@opennextjs/aws 4.1.8 → 4.1.10

package/dist/core/routing/matcher.js

@@ -1,26 +1,90 @@
-import { NextConfig } from "../../adapters/config/index";
-import { compile, match } from "path-to-regexp";
-import { normalizeRepeatedSlashes } from "../../utils/normalize-path";
-import { emptyReadableStream, toReadableStream } from "../../utils/stream";
+import { NextConfig } from "../../adapters/config/index.js";
+import { compile, match, parse } from "path-to-regexp";
+import { normalizeRepeatedSlashes } from "../../utils/normalize-path.js";
+import { emptyReadableStream, toReadableStream } from "../../utils/stream.js";
 import { debug } from "../../adapters/logger";
 import { handleLocaleRedirect, localizePath } from "./i18n";
 import { dynamicRouteMatcher, staticRouteMatcher } from "./routeMatcher";
 import { constructNextUrl, convertFromQueryString, convertToQueryString, escapeRegex, getUrlParts, isExternal, unescapeRegex, } from "./util";
+const compiledRegExps = new Map();
+/**
+ * Returns the compiled regular expression for a configured pattern.
+ *
+ * Patterns come from the Next.js config and manifests, so each one is compiled
+ * on first use and reused by later requests. `lastIndex` is reset on every call
+ * so a shared global or sticky expression always starts from the beginning.
+ *
+ * @param pattern The regular expression source
+ * @param flags The optional regular expression flags
+ * @returns The compiled regular expression
+ * @throws {SyntaxError} When the pattern is invalid
+ */
+export function getCompiledRegExp(pattern, flags = "") {
+    const key = `/${pattern}/${flags}`;
+    let regExp = compiledRegExps.get(key);
+    if (!regExp) {
+        regExp = new RegExp(pattern, flags);
+        compiledRegExps.set(key, regExp);
+    }
+    regExp.lastIndex = 0;
+    return regExp;
+}
+/**
+ * Tests a request value against a route condition.
+ *
+ * Repeated query parameters are present when their array exists, but configured
+ * patterns match only the final entry, including an empty final entry. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L92-L115
+ *
+ * @param value The scalar or repeated request value
+ * @param pattern The optional configured condition pattern
+ * @returns Whether the request value satisfies the condition
+ * @throws {SyntaxError} When the configured pattern is invalid
+ */
+function matchHasValue(value, pattern) {
+    if (!value)
+        return false;
+    if (!pattern)
+        return true;
+    const candidate = Array.isArray(value) ? value.at(-1) : value;
+    return (candidate !== undefined && getCompiledRegExp(`^${pattern}$`).test(candidate));
+}
+/**
+ * Normalizes the request host for route-condition matching and captures.
+ *
+ * Next.js removes the port and lowercases the hostname before applying host
+ * patterns. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L82-L88
+ *
+ * @param headers The request headers
+ * @returns The normalized hostname, or undefined when no host is present
+ */
+function getHostname(headers) {
+    return headers.host?.split(":", 1)[0].toLowerCase();
+}
+/**
+ * Removes characters unsupported by path-to-regexp parameter names.
+ *
+ * Next.js exposes value-less conditions under a name containing only ASCII
+ * letters. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L21-L36
+ *
+ * @param name The route-condition key
+ * @returns The sanitized destination parameter name
+ */
+function getSafeParamName(name) {
+    return name.replaceAll(/[^a-zA-Z]/g, "");
+}
 const routeHasMatcher = (headers, cookies, query) => (redirect) => {
     switch (redirect.type) {
         case "header":
-            return (!!headers?.[redirect.key.toLowerCase()] &&
-                new RegExp(redirect.value ?? "").test(headers[redirect.key.toLowerCase()] ?? ""));
+            return matchHasValue(headers[redirect.key.toLowerCase()], redirect.value);
         case "cookie":
-            return (!!cookies?.[redirect.key] &&
-                new RegExp(redirect.value ?? "").test(cookies[redirect.key] ?? ""));
+            return matchHasValue(cookies[redirect.key], redirect.value);
         case "query":
-            return query[redirect.key] && Array.isArray(redirect.value)
-                ? redirect.value.reduce((prev, current) => prev || new RegExp(current).test(query[redirect.key]), false)
-                : new RegExp(redirect.value ?? "").test(query[redirect.key] ?? "");
+            return matchHasValue(query[redirect.key], redirect.value);
         case "host":
-            return (headers?.host !== "" &&
-                new RegExp(redirect.value ?? "").test(headers.host));
+            return matchHasValue(getHostname(headers), redirect.value);
         default:
             return false;
     }
@@ -39,13 +103,48 @@ const getParamsFromSource = (source) => (value) => {
     const _match = source(value);
     return _match ? _match.params : {};
 };
+/**
+ * Creates an extractor for route-condition captures.
+ *
+ * Value-less conditions expose their present value under a safe parameter
+ * name. Patterned repeated query parameters capture their final value, matching
+ * the value used to decide the condition. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L92-L107
+ *
+ * @param headers The request headers
+ * @param cookies The parsed request cookies
+ * @param query The request query parameters
+ * @returns A function that extracts named captures for one condition
+ * @throws {SyntaxError} When the configured pattern is invalid
+ */
 const computeParamHas = (headers, cookies, query) => (has) => {
-    if (!has.value)
-        return {};
-    const matcher = new RegExp(`^${has.value}$`);
-    const fromSource = (value) => {
+    if (!has.value) {
+        let key;
+        let value;
+        switch (has.type) {
+            case "header":
+                key = has.key.toLowerCase();
+                value = headers[key];
+                break;
+            case "cookie":
+                key = has.key;
+                value = cookies[key];
+                break;
+            case "query":
+                key = has.key;
+                value = query[key];
+                break;
+            case "host":
+                return {};
+        }
+        return value ? { [getSafeParamName(key)]: value } : {};
+    }
+    const matcher = getCompiledRegExp(`^${has.value}$`);
+    const fromSource = (value, implicitKey) => {
         const matches = value.match(matcher);
-        return matches?.groups ?? {};
+        if (matches?.groups)
+            return matches.groups;
+        return implicitKey && matches?.[0] ? { [implicitKey]: matches[0] } : {};
     };
     switch (has.type) {
         case "header":
@@ -53,39 +152,108 @@ const computeParamHas = (headers, cookies, query) => (has) => {
         case "cookie":
             return fromSource(cookies[has.key] ?? "");
         case "query":
-            return Array.isArray(query[has.key])
-                ? fromSource(query[has.key].join(","))
-                : fromSource(query[has.key] ?? "");
+            return fromSource(Array.isArray(query[has.key])
+                ? (query[has.key].at(-1) ?? "")
+                : (query[has.key] ?? ""));
         case "host":
-            return fromSource(headers.host ?? "");
+            return fromSource(getHostname(headers) ?? "", "host");
     }
 };
-function convertMatch(match, toDestination, destination) {
-    if (!match) {
-        return destination;
+/**
+ * Compiles parameters in a non-path value while preserving literal syntax.
+ *
+ * Header keys and values can contain URL schemes and characters that
+ * path-to-regexp otherwise treats as patterns. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L127-L160
+ *
+ * @param value The configured header key or value
+ * @param params The source and route-condition parameters
+ * @returns The interpolated value
+ * @throws {TypeError} When a referenced parameter cannot be compiled
+ */
+function compileNonPath(value, params) {
+    if (!value.includes(":"))
+        return value;
+    let compiledValue = value;
+    for (const key of Object.keys(params)) {
+        if (!compiledValue.includes(`:${key}`))
+            continue;
+        const escapedKey = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+        compiledValue = compiledValue
+            .replace(getCompiledRegExp(`:${escapedKey}\\*`, "g"), `:${key}--ESCAPED_PARAM_ASTERISKS`)
+            .replace(getCompiledRegExp(`:${escapedKey}\\?`, "g"), `:${key}--ESCAPED_PARAM_QUESTION`)
+            .replace(getCompiledRegExp(`:${escapedKey}\\+`, "g"), `:${key}--ESCAPED_PARAM_PLUS`)
+            .replace(getCompiledRegExp(`:${escapedKey}(?!\\w)`, "g"), `--ESCAPED_PARAM_COLON${key}`);
     }
-    const { params } = match;
-    const isUsingParams = Object.keys(params).length > 0;
-    return isUsingParams ? toDestination(params) : destination;
+    compiledValue = compiledValue
+        .replace(/(:|\*|\?|\+|\(|\)|\{|\})/g, "\\$1")
+        .replaceAll("--ESCAPED_PARAM_PLUS", "+")
+        .replaceAll("--ESCAPED_PARAM_COLON", ":")
+        .replaceAll("--ESCAPED_PARAM_QUESTION", "?")
+        .replaceAll("--ESCAPED_PARAM_ASTERISKS", "*");
+    return compile(`/${compiledValue}`, { validate: false })(params).slice(1);
 }
+/**
+ * Compiles each destination query value independently.
+ *
+ * Independent compilation gives repeat parameters the same slash separator as
+ * Next.js while preserving configured query keys and delimiters.
+ *
+ * @param queryString The destination query string without a leading question mark
+ * @param params The source and route-condition parameters
+ * @returns The interpolated destination query string
+ * @throws {TypeError} When a referenced parameter cannot be compiled
+ */
+function compileQueryString(queryString, params) {
+    return queryString
+        .split("&")
+        .map((part) => {
+        const separator = part.indexOf("=");
+        if (separator === -1)
+            return part;
+        const key = part.slice(0, separator + 1);
+        return `${key}${compileNonPath(part.slice(separator + 1), params)}`;
+    })
+        .join("&");
+}
+/**
+ * Resolves configured response headers for a request.
+ *
+ * Source parameters are merged with successful condition parameters before
+ * interpolation, with condition parameters taking precedence. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/server/lib/router-utils/resolve-routes.ts#L400-L414
+ *
+ * @param event The request used to match configured headers
+ * @param configHeaders The configured header routes
+ * @returns The response headers produced by every matching route
+ * @throws {SyntaxError} When a configured route pattern is invalid
+ */
 export function getNextConfigHeaders(event, configHeaders) {
     if (!configHeaders) {
         return {};
     }
     const matcher = routeHasMatcher(event.headers, event.cookies, event.query);
+    const computeHas = computeParamHas(event.headers, event.cookies, event.query);
     const requestHeaders = {};
     const localizedRawPath = localizePath(event);
     for (const { headers, has, missing, regex, source, locale, } of configHeaders) {
         const path = locale === false ? event.rawPath : localizedRawPath;
-        if (new RegExp(regex).test(path) &&
+        if (getCompiledRegExp(regex).test(path) &&
             checkHas(matcher, has) &&
             checkHas(matcher, missing, true)) {
             const fromSource = match(source);
             const _match = fromSource(path);
+            const params = {
+                ...(_match ? _match.params : {}),
+                ...has?.reduce((acc, cur) => {
+                    return Object.assign(acc, computeHas(cur));
+                }, {}),
+            };
+            const hasParams = Object.keys(params).length > 0;
             headers.forEach((h) => {
                 try {
-                    const key = convertMatch(_match, compile(h.key), h.key);
-                    const value = convertMatch(_match, compile(h.value), h.value);
+                    const key = hasParams ? compileNonPath(h.key, params) : h.key;
+                    const value = hasParams ? compileNonPath(h.value, params) : h.value;
                     requestHeaders[key] = value;
                 }
                 catch {
@@ -98,18 +266,34 @@ export function getNextConfigHeaders(event, configHeaders) {
     return requestHeaders;
 }
 /**
- * TODO: This method currently only check for the first match.
- *       It should check for all matches for `beforeFiles` and `afterFiles` rewrite
- *       See https://nextjs.org/docs/app/api-reference/config/next-config-js/rewrites
+ * Applies the first matching rewrite to an internal request.
+ *
+ * Only successful `has` predicates supply destination parameters. Nonmatching
+ * `missing` predicates must not manufacture captures from absent values. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L113-L125
+ *
+ * Destination queries use non-path compilation so repeated parameters retain
+ * their separators. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L292-L302
+ *
+ * TODO: This method currently only checks the first match. It should check all
+ * matches for `beforeFiles` and `afterFiles` rewrites. See
+ * https://nextjs.org/docs/app/api-reference/config/next-config-js/rewrites
+ *
+ * @param event The request to rewrite
+ * @param rewrites The configured rewrites to evaluate
+ * @param appendParamsToQuery Whether unused match parameters are added to the query
+ * @returns The rewritten request and matched rewrite metadata
+ * @throws {TypeError} When a matched destination cannot be compiled
  */
-export function handleRewrites(event, rewrites) {
+export function handleRewrites(event, rewrites, appendParamsToQuery = true) {
     const { rawPath, headers, query, cookies, url } = event;
     const localizedRawPath = localizePath(event);
     const matcher = routeHasMatcher(headers, cookies, query);
     const computeHas = computeParamHas(headers, cookies, query);
     const rewrite = rewrites.find((route) => {
         const path = route.locale === false ? rawPath : localizedRawPath;
-        return (new RegExp(route.regex).test(path) &&
+        return (getCompiledRegExp(route.regex).test(path) &&
             checkHas(matcher, route.has) &&
             checkHas(matcher, route.missing, true));
     });
@@ -118,14 +302,16 @@ export function handleRewrites(event, rewrites) {
     const isExternalRewrite = isExternal(rewrite?.destination);
     debug("isExternalRewrite", isExternalRewrite);
     if (rewrite) {
-        const { pathname, protocol, hostname, queryString } = getUrlParts(rewrite.destination, isExternalRewrite);
+        const { pathname, protocol, hostname, queryString, hash } = getUrlParts(rewrite.destination, isExternalRewrite);
         // We need to use a localized path if the rewrite is not locale specific
         const pathToUse = rewrite.locale === false ? rawPath : localizedRawPath;
-        debug("urlParts", { pathname, protocol, hostname, queryString });
-        const toDestinationPath = compile(escapeRegex(pathname, { isPath: true }));
+        debug("urlParts", { pathname, protocol, hostname, queryString, hash });
+        // Values were validated while matching; Next.js does not revalidate them
+        // as single path segments. https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L254-L268
+        const compileOptions = { validate: false };
+        const toDestinationPath = compile(escapeRegex(pathname, { isPath: true }), compileOptions);
         // A literal numeric port is URL syntax, not a path-to-regexp parameter.
-        const toDestinationHost = compile(escapeRegex(hostname).replace(/:(\d+)$/, "\\:$1"));
-        const toDestinationQuery = compile(escapeRegex(queryString));
+        const toDestinationHost = compile(escapeRegex(hostname).replace(/:(\d+)$/, "\\:$1"), { ...compileOptions, encode: encodeURIComponent });
         const params = {
             // params for the source
             ...getParamsFromSource(match(escapeRegex(rewrite.source, { isPath: true })))(pathToUse),
@@ -133,23 +319,33 @@ export function handleRewrites(event, rewrites) {
             ...rewrite.has?.reduce((acc, cur) => {
                 return Object.assign(acc, computeHas(cur));
             }, {}),
-            // params for the missing
-            ...rewrite.missing?.reduce((acc, cur) => {
-                return Object.assign(acc, computeHas(cur));
-            }, {}),
         };
         const isUsingParams = Object.keys(params).length > 0;
+        const queryParams = Object.fromEntries(Object.entries(params).filter(([key]) => key !== "nextInternalLocale"));
+        // Next.js appends match parameters only when none are consumed by the
+        // destination path or hostname. See
+        // https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L286-L302
+        const destinationParams = [
+            ...parse(escapeRegex(`${pathname}${hash}`, { isPath: true })),
+            ...(hostname
+                ? parse(escapeRegex(hostname).replace(/:(\d+)$/, "\\:$1"))
+                : []),
+        ].flatMap((token) => typeof token === "string" ? [] : [String(token.name)]);
         let rewrittenQuery = queryString;
         let rewrittenHost = hostname;
-        let rewrittenPath = pathname;
+        let rewrittenHash = hash;
+        let rewrittenPath = unescapeRegex(toDestinationPath(params));
+        if (pathname.startsWith("/") && !rewrittenPath.startsWith("/")) {
+            rewrittenPath = `/${rewrittenPath}`;
+        }
         if (isUsingParams) {
-            rewrittenPath = unescapeRegex(toDestinationPath(params));
             rewrittenHost = unescapeRegex(toDestinationHost(params));
-            rewrittenQuery = unescapeRegex(toDestinationQuery(params));
+            rewrittenQuery = compileQueryString(queryString, params);
+            rewrittenHash = compileNonPath(hash, params);
         }
         // We need to strip the locale from the path if it's a local api route
         if (NextConfig.i18n && !isExternalRewrite) {
-            const strippedPathLocale = rewrittenPath.replace(new RegExp(`^/(${NextConfig.i18n.locales.join("|")})`), "");
+            const strippedPathLocale = rewrittenPath.replace(getCompiledRegExp(`^/(${NextConfig.i18n.locales.join("|")})`), "");
             if (strippedPathLocale.startsWith("/api/")) {
                 rewrittenPath = strippedPathLocale;
             }
@@ -158,11 +354,17 @@ export function handleRewrites(event, rewrites) {
             ? `${protocol}//${rewrittenHost}${rewrittenPath}`
             : new URL(rewrittenPath, event.url).href;
         // We merge query params from the source and the destination
+        const destinationQuery = convertFromQueryString(rewrittenQuery);
         finalQuery = {
             ...query,
-            ...convertFromQueryString(rewrittenQuery),
+            ...(!appendParamsToQuery ||
+                Object.keys(queryParams).some((key) => destinationParams.includes(key))
+                ? {}
+                : queryParams),
+            ...destinationQuery,
         };
         rewrittenUrl += convertToQueryString(finalQuery);
+        rewrittenUrl += rewrittenHash;
         debug("rewrittenUrl", { rewrittenUrl, finalQuery, isUsingParams });
     }
     return {
@@ -176,6 +378,35 @@ export function handleRewrites(event, rewrites) {
         isExternalRewrite,
     };
 }
+/**
+ * Applies every matching `beforeFiles` rewrite, in order.
+ *
+ * Next.js keeps evaluating `beforeFiles` rewrites after a match, each one
+ * against the URL produced by the previous match. An external rewrite ends the
+ * evaluation. See
+ * https://github.com/vercel/next.js/blob/ae745ba/packages/next/src/server/lib/router-utils/resolve-routes.ts#L863-L932
+ *
+ * @param event The request to rewrite
+ * @param rewrites The configured `beforeFiles` rewrites
+ * @returns The rewritten request and the last matched rewrite metadata
+ * @throws {TypeError} When a matched destination cannot be compiled
+ */
+export function handleBeforeFilesRewrites(event, rewrites) {
+    let result = {
+        internalEvent: event,
+        __rewrite: undefined,
+        isExternalRewrite: false,
+    };
+    for (const rewrite of rewrites) {
+        const rewriteResult = handleRewrites(result.internalEvent, [rewrite]);
+        if (!rewriteResult.__rewrite)
+            continue;
+        result = rewriteResult;
+        if (result.isExternalRewrite)
+            break;
+    }
+    return result;
+}
 // Normalizes repeated slashes in the path e.g. hello//world -> hello/world
 // or backslashes to forward slashes. This prevents requests such as //domain
 // from invoking the middleware with `request.url === "domain"`.
@@ -250,7 +481,7 @@ export function handleRedirects(event, redirects) {
     const localeRedirect = handleLocaleRedirect(event);
     if (localeRedirect)
         return localeRedirect;
-    const { internalEvent, __rewrite } = handleRewrites(event, redirects.filter((r) => !r.internal));
+    const { internalEvent, __rewrite } = handleRewrites(event, redirects.filter((r) => !r.internal), false);
     if (__rewrite && !__rewrite.internal) {
         return {
             type: event.type,
@@ -301,10 +532,7 @@ export function handleFallbackFalse(internalEvent, prerenderManifest) {
     const { rawPath } = internalEvent;
     const { dynamicRoutes = {}, routes = {} } = prerenderManifest ?? {};
     const prerenderedFallbackRoutes = Object.entries(dynamicRoutes).filter(([, { fallback }]) => fallback === false);
-    const routeFallback = prerenderedFallbackRoutes.some(([, { routeRegex }]) => {
-        const routeRegexExp = new RegExp(routeRegex);
-        return routeRegexExp.test(rawPath);
-    });
+    const routeFallback = prerenderedFallbackRoutes.some(([, { routeRegex }]) => getCompiledRegExp(routeRegex).test(rawPath));
     const locales = NextConfig.i18n?.locales;
     const routesAlreadyHaveLocale = locales?.includes(rawPath.split("/")[1]) ||
         // If we don't use locales, we don't need to add the default locale

package/dist/core/routing/middleware.d.ts

@@ -4,11 +4,15 @@ type MiddlewareLoader = () => Promise<{
     default: Middleware;
 }>;
 /**
+ * Runs matching Next.js middleware and applies its routing result.
  *
- * @param internalEvent the internal event
- * @param initialSearch the initial query string as it was received in the handler
- * @param middlewareLoader Only used for unit test
- * @returns `Promise<MiddlewareEvent | InternalResult>`
+ * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
+ *
+ * @param internalEvent The internal request event.
+ * @param initialSearch The initial query string received by the handler.
+ * @param middlewareLoader The middleware loader, overridden by unit tests.
+ * @return The middleware-adjusted event or a terminal middleware response.
+ * @throws When middleware loading, execution, or response processing fails.
  */
 export declare function handleMiddleware(internalEvent: InternalEvent, initialSearch: string, middlewareLoader?: MiddlewareLoader): Promise<MiddlewareEvent | InternalResult>;
 export {};

package/dist/core/routing/middleware.js

@@ -14,11 +14,15 @@ function defaultMiddlewareLoader() {
     return import("./middleware.mjs");
 }
 /**
+ * Runs matching Next.js middleware and applies its routing result.
  *
- * @param internalEvent the internal event
- * @param initialSearch the initial query string as it was received in the handler
- * @param middlewareLoader Only used for unit test
- * @returns `Promise<MiddlewareEvent | InternalResult>`
+ * Middleware request-header overrides are normalized and filtered to Next.js's allowlist.
+ *
+ * @param internalEvent The internal request event.
+ * @param initialSearch The initial query string received by the handler.
+ * @param middlewareLoader The middleware loader, overridden by unit tests.
+ * @return The middleware-adjusted event or a terminal middleware response.
+ * @throws When middleware loading, execution, or response processing fails.
  */
 export async function handleMiddleware(internalEvent, initialSearch, middlewareLoader = defaultMiddlewareLoader) {
     const headers = internalEvent.headers;
@@ -81,11 +85,15 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
   
       We can delete `x-middleware-override-headers` and check if the key starts with
       x-middleware-request- to set the req headers
+  
+      The request headers that are not listed in `x-middleware-override-headers` have been
+      deleted by the middleware and must not be forwarded.
     */
     const responseHeaders = result.headers;
     const reqHeaders = {};
     const resHeaders = {};
     // These are internal headers used by Next.js, we don't want to expose them to the client
+    // NOTE: keys must be in lowercase to match the normalized header keys.
     const filteredHeaders = [
         "x-middleware-override-headers",
         "x-middleware-next",
@@ -95,21 +103,23 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     ];
     const xMiddlewareKey = "x-middleware-request-";
     responseHeaders.forEach((value, key) => {
-        if (key.startsWith(xMiddlewareKey)) {
-            const k = key.substring(xMiddlewareKey.length);
+        // Always use the normalized key (lowercase) for comparison and storage.
+        const normalizedKey = key.toLowerCase();
+        if (normalizedKey.startsWith(xMiddlewareKey)) {
+            const k = normalizedKey.substring(xMiddlewareKey.length);
             reqHeaders[k] = value;
         }
         else {
-            if (filteredHeaders.includes(key.toLowerCase()))
+            if (filteredHeaders.includes(normalizedKey))
                 return;
             // Headers.forEach folds same-name headers; use getSetCookie() below instead.
-            if (key.toLowerCase() === "set-cookie")
+            if (normalizedKey === "set-cookie")
                 return;
-            if (REDIRECTS.has(statusCode) && key.toLowerCase() === "location") {
-                resHeaders[key] = normalizeLocationHeader(value, internalEvent.url);
+            if (REDIRECTS.has(statusCode) && normalizedKey === "location") {
+                resHeaders[normalizedKey] = normalizeLocationHeader(value, internalEvent.url);
             }
             else {
-                resHeaders[key] = value;
+                resHeaders[normalizedKey] = value;
             }
         }
     });
@@ -122,6 +132,13 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
     if (setCookies.length > 0) {
         resHeaders["set-cookie"] = setCookies;
     }
+    const overrideHeaders = responseHeaders.get("x-middleware-override-headers");
+    const overriddenHeaders = overrideHeaders === null
+        ? undefined
+        : new Set(overrideHeaders.split(",").map((key) => key.trim().toLowerCase()));
+    const newHeaders = Object.fromEntries([...Object.entries(internalEvent.headers), ...Object.entries(reqHeaders)]
+        .map(([key, value]) => [key.toLowerCase(), value])
+        .filter(([key]) => !overriddenHeaders || overriddenHeaders.has(key)));
     // If the middleware returned a Rewrite, set the `url` to the pathname of the rewrite
     // NOTE: the header was added to `req` from above
     const rewriteUrl = responseHeaders.get("x-middleware-rewrite");
@@ -162,7 +179,7 @@ export async function handleMiddleware(internalEvent, initialSearch, middlewareL
         url: newUrl,
         rawPath: new URL(newUrl).pathname,
         type: internalEvent.type,
-        headers: { ...internalEvent.headers, ...reqHeaders },
+        headers: newHeaders,
         body: internalEvent.body,
         method: internalEvent.method,
         query: middlewareQuery,

package/dist/core/routing/routeMatcher.d.ts

@@ -1,3 +1,3 @@
-import type { ResolvedRoute } from "../../types/open-next";
+import type { ResolvedRoute } from "../../types/open-next.js";
 export declare const staticRouteMatcher: (path: string) => ResolvedRoute[];
 export declare const dynamicRouteMatcher: (path: string) => ResolvedRoute[];

package/dist/core/routing/routeMatcher.js

@@ -1,4 +1,4 @@
-import { AppPathRoutesManifest, PagesManifest, RoutesManifest, } from "../../adapters/config/index";
+import { AppPathRoutesManifest, PagesManifest, RoutesManifest, } from "../../adapters/config/index.js";
 // Add the locale prefix to the regex so we correctly match the rawPath
 const optionalLocalePrefixRegex = `^/(?:${RoutesManifest.locales.map((locale) => `${locale}/?`).join("|")})?`;
 // Add the basepath prefix to the regex so we correctly match the rawPath

package/dist/core/routing/util.d.ts

@@ -1,7 +1,7 @@
 import type { OutgoingHttpHeaders } from "node:http";
 import type { IncomingMessage } from "../../http/index.js";
 import { OpenNextNodeResponse } from "../../http/openNextResponse.js";
-import type { FunctionsConfigManifest, MiddlewareManifest } from "../../types/next-types";
+import type { FunctionsConfigManifest, MiddlewareManifest } from "../../types/next-types.js";
 import type { InternalEvent, InternalResult, RoutingResult, StreamCreator } from "../../types/open-next.js";
 import { ReadableStream } from "node:stream/web";
 /**
@@ -9,17 +9,31 @@ import { ReadableStream } from "node:stream/web";
  * @__PURE__
  */
 export declare function isExternal(url?: string, host?: string): boolean;
+/**
+ * Parses a raw query string into decoded scalar or repeated values.
+ *
+ * The result has the same shape the converters produce from `URLSearchParams`
+ * and follows Next.js's decoded query representation.
+ * https://github.com/vercel/next.js/blob/3439bde/packages/next/src/shared/lib/router/utils/querystring.ts#L34-L48
+ *
+ * @param query The query string without a leading question mark
+ * @returns The decoded scalar and repeated query values
+ *
+ * @__PURE__
+ */
 export declare function convertFromQueryString(query: string): Record<string, string | string[]>;
 /**
  * Splits an URL into its parts
  *
  * The URL is a route destination, i.e. a `path-to-regexp` pattern rather than a
  * well formed URL, so it can not be parsed with `new URL()` which would percent
- * encode some of the pattern characters.
+ * encode some of the pattern characters. Like Next.js, the fragment is kept
+ * separate from the query while destination parameters are interpolated.
+ * https://github.com/vercel/next.js/blob/3439bde/packages/next/src/shared/lib/router/utils/prepare-destination.ts#L221-L299
  *
  * @param url The URL to split
  * @param isExternal Whether the URL points to an external host
- * @returns The protocol, hostname, pathname and query string of the URL
+ * @returns The protocol, hostname, pathname, query string and fragment
  * @throws When `isExternal` is true and the URL is not an absolute HTTP(S) URL
  *
  * @__PURE__
@@ -29,6 +43,7 @@ export declare function getUrlParts(url: string, isExternal: boolean): {
     pathname: string;
     protocol: string;
     queryString: string;
+    hash: string;
 };
 /**
  * Creates an URL to a Next page
@@ -49,7 +64,8 @@ export declare function convertRes(res: OpenNextNodeResponse): InternalResult;
  * Make sure that multi-value query parameters are transformed to
  * ?key=value1&key=value2&... so that Next converts those parameters
  * to an array when reading the query parameters
- * query should be properly encoded before using this function
+ * Keys and values are expected decoded (as produced by the converters) and are
+ * percent-encoded here, so a value such as "h&m" survives as "h%26m"
  * @__PURE__
  */
 export declare function convertToQueryString(query: Record<string, string | string[]>): string;