after parsing (e.g. by a\n   * catch-all route dispatcher decoding dynamic segments itself) would be\n   * visible on `request.params` but not through `input()`/`get()`, since\n   * those read the once-computed `payload.all`.\n   */\n  public setParam(key: string, value: any) {\n    set(this.payload.params, key, value);\n    set(this.payload.all, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get request query\n   */\n  public get query() {\n    return this.payload.query;\n  }\n\n  /**\n   * Set request query value\n   */\n  public setQuery(key: string, value: any) {\n    set(this.payload.query, key, value);\n\n    return this;\n  }\n\n  /**\n   * Get all inputs\n   */\n  public all() {\n    return this.payload.all;\n  }\n\n  /**\n   * Get all inputs except params\n   */\n  public allExceptParams() {\n    return {\n      ...this.payload.query,\n      ...this.payload.body,\n    };\n  }\n\n  /**\n   * Get all heavy inputs except params\n   */\n  public heavyExceptParams() {\n    const inputs = this.allExceptParams();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only heavy inputs, the input with a value\n   */\n  public heavy() {\n    const inputs = this.all();\n\n    const heavyInputs: any = {};\n\n    for (const key in inputs) {\n      const value = inputs[key];\n\n      if (isEmpty(value) && value !== null) continue;\n\n      heavyInputs[key] = value;\n    }\n\n    return heavyInputs;\n  }\n\n  /**\n   * Get only the given keys from the request data\n   */\n  public only(keys: string[]) {\n    return only(this.all(), keys);\n  }\n\n  /**\n   * Pluck the given keys from the request data\n   */\n  public pluck(keys: string[]) {\n    const data = this.only(keys);\n\n    this.unset(...keys);\n\n    return data;\n  }\n\n  /**\n   * Get all request inputs except the given keys\n   */\n  public except(keys: string[]) {\n    return except(this.all(), keys);\n  }\n\n  /**\n   * Get boolean input value\n   */\n  public bool(key: string, defaultValue = false) {\n    const value = this.input(key, defaultValue);\n\n    if (value === \"true\") {\n      return true;\n    }\n\n    if (value === \"false\") {\n      return false;\n    }\n\n    if (value === 0) {\n      return false;\n    }\n\n    return Boolean(value);\n  }\n\n  /**\n   * Get integer input value\n   */\n  public int(key: string, defaultValue: number = 0): number | undefined {\n    const value = this.input(key, defaultValue);\n\n    if (!value && value !== 0) return undefined;\n\n    return parseInt(value);\n  }\n\n  /**\n   * Shorthand getter to get id param\n   */\n  public get idParam() {\n    return this.int(\"id\");\n  }\n\n  /**\n   * Get string input value\n   */\n  public string(key: string, defaultValue: string = \"\"): string {\n    const value = this.input(key, defaultValue);\n\n    return String(value);\n  }\n\n  /**\n   * Get float input value\n   */\n  public float(key: string, defaultValue: number = 0): number {\n    const value = this.input(key, defaultValue);\n\n    return parseFloat(value) || 0;\n  }\n\n  /**\n   * Get number input value\n   */\n  public number(key: string, defaultValue: number = 0): number {\n    const value = Number(this.input(key, defaultValue));\n\n    return isNaN(value) ? defaultValue : value;\n  }\n\n  /**\n   * Immediate-peer IP as Fastify reports it — the address that connected to\n   * the server socket, with `trustProxy` resolution applied. Use this when\n   * you specifically need the peer address (rate-limit-by-direct-connection,\n   * health-check origin verification).\n   *\n   * **For most use cases prefer `request.detectIp()`** — behind any proxy\n   * (load balancer, CDN, sidecar) `ip` reports the proxy, not the real client.\n   */\n  public get ip() {\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * Best-effort real client IP — the value everything IP-scoped keys on\n   * (ip-filter allowlists, rate-limit buckets, idempotency scoping).\n   *\n   * `X-Forwarded-For` resolution is **delegated to Fastify**: `baseRequest.ip`\n   * is already the client address Fastify's `trustProxy` machinery picked out\n   * of the chain, so every shape `http.trustProxy` accepts is honoured here\n   * with exactly the semantics Fastify documents:\n   *\n   * - `false` (default) — no header is trusted; the socket peer address wins.\n   *   Both forwarding headers are client-settable, so without a trusted edge\n   *   that rewrites them any client could otherwise forge its own IP.\n   * - `true` — the whole chain is trusted; the leftmost hop (original client)\n   *   wins.\n   * - `number` — that many rightmost hops are trusted, so an edge that\n   *   APPENDS to `X-Forwarded-For` yields the real client rather than whatever\n   *   the client prepended.\n   * - CIDR / IP list (string, comma-separated string, or array) or a custom\n   *   predicate — the chain is walked right-to-left and stops at the first hop\n   *   that isn't a trusted proxy.\n   *\n   * `X-Real-IP` is NOT part of that resolution — Fastify never looks at it,\n   * and unlike `X-Forwarded-For` it carries no chain, so there is nothing to\n   * validate a proxy allowlist against. It is therefore honoured\n   * only under `trustProxy: true` (\"everything upstream is mine\"), where it is\n   * no weaker than the trust already granted. Under a bounded `trustProxy`\n   * (CIDR / IP list) it is ignored: a trusted-but-passthrough edge that\n   * forwards the client's own `X-Real-IP` verbatim would otherwise hand any\n   * client a way around the bound.\n   *\n   * **Prefer this over `request.ip` for any caller behind a proxy** (load\n   * balancer, CDN, reverse proxy, k8s ingress).\n   */\n  public detectIp() {\n    // Trusting `X-Real-IP` is only sound when the config trusts the entire\n    // upstream chain; bounded shapes get chain-aware resolution instead.\n    // Typed as `unknown`: config.get(key, fallback) infers the FALLBACK's type, so\n    // the literal `false` narrowed this to `false` and TypeScript called the\n    // comparison unreachable. The stored value is genuinely unconstrained at compile\n    // time - trustProxy accepts a boolean, a CIDR list or a predicate - so `unknown`\n    // is what it actually is, and the === true check is the narrowing.\n    const trustProxy: unknown = config.get(\"http.trustProxy\", false);\n\n    if (trustProxy === true) {\n      const realIp = this.header(\"x-real-ip\");\n\n      if (realIp) {\n        // `split` always yields a first element, so `?? \"\"` changes nothing —\n        // and an empty address is already falsy, so it falls through to the\n        // next source exactly as a blank header does. This is the CLIENT IP\n        // used for rate limiting and logging; it must never become the string\n        // \"undefined\".\n        const address = (String(realIp).split(\",\")[0] ?? \"\").trim();\n\n        if (address) return address;\n      }\n    }\n\n    // Fastify resolved this against the configured `trustProxy` already:\n    // socket peer when trust is off, the correct hop of `X-Forwarded-For`\n    // when it is on. Re-parsing the header here would mean a second, weaker\n    // trust model that could disagree with `request.ip` and with the plugins\n    // (rate limit, proxy) that key on it.\n    return this.baseRequest.ip;\n  }\n\n  /**\n   * An alias to detectIp\n   */\n  public get realIp() {\n    return this.detectIp();\n  }\n\n  /**\n   * Get request ips\n   */\n  public get ips() {\n    return this.baseRequest.ips;\n  }\n\n  /**\n   * Get request referer\n   */\n  public get referer() {\n    return this.baseRequest.headers.referer;\n  }\n\n  /**\n   * Get user agent\n   */\n  public get userAgent() {\n    return this.baseRequest.headers[\"user-agent\"];\n  }\n\n  /**\n   * Get request headers\n   */\n  public get headers(): typeof this.baseRequest.headers {\n    return this.baseRequest.headers;\n  }\n\n  /**\n   * Set the given header\n   */\n  public setHeader(key: HeaderKeys, value: string) {\n    this.baseRequest.headers[key.toLowerCase()] = value;\n\n    return this;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA+CA,IAAa,UAAb,MAAa,QAAiC;;iBAyFnB,CAAC;gBAmDK,CAAC;eA+CE;WAKJ;iBAeV;YAUR,OAAO,OAAO,EAAE;iBAOX;mBAKE,KAAK,IAAI;;;;;;;;;;;;;;;;;;;;;CA/K5B,IAAW,SAAsB;EAC/B,IAAI,KAAK,sBAAsB,OAAO,KAAK,qBAAqB;EAEhE,MAAM,aAAa,IAAI,gBAAgB;EAEvC,KAAK,uBAAuB;EAE5B,MAAM,MAAM,KAAK,UAAU,cAAc;EAEzC,IAAI,CAAC,OAAO,OAAO,IAAI,SAAS,YAAY,OAAO,WAAW;EAE9D,MAAM,4BAA4B;GAChC,IAAI,IAAI,kBAAkB;GAE1B,WAAW,MACT,IAAI,aAAa,wDAAwD,YAAY,CACvF;EACF;EAEA,IAAI,IAAI,kBAAkB,OAAO,WAAW;EAE5C,IAAI,IAAI,WAAW;GACjB,oBAAoB;GAEpB,OAAO,WAAW;EACpB;EAEA,IAAI,KAAK,SAAS,mBAAmB;EAErC,OAAO,WAAW;CACpB;;;;;;;;CAmBA,IAAW,qBAAqD;EAC9D,OAAO,KAAK;CACd;CAEA,IAAW,mBAAmB,OAAuC;EACnE,KAAK,sBAAsB;EAC3B,KAAK,OAAO,cAAc;CAC5B;;;;;;;;;;;;;;;;;;;;;;;CA4DA,IAAW,QAAgB;EACzB,IAAI,CAAC,KAAK,QACR,KAAK,SAAS,YAAY,EAAE,CAAC,CAAC,SAAS,QAAQ;EAGjD,OAAO,KAAK;CACd;;;;CA+DA,AAAO,WAAW,SAAyB;EACzC,KAAK,cAAc;EAEnB,KAAK,iBAAiB;EAEtB,KAAK,eAAe;EAEpB,KAAK,aAAa;EAOlB,KAAK,QAAQ,KAAK,KAAK,SAAiB,iBACtC,UAAU,KAAK,cAAc,GAAG,SAAS,YAAY;EAEvD,OAAO;CACT;;;;;;;;;;CAWA,AAAU,mBAAmB;EAC3B,MAAM,kBAAkB,OAAO,IAAI,gBAAgB,KAAK,CAAC;EAEzD,IAAI,gBAAgB,YAAY,OAAO;EAEvC,MAAM,cAAc,gBAAgB,UAAU,eAAc,CAAE,YAAY;EAC1E,MAAM,WAAW,KAAK,YAAY,QAAQ;EAE1C,IAAI,QAAQ,iBAAiB,QAAQ,GAAG;GACtC,KAAK,KAAK;GAEV;EACF;EAEA,IAAI,OAAO,gBAAgB,cAAc,YACvC,KAAK,KAAK,gBAAgB,UAAU;CAExC;;;;;;;;CASA,AAAU,iBAAiB;EACzB,MAAM,SAAS,KAAK,YAAY,QAAQ;EACxC,MAAM,cAAc,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;EAExD,KAAK,UAAU,cAAc,aAAa,KAAK,EAAE;CACnD;;;;;;CAOA,OAAiB,iBAAiB,OAAiC;EACjE,OACE,OAAO,UAAU,YACjB,MAAM,SAAS,KACf,MAAM,UAAU,OAChB,iBAAiB,KAAK,KAAK;CAE/B;;;;CAKA,AAAO,UAAU,YAAoB,SAAiB,cAAoB;EACxE,OAAO,UAAU,YAAY,SAAS,YAAY;CACpD;;;;;;;;;CAUA,AAAU,YAAY,WAA4B;EAChD,MAAM,EAAE,mBAAmB,gBAAgB,2BACzC,OAAO,IAAI,gBAAgB,GAC3B,OAAO,IAAI,iBAAiB,CAC9B;EAEA,MAAM,YAAY,OAAO,cAAc,YAAY,UAAU,SAAS,IAAI,YAAY;EAEtF,KAAK,UACH,cAAc,WAAc,gBAAgB,UAAa,YAAY,SAAS,SAAS,KACnF,YACA;EAEN,OAAO,KAAK;CACd;;;;;CAMA,AAAU,gBAAwB;EAChC,MAAM,EAAE,gBAAgB,2BACtB,OAAO,IAAI,gBAAgB,GAC3B,OAAO,IAAI,iBAAiB,CAC9B;EACA,MAAM,aAAa,KAAK,QAAQ;EAGhC,MAAM,sBACJ,OAAO,eAAe,aACrB,gBAAgB,UAAa,YAAY,SAAS,UAAU,KACzD,aACA;EACN,MAAM,YAAY;GAChB,KAAK,MAAM;GACX;GACA,KAAK,QAAQ;GACb,KAAK,OAAO,QAAQ;EACtB,CAAC,CAAC,MAAM,UAAU,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;EAE/D,OAAO,KAAK,YAAY,SAAS;CACnC;;;;CAKA,IAAW,SAAiB;EAC1B,IAAI,KAAK,SAAS,OAAO,KAAK;EAE9B,OAAO,KAAK,cAAc;CAC5B;;;;CAKA,IAAW,OAAO,YAAoB;EACpC,KAAK,YAAY,UAAU;CAC7B;;;;CAKA,AAAO,cAAc,YAAoB;EACvC,KAAK,SAAS;EAEd,OAAO;CACT;;;;;;CAOA,AAAO,cAAc,0BAA2C;EAC9D,OAAO,KAAK;CACd;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,MAAa,SAAS,YAA2B,gBAA2B;EAC1E,OAAO,MAAM,EAAE,SAAS,YAAY,iBAAiB,KAAK,KAAK,cAAc,IAAI,KAAK,IAAI,CAAC;CAC7F;;;;CAKA,AAAO,OACL,MACA,eAAoB,MACpB;EACA,OAAO,KAAK,YAAY,QAAQ,KAAK,kBAAkB,MAAM;CAC/D;;;;CAKA,IAAW,UAA8C;EACvD,OAAO,KAAK,YAAY,WAAW,CAAC;CACtC;;;;;;;;CASA,AAAQ,yBAAyB,MAAoB;EACnD,IAAI,KAAK,YAAY,YAAY,QAC/B,MAAM,IAAI,0BAA0B,IAAI;CAE5C;;;;CAKA,AAAO,OAAO,MAAc,cAAkC;EAC5D,KAAK,yBAAyB,IAAI;EAElC,MAAM,QAAQ,KAAK,QAAQ,SAAS;EAEpC,IAAI;GACF,OAAO,KAAK,MAAM,KAAK;EACzB,SAAS,OAAO;GACd,OAAO;EACT;CACF;;;;CAKA,AAAO,UAAU,MAAuB;EACtC,KAAK,yBAAyB,IAAI;EAElC,OAAO,KAAK,QAAQ,UAAU;CAChC;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,SAAS,QAAQ,UAAU,EAAE;CACvD;;;;CAKA,IAAW,WAAW;EACpB,OAAO,KAAK;CACd;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,eAAe;EACxB,IAAI,SAAwB;EAE5B,IAAI;GACF,SAAS,KAAK,SAAS,IAAI,IAAI,KAAK,MAAM,CAAC,CAAC,WAAW;EACzD,QAAQ;GAEN,SAAS;EACX;EAEA,IAAI,QAAQ,WAAW,MAAM,GAC3B,OAAO,OAAO,QAAQ,UAAU,EAAE;EAGpC,OAAO;CACT;;;;CAKA,IAAW,qBAA6B;EACtC,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe,OAAO;EAE3B,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,GAAG,OAAO;EAE5D,OAAO,SAAS;CAClB;;;;;;CAOA,IAAW,cAAkC;EAC3C,MAAM,gBAAgB,KAAK,OAAO,eAAe;EAEjD,IAAI,CAAC,eAAe;EAEpB,MAAM,CAAC,MAAM,SAAS,cAAc,MAAM,GAAG;EAE7C,IAAI,KAAK,YAAY,MAAM,UAAU;EAErC,OAAO;CACT;;;;CAKA,IAAW,gBAAgB;EACzB,OAAO,KAAK,OAAO,eAAe;CACpC;;;;CAKA,IAAW,SAAiB;EAC1B,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;CAYA,AAAU,iBAAiB,KAAqB;EAC9C,OAAO,IAAI,QAAQ,SAAS,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;CACxE;;;;;;CAOA,AAAU,iBAAiB,KAAsB;EAC/C,OAAO,IACJ,MAAM,SAAS,CAAC,CAChB,MACE,YACC,YAAY,eAAe,YAAY,iBAAiB,YAAY,WACxE;CACJ;;;;;;;;;;CAWA,AAAU,cAAc,OAAY,YAAqB,OAA4B;EACnF,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,KAAK;EAEhD,OAAO,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK;CAClD;CAEA,AAAU,eAAe;EACvB,KAAK,QAAQ,OAAO,KAAK,WAAW,IAC/B,KAAK,YAAY,QAAQ,CAAC,IAC3B,KAAK,UAAU,KAAK,YAAY,IAAI;EAExC,KAAK,QAAQ,QAAQ,KAAK,UAAU,KAAK,YAAY,KAAK;EAC1D,KAAK,QAAQ,SAAS,EAAE,GAAI,KAAK,YAAY,UAAU,CAAC,EAAG;EAE3D,KAAK,QAAQ,MAAM;GACjB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;;CAMA,AAAU,aAAa;EACrB,MAAM,cAAc,KAAK,YAAY,UAAU;EAE/C,OAAO,OAAO,gBAAgB,YAAY,QAAQ,KAAK,WAAW;CACpE;;;;CAKA,AAAU,UAAU,MAAW;EAC7B,IAAI;GACF,IAAI,CAAC,MAAM,OAAO,CAAC;GAEnB,MAAM,OAAY,CAAC;GAEnB,MAAM,sBAA2B,CAAC;GAElC,KAAK,IAAI,OAAO,MAAM;IACpB,MAAM,QAAQ,KAAK;IAEnB,IAAI,aAAa;IAEjB,IAAI,IAAI,SAAS,IAAI,GACnB,aAAa;IAGf,MAAM,MAAM,KAAK,IAAI;IAIrB,IAAI,KAAK,iBAAiB,GAAG,GAAG;IAMhC,IAAI,IAAI,SAAS,GAAG,GAAG;KAErB,IAAI,IAAI,SAAS,IAAI,GAAG;MACtB,MAAM,WAAW,IAAI,MAAM,GAAG;MAE9B,MAAM,UAAU,SAAS;MACzB,MAAM,eAAe,SAAS;MAC9B,MAAM,gBAAgB,SAAS;MAc/B,IACE,YAAY,UACZ,iBAAiB,UACjB,kBAAkB,QAClB;OACA,IACE,MACA,KAAK,iBAAiB,GAAG,GACzB,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;OAEA;MACF;MAEA,MAAM,eAAe,aAAa,MAAM,GAAG;MAE3C,MAAM,QAAQ,OAAO,aAAa,EAAE;MAGpC,IAAI,OAAO,UAAU,KAAK,KAAK,QAAQ,KAAM;MAoB7C,IAAI,OAAO,MAAM,KAAK,GAAG;OACvB,IACE,MACA,KAAK,iBAAiB,GAAG,GACzB,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;OAEA;MACF;MAEA,MAAM,SAAU,oBAAoB,aAAa,CAAC;MAElD,MAAM,QAAS,OAAO,WAAW,CAAC;MAIlC,MAAM,WADgB,cAAc,MAAM,GACb,CAAC,CAAC;MAM/B,IAAI,aAAa,QAAW;MAE5B,MAAM,YAAY,KAAK,WAAW,KAAK;MAEvC;KACF;KAEA,MAAM,WAAW,IAAI,MAAM,GAAG;KAC9B,MAAM,UAAU,SAAS;KAKzB,MAAM,gBAAgB,SAAS,MAAM,IAAG,CAAE,MAAM,GAAG;KAenD,IACE,MACA,UAAU,MAAM,aAAa,IAC7B,KAAK,cAAc,OAAO,YAAY,KAAK,WAAW,KAAK,IAAI,CAAC,CAClE;KAEA;IACF;IAEA,IAAI,MAAM,QAAQ,KAAK,GACrB,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,WAAW,KAAK,IAAI,CAAC,CAAC;SAC/C,IAAI,YACT,IAAI,KAAK,MACP,KAAK,IAAI,CAAC,KAAK,KAAK,WAAW,KAAK,CAAC;SAChC;KACL,KAAK,OAAO,CAAC,KAAK,WAAW,KAAK,CAAC;KAEnC;IACF;SAEA,IAAI,MAAM,KAAK,KAAK,WAAW,KAAK,CAAC;GAEzC;GAGA,KAAK,MAAM,OAAO,qBAChB,KAAK,OAAO,oBAAoB;GAGlC,OAAO;EACT,SAAS,OAAO;GACd,QAAQ,IAAI,KAAK;GACjB,KAAK,IAAI,OAAO,OAAO;GAEvB,OAAO,CAAC;EACV;CACF;;;;CAKA,AAAU,WAAW,MAAW;EAG9B,IAAI,MAAM,MAAM,OAAO,IAAI,aAAa,IAAI;EAC5C,IAAI,MAAM,UAAU,UAAa,MAAM,UAAU,MAAM,MACrD,OAAO,KAAK;EAGd,IAAI,SAAS,SAAS,OAAO;EAE7B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,SAAS,QAAQ,OAAO;EAE5B,IAAI,OAAO,SAAS,UAAU,OAAO,KAAK,KAAK;EAE/C,OAAO;CACT;;;;CAKA,AAAO,SAAS,OAAc;EAC5B,KAAK,QAAQ;EAGb,KAAK,SAAS,SAAS,KAAK;EAE5B,OAAO;CACT;;;;CAKA,AAAO,QAAQ,WAAyB,GAAG,MAAa;EACtD,OAAO,OAAO,QAAQ,WAAW,aAAa,GAAG,MAAM,IAAI;CAC7D;;;;CAKA,AAAO,GAAG,WAAyB,UAAe;EAChD,OAAO,OAAO,UAAU,WAAW,aAAa,QAAQ;CAC1D;;;;CAKA,AAAO,IAAI,SAAc,QAAkB,QAAQ;EACjD,IAAI,CAAC,OAAO,IAAI,UAAU,GAAG;EAE7B,IAAI,IAAI;GACN,QAAQ;GACR,QAAQ,KAAK,MAAM,SAAS,MAAM,KAAK,MAAM,KAAK,QAAQ,MAAM,EAAE,IAAI,IAAI,KAAK;GAC/E;GACA,MAAM;GACN,SAAS,EACP,SAAS,KAAK,cAAc,EAC9B;EACF,CAAC;CACH;;;;;;;;;;;;;CAcA,AAAO,gBAAoC;EACzC,MAAM,cAAc,KAAK;EAEzB,OAAO,wBAAwB;GAC7B,IAAI,KAAK;GACT,QAAQ,aAAa,UAAU,KAAK,OAAO,UAAU;GACrD,KAAK,aAAa,OAAO;GACzB,IAAI,cAAc,KAAK,SAAS,IAAI;GACpC,WAAW,aAAa,UAAU;GAClC,OAAO,KAAK,SAAS;GACrB,MAAM,KAAK,SAAS;GACpB,OAAO,KAAK;EACd,CAAC;CACH;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,WAAW,QAAQ,KAAK,WAAW,KAAK;CACtD;;;;;;;;;CAUA,MAAa,gBAAgB;EAG3B,MAAM,mBAAmB,MAAM,KAAK,kBAAkB;EAEtD,IAAI,qBAAqB,QAAW;GAElC,IAAI,4BAA4B,UAAU,OAAO;GAEjD,OAAO,KAAK,SAAS,KAAK,gBAAgB;EAC5C;EAEA,MAAM,UAAU,KAAK,MAAM;EAE3B,IAAI,CAAC,QAAQ,YAAY;EAKzB,MAAM,iBAAiB,iBAAiB;EACxC,MAAM,sBAAsB,iBAAiB,YAAY,IAAI,IAAI;EAEjE,MAAM,mBAAmB,MAAM,YAAY,QAAQ,YAAY,MAAM,KAAK,QAAQ;EAElF,IAAI,gBACF,cAAc,oBAAoB,IAAI,GAAG;GACvC,MAAM;GACN,YAAY,YAAY,IAAI,IAAI;EAClC,CAAC;EAGH,OAAO;CACT;;;;;;CAOA,AAAO,aAAa;EAClB,OAAO,KAAK,MAAM;CACpB;;;;;CAMA,AAAO,UAAsC,QAAmD;EAC9F,IAAI,KAAK,eACP,OAAO,SACH,KAAK,KAAK,eAAyB,MAAkB,IACpD,KAAK;EAGZ,OAAO,CAAC;CACV;;;;CAKA,AAAO,gBAAgB,GAAG,QAAqC;EAC7D,OAAO,OAAO,KAAK,UAAU,GAAG,MAAM;CACxC;;;;CAKA,AAAO,iBAAiB,MAAyB;EAC/C,KAAK,gBAAgB;CACvB;;;;;;;;CASA,MAAa,UAAU;EACrB,IAAI;GAGF,KAAK,IAAI,uBAAuB;GAEhC,OAAO,MAAM,mBAAmB,MAAM,KAAK,QAAQ;EACrD,SAAS,OAAO;GACd,KAAK,IAAI,OAAO,OAAO;GAEvB,MAAM;EACR;CACF;;;;;;;CAQA,MAAgB,oBAAoB;EAElC,MAAM,cAAc,KAAK,mBAAmB;EAG5C,IAAI,YAAY,WAAW,GAAG;EAE9B,KAAK,IAAI,sCAAsC;EAG/C,KAAK,QAAQ,uBAAuB,aAAa,KAAK,KAAK;EAE3D,MAAM,iBAAiB,iBAAiB;EAExC,KAAK,MAAM,CAAC,OAAO,eAAe,YAAY,QAAQ,GAAG;GACvD,KAAK,IAAI,0BAA0B,OAAO,aAAa,WAAW,IAAI,CAAC;GAEvE,MAAM,sBAAsB,iBAAiB,YAAY,IAAI,IAAI;GAEjE,MAAM,SAAS,MAAM,WAAW;IAC9B,SAAS;IACT,UAAU,KAAK;GACjB,CAAC;GAED,IAAI,gBACF,cAAc,oBAAoB,IAAI,GAAG;IACvC,MAAM;IACN,YAAY,YAAY,IAAI,IAAI;IAChC,OAAO;KAAE,MAAM,WAAW;KAAM;IAAM;GACxC,CAAC;GAGH,KAAK,IAAI,yBAAyB,OAAO,aAAa,WAAW,IAAI,GAAG,SAAS;GAEjF,IAAI,WAAW,QAAW;IACxB,KAAK,IACH,OAAO,OAAO,oCAAoC,IAAI,OAAO,WAAW,WAAW,IAAI,GACvF,MACF;IAEA,KAAK,QAAQ,oBAAoB;IAEjC,KAAK,IAAI,gCAAgC,SAAS;IAElD,OAAO;GACT;EACF;EAEA,KAAK,IAAI,gCAAgC,SAAS;EAGlD,KAAK,QAAQ,sBAAsB,aAAa,KAAK,KAAK;CAC5D;;;;;;;CAQA,AAAU,qBAAmC;EAC3C,MAAM,QAAQ,KAAK;EACnB,MAAM,aAAa,OAAO,IAAI,iBAAiB;EAE/C,MAAM,gBAAgB,WACpB,QACE,WACE,MAAM,QAAQ,OAAO,QAAQ,SAAS,MAAM,IAAI,KAC/C,MAAM,QAAQ,OAAO,aAAa,SAAS,MAAM,IAAI,EAC1D;EAGF,MAAM,SAAuB,CAAC,GAAI,YAAY,OAAO,CAAC,CAAE;EAExD,IAAI,aAAa,YAAY,IAAI,GAC/B,OAAO,KAAK,GAAI,YAAY,MAAM,cAAc,CAAC,CAAE;EAIrD,MAAM,WAAW,aAAa,YAAY,MAAM,IAAI,YAAY,QAAQ,cAAc,CAAC,IAAI,CAAC;EAG5F,OAAO,CACL,GAAG,IAAI,IAAI,CACT,GAAG,OAAO,QAAQ,eAAe,CAAC,SAAS,SAAS,UAAU,CAAC,GAC/D,GAAI,MAAM,cAAc,CAAC,CAC3B,CAAC,CACH;CACF;;;;CAKA,AAAO,MAAM,KAAa,cAAoB;EAC5C,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,YAAY;CAChD;;;;CAKA,AAAO,MAAM,MAAc,SAAS,eAAuB,IAAY;EACrE,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC,EAAE,YAAY,KAAK;CACzD;;;;CAKA,AAAO,IAAI,KAAa,cAAoB;EAC1C,OAAO,KAAK,MAAM,KAAK,YAAY;CACrC;;;;CAKA,AAAO,IAAI,KAAa;EACtB,OAAO,IAAI,KAAK,QAAQ,KAAK,KAAK,MAAS,MAAM;CACnD;;;;CAKA,AAAO,IAAI,KAAa,OAAY;EAClC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,WAAW,KAAa,OAAY;EACzC,IAAI,KAAK,IAAI,GAAG,GAAG,OAAO;EAE1B,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,AAAO,MAAM,GAAG,MAAgB;EAC9B,KAAK,QAAQ,MAAM,MAAM,KAAK,QAAQ,KAAK,IAAI;EAE/C,OAAO;CACT;;;;CAKA,IAAW,OAAO;EAChB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,QAAQ,KAAa,OAAY;EACtC,IAAI,KAAK,QAAQ,MAAM,KAAK,KAAK;EAEjC,OAAO;CACT;;;;CAKA,IAAW,aAAa;EACtB,MAAM,SAAS,KAAK,QAAQ;EAE5B,MAAM,aAAkB,CAAC;EAEzB,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,MAAM,QAAQ,MAAM,WAAW;GAEnC,WAAW,OAAO;EACpB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,KAAuC;EAGjD,OAFa,KAAK,MAAM,GAEd;CACZ;;;;;CAMA,AAAO,MAAM,MAA8B;EACzC,OAAO,KAAK,MAAM,IAAI,KAAK,CAAC;CAC9B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,QAAQ;CACtB;;;;;;;;;;;CAYA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,QAAQ,KAAK,KAAK;EACnC,IAAI,KAAK,QAAQ,KAAK,KAAK,KAAK;EAEhC,OAAO;CACT;;;;CAKA,IAAW,QAAQ;EACjB,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,SAAS,KAAa,OAAY;EACvC,IAAI,KAAK,QAAQ,OAAO,KAAK,KAAK;EAElC,OAAO;CACT;;;;CAKA,AAAO,MAAM;EACX,OAAO,KAAK,QAAQ;CACtB;;;;CAKA,AAAO,kBAAkB;EACvB,OAAO;GACL,GAAG,KAAK,QAAQ;GAChB,GAAG,KAAK,QAAQ;EAClB;CACF;;;;CAKA,AAAO,oBAAoB;EACzB,MAAM,SAAS,KAAK,gBAAgB;EAEpC,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,QAAQ;EACb,MAAM,SAAS,KAAK,IAAI;EAExB,MAAM,cAAmB,CAAC;EAE1B,KAAK,MAAM,OAAO,QAAQ;GACxB,MAAM,QAAQ,OAAO;GAErB,IAAI,QAAQ,KAAK,KAAK,UAAU,MAAM;GAEtC,YAAY,OAAO;EACrB;EAEA,OAAO;CACT;;;;CAKA,AAAO,KAAK,MAAgB;EAC1B,OAAO,KAAK,KAAK,IAAI,GAAG,IAAI;CAC9B;;;;CAKA,AAAO,MAAM,MAAgB;EAC3B,MAAM,OAAO,KAAK,KAAK,IAAI;EAE3B,KAAK,MAAM,GAAG,IAAI;EAElB,OAAO;CACT;;;;CAKA,AAAO,OAAO,MAAgB;EAC5B,OAAO,OAAO,KAAK,IAAI,GAAG,IAAI;CAChC;;;;CAKA,AAAO,KAAK,KAAa,eAAe,OAAO;EAC7C,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,UAAU,QACZ,OAAO;EAGT,IAAI,UAAU,SACZ,OAAO;EAGT,IAAI,UAAU,GACZ,OAAO;EAGT,OAAO,QAAQ,KAAK;CACtB;;;;CAKA,AAAO,IAAI,KAAa,eAAuB,GAAuB;EACpE,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,IAAI,CAAC,SAAS,UAAU,GAAG,OAAO;EAElC,OAAO,SAAS,KAAK;CACvB;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,IAAI,IAAI;CACtB;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,IAAY;EAC5D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,OAAO,KAAK;CACrB;;;;CAKA,AAAO,MAAM,KAAa,eAAuB,GAAW;EAC1D,MAAM,QAAQ,KAAK,MAAM,KAAK,YAAY;EAE1C,OAAO,WAAW,KAAK,KAAK;CAC9B;;;;CAKA,AAAO,OAAO,KAAa,eAAuB,GAAW;EAC3D,MAAM,QAAQ,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;EAElD,OAAO,MAAM,KAAK,IAAI,eAAe;CACvC;;;;;;;;;;CAWA,IAAW,KAAK;EACd,OAAO,KAAK,YAAY;CAC1B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmCA,AAAO,WAAW;EAUhB,IAF4B,OAAO,IAAI,mBAAmB,KAE7C,MAAM,MAAM;GACvB,MAAM,SAAS,KAAK,OAAO,WAAW;GAEtC,IAAI,QAAQ;IAMV,MAAM,WAAW,OAAO,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAE,CAAE,KAAK;IAE1D,IAAI,SAAS,OAAO;GACtB;EACF;EAOA,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,SAAS;EAClB,OAAO,KAAK,SAAS;CACvB;;;;CAKA,IAAW,MAAM;EACf,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,IAAW,UAAU;EACnB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,YAAY;EACrB,OAAO,KAAK,YAAY,QAAQ;CAClC;;;;CAKA,IAAW,UAA2C;EACpD,OAAO,KAAK,YAAY;CAC1B;;;;CAKA,AAAO,UAAU,KAAiB,OAAe;EAC/C,KAAK,YAAY,QAAQ,IAAI,YAAY,KAAK;EAE9C,OAAO;CACT;AACF"}

package/esm/http/resolve-bind-port.mjs

@@ -1,6 +1,6 @@
 import { defaultHttpConfigurations } from "./config.mjs";
 
-//#region ../core/src/http/resolve-bind-port.ts
+//#region ../../packages/core/src/http/resolve-bind-port.ts
 /**
 * Fallback used only if `defaultHttpConfigurations.port` is ever unset —
 * `HttpConfigurations.port` is typed optional for consumers, but the

package/esm/http/resolve-bind-port.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-bind-port.mjs","names":[],"sources":["../../../../../../../core/src/http/resolve-bind-port.ts"],"sourcesContent":["import { defaultHttpConfigurations } from \"./config\";\n\n/**\n * Fallback used only if `defaultHttpConfigurations.port` is ever unset —\n * `HttpConfigurations.port` is typed optional for consumers, but the\n * framework's own default configuration always declares one. Keeps\n * `resolveBindPort`'s return type a plain `number` without an `as`.\n */\nconst FALLBACK_PORT = 3000;\n\n/**\n * Resolve a raw, possibly-stringy `http.port` value into the number the\n * socket layer will actually bind.\n *\n * `env()` only coerces a `.env` value to a number when it round-trips\n * exactly (`String(Number(v)) === v`), so values like `\"03999\"`, `\" 3999\"`,\n * `\"+3999\"` or `\"1e3\"` arrive here as strings. `net.Server.listen({ port })`\n * happily accepts every one of those and binds SOMETHING — `\"1e3\"` binds\n * port 1000 with no diagnostic anywhere — so this is the one place the\n * configured port is turned into a canonical integer before anything binds,\n * logs, or reports it.\n *\n * `undefined`/`null` (no `http.port` configured at all) resolves to the\n * framework default rather than throwing — that case is not misconfiguration.\n *\n * @throws {Error} when the raw value cannot be resolved to a usable TCP port\n * (0-65535, finite integer) — naming the raw value and where to fix it.\n */\nexport function resolveBindPort(rawPort: unknown): number {\n  if (rawPort === undefined || rawPort === null) {\n    return defaultHttpConfigurations.port ?? FALLBACK_PORT;\n  }\n\n  const resolved = Number(String(rawPort).trim());\n\n  if (!Number.isInteger(resolved) || resolved < 0 || resolved > 65_535) {\n    throw new Error(\n      `Invalid http port ${JSON.stringify(rawPort)}: it does not resolve to a usable TCP port ` +\n        `(0-65535, whole number). Fix HTTP_PORT in .env, or http.port in src/config/http.ts.`,\n    );\n  }\n\n  return resolved;\n}\n\n/**\n * Whether `rawPort` was already the canonical value `resolveBindPort`\n * returned for it — i.e. nothing needed normalising.\n *\n * Lets a caller print exactly one notice when the configured port and the\n * bound port differ in representation (`\"03999\"` -> `3999`), and stay silent\n * for the ordinary case (a plain number, or a string that was already\n * canonical).\n */\nexport function isCanonicalPortValue(rawPort: unknown, resolved: number): boolean {\n  if (typeof rawPort === \"number\" || rawPort === undefined || rawPort === null) {\n    return true;\n  }\n\n  return String(rawPort) === String(resolved);\n}\n"],"mappings":";;;;;;;;;AAQA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;AAoBtB,SAAgB,gBAAgB,SAA0B;CACxD,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO,0BAA0B,QAAQ;CAG3C,MAAM,WAAW,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC;CAE9C,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,OAC5D,MAAM,IAAI,MACR,qBAAqB,KAAK,UAAU,OAAO,EAAE,+HAE/C;CAGF,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,qBAAqB,SAAkB,UAA2B;CAChF,IAAI,OAAO,YAAY,YAAY,YAAY,UAAa,YAAY,MACtE,OAAO;CAGT,OAAO,OAAO,OAAO,MAAM,OAAO,QAAQ;AAC5C"}
+{"version":3,"file":"resolve-bind-port.mjs","names":[],"sources":["../../../../../../../../packages/core/src/http/resolve-bind-port.ts"],"sourcesContent":["import { defaultHttpConfigurations } from \"./config\";\n\n/**\n * Fallback used only if `defaultHttpConfigurations.port` is ever unset —\n * `HttpConfigurations.port` is typed optional for consumers, but the\n * framework's own default configuration always declares one. Keeps\n * `resolveBindPort`'s return type a plain `number` without an `as`.\n */\nconst FALLBACK_PORT = 3000;\n\n/**\n * Resolve a raw, possibly-stringy `http.port` value into the number the\n * socket layer will actually bind.\n *\n * `env()` only coerces a `.env` value to a number when it round-trips\n * exactly (`String(Number(v)) === v`), so values like `\"03999\"`, `\" 3999\"`,\n * `\"+3999\"` or `\"1e3\"` arrive here as strings. `net.Server.listen({ port })`\n * happily accepts every one of those and binds SOMETHING — `\"1e3\"` binds\n * port 1000 with no diagnostic anywhere — so this is the one place the\n * configured port is turned into a canonical integer before anything binds,\n * logs, or reports it.\n *\n * `undefined`/`null` (no `http.port` configured at all) resolves to the\n * framework default rather than throwing — that case is not misconfiguration.\n *\n * @throws {Error} when the raw value cannot be resolved to a usable TCP port\n * (0-65535, finite integer) — naming the raw value and where to fix it.\n */\nexport function resolveBindPort(rawPort: unknown): number {\n  if (rawPort === undefined || rawPort === null) {\n    return defaultHttpConfigurations.port ?? FALLBACK_PORT;\n  }\n\n  const resolved = Number(String(rawPort).trim());\n\n  if (!Number.isInteger(resolved) || resolved < 0 || resolved > 65_535) {\n    throw new Error(\n      `Invalid http port ${JSON.stringify(rawPort)}: it does not resolve to a usable TCP port ` +\n        `(0-65535, whole number). Fix HTTP_PORT in .env, or http.port in src/config/http.ts.`,\n    );\n  }\n\n  return resolved;\n}\n\n/**\n * Whether `rawPort` was already the canonical value `resolveBindPort`\n * returned for it — i.e. nothing needed normalising.\n *\n * Lets a caller print exactly one notice when the configured port and the\n * bound port differ in representation (`\"03999\"` -> `3999`), and stay silent\n * for the ordinary case (a plain number, or a string that was already\n * canonical).\n */\nexport function isCanonicalPortValue(rawPort: unknown, resolved: number): boolean {\n  if (typeof rawPort === \"number\" || rawPort === undefined || rawPort === null) {\n    return true;\n  }\n\n  return String(rawPort) === String(resolved);\n}\n"],"mappings":";;;;;;;;;AAQA,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;AAoBtB,SAAgB,gBAAgB,SAA0B;CACxD,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO,0BAA0B,QAAQ;CAG3C,MAAM,WAAW,OAAO,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC;CAE9C,IAAI,CAAC,OAAO,UAAU,QAAQ,KAAK,WAAW,KAAK,WAAW,OAC5D,MAAM,IAAI,MACR,qBAAqB,KAAK,UAAU,OAAO,EAAE,+HAE/C;CAGF,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,qBAAqB,SAAkB,UAA2B;CAChF,IAAI,OAAO,YAAY,YAAY,YAAY,UAAa,YAAY,MACtE,OAAO;CAGT,OAAO,OAAO,OAAO,MAAM,OAAO,QAAQ;AAC5C"}

package/esm/http/response.d.mts

@@ -2,7 +2,7 @@ import { StorageFile } from "../storage/storage-file.mjs";
 import { PipeableReactStream } from "./stream-react-response.mjs";
 import { XMLable } from "./xmlable.mjs";
 import { Request } from "./request.mjs";
-import { ResponseEvent, ResponseSSEController, ResponseStreamController } from "./types.mjs";
+import { ResponseEvent, ResponseSSEController, ResponseSSEOptions, ResponseStreamController, ResponseStreamOptions } from "./types.mjs";
 import { Route } from "../router/types.mjs";
 import { ValidationResult } from "@warlock.js/seal";
 import { LogLevel } from "@warlock.js/logger";
@@ -11,7 +11,7 @@ import { FastifyReply } from "fastify";
 import { CookieSerializeOptions } from "@fastify/cookie";
 import React from "react";
 
-//#region ../core/src/http/response.d.ts
+//#region ../../packages/core/src/http/response.d.ts
 type CookieValue = string | number | boolean | Record<string, any> | Array<any>;
 /**
  * Cookie options accepted by `response.cookie()`.
@@ -70,6 +70,12 @@ type SendBufferOptions = SendFileOptions & {
   contentType?: string;
   etag?: string;
 };
+/**
+ * Make a value safe for a single-line SSE field (`event:`, `id:`): line breaks
+ * would end the field and inject the rest as new fields or events, and the
+ * spec makes a client ignore an `id` containing NUL. All three are removed.
+ */
+declare function toSingleLineSseField(value: unknown): string;
 declare class Response {
   /**
    * Current route
@@ -258,7 +264,7 @@ declare class Response {
    * Create a streaming response for progressive/chunked data sending
    *
    * This method allows you to send data in chunks and control when the response ends.
-   * Perfect for Server-Sent Events (SSE), progressive rendering, or streaming large responses.
+   * Perfect for progressive rendering or streaming large responses.
    *
    * @example
    * ```ts
@@ -268,12 +274,21 @@ declare class Response {
    * stream.render(<MyComponent />);
    * stream.send("</body></html>");
    * stream.end();
+   *
+   * // Long-lived or high-volume streams: wait for the client to catch up
+   * for await (const line of output) {
+   *   if (!(await stream.write(line))) break; // client is gone
+   * }
    * ```
    *
+   * Written chunks are not kept: after `end()`, `response.body` holds only the
+   * last `retainChunks` chunks (none by default), so a stream that runs for
+   * hours costs the same memory as one that runs for seconds.
+   *
    * @param contentType - The content type for the stream (default: "text/plain")
-   * @returns Stream controller with send(), render(), and end() methods
+   * @returns Stream controller with send(), write(), render(), drain() and end() methods
    */
-  stream(contentType?: string): ResponseStreamController;
+  stream(contentType?: string, options?: ResponseStreamOptions): ResponseStreamController;
   /**
    * Pipe a React server stream (`renderToPipeableStream`) onto this
    * response — the Stage 1 streaming SSR seam. Writes the already-committed
@@ -305,6 +320,11 @@ declare class Response {
    * sse.send("message", { text: "Hello!" });
    * sse.send("notification", { type: "info", message: "Update available" }, "msg-123");
    *
+   * // Long-lived or high-volume streams: wait for the client to catch up
+   * for await (const line of terminalOutput) {
+   *   if (!(await sse.write("output", { line }))) break; // client is gone
+   * }
+   *
    * // Keep connection alive
    * const keepAlive = setInterval(() => sse.comment("ping"), 30000);
    *
@@ -313,9 +333,13 @@ declare class Response {
    * sse.end();
    * ```
    *
-   * @returns SSE controller with send(), comment(), and end() methods
+   * Sent events are not kept: after `end()`, `response.body` holds only the
+   * last `retainEvents` events (none by default), so a stream that runs for
+   * hours costs the same memory as one that runs for seconds.
+   *
+   * @returns SSE controller with send(), write(), drain(), comment(), and end() methods
    */
-  sse(): ResponseSSEController;
+  sse(options?: ResponseSSEOptions): ResponseSSEController;
   /**
    * Set the status code
    */
@@ -332,6 +356,14 @@ declare class Response {
    * Get the response time
    */
   getResponseTime(): number;
+  /**
+   * Ask a long-lived response (`sse()`, `stream()`) to keep its connection
+   * open, unless a graceful shutdown already marked it `Connection: close`
+   * (see `beginHttpDrain`). The reply's own headers win over the raw ones at
+   * `writeHead`, so setting keep-alive unconditionally would undo the drain
+   * and hold the server's `close()` until the shutdown budget runs out.
+   */
+  protected keepLongLivedConnectionAlive(): void;
   /**
    * Remove a specific header
    */
@@ -554,5 +586,5 @@ declare class Response {
   failedSchema(result: ValidationResult): Promise<Response>;
 }
 //#endregion
-export { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions };
+export { CookieOptions, Response, ResponseStatus, SendBufferOptions, SendFileOptions, toSingleLineSseField };
 //# sourceMappingURL=response.d.mts.map

package/esm/http/response.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"response.d.mts","names":[],"sources":["../../../../../../../core/src/http/response.ts"],"mappings":";;;;;;;;;;;;;;KAiCK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFjC;;;;AAEiC;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AAAA,cAqBW,QAAA;EAAQ;;;EAAA,UAIT,KAAA,EAAQ,KAAA;EAiCD;;;;;;;;;;;;;;;;EAfV,YAAA,EAAe,YAAA;EAybV;;;EAAA,UApbF,iBAAA;EA8ca;;;EAAA,UAzcb,WAAA;EAsdgB;;;EAjdnB,OAAA,EAAU,OAAA;EAke4B;;;EAAA,UA7dnC,MAAA,EAAM,GAAA;EA6pBF;;;;;EAtpBP,UAAA;EA8+BuB;;;EAAA,IAz+BnB,GAAA,mBAAG,cAAA,gBAAA,eAAA;EAqgCX;;;EAAA,IA9/BQ,IAAA;EAghCR;;;EAAA,IAzgCQ,IAAA,CAAK,IAAA;EA4hCW;;;EArhCpB,SAAA,CAAU,QAAA;EAmiCa;;;EA1hCvB,MAAA,CAAO,QAAA;EAojC4D;;;EA3iCnE,WAAA,CAAY,QAAA,EAAU,YAAA;EAyjCG;;;EA1iCzB,KAAA;EAyoCkC;;;EAhoClC,QAAA,CAAS,KAAA,EAAO,KAAA;EA2tCG;;;EAAA,IAltCf,WAAA;EAsuCW;;;EA/tCf,cAAA,CAAe,WAAA;EAswCgD;;;EAAA,IA7vC3D,UAAA;EA2wCkD;;;EAAA,IApwClD,IAAA;EA4zCiC;;;EAAA,IArzCjC,IAAA;EAtIJ;;;EAAA,OA6IO,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAjII;;;EAAA,iBAwIgB,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EA5H5D;;;EAAA,UAyIS,SAAA,IAAS,OAAA;EA7Hd;;;EAoIE,KAAA,CAAM,KAAA,QAAa,OAAA;EAtHf;;;EAwKV,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EAtJN;;;EAAA,IAwKlB,MAAA;EAhJY;;;;;;EA0JV,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EAnHvE;;;;;EAAA,UA4MD,cAAA,CAAe,UAAA;EAnMvB;EAAA,UAiQQ,OAAA,IAAO,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EAzPM;EAAA,UAkQb,OAAA,CAAQ,IAAA,QAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EAlQI;;;;;;;;;;;;;;;;;;;EA6RxB,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAzCK;;;EA4DV,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EA5D5B;;;EAmEV,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EA1DlD;;;;;;;;;EAuEpB,GAAA,CAAI,IAAA,WAAe,OAAA,EAAS,UAAA,YAAmB,OAAA,CAAA,QAAA;EAzCpD;;;EA0DK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EAxDzC;;;;;;;;;;;;;;;;;;;EA+EG,MAAA,CAAO,WAAA,YAA6B,wBAAA;EAxCW;;;;;;;;;;;;;;;;EAgK/C,WAAA,CAAY,cAAA,EAAgB,mBAAA,GAAsB,OAAA;EAwLpC;;;;;;;;;;;;;;;;;;;;;;;;EAvId,GAAA,IAAO,qBAAA;EA0P2C;;;EAnHlD,aAAA,CAAc,UAAA;EA2Ld;;;EAlLA,QAAA,CAAS,GAAA,UAAa,UAAA;EAwMtB;;;EA9LA,iBAAA,CAAkB,GAAA;EAyMR;;;EA/LV,eAAA;EAsMqB;;;EA/LrB,YAAA,CAAa,GAAA;EAyMjB;;;EAhMI,SAAA,CAAU,GAAA;EAwMkB;;;EAQjC;;;;;EApMK,mBAAA;EAMA,UAAA,IAAU,MAAA,+BAAA,UAAA;EAmNV;;;EA5MA,OAAA,CAAQ,OAAA,EAAS,MAAA;EAmNjB;;;EA1MA,MAAA,CAAO,GAAA,UAAa,KAAA;EAiNpB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA7KA,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA6NrB;;;;;;;;;;;;;;;;;;;;;EAlL7B,SAAA,CAAU,MAAA;EAoWqD;;;;;;EAvU/D,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EA2VzC;;;;;;;;;;;;;;;EArUK,YAAA,CAAa,OAAA,GAAU,sBAAA;EA0X+B;;;EA/WtD,SAAA,CAAU,GAAA,UAAa,KAAA;EAuavB;;;EAhaA,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;EAgagB;;AAAA;EAzZrC,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;;;;EAQI,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAO5B,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;;;;EAQI,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;;;;EAQI,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAOpB,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAOzB,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAOvB,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;;;;EAOrC,SAAA,IAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAYT,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;;;;EAOnE,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;;;;EAOnD,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;EAQzB,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;;;;;;;;;;;;UAmB5B,kBAAA;EAAA,QA2BA,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EA2FjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAgDtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}
+{"version":3,"file":"response.d.mts","names":[],"sources":["../../../../../../../../packages/core/src/http/response.ts"],"mappings":";;;;;;;;;;;;;;KAwCK,WAAA,+BAA0C,MAAA,gBAAsB,KAAK;;;;AAFjC;;;;AAEiC;AAc1E;;;;KAAY,aAAA,GAAgB,sBAAsB;EAStC;;;;;EAHV,GAAG;AAAA;AAAA,aAGO,cAAA;EACV,EAAA;EACA,OAAA;EACA,QAAA;EACA,iBAAA;EACA,KAAA;EACA,SAAA;EACA,YAAA;EACA,kBAAA;EACA,kBAAA;EACA,UAAA;EACA,WAAA;EACA,YAAA;EACA,SAAA;EACA,SAAA;EACA,kBAAA;EACA,QAAA;EACA,iBAAA;EACA,qBAAA;EACA,mBAAA;AAAA;;;;KAMU,eAAA;EACV,SAAA;EACA,SAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;KAMU,iBAAA,GAAoB,eAAe;EAC7C,WAAA;EACA,IAAA;AAAA;AA0BF;;;;AAAmD;AAAnD,iBAAgB,oBAAA,CAAqB,KAAc;AAAA,cAItC,QAAA;;;;YAID,KAAA,EAAQ,KAAA;EAsCF;;;;;;;;;;;;;;;;EApBT,YAAA,EAAe,YAAA;EAyblB;;;EAAA,UApbM,iBAAA;EA8ckC;;;EAAA,UAzclC,WAAA;EAsd4C;;;EAjd/C,OAAA,EAAU,OAAA;EAogBN;;;EAAA,UA/fD,MAAA,EAAM,GAAA;EAyuBI;;;;;EAluBb,UAAA;EA8lCoC;;;EAAA,IAzlChC,GAAA,mBAAG,cAAA,gBAAA,eAAA;EA2oCX;;;EAAA,IApoCQ,IAAA;EAspCR;;;EAAA,IA/oCQ,IAAA,CAAK,IAAA;EAkqCW;;;EA3pCpB,SAAA,CAAU,QAAA;EAyqCa;;;EAhqCvB,MAAA,CAAO,QAAA;EA8qCE;;;EArqCT,WAAA,CAAY,QAAA,EAAU,YAAA;EAwrC6B;;;EAzqCnD,KAAA;EAwrC6B;;;EA/qC7B,QAAA,CAAS,KAAA,EAAO,KAAA;EAswCiE;;;EAAA,IA7vC7E,WAAA;EA42CgB;;;EAr2CpB,cAAA,CAAe,WAAA;EA44CgD;;;EAAA,IAn4C3D,UAAA;EAi5CkD;;;EAAA,IA14ClD,IAAA;EAk8CiC;;;EAAA,IA37CjC,IAAA;EAxJO;;;EAAA,OA+JJ,EAAA,CACZ,KAAA,EAAO,aAAA,EACP,QAAA,GAAW,QAAA,EAAU,QAAA,YACpB,iBAAA;EAtIO;;;EAAA,iBA6Ia,OAAA,CAAQ,KAAA,EAAO,aAAA,KAAkB,IAAA,UAAW,OAAA;EAnInD;;;EAAA,UAgJA,SAAA,IAAS,OAAA;EApIX;;;EA2ID,KAAA,CAAM,KAAA,QAAa,OAAA;EAtHzB;;;EAwKA,GAAA,CAAI,OAAA,UAAiB,KAAA,GAAO,QAAA;EAtJ5B;;;EAAA,IAwKI,MAAA;EAhJJ;;;;;;EA0JM,IAAA,CAAK,IAAA,QAAY,UAAA,WAAqB,aAAA,aAAuB,OAAA,CAAQ,QAAA;EA1HvE;;;;;EAAA,UAmND,cAAA,CAAe,UAAA;EAnMZ;EAAA,UAiQH,OAAA,IAAO,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EAhQd;EAAA,UAyQO,OAAA,CAAQ,IAAA,QAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;EAlQW;;;;;;;;;;;;;;;;;;;EA6R/B,MAAA,CAAO,MAAA;IACZ,MAAA;IACA,IAAA;IACA,WAAA;IACA,OAAA,GAAU,MAAA;EAAA,IACR,OAAA,CAAQ,QAAA;EAzCK;;;EA4DV,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EA5D5B;;;EAmEV,MAAA,CAAO,OAAA,EAAS,KAAA,CAAM,YAAA,GAAe,KAAA,CAAM,aAAA,EAAe,MAAA,YAAY,OAAA,CAAA,QAAA;EA1DlD;;;;;;;;;EAuEpB,GAAA,CAAI,IAAA,WAAe,OAAA,EAAS,UAAA,YAAmB,OAAA,CAAA,QAAA;EA1CpD;;;EA2DK,IAAA,CAAK,IAAA,UAAc,UAAA,YAAmB,OAAA,CAAA,QAAA;EA7D/B;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6FP,MAAA,CACL,WAAA,WACA,OAAA,GAAS,qBAAA,GACR,wBAAA;EAFD;;;;;;;;;;;;;;;;EAiLK,WAAA,CAAY,cAAA,EAAgB,mBAAA,GAAsB,OAAA;EA+PlD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EArMA,GAAA,CAAI,OAAA,GAAS,kBAAA,GAA0B,qBAAA;EA6Z7B;;;EA3OV,aAAA,CAAc,UAAA;EAkPO;;;EAzOrB,QAAA,CAAS,GAAA,UAAa,UAAA;EAmP1B;;;EAzOI,iBAAA,CAAkB,GAAA;EAiPU;;;EAvO5B,eAAA;EAiPJ;;;;;;;EAAA,UAtOO,4BAAA;EAyPiB;;;EA9OpB,YAAA,CAAa,GAAA;EAqPY;;;EA5OzB,SAAA,CAAU,GAAA;EAmPa;;;EAOf;;;;;EA9OR,mBAAA;EAMA,UAAA,IAAU,MAAA,+BAAA,UAAA;EA+OD;;;EAxOT,OAAA,CAAQ,OAAA,EAAS,MAAA;EAwOR;;;EA/NT,MAAA,CAAO,GAAA,UAAa,KAAA;EA2O+C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAvMnE,MAAA,CAAO,IAAA,UAAc,KAAA,EAAO,WAAA,EAAa,OAAA,GAAS,aAAA;EA+Ya;;;;;;;;;;;;;;;;;;;;;EApW/D,SAAA,CAAU,MAAA;EA6aJ;;;;;;EAhZN,WAAA,CAAY,IAAA,UAAc,OAAA,GAAU,sBAAA;EAwcpC;;;;;;AAAqC;;;;;;;;;EAlbrC,YAAA,CAAa,OAAA,GAAU,sBAAA;;;;EAWvB,SAAA,CAAU,GAAA,UAAa,KAAA;;;;EAOvB,WAAA,CAAY,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAOrB,SAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;;;;EAQI,kBAAA,CAAmB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAO5B,YAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;;;;EAQI,QAAA,CACL,IAAA,SAEC,OAAA,CAAA,QAAA;;;;EAQI,UAAA,CAAW,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAOpB,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAOzB,aAAA,CAAc,IAAA,QAAS,OAAA,CAAA,QAAA;;;;EAOvB,OAAA,CAAQ,IAAA,SAA6B,OAAA,CAAA,QAAA;;;;EAOrC,SAAA,IAAS,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAYT,QAAA,CAAS,IAAA,SAA0D,OAAA,CAAA,QAAA;;;;EAOnE,QAAA,CAAS,IAAA,SAA0C,OAAA,CAAA,QAAA;;;;EAOnD,eAAA,CAAgB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;EAQzB,mBAAA,CAAoB,IAAA,QAAS,OAAA,CAAA,QAAA;;;;;;;;;;;;;;;;UAmB5B,kBAAA;EAAA,QA2BA,oBAAA;;;;EAyCK,QAAA,CAAS,QAAA,WAAmB,WAAA,EAAa,OAAA,YAAmB,eAAA,GAAe,OAAA,CAAA,QAAA;;;;;EA2FjF,UAAA,CAAW,MAAA,EAAQ,MAAA,EAAQ,OAAA,YAAmB,iBAAA,GAAiB,YAAA,mBAAA,qBAAA,oBAAA,gBAAA,iBAAA,eAAA,iBAAA,cAAA,gBAAA,eAAA,8BAAA,aAAA,oBAAA,0BAAA;;;;;EAkBzD,SAAA,CACX,KAAA;EACA,OAAA,aAAoB,IAAA,CAAK,iBAAA;IAAsC,WAAA;EAAA,KAAuB,OAAA;;;;;;EAuCjF,cAAA,CAAe,IAAA,WAAe,WAAA,EAAa,SAAA,YAAoB,OAAA,CAAA,QAAA;;;;EAO/D,QAAA,CAAS,IAAA,UAAc,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAOlC,YAAA,CAAa,QAAA,UAAkB,QAAA,YAAiB,OAAA,CAAA,QAAA;;;;EAgDtD,kBAAA,CAAmB,QAAA;;;;EAQnB,YAAA,CAAa,MAAA,EAAQ,gBAAA,GAAgB,OAAA,CAAA,QAAA;AAAA"}