@opennextjs/aws 4.1.14 → 4.1.15

package/dist/adapters/composable-cache.d.ts

@@ -1,5 +1,15 @@
 import type { ComposableCacheEntry } from "../types/cache.js";
 declare const _default: {
+    /**
+     * Reads a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @returns The cache entry, or `undefined` on a miss or when the entry has been revalidated.
+     * Errors are caught and reported as a miss.
+     */
     get(cacheKey: string): Promise<{
         value: import("stream/web").ReadableStream<any>;
         tags: string[];
@@ -8,6 +18,16 @@ declare const _default: {
         expire: number;
         revalidate: number;
     } | undefined>;
+    /**
+     * Writes a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @param pendingEntry The entry to store, resolves once the cached function has completed
+     * @throws When the entry can not be resolved or when the incremental cache or tag cache write fails
+     */
     set(cacheKey: string, pendingEntry: Promise<ComposableCacheEntry>): Promise<void>;
     refreshTags(): Promise<void>;
     /**

package/dist/adapters/composable-cache.js

@@ -1,4 +1,4 @@
-import { isStale, writeTags } from "../utils/cache.js";
+import { getComposableCacheStorageKey, isStale, writeTags } from "../utils/cache.js";
 import { fromReadableStream, toReadableStream } from "../utils/stream.js";
 import { debug } from "./logger";
 /**
@@ -17,12 +17,25 @@ import { debug } from "./logger";
  * flight from the same render while making a cross-request share impossible.
  * With no ALS store (e.g. at build time) the dedupe is skipped and `get` falls
  * through to the incremental cache.
+ *
+ * The map is keyed by the cache key provided by Next.js: it is an in-memory exact string
+ * comparison so there is no need to use the storage key (see `getComposableCacheStorageKey`).
  */
 const PENDING_WRITES_CACHE_KEY = "composable-cache:pending-writes";
 const getPendingWritePromiseMap = () => globalThis.__openNextAls
     ?.getStore()
     ?.requestCache?.getOrCreate(PENDING_WRITES_CACHE_KEY);
 export default {
+    /**
+     * Reads a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @returns The cache entry, or `undefined` on a miss or when the entry has been revalidated.
+     * Errors are caught and reported as a miss.
+     */
     async get(cacheKey) {
         try {
             // We first check if we have a pending write for this cache key
@@ -37,7 +50,8 @@ export default {
                     }));
                 }
             }
-            const result = await globalThis.incrementalCache.get(cacheKey, "composable");
+            const storageKey = getComposableCacheStorageKey(cacheKey);
+            const result = await globalThis.incrementalCache.get(storageKey, "composable");
             if (!result?.value?.value) {
                 return undefined;
             }
@@ -54,7 +68,7 @@ export default {
                 // Check if tags are stale – entry is valid but needs background revalidation
                 const isCacheStale = result.shouldBypassTagCache
                     ? false
-                    : await isStale(cacheKey, result.value.tags, result.lastModified);
+                    : await isStale(storageKey, result.value.tags, result.lastModified);
                 if (isCacheStale) {
                     revalidate = -1;
                 }
@@ -63,13 +77,13 @@ export default {
                 globalThis.tagCache.mode === undefined) {
                 const hasBeenRevalidated = result.shouldBypassTagCache
                     ? false
-                    : (await globalThis.tagCache.getLastModified(cacheKey, result.lastModified)) === -1;
+                    : (await globalThis.tagCache.getLastModified(storageKey, result.lastModified)) === -1;
                 if (hasBeenRevalidated)
                     return undefined;
                 // Check if tags are stale – entry is valid but needs background revalidation
                 const isCacheStale = result.shouldBypassTagCache
                     ? false
-                    : await isStale(cacheKey, result.value.tags, result.lastModified);
+                    : await isStale(storageKey, result.value.tags, result.lastModified);
                 if (isCacheStale) {
                     revalidate = -1;
                 }
@@ -85,6 +99,16 @@ export default {
             return undefined;
         }
     },
+    /**
+     * Writes a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @param pendingEntry The entry to store, resolves once the cached function has completed
+     * @throws When the entry can not be resolved or when the incremental cache or tag cache write fails
+     */
     async set(cacheKey, pendingEntry) {
         const promiseEntry = pendingEntry.then(async (entry) => ({
             ...entry,
@@ -95,15 +119,16 @@ export default {
         const entry = await promiseEntry.finally(() => {
             pendingWritePromiseMap?.delete(cacheKey);
         });
-        await globalThis.incrementalCache.set(cacheKey, {
+        const storageKey = getComposableCacheStorageKey(cacheKey);
+        await globalThis.incrementalCache.set(storageKey, {
             ...entry,
             value: entry.value,
         }, "composable");
         if (globalThis.tagCache.mode === "original") {
-            const storedTags = await globalThis.tagCache.getByPath(cacheKey);
+            const storedTags = await globalThis.tagCache.getByPath(storageKey);
             const tagsToWrite = entry.tags.filter((tag) => !storedTags.includes(tag));
             if (tagsToWrite.length > 0) {
-                await writeTags(tagsToWrite.map((tag) => ({ tag, path: cacheKey })));
+                await writeTags(tagsToWrite.map((tag) => ({ tag, path: storageKey })));
             }
         }
     },

package/dist/adapters/edge-adapter.js

@@ -1,3 +1,4 @@
+import { convertEdgeResponseHeaders } from "../http/util.js";
 import { runWithOpenNextRequestContext } from "../utils/promise.js";
 import { emptyReadableStream } from "../utils/stream.js";
 // We import it like that so that the edge plugin can replace it
@@ -26,17 +27,7 @@ const defaultHandler = async (internalEvent, options) => {
             url: internalEvent.url,
             body: convertBodyToReadableStream(internalEvent.method, internalEvent.body),
         });
-        const responseHeaders = {};
-        response.headers.forEach((value, key) => {
-            // Headers.forEach folds same-name headers; use getSetCookie() below instead.
-            if (key.toLowerCase() === "set-cookie")
-                return;
-            responseHeaders[key] = value;
-        });
-        const setCookies = response.headers.getSetCookie();
-        if (setCookies.length > 0) {
-            responseHeaders["set-cookie"] = setCookies;
-        }
+        const responseHeaders = convertEdgeResponseHeaders(response.headers);
         const body = response.body ?? emptyReadableStream();
         return {
             type: "core",

package/dist/core/routing/cacheInterceptor.js

@@ -24,6 +24,30 @@ const VARY_HEADER = "RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Rou
 const NEXT_SEGMENT_PREFETCH_HEADER = "next-router-segment-prefetch";
 const NEXT_PRERENDER_HEADER = "x-nextjs-prerender";
 const NEXT_POSTPONED_HEADER = "x-nextjs-postponed";
+/**
+ * Internal header that can be stored in a cache entry but must not be sent to the client.
+ *
+ * It is set when a route handler calls `response.cookies` and contains the `HttpOnly` cookies.
+ * Next.js strips it in `sendResponse` when it serves a cached response.
+ */
+const MIDDLEWARE_SET_COOKIE_HEADER = "x-middleware-set-cookie";
+/**
+ * Returns the headers stored in a cache entry, without the internal `x-middleware-set-cookie` header.
+ *
+ * @param headers The headers stored in the cache entry meta
+ * @returns A copy of the headers without the internal header
+ */
+function getCachedResponseHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        if (value === undefined ||
+            key.toLowerCase() === MIDDLEWARE_SET_COOKIE_HEADER) {
+            continue;
+        }
+        result[key] = value;
+    }
+    return result;
+}
 async function computeCacheControl(path, body, host, revalidate, lastModified, isStaleFromTagCache = false, revalidationPath = path, revalidationKey = path) {
     let finalRevalidate = CACHE_ONE_YEAR;
     const existingRoute = Object.entries(PrerenderManifest?.routes ?? {}).find((p) => p[0] === path)?.[1];
@@ -194,7 +218,7 @@ async function generateResult(event, localizedPath, cachedValue, lastModified, i
     const headers = {
         ...cacheControl,
         "content-type": type,
-        ...cachedValue.meta?.headers,
+        ...getCachedResponseHeaders(cachedValue.meta?.headers),
         vary: VARY_HEADER,
         ...additionalHeaders,
     };
@@ -400,8 +424,7 @@ export async function cacheInterceptor(event, resolvedRoutes) {
                         statusCode: cachedData.value.meta?.status ?? 307,
                         body: emptyReadableStream(),
                         headers: {
-                            ...(cachedData.value.meta?.headers ??
-                                {}),
+                            ...getCachedResponseHeaders(cachedData.value.meta?.headers),
                             ...cacheControl,
                         },
                         isBase64Encoded: false,
@@ -413,7 +436,7 @@ export async function cacheInterceptor(event, resolvedRoutes) {
                     const statusCode = computeStatusCode(event.rewriteStatusCode, cachedData.value.meta?.status);
                     const headers = {
                         ...cacheControl,
-                        ...cachedData.value.meta?.headers,
+                        ...getCachedResponseHeaders(cachedData.value.meta?.headers),
                         vary: VARY_HEADER,
                     };
                     // See the note in `generateResult`.

package/dist/core/routing/matcher.js

@@ -426,6 +426,17 @@ function handleRepeatedSlashRedirect(event) {
     }
     return false;
 }
+/**
+ * Returns the internal trailing slash redirect for the request, if any.
+ *
+ * Mirrors the internal redirects that Next.js generates from `trailingSlash`. They apply to every
+ * path, including API routes, and run before the middleware so that it always sees the canonical
+ * pathname. Data requests (`/_next/data/<buildId>/*.json`) are not redirected.
+ * See https://github.com/vercel/next.js/blob/324b297/packages/next/src/lib/load-custom-routes.ts#L791-L849
+ *
+ * @param event The incoming request
+ * @returns The 308 redirect, or `false` when the path is already canonical
+ */
 function handleTrailingSlashRedirect(event) {
     // When rawPath is `//domain`, `url.host` would be `domain`.
     // https://github.com/opennextjs/opennextjs-aws/issues/355
@@ -433,14 +444,15 @@ function handleTrailingSlashRedirect(event) {
     if (
     // Someone is trying to redirect to a different origin, let's not do that
     url.host !== "localhost" ||
-        NextConfig.skipTrailingSlashRedirect ||
-        // We should not apply trailing slash redirect to API routes
-        event.rawPath.startsWith("/api/")) {
+        NextConfig.skipTrailingSlashRedirect) {
         return false;
     }
     const emptyBody = emptyReadableStream();
     if (NextConfig.trailingSlash &&
-        !(event.query.__nextDataReq === "1") &&
+        // Data requests (`/_next/data/<buildId>/*.json`) are never redirected, as with Next.js.
+        // The header is set by `fixDataPage`, a client supplied value is removed by the routing handler.
+        // The `__nextDataReq` query parameter can not be used as it is set by the client.
+        event.headers["x-nextjs-data"] !== "1" &&
         !event.rawPath.endsWith("/") &&
         !event.rawPath.match(/[\w-]+\.[\w]+$/g)) {
         const headersLocation = event.url.split("?");

package/dist/core/routing/middleware.d.ts

@@ -8,6 +8,10 @@ type MiddlewareLoader = () => Promise<{
  *
  * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
  *
+ * Next.js internal headers are never exposed on the response.
+ * `x-middleware-set-cookie` is only forwarded on the request headers of the returned `MiddlewareEvent`,
+ * regardless of the allowlist.
+ *
  * @param internalEvent The internal request event.
  * @param initialSearch The initial query string received by the handler.
  * @param middlewareLoader The middleware loader, overridden by unit tests.

package/dist/core/routing/middleware.js

@@ -9,6 +9,8 @@ const middlewareManifest = MiddlewareManifest;
 const functionsConfigManifest = FunctionsConfigManifest;
 const middleMatch = getMiddlewareMatch(middlewareManifest, functionsConfigManifest);
 const REDIRECTS = new Set([301, 302, 303, 307, 308]);
+// Internal header set by `NextResponse` when `response.cookies` is modified.
+const MIDDLEWARE_SET_COOKIE_HEADER = "x-middleware-set-cookie";
 function defaultMiddlewareLoader() {
     // @ts-expect-error - This is bundled
     return import("./middleware.mjs");
@@ -18,6 +20,10 @@ function defaultMiddlewareLoader() {
  *
  * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
  *
+ * Next.js internal headers are never exposed on the response.
+ * `x-middleware-set-cookie` is only forwarded on the request headers of the returned `MiddlewareEvent`,
+ * regardless of the allowlist.
+ *
  * @param internalEvent The internal request event.
  * @param initialSearch The initial query string received by the handler.
  * @param middlewareLoader The middleware loader, overridden by unit tests.
@@ -92,6 +98,7 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     const responseHeaders = result.headers;
     const reqHeaders = {};
     const resHeaders = {};
+    let middlewareSetCookie;
     // These are internal headers used by Next.js, we don't want to expose them to the client
     // NOTE: keys must be in lowercase to match the normalized header keys.
     const filteredHeaders = [
@@ -112,6 +119,13 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
         else {
             if (filteredHeaders.includes(normalizedKey))
                 return;
+            // `x-middleware-set-cookie` holds a copy of the cookies set by the middleware,
+            // including the `HttpOnly` ones. It must never be sent to the client.
+            // It is only forwarded on the request (see below) so that `cookies().get()` sees them.
+            if (normalizedKey === MIDDLEWARE_SET_COOKIE_HEADER) {
+                middlewareSetCookie = value;
+                return;
+            }
             // Headers.forEach folds same-name headers; use getSetCookie() below instead.
             if (normalizedKey === "set-cookie")
                 return;
@@ -139,6 +153,11 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     const newHeaders = Object.fromEntries([...Object.entries(internalEvent.headers), ...Object.entries(reqHeaders)]
         .map(([key, value]) => [key.toLowerCase(), value])
         .filter(([key]) => !overriddenHeaders || overriddenHeaders.has(key)));
+    // Next.js forwards `x-middleware-set-cookie` after applying the override allowlist,
+    // so it is never filtered out (see `resolve-routes.ts`).
+    if (middlewareSetCookie !== undefined) {
+        newHeaders[MIDDLEWARE_SET_COOKIE_HEADER] = middlewareSetCookie;
+    }
     // If the middleware returned a Rewrite, set the `url` to the pathname of the rewrite
     // NOTE: the header was added to `req` from above
     const rewriteUrl = responseHeaders.get("x-middleware-rewrite");

package/dist/core/routing/routeParamPlaceholder.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Returns whether a segment of the pathname is the placeholder of a matched dynamic App Router page.
+ *
+ * Next.js versions before 16.4.5 treat a param whose value is its placeholder (e.g. `[slug]` for `[slug]`) as an
+ * unresolved fallback param. Such values are not legitimate and must not reach Next.js.
+ *
+ * Segments are decoded like Next.js decodes param values (catch-all values are split on `/` first).
+ * Segments with a malformed percent encoding never match.
+ * Pathnames without an opening bracket return early, without matching the dynamic routes.
+ *
+ * @param pathname The internal pathname, which may include the basePath, a locale prefix and a trailing slash
+ * @returns Whether a segment of the pathname is a placeholder of a matched dynamic App Router page
+ */
+export declare function hasRouteParamPlaceholder(pathname: string): boolean;

package/dist/core/routing/routeParamPlaceholder.js

@@ -0,0 +1,42 @@
+import { dynamicRouteMatcher } from "./routeMatcher";
+// The placeholders of a route pattern: `[slug]`, `[...slug]` or `[[...slug]]`
+const PLACEHOLDER_REGEX = /\[\[\.\.\.[^\]]+\]\]|\[(?:\.\.\.)?[^\]]+\]/g;
+// A placeholder starts with `[`, which is either literal or percent encoded in the pathname
+const OPENING_BRACKET_REGEX = /\[|%5b/i;
+/**
+ * Returns whether a segment of the pathname is the placeholder of a matched dynamic App Router page.
+ *
+ * Next.js versions before 16.4.5 treat a param whose value is its placeholder (e.g. `[slug]` for `[slug]`) as an
+ * unresolved fallback param. Such values are not legitimate and must not reach Next.js.
+ *
+ * Segments are decoded like Next.js decodes param values (catch-all values are split on `/` first).
+ * Segments with a malformed percent encoding never match.
+ * Pathnames without an opening bracket return early, without matching the dynamic routes.
+ *
+ * @param pathname The internal pathname, which may include the basePath, a locale prefix and a trailing slash
+ * @returns Whether a segment of the pathname is a placeholder of a matched dynamic App Router page
+ */
+export function hasRouteParamPlaceholder(pathname) {
+    if (!OPENING_BRACKET_REGEX.test(pathname)) {
+        return false;
+    }
+    const placeholders = new Set(dynamicRouteMatcher(pathname)
+        .filter(({ type }) => type === "app")
+        .flatMap(({ route }) => route.match(PLACEHOLDER_REGEX) ?? []));
+    return (placeholders.size > 0 &&
+        pathname.split("/").some((segment) => placeholders.has(safeDecode(segment))));
+}
+/**
+ * Decodes a URI component without throwing.
+ *
+ * @param value The encoded value
+ * @returns The decoded value, or an empty string when the encoding is malformed
+ */
+function safeDecode(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return "";
+    }
+}

package/dist/core/routingHandler.js

@@ -6,6 +6,7 @@ import { detectLocale } from "./routing/i18n";
 import { fixDataPage, getNextConfigHeaders, handleBeforeFilesRewrites, handleFallbackFalse, handleRedirects, handleRewrites, } from "./routing/matcher";
 import { handleMiddleware } from "./routing/middleware";
 import { dynamicRouteMatcher, staticRouteMatcher, } from "./routing/routeMatcher";
+import { hasRouteParamPlaceholder } from "./routing/routeParamPlaceholder";
 import { constructNextUrl, normalizeLocationHeader } from "./routing/util";
 export const MIDDLEWARE_HEADER_PREFIX = "x-middleware-response-";
 export const MIDDLEWARE_HEADER_PREFIX_LEN = MIDDLEWARE_HEADER_PREFIX.length;
@@ -159,7 +160,7 @@ export default async function routingHandler(event, { assetResolver }) {
         const isRouteFoundBeforeAllRewrites = isStaticRoute || isDynamicRoute || isExternalRewrite;
         // Resolve against the final internal pathname after every rewrite phase.
         // These ordered matches are also the authoritative cache owner candidates.
-        const resolvedRoutes = [
+        let resolvedRoutes = [
             ...staticRouteMatcher(eventOrResult.rawPath),
             ...dynamicRouteMatcher(eventOrResult.rawPath),
         ];
@@ -169,7 +170,12 @@ export default async function routingHandler(event, { assetResolver }) {
             isNextImageRoute ||
             // We need to check again once all rewrites have been applied
             staticRouteMatcher(eventOrResult.rawPath).length > 0 ||
-            dynamicRouteMatcher(eventOrResult.rawPath).length > 0)) {
+            dynamicRouteMatcher(eventOrResult.rawPath).length > 0) ||
+            // Next.js versions before 16.4.5 treat a param whose value is its placeholder (e.g. `[slug]`) as unresolved.
+            // Next.js receives both the rawPath and the URL pathname, which is normalized (e.g. dot segments).
+            (!isExternalRewrite &&
+                [eventOrResult.rawPath, new URL(eventOrResult.url).pathname].some(hasRouteParamPlaceholder))) {
+            resolvedRoutes = [];
             eventOrResult = {
                 ...eventOrResult,
                 rawPath: "/404",

package/dist/http/framing.d.ts

@@ -0,0 +1,35 @@
+import type { ServerResponse } from "node:http";
+import { type Writable } from "node:stream";
+/**
+ * Largest `content-length` that is verified by buffering the body.
+ *
+ * It matches the largest response compressed by CloudFront, which only compresses responses with a `content-length`.
+ * Larger responses are streamed without `content-length`.
+ */
+export declare const MAX_VERIFIED_CONTENT_LENGTH = 10000000;
+/**
+ * Writes the head of a Node.js `ServerResponse` and returns the stream to write the body to.
+ *
+ * The framing headers set by the app may not match the body that is actually written (e.g. a `fetch()` response
+ * body is decoded but keeps the upstream `content-length`). The bytes past a stale `content-length` would stay on
+ * the keep-alive connection and be read as the next response.
+ *
+ * - `transfer-encoding` is always removed, Node.js picks the transfer coding.
+ * - A `content-length` that is not a valid length is removed.
+ * - `content-length` is kept for HEAD requests and 304 responses, Node.js does not write a body for them.
+ * - Otherwise `content-length` is only kept when the body has exactly the declared length. The body is buffered
+ *   until this is known, and the head is written then, so the first byte is only sent once the whole body is
+ *   received. When the length doesn't match, or is larger than `MAX_VERIFIED_CONTENT_LENGTH`, `content-length` is
+ *   removed and Node.js frames the body itself (chunked on HTTP/1.1).
+ *
+ * The status code and the headers are always validated synchronously, even when the head is written later.
+ *
+ * @param res The Node.js response.
+ * @param method The request method.
+ * @param statusCode The response status code.
+ * @param headers The response headers, keys are matched case-insensitively.
+ * @returns The stream to write the body to.
+ * @throws When the status code or a header is invalid, or the headers were already sent (same errors as
+ *   `res.writeHead()`).
+ */
+export declare function writeResponseHead(res: ServerResponse, method: string | undefined, statusCode: number, headers: Record<string, string>): Writable;

package/dist/http/framing.js

@@ -0,0 +1,181 @@
+import { Transform } from "node:stream";
+import { error } from "../adapters/logger";
+/**
+ * Largest `content-length` that is verified by buffering the body.
+ *
+ * It matches the largest response compressed by CloudFront, which only compresses responses with a `content-length`.
+ * Larger responses are streamed without `content-length`.
+ */
+export const MAX_VERIFIED_CONTENT_LENGTH = 10_000_000;
+/**
+ * Writes the head of a Node.js `ServerResponse` and returns the stream to write the body to.
+ *
+ * The framing headers set by the app may not match the body that is actually written (e.g. a `fetch()` response
+ * body is decoded but keeps the upstream `content-length`). The bytes past a stale `content-length` would stay on
+ * the keep-alive connection and be read as the next response.
+ *
+ * - `transfer-encoding` is always removed, Node.js picks the transfer coding.
+ * - A `content-length` that is not a valid length is removed.
+ * - `content-length` is kept for HEAD requests and 304 responses, Node.js does not write a body for them.
+ * - Otherwise `content-length` is only kept when the body has exactly the declared length. The body is buffered
+ *   until this is known, and the head is written then, so the first byte is only sent once the whole body is
+ *   received. When the length doesn't match, or is larger than `MAX_VERIFIED_CONTENT_LENGTH`, `content-length` is
+ *   removed and Node.js frames the body itself (chunked on HTTP/1.1).
+ *
+ * The status code and the headers are always validated synchronously, even when the head is written later.
+ *
+ * @param res The Node.js response.
+ * @param method The request method.
+ * @param statusCode The response status code.
+ * @param headers The response headers, keys are matched case-insensitively.
+ * @returns The stream to write the body to.
+ * @throws When the status code or a header is invalid, or the headers were already sent (same errors as
+ *   `res.writeHead()`).
+ */
+export function writeResponseHead(res, method, statusCode, headers) {
+    validateHead(res, statusCode);
+    let contentLength;
+    for (const [key, value] of Object.entries(headers)) {
+        const lowerKey = key.toLowerCase();
+        if (lowerKey === "content-length") {
+            contentLength = value;
+        }
+        else if (lowerKey !== "transfer-encoding") {
+            // `setHeader()` validates the header like `writeHead()` does
+            res.setHeader(key, value);
+        }
+    }
+    const expectedLength = parseContentLength(contentLength);
+    if (!Number.isNaN(expectedLength) &&
+        (method?.toUpperCase() === "HEAD" || statusCode === 304)) {
+        res.setHeader("content-length", String(expectedLength));
+        res.writeHead(statusCode);
+        res.flushHeaders();
+        return res;
+    }
+    if (statusCode === 204 || !(expectedLength <= MAX_VERIFIED_CONTENT_LENGTH)) {
+        res.writeHead(statusCode);
+        res.flushHeaders();
+        return res;
+    }
+    const body = new ContentLengthVerifier(res, statusCode, expectedLength);
+    body.pipe(res);
+    return body;
+}
+/**
+ * Checks that the head can be written, the way `res.writeHead()` does.
+ *
+ * The headers are validated by `res.setHeader()`.
+ *
+ * @param res The Node.js response.
+ * @param statusCode The response status code.
+ * @throws {Error} When the headers were already sent (code `ERR_HTTP_HEADERS_SENT`).
+ * @throws {RangeError} When the status code is not in 100-999 (code `ERR_HTTP_INVALID_STATUS_CODE`).
+ */
+function validateHead(res, statusCode) {
+    if (res.headersSent) {
+        throw Object.assign(new Error("Cannot write headers after they are sent to the client"), { code: "ERR_HTTP_HEADERS_SENT" });
+    }
+    const code = statusCode | 0;
+    if (code < 100 || code > 999) {
+        throw Object.assign(new RangeError(`Invalid status code: ${statusCode}`), {
+            code: "ERR_HTTP_INVALID_STATUS_CODE",
+        });
+    }
+}
+/**
+ * Parses a `content-length` header value.
+ *
+ * @param contentLength The header value.
+ * @returns The length, or `NaN` when the value is missing or not a valid length.
+ */
+function parseContentLength(contentLength) {
+    const value = contentLength?.trim() ?? "";
+    const length = /^\d+$/.test(value) ? Number(value) : Number.NaN;
+    return Number.isSafeInteger(length) ? length : Number.NaN;
+}
+/**
+ * Buffers the body until it is known whether it has the declared length, then writes the head and the body.
+ *
+ * The headers, other than `content-length`, are already set on the response.
+ */
+class ContentLengthVerifier extends Transform {
+    res;
+    statusCode;
+    expectedLength;
+    chunks = [];
+    length = 0;
+    headWritten = false;
+    /**
+     * @param res The Node.js response.
+     * @param statusCode The response status code, already validated.
+     * @param expectedLength The declared `content-length`.
+     */
+    constructor(res, statusCode, expectedLength) {
+        super();
+        this.res = res;
+        this.statusCode = statusCode;
+        this.expectedLength = expectedLength;
+    }
+    /**
+     * Buffers the chunk until the head is written, then passes it through.
+     *
+     * The head is written without `content-length` as soon as the body is longer than declared.
+     *
+     * @param chunk The body chunk.
+     * @param _encoding Unused, chunks are buffers.
+     * @param callback Called once the chunk is processed.
+     */
+    _transform(chunk, _encoding, callback) {
+        if (this.headWritten) {
+            callback(null, chunk);
+            return;
+        }
+        this.chunks.push(chunk);
+        this.length += chunk.length;
+        if (this.length > this.expectedLength) {
+            this.writeHead(false);
+        }
+        callback();
+    }
+    /**
+     * Writes the head, when not already written, once the whole body is received.
+     *
+     * @param callback Called once the head and the buffered chunks are written.
+     */
+    _flush(callback) {
+        if (!this.headWritten) {
+            this.writeHead(this.length === this.expectedLength);
+        }
+        callback();
+    }
+    /**
+     * Writes the head and the buffered chunks.
+     *
+     * This runs from the stream callbacks, where a thrown error would be uncaught and crash the process. The
+     * head is validated synchronously in `writeResponseHead()`, if writing it still fails, the response is destroyed.
+     *
+     * @param keepContentLength Whether the body has the declared length.
+     */
+    writeHead(keepContentLength) {
+        this.headWritten = true;
+        const chunks = this.chunks;
+        this.chunks = [];
+        try {
+            if (keepContentLength) {
+                this.res.setHeader("content-length", String(this.expectedLength));
+            }
+            this.res.writeHead(this.statusCode);
+        }
+        catch (e) {
+            error("Failed to write the response head", e);
+            this.res.destroy();
+            // Without an error, no `error` event is emitted
+            this.destroy();
+            return;
+        }
+        for (const chunk of chunks) {
+            this.push(chunk);
+        }
+    }
+}

package/dist/http/util.d.ts

@@ -8,6 +8,17 @@ export declare const convertHeader: (header: http.OutgoingHttpHeader) => string;
  * @returns A list of Set-Cookie header
  */
 export declare function parseSetCookieHeader(cookies: string | string[] | null | undefined): string[];
+/**
+ * Converts the headers of a response returned by an edge function.
+ *
+ * `Set-Cookie` headers are returned as a list.
+ * The internal `x-middleware-set-cookie` header is dropped: `NextResponse` sets it when
+ * `response.cookies` is modified (i.e. in a route handler) and it contains the `HttpOnly` cookies.
+ *
+ * @param headers The headers of the response
+ * @returns The response headers to send to the client
+ */
+export declare function convertEdgeResponseHeaders(headers: Pick<Headers, "forEach" | "getSetCookie">): Record<string, string | string[]>;
 /**
  *
  * Get the query object from an iterable of [key, value] pairs

package/dist/http/util.js

@@ -58,6 +58,32 @@ export function parseSetCookieHeader(cookies) {
     }
     return cookies;
 }
+/**
+ * Converts the headers of a response returned by an edge function.
+ *
+ * `Set-Cookie` headers are returned as a list.
+ * The internal `x-middleware-set-cookie` header is dropped: `NextResponse` sets it when
+ * `response.cookies` is modified (i.e. in a route handler) and it contains the `HttpOnly` cookies.
+ *
+ * @param headers The headers of the response
+ * @returns The response headers to send to the client
+ */
+export function convertEdgeResponseHeaders(headers) {
+    const responseHeaders = {};
+    headers.forEach((value, key) => {
+        const lowerKey = key.toLowerCase();
+        // Headers.forEach folds same-name headers; use getSetCookie() below instead.
+        if (lowerKey === "set-cookie" || lowerKey === "x-middleware-set-cookie") {
+            return;
+        }
+        responseHeaders[key] = value;
+    });
+    const setCookies = headers.getSetCookie();
+    if (setCookies.length > 0) {
+        responseHeaders["set-cookie"] = setCookies;
+    }
+    return responseHeaders;
+}
 /**
  *
  * Get the query object from an iterable of [key, value] pairs

package/dist/overrides/proxyExternalRequest/fetch.js

@@ -4,7 +4,11 @@ const fetchProxy = {
     // @ts-ignore
     proxy: async (internalEvent) => {
         const { url, headers: eventHeaders, method, body } = internalEvent;
-        const headers = Object.fromEntries(Object.entries(eventHeaders).filter(([key]) => key.toLowerCase() !== "cf-connecting-ip"));
+        const headers = Object.fromEntries(Object.entries(eventHeaders).filter(([key]) => !["cf-connecting-ip", "x-forwarded-host"].includes(key.toLowerCase())));
+        // Like Next.js, do not relay the `x-forwarded-host` sent by the client
+        if (eventHeaders.host) {
+            headers["x-forwarded-host"] = eventHeaders.host;
+        }
         const response = await fetch(url, {
             method,
             headers,

package/dist/overrides/proxyExternalRequest/node.js

@@ -6,6 +6,7 @@ function filterHeadersForProxy(headers) {
     const filteredHeaders = {};
     const disallowedHeaders = [
         "host",
+        "x-forwarded-host",
         "connection",
         "via",
         "x-cache",
@@ -30,6 +31,10 @@ const nodeProxy = {
         debug("proxyRequest", url);
         return new Promise((resolve, reject) => {
             const filteredHeaders = filterHeadersForProxy(headers);
+            // Like Next.js, do not relay the `x-forwarded-host` sent by the client
+            if (headers.host) {
+                filteredHeaders["x-forwarded-host"] = headers.host;
+            }
             debug("filteredHeaders", filteredHeaders);
             const req = request(url, {
                 headers: filteredHeaders,

package/dist/overrides/wrappers/express-dev.js

@@ -1,6 +1,7 @@
 import path from "node:path";
 import express from "express";
 import { NextConfig } from "../../adapters/config/index.js";
+import { writeResponseHead } from "../../http/framing.js";
 import { getMonorepoRelativePath } from "../../utils/normalize-path.js";
 const wrapper = async (handler, converter) => {
     const app = express();
@@ -16,8 +17,7 @@ const wrapper = async (handler, converter) => {
         const internalEvent = await converter.convertFrom(req);
         const streamCreator = {
             writeHeaders: (prelude) => {
-                res.writeHead(prelude.statusCode, prelude.headers);
-                return res;
+                return writeResponseHead(res, req.method, prelude.statusCode, prelude.headers);
             },
         };
         await imageHandler(internalEvent, { streamCreator });
@@ -34,9 +34,7 @@ const wrapper = async (handler, converter) => {
         const streamCreator = {
             writeHeaders: (prelude) => {
                 res.setHeader("Set-Cookie", prelude.cookies);
-                res.writeHead(prelude.statusCode, prelude.headers);
-                res.flushHeaders();
-                return res;
+                return writeResponseHead(res, req.method, prelude.statusCode, prelude.headers);
             },
             onFinish: () => { },
             abortSignal: abortController.signal,

package/dist/overrides/wrappers/node.js

@@ -1,4 +1,5 @@
 import { createServer } from "node:http";
+import { writeResponseHead } from "../../http/framing.js";
 import { debug, error } from "../../adapters/logger";
 const wrapper = async (handler, converter) => {
     const server = createServer(async (req, res) => {
@@ -7,9 +8,7 @@ const wrapper = async (handler, converter) => {
         const streamCreator = {
             writeHeaders: (prelude) => {
                 res.setHeader("Set-Cookie", prelude.cookies);
-                res.writeHead(prelude.statusCode, prelude.headers);
-                res.flushHeaders();
-                return res;
+                return writeResponseHead(res, req.method, prelude.statusCode, prelude.headers);
             },
             abortSignal: abortController.signal,
         };

package/dist/utils/cache.d.ts

@@ -1,4 +1,18 @@
 import type { CacheValue, NextModeTagCacheWriteInput, OriginalTagCacheWriteInput, WithLastModified } from "../types/overrides.js";
+/**
+ * Computes the key used to store a composable (`"use cache"`) entry.
+ *
+ * The cache key provided by Next.js embeds the serialized arguments of the cached function and may
+ * contain any UTF-16 string. Storage backends transform keys (path normalization, URL parsing,
+ * UTF-8 encoding, ...) which could map distinct Next.js keys to the same stored entry.
+ *
+ * The storage key is the sha256 of the exact UTF-16 code units of the cache key, as a 64 characters
+ * lowercase hex string that every backend can store as is.
+ *
+ * @param cacheKey The cache key provided by Next.js
+ * @returns The key to use for the incremental cache and the tag cache
+ */
+export declare function getComposableCacheStorageKey(cacheKey: string): string;
 /**
  *
  * @param key The key for that specific cache entry

package/dist/utils/cache.js

@@ -1,6 +1,26 @@
+import { Buffer } from "node:buffer";
+import { createHash } from "node:crypto";
 import { debug } from "../adapters/logger";
 import { CACHE_TAGS_HEADER } from "./cacheHeaders";
 import { compareSemver } from "./semver";
+/**
+ * Computes the key used to store a composable (`"use cache"`) entry.
+ *
+ * The cache key provided by Next.js embeds the serialized arguments of the cached function and may
+ * contain any UTF-16 string. Storage backends transform keys (path normalization, URL parsing,
+ * UTF-8 encoding, ...) which could map distinct Next.js keys to the same stored entry.
+ *
+ * The storage key is the sha256 of the exact UTF-16 code units of the cache key, as a 64 characters
+ * lowercase hex string that every backend can store as is.
+ *
+ * @param cacheKey The cache key provided by Next.js
+ * @returns The key to use for the incremental cache and the tag cache
+ */
+export function getComposableCacheStorageKey(cacheKey) {
+    return createHash("sha256")
+        .update(Buffer.from(cacheKey, "utf16le"))
+        .digest("hex");
+}
 /**
  *
  * @param key The key for that specific cache entry

package/package.json

@@ -3,7 +3,7 @@
     "access": "public"
   },
   "name": "@opennextjs/aws",
-  "version": "4.1.14",
+  "version": "4.1.15",
   "bin": {
     "open-next": "./dist/index.js"
   },
@@ -57,13 +57,13 @@
     "@types/node": "20.17.6",
     "concurrently": "^9.2.4",
     "diff": "^9.0.0",
-    "next": "16.4.1",
+    "next": "16.4.5",
     "tsc-alias": "^1.9.7",
     "typescript": "5.9.3"
   },
   "peerDependencies": {
     "diff": "^9.0.0",
-    "next": ">=15.5.28 <16 || >=16.4.1"
+    "next": ">=15.5.29 <16 || >=16.4.5"
   },
   "peerDependenciesMeta": {
     "diff": {