Minn\Http

The shared collection parameters, judged first: the reference answers a refusal among these alone, and reads the route's own parameters only once these pass.

The key an argument carries when its handler judges it (a status the caller may not read is refused before the enum is).

Read by Rest\Context::of(): which view of a resource is wanted.

Read by Content\PostWriter: whether a delete bypasses the trash.

Read by Rest\UserCollectionParams: the user collection.

Read by Rest\TermCollectionParams: a term collection, either shape.

Read by Rest\CommentsController::list(): the comment collection.

Read by Rest\UsersController::create(): the body of a user create. The locale takes any string here; the reference's enum is the site's installed languages, which is not a constant.

Read by Rest\UsersController::update(): the body of a user edit; nothing is required.

Read by Rest\UsersController::delete(): the reassignment a user delete requires, and the force it insists on.

Read by Rest\ApplicationPasswordsController::create(): the body of a new application password.

Read by Rest\SearchController::list(): the search collection, whose context has no edit view.

The sets merged into one map, as a route's endpoint publishes them.

Whether a certificate's reference name is one a host can match.

Whether the host matches the reference name.

Whether a parsed certificate (openssl_x509_parse) names the host.

A Set-Cookie value split up. With a name given, the first part is all value; a first part without "=" is a value with an empty name.

One attribute normalized, or null when it should go: dates become timestamps, the domain loses its leading dot.

Whether a host-only cookie with this domain attribute (none means any) belongs to the domain: the same text only.

Whether a cookie with this domain attribute (none means any) belongs to the domain or one of its subdomains (never an IP address).

Whether a cookie with this path attribute (none means any) is sent for the request path.

The path a cookie without one gets: the request path up to its last slash, or "/".

Why $url may not be requested, or null when nothing about the URL itself refuses it (a name is judged again once resolved).

The request with curl pinned to the addresses its host resolves to, or the failed exchange when the name does not resolve or resolves somewhere private it was not allowed.

A URL's host, lower-cased, without the brackets around an IPv6 address.

The whole page: $languageAttributes go inside <html> unless the direction is 'rtl'; $robots is the printed robots tag.

The body at $url, following at most five redirects.

The answer to a matched request, refusals included.

An exchange in which no response arrived.

Whether the transport failed before any status came back.

A response arrived and it was a 2xx.

The body decoded as JSON, or null when it is not JSON.

One header by any spelling of its name; a repeated header's values joined with ", ".

One cookie's value from the Set-Cookie headers, percent-decoded; the last one set wins.

This exchange when it is ok(), otherwise a RequestFailed exception (a RuntimeException) carrying it, for callers who would rather catch than check.

Opens the window in which a failure is an extension's fault: while the plugins and the theme's functions file load and the boot actions fire, code that fails fails for every visitor, so pausing it heals the site. A failure after that (a route, a shortcode, a template) answers to one request's input and is never grounds for a pause; it is logged and the request ends in the error page.

Closes the window armRecovery() opened.

What to do with a fatal beyond showing the page: the engine records the extension it came from so the next request loads without it. Installed once the runtime is up, since it needs the database.

Sets PHP's error settings from the debug constants as the reference's boot does (Runtime\DebugMode), and installs the error handlers. With WP_DEBUG off, or for a request that answers a machine, errors never display. In the first case the reference leaves php.ini's setting; the engine never shows a visitor PHP's errors. Detail is shown only while display_errors is on.

Logs the cause; the page says only that something went wrong.

The same, for a request that asked for JSON: a client that speaks REST is answered in REST, never handed the HTML error page.

The 500 page.

The 503 page the reference shows when the database cannot be reached.

The 503 page while maintenance mode holds; monitors read the status, the retry hint, and the title.

The same page with the cause on it, for a site that asked to see errors. Only ever reached when WP_DEBUG_DISPLAY (or WP_DEBUG) is on: a site that has not asked never learns this much from a response.

Keys are URL patterns (* matches anything; the scheme and query may be left off); values are an array (sent as JSON), a string (the body), a status code, an Exchange from reply(), or a closure taking the Outbound and returning one of those. A request no pattern matches fails as if nothing were listening.

A client this fake answers, bound to $within as an extension's is by its needs.http. The destination rules still run, but names are not resolved.

The answer for one request, which is recorded as sent.

The requests sent so far, oldest first; with a pattern, only those whose URL matches it.

A response made by hand, for a fake to answer with. An array body is sent as JSON.

Whether a URL matches a pattern in which * stands for anything; the scheme and the query string may be left off.

The address with "::" expanded into zero groups.

The address with leading zeros dropped from all-digit groups and the longest zero run as "::".

Whether the text is an IPv6 address (with an optional IPv4 tail).

The parts of an IRI (RFC 3986 appendix B).

Whether the parts make a well-formed IRI: a valid scheme when there is one, no "//" path without an authority.

The reference resolved against this base (RFC 3986 section 5.2), or null when the base has no scheme.

The same IRI with another host.

The same IRI with another path.

The normalized IRI: non-ASCII characters stay as they are.

The normalized URI: non-ASCII characters percent-encoded too.

Routes the request; a thrown failure becomes its response, and null means no route matched.

A header block (a string, its folded lines joined, or a list of lines) read into the last status line's code and message, lower-cased headers (a repeated one as a list) and the Set-Cookie values. Each status line starts the headers over.

A chunked body decoded as the reference's WP_Http::chunkTransferDecode decodes one. The CRLF after a chunk is not stepped over, so it decodes only when chunks run into each other and a final 0 ends the body; any other shape comes back as it was.

A redirect's address made safe, as wp_sanitize_redirect() makes it (probe security-parity): spaces as %20, whole UTF-8 sequences URL-encoded, any other character outside the URL set dropped, and an encoded CR or LF taken out until none is left. Other encoded control characters stay, as they do on the reference.

The absolute URL $location names, read against $base as RFC 3986 reads a reference: a scheme keeps it as written, "//" takes the base's scheme, a fragment or query alone keeps the base's path, and a relative path joins the base's directory with "." and ".." resolved.

Whether two URLs share scheme, host, and port, so credentials may follow from one to the other.

Whether a list of media types names JSON: application/json, or any application/…+json vendor type, parameters and case ignored (wp_is_json_media_type(), probe load-remaining).

The verb for a name, GET when the name is unknown.

HEAD is served by GET handlers; the kernel drops the body.

Canonical redirects (trailing slash, pretty-URL mapping, 404 guessing) run only for reads; every other method renders the URL as typed.

The same request sent somewhere else, as the next hop of a redirect.

The same request with a last word on the curl handle, run after any it already has.

Whether the route is open to anyone with nothing to look up, so the gate need not run at all.

The 404 code a missing subject earns.

The 404 message a missing subject earns.

Every capability the policy asks for by name, the one on the object included, so a listing can show what a route takes.

The policy as data, for the route catalogue. @return array<string, mixed>

The policy in one line, for the route index and the docs.

A whole host name, label by label.

One label in ASCII.

The Punycode of a UTF-8 string (without the prefix).

The exchange as raw response text: its status line, header lines, a blank line, the body.

The text split into protocol, status, header pairs (folded lines joined) and body.

A head alone (the body went to a file): protocol, status, header pairs, and an empty body.

A chunked body joined; text that is not chunked comes back as it was.

A gzip body inflated past its header fields (extra, name, comment, header CRC) and trailer, or a zlib one past its two-byte header, as WP_Http_Encoding::compatible_gzinflate reads them; false when neither inflates.

A gzip or zlib body inflated; anything else (raw deflate included) comes back as it was.

Throws the refusal when the request earns it; returns quietly otherwise.

what the server says about itself: software, protocol, and address; diagnostics only

The request PHP received, read once from the superglobals.

The JSON body as an array, or the form fields when the body is empty or a form.

The same request addressed to another path (a REST route carried in ?rest_route=).

One query value as a string, or the default when it is absent or not a string.

A query value read as the reference reads a boolean argument: true, 1, yes, on; anything else is false.

A boolean the query or the body sets, as a DELETE may carry force in either (probes rest-posts-write, rest-terms-controller).

Whether the query carries this key at all, even empty.

A request header by case-insensitive name, or null.

A cookie's value, or null.

The path split into non-empty segments: "/a/b/" becomes ["a", "b"].

The query string with the given keys removed, ready to append to a redirect.

The namespaced name for a Requests_* name, or null when it is not one.

An HTML response.

A JSON response with the payload encoded.

A redirect to a location.

The same response with one header set, after those already set (one already there keeps its place).

The same response without one header.

The same response with a cookie to set.

The same response with an empty body, the HEAD answer.

The same response with work to run once the client has been answered. @param Closure(): void $work

One header line sent now, as plugin code sends one, ahead of the response's own (which win on a shared name). Nothing outside a web request, or once the head is out.

Bytes written to PHP's output now, so into whatever buffers are open: for a page passed through buffers plugin code opened before it (Theme\TemplateBuffer), whose handlers then see it.

Writes the status, the headers, and the cookies now, and nothing else: for an answer that code outside the engine may finish on its own (an ajax handler that ends the request), which must find them already said.

Writes the status, the headers, the cookies, and the body, ends the request for the client, then runs the after-send work in the same process (the server that can close the connection first does).

The parameters this route accepts, as the REST index publishes them: from its params source for these captures (a capture the pattern fixes, such as {base:posts}, counts when none is given), or its fixed sets.

The parameters this route reads from the JSON body, validated before the caller is judged.

The pattern as a regular expression with named captures.

The route's parameters for these captures, as the index publishes them; none when the captures name nothing.

The row for one attribute on one handler method; the name defaults to the handler.

The parameters as the index publishes them for one concrete route the pattern takes (a {base} route's parameters are that base's).

The row as data, for the JSON catalogue. @return array<string, mixed>

Registers every #[Route] method of the given handlers; returns the router for chaining.

The routes that list in an index: pattern => methods. @return array<string, list<string>>

Every registered route as a row: what it is, who it is for, what it takes. The same rows Rest\Catalogue reads from the classes alone.

The methods the caller may use on this path, for the Allow header: every route matching the path (a route with no captures that names the path exactly claims it alone), its policy judged for the caller without dispatching. A route that states no policy counts for GET only, until it states one. Empty when nothing matched or nothing is allowed, and the header is then left out, as the reference does.

The routes a request's method and path match, policies unjudged, in the order dispatch tries them, with their captures: what a batch reads to tell a route that does not take part from no route at all.

Null when nothing matched, so the caller can fall through.

The phrase for a code, or empty for one the table does not know.

The reference's error code for a record that does not exist.

The reference's message for a record that does not exist.

Performs one outgoing request over curl and returns the exchange, a transport error included.

Nobody in front of the engine speaks for the client.

What the site declared in wp-config.php, or nobody.

Whether the engine believes what this address says about the client.

The client's address, given who connected and what was forwarded: the right-most forwarded address that is not itself a trusted proxy.

Whether a forwarded scheme may be believed, and says https.