The HTTP method.

The full request URL.

The URL path component (no query string).

Request headers (web-standard Headers).

Client IP address, when derivable.

The authenticated principal, populated by authentication middleware. Absent when the request is unauthenticated.

It accepts one implicit write per request; a second assignment throws so independent identity writers fail loudly. Use replacePrincipal for an intentional replacement such as step-up authentication. This is not an authorization control: a write before authentication is still the first write and is allowed.

The resolved tenant, populated by the multi-tenancy middleware. Absent when no tenant could be resolved or multi-tenancy is not enabled.

It accepts one implicit write per request; use replaceTenant for an intentional replacement. Like user, this detects late accidental overwrites and is not an authorization control.

An abort signal that fires when the underlying HTTP connection is severed (client disconnect, timeout). Populated by the HTTP adapter from the native Request.signal; optional because injected / test requests may not carry one.

When absent, the kernel's request-context factory falls back to a non-aborting sentinel so that producers reading IRequestContext.signal always have a live signal to listen on.

The undisturbed web-standard Request, preserved for WebSocket upgrade and gRPC dispatch after the middleware pipeline.

Populated by the HTTP adapter before the body is consumed by the framework mapping. Optional because injected or test requests may not carry one.

Reads and parses the body as JSON.

Reads the body as text.

Reads the body as raw bytes.

Reads the body as a form, for both application/x-www-form-urlencoded and multipart/form-data requests.

The parse is the shared parseFormBody, memoized exactly as json() is — the in-flight promise is cached (a rejection with it), so two middleware reading the same body trigger one parse, not two.

Optional on the signal? / fs? / raw? precedent: a custom IRequest implementor may omit it. Such a caller falls back to parseFormBody(await request.bytes(), request.headers.get('content-type')), the same common function the producers call — what the accessor adds over the fallback is the memoization.