@klnap/next-proxy-chain 1.0.0

package/dist/index.cjs

@@ -0,0 +1,882 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  DEFAULT_BLOCKED_REQUEST_HEADERS: () => DEFAULT_BLOCKED_REQUEST_HEADERS,
+  NEXT: () => NEXT,
+  RuleTimeoutError: () => RuleTimeoutError,
+  applyMergedToResponse: () => applyMergedToResponse,
+  assertIncludeExcludeNoOverlap: () => assertIncludeExcludeNoOverlap,
+  assertOverrideMechanismSupported: () => assertOverrideMechanismSupported,
+  compileScopes: () => compileScopes,
+  cookieItemsFromHeaders: () => cookieItemsFromHeaders,
+  createConsoleLogger: () => createConsoleLogger,
+  createProxyContext: () => createProxyContext,
+  decodeOverriddenRequestHeaders: () => decodeOverriddenRequestHeaders,
+  defineProxy: () => defineProxy,
+  formatPipelineLine: () => formatPipelineLine,
+  headersDiffer: () => headersDiffer,
+  host: () => host,
+  isNextResult: () => isNextResult,
+  isRequestHeaderAllowed: () => isRequestHeaderAllowed,
+  listSetCookie: () => listSetCookie,
+  mergeRequestHeaderOverrides: () => mergeRequestHeaderOverrides,
+  mergeWrites: () => mergeWrites,
+  next: () => next,
+  normalizeHost: () => normalizeHost,
+  parseCookieName: () => parseCookieName,
+  path: () => path,
+  pathMatches: () => pathMatches,
+  proxyChain: () => proxyChain,
+  responseHeaderItems: () => responseHeaderItems,
+  ruleLabel: () => ruleLabel,
+  ruleMatches: () => ruleMatches,
+  safeInternalError: () => safeInternalError,
+  toPathRegex: () => toPathRegex,
+  toRule: () => toRule,
+  toStatelessRegExp: () => toStatelessRegExp,
+  withPaths: () => withPaths,
+  withRuleTimeout: () => withRuleTimeout
+});
+module.exports = __toCommonJS(index_exports);
+var import_server = require("next/server");
+
+// src/core.ts
+var NEXT = /* @__PURE__ */ Symbol.for("proxy-chain.next");
+function next(options = {}) {
+  return { [NEXT]: true, ...options };
+}
+function isNextResult(value) {
+  return typeof value === "object" && value !== null && NEXT in value;
+}
+function createProxyContext() {
+  return /* @__PURE__ */ new Map();
+}
+var USELESS_FN_NAMES = /* @__PURE__ */ new Set(["", "proxy", "anonymous", "run", "next"]);
+function usefulName(value) {
+  if (!value || USELESS_FN_NAMES.has(value)) return void 0;
+  return value;
+}
+function toStatelessRegExp(re) {
+  const flags = re.flags.replace(/[gy]/g, "");
+  return flags === re.flags ? re : new RegExp(re.source, flags);
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function host(matcher) {
+  const list = Array.isArray(matcher) ? matcher : [matcher];
+  const parts = list.map((m) => {
+    if (m instanceof RegExp) return `(?:${toStatelessRegExp(m).source})`;
+    return `(?:${escapeRegex(m.toLowerCase())})`;
+  });
+  return toStatelessRegExp(new RegExp(`^(?:${parts.join("|")})$`, "i"));
+}
+function isScopeObject(value) {
+  return "host" in value || "path" in value;
+}
+function compileScopes(input, pathOptions) {
+  if (input == null) return void 0;
+  const list = Array.isArray(input) ? input : [input];
+  const compilePath = (matcher) => {
+    if (Array.isArray(matcher)) {
+      const parts = matcher.map(
+        (m) => typeof m === "string" ? path(m, pathOptions) : toStatelessRegExp(m)
+      );
+      if (parts.length === 1) return parts[0];
+      return toStatelessRegExp(new RegExp(`(?:${parts.map((r) => `(?:${r.source})`).join("|")})`));
+    }
+    return typeof matcher === "string" ? path(matcher, pathOptions) : toStatelessRegExp(matcher);
+  };
+  const compiled = [];
+  for (const item of list) {
+    if (typeof item === "string" || item instanceof RegExp) {
+      compiled.push({ path: compilePath(item) });
+      continue;
+    }
+    if (item && typeof item === "object" && isScopeObject(item)) {
+      if (item.host == null && item.path == null) {
+        throw new Error("[proxy-chain] scope needs at least `host` or `path`");
+      }
+      compiled.push({
+        host: item.host != null ? host(item.host) : void 0,
+        path: item.path != null ? compilePath(item.path) : void 0
+      });
+      continue;
+    }
+    throw new Error("[proxy-chain] invalid include/exclude scope");
+  }
+  return compiled;
+}
+function scopeMatches(pathname, hostname, scope) {
+  if (scope.host) {
+    if (!hostname || !scope.host.test(hostname)) return false;
+  }
+  if (scope.path) {
+    if (!scope.path.test(pathname)) return false;
+  }
+  return true;
+}
+function toRule(entry) {
+  if (typeof entry === "function") {
+    const name2 = usefulName(entry.name);
+    return name2 ? { run: entry, name: name2 } : { run: entry };
+  }
+  const rule = entry;
+  const runName = typeof rule.run === "function" ? usefulName(rule.run.name) : void 0;
+  const name = usefulName(rule.name) ?? runName;
+  const harden = (scopes) => scopes?.map((s) => ({
+    host: s.host ? toStatelessRegExp(s.host) : void 0,
+    path: s.path ? toStatelessRegExp(s.path) : void 0
+  }));
+  return {
+    ...rule,
+    name: name ?? void 0,
+    include: harden(rule.include),
+    exclude: harden(rule.exclude)
+  };
+}
+function ruleLabel(rule, index) {
+  const runName = typeof rule.run === "function" ? usefulName(rule.run.name) : void 0;
+  return usefulName(rule.name) ?? runName ?? `rule#${index}`;
+}
+function withPaths(entry, filter) {
+  const base = toRule(entry);
+  const opts = filter.pathOptions;
+  const include = compileScopes(filter.include, opts);
+  const exclude = compileScopes(filter.exclude, opts);
+  const name = filter.name ?? base.name;
+  assertIncludeExcludeNoOverlap(include, exclude, name ?? "proxy");
+  return { run: base.run, include, exclude, name };
+}
+function ruleMatches(pathname, hostname, rule) {
+  if (rule.exclude?.some((scope) => scopeMatches(pathname, hostname, scope))) return false;
+  if (rule.include && !rule.include.some((scope) => scopeMatches(pathname, hostname, scope))) {
+    return false;
+  }
+  return true;
+}
+function pathMatches(pathname, rule) {
+  return ruleMatches(pathname, null, rule);
+}
+function normalizeHost(raw) {
+  if (!raw) return null;
+  const first = raw.split(",")[0]?.trim().toLowerCase();
+  if (!first) return null;
+  if (first.startsWith("[")) {
+    const end = first.indexOf("]");
+    return end === -1 ? first : first.slice(1, end);
+  }
+  const withoutPort = first.replace(/:\d+$/, "");
+  return withoutPort || null;
+}
+function parseCookieName(setCookie) {
+  const eq = setCookie.indexOf("=");
+  return (eq === -1 ? setCookie : setCookie.slice(0, eq)).trim();
+}
+function listSetCookie(headers) {
+  const extended = headers;
+  if (typeof extended.getSetCookie === "function") return extended.getSetCookie();
+  const single = headers.get("set-cookie");
+  return single ? [single] : [];
+}
+function cookieItemsFromHeaders(headers) {
+  const map = /* @__PURE__ */ new Map();
+  for (const value of listSetCookie(headers)) {
+    map.set(parseCookieName(value), value);
+  }
+  return map;
+}
+function responseHeaderItems(headers) {
+  const map = /* @__PURE__ */ new Map();
+  headers.forEach((value, key) => {
+    const lower = key.toLowerCase();
+    if (lower === "set-cookie") return;
+    if (lower.startsWith("x-middleware-next") || lower.startsWith("x-middleware-rewrite") || lower.startsWith("x-middleware-override-headers") || lower.startsWith("x-middleware-request-")) {
+      return;
+    }
+    map.set(key, value);
+  });
+  return map;
+}
+function decodeOverriddenRequestHeaders(headers) {
+  const result = new Headers();
+  const overrideHeaderNames = headers.get("x-middleware-override-headers");
+  if (overrideHeaderNames) {
+    for (const name of overrideHeaderNames.split(",")) {
+      const trimmed = name.trim();
+      const val = headers.get(`x-middleware-request-${trimmed}`);
+      if (val !== null) {
+        result.set(trimmed, val);
+      }
+    }
+  }
+  return result;
+}
+function mergeWrites(writes, strategy, onConflict) {
+  const resolved = /* @__PURE__ */ new Map();
+  const setBy = /* @__PURE__ */ new Map();
+  for (const write of writes) {
+    for (const [key, value] of write.items) {
+      const existing = resolved.get(key);
+      if (existing === void 0) {
+        resolved.set(key, value);
+        setBy.set(key, write.ruleName);
+        continue;
+      }
+      const previousRule = setBy.get(key);
+      if (typeof strategy === "function") {
+        const result = strategy(key, existing, value);
+        if (result === null) resolved.delete(key);
+        else resolved.set(key, result);
+        setBy.set(key, write.ruleName);
+        continue;
+      }
+      if (strategy === "first-write-wins") {
+        onConflict?.(key, previousRule, write.ruleName);
+        continue;
+      }
+      onConflict?.(key, write.ruleName, previousRule);
+      resolved.set(key, value);
+      setBy.set(key, write.ruleName);
+    }
+  }
+  return resolved;
+}
+function applyMergedToResponse(res, headers, cookies) {
+  for (const [key, value] of headers) {
+    res.headers.set(key, value);
+  }
+  res.headers.delete("set-cookie");
+  for (const cookie of cookies.values()) {
+    res.headers.append("set-cookie", cookie);
+  }
+}
+var DEFAULT_BLOCKED_REQUEST_HEADERS = [
+  "host",
+  "connection",
+  "keep-alive",
+  "proxy-authenticate",
+  "proxy-authorization",
+  "te",
+  "trailer",
+  "transfer-encoding",
+  "upgrade",
+  "content-length",
+  "cookie",
+  "authorization",
+  "x-forwarded-host",
+  "x-forwarded-for",
+  "x-forwarded-proto",
+  "x-real-ip",
+  "x-middleware-next",
+  "x-middleware-override-headers"
+];
+function normalizeHeaderName(name) {
+  return name.toLowerCase();
+}
+function isRequestHeaderAllowed(name, policy = {}) {
+  const key = normalizeHeaderName(name);
+  const allowed = new Set((policy.allowed ?? []).map(normalizeHeaderName));
+  if (allowed.has(key)) return true;
+  if (key.startsWith("x-middleware-")) return false;
+  const blocked = /* @__PURE__ */ new Set([
+    ...DEFAULT_BLOCKED_REQUEST_HEADERS.map(normalizeHeaderName),
+    ...(policy.blocked ?? []).map(normalizeHeaderName)
+  ]);
+  return !blocked.has(key);
+}
+function mergeRequestHeaderOverrides(target, overrides, policy = {}) {
+  const dropped = [];
+  let applied = 0;
+  overrides.forEach((value, key) => {
+    if (!isRequestHeaderAllowed(key, policy)) {
+      dropped.push(key);
+      return;
+    }
+    target.set(key, value);
+    applied++;
+  });
+  return { applied, dropped };
+}
+function headersInitToHeaders(init) {
+  return new Headers(init);
+}
+function headersDiffer(base, overrides) {
+  for (const [key, value] of overrides.entries()) {
+    if (base.get(key) !== value) return true;
+  }
+  return false;
+}
+function segmentToRegex(segment) {
+  if (segment === "**") return "(?:.*)";
+  if (segment === "*") return "[^/]+";
+  if (segment.startsWith(":")) return "[^/]+";
+  return escapeRegex(segment);
+}
+function path(pattern, options = {}) {
+  const { locales = [] } = options;
+  const localePrefix = locales.length > 0 ? `(?:(?:${locales.map(escapeRegex).join("|")})\\/)?` : "";
+  if (pattern instanceof RegExp) {
+    const body2 = pattern.source.replace(/^\^/, "").replace(/\$$/, "");
+    const needsStart = !pattern.source.startsWith("^");
+    const needsEnd = !pattern.source.endsWith("$");
+    return toStatelessRegExp(
+      new RegExp(
+        `${needsStart ? "^" : ""}${localePrefix ? `/${localePrefix}` : ""}${body2}${needsEnd ? "$" : ""}`,
+        pattern.flags
+      )
+    );
+  }
+  const normalized = (pattern.startsWith("/") ? pattern : `/${pattern}`).replace(/\/$/, "") || "/";
+  const segments = normalized.slice(1).split("/");
+  const trailingStar = segments.length > 0 && segments[segments.length - 1] === "*";
+  const suffix = trailingStar ? "(?:\\/.*)?$" : "$";
+  const body = trailingStar ? segments.slice(0, -1).map(segmentToRegex).concat("[^/]+").join("\\/") : segments.map(segmentToRegex).join("\\/");
+  return new RegExp(`^/${localePrefix}${body}${suffix}`);
+}
+function toPathRegex(matcher, options) {
+  const list = Array.isArray(matcher) ? matcher : [matcher];
+  const regexes = list.map((m) => path(m, options));
+  if (regexes.length === 1) return toStatelessRegExp(regexes[0]);
+  return toStatelessRegExp(new RegExp(`(?:${regexes.map((r) => `(?:${r.source})`).join("|")})`));
+}
+function scopeKey(scope) {
+  return `${scope.host?.source ?? "*"}::${scope.host?.flags ?? ""}|${scope.path?.source ?? "*"}::${scope.path?.flags ?? ""}`;
+}
+function assertIncludeExcludeNoOverlap(include, exclude, label) {
+  if (!include?.length || !exclude?.length) return;
+  const excluded = new Set(exclude.map(scopeKey));
+  for (const scope of include) {
+    if (excluded.has(scopeKey(scope))) {
+      throw new Error(
+        `[proxy-chain] ${label}: include and exclude share an identical scope. Remove one.`
+      );
+    }
+  }
+}
+var LEVEL_RANK = {
+  debug: 10,
+  info: 20,
+  warn: 30,
+  error: 40
+};
+function createConsoleLogger(minLevel = "info") {
+  const min = LEVEL_RANK[minLevel];
+  const write = (level) => (obj, msg) => {
+    if (LEVEL_RANK[level] < min) return;
+    if (typeof obj === "string") {
+      console[level](obj);
+      return;
+    }
+    const message = msg ?? "";
+    if (message) console[level](`[proxy-chain] ${message}`, obj);
+    else console[level]("[proxy-chain]", obj);
+  };
+  return {
+    debug: write("debug"),
+    info: write("info"),
+    warn: write("warn"),
+    error: write("error")
+  };
+}
+function formatDuration(ms) {
+  return `${ms.toFixed(2)}ms`;
+}
+function formatPipelineLine(input) {
+  const trace = input.traceId ? ` [${input.traceId.slice(0, 8)}]` : "";
+  const req = `${input.method} ${input.path}${trace}`;
+  const { name, outcome } = input;
+  switch (outcome.kind) {
+    case "passed":
+      return `[proxy-chain] \xB7 ${req} | ${name} (${formatDuration(outcome.duration)}) -> passed`;
+    case "next":
+      return `[proxy-chain] ~ ${req} | ${name} (${formatDuration(outcome.duration)}) -> headers mutated (${outcome.headers})`;
+    case "stop":
+      return `[proxy-chain] \xD7 ${req} | ${name} (${formatDuration(outcome.duration)}) -> stop ${outcome.status}`;
+  }
+}
+var RuleTimeoutError = class extends Error {
+  ruleName;
+  timeoutMs;
+  constructor(ruleName, timeoutMs) {
+    super(`[proxy-chain] ${ruleName} timed out after ${timeoutMs}ms`);
+    this.name = "RuleTimeoutError";
+    this.ruleName = ruleName;
+    this.timeoutMs = timeoutMs;
+  }
+};
+async function withRuleTimeout(promise, timeoutMs, ruleName) {
+  if (!timeoutMs || timeoutMs <= 0) return promise;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new RuleTimeoutError(ruleName, timeoutMs)), timeoutMs);
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+  }
+}
+
+// src/index.ts
+function isPathFilter(value) {
+  if (value === null || typeof value !== "object") return false;
+  if ("nextUrl" in value) return false;
+  return "include" in value || "exclude" in value || "name" in value || "pathOptions" in value;
+}
+function defineProxy(nameOrRun, maybeRun) {
+  const defaultName = typeof nameOrRun === "string" ? nameOrRun : void 0;
+  const run = typeof nameOrRun === "function" ? nameOrRun : maybeRun;
+  const proxy = ((reqOrFilter, eventOrCtx, maybeEvent) => {
+    if (isPathFilter(reqOrFilter)) {
+      return withPaths(run, {
+        ...reqOrFilter,
+        name: reqOrFilter.name ?? defaultName
+      });
+    }
+    return run(reqOrFilter, eventOrCtx, maybeEvent);
+  });
+  Object.defineProperty(proxy, "name", {
+    value: defaultName ?? "",
+    configurable: true
+  });
+  return proxy;
+}
+function resolveConfig(overrides = {}) {
+  const { logger, debug, ...rest } = overrides;
+  return {
+    createContext: () => createProxyContext(),
+    cookieMergeStrategy: "last-write-wins",
+    headerMergeStrategy: "last-write-wins",
+    debug: false,
+    ruleTimeoutMs: 0,
+    requestHeaderPolicy: {},
+    strictOverrideCheck: false,
+    ...rest,
+    ...debug !== void 0 ? { debug } : {},
+    logger: logger ?? createConsoleLogger(debug ? "debug" : "info")
+  };
+}
+function safeInternalError() {
+  return new import_server.NextResponse("Internal Server Error", {
+    status: 500,
+    headers: { "content-type": "text/plain; charset=utf-8" }
+  });
+}
+var cachedOverrideSupported = null;
+function assertOverrideMechanismSupported(strict = false) {
+  if (cachedOverrideSupported !== null) return cachedOverrideSupported;
+  try {
+    const testRes = import_server.NextResponse.next({
+      request: { headers: new Headers({ "x-proxy-chain-probe": "1" }) }
+    });
+    const isSupported = testRes.headers.get("x-middleware-next") === "1";
+    cachedOverrideSupported = isSupported;
+    if (!isSupported) {
+      const msg = "[proxy-chain] Warning: platform NextResponse.next() does not support x-middleware-next header overrides.";
+      if (strict) throw new Error(msg);
+      console.warn(msg);
+    }
+    return isSupported;
+  } catch (err) {
+    cachedOverrideSupported = false;
+    const msg = "[proxy-chain] Warning: unable to verify NextResponse request override mechanism.";
+    if (strict) throw err instanceof Error ? err : new Error(msg);
+    console.warn(msg, err);
+    return false;
+  }
+}
+function resolveRuleResult(res, requestHeaderPolicy, logger, debug) {
+  if (res == null) {
+    return { kind: "continue", responseHeaders: /* @__PURE__ */ new Map(), cookies: /* @__PURE__ */ new Map() };
+  }
+  if (isNextResult(res)) {
+    let request;
+    if (res.request) {
+      const filtered = new Headers();
+      const { dropped } = mergeRequestHeaderOverrides(
+        filtered,
+        headersInitToHeaders(res.request),
+        requestHeaderPolicy
+      );
+      if (debug && dropped.length) {
+        logger.warn({ dropped }, "blocked request header mutation");
+      }
+      if ([...filtered.keys()].length) request = filtered;
+    }
+    return {
+      kind: "continue",
+      request,
+      responseHeaders: res.headers ? responseHeaderItems(headersInitToHeaders(res.headers)) : /* @__PURE__ */ new Map(),
+      cookies: /* @__PURE__ */ new Map()
+    };
+  }
+  if (res.headers.get("x-middleware-next") === "1") {
+    let request;
+    const decoded = decodeOverriddenRequestHeaders(res.headers);
+    if ([...decoded.keys()].length > 0) {
+      const target = new Headers();
+      mergeRequestHeaderOverrides(target, decoded, requestHeaderPolicy);
+      if ([...target.keys()].length) request = target;
+    }
+    return {
+      kind: "continue",
+      request,
+      responseHeaders: responseHeaderItems(res.headers),
+      cookies: cookieItemsFromHeaders(res.headers)
+    };
+  }
+  const rewriteHeader = res.headers.get("x-middleware-rewrite");
+  if (rewriteHeader && (res.status === 200 || !res.status)) {
+    let request;
+    const decoded = decodeOverriddenRequestHeaders(res.headers);
+    if ([...decoded.keys()].length > 0) {
+      const target = new Headers();
+      mergeRequestHeaderOverrides(target, decoded, requestHeaderPolicy);
+      if ([...target.keys()].length) request = target;
+    }
+    return {
+      kind: "continue",
+      request,
+      responseHeaders: responseHeaderItems(res.headers),
+      cookies: cookieItemsFromHeaders(res.headers),
+      rewriteUrl: rewriteHeader
+    };
+  }
+  return { kind: "stop", response: res };
+}
+function proxyChain(optionsOrEntries, maybeEntries) {
+  const options = Array.isArray(optionsOrEntries) ? {} : optionsOrEntries;
+  const entries = Array.isArray(optionsOrEntries) ? optionsOrEntries : maybeEntries;
+  const config = resolveConfig(options);
+  const rules = entries.map(toRule);
+  const {
+    logger,
+    debug,
+    cookieMergeStrategy,
+    headerMergeStrategy,
+    ruleTimeoutMs,
+    requestHeaderPolicy,
+    strictOverrideCheck
+  } = config;
+  assertOverrideMechanismSupported(strictOverrideCheck);
+  for (let i = 0; i < rules.length; i++) {
+    assertIncludeExcludeNoOverlap(rules[i].include, rules[i].exclude, ruleLabel(rules[i], i));
+  }
+  return async function proxy(req, event) {
+    let ctx;
+    try {
+      ctx = config.createContext(req, event);
+    } catch (err) {
+      logger.error({ err }, "createContext threw");
+      return safeInternalError();
+    }
+    const method = req.method;
+    const pathname = req.nextUrl.pathname;
+    const traceId = req.headers.get("x-request-id") ?? req.headers.get("traceparent") ?? req.headers.get("x-b3-traceid") ?? void 0;
+    let currentReq = req;
+    let pendingRequestOverrides = null;
+    let pendingRewriteUrl = null;
+    const headerWrites = [];
+    const cookieWrites = [];
+    const materializeRequest = () => {
+      if (!pendingRequestOverrides) return currentReq;
+      if (!headersDiffer(currentReq.headers, pendingRequestOverrides)) {
+        pendingRequestOverrides = null;
+        return currentReq;
+      }
+      const merged = new Headers(currentReq.headers);
+      pendingRequestOverrides.forEach((v, k) => {
+        merged.set(k, v);
+      });
+      pendingRequestOverrides = null;
+      currentReq = new import_server.NextRequest(currentReq, { headers: merged });
+      return currentReq;
+    };
+    const appliedRequestOverrides = new Headers();
+    const queueRequestOverrides = (overrides) => {
+      if (!pendingRequestOverrides) pendingRequestOverrides = new Headers();
+      mergeRequestHeaderOverrides(pendingRequestOverrides, overrides, requestHeaderPolicy);
+      overrides.forEach((v, k) => {
+        appliedRequestOverrides.set(k, v);
+      });
+    };
+    try {
+      for (let i = 0; i < rules.length; i++) {
+        const rule = rules[i];
+        const label = ruleLabel(rule, i);
+        const activeReq = materializeRequest();
+        const reqHost = normalizeHost(
+          activeReq.headers.get("host") ?? activeReq.headers.get("x-forwarded-host")
+        );
+        if (!ruleMatches(activeReq.nextUrl.pathname, reqHost, rule)) continue;
+        const startedAt = debug ? performance.now() : 0;
+        let raw;
+        try {
+          raw = await withRuleTimeout(
+            Promise.resolve(rule.run(activeReq, ctx, event)),
+            ruleTimeoutMs,
+            label
+          );
+        } catch (err) {
+          if (config.onError) {
+            try {
+              const recovered = await config.onError(err, i, activeReq, ctx);
+              if (recovered == null) continue;
+              if (isNextResult(recovered)) {
+                raw = recovered;
+              } else if (recovered instanceof Response) {
+                headerWrites.push({
+                  ruleIndex: i,
+                  ruleName: label,
+                  items: responseHeaderItems(recovered.headers)
+                });
+                cookieWrites.push({
+                  ruleIndex: i,
+                  ruleName: label,
+                  items: cookieItemsFromHeaders(recovered.headers)
+                });
+                if (debug) {
+                  logger.debug(
+                    formatPipelineLine({
+                      method,
+                      path: pathname,
+                      name: label,
+                      traceId,
+                      outcome: {
+                        kind: "stop",
+                        duration: performance.now() - startedAt,
+                        status: recovered.status
+                      }
+                    })
+                  );
+                }
+                return finalize(
+                  recovered,
+                  headerWrites,
+                  cookieWrites,
+                  headerMergeStrategy,
+                  cookieMergeStrategy,
+                  logger,
+                  debug
+                );
+              } else {
+                continue;
+              }
+            } catch (onErrorErr) {
+              logger.error({ rule: label, err: onErrorErr }, "onError handler threw");
+              return safeInternalError();
+            }
+          } else {
+            logger.error({ rule: label, err }, "rule threw");
+            return safeInternalError();
+          }
+        }
+        const outcome = resolveRuleResult(raw, requestHeaderPolicy, logger, debug);
+        const duration = debug ? performance.now() - startedAt : 0;
+        if (outcome.kind === "continue") {
+          if (outcome.rewriteUrl) {
+            pendingRewriteUrl = outcome.rewriteUrl;
+            try {
+              const parsed = new URL(outcome.rewriteUrl);
+              currentReq.nextUrl.pathname = parsed.pathname;
+              currentReq.nextUrl.search = parsed.search;
+            } catch {
+              currentReq.nextUrl.pathname = outcome.rewriteUrl;
+            }
+          }
+          if (outcome.request) queueRequestOverrides(outcome.request);
+          if (outcome.responseHeaders.size || outcome.cookies.size) {
+            headerWrites.push({ ruleIndex: i, ruleName: label, items: outcome.responseHeaders });
+            cookieWrites.push({ ruleIndex: i, ruleName: label, items: outcome.cookies });
+          }
+          if (debug) {
+            const mutated = outcome.responseHeaders.size + outcome.cookies.size + (outcome.request ? 1 : 0) + (outcome.rewriteUrl ? 1 : 0);
+            logger.debug(
+              formatPipelineLine({
+                method,
+                path: pathname,
+                name: label,
+                traceId,
+                outcome: mutated === 0 ? { kind: "passed", duration } : { kind: "next", duration, headers: outcome.responseHeaders.size }
+              })
+            );
+          }
+          continue;
+        }
+        headerWrites.push({
+          ruleIndex: i,
+          ruleName: label,
+          items: responseHeaderItems(outcome.response.headers)
+        });
+        cookieWrites.push({
+          ruleIndex: i,
+          ruleName: label,
+          items: cookieItemsFromHeaders(outcome.response.headers)
+        });
+        if (debug) {
+          logger.debug(
+            formatPipelineLine({
+              method,
+              path: pathname,
+              name: label,
+              traceId,
+              outcome: {
+                kind: "stop",
+                duration,
+                status: outcome.response.status
+              }
+            })
+          );
+        }
+        const internalFolder = appliedRequestOverrides.get("x-internal-host-folder");
+        if (internalFolder && outcome.response.headers.has("x-middleware-rewrite")) {
+          const rawRewrite = outcome.response.headers.get("x-middleware-rewrite");
+          const cleanFolder = "/" + internalFolder.replace(/^\/+|\/+$/g, "").split("/").filter((seg) => !/^\(.*\)$/.test(seg)).join("/");
+          try {
+            const parsed = new URL(rawRewrite, currentReq.url);
+            if (!parsed.pathname.startsWith(cleanFolder)) {
+              parsed.pathname = cleanFolder + (parsed.pathname === "/" ? "" : parsed.pathname);
+              outcome.response.headers.set("x-middleware-rewrite", parsed.toString());
+            }
+          } catch {
+            if (!rawRewrite.startsWith(cleanFolder)) {
+              outcome.response.headers.set(
+                "x-middleware-rewrite",
+                cleanFolder + (rawRewrite === "/" ? "" : rawRewrite)
+              );
+            }
+          }
+        }
+        return finalize(
+          outcome.response,
+          headerWrites,
+          cookieWrites,
+          headerMergeStrategy,
+          cookieMergeStrategy,
+          logger,
+          debug
+        );
+      }
+      const finalReq = materializeRequest();
+      const internalHostFolder = appliedRequestOverrides.get("x-internal-host-folder");
+      let finalRewriteUrl = pendingRewriteUrl;
+      if (internalHostFolder) {
+        const cleanFolder = "/" + internalHostFolder.replace(/^\/+|\/+$/g, "").split("/").filter((seg) => !/^\(.*\)$/.test(seg)).join("/");
+        if (finalRewriteUrl) {
+          try {
+            const parsed = new URL(finalRewriteUrl, finalReq.url);
+            if (!parsed.pathname.startsWith(cleanFolder)) {
+              parsed.pathname = cleanFolder + (parsed.pathname === "/" ? "" : parsed.pathname);
+              finalRewriteUrl = parsed.toString();
+            }
+          } catch {
+            if (!finalRewriteUrl.startsWith(cleanFolder)) {
+              finalRewriteUrl = cleanFolder + (finalRewriteUrl === "/" ? "" : finalRewriteUrl);
+            }
+          }
+        } else {
+          const currentPath = finalReq.nextUrl.pathname;
+          if (!currentPath.startsWith(cleanFolder)) {
+            const targetUrl = finalReq.nextUrl.clone();
+            targetUrl.pathname = cleanFolder + (currentPath === "/" ? "" : currentPath);
+            finalRewriteUrl = targetUrl.toString();
+          }
+        }
+      }
+      let final;
+      if (finalRewriteUrl) {
+        const rewriteTarget = new URL(finalRewriteUrl, finalReq.url);
+        final = import_server.NextResponse.rewrite(rewriteTarget, { request: { headers: finalReq.headers } });
+      } else {
+        final = import_server.NextResponse.next({ request: { headers: finalReq.headers } });
+      }
+      return finalize(
+        final,
+        headerWrites,
+        cookieWrites,
+        headerMergeStrategy,
+        cookieMergeStrategy,
+        logger,
+        debug
+      );
+    } catch (err) {
+      logger.error({ err }, "proxy chain failed");
+      if (config.onError) {
+        try {
+          const recovered = await config.onError(err, -1, materializeRequest(), ctx);
+          if (recovered instanceof Response) return recovered;
+        } catch {
+        }
+      }
+      return safeInternalError();
+    }
+  };
+}
+function finalize(res, headerWrites, cookieWrites, headerStrategy, cookieStrategy, logger, debug) {
+  const headers = mergeWrites(headerWrites, headerStrategy, (key, winner, loser) => {
+    if (debug) logger.debug({ header: key, winner, loser }, "header conflict resolved");
+  });
+  const cookies = mergeWrites(cookieWrites, cookieStrategy, (key, winner, loser) => {
+    if (debug) logger.debug({ cookie: key, winner, loser }, "cookie conflict resolved");
+  });
+  applyMergedToResponse(res, headers, cookies);
+  return res;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_BLOCKED_REQUEST_HEADERS,
+  NEXT,
+  RuleTimeoutError,
+  applyMergedToResponse,
+  assertIncludeExcludeNoOverlap,
+  assertOverrideMechanismSupported,
+  compileScopes,
+  cookieItemsFromHeaders,
+  createConsoleLogger,
+  createProxyContext,
+  decodeOverriddenRequestHeaders,
+  defineProxy,
+  formatPipelineLine,
+  headersDiffer,
+  host,
+  isNextResult,
+  isRequestHeaderAllowed,
+  listSetCookie,
+  mergeRequestHeaderOverrides,
+  mergeWrites,
+  next,
+  normalizeHost,
+  parseCookieName,
+  path,
+  pathMatches,
+  proxyChain,
+  responseHeaderItems,
+  ruleLabel,
+  ruleMatches,
+  safeInternalError,
+  toPathRegex,
+  toRule,
+  toStatelessRegExp,
+  withPaths,
+  withRuleTimeout
+});