@klnap/next-proxy-chain 1.0.2 → 1.0.4

package/dist/index.cjs

@@ -20,47 +20,20 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
-  DEFAULT_BLOCKED_REQUEST_HEADERS: () => DEFAULT_BLOCKED_REQUEST_HEADERS,
-  NEXT: () => NEXT,
   RuleTimeoutError: () => RuleTimeoutError,
-  applyMergedToResponse: () => applyMergedToResponse,
-  assertIncludeExcludeNoOverlap: () => assertIncludeExcludeNoOverlap,
-  assertOverrideMechanismSupported: () => assertOverrideMechanismSupported,
-  compileScopes: () => compileScopes,
-  cookieItemsFromHeaders: () => cookieItemsFromHeaders,
-  createConsoleLogger: () => createConsoleLogger,
   createProxyContext: () => createProxyContext,
-  decodeOverriddenRequestHeaders: () => decodeOverriddenRequestHeaders,
   defineProxy: () => defineProxy,
-  finalizeResponse: () => finalizeResponse,
-  formatPipelineLine: () => formatPipelineLine,
-  headersDiffer: () => headersDiffer,
-  headersInitToHeaders: () => headersInitToHeaders,
   host: () => host,
   isNextResult: () => isNextResult,
-  isRequestHeaderAllowed: () => isRequestHeaderAllowed,
-  listSetCookie: () => listSetCookie,
-  mergeRequestHeaderOverrides: () => mergeRequestHeaderOverrides,
-  mergeWrites: () => mergeWrites,
   next: () => next,
-  normalizeHost: () => normalizeHost,
-  parseCookieName: () => parseCookieName,
   path: () => path,
-  pathMatches: () => pathMatches,
-  proxyChain: () => proxyChain,
-  resolveRuleResult: () => resolveRuleResult,
-  responseHeaderItems: () => responseHeaderItems,
-  ruleLabel: () => ruleLabel,
-  ruleMatches: () => ruleMatches,
-  safeInternalError: () => safeInternalError,
-  toPathRegex: () => toPathRegex,
-  toRule: () => toRule,
-  toStatelessRegExp: () => toStatelessRegExp,
-  withPaths: () => withPaths,
-  withRuleTimeout: () => withRuleTimeout
+  proxyChain: () => proxyChain
 });
 module.exports = __toCommonJS(index_exports);
 
+// src/core/engine.ts
+var import_server2 = require("next/server");
+
 // src/core/constants.ts
 var NEXT = /* @__PURE__ */ Symbol.for("proxy-chain.next");
 var DEFAULT_BLOCKED_REQUEST_HEADERS = Object.freeze([
@@ -84,178 +57,19 @@ var DEFAULT_BLOCKED_REQUEST_HEADERS = Object.freeze([
   "x-middleware-override-headers"
 ]);
 
+// src/core/actions.ts
+function next(options = {}) {
+  return { [NEXT]: true, ...options };
+}
+function isNextResult(value) {
+  return typeof value === "object" && value !== null && NEXT in value;
+}
+
 // src/core/context.ts
 function createProxyContext() {
   return /* @__PURE__ */ new Map();
 }
 
-// src/core/matching.ts
-var RESERVED_FN_NAMES = /* @__PURE__ */ new Set(["", "proxy", "anonymous", "run", "next"]);
-function extractMeaningfulName(value) {
-  if (!value || RESERVED_FN_NAMES.has(value)) return void 0;
-  return value;
-}
-function toStatelessRegExp(re) {
-  const flags = re.flags.replace(/[gy]/g, "");
-  return flags === re.flags ? re : new RegExp(re.source, flags);
-}
-function escapeRegex(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-function host(matcher) {
-  const list = Array.isArray(matcher) ? matcher : [matcher];
-  const parts = list.map((m) => {
-    if (m instanceof RegExp) return `(?:${toStatelessRegExp(m).source})`;
-    return `(?:${escapeRegex(m.toLowerCase())})`;
-  });
-  return toStatelessRegExp(new RegExp(`^(?:${parts.join("|")})$`, "i"));
-}
-function isScopeObject(value) {
-  return "host" in value || "path" in value;
-}
-function segmentToRegex(segment) {
-  if (segment === "**") return "(?:.*)";
-  if (segment === "*") return "[^/]+";
-  if (segment.startsWith(":")) return "[^/]+";
-  return escapeRegex(segment);
-}
-function path(pattern, options = {}) {
-  const { locales = [] } = options;
-  const localePrefix = locales.length > 0 ? `(?:(?:${locales.map(escapeRegex).join("|")})\\/)?` : "";
-  if (pattern instanceof RegExp) {
-    const body2 = pattern.source.replace(/^\^/, "").replace(/\$$/, "");
-    const needsStart = !pattern.source.startsWith("^");
-    const needsEnd = !pattern.source.endsWith("$");
-    return toStatelessRegExp(
-      new RegExp(
-        `${needsStart ? "^" : ""}${localePrefix ? `/${localePrefix}` : ""}${body2}${needsEnd ? "$" : ""}`,
-        pattern.flags
-      )
-    );
-  }
-  const normalized = (pattern.startsWith("/") ? pattern : `/${pattern}`).replace(/\/$/, "") || "/";
-  const segments = normalized.slice(1).split("/");
-  const trailingStar = segments.length > 0 && segments[segments.length - 1] === "*";
-  const suffix = trailingStar ? "(?:\\/.*)?$" : "$";
-  const body = trailingStar ? segments.slice(0, -1).map(segmentToRegex).concat("[^/]+").join("\\/") : segments.map(segmentToRegex).join("\\/");
-  return new RegExp(`^/${localePrefix}${body}${suffix}`);
-}
-function toPathRegex(matcher, options) {
-  const list = Array.isArray(matcher) ? matcher : [matcher];
-  const regexes = list.map((m) => path(m, options));
-  if (regexes.length === 1) return toStatelessRegExp(regexes[0]);
-  return toStatelessRegExp(new RegExp(`(?:${regexes.map((r) => `(?:${r.source})`).join("|")})`));
-}
-function compileScopes(input, pathOptions) {
-  if (input == null) return void 0;
-  const list = Array.isArray(input) ? input : [input];
-  const compilePath = (matcher) => {
-    if (Array.isArray(matcher)) {
-      const parts = matcher.map(
-        (m) => typeof m === "string" ? path(m, pathOptions) : toStatelessRegExp(m)
-      );
-      if (parts.length === 1) return parts[0];
-      return toStatelessRegExp(new RegExp(`(?:${parts.map((r) => `(?:${r.source})`).join("|")})`));
-    }
-    return typeof matcher === "string" ? path(matcher, pathOptions) : toStatelessRegExp(matcher);
-  };
-  const compiled = [];
-  for (const item of list) {
-    if (typeof item === "string" || item instanceof RegExp) {
-      compiled.push({ path: compilePath(item) });
-      continue;
-    }
-    if (item && typeof item === "object" && isScopeObject(item)) {
-      if (item.host == null && item.path == null) {
-        throw new Error("[proxy-chain] scope needs at least `host` or `path`");
-      }
-      compiled.push({
-        host: item.host != null ? host(item.host) : void 0,
-        path: item.path != null ? compilePath(item.path) : void 0
-      });
-      continue;
-    }
-    throw new Error("[proxy-chain] invalid include/exclude scope");
-  }
-  return compiled;
-}
-function scopeMatches(pathname, hostname, scope) {
-  if (scope.host) {
-    if (!hostname || !scope.host.test(hostname)) return false;
-  }
-  if (scope.path) {
-    if (!scope.path.test(pathname)) return false;
-  }
-  return true;
-}
-function toRule(entry) {
-  if (typeof entry === "function") {
-    const name2 = extractMeaningfulName(entry.name);
-    return name2 ? { run: entry, name: name2 } : { run: entry };
-  }
-  const rule = entry;
-  const runName = typeof rule.run === "function" ? extractMeaningfulName(rule.run.name) : void 0;
-  const name = extractMeaningfulName(rule.name) ?? runName;
-  const harden = (scopes) => scopes?.map((s) => ({
-    host: s.host ? toStatelessRegExp(s.host) : void 0,
-    path: s.path ? toStatelessRegExp(s.path) : void 0
-  }));
-  return {
-    ...rule,
-    name: name ?? void 0,
-    include: harden(rule.include),
-    exclude: harden(rule.exclude)
-  };
-}
-function ruleLabel(rule, index) {
-  const runName = typeof rule.run === "function" ? extractMeaningfulName(rule.run.name) : void 0;
-  return extractMeaningfulName(rule.name) ?? runName ?? `rule#${index}`;
-}
-function withPaths(entry, filter) {
-  const base = toRule(entry);
-  const opts = filter.pathOptions;
-  const include = compileScopes(filter.include, opts);
-  const exclude = compileScopes(filter.exclude, opts);
-  const name = filter.name ?? base.name;
-  assertIncludeExcludeNoOverlap(include, exclude, name ?? "proxy");
-  return { run: base.run, include, exclude, name };
-}
-function ruleMatches(pathname, hostname, rule) {
-  if (rule.exclude?.some((scope) => scopeMatches(pathname, hostname, scope))) return false;
-  if (rule.include && !rule.include.some((scope) => scopeMatches(pathname, hostname, scope))) {
-    return false;
-  }
-  return true;
-}
-function pathMatches(pathname, rule) {
-  return ruleMatches(pathname, null, rule);
-}
-function normalizeHost(raw) {
-  if (!raw) return null;
-  const first = raw.split(",")[0]?.trim().toLowerCase();
-  if (!first) return null;
-  if (first.startsWith("[")) {
-    const end = first.indexOf("]");
-    return end === -1 ? first : first.slice(1, end);
-  }
-  const withoutPort = first.replace(/:\d+$/, "");
-  return withoutPort || null;
-}
-function scopeKey(scope) {
-  return `${scope.host?.source ?? "*"}::${scope.host?.flags ?? ""}|${scope.path?.source ?? "*"}::${scope.path?.flags ?? ""}`;
-}
-function assertIncludeExcludeNoOverlap(include, exclude, label) {
-  if (!include?.length || !exclude?.length) return;
-  const excluded = new Set(exclude.map(scopeKey));
-  for (const scope of include) {
-    if (excluded.has(scopeKey(scope))) {
-      throw new Error(
-        `[proxy-chain] ${label}: include and exclude share an identical scope. Remove one.`
-      );
-    }
-  }
-}
-
 // src/core/headers.ts
 function normalizeHeaderName(name) {
   return name.toLowerCase();
@@ -298,15 +112,32 @@ function parseCookieName(setCookie) {
   return (eq === -1 ? setCookie : setCookie.slice(0, eq)).trim();
 }
 function listSetCookie(headers) {
-  const extended = headers;
-  if (typeof extended.getSetCookie === "function") return extended.getSetCookie();
+  if (typeof headers.getSetCookie === "function") return headers.getSetCookie();
   const single = headers.get("set-cookie");
   return single ? [single] : [];
 }
+function cookieAttribute(setCookie, name) {
+  const parts = setCookie.split(";");
+  for (let i = 1; i < parts.length; i++) {
+    const piece = parts[i];
+    if (!piece) continue;
+    const eq = piece.indexOf("=");
+    const key = (eq === -1 ? piece : piece.slice(0, eq)).trim().toLowerCase();
+    if (key !== name) continue;
+    return (eq === -1 ? "" : piece.slice(eq + 1)).trim();
+  }
+  return "";
+}
+function cookieIdentityKey(setCookie) {
+  const name = parseCookieName(setCookie);
+  const path2 = cookieAttribute(setCookie, "path");
+  const domain = cookieAttribute(setCookie, "domain").toLowerCase();
+  return `${name};domain=${domain};path=${path2}`;
+}
 function cookieItemsFromHeaders(headers) {
   const map = /* @__PURE__ */ new Map();
   for (const value of listSetCookie(headers)) {
-    map.set(parseCookieName(value), value);
+    map.set(cookieIdentityKey(value), value);
   }
   return map;
 }
@@ -366,7 +197,12 @@ function mergeWrites(writes, strategy, onConflict) {
   }
   return resolved;
 }
-function applyMergedToResponse(res, headers, cookies) {
+function applyMergedToResponse(res, headers, cookies, dropHeaders) {
+  if (dropHeaders) {
+    for (const key of dropHeaders) {
+      if (!headers.has(key)) res.headers.delete(key);
+    }
+  }
   for (const [key, value] of headers) {
     res.headers.set(key, value);
   }
@@ -376,14 +212,6 @@ function applyMergedToResponse(res, headers, cookies) {
   }
 }
 
-// src/core/actions.ts
-function next(options = {}) {
-  return { [NEXT]: true, ...options };
-}
-function isNextResult(value) {
-  return typeof value === "object" && value !== null && NEXT in value;
-}
-
 // src/core/logger.ts
 var LEVEL_RANK = {
   debug: 10,
@@ -427,27 +255,180 @@ function formatPipelineLine(input) {
   }
 }
 
-// src/core/timeout.ts
-var RuleTimeoutError = class extends Error {
-  ruleName;
-  timeoutMs;
-  constructor(ruleName, timeoutMs) {
-    super(`[proxy-chain] ${ruleName} timed out after ${timeoutMs}ms`);
-    this.name = "RuleTimeoutError";
-    this.ruleName = ruleName;
-    this.timeoutMs = timeoutMs;
-  }
-};
-async function withRuleTimeout(promise, timeoutMs, ruleName) {
-  if (!timeoutMs || timeoutMs <= 0) return promise;
-  let timer;
-  const timeout = new Promise((_, reject) => {
-    timer = setTimeout(() => reject(new RuleTimeoutError(ruleName, timeoutMs)), timeoutMs);
+// src/core/matching.ts
+var RESERVED_FN_NAMES = /* @__PURE__ */ new Set(["", "proxy", "anonymous", "run", "next"]);
+function extractMeaningfulName(value) {
+  if (!value || RESERVED_FN_NAMES.has(value)) return void 0;
+  return value;
+}
+function toStatelessRegExp(re) {
+  const flags = re.flags.replace(/[gy]/g, "");
+  return flags === re.flags ? re : new RegExp(re.source, flags);
+}
+function escapeRegex(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function hostGlobToRegex(value) {
+  return escapeRegex(value.toLowerCase()).replace(/\\\*/g, "[^.]+");
+}
+function host(matcher) {
+  const list = Array.isArray(matcher) ? matcher : [matcher];
+  const parts = list.map((m) => {
+    if (m instanceof RegExp) return `(?:${toStatelessRegExp(m).source})`;
+    return `(?:${hostGlobToRegex(m)})`;
   });
-  try {
-    return await Promise.race([promise, timeout]);
-  } finally {
-    if (timer !== void 0) clearTimeout(timer);
+  return toStatelessRegExp(new RegExp(`^(?:${parts.join("|")})$`, "i"));
+}
+function isScopeObject(value) {
+  return "host" in value || "path" in value;
+}
+function segmentToRegex(segment) {
+  if (segment === "**") return "(?:.*)";
+  if (segment === "*") return "[^/]+";
+  if (segment.startsWith(":")) return "[^/]+";
+  return escapeRegex(segment);
+}
+function hasEndAnchor(source) {
+  if (!source.endsWith("$")) return false;
+  let slashes = 0;
+  for (let i = source.length - 2; i >= 0 && source[i] === "\\"; i--) slashes++;
+  return slashes % 2 === 0;
+}
+function compileRegexPath(pattern) {
+  let source = pattern.source;
+  const hasStart = source.startsWith("^");
+  const hasEnd = hasEndAnchor(source);
+  if (hasStart) source = source.slice(1);
+  if (hasEnd) source = source.slice(0, -1);
+  const wrapFull = !hasStart && !hasEnd;
+  const start = hasStart || wrapFull ? "^" : "";
+  const end = hasEnd || wrapFull ? "$" : "";
+  return toStatelessRegExp(new RegExp(`${start}${source}${end}`, pattern.flags));
+}
+function compileStringPath(pattern) {
+  const normalized = (pattern.startsWith("/") ? pattern : `/${pattern}`).replace(/\/$/, "") || "/";
+  const segments = normalized === "/" ? [] : normalized.slice(1).split("/");
+  const last = segments[segments.length - 1];
+  const trailingStar = last === "*";
+  const trailingGlobstar = last === "**";
+  let pathPattern;
+  if (normalized === "/") {
+    pathPattern = "/";
+  } else if (trailingStar) {
+    const prefix = segments.slice(0, -1).map(segmentToRegex).join("/");
+    pathPattern = prefix ? `/${prefix}/[^/]+` : `/[^/]+`;
+  } else if (trailingGlobstar) {
+    const prefix = segments.slice(0, -1).map(segmentToRegex).join("/");
+    pathPattern = prefix ? `/${prefix}(?:/.*)?` : `/(?:.*)?`;
+  } else {
+    pathPattern = `/${segments.map(segmentToRegex).join("/")}`;
+  }
+  return new RegExp(`^${pathPattern}$`);
+}
+function path(pattern) {
+  if (pattern instanceof RegExp) return compileRegexPath(pattern);
+  return compileStringPath(pattern);
+}
+function toPathRegex(matcher) {
+  const list = Array.isArray(matcher) ? matcher : [matcher];
+  const regexes = list.map((m) => path(m));
+  if (regexes.length === 1) return toStatelessRegExp(regexes[0]);
+  return toStatelessRegExp(new RegExp(`(?:${regexes.map((r) => `(?:${r.source})`).join("|")})`));
+}
+function compileScopes(input) {
+  if (input == null) return void 0;
+  const list = Array.isArray(input) ? input : [input];
+  const compilePath = (matcher) => toPathRegex(matcher);
+  const compiled = [];
+  for (const item of list) {
+    if (typeof item === "string" || item instanceof RegExp) {
+      compiled.push({ path: compilePath(item) });
+      continue;
+    }
+    if (item && typeof item === "object" && isScopeObject(item)) {
+      if (item.host == null && item.path == null) {
+        throw new Error("[proxy-chain] scope needs at least `host` or `path`");
+      }
+      compiled.push({
+        host: item.host != null ? host(item.host) : void 0,
+        path: item.path != null ? compilePath(item.path) : void 0
+      });
+      continue;
+    }
+    throw new Error("[proxy-chain] invalid include/exclude scope");
+  }
+  return compiled;
+}
+function scopeMatches(pathname, hostname, scope) {
+  if (scope.host) {
+    if (!hostname || !scope.host.test(hostname)) return false;
+  }
+  if (scope.path) {
+    if (!scope.path.test(pathname)) return false;
+  }
+  return true;
+}
+function toRule(entry) {
+  if (typeof entry === "function") {
+    const name2 = extractMeaningfulName(entry.name);
+    return name2 ? { run: entry, name: name2 } : { run: entry };
+  }
+  const rule = entry;
+  const runName = typeof rule.run === "function" ? extractMeaningfulName(rule.run.name) : void 0;
+  const name = extractMeaningfulName(rule.name) ?? runName;
+  const harden = (scopes) => scopes?.map((s) => ({
+    host: s.host ? toStatelessRegExp(s.host) : void 0,
+    path: s.path ? toStatelessRegExp(s.path) : void 0
+  }));
+  return {
+    ...rule,
+    name: name ?? void 0,
+    include: harden(rule.include),
+    exclude: harden(rule.exclude)
+  };
+}
+function ruleLabel(rule, index) {
+  const runName = typeof rule.run === "function" ? extractMeaningfulName(rule.run.name) : void 0;
+  return extractMeaningfulName(rule.name) ?? runName ?? `rule#${index}`;
+}
+function withPaths(entry, filter) {
+  const base = toRule(entry);
+  const include = compileScopes(filter.include);
+  const exclude = compileScopes(filter.exclude);
+  const name = filter.name ?? base.name;
+  assertIncludeExcludeNoOverlap(include, exclude, name ?? "proxy");
+  return { run: base.run, include, exclude, name };
+}
+function ruleMatches(pathname, hostname, rule) {
+  if (rule.exclude?.some((scope) => scopeMatches(pathname, hostname, scope))) return false;
+  if (rule.include && !rule.include.some((scope) => scopeMatches(pathname, hostname, scope))) {
+    return false;
+  }
+  return true;
+}
+function normalizeHost(raw) {
+  if (!raw) return null;
+  const first = raw.split(",")[0]?.trim().toLowerCase();
+  if (!first) return null;
+  if (first.startsWith("[")) {
+    const end = first.indexOf("]");
+    return end === -1 ? first : first.slice(1, end);
+  }
+  const withoutPort = first.replace(/:\d+$/, "");
+  return withoutPort || null;
+}
+function scopeKey(scope) {
+  return `${scope.host?.source ?? "*"}::${scope.host?.flags ?? ""}|${scope.path?.source ?? "*"}::${scope.path?.flags ?? ""}`;
+}
+function assertIncludeExcludeNoOverlap(include, exclude, label) {
+  if (!include?.length || !exclude?.length) return;
+  const excluded = new Set(exclude.map(scopeKey));
+  for (const scope of include) {
+    if (excluded.has(scopeKey(scope))) {
+      throw new Error(
+        `[proxy-chain] ${label}: include and exclude share an identical scope. Remove one.`
+      );
+    }
   }
 }
 
@@ -459,26 +440,42 @@ function safeInternalError() {
     headers: { "content-type": "text/plain; charset=utf-8" }
   });
 }
-var cachedOverrideSupported = null;
+var UNSUPPORTED_OVERRIDE_MSG = "[proxy-chain] Warning: platform NextResponse.next() does not support x-middleware-next header overrides.";
+var VERIFY_OVERRIDE_MSG = "[proxy-chain] Warning: unable to verify NextResponse request override mechanism.";
+var cachedOverrideProbe = null;
+var overrideProbeForTests = null;
+function runOverrideProbe() {
+  if (overrideProbeForTests) return overrideProbeForTests();
+  const testRes = import_server.NextResponse.next({
+    request: { headers: new Headers({ "x-proxy-chain-probe": "1" }) }
+  });
+  return testRes.headers.get("x-middleware-next") === "1";
+}
+function throwForCachedProbe(probe) {
+  if (probe.kind === "unsupported") throw new Error(UNSUPPORTED_OVERRIDE_MSG);
+  throw probe.err instanceof Error ? probe.err : new Error(VERIFY_OVERRIDE_MSG);
+}
+function resolveCachedProbe(probe, strict) {
+  if (probe.kind === "supported") return true;
+  if (strict) throwForCachedProbe(probe);
+  return false;
+}
 function assertOverrideMechanismSupported(strict = false) {
-  if (cachedOverrideSupported !== null) return cachedOverrideSupported;
+  if (cachedOverrideProbe !== null) return resolveCachedProbe(cachedOverrideProbe, strict);
   try {
-    const testRes = import_server.NextResponse.next({
-      request: { headers: new Headers({ "x-proxy-chain-probe": "1" }) }
-    });
-    const isSupported = testRes.headers.get("x-middleware-next") === "1";
-    cachedOverrideSupported = isSupported;
-    if (!isSupported) {
-      const msg = "[proxy-chain] Warning: platform NextResponse.next() does not support x-middleware-next header overrides.";
-      if (strict) throw new Error(msg);
-      console.warn(msg);
+    const isSupported = runOverrideProbe();
+    if (isSupported) {
+      cachedOverrideProbe = { kind: "supported" };
+      return true;
     }
-    return isSupported;
+    cachedOverrideProbe = { kind: "unsupported" };
+    if (strict) throw new Error(UNSUPPORTED_OVERRIDE_MSG);
+    console.warn(UNSUPPORTED_OVERRIDE_MSG);
+    return false;
   } catch (err) {
-    cachedOverrideSupported = false;
-    const msg = "[proxy-chain] Warning: unable to verify NextResponse request override mechanism.";
-    if (strict) throw err instanceof Error ? err : new Error(msg);
-    console.warn(msg, err);
+    cachedOverrideProbe = { kind: "error", err };
+    if (strict) throw err instanceof Error ? err : new Error(VERIFY_OVERRIDE_MSG);
+    console.warn(VERIFY_OVERRIDE_MSG, err);
     return false;
   }
 }
@@ -500,11 +497,12 @@ function resolveRuleResult(res, requestHeaderPolicy, logger, debug) {
       }
       if ([...filtered.keys()].length) request = filtered;
     }
+    const headerInit = res.headers ? headersInitToHeaders(res.headers) : void 0;
     return {
       kind: "continue",
       request,
-      responseHeaders: res.headers ? responseHeaderItems(headersInitToHeaders(res.headers)) : /* @__PURE__ */ new Map(),
-      cookies: /* @__PURE__ */ new Map()
+      responseHeaders: headerInit ? responseHeaderItems(headerInit) : /* @__PURE__ */ new Map(),
+      cookies: headerInit ? cookieItemsFromHeaders(headerInit) : /* @__PURE__ */ new Map()
     };
   }
   if (res.headers.get("x-middleware-next") === "1") {
@@ -548,16 +546,57 @@ function finalizeResponse(res, headerWrites, cookieWrites, headerStrategy, cooki
   const cookies = mergeWrites(cookieWrites, cookieStrategy, (key, winner, loser) => {
     if (debug) logger.debug({ cookie: key, winner, loser }, "cookie conflict resolved");
   });
-  applyMergedToResponse(res, headers, cookies);
+  const seenHeaders = /* @__PURE__ */ new Set();
+  for (const write of headerWrites) {
+    for (const key of write.items.keys()) seenHeaders.add(key);
+  }
+  const dropHeaders = [];
+  for (const key of seenHeaders) {
+    if (!headers.has(key)) dropHeaders.push(key);
+  }
+  applyMergedToResponse(res, headers, cookies, dropHeaders);
   return res;
 }
 
+// src/core/timeout.ts
+var RuleTimeoutError = class extends Error {
+  ruleName;
+  timeoutMs;
+  constructor(ruleName, timeoutMs) {
+    super(`[proxy-chain] ${ruleName} timed out after ${timeoutMs}ms`);
+    this.name = "RuleTimeoutError";
+    this.ruleName = ruleName;
+    this.timeoutMs = timeoutMs;
+  }
+};
+function assertFiniteRuleTimeoutMs(ruleTimeoutMs) {
+  if (ruleTimeoutMs != null && !Number.isFinite(ruleTimeoutMs)) {
+    throw new RangeError(
+      `[proxy-chain] ruleTimeoutMs must be a finite positive number, got ${ruleTimeoutMs}`
+    );
+  }
+}
+async function withRuleTimeout(promise, timeoutMs, ruleName) {
+  assertFiniteRuleTimeoutMs(timeoutMs);
+  if (timeoutMs == null || timeoutMs <= 0) return promise;
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => reject(new RuleTimeoutError(ruleName, timeoutMs)), timeoutMs);
+  });
+  try {
+    return await Promise.race([promise, timeout]);
+  } finally {
+    if (timer !== void 0) clearTimeout(timer);
+    void promise.catch(() => {
+    });
+  }
+}
+
 // src/core/engine.ts
-var import_server2 = require("next/server");
 function isPathFilter(value) {
   if (value === null || typeof value !== "object") return false;
   if ("nextUrl" in value) return false;
-  return "include" in value || "exclude" in value || "name" in value || "pathOptions" in value;
+  return "include" in value || "exclude" in value || "name" in value;
 }
 function defineProxy(nameOrRun, maybeRun) {
   const defaultName = typeof nameOrRun === "string" ? nameOrRun : void 0;
@@ -577,25 +616,47 @@ function defineProxy(nameOrRun, maybeRun) {
   });
   return proxy;
 }
-function resolveConfig(overrides = {}) {
-  const { logger, debug, ...rest } = overrides;
-  return {
-    createContext: () => createProxyContext(),
+function resolveConfig(overrides, fallbackCreateContext) {
+  const { logger, debug, createContext, ...rest } = overrides;
+  const config = {
+    createContext: createContext ?? fallbackCreateContext,
     cookieMergeStrategy: "last-write-wins",
     headerMergeStrategy: "last-write-wins",
     debug: false,
     ruleTimeoutMs: 0,
     requestHeaderPolicy: {},
     strictOverrideCheck: false,
+    hostFolderHeader: void 0,
     ...rest,
     ...debug !== void 0 ? { debug } : {},
     logger: logger ?? createConsoleLogger(debug ? "debug" : "info")
   };
+  assertFiniteRuleTimeoutMs(config.ruleTimeoutMs);
+  return config;
+}
+function physicalFolderPrefix(raw) {
+  return "/" + raw.replace(/^\/+|\/+$/g, "").split("/").filter((seg) => !/^\(.*\)$/.test(seg)).join("/");
+}
+function applyFolderPrefix(rewriteUrl, folder, baseUrl) {
+  try {
+    const parsed = new URL(rewriteUrl, baseUrl);
+    if (!parsed.pathname.startsWith(folder)) {
+      parsed.pathname = folder + (parsed.pathname === "/" ? "" : parsed.pathname);
+      return parsed.toString();
+    }
+    return rewriteUrl;
+  } catch {
+    if (!rewriteUrl.startsWith(folder)) {
+      return folder + (rewriteUrl === "/" ? "" : rewriteUrl);
+    }
+    return rewriteUrl;
+  }
 }
 function proxyChain(optionsOrEntries, maybeEntries) {
   const options = Array.isArray(optionsOrEntries) ? {} : optionsOrEntries;
-  const entries = Array.isArray(optionsOrEntries) ? optionsOrEntries : maybeEntries;
-  const config = resolveConfig(options);
+  const entries = (Array.isArray(optionsOrEntries) ? optionsOrEntries : maybeEntries) ?? [];
+  const fallbackCreateContext = createProxyContext;
+  const config = resolveConfig(options, fallbackCreateContext);
   const rules = entries.map(toRule);
   const {
     logger,
@@ -604,7 +665,8 @@ function proxyChain(optionsOrEntries, maybeEntries) {
     headerMergeStrategy,
     ruleTimeoutMs,
     requestHeaderPolicy,
-    strictOverrideCheck
+    strictOverrideCheck,
+    hostFolderHeader
   } = config;
   assertOverrideMechanismSupported(strictOverrideCheck);
   for (let i = 0; i < rules.length; i++) {
@@ -670,7 +732,7 @@ function proxyChain(optionsOrEntries, maybeEntries) {
           if (config.onError) {
             try {
               const recovered = await config.onError(err, i, activeReq, ctx);
-              if (recovered == null) continue;
+              if (recovered == null) return safeInternalError();
               if (isNextResult(recovered)) {
                 raw = recovered;
               } else if (recovered instanceof Response) {
@@ -709,7 +771,7 @@ function proxyChain(optionsOrEntries, maybeEntries) {
                   debug
                 );
               } else {
-                continue;
+                return safeInternalError();
               }
             } catch (onErrorErr) {
               logger.error({ rule: label, err: onErrorErr }, "onError handler threw");
@@ -725,6 +787,9 @@ function proxyChain(optionsOrEntries, maybeEntries) {
         if (outcome.kind === "continue") {
           if (outcome.rewriteUrl) {
             pendingRewriteUrl = outcome.rewriteUrl;
+            if (currentReq === req) {
+              currentReq = new import_server2.NextRequest(currentReq);
+            }
             try {
               const parsed = new URL(outcome.rewriteUrl);
               currentReq.nextUrl.pathname = parsed.pathname;
@@ -777,24 +842,14 @@ function proxyChain(optionsOrEntries, maybeEntries) {
             })
           );
         }
-        const internalFolder = appliedRequestOverrides.get("x-internal-host-folder");
+        const internalFolder = hostFolderHeader ? appliedRequestOverrides.get(hostFolderHeader) : null;
         if (internalFolder && outcome.response.headers.has("x-middleware-rewrite")) {
           const rawRewrite = outcome.response.headers.get("x-middleware-rewrite");
-          const cleanFolder = "/" + internalFolder.replace(/^\/+|\/+$/g, "").split("/").filter((seg) => !/^\(.*\)$/.test(seg)).join("/");
-          try {
-            const parsed = new URL(rawRewrite, currentReq.url);
-            if (!parsed.pathname.startsWith(cleanFolder)) {
-              parsed.pathname = cleanFolder + (parsed.pathname === "/" ? "" : parsed.pathname);
-              outcome.response.headers.set("x-middleware-rewrite", parsed.toString());
-            }
-          } catch {
-            if (!rawRewrite.startsWith(cleanFolder)) {
-              outcome.response.headers.set(
-                "x-middleware-rewrite",
-                cleanFolder + (rawRewrite === "/" ? "" : rawRewrite)
-              );
-            }
-          }
+          const cleanFolder = physicalFolderPrefix(internalFolder);
+          outcome.response.headers.set(
+            "x-middleware-rewrite",
+            applyFolderPrefix(rawRewrite, cleanFolder, currentReq.url)
+          );
         }
         return finalizeResponse(
           outcome.response,
@@ -807,22 +862,12 @@ function proxyChain(optionsOrEntries, maybeEntries) {
         );
       }
       const finalReq = materializeRequest();
-      const internalHostFolder = appliedRequestOverrides.get("x-internal-host-folder");
+      const internalHostFolder = hostFolderHeader ? appliedRequestOverrides.get(hostFolderHeader) : null;
       let finalRewriteUrl = pendingRewriteUrl;
       if (internalHostFolder) {
-        const cleanFolder = "/" + internalHostFolder.replace(/^\/+|\/+$/g, "").split("/").filter((seg) => !/^\(.*\)$/.test(seg)).join("/");
+        const cleanFolder = physicalFolderPrefix(internalHostFolder);
         if (finalRewriteUrl) {
-          try {
-            const parsed = new URL(finalRewriteUrl, finalReq.url);
-            if (!parsed.pathname.startsWith(cleanFolder)) {
-              parsed.pathname = cleanFolder + (parsed.pathname === "/" ? "" : parsed.pathname);
-              finalRewriteUrl = parsed.toString();
-            }
-          } catch {
-            if (!finalRewriteUrl.startsWith(cleanFolder)) {
-              finalRewriteUrl = cleanFolder + (finalRewriteUrl === "/" ? "" : finalRewriteUrl);
-            }
-          }
+          finalRewriteUrl = applyFolderPrefix(finalRewriteUrl, cleanFolder, finalReq.url);
         } else {
           const currentPath = finalReq.nextUrl.pathname;
           if (!currentPath.startsWith(cleanFolder)) {
@@ -863,42 +908,12 @@ function proxyChain(optionsOrEntries, maybeEntries) {
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  DEFAULT_BLOCKED_REQUEST_HEADERS,
-  NEXT,
   RuleTimeoutError,
-  applyMergedToResponse,
-  assertIncludeExcludeNoOverlap,
-  assertOverrideMechanismSupported,
-  compileScopes,
-  cookieItemsFromHeaders,
-  createConsoleLogger,
   createProxyContext,
-  decodeOverriddenRequestHeaders,
   defineProxy,
-  finalizeResponse,
-  formatPipelineLine,
-  headersDiffer,
-  headersInitToHeaders,
   host,
   isNextResult,
-  isRequestHeaderAllowed,
-  listSetCookie,
-  mergeRequestHeaderOverrides,
-  mergeWrites,
   next,
-  normalizeHost,
-  parseCookieName,
   path,
-  pathMatches,
-  proxyChain,
-  resolveRuleResult,
-  responseHeaderItems,
-  ruleLabel,
-  ruleMatches,
-  safeInternalError,
-  toPathRegex,
-  toRule,
-  toStatelessRegExp,
-  withPaths,
-  withRuleTimeout
+  proxyChain
 });