[ENG-4059] Resolve request fields the way applications read them

[patchstackdave]

Stacked on #298 (request value decoding), which should merge first.

Makes a rule see a request field in the same form the application reads it, whichever parser produced the request, and reports when a value is too large to inspect in full.

• Cookies. Pairs are split first, then their values are normalised the same way whether a framework already parsed them or they come from the Cookie header. Quoted values lose their quotes, and a name sent more than once keeps every value, so a rule inspects each one.
• Bracketed field names. get.user.name also resolves user[name], and get.id also resolves id[]. The reverse works too, so a rule written in either spelling applies both to parsers that expand brackets and to parsers that keep them as literal keys. The request.* source follows the same rule.
• Large structured values. Beyond the leaf walk's bound, the value is matched as serialised text, and the bound is reported as a container-cap skip through onSkip / coverage(). This applies to the request phase and, once per response, to the response phase. A decoding mutation that reaches its own node or depth bound on a structured value reports the same skip, so a value handed to a whole-value matcher past that bound is visible too.
• internal_host. The host is also read from the shorter URL spellings a URL parser still resolves: http:/host, http:host, backslash forms, and tabs or leading control characters.

Synthetic tests cover each shape, including its fetch, Node and Express paths, with controls that must not match.

Validation: full suite with #298 (3,501 passed, 7 skipped), typecheck and build.

🤖 Generated with Claude Code

[coderbuds]

Well-commented and cohesive enhancements to request parsing and normalization.

🎯 Quality: 95% Elite · 📦 Size: Extra Large — strongly consider breaking this down

🛡️ Standards: Not checked — 631 lines changed, over your team's 400-line limit, and nothing checked before it was opened. Coding agents can call the assess-change-fit tool first, while a change this size is still cheap to split.

🤖 Authorship: Agent-written — Claude Code, going by its own attribution. Whether a person read it is unknown; coding agents can call the report-ai-usage tool to say.

📈 This month: Your 161st PR — above team average · Averaging Good

_{See how your team is trending →}

[patchstackdave]

/review