@opennextjs/aws 4.1.6 → 4.1.8

package/dist/adapters/cache.js

@@ -1,6 +1,7 @@
 import { getStaleLastModified, getTagsFromValue, hasBeenRevalidated, isStale, writeTags, } from "../utils/cache";
 import { isBinaryContentType } from "../utils/binary";
 import { CACHE_TAGS_HEADER } from "../utils/cacheHeaders";
+import { getPathFromRouteCacheKey } from "../utils/routeCacheKey";
 import { compareSemver } from "../utils/semver";
 import { debug, error, warn } from "./logger";
 export const SOFT_TAG_PREFIX = "_N_T_/";
@@ -334,7 +335,8 @@ export default class Cache {
                 if (paths.length > 0) {
                     // TODO: we should introduce a new method in cdnInvalidationHandler to invalidate paths by tags for cdn that supports it
                     // It also means that we'll need to provide the tags used in every request to the wrapper or converter.
-                    await globalThis.cdnInvalidationHandler.invalidatePaths(paths.map((path) => ({
+                    // Fixed Next.js releases store route-scoped cache keys in the tag cache.
+                    await globalThis.cdnInvalidationHandler.invalidatePaths(paths.map(getPathFromRouteCacheKey).map((path) => ({
                         initialPath: path,
                         rawPath: path,
                         resolvedRoutes: [
@@ -408,7 +410,8 @@ export default class Cache {
                 const uniquePaths = Array.from(new Set(toInsert
                     // We need to filter fetch cache key as they are not in the CDN
                     .filter((t) => t.tag.startsWith(SOFT_TAG_PREFIX))
-                    .map((t) => `/${t.path}`)));
+                    // Fixed Next.js releases store route-scoped cache keys in the tag cache.
+                    .map((t) => getPathFromRouteCacheKey(`/${t.path}`))));
                 if (uniquePaths.length > 0) {
                     await globalThis.cdnInvalidationHandler.invalidatePaths(uniquePaths.map((path) => ({
                         initialPath: path,

package/dist/build/createAssets.js

@@ -5,6 +5,7 @@ import { safeParseJsonFile } from "../utils/safe-json-parse.js";
 import logger from "../logger.js";
 import { isBinaryContentType } from "../utils/binary.js";
 import { CACHE_TAGS_HEADER } from "../utils/cacheHeaders.js";
+import { useRouteCacheKeys } from "../utils/routeCacheKey.js";
 import * as buildHelper from "./helper.js";
 /**
  * Copy the static assets to the output folder
@@ -84,7 +85,7 @@ export function createCacheAssets(options) {
         relativePath.endsWith(".segment.rsc") ||
         (relativePath.endsWith(".html") && htmlPages.has(relativePath));
     // Merge cache files into a single file
-    const cacheFilesPath = {};
+    const cacheArtifacts = {};
     // Process each source directory
     sourceDirs.forEach((sourceDir) => {
         buildHelper.traverseFiles(sourceDir, ({ relativePath }) => !isFileSkipped(relativePath), ({ absolutePath, relativePath }) => {
@@ -102,14 +103,18 @@ export function createCacheAssets(options) {
                     //
                     // Next 16.1 removed `.prefetch.rsc`, so the strip is a no-op on Next 16 where
                     // the `rsc` field always holds a full payload.
-                    const newFilePath = path
-                        .join(outputCachePath, relativePath)
-                        .substring(0, path.join(outputCachePath, relativePath).length - ext.length)
+                    const legacyKey = relativePath
+                        .slice(0, -ext.length)
                         .replace(/\.prefetch$/, "")
-                        .concat(".cache");
-                    cacheFilesPath[newFilePath] = {
-                        [ext.slice(1)]: absolutePath,
-                        ...cacheFilesPath[newFilePath],
+                        .split(path.sep)
+                        .join(path.posix.sep);
+                    const artifactId = `${sourceDir}:${legacyKey}`;
+                    const existingArtifact = cacheArtifacts[artifactId];
+                    const fileType = ext.slice(1);
+                    cacheArtifacts[artifactId] = {
+                        ...existingArtifact,
+                        legacyKey,
+                        [fileType]: existingArtifact?.[fileType] ?? absolutePath,
                     };
                     break;
                 }
@@ -121,11 +126,21 @@ export function createCacheAssets(options) {
             }
         });
     });
+    const metaFiles = [];
     // Generate cache file
-    Object.entries(cacheFilesPath).forEach(([cacheFilePath, files]) => {
+    Object.values(cacheArtifacts).forEach(({ legacyKey, ...files }) => {
         const cacheFileMeta = files.meta
-            ? safeParseJsonFile(fs.readFileSync(files.meta, "utf8"), cacheFilePath)
+            ? safeParseJsonFile(fs.readFileSync(files.meta, "utf8"), files.meta)
             : undefined;
+        const cacheKey = useRouteCacheKeys(options.nextVersion) && cacheFileMeta?.routeCache?.key
+            ? cacheFileMeta.routeCache.key.replace(/^[/\\]+/, "")
+            : legacyKey;
+        const outputRoot = path.resolve(outputCachePath);
+        const cacheFilePath = path.resolve(outputRoot, `${cacheKey}.cache`);
+        if (!cacheFilePath.startsWith(`${outputRoot}${path.sep}`)) {
+            logger.warn(`Cache key resolves outside the cache output: ${cacheKey}`);
+            return;
+        }
         const cacheJson = files.json
             ? safeParseJsonFile(fs.readFileSync(files.json, "utf8"), cacheFilePath)
             : undefined;
@@ -159,9 +174,19 @@ export function createCacheAssets(options) {
         // Ensure directory exists before writing
         fs.mkdirSync(path.dirname(cacheFilePath), { recursive: true });
         fs.writeFileSync(cacheFilePath, JSON.stringify(cacheFileContent));
+        if (!options.config.dangerous?.disableTagCache &&
+            cacheFileMeta?.headers?.[CACHE_TAGS_HEADER]) {
+            cacheFileMeta.headers[CACHE_TAGS_HEADER]
+                .split(",")
+                .forEach((tag) => {
+                metaFiles.push({
+                    tag: { S: path.posix.join(buildId, tag.trim()) },
+                    path: { S: path.posix.join(buildId, cacheKey) },
+                    revalidatedAt: { N: "1" },
+                });
+            });
+        }
     });
-    // We need to traverse the cache to find every .meta file
-    const metaFiles = [];
     // Copy fetch-cache to cache folder
     const fetchCachePath = path.join(appBuildOutputPath, ".next/cache/fetch-cache");
     if (fs.existsSync(fetchCachePath)) {
@@ -183,29 +208,6 @@ export function createCacheAssets(options) {
         });
     }
     if (!options.config.dangerous?.disableTagCache) {
-        // Compute dynamodb cache data
-        // Traverse files inside cache to find all meta files and cache tags associated with them
-        sourceDirs.forEach((sourceDir) => {
-            buildHelper.traverseFiles(sourceDir, ({ absolutePath, relativePath }) => absolutePath.endsWith(".meta") && !isFileSkipped(relativePath), ({ absolutePath, relativePath }) => {
-                const fileContent = fs.readFileSync(absolutePath, "utf8");
-                const fileData = safeParseJsonFile(fileContent, absolutePath);
-                if (fileData?.headers?.[CACHE_TAGS_HEADER]) {
-                    fileData.headers[CACHE_TAGS_HEADER]
-                        .split(",")
-                        .forEach((tag) => {
-                        // TODO: We should split the tag using getDerivedTags from next.js or maybe use an in house implementation
-                        metaFiles.push({
-                            tag: { S: path.posix.join(buildId, tag.trim()) },
-                            path: {
-                                S: path.posix.join(buildId, relativePath.replace(".meta", "")),
-                            },
-                            // We don't care about the revalidation time here, we just need to make sure it's there
-                            revalidatedAt: { N: "1" },
-                        });
-                    });
-                }
-            });
-        });
         if (metaFiles.length > 0) {
             useTagCache = true;
             const providerPath = path.join(outputDir, "dynamodb-provider");

package/dist/build/patch/patches/patchBackgroundRevalidation.d.ts

@@ -1,9 +1,10 @@
-export declare const rule = "\nrule:\n  kind: binary_expression\n  all:\n    - has:\n        kind: unary_expression\n        pattern: \"!$ENTRY.isStale\"\n    -  has:\n         kind: member_expression\n         regex: \"context.isPrefetch\"\nfix:\n  'true'";
+export declare const rule = "\nrule:\n  kind: binary_expression\n  # The names are mangled in the minified runtimes\n  pattern: \"!$ENTRY.isStale || $CONTEXT.isPrefetch\"\n  all:\n    # It has to be the whole check, not a part of a bigger expression\n    - not:\n        inside:\n          kind: binary_expression\n    # It has to be guarded by the on-demand revalidation check\n    - inside:\n        kind: if_statement\n        stopBy: end\n        has:\n          field: condition\n          stopBy: end\n          any:\n            # Next 15.5+ and its minified runtime copies use the same context object\n            - pattern: \"!$CONTEXT.isOnDemandRevalidate\"\n            # Earlier unminified versions keep this flag in a local\n            - pattern: \"!isOnDemandRevalidate\"\nfix:\n  'true'";
 export declare const patchBackgroundRevalidation: {
     name: string;
     patches: {
         versions: ">=14.1.0";
         pathFilter: RegExp;
+        contentFilter: RegExp;
         patchCode: import("../codePatcher.js").PatchCodeFn;
     }[];
 };

package/dist/build/patch/patches/patchBackgroundRevalidation.js

@@ -1,15 +1,31 @@
 import { getCrossPlatformPathRegex } from "../../../utils/regex.js";
 import { createPatchCode } from "../astCodePatcher.js";
+// Matches the check that decides whether a cached entry can be served as is in `ResponseCache.get`:
+//   if (entry && !context.isOnDemandRevalidate) { ...; if (!entry.isStale || context.isPrefetch) return ... }
+// which is minified in the compiled runtimes as:
+//   if ((a = ...) && !r.isOnDemandRevalidate && (n(a), i = !0, !a.isStale || r.isPrefetch)) return a;
 export const rule = `
 rule:
   kind: binary_expression
+  # The names are mangled in the minified runtimes
+  pattern: "!$ENTRY.isStale || $CONTEXT.isPrefetch"
   all:
-    - has:
-        kind: unary_expression
-        pattern: "!$ENTRY.isStale"
-    -  has:
-         kind: member_expression
-         regex: "context.isPrefetch"
+    # It has to be the whole check, not a part of a bigger expression
+    - not:
+        inside:
+          kind: binary_expression
+    # It has to be guarded by the on-demand revalidation check
+    - inside:
+        kind: if_statement
+        stopBy: end
+        has:
+          field: condition
+          stopBy: end
+          any:
+            # Next 15.5+ and its minified runtime copies use the same context object
+            - pattern: "!$CONTEXT.isOnDemandRevalidate"
+            # Earlier unminified versions keep this flag in a local
+            - pattern: "!isOnDemandRevalidate"
 fix:
   'true'`;
 export const patchBackgroundRevalidation = {
@@ -18,7 +34,10 @@ export const patchBackgroundRevalidation = {
         {
             // TODO: test for earlier versions of Next
             versions: ">=14.1.0",
-            pathFilter: getCrossPlatformPathRegex("server/response-cache/index.js"),
+            // Since Next 15.5 route modules use their own `ResponseCache`, which is inlined (and minified)
+            // in `next/dist/compiled/next-server/*.runtime.prod.js`
+            pathFilter: getCrossPlatformPathRegex(String.raw `(server/response-cache/index\.js|\.runtime\.prod\.js)$`, { escape: false }),
+            contentFilter: /\.isStale\s*\|\|\s*[\w$]+\.isPrefetch/,
             patchCode: createPatchCode(rule),
         },
     ],

package/dist/core/routing/cacheInterceptor.d.ts

@@ -1,2 +1,2 @@
-import type { InternalEvent, InternalResult, MiddlewareEvent } from "../../types/open-next";
-export declare function cacheInterceptor(event: MiddlewareEvent): Promise<InternalEvent | InternalResult>;
+import type { InternalEvent, InternalResult, MiddlewareEvent, ResolvedRoute } from "../../types/open-next";
+export declare function cacheInterceptor(event: MiddlewareEvent, resolvedRoutes?: ResolvedRoute[]): Promise<InternalEvent | InternalResult>;

package/dist/core/routing/cacheInterceptor.js

@@ -1,12 +1,14 @@
 import { createHash } from "node:crypto";
-import { NextConfig, PrerenderManifest } from "../../adapters/config/index";
+import { AppPathsManifest, NextConfig, PagesManifest, PrerenderManifest, } from "../../adapters/config/index";
 import { emptyReadableStream, toReadableStream } from "../../utils/stream";
 import { isBinaryContentType } from "../../utils/binary";
 import { getTagsFromValue, hasBeenRevalidated, isStale } from "../../utils/cache";
 import { CACHE_CONTROL_HEADER, NO_STORE_CACHE_CONTROL, OPEN_NEXT_CACHE_HEADER, PRERENDER_REVALIDATE_HEADER, fixCacheControlForError, } from "../../utils/cacheHeaders";
+import { getDynamicRouteCachePathname, getPrerenderRouteCacheKey, getRouteCacheKey, getRouteCacheOwner, useRouteCacheKeys, } from "../../utils/routeCacheKey";
 import { debug } from "../../adapters/logger";
 import { localizePath } from "./i18n";
 import { generateMessageGroupId } from "./queue";
+import { dynamicRouteMatcher } from "./routeMatcher";
 const CACHE_ONE_YEAR = 60 * 60 * 24 * 365;
 const CACHE_ONE_MONTH = 60 * 60 * 24 * 30;
 /*
@@ -22,7 +24,7 @@ const VARY_HEADER = "RSC, Next-Router-State-Tree, Next-Router-Prefetch, Next-Rou
 const NEXT_SEGMENT_PREFETCH_HEADER = "next-router-segment-prefetch";
 const NEXT_PRERENDER_HEADER = "x-nextjs-prerender";
 const NEXT_POSTPONED_HEADER = "x-nextjs-postponed";
-async function computeCacheControl(path, body, host, revalidate, lastModified, isStaleFromTagCache = false) {
+async function computeCacheControl(path, body, host, revalidate, lastModified, isStaleFromTagCache = false, revalidationPath = path, revalidationKey = path) {
     let finalRevalidate = CACHE_ONE_YEAR;
     const existingRoute = Object.entries(PrerenderManifest?.routes ?? {}).find((p) => p[0] === path)?.[1];
     if (revalidate === undefined && existingRoute) {
@@ -64,7 +66,9 @@ async function computeCacheControl(path, body, host, revalidate, lastModified, i
             isStaleFromTagCache,
         });
         if (isStale) {
-            let url = NextConfig.trailingSlash ? `${path}/` : path;
+            let url = NextConfig.trailingSlash && revalidationPath !== "/"
+                ? `${revalidationPath}/`
+                : revalidationPath;
             if (NextConfig.basePath) {
                 url = `${NextConfig.basePath}${url}`;
             }
@@ -75,8 +79,8 @@ async function computeCacheControl(path, body, host, revalidate, lastModified, i
                     eTag: etag,
                     lastModified: lastModified ?? Date.now(),
                 },
-                MessageDeduplicationId: hash(`${path}-${lastModified}-${etag}`),
-                MessageGroupId: generateMessageGroupId(path),
+                MessageDeduplicationId: hash(`${revalidationKey}-${lastModified}-${etag}`),
+                MessageGroupId: generateMessageGroupId(revalidationKey),
             });
         }
         return {
@@ -153,7 +157,7 @@ function getBodyForAppRouter(event, cachedValue) {
  * request - the caller should then fallback to the server.
  * @throws When `cachedValue` is neither of type `app` nor `page`
  */
-async function generateResult(event, localizedPath, cachedValue, lastModified, isStaleFromTagCache = false) {
+async function generateResult(event, localizedPath, cachedValue, lastModified, isStaleFromTagCache = false, cacheKey = localizedPath, revalidationPath = localizedPath) {
     debug("Returning result from experimental cache");
     let body;
     let type = "application/octet-stream";
@@ -185,7 +189,7 @@ async function generateResult(event, localizedPath, cachedValue, lastModified, i
         debug("Missing body in the cache entry, falling back to the server");
         return undefined;
     }
-    const cacheControl = await computeCacheControl(localizedPath, body, event.headers.host, cachedValue.revalidate, lastModified, isStaleFromTagCache);
+    const cacheControl = await computeCacheControl(localizedPath, body, event.headers.host, cachedValue.revalidate, lastModified, isStaleFromTagCache, revalidationPath, cacheKey);
     const statusCode = computeStatusCode(event.rewriteStatusCode, cachedValue.meta?.status);
     const headers = {
         ...cacheControl,
@@ -247,10 +251,83 @@ function decodePathParams(pathname) {
         .map((segment) => escapePathDelimiters(decodeURIComponent(segment), true))
         .join("/");
 }
-export async function cacheInterceptor(event) {
+let routeCacheManifests;
+function getRouteCacheManifests() {
+    routeCacheManifests ??= {
+        prerenderManifest: {
+            routes: PrerenderManifest?.routes ?? {},
+            dynamicRoutes: PrerenderManifest?.dynamicRoutes ?? {},
+        },
+        appPaths: Object.keys(AppPathsManifest ?? {}),
+        pagesManifest: PagesManifest ?? {},
+        locales: NextConfig.i18n?.locales,
+    };
+    return routeCacheManifests;
+}
+/**
+ * Computes the key of the cache entry serving the request.
+ *
+ * Next.js 15.5.27 and 16.3.8 scope the key by the route owning the entry. It is computed from:
+ * - the prerender manifest for prerendered routes,
+ * - the dynamic route Next.js would render for entries cached at runtime.
+ *
+ * @param event The incoming event
+ * @param localizedPath The localized and decoded path, without basePath nor trailing slash
+ * @param resolvedRoutes Ordered route matches for the final internal pathname
+ * @returns The cache key, or `undefined` when the path is not served by an ISR route
+ */
+function getCacheKey(event, localizedPath, resolvedRoutes) {
+    if (!useRouteCacheKeys(globalThis.nextVersion)) {
+        const isISR = Object.keys(PrerenderManifest?.routes ?? {}).includes(localizedPath) ||
+            Object.values(PrerenderManifest?.dynamicRoutes ?? {}).some((dr) => new RegExp(dr.routeRegex).test(localizedPath));
+        // The route is keyed as `/` in the prerender manifest, but the generated
+        // cache asset for the index route is uploaded as `/index`.
+        if (!isISR)
+            return undefined;
+        return localizedPath === "/" ? "/index" : localizedPath;
+    }
+    const manifests = getRouteCacheManifests();
+    if (Object.hasOwn(manifests.prerenderManifest.routes, localizedPath)) {
+        const manifestKey = getPrerenderRouteCacheKey(localizedPath, manifests);
+        const selectedRoute = resolvedRoutes?.[0];
+        // The routing handler always supplies matches. An empty list there means
+        // ownership could not be proven and scoped interception must fail closed.
+        if (resolvedRoutes && !selectedRoute)
+            return undefined;
+        if (!selectedRoute)
+            return manifestKey;
+        const selectedOwner = getRouteCacheOwner(selectedRoute.route, manifests);
+        if (!selectedOwner)
+            return undefined;
+        const selectedKey = getRouteCacheKey(localizedPath, selectedOwner);
+        return selectedKey === manifestKey ? manifestKey : undefined;
+    }
+    // Not prerendered, the entry might have been cached at runtime by a dynamic route.
+    // Dynamic routes are sorted by specificity, the first match is the one Next.js renders.
+    const dynamicRoute = resolvedRoutes
+        ? resolvedRoutes[0]
+        : dynamicRouteMatcher(event.rawPath)[0];
+    const dynamicPrerender = dynamicRoute
+        ? manifests.prerenderManifest.dynamicRoutes[dynamicRoute.route]
+        : undefined;
+    if (!dynamicRoute ||
+        !dynamicPrerender ||
+        dynamicPrerender.fallback !== null) {
+        return undefined;
+    }
+    const owner = getRouteCacheOwner(dynamicRoute.route, manifests);
+    return owner
+        ? getRouteCacheKey(getDynamicRouteCachePathname(localizedPath, manifests.locales), owner)
+        : undefined;
+}
+export async function cacheInterceptor(event, resolvedRoutes) {
     if (Boolean(event.headers["next-action"]) ||
         Boolean(event.headers[PRERENDER_REVALIDATE_HEADER]))
         return event;
+    // Only GET and HEAD can be answered from the cache. A form posted without
+    // JavaScript carries its server action id in the body, not in the next-action header.
+    if (event.method !== "GET" && event.method !== "HEAD")
+        return event;
     // Check for Next.js preview mode cookies
     const cookies = event.headers.cookie || "";
     const hasPreviewData = cookies.includes("__prerender_bypass") ||
@@ -259,14 +336,21 @@ export async function cacheInterceptor(event) {
         debug("Preview mode detected, passing through to handler");
         return event;
     }
-    // We localize the path in case i18n is enabled
-    let localizedPath = localizePath(event);
-    // If using basePath we need to remove it from the path
-    if (NextConfig.basePath) {
-        localizedPath = localizedPath.replace(NextConfig.basePath, "");
-    }
+    const basePath = NextConfig.basePath;
+    const pathWithoutBasePath = !basePath
+        ? event.rawPath
+        : event.rawPath === basePath
+            ? "/"
+            : event.rawPath.startsWith(`${basePath}/`)
+                ? event.rawPath.slice(basePath.length)
+                : event.rawPath;
+    // Locale detection must inspect the first segment after basePath.
+    let localizedPath = localizePath({ ...event, rawPath: pathWithoutBasePath });
     // We also need to remove trailing slash
     localizedPath = localizedPath.replace(/\/$/, "");
+    // Revalidation must request the original encoded spelling so route selection
+    // cannot switch from an encoded catch-all to a more specific canonical route.
+    const revalidationPath = localizedPath || "/";
     // Then we decode the path params
     try {
         localizedPath = decodePathParams(localizedPath) || "/";
@@ -276,14 +360,10 @@ export async function cacheInterceptor(event) {
         // partially decode the path and select a different route identity.
         return event;
     }
-    // The route is keyed as `/` in the prerender manifest, but the generated
-    // cache asset for the app index route is uploaded as `/index`.
-    const cacheKey = localizedPath === "/" ? "/index" : localizedPath;
     debug("Checking cache for", localizedPath, PrerenderManifest);
-    const isISR = Object.keys(PrerenderManifest?.routes ?? {}).includes(localizedPath) ||
-        Object.values(PrerenderManifest?.dynamicRoutes ?? {}).some((dr) => new RegExp(dr.routeRegex).test(localizedPath));
-    debug("isISR", isISR);
-    if (isISR) {
+    const cacheKey = getCacheKey(event, localizedPath, resolvedRoutes);
+    debug("cacheKey", cacheKey);
+    if (cacheKey) {
         try {
             const cachedData = await globalThis.incrementalCache.get(cacheKey);
             debug("cached data in interceptor", cachedData);
@@ -309,12 +389,12 @@ export async function cacheInterceptor(event) {
             switch (cachedData?.value?.type) {
                 case "app":
                 case "page": {
-                    const result = await generateResult(event, localizedPath, cachedData.value, cachedData.lastModified, _isStale);
+                    const result = await generateResult(event, localizedPath, cachedData.value, cachedData.lastModified, _isStale, cacheKey, revalidationPath);
                     // The cache entry can not serve this request, fallback to the server.
                     return result ?? event;
                 }
                 case "redirect": {
-                    const cacheControl = await computeCacheControl(localizedPath, "", host, cachedData.value.revalidate, cachedData.lastModified, _isStale);
+                    const cacheControl = await computeCacheControl(localizedPath, "", host, cachedData.value.revalidate, cachedData.lastModified, _isStale, revalidationPath, cacheKey);
                     return {
                         type: "core",
                         statusCode: cachedData.value.meta?.status ?? 307,
@@ -328,7 +408,7 @@ export async function cacheInterceptor(event) {
                     };
                 }
                 case "route": {
-                    const cacheControl = await computeCacheControl(localizedPath, cachedData.value.body, host, cachedData.value.revalidate, cachedData.lastModified, _isStale);
+                    const cacheControl = await computeCacheControl(localizedPath, cachedData.value.body, host, cachedData.value.revalidate, cachedData.lastModified, _isStale, revalidationPath, cacheKey);
                     const isBinary = isBinaryContentType(String(cachedData.value.meta?.headers?.["content-type"]));
                     const statusCode = computeStatusCode(event.rewriteStatusCode, cachedData.value.meta?.status);
                     const headers = {

package/dist/core/routing/matcher.js

@@ -123,7 +123,8 @@ export function handleRewrites(event, rewrites) {
         const pathToUse = rewrite.locale === false ? rawPath : localizedRawPath;
         debug("urlParts", { pathname, protocol, hostname, queryString });
         const toDestinationPath = compile(escapeRegex(pathname, { isPath: true }));
-        const toDestinationHost = compile(escapeRegex(hostname));
+        // A literal numeric port is URL syntax, not a path-to-regexp parameter.
+        const toDestinationHost = compile(escapeRegex(hostname).replace(/:(\d+)$/, "\\:$1"));
         const toDestinationQuery = compile(escapeRegex(queryString));
         const params = {
             // params for the source

package/dist/core/routingHandler.js

@@ -157,6 +157,12 @@ export default async function routingHandler(event, { assetResolver }) {
         }
         const isNextImageRoute = eventOrResult.rawPath.startsWith("/_next/image");
         const isRouteFoundBeforeAllRewrites = isStaticRoute || isDynamicRoute || isExternalRewrite;
+        // Resolve against the final internal pathname after every rewrite phase.
+        // These ordered matches are also the authoritative cache owner candidates.
+        const resolvedRoutes = [
+            ...staticRouteMatcher(eventOrResult.rawPath),
+            ...dynamicRouteMatcher(eventOrResult.rawPath),
+        ];
         // If we still haven't found a route, we show the 404 page
         // We need to ensure that rewrites are applied before showing the 404 page
         if (!(isRouteFoundBeforeAllRewrites ||
@@ -175,9 +181,10 @@ export default async function routingHandler(event, { assetResolver }) {
             };
         }
         if (globalThis.openNextConfig.dangerous?.enableCacheInterception &&
+            !isExternalRewrite &&
             !isInternalResult(eventOrResult)) {
             debug("Cache interception enabled");
-            eventOrResult = await cacheInterceptor(eventOrResult);
+            eventOrResult = await cacheInterceptor(eventOrResult, resolvedRoutes);
             if (isInternalResult(eventOrResult)) {
                 applyMiddlewareHeaders(eventOrResult, headers);
                 return eventOrResult;
@@ -185,10 +192,6 @@ export default async function routingHandler(event, { assetResolver }) {
         }
         // We apply the headers from the middleware response last
         applyMiddlewareHeaders(eventOrResult, headers);
-        const resolvedRoutes = [
-            ...foundStaticRoute,
-            ...foundDynamicRoute,
-        ];
         debug("resolvedRoutes", resolvedRoutes);
         return {
             internalEvent: eventOrResult,

package/dist/types/next-types.d.ts

@@ -151,11 +151,14 @@ export interface MiddlewareManifest {
 export interface PrerenderManifest {
     routes: Record<string, {
         initialRevalidateSeconds: number | false;
+        srcRoute?: string | null;
+        dataRoute?: string | null;
     }>;
     dynamicRoutes: {
         [route: string]: {
             routeRegex: string;
             fallback: string | false | null;
+            fallbackSourceRoute?: string;
             dataRouteRegex: string;
         };
     };

package/dist/utils/promise.d.ts

@@ -13,8 +13,25 @@ export declare class DetachedPromise<T = any> {
 }
 export declare class DetachedPromiseRunner {
     private promises;
+    /**
+     * Create a deferred promise tracked by this runner.
+     *
+     * @returns The tracked promise and its resolve/reject functions.
+     */
     withResolvers<T>(): DetachedPromise<T>;
+    /**
+     * Track background work and handle failures immediately.
+     *
+     * @param promise Work to await, including work registered during an active drain.
+     * @returns Nothing; failures are logged rather than propagated.
+     */
     add<T>(promise: Promise<T>): void;
+    /**
+     * Drain tracked work, including additions made while earlier work is pending.
+     *
+     * Work started after the drain has settled still needs a new runtime waitUntil.
+     * @returns Resolves when all work registered during this drain has settled.
+     */
     await(): Promise<void>;
 }
 export declare function runWithOpenNextRequestContext<T>({ isISRRevalidation, waitUntil, requestId, }: {

package/dist/utils/promise.js

@@ -28,23 +28,41 @@ export class DetachedPromise {
 }
 export class DetachedPromiseRunner {
     promises = [];
+    /**
+     * Create a deferred promise tracked by this runner.
+     *
+     * @returns The tracked promise and its resolve/reject functions.
+     */
     withResolvers() {
         const detachedPromise = new DetachedPromise();
-        this.promises.push(detachedPromise);
+        this.add(detachedPromise.promise);
         return detachedPromise;
     }
+    /**
+     * Track background work and handle failures immediately.
+     *
+     * @param promise Work to await, including work registered during an active drain.
+     * @returns Nothing; failures are logged rather than propagated.
+     */
     add(promise) {
-        const detachedPromise = new DetachedPromise();
-        this.promises.push(detachedPromise);
-        promise.then(detachedPromise.resolve, detachedPromise.reject);
+        // A late promise may reject before the current batch finishes. Attach its
+        // rejection handler now so it cannot become an unhandled rejection.
+        this.promises.push(promise.then(() => { }, error));
     }
+    /**
+     * Drain tracked work, including additions made while earlier work is pending.
+     *
+     * Work started after the drain has settled still needs a new runtime waitUntil.
+     * @returns Resolves when all work registered during this drain has settled.
+     */
     async await() {
         debug(`Awaiting ${this.promises.length} detached promises`);
-        const results = await Promise.allSettled(this.promises.map((p) => p.promise));
-        const rejectedPromises = results.filter((r) => r.status === "rejected");
-        rejectedPromises.forEach((r) => {
-            error(r.reason);
-        });
+        let awaited = 0;
+        while (awaited < this.promises.length) {
+            const batch = this.promises.slice(awaited);
+            awaited = this.promises.length;
+            await Promise.all(batch);
+        }
     }
 }
 async function awaitAllDetachedPromise() {
@@ -61,13 +79,17 @@ function provideNextAfterProvider() {
     // This is needed by some lib that relies on the vercel request context to properly await stuff.
     // Remove this when vercel builder is updated to provide '@next/request-context'.
     const VERCEL_REQUEST_CONTEXT_SYMBOL = Symbol.for("@vercel/request-context");
-    const store = globalThis.__openNextAls.getStore();
-    const waitUntil = store?.waitUntil ??
-        ((promise) => store?.pendingPromiseRunner.add(promise));
+    // `get` resolves the store on every call rather than capturing it here: the
+    // object is published on `globalThis`, which every request in the isolate
+    // shares, so a captured store could belong to a different request.
     const nextAfterContext = {
-        get: () => ({
-            waitUntil,
-        }),
+        get: () => {
+            const store = globalThis.__openNextAls.getStore();
+            return {
+                waitUntil: store?.waitUntil ??
+                    ((promise) => store?.pendingPromiseRunner.add(promise)),
+            };
+        },
     };
     //@ts-expect-error
     globalThis[NEXT_REQUEST_CONTEXT_SYMBOL] = nextAfterContext;

package/dist/utils/routeCacheKey.d.ts

@@ -0,0 +1,124 @@
+import type { PrerenderManifest } from "../types/next-types.js";
+/**
+ * Next.js 15.5.27 and 16.3.8 introduced response cache keys scoped by the route
+ * owning each pages, app page, or app route entry:
+ * `/route-cache/<kind>/<sha256(sourceRoute)>/$<normalizedPathname>`.
+ *
+ * The helpers below mirror Next.js so that the build time cache population and the cache
+ * interceptor compute the exact same key Next.js uses when reading and writing the cache.
+ * https://github.com/vercel/next.js/blob/v16.3.8/packages/next/src/server/lib/route-cache-key.ts
+ */
+export type RouteCacheKind = "PAGES" | "APP_PAGE" | "APP_ROUTE";
+export interface RouteCacheOwner {
+    kind: RouteCacheKind;
+    /**
+     * The page pathname for the pages router (i.e. `/blog/[slug]`).
+     * The app entry for the app router (i.e. `/(group)/blog/[slug]/page`).
+     */
+    sourceRoute: string;
+}
+export interface RouteCacheManifests {
+    prerenderManifest: Pick<PrerenderManifest, "routes" | "dynamicRoutes">;
+    /** The keys of the app paths manifest */
+    appPaths: string[];
+    pagesManifest: Record<string, string>;
+    /** The i18n locales */
+    locales?: string[];
+}
+/**
+ * Whether the Next.js version uses scoped route cache keys.
+ *
+ * @param nextVersion The Next.js version
+ */
+export declare function useRouteCacheKeys(nextVersion: string): boolean;
+/**
+ * Mirrors `normalizePagePath` from Next.js.
+ *
+ * @example
+ *     normalizePagePath("/") === "/index"
+ *     normalizePagePath("/index/foo") === "/index/index/foo"
+ */
+export declare function normalizePagePath(page: string): string;
+/**
+ * Mirrors `denormalizePagePath` from Next.js, the inverse of `normalizePagePath`.
+ *
+ * @example
+ *     denormalizePagePath("/index") === "/"
+ *     denormalizePagePath("/index/index/foo") === "/index/foo"
+ */
+export declare function denormalizePagePath(page: string): string;
+/**
+ * Mirrors `normalizeAppPath` from Next.js: removes groups, parallel slots and the leaf
+ * `page`/`route` segment from an app entry.
+ *
+ * @example
+ *     normalizeAppPath("/(group)/@modal/blog/[slug]/page") === "/blog/[slug]"
+ */
+export declare function normalizeAppPath(entry: string): string;
+/**
+ * Mirrors `selectAppPageEntry` from Next.js: selects the app entry rendering `route`,
+ * a route can have multiple entries when it uses parallel routes.
+ *
+ * @param route The route, i.e. `/blog/[slug]`
+ * @param appPaths The keys of the app paths manifest
+ * @returns The app entry, or `undefined` when no entry renders the route
+ */
+export declare function selectAppPageEntry(route: string, appPaths: string[]): string | undefined;
+/**
+ * Computes the owner of the cache entries for a route.
+ *
+ * @param sourceRoute The route owning the entry, i.e. `/blog/[slug]`
+ * @param manifests.appPaths The keys of the app paths manifest
+ * @param manifests.pagesManifest The pages manifest
+ * @returns The owner, or `undefined` when the route is not handled by an app entry nor a page
+ */
+export declare function getRouteCacheOwner(sourceRoute: string, { appPaths, pagesManifest, }: {
+    appPaths: string[];
+    pagesManifest: Record<string, string>;
+}): RouteCacheOwner | undefined;
+/**
+ * Mirrors `normalizeLocalePath` from Next.js: removes the locale prefix from a pathname.
+ *
+ * @example
+ *     normalizeLocalePath("/en/isr", ["en", "fr"]) === "/isr"
+ *     normalizeLocalePath("/en", ["en", "fr"]) === "/"
+ */
+export declare function normalizeLocalePath(pathname: string, locales?: string[]): string;
+/**
+ * Mirrors how Next.js resolves the cache pathname of a dynamic route: a route resolving to
+ * `/index` (i.e. a root catch-all rendering `/index`) is cached as `/`, or as `/<locale>` with i18n.
+ *
+ * @example
+ *     getDynamicRouteCachePathname("/index") === "/"
+ *     getDynamicRouteCachePathname("/en/index", ["en", "fr"]) === "/en"
+ *
+ * @param pathname The localized pathname, i.e. `/en/blog/hello` with i18n
+ * @param locales The i18n locales
+ */
+export declare function getDynamicRouteCachePathname(pathname: string, locales?: string[]): string;
+/**
+ * Computes the cache key of an entry from the prerender manifest, i.e. a prerendered
+ * route (`routes`) or a fallback shell (`dynamicRoutes`).
+ *
+ * @param pathname The pathname of the entry, as keyed in the prerender manifest
+ * @param manifests The manifests used to compute the owner
+ * @returns The cache key, or `undefined` when the pathname is not in the prerender manifest
+ * or when its owner could not be found.
+ */
+export declare function getPrerenderRouteCacheKey(pathname: string, manifests: RouteCacheManifests): string | undefined;
+/**
+ * Mirrors `getRouteCacheKey` from Next.js.
+ *
+ * @param pathname The pathname of the entry, i.e. `/blog/hello` (`/en/blog/hello` with i18n)
+ * @param owner The owner of the entry
+ * @returns The cache key, i.e. `/route-cache/APP_PAGE/<sha256>/$/blog/hello`
+ */
+export declare function getRouteCacheKey(pathname: string, owner: RouteCacheOwner): string;
+/**
+ * Returns the normalized pathname of a route cache key, i.e. `/blog/hello` for
+ * `/route-cache/APP_PAGE/<sha256>/$/blog/hello`.
+ * Keys that are not route cache keys are returned unchanged.
+ *
+ * @param key The cache key, with or without the leading `/`
+ */
+export declare function getPathFromRouteCacheKey(key: string): string;

package/dist/utils/routeCacheKey.js

@@ -0,0 +1,210 @@
+import { createHash } from "node:crypto";
+import { compareSemver } from "./semver.js";
+const ROUTE_CACHE_DIRECTORY = "route-cache";
+const ROUTE_CACHE_KEY_PREFIX = /^\/?route-cache\/(?:PAGES|APP_PAGE|APP_ROUTE)\/[0-9a-f]{64}\/\$(?=\/)/;
+const DYNAMIC_ROUTE_REGEX = /\/\[[^/]+?\](?=\/|$)/;
+/**
+ * Whether the Next.js version uses scoped route cache keys.
+ *
+ * @param nextVersion The Next.js version
+ */
+export function useRouteCacheKeys(nextVersion) {
+    return ((compareSemver(nextVersion, ">=", "15.5.27") &&
+        compareSemver(nextVersion, "<", "16.0.0")) ||
+        compareSemver(nextVersion, ">=", "16.3.8"));
+}
+/**
+ * Mirrors `normalizePagePath` from Next.js.
+ *
+ * @example
+ *     normalizePagePath("/") === "/index"
+ *     normalizePagePath("/index/foo") === "/index/index/foo"
+ */
+export function normalizePagePath(page) {
+    if (/^\/index(\/|$)/.test(page) && !DYNAMIC_ROUTE_REGEX.test(page)) {
+        return `/index${page}`;
+    }
+    if (page === "/") {
+        return "/index";
+    }
+    return page.startsWith("/") ? page : `/${page}`;
+}
+/**
+ * Mirrors `denormalizePagePath` from Next.js, the inverse of `normalizePagePath`.
+ *
+ * @example
+ *     denormalizePagePath("/index") === "/"
+ *     denormalizePagePath("/index/index/foo") === "/index/foo"
+ */
+export function denormalizePagePath(page) {
+    if (page.startsWith("/index/") && !DYNAMIC_ROUTE_REGEX.test(page)) {
+        return page.slice(6);
+    }
+    return page === "/index" ? "/" : page;
+}
+/**
+ * Mirrors `normalizeAppPath` from Next.js: removes groups, parallel slots and the leaf
+ * `page`/`route` segment from an app entry.
+ *
+ * @example
+ *     normalizeAppPath("/(group)/@modal/blog/[slug]/page") === "/blog/[slug]"
+ */
+export function normalizeAppPath(entry) {
+    const pathname = entry.split("/").reduce((acc, segment, index, segments) => {
+        if (!segment)
+            return acc;
+        // Groups are ignored.
+        if (segment.startsWith("(") && segment.endsWith(")"))
+            return acc;
+        // Parallel segments are ignored.
+        if (segment.startsWith("@"))
+            return acc;
+        // The last segment (if it's a leaf) is ignored.
+        if ((segment === "page" || segment === "route") &&
+            index === segments.length - 1) {
+            return acc;
+        }
+        return `${acc}/${segment}`;
+    }, "");
+    return pathname === "" ? "/" : pathname;
+}
+function compareAppPaths(a, b) {
+    const aHasSlot = a.includes("/@");
+    const bHasSlot = b.includes("/@");
+    if (aHasSlot && !bHasSlot)
+        return -1;
+    if (!aHasSlot && bHasSlot)
+        return 1;
+    return a.localeCompare(b);
+}
+/**
+ * Mirrors `selectAppPageEntry` from Next.js: selects the app entry rendering `route`,
+ * a route can have multiple entries when it uses parallel routes.
+ *
+ * @param route The route, i.e. `/blog/[slug]`
+ * @param appPaths The keys of the app paths manifest
+ * @returns The app entry, or `undefined` when no entry renders the route
+ */
+export function selectAppPageEntry(route, appPaths) {
+    let entry;
+    for (const appPath of appPaths) {
+        if (normalizeAppPath(appPath).replace(/%5F/g, "_") !== route)
+            continue;
+        if (entry === undefined || compareAppPaths(entry, appPath) < 0) {
+            entry = appPath;
+        }
+    }
+    return entry;
+}
+/**
+ * Computes the owner of the cache entries for a route.
+ *
+ * @param sourceRoute The route owning the entry, i.e. `/blog/[slug]`
+ * @param manifests.appPaths The keys of the app paths manifest
+ * @param manifests.pagesManifest The pages manifest
+ * @returns The owner, or `undefined` when the route is not handled by an app entry nor a page
+ */
+export function getRouteCacheOwner(sourceRoute, { appPaths, pagesManifest, }) {
+    const appEntry = selectAppPageEntry(sourceRoute, appPaths);
+    if (appEntry) {
+        return {
+            kind: appEntry.endsWith("/route") ? "APP_ROUTE" : "APP_PAGE",
+            sourceRoute: appEntry,
+        };
+    }
+    if (Object.hasOwn(pagesManifest, sourceRoute)) {
+        return { kind: "PAGES", sourceRoute };
+    }
+    return undefined;
+}
+/**
+ * Mirrors `normalizeLocalePath` from Next.js: removes the locale prefix from a pathname.
+ *
+ * @example
+ *     normalizeLocalePath("/en/isr", ["en", "fr"]) === "/isr"
+ *     normalizeLocalePath("/en", ["en", "fr"]) === "/"
+ */
+export function normalizeLocalePath(pathname, locales) {
+    const segment = pathname.split("/", 2)[1]?.toLowerCase();
+    const locale = locales?.find((l) => l.toLowerCase() === segment);
+    if (!locale) {
+        return pathname;
+    }
+    return pathname.slice(locale.length + 1) || "/";
+}
+/**
+ * Mirrors how Next.js resolves the cache pathname of a dynamic route: a route resolving to
+ * `/index` (i.e. a root catch-all rendering `/index`) is cached as `/`, or as `/<locale>` with i18n.
+ *
+ * @example
+ *     getDynamicRouteCachePathname("/index") === "/"
+ *     getDynamicRouteCachePathname("/en/index", ["en", "fr"]) === "/en"
+ *
+ * @param pathname The localized pathname, i.e. `/en/blog/hello` with i18n
+ * @param locales The i18n locales
+ */
+export function getDynamicRouteCachePathname(pathname, locales) {
+    if (normalizeLocalePath(pathname, locales) !== "/index") {
+        return pathname;
+    }
+    return pathname.slice(0, -"/index".length) || "/";
+}
+/**
+ * Computes the cache key of an entry from the prerender manifest, i.e. a prerendered
+ * route (`routes`) or a fallback shell (`dynamicRoutes`).
+ *
+ * @param pathname The pathname of the entry, as keyed in the prerender manifest
+ * @param manifests The manifests used to compute the owner
+ * @returns The cache key, or `undefined` when the pathname is not in the prerender manifest
+ * or when its owner could not be found.
+ */
+export function getPrerenderRouteCacheKey(pathname, manifests) {
+    const { routes, dynamicRoutes } = manifests.prerenderManifest;
+    const prerender = Object.hasOwn(routes, pathname)
+        ? routes[pathname]
+        : undefined;
+    const fallback = !prerender && Object.hasOwn(dynamicRoutes, pathname)
+        ? dynamicRoutes[pathname]
+        : undefined;
+    if (!prerender && !fallback) {
+        return undefined;
+    }
+    const sourceRoute = prerender
+        ? prerender.srcRoute
+        : (fallback?.fallbackSourceRoute ?? pathname);
+    let owner;
+    if (sourceRoute) {
+        owner = getRouteCacheOwner(sourceRoute, manifests);
+    }
+    else {
+        // Static routes have no `srcRoute`, the pathname is the route.
+        // Pages routes are localized while the page itself is not.
+        owner = getRouteCacheOwner(pathname, manifests);
+        if (!owner && manifests.locales?.length) {
+            const pagesOwner = getRouteCacheOwner(normalizeLocalePath(pathname, manifests.locales), manifests);
+            owner = pagesOwner?.kind === "PAGES" ? pagesOwner : undefined;
+        }
+    }
+    return owner ? getRouteCacheKey(pathname, owner) : undefined;
+}
+/**
+ * Mirrors `getRouteCacheKey` from Next.js.
+ *
+ * @param pathname The pathname of the entry, i.e. `/blog/hello` (`/en/blog/hello` with i18n)
+ * @param owner The owner of the entry
+ * @returns The cache key, i.e. `/route-cache/APP_PAGE/<sha256>/$/blog/hello`
+ */
+export function getRouteCacheKey(pathname, owner) {
+    const source = createHash("sha256").update(owner.sourceRoute).digest("hex");
+    return `/${ROUTE_CACHE_DIRECTORY}/${owner.kind}/${source}/$${normalizePagePath(pathname)}`;
+}
+/**
+ * Returns the normalized pathname of a route cache key, i.e. `/blog/hello` for
+ * `/route-cache/APP_PAGE/<sha256>/$/blog/hello`.
+ * Keys that are not route cache keys are returned unchanged.
+ *
+ * @param key The cache key, with or without the leading `/`
+ */
+export function getPathFromRouteCacheKey(key) {
+    return key.replace(ROUTE_CACHE_KEY_PREFIX, "");
+}

package/package.json

@@ -3,7 +3,7 @@
     "access": "public"
   },
   "name": "@opennextjs/aws",
-  "version": "4.1.6",
+  "version": "4.1.8",
   "bin": {
     "open-next": "./dist/index.js"
   },
@@ -56,12 +56,12 @@
     "@types/express": "5.0.0",
     "@types/node": "20.17.6",
     "concurrently": "^9.2.1",
-    "next": "16.3.6",
+    "next": "16.3.8",
     "tsc-alias": "^1.8.16",
     "typescript": "5.9.3"
   },
   "peerDependencies": {
-    "next": ">=15.5.26 <16 || >=16.3.6"
+    "next": ">=15.5.27 <16 || >=16.3.8"
   },
   "bugs": {
     "url": "https://github.com/opennextjs/opennextjs-aws/issues"