9router-proxy 0.6.11 → 0.6.12

package/app/node_modules/next/dist/server/route-modules/pages/pages-handler.js

@@ -38,7 +38,6 @@ function _interop_require_default(obj) {
 }
 const getHandler = ({ srcPage: originalSrcPage, config, userland, routeModule, isFallbackError, getStaticPaths, getStaticProps, getServerSideProps })=>{
     return async function handler(req, res, ctx) {
-        var _serverFilesManifest_config_experimental, _serverFilesManifest_config, _parsedUrl_pathname;
         if (ctx.requestMeta) {
             (0, _requestmeta.setRequestMeta)(req, ctx.requestMeta);
         }
@@ -56,6 +55,23 @@ const getHandler = ({ srcPage: originalSrcPage, config, userland, routeModule, i
             srcPage = '/';
         }
         const multiZoneDraftMode = process.env.__NEXT_MULTI_ZONE_DRAFT_MODE;
+        // Registering `instrumentation.ts` usually installs the tracer provider, so
+        // do it before starting the request span. The span is started before
+        // `prepare`, so route module preparation is part of the request's trace.
+        // When this request triggers registration, the lifecycle spans of
+        // `instrumentation.ts` are emitted inside the request span.
+        const { instrumentation } = await routeModule.ensureInstrumentation(req, {
+            deferSpans: true
+        });
+        return routeModule.traceRequest(req, {
+            tracer: (0, _tracer.getTracer)(),
+            spanName: `${req.method || 'GET'} ${srcPage}`,
+            httpTarget: req.url,
+            instrumentation
+        }, (requestSpan, requestRootSpan)=>handleRequest(req, res, ctx, srcPage, multiZoneDraftMode, requestSpan, requestRootSpan));
+    };
+    async function handleRequest(req, res, ctx, srcPage, multiZoneDraftMode, requestSpan, requestRootSpan) {
+        var _serverFilesManifest_config_experimental, _serverFilesManifest_config, _parsedUrl_pathname;
         const prepareResult = await routeModule.prepare(req, res, {
             srcPage,
             multiZoneDraftMode
@@ -133,7 +149,6 @@ const getHandler = ({ srcPage: originalSrcPage, config, userland, routeModule, i
             isIsrFallback = false;
         }
         const tracer = (0, _tracer.getTracer)();
-        const activeSpan = tracer.getActiveScopeSpan();
         const isWrappedByNextServer = Boolean(routerServerContext == null ? void 0 : routerServerContext.isWrappedByNextServer);
         const method = req.method || 'GET';
         const resolvedUrl = (0, _formaturl.formatUrl)({
@@ -141,7 +156,6 @@ const getHandler = ({ srcPage: originalSrcPage, config, userland, routeModule, i
             // make sure to only add query values from original URL
             query: hasStaticProps ? {} : originalQuery
         });
-        let parentSpan;
         const handleResponse = async (span)=>{
             const responseGenerator = async ({ previousCacheEntry })=>{
                 var _previousCacheEntry_value;
@@ -545,32 +559,24 @@ const getHandler = ({ srcPage: originalSrcPage, config, userland, routeModule, i
                         'next.span_name': name
                     });
                     span.updateName(name);
-                    // Propagate http.route to the parent span if one exists
-                    // (e.g. a platform-created HTTP span in adapter
+                    // Propagate http.route to the request's root span if it isn't
+                    // the request span (e.g. a platform-created HTTP span in adapter
                     // deployments).
-                    if (parentSpan && parentSpan !== span) {
-                        parentSpan.setAttribute('http.route', route);
-                        parentSpan.updateName(name);
+                    if (requestRootSpan && requestRootSpan !== span) {
+                        requestRootSpan.setAttribute('http.route', route);
+                        requestRootSpan.updateName(name);
                     }
                 })();
             }
         };
-        // TODO: activeSpan code path is for when wrapped by
-        // next-server can be removed when this is no longer used
-        if (isWrappedByNextServer && activeSpan) {
-            await handleResponse(activeSpan);
-        } else {
-            parentSpan = tracer.getActiveScopeSpan();
-            await tracer.withPropagatedContext(req.headers, ()=>tracer.trace(_constants.BaseServerSpan.handleRequest, {
-                    spanName: `${method} ${srcPage}`,
-                    kind: _tracer.SpanKind.SERVER,
-                    attributes: {
-                        'http.method': method,
-                        'http.target': req.url
-                    }
-                }, handleResponse), undefined, !isWrappedByNextServer);
+        // When invoked directly, the request span was started before `prepare`;
+        // record the request target as normalized by it. next-server's request
+        // span already has it.
+        if (!isWrappedByNextServer && req.url !== undefined) {
+            requestSpan == null ? void 0 : requestSpan.setAttribute('http.target', req.url);
         }
-    };
+        await handleResponse(requestSpan);
+    }
 };
 
 //# sourceMappingURL=pages-handler.js.map

package/app/node_modules/next/dist/server/route-modules/route-module.js

@@ -356,33 +356,110 @@ class RouteModule {
             deploymentId
         };
     }
+    /**
+   * Runs a route handler that was invoked directly (e.g. by an adapter or a
+   * deployment, without next-server) inside its request span
+   * (`BaseServer.handleRequest`).
+   *
+   * The span is started before `fn` calls `prepare`, so everything done for
+   * the request, including route module preparation, belongs to the request's
+   * trace. When the handler is wrapped by next-server, which already started
+   * the request span, `fn` runs inside that active span instead.
+   *
+   * Callers must await `ensureInstrumentation` before calling this: on the
+   * first request, registering `instrumentation.ts` usually installs the
+   * tracer provider, and a span started earlier would not be recorded. With
+   * the `instrumentation` it returned, the request span is backdated to cover
+   * registration, and the lifecycle spans of `instrumentation.ts` are children
+   * of the request span when this request triggered registration.
+   *
+   * `fn` receives the request span and the request's root span: the span that
+   * was active when the handler was invoked (next-server's request span, or a
+   * platform-created HTTP span), or the request span itself when there is no
+   * such span.
+   *
+   * `tracer` must be the caller's tracer: route modules are bundled with their
+   * own copy of the tracer, whose root span bookkeeping (e.g.
+   * `getRootSpanAttributes`) the caller can't see.
+   *
+   * @internal - only called by the Next.js build templates. Kept out of the
+   * published type declarations, which can't reference the tracer's types.
+   */ async traceRequest(req, { tracer, spanName, httpTarget, instrumentation }, fn) {
+        var _this_getRouterServerContext;
+        const activeSpan = tracer.getActiveScopeSpan();
+        const isWrappedByNextServer = Boolean((_this_getRouterServerContext = this.getRouterServerContext(req)) == null ? void 0 : _this_getRouterServerContext.isWrappedByNextServer);
+        // TODO: activeSpan code path is for when wrapped by
+        // next-server can be removed when this is no longer used
+        if (isWrappedByNextServer && activeSpan) {
+            return fn(activeSpan, activeSpan);
+        }
+        return tracer.withPropagatedContext(req.headers, ()=>tracer.trace(_constants1.BaseServerSpan.handleRequest, {
+                spanName,
+                kind: _tracer.SpanKind.SERVER,
+                startTime: instrumentation == null ? void 0 : instrumentation.startTime,
+                attributes: {
+                    'http.method': req.method || 'GET',
+                    'http.target': httpTarget
+                }
+            }, (span)=>{
+                var _instrumentation_emitSpans;
+                instrumentation == null ? void 0 : (_instrumentation_emitSpans = instrumentation.emitSpans) == null ? void 0 : _instrumentation_emitSpans.call(instrumentation);
+                return fn(span, activeSpan ?? span);
+            }), undefined, !isWrappedByNextServer);
+    }
     prepare(req, res, options) {
         return (0, _tracer.getTracer)().trace(_constants1.RouteModuleSpan.prepare, {
             spanName: 'prepare route module'
         }, ()=>this.prepareImpl(req, res, options));
     }
-    async prepareImpl(req, res, { srcPage, multiZoneDraftMode }) {
-        var _req_headers_xforwardedproto, _nextConfig_experimental;
+    /**
+   * Makes sure `instrumentation.ts` is registered for the Node.js runtime.
+   * Safe to call more than once per request. Returns the absolute project
+   * directory (`undefined` in the edge runtime, which handles loading
+   * instrumentation at the edge adapter level).
+   *
+   * With `deferSpans` (callers of `traceRequest`), it also returns the
+   * `instrumentation` to pass to `traceRequest`: when this call triggered
+   * registration, the lifecycle spans of `instrumentation.ts` are not emitted
+   * yet but emitted inside the request span.
+   *
+   * @internal - called by `prepare` and by the Next.js build templates before
+   * `traceRequest`.
+   */ async ensureInstrumentation(req, { deferSpans = false } = {}) {
         let absoluteProjectDir;
-        // edge runtime handles loading instrumentation at the edge adapter level
+        const instrumentation = deferSpans ? {
+            startTime: performance.timeOrigin + performance.now()
+        } : undefined;
         if (process.env.NEXT_RUNTIME !== 'edge') {
-            if (res) {
-                (0, _patchsetheader.patchSetHeaderWithCookieSupport)(req, res);
-            }
             const { join, relative } = require('node:path');
             absoluteProjectDir = join(/* turbopackIgnore: true */ process.cwd(), (0, _requestmeta.getRequestMeta)(req, 'relativeProjectDir') || this.relativeProjectDir);
             const absoluteDistDir = (0, _requestmeta.getRequestMeta)(req, 'distDir');
             if (absoluteDistDir) {
                 this.distDir = relative(absoluteProjectDir, absoluteDistDir);
             }
-            const { ensureInstrumentationRegistered } = await import('../lib/router-utils/instrumentation-globals.external.js');
+            const { ensureInstrumentationRegistered, ensureInstrumentationRegisteredWithDeferredSpans } = await import('../lib/router-utils/instrumentation-globals.external.js');
             // ensure instrumentation is registered and pass
             // onRequestError below. Awaited so any caller of `RouteModule.prepare`
             // that bypasses `BaseServer.handleRequest` (where this is also awaited
             // via `prepareImpl`) still observes the instrumentation hook completing
             // before the userland route handler runs.
-            await ensureInstrumentationRegistered(absoluteProjectDir, this.distDir);
+            if (instrumentation) {
+                instrumentation.emitSpans = await ensureInstrumentationRegisteredWithDeferredSpans(absoluteProjectDir, this.distDir);
+            } else {
+                await ensureInstrumentationRegistered(absoluteProjectDir, this.distDir);
+            }
+        }
+        return {
+            absoluteProjectDir,
+            instrumentation
+        };
+    }
+    async prepareImpl(req, res, { srcPage, multiZoneDraftMode }) {
+        var _req_headers_xforwardedproto, _nextConfig_experimental;
+        if (process.env.NEXT_RUNTIME !== 'edge' && res) {
+            (0, _patchsetheader.patchSetHeaderWithCookieSupport)(req, res);
         }
+        const { absoluteProjectDir } = await this.ensureInstrumentation(req);
         const manifests = (0, _tracer.getTracer)().trace(_constants1.RouteModuleSpan.loadManifests, {
             spanName: 'load route manifests'
         }, ()=>this.loadManifests(srcPage, absoluteProjectDir));

package/app/node_modules/next/dist/server/web/adapter.js

@@ -39,6 +39,7 @@ const _invarianterror = require("../../shared/lib/invariant-error");
 const _tracer = require("../lib/trace/tracer");
 const _constants = require("../lib/trace/constants");
 const _webonclose = require("./web-on-close");
+const _forwardtracecontext = require("./forward-trace-context");
 const _getedgepreviewprops = require("./get-edge-preview-props");
 const _builtinrequestcontext = require("../after/builtin-request-context");
 const _implicittags = require("../lib/implicit-tags");
@@ -81,9 +82,15 @@ const headersGetter = {
     keys: (headers)=>Array.from(headers.keys()),
     get: (headers, key)=>headers.get(key) ?? undefined
 };
+function isMiddlewarePage(page) {
+    return page === '/middleware' || page === '/src/middleware' || page === '/proxy' || page === '/src/proxy';
+}
 let propagator = (request, fn)=>{
-    const tracer = (0, _tracer.getTracer)();
-    return tracer.withPropagatedContext(request.headers, fn, headersGetter);
+    // An active (host) span wins over a `traceparent` the request carries: the
+    // header can't be trusted to override, e.g., an APM's or the platform's
+    // server span. The middleware forwards the context it continues to the
+    // downstream request (the render), so both stay in one trace.
+    return (0, _tracer.getTracer)().withPropagatedContext(request.headers, fn, headersGetter);
 };
 let testApisIntercepted = false;
 function ensureTestApisIntercepted() {
@@ -208,79 +215,123 @@ async function adapter(params) {
     });
     let response;
     let cookiesFromResponse;
+    // The trace context of the span the middleware span and the downstream
+    // request share as their parent, to forward to the downstream request (see
+    // `forwardTraceContextToRequest`), and the request headers as the
+    // middleware received them.
+    let forwardedTraceContext;
+    let forwardedRequestHeaders;
     response = await propagator(request, ()=>{
         // we only care to make async storage available for middleware
-        const isMiddleware = params.page === '/middleware' || params.page === '/src/middleware' || params.page === '/proxy' || params.page === '/src/proxy';
+        const isMiddleware = isMiddlewarePage(params.page);
         if (isMiddleware) {
             // if we're in an edge function, we only get a subset of `nextConfig` (no `experimental`),
             // so we have to inject it via DefinePlugin.
             // in `next start` this will be passed normally (see `NextNodeServer.runMiddleware`).
             const waitUntil = event.waitUntil.bind(event);
             const closeController = new _webonclose.CloseController();
-            return (0, _tracer.getTracer)().trace(_constants.MiddlewareSpan.execute, {
-                spanName: `middleware ${request.method}`,
-                attributes: {
-                    'http.target': request.nextUrl.pathname,
-                    'http.method': request.method
+            const tracer = (0, _tracer.getTracer)();
+            const executeMiddleware = ()=>{
+                // The middleware span and the downstream request (the render) are
+                // siblings: they share the currently active context as their parent.
+                // That is an active host span, otherwise the request's `traceparent`
+                // (incoming, or written by next-server's middleware-invoke pass), or
+                // the root span inserted below. When this request registered
+                // `instrumentation.ts`, its lifecycle spans are children of the
+                // middleware span, which is backdated to cover registration.
+                const receivedHeaders = new Headers(request.headers);
+                forwardedTraceContext = (0, _forwardtracecontext.getSharedParentTraceContext)(receivedHeaders, tracer.getTraceContextHeaders());
+                if (forwardedTraceContext) {
+                    // Snapshot before the handler can mutate `request.headers`.
+                    forwardedRequestHeaders = receivedHeaders;
                 }
-            }, async ()=>{
-                try {
-                    var _params_request_nextConfig_experimental, _params_request_nextConfig;
-                    const onUpdateCookies = (cookies)=>{
-                        cookiesFromResponse = cookies;
-                    };
-                    const previewProps = (0, _getedgepreviewprops.getEdgePreviewProps)();
-                    const page = '/' // Fake Work
-                    ;
-                    const fallbackRouteParams = null;
-                    const implicitTags = await (0, _implicittags.getImplicitTags)(page, request.nextUrl.pathname, fallbackRouteParams);
-                    const requestStore = (0, _requeststore.createRequestStoreForAPI)(request, request.nextUrl, implicitTags, onUpdateCookies, previewProps, // Edge route handlers can't use `"use cache"`, so there's no HMR
-                    // refresh hash to thread through here.
-                    undefined);
-                    const workStore = (0, _workstore.createWorkStore)({
-                        page,
-                        renderOpts: {
-                            cacheLifeProfiles: proxyCacheLifeProfiles,
-                            // Proxy doesn't do static generation, so this value does not
-                            // apply here. 0 is a sentinel: if something ever reads it,
-                            // it'll surface loudly instead of silently using a misleading
-                            // default.
-                            staticPageGenerationTimeout: 0,
-                            cacheComponents: false,
-                            // Proxy doesn't run instant validation; the level value is
-                            // irrelevant here.
-                            // TODO: remove validationLevel and other global config from renderOpts
-                            validationLevel: 'warning',
-                            experimental: {
-                                isRoutePPREnabled: false,
-                                authInterrupts: !!((_params_request_nextConfig = params.request.nextConfig) == null ? void 0 : (_params_request_nextConfig_experimental = _params_request_nextConfig.experimental) == null ? void 0 : _params_request_nextConfig_experimental.authInterrupts),
-                                // Proxy doesn't fill Cache Components entries, so this value
-                                // is never read. 0 is a sentinel: if something ever reads it,
-                                // the cache fill will time out immediately and surface the
-                                // bug.
-                                useCacheTimeout: 0,
-                                durableUseCacheEntries: false
+                return tracer.trace(_constants.MiddlewareSpan.execute, {
+                    spanName: `middleware ${request.method}`,
+                    startTime: params.emitInstrumentationSpans ? params.requestStartTime : undefined,
+                    attributes: {
+                        'http.target': request.nextUrl.pathname,
+                        'http.method': request.method
+                    }
+                }, async ()=>{
+                    params.emitInstrumentationSpans == null ? void 0 : params.emitInstrumentationSpans.call(params);
+                    try {
+                        var _params_request_nextConfig_experimental, _params_request_nextConfig;
+                        const onUpdateCookies = (cookies)=>{
+                            cookiesFromResponse = cookies;
+                        };
+                        const previewProps = (0, _getedgepreviewprops.getEdgePreviewProps)();
+                        const page = '/' // Fake Work
+                        ;
+                        const fallbackRouteParams = null;
+                        const implicitTags = await (0, _implicittags.getImplicitTags)(page, request.nextUrl.pathname, fallbackRouteParams);
+                        const requestStore = (0, _requeststore.createRequestStoreForAPI)(request, request.nextUrl, implicitTags, onUpdateCookies, previewProps, // Edge route handlers can't use `"use cache"`, so there's no HMR
+                        // refresh hash to thread through here.
+                        undefined);
+                        const workStore = (0, _workstore.createWorkStore)({
+                            page,
+                            renderOpts: {
+                                cacheLifeProfiles: proxyCacheLifeProfiles,
+                                // Proxy doesn't do static generation, so this value does not
+                                // apply here. 0 is a sentinel: if something ever reads it,
+                                // it'll surface loudly instead of silently using a misleading
+                                // default.
+                                staticPageGenerationTimeout: 0,
+                                cacheComponents: false,
+                                // Proxy doesn't run instant validation; the level value is
+                                // irrelevant here.
+                                // TODO: remove validationLevel and other global config from renderOpts
+                                validationLevel: 'warning',
+                                experimental: {
+                                    isRoutePPREnabled: false,
+                                    authInterrupts: !!((_params_request_nextConfig = params.request.nextConfig) == null ? void 0 : (_params_request_nextConfig_experimental = _params_request_nextConfig.experimental) == null ? void 0 : _params_request_nextConfig_experimental.authInterrupts),
+                                    // Proxy doesn't fill Cache Components entries, so this value
+                                    // is never read. 0 is a sentinel: if something ever reads it,
+                                    // the cache fill will time out immediately and surface the
+                                    // bug.
+                                    useCacheTimeout: 0,
+                                    durableUseCacheEntries: false
+                                },
+                                waitUntil,
+                                onClose: closeController.onClose.bind(closeController),
+                                onAfterTaskError: undefined
                             },
-                            waitUntil,
-                            onClose: closeController.onClose.bind(closeController),
-                            onAfterTaskError: undefined
-                        },
-                        isPrefetchRequest: request.headers.get(_approuterheaders.NEXT_ROUTER_PREFETCH_HEADER) === '1',
-                        buildId: buildId ?? '',
-                        deploymentId: deploymentId ?? '',
-                        previouslyRevalidatedTags: []
-                    });
-                    return await _workasyncstorageexternal.workAsyncStorage.run(workStore, ()=>_workunitasyncstorageexternal.workUnitAsyncStorage.run(requestStore, params.handler, request, event));
-                } finally{
-                    // middleware cannot stream, so we can consider the response closed
-                    // as soon as the handler returns.
-                    // we can delay running it until a bit later --
-                    // if it's needed, we'll have a `waitUntil` lock anyway.
-                    setTimeout(()=>{
-                        closeController.dispatchClose();
-                    }, 0);
-                }
-            });
+                            isPrefetchRequest: request.headers.get(_approuterheaders.NEXT_ROUTER_PREFETCH_HEADER) === '1',
+                            buildId: buildId ?? '',
+                            deploymentId: deploymentId ?? '',
+                            previouslyRevalidatedTags: []
+                        });
+                        return await _workasyncstorageexternal.workAsyncStorage.run(workStore, ()=>_workunitasyncstorageexternal.workUnitAsyncStorage.run(requestStore, params.handler, request, event));
+                    } finally{
+                        // middleware cannot stream, so we can consider the response closed
+                        // as soon as the handler returns.
+                        // we can delay running it until a bit later --
+                        // if it's needed, we'll have a `waitUntil` lock anyway.
+                        setTimeout(()=>{
+                            closeController.dispatchClose();
+                        }, 0);
+                    }
+                });
+            };
+            if (tracer.isOpenTelemetryEnabled() && !tracer.hasActiveSpanContext()) {
+                // Middleware invoked separately from the render without any trace
+                // context (no incoming `traceparent`, no host span): insert a root
+                // span for the request. Its context is forwarded to the render, so the
+                // middleware and the render are siblings in one trace instead of two
+                // independent root spans. It's named after the method only (like
+                // next-server's request span before its route is known): the path
+                // would make the span name high-cardinality. It is backdated to when
+                // the request was received, to cover registering `instrumentation.ts`.
+                return tracer.trace(_constants.NextSpan.request, {
+                    spanName: request.method,
+                    kind: _tracer.SpanKind.SERVER,
+                    startTime: params.requestStartTime,
+                    attributes: {
+                        'http.target': request.nextUrl.pathname,
+                        'http.method': request.method
+                    }
+                }, executeMiddleware);
+            }
+            return executeMiddleware();
         }
         return params.handler(request, event);
     });
@@ -385,6 +436,14 @@ async function adapter(params) {
         }
     }
     const finalResponse = response ? response : _response.NextResponse.next();
+    if (forwardedRequestHeaders) {
+        // Make the downstream request (render) a sibling of the middleware span
+        // in the same trace. Every host applies these request-header overrides to
+        // the render, including next-server's router server, so this works
+        // whether or not the host invokes the middleware separately from the
+        // render.
+        (0, _forwardtracecontext.forwardTraceContextToRequest)(finalResponse.headers, forwardedRequestHeaders, forwardedTraceContext);
+    }
     // Flight headers are not overridable / removable so they are applied at the end.
     const middlewareOverrideHeaders = finalResponse.headers.get('x-middleware-override-headers');
     const overwrittenHeaders = [];

package/app/node_modules/next/dist/server/web/forward-trace-context.js

@@ -0,0 +1,102 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", {
+    value: true
+});
+0 && (module.exports = {
+    forwardTraceContextToRequest: null,
+    getSharedParentTraceContext: null
+});
+function _export(target, all) {
+    for(var name in all)Object.defineProperty(target, name, {
+        enumerable: true,
+        get: all[name]
+    });
+}
+_export(exports, {
+    forwardTraceContextToRequest: function() {
+        return forwardTraceContextToRequest;
+    },
+    getSharedParentTraceContext: function() {
+        return getSharedParentTraceContext;
+    }
+});
+const OVERRIDE_HEADERS = 'x-middleware-override-headers';
+const REQUEST_HEADER_PREFIX = 'x-middleware-request-';
+// The trace ID and parent ID of a W3C `traceparent`
+// (`version-traceid-parentid-flags`), lower-cased.
+function getTraceparentIds(traceparent) {
+    const [, traceId, parentId] = (traceparent == null ? void 0 : traceparent.toLowerCase().split('-')) ?? [];
+    return traceId && parentId ? `${traceId}-${parentId}` : undefined;
+}
+function getSharedParentTraceContext(requestHeaders, activeTraceContext) {
+    if (!activeTraceContext) {
+        return undefined;
+    }
+    const receivedTraceparent = requestHeaders.get('traceparent');
+    const receivedIds = getTraceparentIds(receivedTraceparent);
+    if (receivedTraceparent && receivedIds && receivedIds === getTraceparentIds(activeTraceContext.traceparent)) {
+        const receivedTracestate = requestHeaders.get('tracestate');
+        return receivedTracestate ? {
+            traceparent: receivedTraceparent,
+            tracestate: receivedTracestate
+        } : {
+            traceparent: receivedTraceparent,
+            tracestate: undefined
+        };
+    }
+    return activeTraceContext;
+}
+function forwardTraceContextToRequest(responseHeaders, requestHeaders, traceContext) {
+    if (!traceContext) {
+        return;
+    }
+    // Redirects and direct responses have no downstream request.
+    if (!responseHeaders.has('x-middleware-next') && !responseHeaders.has('x-middleware-rewrite')) {
+        return;
+    }
+    const userOverrides = responseHeaders.get(OVERRIDE_HEADERS);
+    // An empty override list is ignored by hosts (no headers are replaced), so
+    // treat it like no overrides rather than turning it into "only the trace
+    // context headers".
+    if (!userOverrides) {
+        if (requestHeaders.get('traceparent') === traceContext.traceparent && requestHeaders.get('tracestate') === (traceContext.tracestate ?? null)) {
+            // The downstream request already carries the trace context.
+            return;
+        }
+        const keys = [];
+        for (const [key, value] of requestHeaders){
+            if (!isTraceHeader(key)) {
+                responseHeaders.set(REQUEST_HEADER_PREFIX + key, value);
+                keys.push(key);
+            }
+        }
+        setTraceContextOverrides(responseHeaders, keys, traceContext);
+        return;
+    }
+    const keys = userOverrides.split(',').map((key)=>key.trim()).filter(Boolean);
+    if (keys.includes('traceparent') && responseHeaders.get(REQUEST_HEADER_PREFIX + 'traceparent') !== requestHeaders.get('traceparent')) {
+        // The user explicitly set the `traceparent`: keep both trace headers as
+        // the user set them.
+        return;
+    }
+    setTraceContextOverrides(responseHeaders, keys.filter((key)=>!isTraceHeader(key)), traceContext);
+}
+function isTraceHeader(key) {
+    return key === 'traceparent' || key === 'tracestate';
+}
+// Lists the trace context's `traceparent` and `tracestate` (or no
+// `tracestate`, if it has none) as request-header overrides, after `keys`
+// (the other overridden headers).
+function setTraceContextOverrides(responseHeaders, keys, traceContext) {
+    responseHeaders.set(REQUEST_HEADER_PREFIX + 'traceparent', traceContext.traceparent);
+    keys.push('traceparent');
+    if (traceContext.tracestate) {
+        responseHeaders.set(REQUEST_HEADER_PREFIX + 'tracestate', traceContext.tracestate);
+        keys.push('tracestate');
+    } else {
+        responseHeaders.delete(REQUEST_HEADER_PREFIX + 'tracestate');
+    }
+    responseHeaders.set(OVERRIDE_HEADERS, keys.join(','));
+}
+
+//# sourceMappingURL=forward-trace-context.js.map

package/app/node_modules/next/dist/telemetry/anonymous-meta.js

@@ -82,7 +82,7 @@ async function getAnonymousMeta() {
         isWsl: _iswsl.default,
         isCI: _ciinfo.isCI,
         ciName: _ciinfo.isCI && _ciinfo.name || null,
-        nextVersion: "16.4.2",
+        nextVersion: "16.4.3",
         agentName: await (0, _agentname.getAgentName)()
     };
     return traits;

package/app/node_modules/next/dist/telemetry/events/swc-load-failure.js

@@ -38,7 +38,7 @@ async function eventSwcLoadFailure(event) {
     telemetry.record({
         eventName: EVENT_PLUGIN_PRESENT,
         payload: {
-            nextVersion: "16.4.2",
+            nextVersion: "16.4.3",
             glibcVersion,
             installedSwcPackages,
             arch: process.arch,

package/app/node_modules/next/dist/telemetry/events/version.js

@@ -12,12 +12,12 @@ const EVENT_VERSION = 'NEXT_CLI_SESSION_STARTED';
 function eventCliSession(nextConfig, event) {
     var _nextConfig_experimental, _nextConfig_experimental_staleTimes, _nextConfig_experimental_staleTimes1, _nextConfig_reactCompiler, _nextConfig_reactCompiler1;
     // This should be an invariant, if it fails our build tooling is broken.
-    if (typeof "16.4.2" !== 'string') {
+    if (typeof "16.4.3" !== 'string') {
         return [];
     }
     const { images, i18n } = nextConfig || {};
     const payload = {
-        nextVersion: "16.4.2",
+        nextVersion: "16.4.3",
         nodeVersion: process.version,
         cliCommand: event.cliCommand,
         isSrcDir: event.isSrcDir,

package/app/node_modules/next/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next",
-  "version": "16.4.2",
+  "version": "16.4.3",
   "description": "The React Framework",
   "main": "./dist/server/next.js",
   "license": "MIT",
@@ -82,7 +82,7 @@
     "next": "./dist/bin/next"
   },
   "dependencies": {
-    "@next/env": "16.4.2",
+    "@next/env": "16.4.3",
     "@swc/helpers": "0.5.23",
     "baseline-browser-mapping": "^2.9.19",
     "caniuse-lite": "^1.0.30001579",
@@ -113,14 +113,14 @@
   },
   "optionalDependencies": {
     "sharp": "^0.35.5",
-    "@next/swc-darwin-arm64": "16.4.2",
-    "@next/swc-darwin-x64": "16.4.2",
-    "@next/swc-linux-arm64-gnu": "16.4.2",
-    "@next/swc-linux-arm64-musl": "16.4.2",
-    "@next/swc-linux-x64-gnu": "16.4.2",
-    "@next/swc-linux-x64-musl": "16.4.2",
-    "@next/swc-win32-arm64-msvc": "16.4.2",
-    "@next/swc-win32-x64-msvc": "16.4.2"
+    "@next/swc-darwin-arm64": "16.4.3",
+    "@next/swc-darwin-x64": "16.4.3",
+    "@next/swc-linux-arm64-gnu": "16.4.3",
+    "@next/swc-linux-arm64-musl": "16.4.3",
+    "@next/swc-linux-x64-gnu": "16.4.3",
+    "@next/swc-linux-x64-musl": "16.4.3",
+    "@next/swc-win32-arm64-msvc": "16.4.3",
+    "@next/swc-win32-x64-msvc": "16.4.3"
   },
   "keywords": [
     "react",