Fix cross-request header leakage in proxy

[renan628]

Problem

The proxy temporarily replaced the shared NextResponse.next method while awaiting application middleware. Overlapping requests could inherit another visitor's headers, including a preview token. Out-of-order completion could also leave a stale wrapper installed after both requests finished.

Solution and guarantees

Replace per-request patching/restoration with a stable interceptor backed by Next's AsyncLocalStorage.

• Request isolation: every invocation gets its own scope, including nested calls, excluded routes, and requests without a matching handler.
• Bounded lifetime: the context helper owns activation and cleanup on success and failure, so detached async work cannot keep injecting an ended request's context. Application callbacks are never retried.
• Idempotent initialization: synchronous installation and a per-constructor symbol registry handle concurrent startup, ESM/CJS imports, compatible duplicate packages, and reloads without stacking wrappers.
• Conservative fallback: missing or closed context means no automatic injection; explicit headers retain native behavior. Missing required context can still make fetchContent() fail.

This isolates Croct's automatic forwarding while preserving the public API, header precedence, dependencies, and supported runtime ranges. Production changes are limited to the proxy and its internal context helper.

Validation

• Five deterministic regressions failed before the fix and pass afterward, covering both completion orders and residual contamination.
• 284 unit tests pass; proxy/context suites also pass in randomized order. Lint, TypeScript validation, and build pass.
• The simplified implementation was revalidated with real Next 16.1.7 / Node 24.21.0, production Webpack and a local content-service fixture: App/Pages Router, redirects, rewrites, cookies, and errors.
• 10,000 packaged proxy invocations, at concurrency 1/10/100, with no cross-request contamination and the heap-retention guard passing; ESM/CJS duplicates and context-module reloads also pass.

Randomizing the entire suite exposes a pre-existing console-mock order dependency in fetchContent.test.ts, reproduced independently and left outside this fix.

The integration/load harness was used locally; this PR includes only the fix and focused source regression tests. Deployment-specific staging validation remains a release step.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@croct/plug-next@211

commit: 9a8dc32