@opennextjs/aws 4.1.14 → 4.1.16

package/dist/adapters/cache.js

@@ -167,8 +167,9 @@ export default class Cache {
             const store = globalThis.__openNextAls.getStore();
             if (store) {
                 // The sentinel is kept as is in the store so that the revalidation queue keeps
-                // deduplicating every stale request for the same path.
+                // deduplicating every stale request for the same path. The queue gets the real time.
                 store.lastModified = _isStale ? 1 : _lastModified;
+                store.entryLastModified = _lastModified;
             }
             if (_isStale) {
                 _lastModified = getStaleLastModified(cacheData.revalidate);

package/dist/adapters/composable-cache.d.ts

@@ -1,5 +1,15 @@
 import type { ComposableCacheEntry } from "../types/cache.js";
 declare const _default: {
+    /**
+     * Reads a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @returns The cache entry, or `undefined` on a miss or when the entry has been revalidated.
+     * Errors are caught and reported as a miss.
+     */
     get(cacheKey: string): Promise<{
         value: import("stream/web").ReadableStream<any>;
         tags: string[];
@@ -8,6 +18,16 @@ declare const _default: {
         expire: number;
         revalidate: number;
     } | undefined>;
+    /**
+     * Writes a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @param pendingEntry The entry to store, resolves once the cached function has completed
+     * @throws When the entry can not be resolved or when the incremental cache or tag cache write fails
+     */
     set(cacheKey: string, pendingEntry: Promise<ComposableCacheEntry>): Promise<void>;
     refreshTags(): Promise<void>;
     /**

package/dist/adapters/composable-cache.js

@@ -1,4 +1,4 @@
-import { isStale, writeTags } from "../utils/cache.js";
+import { getComposableCacheStorageKey, isStale, writeTags } from "../utils/cache.js";
 import { fromReadableStream, toReadableStream } from "../utils/stream.js";
 import { debug } from "./logger";
 /**
@@ -17,12 +17,25 @@ import { debug } from "./logger";
  * flight from the same render while making a cross-request share impossible.
  * With no ALS store (e.g. at build time) the dedupe is skipped and `get` falls
  * through to the incremental cache.
+ *
+ * The map is keyed by the cache key provided by Next.js: it is an in-memory exact string
+ * comparison so there is no need to use the storage key (see `getComposableCacheStorageKey`).
  */
 const PENDING_WRITES_CACHE_KEY = "composable-cache:pending-writes";
 const getPendingWritePromiseMap = () => globalThis.__openNextAls
     ?.getStore()
     ?.requestCache?.getOrCreate(PENDING_WRITES_CACHE_KEY);
 export default {
+    /**
+     * Reads a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @returns The cache entry, or `undefined` on a miss or when the entry has been revalidated.
+     * Errors are caught and reported as a miss.
+     */
     async get(cacheKey) {
         try {
             // We first check if we have a pending write for this cache key
@@ -37,7 +50,8 @@ export default {
                     }));
                 }
             }
-            const result = await globalThis.incrementalCache.get(cacheKey, "composable");
+            const storageKey = getComposableCacheStorageKey(cacheKey);
+            const result = await globalThis.incrementalCache.get(storageKey, "composable");
             if (!result?.value?.value) {
                 return undefined;
             }
@@ -54,7 +68,7 @@ export default {
                 // Check if tags are stale – entry is valid but needs background revalidation
                 const isCacheStale = result.shouldBypassTagCache
                     ? false
-                    : await isStale(cacheKey, result.value.tags, result.lastModified);
+                    : await isStale(storageKey, result.value.tags, result.lastModified);
                 if (isCacheStale) {
                     revalidate = -1;
                 }
@@ -63,13 +77,13 @@ export default {
                 globalThis.tagCache.mode === undefined) {
                 const hasBeenRevalidated = result.shouldBypassTagCache
                     ? false
-                    : (await globalThis.tagCache.getLastModified(cacheKey, result.lastModified)) === -1;
+                    : (await globalThis.tagCache.getLastModified(storageKey, result.lastModified)) === -1;
                 if (hasBeenRevalidated)
                     return undefined;
                 // Check if tags are stale – entry is valid but needs background revalidation
                 const isCacheStale = result.shouldBypassTagCache
                     ? false
-                    : await isStale(cacheKey, result.value.tags, result.lastModified);
+                    : await isStale(storageKey, result.value.tags, result.lastModified);
                 if (isCacheStale) {
                     revalidate = -1;
                 }
@@ -85,6 +99,16 @@ export default {
             return undefined;
         }
     },
+    /**
+     * Writes a composable cache entry.
+     *
+     * The incremental cache and the tag cache are accessed with a key derived from `cacheKey`,
+     * see `getComposableCacheStorageKey`.
+     *
+     * @param cacheKey The cache key provided by Next.js
+     * @param pendingEntry The entry to store, resolves once the cached function has completed
+     * @throws When the entry can not be resolved or when the incremental cache or tag cache write fails
+     */
     async set(cacheKey, pendingEntry) {
         const promiseEntry = pendingEntry.then(async (entry) => ({
             ...entry,
@@ -95,15 +119,16 @@ export default {
         const entry = await promiseEntry.finally(() => {
             pendingWritePromiseMap?.delete(cacheKey);
         });
-        await globalThis.incrementalCache.set(cacheKey, {
+        const storageKey = getComposableCacheStorageKey(cacheKey);
+        await globalThis.incrementalCache.set(storageKey, {
             ...entry,
             value: entry.value,
         }, "composable");
         if (globalThis.tagCache.mode === "original") {
-            const storedTags = await globalThis.tagCache.getByPath(cacheKey);
+            const storedTags = await globalThis.tagCache.getByPath(storageKey);
             const tagsToWrite = entry.tags.filter((tag) => !storedTags.includes(tag));
             if (tagsToWrite.length > 0) {
-                await writeTags(tagsToWrite.map((tag) => ({ tag, path: cacheKey })));
+                await writeTags(tagsToWrite.map((tag) => ({ tag, path: storageKey })));
             }
         }
     },

package/dist/adapters/edge-adapter.js

@@ -1,3 +1,4 @@
+import { convertEdgeResponseHeaders } from "../http/util.js";
 import { runWithOpenNextRequestContext } from "../utils/promise.js";
 import { emptyReadableStream } from "../utils/stream.js";
 // We import it like that so that the edge plugin can replace it
@@ -26,17 +27,7 @@ const defaultHandler = async (internalEvent, options) => {
             url: internalEvent.url,
             body: convertBodyToReadableStream(internalEvent.method, internalEvent.body),
         });
-        const responseHeaders = {};
-        response.headers.forEach((value, key) => {
-            // Headers.forEach folds same-name headers; use getSetCookie() below instead.
-            if (key.toLowerCase() === "set-cookie")
-                return;
-            responseHeaders[key] = value;
-        });
-        const setCookies = response.headers.getSetCookie();
-        if (setCookies.length > 0) {
-            responseHeaders["set-cookie"] = setCookies;
-        }
+        const responseHeaders = convertEdgeResponseHeaders(response.headers);
         const body = response.body ?? emptyReadableStream();
         return {
             type: "core",

package/dist/core/requestHandler.d.ts

@@ -2,6 +2,22 @@ import type { OpenNextNodeResponse } from "../http/index.js";
 import { IncomingMessage } from "../http/index.js";
 import type { InternalEvent, InternalResult, RoutingResult } from "../types/open-next.js";
 import type { OpenNextHandlerOptions } from "../types/overrides.js";
+type HeaderRecord = InternalEvent["headers"];
+/**
+ * Splits the headers of a routed event into the request and response headers.
+ *
+ * The routing adds the middleware and `next.config` response headers to the event with a prefix each (see
+ * `applyResponseHeaders`). As in Next.js, both go on the response but only the middleware headers go on the request:
+ * a `Content-Security-Policy` from `next.config` must not replace the one, holding the script nonce, that the
+ * middleware set on the request.
+ *
+ * @param eventHeaders The headers of the routed event, not modified
+ * @returns The headers to send to Next.js and the headers to set on the response
+ */
+export declare function splitRoutingHeaders(eventHeaders: HeaderRecord): {
+    requestHeaders: HeaderRecord;
+    responseHeaders: HeaderRecord;
+};
 export declare function openNextHandler(internalEvent: InternalEvent, options?: OpenNextHandlerOptions): Promise<InternalResult>;
 /**
  * Renders the next resolved route after a `fallback: false` route threw a `NoFallbackError`.
@@ -26,3 +42,4 @@ export declare function openNextHandler(internalEvent: InternalEvent, options?:
  * @return A promise that resolves after rendering a route or an error response
  */
 export declare function handleNoFallbackError(req: IncomingMessage, res: OpenNextNodeResponse, routingResult: RoutingResult, metadata: Record<string, unknown>, index?: number): Promise<void>;
+export {};

package/dist/core/requestHandler.js

@@ -8,13 +8,45 @@ import { debug, error } from "../adapters/logger";
 import { patchAsyncStorage } from "./patchAsyncStorage";
 import { getRouteMatchMetadata } from "./routeMatchMetadata";
 import { constructNextUrl, convertRes, convertToQuery, createServerResponse, } from "./routing/util";
-import routingHandler, { INTERNAL_EVENT_REQUEST_ID, INTERNAL_HEADER_REWRITE_STATUS_CODE, INTERNAL_HEADER_INITIAL_URL, INTERNAL_HEADER_RESOLVED_ROUTES, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_HEADER_PREFIX_LEN, } from "./routingHandler";
+import routingHandler, { INTERNAL_EVENT_REQUEST_ID, INTERNAL_HEADER_REWRITE_STATUS_CODE, INTERNAL_HEADER_INITIAL_URL, INTERNAL_HEADER_RESOLVED_ROUTES, MIDDLEWARE_HEADER_PREFIX, MIDDLEWARE_HEADER_PREFIX_LEN, NEXT_CONFIG_HEADER_PREFIX, NEXT_CONFIG_HEADER_PREFIX_LEN, } from "./routingHandler";
 import { requestHandler, setNextjsPrebundledReact } from "./util";
 // This is used to identify requests in the cache
 globalThis.__openNextAls = new AsyncLocalStorage();
 //#override patchAsyncStorage
 patchAsyncStorage();
 //#endOverride
+/**
+ * Splits the headers of a routed event into the request and response headers.
+ *
+ * The routing adds the middleware and `next.config` response headers to the event with a prefix each (see
+ * `applyResponseHeaders`). As in Next.js, both go on the response but only the middleware headers go on the request:
+ * a `Content-Security-Policy` from `next.config` must not replace the one, holding the script nonce, that the
+ * middleware set on the request.
+ *
+ * @param eventHeaders The headers of the routed event, not modified
+ * @returns The headers to send to Next.js and the headers to set on the response
+ */
+export function splitRoutingHeaders(eventHeaders) {
+    const requestHeaders = {};
+    const middlewareHeaders = {};
+    const nextConfigHeaders = {};
+    for (const [key, value] of Object.entries(eventHeaders)) {
+        if (key.startsWith(MIDDLEWARE_HEADER_PREFIX)) {
+            middlewareHeaders[key.slice(MIDDLEWARE_HEADER_PREFIX_LEN)] = value;
+        }
+        else if (key.startsWith(NEXT_CONFIG_HEADER_PREFIX)) {
+            nextConfigHeaders[key.slice(NEXT_CONFIG_HEADER_PREFIX_LEN)] = value;
+        }
+        else {
+            requestHeaders[key] = value;
+        }
+    }
+    return {
+        requestHeaders: { ...requestHeaders, ...middlewareHeaders },
+        // The routing already dropped the `next.config` headers that must not take precedence.
+        responseHeaders: { ...middlewareHeaders, ...nextConfigHeaders },
+    };
+}
 export async function openNextHandler(internalEvent, options) {
     const initialHeaders = internalEvent.headers;
     // We only use the requestId header if we are using an external middleware
@@ -60,22 +92,20 @@ export async function openNextHandler(internalEvent, options) {
             assetResolver: globalThis.assetResolver,
         });
         //#endOverride
-        const headers = "type" in routingResult
-            ? routingResult.headers
-            : routingResult.internalEvent.headers;
-        const overwrittenResponseHeaders = {};
-        for (const [rawKey, value] of Object.entries(headers)) {
-            if (!rawKey.startsWith(MIDDLEWARE_HEADER_PREFIX)) {
-                continue;
-            }
-            const key = rawKey.slice(MIDDLEWARE_HEADER_PREFIX_LEN);
-            // We skip this header here since it is used by Next internally and we don't want it on the response headers.
-            // This header needs to be present in the request headers for processRequest, so cookies().get() from Next will work on initial render.
-            if (key !== "x-middleware-set-cookie") {
-                overwrittenResponseHeaders[key] = value;
-            }
-            headers[key] = value;
-            delete headers[rawKey];
+        // The headers of a result are not prefixed, they are the response headers.
+        let requestHeaders = {};
+        let overwrittenResponseHeaders = {};
+        if (!("type" in routingResult)) {
+            const split = splitRoutingHeaders(routingResult.internalEvent.headers);
+            requestHeaders = split.requestHeaders;
+            overwrittenResponseHeaders = split.responseHeaders;
+            routingResult = {
+                ...routingResult,
+                internalEvent: {
+                    ...routingResult.internalEvent,
+                    headers: requestHeaders,
+                },
+            };
         }
         if ("isExternalRewrite" in routingResult &&
             routingResult.isExternalRewrite === true) {
@@ -138,7 +168,7 @@ export async function openNextHandler(internalEvent, options) {
             // 2. We could alter the lastModified time of our cache to make next believe that the cache is fresh, but this could cause issues with stale data since the cdn will cache the stale data as if it was fresh
             // 3. OUR CHOICE: We could pass a purpose prefetch header to the serverless function to make next believe that the request is a prefetch request and not trigger revalidation (This could potentially break in the future if next changes the behavior of prefetch requests)
             headers: {
-                ...headers,
+                ...requestHeaders,
                 //#override appendPrefetch
                 purpose: "prefetch",
                 //#endOverride

package/dist/core/revalidate.js

@@ -121,6 +121,7 @@ export function createRevalidate(revalidateInProcess) {
             ? globalThis.__openNextAls.run({
                 ...store,
                 lastModified: undefined,
+                entryLastModified: undefined,
                 writtenTags: new Set(),
                 requestCache: new RequestCache(),
             }, renderInProcess)

package/dist/core/routing/cacheInterceptor.js

@@ -1,5 +1,6 @@
 import { createHash } from "node:crypto";
 import { AppPathsManifest, NextConfig, PagesManifest, PrerenderManifest, } from "../../adapters/config/index.js";
+import { decodePathParams } from "../../utils/normalize-path.js";
 import { emptyReadableStream, toReadableStream } from "../../utils/stream.js";
 import { isBinaryContentType } from "../../utils/binary.js";
 import { getTagsFromValue, hasBeenRevalidated, isStale } from "../../utils/cache.js";
@@ -24,6 +25,30 @@ const VARY_HEADER = "RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Rou
 const NEXT_SEGMENT_PREFETCH_HEADER = "next-router-segment-prefetch";
 const NEXT_PRERENDER_HEADER = "x-nextjs-prerender";
 const NEXT_POSTPONED_HEADER = "x-nextjs-postponed";
+/**
+ * Internal header that can be stored in a cache entry but must not be sent to the client.
+ *
+ * It is set when a route handler calls `response.cookies` and contains the `HttpOnly` cookies.
+ * Next.js strips it in `sendResponse` when it serves a cached response.
+ */
+const MIDDLEWARE_SET_COOKIE_HEADER = "x-middleware-set-cookie";
+/**
+ * Returns the headers stored in a cache entry, without the internal `x-middleware-set-cookie` header.
+ *
+ * @param headers The headers stored in the cache entry meta
+ * @returns A copy of the headers without the internal header
+ */
+function getCachedResponseHeaders(headers) {
+    const result = {};
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        if (value === undefined ||
+            key.toLowerCase() === MIDDLEWARE_SET_COOKIE_HEADER) {
+            continue;
+        }
+        result[key] = value;
+    }
+    return result;
+}
 async function computeCacheControl(path, body, host, revalidate, lastModified, isStaleFromTagCache = false, revalidationPath = path, revalidationKey = path) {
     let finalRevalidate = CACHE_ONE_YEAR;
     const existingRoute = Object.entries(PrerenderManifest?.routes ?? {}).find((p) => p[0] === path)?.[1];
@@ -194,7 +219,7 @@ async function generateResult(event, localizedPath, cachedValue, lastModified, i
     const headers = {
         ...cacheControl,
         "content-type": type,
-        ...cachedValue.meta?.headers,
+        ...getCachedResponseHeaders(cachedValue.meta?.headers),
         vary: VARY_HEADER,
         ...additionalHeaders,
     };
@@ -231,26 +256,6 @@ function computeStatusCode(rewriteStatusCode, cachedStatusCode) {
     }
     return rewriteStatusCode ?? cachedStatusCode ?? 200;
 }
-/**
- *
- * https://github.com/vercel/next.js/blob/34039551d2e5f611c0abde31a197d9985918adaf/packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts#L2-L10
- */
-function escapePathDelimiters(segment, escapeEncoded) {
-    return segment.replace(new RegExp(`([/#?]${escapeEncoded ? "|%(2f|23|3f|5c)" : ""})`, "gi"), (char) => encodeURIComponent(char));
-}
-/**
- *
- * SSG cache key needs to be decoded, but some characters needs to be properly escaped
- * https://github.com/vercel/next.js/blob/34039551d2e5f611c0abde31a197d9985918adaf/packages/next/src/server/lib/router-utils/decode-path-params.ts#L11-L26
- * Decoding must be atomic, as in Next.js. Partially decoding a malformed path
- * could select a different cache route than the one evaluated by middleware.
- */
-function decodePathParams(pathname) {
-    return pathname
-        .split("/")
-        .map((segment) => escapePathDelimiters(decodeURIComponent(segment), true))
-        .join("/");
-}
 let routeCacheManifests;
 function getRouteCacheManifests() {
     routeCacheManifests ??= {
@@ -400,8 +405,7 @@ export async function cacheInterceptor(event, resolvedRoutes) {
                         statusCode: cachedData.value.meta?.status ?? 307,
                         body: emptyReadableStream(),
                         headers: {
-                            ...(cachedData.value.meta?.headers ??
-                                {}),
+                            ...getCachedResponseHeaders(cachedData.value.meta?.headers),
                             ...cacheControl,
                         },
                         isBase64Encoded: false,
@@ -413,7 +417,7 @@ export async function cacheInterceptor(event, resolvedRoutes) {
                     const statusCode = computeStatusCode(event.rewriteStatusCode, cachedData.value.meta?.status);
                     const headers = {
                         ...cacheControl,
-                        ...cachedData.value.meta?.headers,
+                        ...getCachedResponseHeaders(cachedData.value.meta?.headers),
                         vary: VARY_HEADER,
                     };
                     // See the note in `generateResult`.

package/dist/core/routing/matcher.d.ts

@@ -20,9 +20,12 @@ export declare function getCompiledRegExp(pattern: string, flags?: string): RegE
  * interpolation, with condition parameters taking precedence. See
  * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/server/lib/router-utils/resolve-routes.ts#L400-L414
  *
+ * Header names are lowercased. As Next.js applies them with the case-insensitive `res.setHeader()`, the last matching
+ * route wins when several set the same header, whatever its case.
+ *
  * @param event The request used to match configured headers
  * @param configHeaders The configured header routes
- * @returns The response headers produced by every matching route
+ * @returns The response headers produced by every matching route, keyed by lowercase name
  * @throws {SyntaxError} When a configured route pattern is invalid
  */
 export declare function getNextConfigHeaders(event: InternalEvent, configHeaders?: Header[] | undefined): Record<string, string | undefined>;
@@ -78,6 +81,16 @@ export declare function handleRewrites<T extends RewriteDefinition>(event: Inter
 export declare function handleBeforeFilesRewrites<T extends RewriteDefinition>(event: InternalEvent, rewrites: T[]): ReturnType<typeof handleRewrites<T>>;
 export declare function handleRedirects(event: InternalEvent, redirects: RedirectDefinition[]): InternalResult | undefined;
 export declare function fixDataPage(internalEvent: InternalEvent, buildId: string): InternalEvent | InternalResult;
+/**
+ * Rewrites the event to `/404` for paths that `fallback: false` routes do not pregenerate.
+ *
+ * A path is pregenerated when its decoded form is a key of the prerender manifest routes.
+ * The rewrite only applies when no other static or dynamic route can serve the path.
+ *
+ * @param internalEvent The incoming event
+ * @param prerenderManifest The prerender manifest
+ * @returns The (possibly rewritten) event and whether the path is pregenerated
+ */
 export declare function handleFallbackFalse(internalEvent: InternalEvent, prerenderManifest?: PrerenderManifest): {
     event: InternalEvent;
     isISR: boolean;

package/dist/core/routing/matcher.js

@@ -1,6 +1,6 @@
 import { NextConfig } from "../../adapters/config/index.js";
 import { compile, match, parse } from "path-to-regexp";
-import { normalizeRepeatedSlashes } from "../../utils/normalize-path.js";
+import { decodePathParams, normalizeRepeatedSlashes, } from "../../utils/normalize-path.js";
 import { emptyReadableStream, toReadableStream } from "../../utils/stream.js";
 import { debug } from "../../adapters/logger";
 import { handleLocaleRedirect, localizePath } from "./i18n";
@@ -223,9 +223,12 @@ function compileQueryString(queryString, params) {
  * interpolation, with condition parameters taking precedence. See
  * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/server/lib/router-utils/resolve-routes.ts#L400-L414
  *
+ * Header names are lowercased. As Next.js applies them with the case-insensitive `res.setHeader()`, the last matching
+ * route wins when several set the same header, whatever its case.
+ *
  * @param event The request used to match configured headers
  * @param configHeaders The configured header routes
- * @returns The response headers produced by every matching route
+ * @returns The response headers produced by every matching route, keyed by lowercase name
  * @throws {SyntaxError} When a configured route pattern is invalid
  */
 export function getNextConfigHeaders(event, configHeaders) {
@@ -254,11 +257,11 @@ export function getNextConfigHeaders(event, configHeaders) {
                 try {
                     const key = hasParams ? compileNonPath(h.key, params) : h.key;
                     const value = hasParams ? compileNonPath(h.value, params) : h.value;
-                    requestHeaders[key] = value;
+                    requestHeaders[key.toLowerCase()] = value;
                 }
                 catch {
                     debug(`Error matching header ${h.key} with value ${h.value}`);
-                    requestHeaders[h.key] = h.value;
+                    requestHeaders[h.key.toLowerCase()] = h.value;
                 }
             });
         }
@@ -426,6 +429,17 @@ function handleRepeatedSlashRedirect(event) {
     }
     return false;
 }
+/**
+ * Returns the internal trailing slash redirect for the request, if any.
+ *
+ * Mirrors the internal redirects that Next.js generates from `trailingSlash`. They apply to every
+ * path, including API routes, and run before the middleware so that it always sees the canonical
+ * pathname. Data requests (`/_next/data/<buildId>/*.json`) are not redirected.
+ * See https://github.com/vercel/next.js/blob/324b297/packages/next/src/lib/load-custom-routes.ts#L791-L849
+ *
+ * @param event The incoming request
+ * @returns The 308 redirect, or `false` when the path is already canonical
+ */
 function handleTrailingSlashRedirect(event) {
     // When rawPath is `//domain`, `url.host` would be `domain`.
     // https://github.com/opennextjs/opennextjs-aws/issues/355
@@ -433,14 +447,15 @@ function handleTrailingSlashRedirect(event) {
     if (
     // Someone is trying to redirect to a different origin, let's not do that
     url.host !== "localhost" ||
-        NextConfig.skipTrailingSlashRedirect ||
-        // We should not apply trailing slash redirect to API routes
-        event.rawPath.startsWith("/api/")) {
+        NextConfig.skipTrailingSlashRedirect) {
         return false;
     }
     const emptyBody = emptyReadableStream();
     if (NextConfig.trailingSlash &&
-        !(event.query.__nextDataReq === "1") &&
+        // Data requests (`/_next/data/<buildId>/*.json`) are never redirected, as with Next.js.
+        // The header is set by `fixDataPage`, a client supplied value is removed by the routing handler.
+        // The `__nextDataReq` query parameter can not be used as it is set by the client.
+        event.headers["x-nextjs-data"] !== "1" &&
         !event.rawPath.endsWith("/") &&
         !event.rawPath.match(/[\w-]+\.[\w]+$/g)) {
         const headersLocation = event.url.split("?");
@@ -528,6 +543,16 @@ export function fixDataPage(internalEvent, buildId) {
     }
     return internalEvent;
 }
+/**
+ * Rewrites the event to `/404` for paths that `fallback: false` routes do not pregenerate.
+ *
+ * A path is pregenerated when its decoded form is a key of the prerender manifest routes.
+ * The rewrite only applies when no other static or dynamic route can serve the path.
+ *
+ * @param internalEvent The incoming event
+ * @param prerenderManifest The prerender manifest
+ * @returns The (possibly rewritten) event and whether the path is pregenerated
+ */
 export function handleFallbackFalse(internalEvent, prerenderManifest) {
     const { rawPath } = internalEvent;
     const { dynamicRoutes = {}, routes = {} } = prerenderManifest ?? {};
@@ -551,7 +576,14 @@ export function handleFallbackFalse(internalEvent, prerenderManifest) {
     const matchedStaticRoute = staticRouteMatcher(localizedPath);
     const prerenderedFallbackRoutesName = prerenderedFallbackRoutes.map(([name]) => name);
     const matchedDynamicRoute = dynamicRouteMatcher(localizedPath).filter(({ route }) => !prerenderedFallbackRoutesName.includes(route));
-    const isPregenerated = Object.keys(routes).includes(localizedPath);
+    let isPregenerated = false;
+    try {
+        // The prerender manifest keys routes by their decoded path while rawPath is percent-encoded.
+        isPregenerated = Object.hasOwn(routes, decodePathParams(localizedPath));
+    }
+    catch {
+        // A malformed escape sequence cannot name a prerendered route.
+    }
     if (routeFallback &&
         !isPregenerated &&
         matchedStaticRoute.length === 0 &&

package/dist/core/routing/middleware.d.ts

@@ -8,6 +8,10 @@ type MiddlewareLoader = () => Promise<{
  *
  * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
  *
+ * Next.js internal headers are never exposed on the response.
+ * `x-middleware-set-cookie` is only forwarded on the request headers of the returned `MiddlewareEvent`,
+ * regardless of the allowlist.
+ *
  * @param internalEvent The internal request event.
  * @param initialSearch The initial query string received by the handler.
  * @param middlewareLoader The middleware loader, overridden by unit tests.

package/dist/core/routing/middleware.js

@@ -9,6 +9,8 @@ const middlewareManifest = MiddlewareManifest;
 const functionsConfigManifest = FunctionsConfigManifest;
 const middleMatch = getMiddlewareMatch(middlewareManifest, functionsConfigManifest);
 const REDIRECTS = new Set([301, 302, 303, 307, 308]);
+// Internal header set by `NextResponse` when `response.cookies` is modified.
+const MIDDLEWARE_SET_COOKIE_HEADER = "x-middleware-set-cookie";
 function defaultMiddlewareLoader() {
     // @ts-expect-error - This is bundled
     return import("./middleware.mjs");
@@ -18,6 +20,10 @@ function defaultMiddlewareLoader() {
  *
  * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
  *
+ * Next.js internal headers are never exposed on the response.
+ * `x-middleware-set-cookie` is only forwarded on the request headers of the returned `MiddlewareEvent`,
+ * regardless of the allowlist.
+ *
  * @param internalEvent The internal request event.
  * @param initialSearch The initial query string received by the handler.
  * @param middlewareLoader The middleware loader, overridden by unit tests.
@@ -92,12 +98,16 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     const responseHeaders = result.headers;
     const reqHeaders = {};
     const resHeaders = {};
+    let middlewareSetCookie;
     // These are internal headers used by Next.js, we don't want to expose them to the client
     // NOTE: keys must be in lowercase to match the normalized header keys.
+    // See `resolve-routes.ts` in Next.js for the headers it drops from the middleware response.
     const filteredHeaders = [
         "x-middleware-override-headers",
         "x-middleware-next",
         "x-middleware-rewrite",
+        "x-middleware-redirect",
+        "x-middleware-refresh",
         // We need to drop `content-encoding` because it will be decoded
         "content-encoding",
     ];
@@ -112,6 +122,13 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
         else {
             if (filteredHeaders.includes(normalizedKey))
                 return;
+            // `x-middleware-set-cookie` holds a copy of the cookies set by the middleware,
+            // including the `HttpOnly` ones. It must never be sent to the client.
+            // It is only forwarded on the request (see below) so that `cookies().get()` sees them.
+            if (normalizedKey === MIDDLEWARE_SET_COOKIE_HEADER) {
+                middlewareSetCookie = value;
+                return;
+            }
             // Headers.forEach folds same-name headers; use getSetCookie() below instead.
             if (normalizedKey === "set-cookie")
                 return;
@@ -139,6 +156,11 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     const newHeaders = Object.fromEntries([...Object.entries(internalEvent.headers), ...Object.entries(reqHeaders)]
         .map(([key, value]) => [key.toLowerCase(), value])
         .filter(([key]) => !overriddenHeaders || overriddenHeaders.has(key)));
+    // Next.js forwards `x-middleware-set-cookie` after applying the override allowlist,
+    // so it is never filtered out (see `resolve-routes.ts`).
+    if (middlewareSetCookie !== undefined) {
+        newHeaders[MIDDLEWARE_SET_COOKIE_HEADER] = middlewareSetCookie;
+    }
     // If the middleware returned a Rewrite, set the `url` to the pathname of the rewrite
     // NOTE: the header was added to `req` from above
     const rewriteUrl = responseHeaders.get("x-middleware-rewrite");

package/dist/core/routing/routeParamPlaceholder.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Returns whether a segment of the pathname is the placeholder of a matched dynamic App Router page.
+ *
+ * Next.js versions before 16.4.5 treat a param whose value is its placeholder (e.g. `[slug]` for `[slug]`) as an
+ * unresolved fallback param. Such values are not legitimate and must not reach Next.js.
+ *
+ * Segments are decoded like Next.js decodes param values (catch-all values are split on `/` first).
+ * Segments with a malformed percent encoding never match.
+ * Pathnames without an opening bracket return early, without matching the dynamic routes.
+ *
+ * @param pathname The internal pathname, which may include the basePath, a locale prefix and a trailing slash
+ * @returns Whether a segment of the pathname is a placeholder of a matched dynamic App Router page
+ */
+export declare function hasRouteParamPlaceholder(pathname: string): boolean;