@opennextjs/aws 4.1.13 → 4.1.15

package/dist/build/createAssets.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import path from "node:path";
-import { loadConfig } from "../adapters/config/util.js";
+import { getOpenNextBuildId, loadConfig } from "../adapters/config/util.js";
 import { safeParseJsonFile } from "../utils/safe-json-parse.js";
 import logger from "../logger.js";
 import { isBinaryContentType } from "../utils/binary.js";
@@ -59,6 +59,9 @@ export function createStaticAssets(options, { useBasePath = false } = {}) {
 /**
  * Create the cache assets.
  *
+ * The cache entries, the fetch cache entries and the tag cache seed are prefixed with the Open Next build id
+ * so that they match the keys used at runtime.
+ *
  * @param options Build options.
  * @returns Whether the tag cache is used, and the meta files collected.
  */
@@ -66,9 +69,9 @@ export function createCacheAssets(options) {
     logger.info("Bundling cache assets...");
     const { appBuildOutputPath, outputDir } = options;
     const packagePath = buildHelper.getPackagePath(options);
-    const buildId = buildHelper.getBuildId(options);
     const nextConfig = loadConfig(path.join(appBuildOutputPath, ".next"));
-    const openNextBuildId = nextConfig.deploymentId ?? buildId;
+    // Must match `process.env.OPEN_NEXT_BUILD_ID` used at runtime to read the cache entries and the tags
+    const openNextBuildId = getOpenNextBuildId(nextConfig, buildHelper.getBuildId(options));
     let useTagCache = false;
     const dotNextPath = path.join(appBuildOutputPath, ".next/standalone", packagePath);
     const outputCachePath = path.join(outputDir, "cache", openNextBuildId);
@@ -180,8 +183,8 @@ export function createCacheAssets(options) {
                 .split(",")
                 .forEach((tag) => {
                 metaFiles.push({
-                    tag: { S: path.posix.join(buildId, tag.trim()) },
-                    path: { S: path.posix.join(buildId, cacheKey) },
+                    tag: { S: path.posix.join(openNextBuildId, tag.trim()) },
+                    path: { S: path.posix.join(openNextBuildId, cacheKey) },
                     revalidatedAt: { N: "1" },
                 });
             });
@@ -190,7 +193,7 @@ export function createCacheAssets(options) {
     // Copy fetch-cache to cache folder
     const fetchCachePath = path.join(appBuildOutputPath, ".next/cache/fetch-cache");
     if (fs.existsSync(fetchCachePath)) {
-        const fetchOutputPath = path.join(outputDir, "cache", "__fetch", buildId);
+        const fetchOutputPath = path.join(outputDir, "cache", "__fetch", openNextBuildId);
         fs.mkdirSync(fetchOutputPath, { recursive: true });
         fs.cpSync(fetchCachePath, fetchOutputPath, { recursive: true });
         buildHelper.traverseFiles(fetchCachePath, () => true, ({ absolutePath, relativePath }) => {
@@ -198,9 +201,9 @@ export function createCacheAssets(options) {
             const fileData = safeParseJsonFile(fileContent, absolutePath);
             fileData?.tags?.forEach((tag) => {
                 metaFiles.push({
-                    tag: { S: path.posix.join(buildId, tag) },
+                    tag: { S: path.posix.join(openNextBuildId, tag) },
                     path: {
-                        S: path.posix.join(buildId, relativePath),
+                        S: path.posix.join(openNextBuildId, relativePath),
                     },
                     revalidatedAt: { N: "1" },
                 });

package/dist/build/createImageOptimizationBundle.js

@@ -83,7 +83,6 @@ export async function createImageOptimizationBundle(options) {
         arch: isDev ? undefined : "arm64",
         // Use the local platform in dev
         os: isDev ? os.platform() : "linux",
-        nodeVersion: "18",
         libc: "glibc",
     });
 }

package/dist/build/helper.js

@@ -381,7 +381,7 @@ export function getPackagePath(options) {
  * @returns the Next.js runtime used: "webpack" or "turbopack"
  */
 export function getBundlerRuntime(options) {
-    const dotNextServerPath = path.join(options.appPath, ".next/server");
+    const dotNextServerPath = path.join(options.appBuildOutputPath, ".next/server");
     if (fs.existsSync(path.join(dotNextServerPath, "webpack-runtime.js"))) {
         return "webpack";
     }

package/dist/build/installDeps.js

@@ -12,20 +12,19 @@ export function installDependencies(outputDir, installOptions) {
         // First we create a tempDir
         const tempInstallDir = fs.mkdtempSync(path.join(os.tmpdir(), `open-next-install-${name}`));
         logger.info(`Installing dependencies for ${name}...`);
+        if (installOptions.nodeVersion) {
+            logger.warn("install.nodeVersion is deprecated and ignored (npm no longer supports --target)");
+        }
         // We then need to run install in the tempDir
         // We don't install in the output dir directly because it could contain a package.json, and npm would then try to reinstall not complete deps from tracing the files
-        const archOption = installOptions.arch
-            ? `--arch=${installOptions.arch}`
-            : "";
-        const targetOption = installOptions.nodeVersion
-            ? `--target=${installOptions.nodeVersion}`
-            : "";
+        // npm filters platform-specific optional dependencies (e.g. sharp's @img/* packages) by --cpu; npm 12 rejects (npm 11 warns) both --arch and --target
+        const cpuOption = installOptions.arch ? `--cpu=${installOptions.arch}` : "";
         const libcOption = installOptions.libc
             ? `--libc=${installOptions.libc}`
             : "";
         const osOption = `--os=${installOptions.os ?? "linux"}`;
         const additionalArgs = installOptions.additionalArgs ?? "";
-        const installCommand = `npm install ${osOption} ${archOption} ${targetOption} ${libcOption} ${additionalArgs} ${installOptions.packages.join(" ")}`;
+        const installCommand = `npm install ${osOption} ${cpuOption} ${libcOption} ${additionalArgs} ${installOptions.packages.join(" ")}`;
         execSync(installCommand, {
             stdio: "pipe",
             cwd: tempInstallDir,

package/dist/build/patch/patches/patchNextServer.d.ts

@@ -3,6 +3,31 @@ export declare const disablePreloadingRule = "\nrule:\n  kind: statement_block\n
 export declare const removeMiddlewareManifestRule = "\nrule:\n  kind: statement_block\n  inside:\n    kind: method_definition\n    has:\n      kind: property_identifier\n      regex: ^getMiddlewareManifest$\nfix:\n  '{return null;}'\n";
 export declare const emptyHandleNextImageRequestRule = "\nrule:\n  kind: assignment_expression\n  pattern: this.handleNextImageRequest = $VALUE\n  inside:\n    kind: method_definition\n    stopBy: end\n    has:\n      kind: property_identifier\n      regex: ^constructor$\n    inside:\n      kind: class_body\nfix:\n  this.handleNextImageRequest = async (req, res, parsedUrl) => false\n";
 export declare const provideInternalWaitUntil = "\nrule:\n  kind: return_statement\n  inside:\n    kind: method_definition\n    stopBy: end\n    has:\n      kind: property_identifier\n      regex: getInternalWaitUntil\n\nfix:\n return globalThis.__openNextAls.getStore()?.waitUntil;\n";
+/**
+ * Exposes `NextNodeServer#revalidate` to `res.revalidate()` of the Pages Router API routes.
+ *
+ * Starting with Next 15.4, `res.revalidate()` uses the `revalidate` function of the router server
+ * context (`globalThis[Symbol.for("@next/router-server-methods")]`) to revalidate in-process.
+ * The context is populated by the router server which is not used by OpenNext.
+ * Without it, `res.revalidate()` throws
+ * `Invariant: missing internal router-server-methods this is an internal bug`.
+ *
+ * `NextNodeServer#handleCatchallRenderRequest` creates the context for environments without
+ * router server, this rule adds `revalidate` to it:
+ *
+ * ```js
+ * routerServerGlobal[RouterServerContextSymbol][relativeProjectDir] = {
+ *   render404: this.render404.bind(this),
+ *   // added by the rule
+ *   revalidate: this.revalidate.bind(this),
+ * };
+ * ```
+ *
+ * OpenNext wraps `NextNodeServer#revalidate` at runtime, see `core/revalidate.ts`.
+ *
+ * https://github.com/vercel/next.js/blob/4e6c27b/packages/next/src/server/api-utils/node/api-resolver.ts
+ */
+export declare const exposeRevalidateRule = "\nrule:\n  pattern:\n    context: \"({ render404: this.render404.bind(this) })\"\n    selector: pair\n  inside:\n    kind: object\n    not:\n      has:\n        kind: pair\n        has:\n          field: key\n          regex: ^revalidate$\nfix: |-\n  render404: this.render404.bind(this),\n  revalidate: this.revalidate.bind(this)\n";
 /**
  * Swaps the body for a throwing implementation
  *

package/dist/build/patch/patches/patchNextServer.js

@@ -60,6 +60,47 @@ rule:
 fix:
  return globalThis.__openNextAls.getStore()?.waitUntil;
 `;
+/**
+ * Exposes `NextNodeServer#revalidate` to `res.revalidate()` of the Pages Router API routes.
+ *
+ * Starting with Next 15.4, `res.revalidate()` uses the `revalidate` function of the router server
+ * context (`globalThis[Symbol.for("@next/router-server-methods")]`) to revalidate in-process.
+ * The context is populated by the router server which is not used by OpenNext.
+ * Without it, `res.revalidate()` throws
+ * `Invariant: missing internal router-server-methods this is an internal bug`.
+ *
+ * `NextNodeServer#handleCatchallRenderRequest` creates the context for environments without
+ * router server, this rule adds `revalidate` to it:
+ *
+ * ```js
+ * routerServerGlobal[RouterServerContextSymbol][relativeProjectDir] = {
+ *   render404: this.render404.bind(this),
+ *   // added by the rule
+ *   revalidate: this.revalidate.bind(this),
+ * };
+ * ```
+ *
+ * OpenNext wraps `NextNodeServer#revalidate` at runtime, see `core/revalidate.ts`.
+ *
+ * https://github.com/vercel/next.js/blob/4e6c27b/packages/next/src/server/api-utils/node/api-resolver.ts
+ */
+export const exposeRevalidateRule = `
+rule:
+  pattern:
+    context: "({ render404: this.render404.bind(this) })"
+    selector: pair
+  inside:
+    kind: object
+    not:
+      has:
+        kind: pair
+        has:
+          field: key
+          regex: ^revalidate$
+fix: |-
+  render404: this.render404.bind(this),
+  revalidate: this.revalidate.bind(this)
+`;
 /**
  * Swaps the body for a throwing implementation
  *
@@ -138,6 +179,13 @@ export const patchNextServer = {
             contentFilter: /getInternalWaitUntil/,
             patchCode: createPatchCode(provideInternalWaitUntil),
         },
+        // Expose `NextNodeServer#revalidate` to `res.revalidate()`
+        {
+            versions: ">=15.4.0",
+            pathFilter,
+            contentFilter: /render404: this\.render404\.bind\(this\)/,
+            patchCode: createPatchCode(exposeRevalidateRule),
+        },
         ...babelPatches,
     ],
 };

package/dist/core/requestHandler.js

@@ -33,6 +33,11 @@ export async function openNextHandler(internalEvent, options) {
         if (initialHeaders["x-forwarded-host"]) {
             initialHeaders.host = initialHeaders["x-forwarded-host"];
         }
+        const requestStore = globalThis.__openNextAls.getStore();
+        if (requestStore) {
+            // Used by `res.revalidate()`, see `core/revalidate.ts`
+            requestStore.host = initialHeaders.host;
+        }
         debug("internalEvent", internalEvent);
         // These 3 will get overwritten by the routing handler if not using an external middleware
         const internalHeaders = {

package/dist/core/resolve.d.ts

@@ -51,5 +51,12 @@ export declare function resolveProxyRequest(proxyRequest: OverrideOptions["proxy
 /**
  * @__PURE__
  */
-export declare function resolveCdnInvalidation(cdnInvalidation: OverrideOptions["cdnInvalidation"]): Promise<import("../types/overrides.js").CDNInvalidationHandler>;
+export declare function resolveCdnInvalidation(cdnInvalidation: OverrideOptions["cdnInvalidation"]): Promise<{
+    name: string;
+    invalidatePaths: (_: {
+        initialPath: string;
+        rawPath: string;
+        resolvedRoutes: import("../types/open-next.js").ResolvedRoute[];
+    }[]) => Promise<void>;
+}>;
 export {};

package/dist/core/revalidate.d.ts

@@ -0,0 +1,68 @@
+import type { ResolvedRoute } from "../types/open-next.js";
+/**
+ * Arguments passed by Next to the router server `revalidate` function.
+ *
+ * Next renamed `revalidateHeaders` to `headers` in 16.x.
+ */
+export interface RevalidateArgs {
+    urlPath: string;
+    headers?: Record<string, string | string[] | undefined>;
+    revalidateHeaders?: Record<string, string | string[] | undefined>;
+    opts: {
+        unstable_onlyGenerated?: boolean;
+    };
+}
+export type RevalidateFn = (args: RevalidateArgs) => Promise<void>;
+/**
+ * Resolve the route of a path.
+ *
+ * Static routes take precedence over dynamic routes, as in Next.
+ *
+ * @param urlPath The path passed to `res.revalidate()`, may include the basePath and a locale
+ * @returns The resolved route or `undefined` when no route matches
+ */
+export declare function resolveRoute(urlPath: string): ResolvedRoute | undefined;
+/**
+ * Convert a resolved route to the format used in `functions[name].routes` of the OpenNext config.
+ *
+ * i.e. `pages/index`, `pages/blog/[slug]`, `app/page`, `app/blog/[slug]/page`, ...
+ *
+ * @param route The resolved route
+ * @returns The candidate route templates (app routes may have several because of route groups)
+ */
+export declare function getRouteTemplates(route: ResolvedRoute): string[];
+/**
+ * Returns whether the route is served by the current function.
+ *
+ * Routes that are not listed in any split function are served by the default function.
+ * Paths that do not match any route are considered local so that Next handles them.
+ *
+ * @param route The resolved route
+ * @returns `true` when the route is served by the current function
+ */
+export declare function isServedByCurrentFunction(route: ResolvedRoute | undefined): boolean;
+/**
+ * Revalidate a page served by another function by sending a `HEAD` request to the app.
+ *
+ * Only the revalidate headers provided by Next are forwarded (no cookies).
+ * The function serving the page takes care of the CDN invalidation.
+ *
+ * TODO: the host comes from the request headers, use a trusted origin instead.
+ *
+ * @param args The arguments passed by Next to `revalidate`
+ * @throws When the host is unknown or the page has not been revalidated
+ */
+export declare function revalidateRemote({ urlPath, headers, revalidateHeaders, opts, }: RevalidateArgs): Promise<void>;
+/**
+ * Wrap `NextNodeServer#revalidate` used by `res.revalidate()` in the Pages Router API routes.
+ *
+ * - Pages served by the current function are revalidated in-process, then invalidated in the CDN.
+ * - Pages served by another split function are revalidated with a `HEAD` request.
+ *
+ * `NextNodeServer#revalidate` is exposed to `res.revalidate()` by a build time patch,
+ * see `exposeRevalidateRule` in `build/patch/patches/patchNextServer.ts`.
+ *
+ * @param revalidateInProcess The original `NextNodeServer#revalidate`
+ * @returns The wrapped revalidate function
+ */
+export declare function createRevalidate(revalidateInProcess: RevalidateFn): RevalidateFn;

package/dist/core/revalidate.js

@@ -0,0 +1,143 @@
+import { AppPathRoutesManifest } from "../adapters/config/index.js";
+import { NEXTJS_CACHE_HEADER } from "../utils/cacheHeaders.js";
+import { RequestCache } from "../utils/requestCache.js";
+import { debug, error } from "../adapters/logger";
+import { dynamicRouteMatcher, staticRouteMatcher, } from "./routing/routeMatcher";
+/**
+ * Timeout of the request revalidating a page served by another function.
+ */
+const REMOTE_REVALIDATE_TIMEOUT_MS = 30_000;
+/**
+ * Resolve the route of a path.
+ *
+ * Static routes take precedence over dynamic routes, as in Next.
+ *
+ * @param urlPath The path passed to `res.revalidate()`, may include the basePath and a locale
+ * @returns The resolved route or `undefined` when no route matches
+ */
+export function resolveRoute(urlPath) {
+    const pathname = urlPath.split(/[?#]/)[0];
+    return staticRouteMatcher(pathname)[0] ?? dynamicRouteMatcher(pathname)[0];
+}
+/**
+ * Convert a resolved route to the format used in `functions[name].routes` of the OpenNext config.
+ *
+ * i.e. `pages/index`, `pages/blog/[slug]`, `app/page`, `app/blog/[slug]/page`, ...
+ *
+ * @param route The resolved route
+ * @returns The candidate route templates (app routes may have several because of route groups)
+ */
+export function getRouteTemplates(route) {
+    if (route.type === "page") {
+        return [`pages${route.route === "/" ? "/index" : route.route}`];
+    }
+    return Object.entries(AppPathRoutesManifest)
+        .filter(([, path]) => path === route.route)
+        .map(([appPath]) => `app${appPath}`);
+}
+/**
+ * Returns whether the route is served by the current function.
+ *
+ * Routes that are not listed in any split function are served by the default function.
+ * Paths that do not match any route are considered local so that Next handles them.
+ *
+ * @param route The resolved route
+ * @returns `true` when the route is served by the current function
+ */
+export function isServedByCurrentFunction(route) {
+    const functions = globalThis.openNextConfig?.functions ?? {};
+    if (!route || Object.keys(functions).length === 0) {
+        return true;
+    }
+    const templates = getRouteTemplates(route);
+    const owner = Object.entries(functions).find(([, fn]) => fn.routes?.some((r) => templates.includes(r)))?.[0];
+    // `globalThis.fnName` is `undefined` in the default function
+    return owner === (globalThis.fnName || undefined);
+}
+/**
+ * Revalidate a page served by another function by sending a `HEAD` request to the app.
+ *
+ * Only the revalidate headers provided by Next are forwarded (no cookies).
+ * The function serving the page takes care of the CDN invalidation.
+ *
+ * TODO: the host comes from the request headers, use a trusted origin instead.
+ *
+ * @param args The arguments passed by Next to `revalidate`
+ * @throws When the host is unknown or the page has not been revalidated
+ */
+export async function revalidateRemote({ urlPath, headers, revalidateHeaders, opts, }) {
+    const host = globalThis.__openNextAls.getStore()?.host;
+    if (!host) {
+        throw new Error(`Unable to revalidate ${urlPath}: unknown host`);
+    }
+    const requestHeaders = new Headers();
+    for (const [key, value] of Object.entries(headers ?? revalidateHeaders ?? {})) {
+        if (value === undefined)
+            continue;
+        for (const v of Array.isArray(value) ? value : [value]) {
+            requestHeaders.append(key, v);
+        }
+    }
+    const url = `https://${host}${urlPath}`;
+    debug("Revalidating page served by another function", { url });
+    const res = await globalThis.internalFetch(url, {
+        method: "HEAD",
+        headers: requestHeaders,
+        redirect: "manual",
+        signal: AbortSignal.timeout(REMOTE_REVALIDATE_TIMEOUT_MS),
+    });
+    // Same check as Next, see `NextNodeServer#revalidate`
+    if (res.headers.get(NEXTJS_CACHE_HEADER)?.toUpperCase() !== "REVALIDATED" &&
+        res.status !== 200 &&
+        !(res.status === 404 && opts.unstable_onlyGenerated)) {
+        throw new Error(`Invalid response ${res.status}`);
+    }
+}
+/**
+ * Wrap `NextNodeServer#revalidate` used by `res.revalidate()` in the Pages Router API routes.
+ *
+ * - Pages served by the current function are revalidated in-process, then invalidated in the CDN.
+ * - Pages served by another split function are revalidated with a `HEAD` request.
+ *
+ * `NextNodeServer#revalidate` is exposed to `res.revalidate()` by a build time patch,
+ * see `exposeRevalidateRule` in `build/patch/patches/patchNextServer.ts`.
+ *
+ * @param revalidateInProcess The original `NextNodeServer#revalidate`
+ * @returns The wrapped revalidate function
+ */
+export function createRevalidate(revalidateInProcess) {
+    return async (args) => {
+        const route = resolveRoute(args.urlPath);
+        if (!isServedByCurrentFunction(route)) {
+            return revalidateRemote(args);
+        }
+        // Render the page in a context isolated from the API route request
+        // so that per-request state (i.e. `lastModified`, request cache) does not leak.
+        // The promise runner and `waitUntil` are shared to keep background work alive.
+        const store = globalThis.__openNextAls.getStore();
+        const renderInProcess = () => revalidateInProcess(args);
+        // Throws when the page has not been revalidated
+        await (store
+            ? globalThis.__openNextAls.run({
+                ...store,
+                lastModified: undefined,
+                writtenTags: new Set(),
+                requestCache: new RequestCache(),
+            }, renderInProcess)
+            : renderInProcess());
+        const path = args.urlPath.split(/[?#]/)[0];
+        try {
+            await globalThis.cdnInvalidationHandler?.invalidatePaths([
+                {
+                    initialPath: path,
+                    rawPath: path,
+                    resolvedRoutes: route ? [route] : [{ route: path, type: "page" }],
+                },
+            ]);
+        }
+        catch (e) {
+            // The page has been revalidated, only the CDN may serve stale content
+            error(`Failed to invalidate ${path} in the CDN`, e);
+        }
+    };
+}

package/dist/core/routing/cacheInterceptor.js

@@ -24,6 +24,30 @@ const VARY_HEADER = "RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Rou
 const NEXT_SEGMENT_PREFETCH_HEADER = "next-router-segment-prefetch";
 const NEXT_PRERENDER_HEADER = "x-nextjs-prerender";
 const NEXT_POSTPONED_HEADER = "x-nextjs-postponed";
+/**
+ * Internal header that can be stored in a cache entry but must not be sent to the client.
+ *
+ * It is set when a route handler calls `response.cookies` and contains the `HttpOnly` cookies.
+ * Next.js strips it in `sendResponse` when it serves a cached response.
+ */
+const MIDDLEWARE_SET_COOKIE_HEADER = "x-middleware-set-cookie";
+/**
+ * Returns the headers stored in a cache entry, without the internal `x-middleware-set-cookie` header.
+ *
+ * @param headers The headers stored in the cache entry meta
+ * @returns A copy of the headers without the internal header
+ */
+function getCachedResponseHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        if (value === undefined ||
+            key.toLowerCase() === MIDDLEWARE_SET_COOKIE_HEADER) {
+            continue;
+        }
+        result[key] = value;
+    }
+    return result;
+}
 async function computeCacheControl(path, body, host, revalidate, lastModified, isStaleFromTagCache = false, revalidationPath = path, revalidationKey = path) {
     let finalRevalidate = CACHE_ONE_YEAR;
     const existingRoute = Object.entries(PrerenderManifest?.routes ?? {}).find((p) => p[0] === path)?.[1];
@@ -194,7 +218,7 @@ async function generateResult(event, localizedPath, cachedValue, lastModified, i
     const headers = {
         ...cacheControl,
         "content-type": type,
-        ...cachedValue.meta?.headers,
+        ...getCachedResponseHeaders(cachedValue.meta?.headers),
         vary: VARY_HEADER,
         ...additionalHeaders,
     };
@@ -400,8 +424,7 @@ export async function cacheInterceptor(event, resolvedRoutes) {
                         statusCode: cachedData.value.meta?.status ?? 307,
                         body: emptyReadableStream(),
                         headers: {
-                            ...(cachedData.value.meta?.headers ??
-                                {}),
+                            ...getCachedResponseHeaders(cachedData.value.meta?.headers),
                             ...cacheControl,
                         },
                         isBase64Encoded: false,
@@ -413,7 +436,7 @@ export async function cacheInterceptor(event, resolvedRoutes) {
                     const statusCode = computeStatusCode(event.rewriteStatusCode, cachedData.value.meta?.status);
                     const headers = {
                         ...cacheControl,
-                        ...cachedData.value.meta?.headers,
+                        ...getCachedResponseHeaders(cachedData.value.meta?.headers),
                         vary: VARY_HEADER,
                     };
                     // See the note in `generateResult`.

package/dist/core/routing/matcher.js

@@ -426,6 +426,17 @@ function handleRepeatedSlashRedirect(event) {
     }
     return false;
 }
+/**
+ * Returns the internal trailing slash redirect for the request, if any.
+ *
+ * Mirrors the internal redirects that Next.js generates from `trailingSlash`. They apply to every
+ * path, including API routes, and run before the middleware so that it always sees the canonical
+ * pathname. Data requests (`/_next/data/<buildId>/*.json`) are not redirected.
+ * See https://github.com/vercel/next.js/blob/324b297/packages/next/src/lib/load-custom-routes.ts#L791-L849
+ *
+ * @param event The incoming request
+ * @returns The 308 redirect, or `false` when the path is already canonical
+ */
 function handleTrailingSlashRedirect(event) {
     // When rawPath is `//domain`, `url.host` would be `domain`.
     // https://github.com/opennextjs/opennextjs-aws/issues/355
@@ -433,14 +444,15 @@ function handleTrailingSlashRedirect(event) {
     if (
     // Someone is trying to redirect to a different origin, let's not do that
     url.host !== "localhost" ||
-        NextConfig.skipTrailingSlashRedirect ||
-        // We should not apply trailing slash redirect to API routes
-        event.rawPath.startsWith("/api/")) {
+        NextConfig.skipTrailingSlashRedirect) {
         return false;
     }
     const emptyBody = emptyReadableStream();
     if (NextConfig.trailingSlash &&
-        !(event.query.__nextDataReq === "1") &&
+        // Data requests (`/_next/data/<buildId>/*.json`) are never redirected, as with Next.js.
+        // The header is set by `fixDataPage`, a client supplied value is removed by the routing handler.
+        // The `__nextDataReq` query parameter can not be used as it is set by the client.
+        event.headers["x-nextjs-data"] !== "1" &&
         !event.rawPath.endsWith("/") &&
         !event.rawPath.match(/[\w-]+\.[\w]+$/g)) {
         const headersLocation = event.url.split("?");

package/dist/core/routing/middleware.d.ts

@@ -8,6 +8,10 @@ type MiddlewareLoader = () => Promise<{
  *
  * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
  *
+ * Next.js internal headers are never exposed on the response.
+ * `x-middleware-set-cookie` is only forwarded on the request headers of the returned `MiddlewareEvent`,
+ * regardless of the allowlist.
+ *
  * @param internalEvent The internal request event.
  * @param initialSearch The initial query string received by the handler.
  * @param middlewareLoader The middleware loader, overridden by unit tests.

package/dist/core/routing/middleware.js

@@ -9,6 +9,8 @@ const middlewareManifest = MiddlewareManifest;
 const functionsConfigManifest = FunctionsConfigManifest;
 const middleMatch = getMiddlewareMatch(middlewareManifest, functionsConfigManifest);
 const REDIRECTS = new Set([301, 302, 303, 307, 308]);
+// Internal header set by `NextResponse` when `response.cookies` is modified.
+const MIDDLEWARE_SET_COOKIE_HEADER = "x-middleware-set-cookie";
 function defaultMiddlewareLoader() {
     // @ts-expect-error - This is bundled
     return import("./middleware.mjs");
@@ -18,6 +20,10 @@ function defaultMiddlewareLoader() {
  *
  * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
  *
+ * Next.js internal headers are never exposed on the response.
+ * `x-middleware-set-cookie` is only forwarded on the request headers of the returned `MiddlewareEvent`,
+ * regardless of the allowlist.
+ *
  * @param internalEvent The internal request event.
  * @param initialSearch The initial query string received by the handler.
  * @param middlewareLoader The middleware loader, overridden by unit tests.
@@ -92,6 +98,7 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     const responseHeaders = result.headers;
     const reqHeaders = {};
     const resHeaders = {};
+    let middlewareSetCookie;
     // These are internal headers used by Next.js, we don't want to expose them to the client
     // NOTE: keys must be in lowercase to match the normalized header keys.
     const filteredHeaders = [
@@ -112,6 +119,13 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
         else {
             if (filteredHeaders.includes(normalizedKey))
                 return;
+            // `x-middleware-set-cookie` holds a copy of the cookies set by the middleware,
+            // including the `HttpOnly` ones. It must never be sent to the client.
+            // It is only forwarded on the request (see below) so that `cookies().get()` sees them.
+            if (normalizedKey === MIDDLEWARE_SET_COOKIE_HEADER) {
+                middlewareSetCookie = value;
+                return;
+            }
             // Headers.forEach folds same-name headers; use getSetCookie() below instead.
             if (normalizedKey === "set-cookie")
                 return;
@@ -139,6 +153,11 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     const newHeaders = Object.fromEntries([...Object.entries(internalEvent.headers), ...Object.entries(reqHeaders)]
         .map(([key, value]) => [key.toLowerCase(), value])
         .filter(([key]) => !overriddenHeaders || overriddenHeaders.has(key)));
+    // Next.js forwards `x-middleware-set-cookie` after applying the override allowlist,
+    // so it is never filtered out (see `resolve-routes.ts`).
+    if (middlewareSetCookie !== undefined) {
+        newHeaders[MIDDLEWARE_SET_COOKIE_HEADER] = middlewareSetCookie;
+    }
     // If the middleware returned a Rewrite, set the `url` to the pathname of the rewrite
     // NOTE: the header was added to `req` from above
     const rewriteUrl = responseHeaders.get("x-middleware-rewrite");

package/dist/core/routing/routeParamPlaceholder.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Returns whether a segment of the pathname is the placeholder of a matched dynamic App Router page.
+ *
+ * Next.js versions before 16.4.5 treat a param whose value is its placeholder (e.g. `[slug]` for `[slug]`) as an
+ * unresolved fallback param. Such values are not legitimate and must not reach Next.js.
+ *
+ * Segments are decoded like Next.js decodes param values (catch-all values are split on `/` first).
+ * Segments with a malformed percent encoding never match.
+ * Pathnames without an opening bracket return early, without matching the dynamic routes.
+ *
+ * @param pathname The internal pathname, which may include the basePath, a locale prefix and a trailing slash
+ * @returns Whether a segment of the pathname is a placeholder of a matched dynamic App Router page
+ */
+export declare function hasRouteParamPlaceholder(pathname: string): boolean;