perf: optimize production assets and proxy-aware URLs

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrnexus/core",
-  "version": "0.2.14",
+  "version": "0.2.15",
   "type": "module",
   "main": "src/index.ts",
   "exports": {

packages/core/src/headers.ts

@@ -178,9 +178,12 @@ export function createCorsPreflightResponse(
 export function resolveRequestUrl(req: Request, trustProxy?: boolean): URL {
   const url = new URL(req.url);
   if (!trustProxy) return url;
-  const proto = req.headers.get("x-forwarded-proto");
+  const forwarded = req.headers.get("forwarded")?.split(",")[0] ?? "";
+  const forwardedProto = /(?:^|;)\s*proto=(?:"([^"]+)"|([^;\s]+))/i.exec(forwarded);
+  const forwardedHost = /(?:^|;)\s*host=(?:"([^"]+)"|([^;\s]+))/i.exec(forwarded);
+  const proto = req.headers.get("x-forwarded-proto") ?? forwardedProto?.[1] ?? forwardedProto?.[2];
   if (proto) url.protocol = (proto.split(",")[0] ?? "").trim() + ":";
-  const host = req.headers.get("x-forwarded-host");
+  const host = req.headers.get("x-forwarded-host") ?? forwardedHost?.[1] ?? forwardedHost?.[2];
   if (host) {
     const h = (host.split(",")[0] ?? "").trim();
     url.host = h;

packages/core/test/headers.test.ts

@@ -1,5 +1,5 @@
 import { test, expect } from "bun:test";
-import { withSecurityHeaders, isWebSocketOriginAllowed } from "../src/index.ts";
+import { withSecurityHeaders, isWebSocketOriginAllowed, resolveRequestUrl } from "../src/index.ts";
 
 const req = (headers: Record<string, string> = {}) => new Request("https://x/", { headers });
 
@@ -64,3 +64,11 @@ test("isWebSocketOriginAllowed blocks cross-site WS (CSWSH), allows same-origin"
     }),
   ).toBe(true);
 });
+
+test("resolveRequestUrl honors standard Forwarded headers behind trusted proxies", () => {
+  const request = new Request("http://127.0.0.1:3000/path", {
+    headers: { forwarded: 'for=192.0.2.1;proto=https;host="workroot.in"' },
+  });
+  expect(resolveRequestUrl(request, true).href).toBe("https://workroot.in/path");
+  expect(resolveRequestUrl(request, false).href).toBe("http://127.0.0.1:3000/path");
+});