cdk-nextjs 0.7.5 → 0.7.7

package/lib/adapter/cache-handler.mjs

@@ -4704,14 +4704,14 @@ var init_getProfileName = __esm({
 });
 
 // node_modules/.pnpm/@smithy+core@3.35.0/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js
-import { createHash } from "node:crypto";
+import { createHash as createHash2 } from "node:crypto";
 import { join as join2 } from "node:path";
 var getSSOTokenFilepath;
 var init_getSSOTokenFilepath = __esm({
   "node_modules/.pnpm/@smithy+core@3.35.0/node_modules/@smithy/core/dist-es/submodules/config/shared-ini-file-loader/getSSOTokenFilepath.js"() {
     init_getHomeDir();
     getSSOTokenFilepath = (id) => {
-      const hasher = createHash("sha1");
+      const hasher = createHash2("sha1");
       const cacheName = hasher.update(id).digest("hex");
       return join2(getHomeDir(), ".aws", "sso", "cache", `${cacheName}.json`);
     };
@@ -6908,7 +6908,7 @@ var init_serdePlugin = __esm({
 });
 
 // node_modules/.pnpm/@smithy+core@3.35.0/node_modules/@smithy/core/dist-es/submodules/serde/hash-node/hash-node.js
-import { createHash as createHash2, createHmac } from "node:crypto";
+import { createHash as createHash3, createHmac } from "node:crypto";
 function castSourceData(toCast, encoding) {
   if (Buffer.isBuffer(toCast)) {
     return toCast;
@@ -6942,7 +6942,7 @@ var init_hash_node = __esm({
         return Promise.resolve(this.hash.digest());
       }
       reset() {
-        this.hash = this.secret ? createHmac(this.algorithmIdentifier, castSourceData(this.secret)) : createHash2(this.algorithmIdentifier);
+        this.hash = this.secret ? createHmac(this.algorithmIdentifier, castSourceData(this.secret)) : createHash3(this.algorithmIdentifier);
       }
     };
   }
@@ -8161,11 +8161,11 @@ var init_Md5Js = __esm({
 });
 
 // node_modules/.pnpm/@smithy+core@3.35.0/node_modules/@smithy/core/dist-es/submodules/checksum/md5/Md5Node.js
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 function buildNativeClass() {
   return class Md5Node {
     digestLength = 16;
-    hash = createHash3("md5");
+    hash = createHash4("md5");
     update(data) {
       this.hash.update(toUint8Array(data));
     }
@@ -8174,7 +8174,7 @@ function buildNativeClass() {
       return new Uint8Array(buf2.buffer, buf2.byteOffset, buf2.byteLength);
     }
     reset() {
-      this.hash = createHash3("md5");
+      this.hash = createHash4("md5");
     }
   };
 }
@@ -8185,7 +8185,7 @@ var init_Md5Node = __esm({
     init_Md5Js();
     hasNativeCrypto = (() => {
       try {
-        createHash3("md5");
+        createHash4("md5");
         return true;
       } catch {
         return false;
@@ -8502,7 +8502,7 @@ var init_Sha256Js = __esm({
 });
 
 // node_modules/.pnpm/@smithy+core@3.35.0/node_modules/@smithy/core/dist-es/submodules/checksum/sha256/Sha256Node.js
-import { createHash as createHash4, createHmac as createHmac2 } from "node:crypto";
+import { createHash as createHash5, createHmac as createHmac2 } from "node:crypto";
 function buildNativeClass3() {
   return class Sha256Node {
     digestLength = 32;
@@ -8536,7 +8536,7 @@ function buildNativeClass3() {
       this.finished = false;
     }
     createHash() {
-      return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash4("sha256");
+      return this.secret ? createHmac2("sha256", toBuffer(this.secret)) : createHash5("sha256");
     }
   };
 }
@@ -8555,7 +8555,7 @@ var init_Sha256Node = __esm({
     init_Sha256Js();
     hasNativeCrypto2 = (() => {
       try {
-        createHash4("sha256");
+        createHash5("sha256");
         return true;
       } catch {
         return false;
@@ -26825,7 +26825,7 @@ var require_dist_cjs13 = __commonJS({
     var { setCredentialFeature: setCredentialFeature2 } = (init_client3(), __toCommonJS(client_exports2));
     var { CredentialsProviderError: CredentialsProviderError2, parseKnownFiles: parseKnownFiles2, getProfileName: getProfileName2 } = (init_config2(), __toCommonJS(config_exports));
     var { HttpRequest: HttpRequest2 } = (init_protocols(), __toCommonJS(protocols_exports));
-    var { createHash: createHash6, createPrivateKey, createPublicKey, sign: sign3 } = __require("node:crypto");
+    var { createHash: createHash7, createPrivateKey, createPublicKey, sign: sign3 } = __require("node:crypto");
     var { promises } = __require("node:fs");
     var { homedir: homedir2 } = __require("node:os");
     var { dirname: dirname2, join: join8 } = __require("node:path");
@@ -26994,7 +26994,7 @@ var require_dist_cjs13 = __commonJS({
       getTokenFilePath() {
         const directory = process.env.AWS_LOGIN_CACHE_DIRECTORY ?? join8(homedir2(), ".aws", "login", "cache");
         const loginSessionBytes = Buffer.from(this.loginSession, "utf8");
-        const loginSessionSha256 = createHash6("sha256").update(loginSessionBytes).digest("hex");
+        const loginSessionSha256 = createHash7("sha256").update(loginSessionBytes).digest("hex");
         return join8(directory, `${loginSessionSha256}.json`);
       }
       derToRawSignature(derSignature) {
@@ -36366,7 +36366,7 @@ var init_Sha1Js = __esm({
 });
 
 // node_modules/.pnpm/@aws-sdk+checksums@3.1001.1/node_modules/@aws-sdk/checksums/dist-es/submodules/sha/sha1/Sha1Node.js
-import { createHash as createHash5, createHmac as createHmac3 } from "node:crypto";
+import { createHash as createHash6, createHmac as createHmac3 } from "node:crypto";
 function buildNativeClass4() {
   return class Sha1Node {
     digestLength = 20;
@@ -36400,7 +36400,7 @@ function buildNativeClass4() {
       this.finished = false;
     }
     createHash() {
-      return this.secret ? createHmac3("sha1", toBuffer2(this.secret)) : createHash5("sha1");
+      return this.secret ? createHmac3("sha1", toBuffer2(this.secret)) : createHash6("sha1");
     }
   };
 }
@@ -36419,7 +36419,7 @@ var init_Sha1Node = __esm({
     init_Sha1Js();
     hasNativeCrypto3 = (() => {
       try {
-        createHash5("sha1");
+        createHash6("sha1");
         return true;
       } catch {
         return false;
@@ -74013,6 +74013,9 @@ var require_dist_cjs22 = __commonJS({
 // src/adapter/cache-handler.ts
 var import_debug9 = __toESM(require_src());
 
+// src/adapter/cache-utils.ts
+import { createHash } from "node:crypto";
+
 // src/utils/base-path.ts
 function normalizeBasePath(basePath) {
   return (basePath || "").replace(/^\/+/, "").replace(/\/+$/, "");
@@ -74077,6 +74080,35 @@ function parseCacheValue(jsonString) {
     return val;
   });
 }
+function cacheKeyFileName(cacheKey) {
+  let cleanCacheKey = cacheKey;
+  if (cacheKey === "/" || cacheKey === "") {
+    cleanCacheKey = "index";
+  } else if (cacheKey.startsWith("/")) {
+    cleanCacheKey = cacheKey.slice(1);
+  }
+  return `${cleanCacheKey}.json`;
+}
+function sha256Hex(value) {
+  return createHash("sha256").update(value).digest("hex");
+}
+var MAX_S3_KEY_BYTES = 1024;
+var MAX_BUILD_ID_BYTES = 127;
+var LONG_KEY_PREFIX = "_long-key";
+function cacheObjectName(cacheKey) {
+  const name = cacheKeyFileName(cacheKey);
+  if (Buffer.byteLength(name) <= MAX_S3_KEY_BYTES - (MAX_BUILD_ID_BYTES + 1)) {
+    return name;
+  }
+  return `${LONG_KEY_PREFIX}/${sha256Hex(name)}.long`;
+}
+var ROUTE_CACHE_KEY_PREFIX = /^route-cache\/[A-Z_]+\/[0-9a-f]{64}\/\$(?=\/)/;
+function denormalizePagePath(pagePath) {
+  if (pagePath === "/index") {
+    return "/";
+  }
+  return pagePath.startsWith("/index/") ? pagePath.slice("/index".length) : pagePath;
+}
 var NEXT_CACHE_TAGS_HEADER = "x-next-cache-tags";
 function headerTags(value) {
   const headers = value?.headers;
@@ -74103,12 +74135,11 @@ var LocalFileCacheHandler = class {
     debug(`Created local cache directory: ${this.cacheDir}`);
   }
   /**
-   * Build file path for cache entry
-   * Structure: {cacheKey}.json (BucketDeployment will add buildId prefix)
+   * Build file path for cache entry: {@link cacheObjectName}, the name the
+   * runtime reads it back under (BucketDeployment will add buildId prefix)
    */
   buildFilePath(cacheKey) {
-    const filePath = join(this.cacheDir, `${cacheKey}.json`);
-    return filePath;
+    return join(this.cacheDir, cacheObjectName(cacheKey));
   }
   /**
    * Read back an entry this build already wrote.
@@ -74195,6 +74226,7 @@ var import_debug7 = __toESM(require_src());
 // src/adapter/aws-cache-store.ts
 var import_client_dynamodb = __toESM(require_dist_cjs19());
 var import_client_s3 = __toESM(require_dist_cjs20());
+import { AsyncLocalStorage } from "node:async_hooks";
 import { join as join6 } from "node:path";
 function resolveAwsCacheConfig() {
   return {
@@ -74205,13 +74237,10 @@ function resolveAwsCacheConfig() {
   };
 }
 function buildS3Key(buildId, cacheKey) {
-  let cleanCacheKey = cacheKey;
-  if (cacheKey === "/" || cacheKey === "") {
-    cleanCacheKey = "index";
-  } else if (cacheKey.startsWith("/")) {
-    cleanCacheKey = cacheKey.slice(1);
-  }
-  return join6(buildId, `${cleanCacheKey}.json`);
+  return join6(buildId, cacheKeyFileName(cacheKey));
+}
+function s3ObjectKey(buildId, cacheKey) {
+  return join6(buildId, cacheObjectName(cacheKey));
 }
 function markerState(marker, createdAt, now) {
   const { revalidatedAt, expiredAt, staleAt } = marker;
@@ -74267,6 +74296,15 @@ function markerOf(item) {
 }
 var BATCH_GET_MAX_KEYS = 100;
 var DEFAULT_TAG_REFRESH_MS = 1e3;
+var TAG_REFRESH_GRACE_MS = 1e3;
+var MAX_SORT_KEY_BYTES = 1024;
+function hashedTag(tag) {
+  return `#${sha256Hex(tag)}`;
+}
+var MAX_TAG_BYTES = 768;
+function sortKeyTag(tag) {
+  return Buffer.byteLength(tag) <= MAX_TAG_BYTES ? tag : hashedTag(tag);
+}
 var TagMarkerTable = class {
   constructor(client, tableName, buildId) {
     this.client = client;
@@ -74289,7 +74327,7 @@ var TagMarkerTable = class {
         TableName: this.tableName,
         Key: {
           pk: { S: this.buildId },
-          sk: { S: tag }
+          sk: { S: sortKeyTag(tag) }
         },
         ...markerUpdate(now, durations),
         ReturnValues: "ALL_NEW"
@@ -74309,7 +74347,13 @@ var TagMarkerTable = class {
     const unique = Array.from(new Set(tags));
     const markers = /* @__PURE__ */ new Map();
     for (let i5 = 0; i5 < unique.length; i5 += BATCH_GET_MAX_KEYS) {
-      let keys = unique.slice(i5, i5 + BATCH_GET_MAX_KEYS).map((tag) => ({ pk: { S: buildId }, sk: { S: tag } }));
+      const tagBySk = new Map(
+        unique.slice(i5, i5 + BATCH_GET_MAX_KEYS).map((tag) => [sortKeyTag(tag), tag])
+      );
+      let keys = Array.from(
+        tagBySk.keys(),
+        (sk) => ({ pk: { S: buildId }, sk: { S: sk } })
+      );
       for (let attempt = 0; keys?.length && attempt < 3; attempt++) {
         const response = await this.client.send(
           new import_client_dynamodb.BatchGetItemCommand({
@@ -74322,7 +74366,7 @@ var TagMarkerTable = class {
           })
         );
         for (const item of response.Responses?.[tableName] ?? []) {
-          const tag = item.sk?.S;
+          const tag = tagBySk.get(item.sk?.S ?? "");
           if (tag !== void 0) {
             markers.set(tag, markerOf(item));
           }
@@ -74360,11 +74404,13 @@ var RevalidationLog = class {
    * to {@link LOG_PUT_ATTEMPTS} times.
    */
   async put(tag, at, marker) {
+    const skTag = sortKeyTag(tag);
     for (let attempt = 1; ; attempt++) {
       const item = {
         pk: { S: this.pk },
-        sk: { S: `${logSkPrefix(at)}#${tag}` },
-        ttl: { N: String(Math.ceil((at + REVALIDATION_LOG_TTL_MS) / 1e3)) }
+        sk: { S: `${logSkPrefix(at)}#${skTag}` },
+        ttl: { N: String(Math.ceil((at + REVALIDATION_LOG_TTL_MS) / 1e3)) },
+        ...skTag !== tag && { longTag: { S: tag } }
       };
       for (const field of MARKER_FIELDS) {
         const value = marker[field];
@@ -74409,7 +74455,7 @@ var RevalidationLog = class {
             ":pk": { S: this.pk },
             ":since": { S: logSkPrefix(Math.max(0, since)) }
           },
-          ProjectionExpression: "sk, revalidatedAt, staleAt, expiredAt",
+          ProjectionExpression: "sk, longTag, revalidatedAt, staleAt, expiredAt",
           ExclusiveStartKey: startKey
         })
       );
@@ -74421,7 +74467,7 @@ var RevalidationLog = class {
         rows.push({
           sk,
           at: Number(sk.slice(0, LOG_SK_DIGITS)),
-          tag: sk.slice(LOG_SK_DIGITS + 1),
+          tag: item.longTag?.S ?? sk.slice(LOG_SK_DIGITS + 1),
           marker: markerOf(item)
         });
       }
@@ -74465,10 +74511,64 @@ var TrackedTagMarkers = class {
    * result rather than dropped.
    */
   pendingRows = /* @__PURE__ */ new Map();
+  /**
+   * Log rows for tags not tracked and not being read, merged by tag, oldest
+   * first: what the log has said about them since {@link completeSince}. Taken
+   * into a tag's marker when it is read or written.
+   */
+  logOnly = /* @__PURE__ */ new Map();
+  /** See {@link completeSince}. */
+  floor;
+  /**
+   * The future `expiredAt`s of markers dropped since, as `[from, to]`, in
+   * order: once `from` is past, {@link completeSince} moves to `to`, and not
+   * before, since only then does it expire anything. `from` and `to` are the
+   * same until spans are merged for space ({@link laterFloor}).
+   */
+  laterFloors = [];
+  /** The in-memory entry stores judged by {@link completeSince}. */
+  entryStores = [];
+  /** How many times {@link forget} ran: a read started before one is made again. */
+  forgotten = 0;
   /** Tracked tags whose read failed, for the next refresh to read again. */
   unread = /* @__PURE__ */ new Set();
+  /**
+   * Set inside a page render {@link catchUp} let go, for that render alone.
+   * See {@link behindInRender}.
+   */
+  caughtUpRender = new AsyncLocalStorage();
+  /** When `sync` last scanned the entry stores ({@link oldestEntry}). */
+  lastEntryScan = -Infinity;
+  /**
+   * No `logOnly` row is known by it or earlier, so a {@link pruneLogged}
+   * against it or earlier drops nothing: a marker is only ever known by later,
+   * as its `expiredAt` passes.
+   */
+  prunedAgainst = -Infinity;
+  /** When the last refresh started, or was skipped. */
   lastRefresh = -Infinity;
+  /**
+   * The refresh in flight. One left open across a freeze comes back after the
+   * thaw with what it read before, so {@link refresh} waits for it and then
+   * for a fresh one, rather than the runtime waiting for it before the freeze:
+   * that would bill every Lambda invocation for the query's tail.
+   */
   refreshing;
+  /**
+   * When {@link refreshing} last showed the process running: a timer ticks
+   * while it is in flight, and a tick that comes late, or none at all, means
+   * the process was paused - frozen - since it started.
+   */
+  lastTick = -Infinity;
+  /** Whether a tick came late since {@link refreshing} started. */
+  pausedWhileRefreshing = false;
+  ticker;
+  canFreeze;
+  /**
+   * When the last refresh settled, either way, unless it spanned a pause: what
+   * it knows is from then. See {@link behind}.
+   */
+  settledAt;
   /**
    * Where the next log query starts (`clock()`): the last successful one's
    * start, less {@link REVALIDATION_LOG_LOOKBACK_MS}.
@@ -74490,20 +74590,68 @@ var TrackedTagMarkers = class {
     this.random = options.random ?? Math.random;
     this.debug = options.debug ?? (() => {
     });
+    this.canFreeze = options.canFreeze ?? false;
     const at = this.clock();
     this.cursor = at - REVALIDATION_LOG_LOOKBACK_MS;
     this.lastLogRead = at;
+    this.settledAt = at;
+    this.floor = markerClock();
   }
   /** `tag`'s marker as this instance knows it, if it tracks `tag`. */
   get(tag) {
     return this.tags.get(tag);
   }
+  /**
+   * Since when (`markerClock()`) this instance knows of every revalidation of
+   * every tag, tracked or not: tracked ones from their markers and the log,
+   * the others from the log alone (`logOnly`). So an entry created at or after
+   * it can be judged by {@link state} and {@link expiration} without
+   * {@link ensure} reading anything - which matters inside a `'use cache'`
+   * lookup, where Next.js waits for the answer and a read pushes the entry out
+   * of the static stage of a staged render.
+   *
+   * Starts at construction: the log is followed from before it. Moves to now
+   * when the tracked markers are forgotten, and past the revalidations of
+   * whatever else it lets go of - a marker evicted for space, a log row
+   * pruned - which are no longer known: to its `expiredAt` only once that is
+   * past, since a profile's `expire` can be a year out, and moving there at
+   * once would turn the read-free path off for the instance's life.
+   *
+   * A row is pruned only once it is no later than every entry held, so that
+   * costs those entries nothing. An entry stored afterwards with an older
+   * `timestamp` - Next.js stamps the start of its generation, which can
+   * outlast a lookback - is older than this too, and is read first.
+   *
+   * It does not cover a revalidation older than the log's first lookback
+   * whose `expiredAt` is still to come, which would expire an entry created
+   * after it. So the `'use cache'` handler reads an entry's tags in the
+   * background as it stores it.
+   */
+  get completeSince() {
+    const at = markerClock();
+    while (this.laterFloors.length > 0 && this.laterFloors[0][0] <= at) {
+      this.floor = Math.max(this.floor, this.laterFloors.shift()[1]);
+    }
+    return this.floor;
+  }
+  /**
+   * Register an in-memory store whose entries are judged by
+   * {@link completeSince}, by the `timestamp` of the oldest entry it holds:
+   * `logOnly` keeps the rows that could still apply to one of them, and no
+   * others. With none registered it keeps nothing. Asked with `scan` false,
+   * `oldestTimestamp` may answer early, but never late, without a scan.
+   */
+  judgeEntriesOf(oldestTimestamp, holdsAny = () => oldestTimestamp(false) < Infinity) {
+    this.entryStores.push({ oldestTimestamp, holdsAny });
+  }
   /**
    * Track `tag` with `marker`: what this instance just wrote, which it knows
    * without reading it back.
    */
   set(tag, marker) {
-    this.remember(tag, marker);
+    const logged = this.logOnly.get(tag);
+    this.logOnly.delete(tag);
+    this.remember(tag, mergeMarkers(marker, logged));
     this.known(tag, this.clock());
   }
   /**
@@ -74556,27 +74704,103 @@ var TrackedTagMarkers = class {
     const unread = [];
     for (const tag of new Set(tags)) {
       const inFlight = this.reading.get(tag);
-      if (inFlight) {
-        waits.push(inFlight);
-      } else if (this.tags.has(tag)) {
+      if (this.tags.has(tag)) {
         this.touch(tag);
+      } else if (inFlight) {
+        waits.push(inFlight);
       } else {
         unread.push(tag);
       }
     }
     if (unread.length > 0) {
-      const read = this.readInto(unread).then(() => {
-        for (const tag of unread) {
-          this.reading.delete(tag);
-        }
-      });
-      for (const tag of unread) {
-        this.reading.set(tag, read);
-      }
-      waits.push(read);
+      waits.push(this.startRead(unread));
     }
     await Promise.all(waits);
   }
+  /**
+   * {@link readInto} `tags`, as the read of each that whoever needs one of
+   * them next waits on ({@link reading}). Never rejects: a failed read leaves
+   * the tags tracked.
+   */
+  startRead(tags) {
+    const read = this.readInto(tags).then(() => {
+      for (const tag of tags) {
+        this.reading.delete(tag);
+      }
+    });
+    for (const tag of tags) {
+      this.reading.set(tag, read);
+    }
+    return read;
+  }
+  /**
+   * Whether the last refresh settled more than `refreshIntervalMs` plus
+   * {@link TAG_REFRESH_GRACE_MS} ago - one that spanned a freeze counts from
+   * when it started: after the instance sat idle or frozen - or always, with
+   * a `refreshIntervalMs` of `0`. Answering from what it knows then could
+   * serve an entry revalidated elsewhere since, however long ago that was, so
+   * `refreshTags` waits for the refresh, and the runtime waits for it before
+   * a page render starts ({@link catchUp}).
+   *
+   * From when it settled, not when it started, so a slow query the runtime
+   * waited for before the render does not leave the instance behind inside
+   * it. A failed one counts too, so one request does not wait for two: the
+   * same "assume the entry is valid" a failed read answers with, until the
+   * next refresh, at most the interval and the grace later.
+   */
+  get behind() {
+    return this.log !== void 0 && // `0` asks before every check, so every check waits for the answer.
+    (this.refreshIntervalMs === 0 || this.overdue(this.settledAt));
+  }
+  /**
+   * {@link behind}, as `refreshTags` asks it: never inside a page's render
+   * {@link catchUp} caught up, since the runtime settled it for that request
+   * before the render started, and a wait inside a `'use cache'` lookup is
+   * what it settled it to avoid - a render crossing the line partway through
+   * would otherwise wait after all. So a revalidation elsewhere can go unseen
+   * for a render's duration on top of the usual window.
+   *
+   * A route handler, which no catch-up precedes, waits at the plain line.
+   */
+  get behindInRender() {
+    return this.refreshIntervalMs !== 0 && this.caughtUpRender.getStore() ? false : this.behind;
+  }
+  /**
+   * Whether a registered store ({@link judgeEntriesOf}) holds any entry: one
+   * a refresh could expire. With none there is nothing to wait for even when
+   * the instance is {@link behind}, since whatever is stored from here on is
+   * newer than what the log would say - which covers the first `'use cache'`
+   * call of a process, which creates the handler inside the render.
+   */
+  get holdsEntries() {
+    return this.entryStores.some((store) => store.holdsAny());
+  }
+  /**
+   * {@link refresh}, waited for when the instance is {@link behind}. The
+   * runtime calls it before handing a page request to Next.js, outside the
+   * staged render whose static stage a wait inside a `'use cache'` lookup
+   * would cut short. Only for the `'use cache'` handler's entries
+   * ({@link judgeEntriesOf}): the other caches wait for the refresh where they
+   * read anyway. Not with a `refreshIntervalMs` of `0` either, where
+   * `refreshTags` asks again regardless. Then `render`, marked as caught up
+   * for ({@link behindInRender}). Rejects only as `render` does.
+   */
+  async catchUp(render) {
+    const log = (error2) => console.error("Error refreshing cache tags:", error2);
+    if (this.refreshIntervalMs > 0 && this.behind) {
+      if (!this.holdsEntries) {
+        return render();
+      }
+      await this.refresh().catch(log);
+    } else if (this.refreshIntervalMs > 0) {
+      void this.refresh().catch(log);
+    }
+    return this.caughtUpRender.run(true, render);
+  }
+  /** Whether `at` is more than the interval and the grace ago. */
+  overdue(at) {
+    return this.clock() - at > this.refreshIntervalMs + TAG_REFRESH_GRACE_MS;
+  }
   /**
    * Catch up on revalidations other instances ran, at most once per
    * `refreshIntervalMs`. See {@link TrackedTagMarkers} for the cost.
@@ -74587,6 +74811,9 @@ var TrackedTagMarkers = class {
       return;
     }
     if (this.refreshing) {
+      if (this.behind && this.pausedSinceRefreshStarted()) {
+        return this.refreshing.then(() => this.refresh());
+      }
       return this.refreshing;
     }
     const at = this.clock();
@@ -74594,14 +74821,47 @@ var TrackedTagMarkers = class {
       return;
     }
     this.lastRefresh = at;
-    if (this.tags.size === 0) {
+    if (this.tags.size === 0 && this.entryStores.length === 0) {
       return;
     }
+    this.startTicking();
     this.refreshing = this.sync(at, log).finally(() => {
+      this.settledAt = Math.max(
+        this.settledAt,
+        this.pausedSinceRefreshStarted() ? this.lastRefresh : this.clock()
+      );
+      this.stopTicking();
       this.refreshing = void 0;
     });
     return this.refreshing;
   }
+  startTicking() {
+    if (!this.canFreeze) {
+      return;
+    }
+    this.lastTick = this.clock();
+    this.pausedWhileRefreshing = false;
+    this.ticker = setInterval(() => {
+      const at = this.clock();
+      if (at - this.lastTick > REFRESH_PAUSE_MS) {
+        this.pausedWhileRefreshing = true;
+      }
+      this.lastTick = at;
+    }, REFRESH_TICK_MS);
+    this.ticker.unref?.();
+  }
+  stopTicking() {
+    clearInterval(this.ticker);
+    this.ticker = void 0;
+  }
+  /**
+   * Whether the process was paused since {@link refreshing} started: a tick
+   * came late, or the next one is overdue (after a thaw, a request can run
+   * before the timer does).
+   */
+  pausedSinceRefreshStarted() {
+    return this.canFreeze && (this.pausedWhileRefreshing || this.clock() - this.lastTick > REFRESH_PAUSE_MS);
+  }
   /**
    * Record a revalidation of `tags`: here at once, and in the revalidation
    * table for every other instance - the marker row plus a log row per tag.
@@ -74634,7 +74894,7 @@ var TrackedTagMarkers = class {
     const at = markerClock();
     let state2 = "fresh";
     for (const tag of tags) {
-      const marker = this.get(tag);
+      const marker = this.knownMarker(tag);
       if (!marker) {
         continue;
       }
@@ -74658,7 +74918,7 @@ var TrackedTagMarkers = class {
     const at = markerClock();
     let latest = 0;
     for (const tag of tags) {
-      const marker = this.get(tag);
+      const marker = this.knownMarker(tag);
       if (!marker) {
         continue;
       }
@@ -74745,13 +75005,14 @@ var TrackedTagMarkers = class {
       );
       return;
     }
-    const [result] = await Promise.all([
-      log.query(this.cursor).catch((error2) => {
-        console.error("Error reading tag revalidation log:", error2);
-        return void 0;
-      }),
-      this.readInto(this.due(at))
-    ]);
+    const due = this.due(at);
+    if (due.length > 0) {
+      void this.startRead(due);
+    }
+    const result = await log.query(this.cursor).catch((error2) => {
+      console.error("Error reading tag revalidation log:", error2);
+      return void 0;
+    });
     if (!result) {
       return;
     }
@@ -74762,6 +75023,11 @@ var TrackedTagMarkers = class {
       );
       return;
     }
+    const scan = at - this.lastEntryScan > ENTRY_SCAN_INTERVAL_MS;
+    if (scan) {
+      this.lastEntryScan = at;
+    }
+    const oldest = this.oldestEntry(scan);
     let applied = 0;
     for (const row of result.rows) {
       if (this.applied.has(row.sk)) {
@@ -74776,11 +75042,20 @@ var TrackedTagMarkers = class {
           mergeMarkers(this.pendingRows.get(row.tag), row.marker)
         );
       } else {
+        this.rememberLogged(
+          row.tag,
+          mergeMarkers(this.logOnly.get(row.tag), row.marker),
+          oldest
+        );
         continue;
       }
       this.applied.set(row.sk, row.at);
       applied++;
     }
+    if (oldest > this.prunedAgainst) {
+      this.pruneLogged(oldest);
+    }
+    this.prunedAgainst = oldest;
     this.lastLogRead = at;
     this.advance(at - REVALIDATION_LOG_LOOKBACK_MS);
     this.debug(
@@ -74796,14 +75071,16 @@ var TrackedTagMarkers = class {
     const due = [];
     for (const tag of this.unread) {
       if (due.length >= BATCH_GET_MAX_KEYS) return due;
-      due.push(tag);
+      if (!this.reading.has(tag)) {
+        due.push(tag);
+      }
     }
     const jitter = this.resyncIntervalMs * TAG_RESYNC_JITTER;
     for (const [tag, dueAt] of this.dueAt) {
       if (due.length >= BATCH_GET_MAX_KEYS || dueAt - jitter > at) {
         break;
       }
-      if (dueAt <= at && !this.unread.has(tag)) {
+      if (dueAt <= at && !this.unread.has(tag) && !this.reading.has(tag)) {
         due.push(tag);
       }
     }
@@ -74816,10 +75093,19 @@ var TrackedTagMarkers = class {
    */
   forget(at, why) {
     this.debug(`forgetting ${this.tags.size} tracked tags: ${why}`);
+    this.forgotten++;
+    for (const marker of this.tags.values()) {
+      this.raiseFloor(marker);
+    }
+    for (const marker of this.logOnly.values()) {
+      this.raiseFloor(marker);
+    }
     this.tags.clear();
     this.dueAt.clear();
     this.unread.clear();
     this.applied.clear();
+    this.logOnly.clear();
+    this.floor = Math.max(this.floor, markerClock());
     this.cursor = at - REVALIDATION_LOG_LOOKBACK_MS;
     this.lastLogRead = at;
   }
@@ -74845,13 +75131,17 @@ var TrackedTagMarkers = class {
    * always answered with, rather than a read on every request while DynamoDB
    * is unavailable.
    */
-  async readInto(tags) {
+  async readInto(tags, again = false) {
     if (tags.length === 0) {
       return true;
     }
     const at = this.clock();
+    const forgotten = this.forgotten;
     try {
       const read = await this.markers.read(tags);
+      if (this.forgotten !== forgotten && !again) {
+        return await this.readInto(tags, true);
+      }
       for (const tag of tags) {
         this.unread.delete(tag);
         this.remember(
@@ -74867,6 +75157,9 @@ var TrackedTagMarkers = class {
       return true;
     } catch (error2) {
       console.error("Error reading tag markers:", error2);
+      if (this.forgotten !== forgotten && !again) {
+        return this.readInto(tags, true);
+      }
       this.trackUnread(tags);
       for (const tag of tags) {
         this.unread.add(tag);
@@ -74880,8 +75173,119 @@ var TrackedTagMarkers = class {
   }
   takePendingRows(tag) {
     const pending = this.pendingRows.get(tag);
+    const logged = this.logOnly.get(tag);
     this.pendingRows.delete(tag);
-    return pending;
+    this.logOnly.delete(tag);
+    return logged ? mergeMarkers(logged, pending) : pending;
+  }
+  /**
+   * What this instance knows of `tag`: tracked, or from the log alone -
+   * including rows that arrived while its first read is in flight.
+   */
+  knownMarker(tag) {
+    const tracked = this.tags.get(tag);
+    if (tracked) {
+      return tracked;
+    }
+    const logged = this.logOnly.get(tag);
+    const pending = this.pendingRows.get(tag);
+    return logged || pending ? mergeMarkers(logged, pending) : void 0;
+  }
+  /**
+   * Keep `tag`'s log rows in `logOnly`, unless they cannot apply to an entry
+   * held, `oldest` or newer (see {@link pruneLogged}), as bounded as the
+   * tracked tags. Either way a row let go of takes what it knew with it, so
+   * `completeSince` moves past it.
+   */
+  rememberLogged(tag, marker, oldest) {
+    this.logOnly.delete(tag);
+    if (knownBy(marker, markerClock()) <= oldest) {
+      this.raiseFloor(marker);
+      return;
+    }
+    this.logOnly.set(tag, marker);
+    for (const [first, dropped] of this.logOnly) {
+      if (this.logOnly.size <= this.maxTrackedTags) {
+        break;
+      }
+      this.logOnly.delete(first);
+      this.raiseFloor(dropped);
+    }
+  }
+  /**
+   * Drop the `logOnly` rows that cannot apply to an entry held, `oldest` or
+   * newer: every revalidation they name so far is no later than it. That
+   * moves `completeSince` no further than `oldest`, which costs the entries
+   * held nothing, and a profile's `expiredAt` still to come waits in
+   * `laterFloors`. Without this, a deployment revalidating many distinct tags
+   * filled `logOnly` with tags no entry here carries, and the evictions past
+   * its bound kept moving `completeSince` up to the present.
+   */
+  pruneLogged(oldest) {
+    const at = markerClock();
+    for (const [tag, marker] of this.logOnly) {
+      if (knownBy(marker, at) <= oldest) {
+        this.logOnly.delete(tag);
+        this.raiseFloor(marker);
+      }
+    }
+  }
+  /**
+   * The oldest entry timestamp of any registered store, `Infinity` with none:
+   * early, never late, unless `scan`.
+   */
+  oldestEntry(scan) {
+    let oldest = Infinity;
+    for (const { oldestTimestamp } of this.entryStores) {
+      oldest = Math.min(oldest, oldestTimestamp(scan));
+    }
+    return oldest;
+  }
+  /**
+   * Move `completeSince` past `marker`'s revalidations: what is no longer
+   * known about a tag once its marker is dropped. A future `expiredAt` waits
+   * in `laterFloors` until it is past.
+   */
+  raiseFloor(marker) {
+    const at = markerClock();
+    this.floor = Math.max(this.floor, knownBy(marker, at));
+    const { expiredAt } = marker;
+    if (expiredAt !== void 0 && expiredAt > Math.max(at, this.floor)) {
+      this.laterFloor(expiredAt);
+    }
+  }
+  /**
+   * Add `time` to `laterFloors`, in order. Past the tracked-tag bound the two
+   * spans closest together are merged: from the first's start,
+   * `completeSince` is the second's end, early - which only costs reads, and
+   * for as short a time as any merge allows. Never later than its time, which
+   * would let an entry expire unseen.
+   */
+  laterFloor(time2) {
+    const floors = this.laterFloors;
+    let low = 0;
+    let high = floors.length;
+    while (low < high) {
+      const mid = Math.floor((low + high) / 2);
+      if (floors[mid][0] < time2) {
+        low = mid + 1;
+      } else {
+        high = mid;
+      }
+    }
+    if (low > 0 && floors[low - 1][1] >= time2 || floors[low]?.[0] === time2) {
+      return;
+    }
+    floors.splice(low, 0, [time2, time2]);
+    if (floors.length > this.maxTrackedTags) {
+      let merge2 = 0;
+      for (let i5 = 1; i5 < floors.length - 1; i5++) {
+        if (floors[i5 + 1][1] - floors[i5][0] < floors[merge2 + 1][1] - floors[merge2][0]) {
+          merge2 = i5;
+        }
+      }
+      floors.splice(merge2, 2, [floors[merge2][0], floors[merge2 + 1][1]]);
+    }
   }
   /** Record that `tag`'s marker was known from the table at `at`. */
   known(tag, at) {
@@ -74898,6 +75302,7 @@ var TrackedTagMarkers = class {
       if (this.tags.size <= this.maxTrackedTags) {
         break;
       }
+      this.raiseFloor(this.tags.get(oldest));
       this.tags.delete(oldest);
       this.dueAt.delete(oldest);
       this.unread.delete(oldest);
@@ -74910,7 +75315,18 @@ var TrackedTagMarkers = class {
     }
   }
 };
+function knownBy(marker, at) {
+  const { revalidatedAt, staleAt, expiredAt } = marker;
+  return Math.max(
+    revalidatedAt ?? -Infinity,
+    staleAt ?? -Infinity,
+    expiredAt !== void 0 && expiredAt <= at ? expiredAt : -Infinity
+  );
+}
 var MAX_LOG_PUT_MS = REVALIDATION_LOG_LOOKBACK_MS / 2;
+var ENTRY_SCAN_INTERVAL_MS = 6e4;
+var REFRESH_TICK_MS = 250;
+var REFRESH_PAUSE_MS = 1e3;
 function mergeMarkers(local, remote) {
   if (!local) {
     return remote ?? {};
@@ -74973,6 +75389,13 @@ var CacheBucket = class {
 // src/adapter/use-cache-common.ts
 var import_client_dynamodb2 = __toESM(require_dist_cjs19());
 var import_debug6 = __toESM(require_src());
+
+// src/runtime/tag-manifest.ts
+var TAG_MANIFEST_SYMBOL = /* @__PURE__ */ Symbol.for(
+  "cdk-nextjs.use-cache.tag-manifest"
+);
+
+// src/adapter/use-cache-common.ts
 function isBuildPhase() {
   return process.env.NEXT_PHASE === "phase-production-build";
 }
@@ -74982,7 +75405,7 @@ function numberFromEnv(name, fallback2) {
   return Number.isFinite(value) && value >= 0 ? value : fallback2;
 }
 var DEFAULT_MEMORY_BYTES = 50 * 1024 * 1024;
-var TAG_MANIFEST_SYMBOL = /* @__PURE__ */ Symbol.for("cdk-nextjs.use-cache.tag-manifest");
+var TAG_TABLE_REQUEST_TIMEOUT_MS = 3e3;
 function sharedTagManifest() {
   const global = globalThis;
   if (!global[TAG_MANIFEST_SYMBOL]) {
@@ -74992,12 +75415,24 @@ function sharedTagManifest() {
       DEFAULT_TAG_REFRESH_MS
     );
     if (config.tableName && !isBuildPhase()) {
-      const client = new import_client_dynamodb2.DynamoDBClient({ region: config.region });
+      const client = new import_client_dynamodb2.DynamoDBClient({
+        region: config.region,
+        // Without `throwOnRequestTimeout` the timeout only logs a warning. It
+        // ends once the response headers arrive: `socketTimeout`, an
+        // inactivity timer kept until the request closes, covers the body.
+        requestHandler: {
+          requestTimeout: TAG_TABLE_REQUEST_TIMEOUT_MS,
+          throwOnRequestTimeout: true,
+          socketTimeout: TAG_TABLE_REQUEST_TIMEOUT_MS
+        }
+      });
       global[TAG_MANIFEST_SYMBOL] = new TrackedTagMarkers({
         markers: new TagMarkerTable(client, config.tableName, config.buildId),
         log: new RevalidationLog(client, config.tableName, config.buildId),
         refreshIntervalMs,
-        debug: (0, import_debug6.default)("cdk-nextjs:cache-handler:tags")
+        debug: (0, import_debug6.default)("cdk-nextjs:cache-handler:tags"),
+        // Set in every Lambda runtime; a container is never frozen.
+        canFreeze: process.env.AWS_LAMBDA_FUNCTION_NAME !== void 0
       });
     } else {
       if (!isBuildPhase()) {
@@ -75353,8 +75788,8 @@ var S3CacheHandler = class {
       if (!this.config.bucketName) {
         return null;
       }
-      const s3Key = this.buildS3Key(cacheKey);
-      const response = await this.bucket.get(s3Key);
+      const objectKey = s3ObjectKey(this.config.buildId, cacheKey);
+      const response = await this.bucket.get(objectKey);
       if (!response) {
         this.debug(`S3 CACHE MISS: ${cacheKey}`);
         return null;
@@ -75364,7 +75799,7 @@ var S3CacheHandler = class {
         this.debug(`S3 CACHE INVALIDATED BY TAG: ${cacheKey}`);
         return isFetchCacheGet(ctx) ? null : { lastModified: EXPIRED_LAST_MODIFIED, value: parsedValue.value };
       }
-      this.debug(`S3 CACHE HIT: ${cacheKey} (${s3Key})`);
+      this.debug(`S3 CACHE HIT: ${cacheKey} (${objectKey})`);
       return {
         lastModified: parsedValue.lastModified,
         value: parsedValue.value
@@ -75436,6 +75871,8 @@ var S3CacheHandler = class {
     this.softRevalidatedKeys.add(cacheKey);
   }
   async set(cacheKey, data, ctx) {
+    const s3Key = buildS3Key(this.config.buildId, cacheKey);
+    const objectKey = s3ObjectKey(this.config.buildId, cacheKey);
     try {
       if (!data) {
         this.debug(`S3 CACHE DELETE: ${cacheKey}`);
@@ -75443,16 +75880,15 @@ var S3CacheHandler = class {
           return;
         }
         this.softRevalidatedKeys.delete(cacheKey);
-        const s3Key2 = this.buildS3Key(cacheKey);
-        const tags2 = await this.storedEntryTags(s3Key2, ctx);
+        const tags2 = await this.storedEntryTags(objectKey, ctx);
         await this.s3Client.send(
           new import_client_s32.DeleteObjectCommand({
             Bucket: this.config.bucketName,
-            Key: s3Key2
+            Key: objectKey
           })
         );
-        this.debug(`S3 CACHE DELETED: ${s3Key2}`);
-        await this.deleteDynamoDBTagMappings(s3Key2, tags2);
+        this.debug(`S3 CACHE DELETED: ${objectKey}`);
+        await this.deleteDynamoDBTagMappings(s3Key, tags2);
         return;
       }
       const tags = entryTags({ tags: getTags(ctx), value: data });
@@ -75462,7 +75898,6 @@ var S3CacheHandler = class {
       if (!this.config.bucketName) {
         return;
       }
-      const s3Key = this.buildS3Key(cacheKey);
       const cacheHandlerValue = {
         // On the marker clock, since that is what it is compared with.
         lastModified: markerClock(),
@@ -75473,7 +75908,7 @@ var S3CacheHandler = class {
         tags
       };
       const body = serializeCacheValue(cacheEntryWithTags);
-      await this.bucket.putJson(s3Key, body);
+      await this.bucket.putJson(objectKey, body);
       this.debug(`S3 CACHE STORED: ${cacheKey} (${data.kind})`);
       if (this.softRevalidatedKeys.delete(cacheKey)) {
         const route = this.s3KeyToInvalidationPath(s3Key);
@@ -75531,17 +75966,19 @@ var S3CacheHandler = class {
    * {@link MAX_TAG_QUERY_PAGES}, or no build tag manifest to read.
    */
   async tagRoutes(tag) {
+    const skPrefix = this.tagMappingPrefix(tag);
     const [{ items, truncated }, buildTags] = await Promise.all([
-      this.queryTagMappings(tag),
+      this.queryTagMappings(tag, skPrefix),
       this.buildTagManifest()
     ]);
-    const prefixLength = tag.length + 1;
+    const prefixLength = skPrefix.length;
     const keyPrefix = this.config.buildId ? `${this.config.buildId}/` : "";
-    const s3Keys = items.map((item) => item.sk?.S?.slice(prefixLength)).filter(
-      (s3Key) => Boolean(s3Key && s3Key.startsWith(keyPrefix))
-    );
+    const s3Keys = items.flatMap((item) => {
+      const rest = item.sk?.S?.slice(prefixLength);
+      return rest && rest.startsWith(keyPrefix) ? [item.s3Key?.S ?? rest] : [];
+    });
     for (const cacheKey of buildTags?.get(tag) ?? []) {
-      s3Keys.push(this.buildS3Key(cacheKey));
+      s3Keys.push(buildS3Key(this.config.buildId, cacheKey));
     }
     this.debug(
       `TAG ${tag}: Found ${s3Keys.length} cache entries to invalidate`
@@ -75566,7 +76003,8 @@ var S3CacheHandler = class {
     });
   }
   /**
-   * Every mapping row for `tag`, following `LastEvaluatedKey`, and whether
+   * Every mapping row for `tag` - those whose sort key starts with
+   * `skPrefix`, its {@link tagMappingPrefix} - following `LastEvaluatedKey`, and whether
    * {@link MAX_TAG_QUERY_PAGES} cut the walk short.
    *
    * DynamoDB caps a Query at 1 MB of items regardless of how many match, and
@@ -75575,7 +76013,7 @@ var S3CacheHandler = class {
    * first page invalidates only that page's entries while still reporting
    * success, which is indistinguishable from revalidation having worked.
    */
-  async queryTagMappings(tag) {
+  async queryTagMappings(tag, skPrefix) {
     const items = [];
     let exclusiveStartKey;
     let pages = 0;
@@ -75586,7 +76024,7 @@ var S3CacheHandler = class {
           KeyConditionExpression: "pk = :pk AND begins_with(sk, :skPrefix)",
           ExpressionAttributeValues: {
             ":pk": { S: this.config.buildId },
-            ":skPrefix": { S: `${tag}#` }
+            ":skPrefix": { S: skPrefix }
           },
           ExclusiveStartKey: exclusiveStartKey
         })
@@ -75622,6 +76060,10 @@ var S3CacheHandler = class {
     if (withoutSuffix.includes("[") || isFetchCacheKey(withoutSuffix)) {
       return void 0;
     }
+    const routeCacheKey = ROUTE_CACHE_KEY_PREFIX.exec(withoutSuffix);
+    if (routeCacheKey) {
+      return denormalizePagePath(withoutSuffix.slice(routeCacheKey[0].length));
+    }
     return withoutSuffix === "index" ? "/" : `/${withoutSuffix}`;
   }
   /**
@@ -75728,19 +76170,37 @@ var S3CacheHandler = class {
       this.cloudFrontConfig.distributionId || this.cloudFrontConfig.distributionIdParameterName
     );
   }
-  /** `{buildId}/{cacheKey}.json`; see {@link buildS3Key}. */
-  buildS3Key(cacheKey) {
-    return buildS3Key(this.config.buildId, cacheKey);
+  /**
+   * The sort key of `tag`'s mapping row for `s3Key`: `<prefix>s3Key`, or, when
+   * that passes DynamoDB's 1024-byte sort key limit, `<prefix><buildId>/#<sha256>`.
+   * Either way the row carries the key itself in `s3Key`. next 16.3.8's
+   * route-scoped keys are ~88 bytes longer than a pathname, enough to push a
+   * long tag on a long path over - and a rejected `PutItem` left
+   * `revalidateTag` nothing to invalidate, so CloudFront kept the stale page.
+   * The prefix is {@link tagMappingPrefix}'s, which {@link MAX_TAG_BYTES} and
+   * the build ID's cap leave room for the hashed form after.
+   */
+  tagMappingSortKey(tag, s3Key) {
+    const prefix = this.tagMappingPrefix(tag);
+    const sk = `${prefix}${s3Key}`;
+    return Buffer.byteLength(sk) <= MAX_SORT_KEY_BYTES ? sk : `${prefix}${this.config.buildId}/${hashedTag(s3Key)}`;
+  }
+  /**
+   * What every mapping row of `tag` starts with, and so what
+   * {@link queryTagMappings} matches: `<sortKeyTag(tag)>#`.
+   */
+  tagMappingPrefix(tag) {
+    return `${sortKeyTag(tag)}#`;
   }
   async storeDynamoDBTagMappings(s3Key, tags) {
     try {
       const updatePromises = tags.map(async (tag) => {
-        const tagCacheKey = `${tag}#${s3Key}`;
+        const sk = this.tagMappingSortKey(tag, s3Key);
         const updateCommand = new import_client_dynamodb3.UpdateItemCommand({
           TableName: this.config.tableName,
           Key: {
             pk: { S: this.config.buildId },
-            sk: { S: tagCacheKey }
+            sk: { S: sk }
           },
           // Deliberately no `revalidatedAt`: a mapping row records only that an
           // entry carries the tag. Stamping it at write time made every tagged
@@ -75748,9 +76208,10 @@ var S3CacheHandler = class {
           // row's timestamp is taken after the entry's `lastModified` — so
           // `checkIfRevalidated` deleted healthy entries and the page
           // re-rendered on every request.
-          UpdateExpression: "SET createdAt = if_not_exists(createdAt, :now)",
+          UpdateExpression: "SET createdAt = if_not_exists(createdAt, :now), s3Key = :s3Key",
           ExpressionAttributeValues: {
-            ":now": { N: Date.now().toString() }
+            ":now": { N: Date.now().toString() },
+            ":s3Key": { S: s3Key }
           }
         });
         await this.dynamoClient.send(updateCommand);
@@ -75799,7 +76260,7 @@ var S3CacheHandler = class {
               TableName: this.config.tableName,
               Key: {
                 pk: { S: this.config.buildId },
-                sk: { S: `${tag}#${s3Key}` }
+                sk: { S: this.tagMappingSortKey(tag, s3Key) }
               }
             })
           );