perf: optimize production assets and proxy-aware URLs

packages/core/test/headers.test.ts

@@ -1,5 +1,5 @@
 import { test, expect } from "bun:test";
-import { withSecurityHeaders, isWebSocketOriginAllowed } from "../src/index.ts";
+import { withSecurityHeaders, isWebSocketOriginAllowed, resolveRequestUrl } from "../src/index.ts";
 
 const req = (headers: Record<string, string> = {}) => new Request("https://x/", { headers });
 
@@ -64,3 +64,11 @@ test("isWebSocketOriginAllowed blocks cross-site WS (CSWSH), allows same-origin"
     }),
   ).toBe(true);
 });
+
+test("resolveRequestUrl honors standard Forwarded headers behind trusted proxies", () => {
+  const request = new Request("http://127.0.0.1:3000/path", {
+    headers: { forwarded: 'for=192.0.2.1;proto=https;host="workroot.in"' },
+  });
+  expect(resolveRequestUrl(request, true).href).toBe("https://workroot.in/path");
+  expect(resolveRequestUrl(request, false).href).toBe("http://127.0.0.1:3000/path");
+});