if (body_ == nullptr) return;

body_->~response_body();

if (!body_inline_) {

// Heap path: ::operator delete pairs with the

// ::operator new(sizeof(T)) the factory uses.

::operator delete(body_);

}

// Invariant: leave in the empty/no-body state regardless of which

// branch ran (inline dtor only, or heap dtor + operator delete).

body_ = nullptr;

body_inline_ = false;

if (other.body_ == nullptr) {

return; // source has no body; nothing to adopt

}

if (other.body_inline_) {

// Placement-move into our buffer, then destroy the source's

// inline body so the source's destructor is a no-op.

other.body_->move_into(body_storage_);

body_ = reinterpret_cast<detail::response_body*>(body_storage_);

body_inline_ = true;

other.body_->~response_body();

} else {

// Heap path: pointer transfer — no allocation, no copy.

body_ = other.body_;

body_inline_ = false;

}

other.body_ = nullptr;

other.body_inline_ = false;

// Reset the moved-from source's kind_ to empty so any code that reads

// kind() on a moved-from http_response sees a consistent state

// (body_ == nullptr always corresponds to body_kind::empty).

other.kind_ = body_kind::empty;

: status_code_(other.status_code_),

headers_(std::move(other.headers_)),

footers_(std::move(other.footers_)),

cookies_(std::move(other.cookies_)),

cookies_mirror_valid_(other.cookies_mirror_valid_),

structured_cookies_(std::move(other.structured_cookies_)),

kind_(other.kind_) {

adopt_body_from(other);

std::string_view key,

std::string_view value) {

if (key.find_first_of(detail::kForbiddenFieldChars) != std::string_view::npos) {

throw std::invalid_argument(

std::string(setter_name) +

": key contains forbidden control character (CR, LF, or NUL)");

}

if (value.find_first_of(detail::kForbiddenFieldChars) != std::string_view::npos) {

throw std::invalid_argument(

std::string(setter_name) +

": value contains forbidden control character (CR, LF, or NUL)");

}

// Legacy v1 string-blob entry point. Build and validate the

// structured cookie FIRST — with_name / with_value throw

// std::invalid_argument for forbidden characters (CR, LF, NUL,

// ';', '=' in names), so structured_cookies_ (the authoritative,

// wire-rendered store) is only mutated once the input is known good.

//

// Note: validate_http_field is intentionally NOT called here. The

// structured cookie::with_name / with_value setters enforce the

// stricter RFC 6265 rules (rejecting ';' in both name and value,

// among others) and give callers the correct error message.

// Calling validate_http_field first would give an incorrect

// earlier error citing 'forbidden control character' rather than

// the real reason.

//

// v1 overwrite semantics: in v1,

// calling with_cookie("sid", "old") then with_cookie("sid", "new")

// silently overwrote — one Set-Cookie header on the wire. So the

// structured store overwrites too: an existing structured cookie

// with the same name is REPLACED in place (keeping its position);

// only a genuinely new name is appended. Name equivalence uses

// http::header_comparator — the same case-insensitive ordering used

// by the deprecated `cookies_` mirror. The structured path

// (do_set_cookie_struct) intentionally keeps append semantics.

cookie new_cookie;

new_cookie.with_name(key).with_value(value); // throws before any mutation

// The deprecated `cookies_` name->value mirror is now rebuilt lazily

// from structured_cookies_ on demand (get_cookies / get_cookie), so

// this hot setter no longer pays a red-black-tree insert whose result

// is never read on the wire path -- it just invalidates the mirror.

cookies_mirror_valid_ = false;

const http::header_comparator name_less;

auto it = std::find_if(

structured_cookies_.begin(), structured_cookies_.end(),

[&](const cookie& existing) {

return !name_less(existing.name(), new_cookie.name())

&& !name_less(new_cookie.name(), existing.name());

});

if (it != structured_cookies_.end()) {

*it = std::move(new_cookie);

} else {

structured_cookies_.push_back(std::move(new_cookie));

}

// Structured entry point. structured_cookies_ is authoritative; the

// deprecated `cookies_` name->value mirror is rebuilt lazily from it

// (get_cookie / get_cookies), so this appends and invalidates the

// mirror rather than eagerly inserting into a map the wire path never

// reads.

//

// NOTE: cookies created by cookie::parse_cookie_header() bypass

// all name/value validators and store raw wire bytes directly.

// Callers MUST NOT pass parsed request cookies to this path

// without first re-constructing them through with_name()/

// with_value(). The render-time guard in

// cookie::to_set_cookie_header() will throw if a forbidden byte

// reaches the wire, providing a last line of defense.

cookies_mirror_valid_ = false;

structured_cookies_.push_back(std::move(c));

if (code < 100 || code > 599) {

throw std::invalid_argument(

"with_status: HTTP status code out of range [100, 599]");

}

status_code_ = code;

std::string_view key) {

auto it = m.find(key);

if (it == m.end()) return {};

return it->second;

// Rebuild the deprecated name->value mirror from the authoritative

// structured_cookies_ list, on the first read after a mutation. Kept

// noexcept (get_cookies() is declared noexcept): on allocation failure

// we surface an empty mirror rather than propagate. Not synchronised

// -- an http_response is owned by a single request thread, like the

// rest of this class. Duplicate names in structured_cookies_ collapse

// last-wins here, matching the old eager insert_or_assign path.

if (cookies_mirror_valid_) {

return;

}

try {

cookies_.clear();

for (const auto& c : structured_cookies_) {

cookies_.insert_or_assign(c.name(), c.value());

}

} catch (...) {

cookies_.clear();

}

cookies_mirror_valid_ = true;