@thomas.f/prnext 0.1.0-alpha.1

package/native/resolve.mjs

@@ -0,0 +1,81 @@
+import { readFileSync, realpathSync } from 'node:fs';
+import { access, stat } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { createRequire } from 'node:module';
+import { fileURLToPath, pathToFileURL } from 'node:url';
+import path from 'node:path';
+
+export const packageRoot = fileURLToPath(new URL('../', import.meta.url));
+export const packageManifest = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+export const platforms = JSON.parse(readFileSync(new URL('./platforms.json', import.meta.url), 'utf8'));
+
+// A dependency installed in node_modules must never mistake its consumer for
+// the framework checkout, even if that consumer also has a Cargo workspace.
+export function sourceCheckout(root = packageRoot) {
+  try {
+    const repository = path.resolve(root, '../..');
+    const manifest = JSON.parse(readFileSync(path.join(repository, 'package.json'), 'utf8'));
+    if (manifest.name !== 'prnext-monorepo' || manifest.private !== true) return null;
+    if (realpathSync(root) !== realpathSync(path.join(repository, 'packages/prnext'))) return null;
+    readFileSync(path.join(repository, 'crates/prnext/Cargo.toml'));
+    return repository;
+  } catch { return null; }
+}
+
+export function nativePlatform({ platform = process.platform, arch = process.arch, libc } = {}) {
+  if (platform === 'linux' && libc === undefined) {
+    libc = process.report?.getReport().header.glibcVersionRuntime ? 'glibc' : 'musl';
+  }
+  const result = platforms.find(item => item.os === platform && item.cpu === arch && (!item.libc || item.libc === libc));
+  if (!result) throw new Error(`PRNext has no prebuilt server for ${platform}/${arch}${libc ? `/${libc}` : ''}. This alpha provides macOS arm64/x64 and Linux glibc arm64/x64. Use a supported system (WSL on Windows), or set PRNEXT_BINARY to your own compatible build.`);
+  return result;
+}
+
+async function executableFile(file) {
+  const info = await stat(file);
+  if (!info.isFile()) throw new Error(`Native executable is not a file: ${file}`);
+  await access(file, process.platform === 'win32' ? constants.F_OK : constants.X_OK);
+  return file;
+}
+
+let compiling;
+export async function resolveNativeBinary({ env = process.env, root = packageRoot, allowBuild = true, platform } = {}) {
+  if (env.PRNEXT_BINARY) {
+    const file = path.resolve(env.PRNEXT_BINARY);
+    try { return await executableFile(file); }
+    catch (cause) { throw new Error(`PRNEXT_BINARY is not an executable file: ${file}`, { cause }); }
+  }
+  const checkout = sourceCheckout(root);
+  if (checkout) {
+    const binary = path.join(checkout, 'target/release', process.platform === 'win32' ? 'prnext.exe' : 'prnext');
+    try { return await executableFile(binary); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    if (!allowBuild) throw new Error('Native server missing from this checkout. Run npm run build:native.');
+    compiling ||= (async () => {
+      const { cargo } = await import(pathToFileURL(path.join(checkout, 'scripts/cargo.mjs')).href);
+      console.error('Compiling native PRNext server for this source checkout…');
+      await new Promise((resolve, reject) => {
+        const child = cargo(['build', '--release', '--locked']);
+        child.once('error', reject);
+        child.once('exit', (code, signal) => code === 0 ? resolve() : reject(new Error(`Native build failed (${signal || code}).`)));
+      });
+    })().finally(() => { compiling = undefined; });
+    await compiling;
+    return executableFile(binary);
+  }
+  const target = nativePlatform(platform);
+  const manifest = root === packageRoot ? packageManifest : JSON.parse(readFileSync(path.join(root, 'package.json'), 'utf8'));
+  const require = createRequire(path.join(root, 'package.json'));
+  let nativeManifestFile;
+  try { nativeManifestFile = require.resolve(`${target.package}/package.json`); }
+  catch (cause) {
+    throw new Error(`Missing PRNext native package ${target.package}@${manifest.version}. Reinstall with optional dependencies enabled (npm install --include=optional), or install ${target.package}@${manifest.version} explicitly. Do not copy node_modules between operating systems.`, { cause });
+  }
+  const native = JSON.parse(readFileSync(nativeManifestFile, 'utf8'));
+  if (native.name !== target.package || native.version !== manifest.version) {
+    throw new Error(`PRNext native version mismatch: expected ${target.package}@${manifest.version}, found ${native.name}@${native.version}. Reinstall matching versions.`);
+  }
+  const binary = path.join(path.dirname(nativeManifestFile), 'bin', 'prnext');
+  try { return await executableFile(binary); }
+  catch (cause) { throw new Error(`PRNext native executable is missing or not executable in ${target.package}. Reinstall the package.`, { cause }); }
+}

package/package.json

@@ -0,0 +1,127 @@
+{
+  "name": "@thomas.f/prnext",
+  "version": "0.1.0-alpha.1",
+  "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
+  "homepage": "https://prnext.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Lorkydey/PRNext.git",
+    "directory": "packages/prnext"
+  },
+  "bugs": {
+    "url": "https://github.com/Lorkydey/PRNext/issues",
+    "email": "contact@heythomas.dev"
+  },
+  "author": {
+    "name": "Thomas",
+    "url": "https://github.com/Lorkydey"
+  },
+  "keywords": ["prnext", "nextjs", "react", "rust", "framework", "ssr", "server-components"],
+  "type": "module",
+  "publishConfig": {
+    "access": "public",
+    "tag": "alpha",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "files": ["cli.mjs", "index.mjs", "build/", "runtime/", "compat/", "native/", "release/"],
+  "scripts": {
+    "prepublishOnly": "node release/verify.mjs"
+  },
+  "bin": {
+    "prnext": "./cli.mjs",
+    "prn": "./cli.mjs"
+  },
+  "exports": {
+    "./package.json": "./package.json",
+    "./og": {
+      "types": "./compat/og.d.cts",
+      "default": "./compat/og.cjs"
+    },
+    "./font/local": {
+      "types": "./compat/font-local.d.cts",
+      "default": "./compat/font-local.cjs"
+    },
+    "./font/google": {
+      "types": "./compat/font-google.d.cts",
+      "default": "./compat/font-google.cjs"
+    },
+    ".": {
+      "types": "./compat/index.d.ts",
+      "default": "./index.mjs"
+    },
+    "./link": "./compat/link.cjs",
+    "./head": "./compat/head.cjs",
+    "./script": {
+      "types": "./compat/script.d.cts",
+      "default": "./compat/script.cjs"
+    },
+    "./app": {
+      "types": "./compat/app.d.cts",
+      "default": "./compat/app.cjs"
+    },
+    "./document": {
+      "types": "./compat/document.d.cts",
+      "default": "./compat/document.cjs"
+    },
+    "./error": {
+      "types": "./compat/error.d.cts",
+      "default": "./compat/error.cjs"
+    },
+    "./dynamic": {
+      "types": "./compat/dynamic.d.cts",
+      "default": "./compat/dynamic.cjs"
+    },
+    "./image": {
+      "types": "./compat/image.d.cts",
+      "default": "./compat/image.cjs"
+    },
+    "./router": "./compat/router.cjs",
+    "./compat/router": {
+      "types": "./compat/compat/router.d.cts",
+      "default": "./compat/compat-router.cjs"
+    },
+    "./navigation": "./compat/navigation.cjs",
+    "./headers": "./compat/headers.cjs",
+    "./server": "./compat/server.cjs",
+    "./cache": "./compat/cache.cjs",
+    "./constants": "./compat/constants.cjs"
+  },
+  "dependencies": {
+    "@babel/core": "7.29.7",
+    "@babel/generator": "^7.29.0",
+    "@babel/parser": "^7.29.0",
+    "@babel/traverse": "^7.29.0",
+    "@babel/types": "^7.29.0",
+    "@edge-runtime/vm": "5.0.0",
+    "@vercel/nft": "1.11.0",
+    "@vercel/og": "1.0.3",
+    "dotenv": "16.6.1",
+    "dotenv-expand": "11.0.7",
+    "esbuild": "^0.28.2",
+    "fontkit": "2.0.4",
+    "loader-runner": "4.3.2",
+    "path-to-regexp": "6.3.0",
+    "picomatch": "4.0.7",
+    "postcss": "8.5.28",
+    "postcss-flexbugs-fixes": "5.0.2",
+    "postcss-preset-env": "11.5.3",
+    "postcss-value-parser": "4.2.0",
+    "react-refresh": "0.19.0",
+    "schema-utils": "4.3.3",
+    "webpack": "5.111.1"
+  },
+  "peerDependencies": {
+    "react": "19.3.0",
+    "react-dom": "19.3.0",
+    "react-server-dom-webpack": "19.3.0"
+  },
+  "optionalDependencies": {
+    "prnext-darwin-arm64": "0.1.0-alpha.1",
+    "prnext-darwin-x64": "0.1.0-alpha.1",
+    "prnext-linux-arm64-gnu": "0.1.0-alpha.1",
+    "prnext-linux-x64-gnu": "0.1.0-alpha.1"
+  },
+  "engines": {
+    "node": ">=22"
+  }
+}

package/release/verify.mjs

@@ -0,0 +1,59 @@
+import { readFile, access } from 'node:fs/promises';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { packageRoot, packageManifest, platforms, sourceCheckout } from '../native/resolve.mjs';
+
+export async function verifyPackage() {
+  const pkg = packageManifest;
+  if (pkg.private === true) throw new Error(`${pkg.name} is marked private.`);
+  if (!/^\d+\.\d+\.\d+-alpha\.\d+$/.test(pkg.version)) throw new Error('This release workflow requires an explicit x.y.z-alpha.N version.');
+  if (pkg.publishConfig?.tag !== 'alpha' || pkg.publishConfig?.access !== 'public') throw new Error('Alpha releases require publishConfig.tag=alpha and access=public.');
+  if (pkg.bin?.prn !== './cli.mjs' || pkg.bin?.prnext !== './cli.mjs') throw new Error('Both prn and prnext must point to cli.mjs.');
+  const expected = Object.fromEntries(platforms.map(item => [item.package, pkg.version]));
+  if (JSON.stringify(Object.entries(pkg.optionalDependencies || {}).sort()) !== JSON.stringify(Object.entries(expected).sort())) throw new Error('All native optional dependencies must match the framework version and platform manifest exactly.');
+  for (const [name, value] of Object.entries({ ...pkg.dependencies, ...pkg.peerDependencies })) {
+    if (/^(?:file:|link:|portal:|workspace:|\.|\/)/.test(value)) throw new Error(`Local dependency cannot be published: ${name}=${value}`);
+  }
+  const rsc = pkg.peerDependencies['react-server-dom-webpack'];
+  if (pkg.peerDependencies.react !== rsc || pkg.peerDependencies['react-dom'] !== rsc) throw new Error('React, React DOM and the RSC runtime must have the same exact version.');
+  async function exported(value) {
+    if (typeof value === 'string') { await access(path.join(packageRoot, value)); return; }
+    for (const target of Object.values(value)) await exported(target);
+  }
+  await exported(pkg.exports);
+  await access(path.join(packageRoot, 'runtime/profiles.json'));
+  const source = sourceCheckout();
+  if (source) {
+    const cargo = await readFile(path.join(source, 'crates/prnext/Cargo.toml'), 'utf8');
+    if (!cargo.includes(`version = "${pkg.version}"`)) throw new Error('Cargo and npm versions differ. Update crates/prnext/Cargo.toml and Cargo.lock before building release binaries.');
+  }
+}
+
+export async function verifyPublishedNatives({ registry = 'https://registry.npmjs.org/', fetcher = fetch } = {}) {
+  // A successful npm install may silently omit a failed optional dependency.
+  // Do not release the JS wrapper until every advertised native is available.
+  const problems = [];
+  for (const target of platforms) {
+    try {
+      const url = new URL(`${target.package}/${packageManifest.version}`, registry);
+      const response = await fetcher(url, { signal: AbortSignal.timeout(15_000) });
+      if (!response.ok) throw new Error(`registry returned HTTP ${response.status}`);
+      const pkg = await response.json();
+      if (pkg.name !== target.package || pkg.version !== packageManifest.version || !pkg.dist?.integrity || !pkg.dist?.tarball ||
+          JSON.stringify(pkg.os) !== JSON.stringify([target.os]) || JSON.stringify(pkg.cpu) !== JSON.stringify([target.cpu]) ||
+          (target.libc && JSON.stringify(pkg.libc) !== JSON.stringify([target.libc]))) throw new Error('published metadata does not match the release');
+    } catch (error) { problems.push(`${target.package}@${packageManifest.version}: ${error.message}`); }
+  }
+  if (problems.length) throw new Error(`Publish the native packages first, then publish ${packageManifest.name}:\n${problems.join('\n')}`);
+}
+
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  try {
+    await verifyPackage();
+    if (!process.argv.includes('--local')) {
+      if (process.env.npm_config_tag && process.env.npm_config_tag !== 'alpha') throw new Error('Publish this prerelease with --tag alpha.');
+      await verifyPublishedNatives();
+    }
+    console.log('PRNext release checks passed.');
+  } catch (error) { console.error(error.message); process.exitCode = 1; }
+}

package/runtime/action-client.mjs

@@ -0,0 +1,19 @@
+let referenceFactory;
+let transport;
+
+// App bootstrap installs the official Flight client after its module loader is
+// ready. Action proxy modules load through that same client graph afterwards.
+export function configureServerActions({ createServerReference, callServer }) {
+  referenceFactory = createServerReference;
+  transport = callServer;
+}
+
+export function callServer(id, args) {
+  if (!transport) return Promise.reject(new Error('The PRNext Server Action transport is not initialized'));
+  return transport(id, args);
+}
+
+export function createServerReference(id) {
+  if (!referenceFactory) throw new Error('Server Action references must load after the PRNext Flight client');
+  return referenceFactory(id, callServer);
+}

package/runtime/action-crypto.mjs

@@ -0,0 +1,138 @@
+import { randomBytes, createCipheriv, createDecipheriv } from 'node:crypto';
+import { serialize, deserialize } from 'node:v8';
+import { currentRequest } from '../compat/headers.cjs';
+
+const LIMIT = 16 * 1024 * 1024;
+function key() {
+  const encoded = currentRequest().actionKey;
+  if (typeof encoded !== 'string') throw new Error('Server Action encryption key is unavailable in this request');
+  const value = Buffer.from(encoded, 'base64');
+  if (![16,24,32].includes(value.length)) throw new Error('Invalid Server Action encryption key');
+  return value;
+}
+
+// The graph envelope preserves cycles and rich capture values without confusing
+// user object properties with transport tags. Functions and class instances are
+// rejected instead of being silently reduced to incomplete plain objects.
+async function encodeCaptures(value) {
+  const nodes = [];
+  const seen = new Map();
+  async function encode(value) {
+    if (typeof value === 'symbol') {
+      const name = Symbol.keyFor(value);
+      if (name === undefined) throw new Error('Server Action closures cannot capture a non-global Symbol');
+      return { symbol: name };
+    }
+    const serverReference=typeof value === 'function' && value.$$typeof===Symbol.for('react.server.reference') && typeof value.$$id==='string';
+    if (typeof value === 'function' && !serverReference) throw new Error('Server Action closures cannot capture functions; move helpers to module scope');
+    if (value === null || (typeof value !== 'object' && !serverReference)) return { value };
+    if (seen.has(value)) return { reference: seen.get(value) };
+    const index = nodes.length;
+    seen.set(value, index);
+    const node = {};
+    nodes.push(node);
+    if (value instanceof Promise) {
+      node.type='promise';
+      let result;
+      try { result=await value; } catch(error) { node.rejected=true;result=error; }
+      node.result=await encode(result);
+    }
+    else if (serverReference) { node.type='action'; node.id=value.$$id; node.bound=await encode(await value.$$bound); }
+    else if (Array.isArray(value)) { node.type='array'; node.items=await Promise.all(Array.from(value,encode)); }
+    else if (value instanceof Map) { node.type='map'; node.items=await Promise.all([...value].map(async ([key,value])=>[await encode(key),await encode(value)])); }
+    else if (value instanceof Set) { node.type='set'; node.items=await Promise.all([...value].map(encode)); }
+    else if (typeof Blob !== 'undefined' && value instanceof Blob) {
+      if(value.size>LIMIT) throw new Error('Server Action closure exceeds the 16 MiB limit');
+      node.type='blob'; node.bytes=Buffer.from(await value.arrayBuffer()); node.mime=value.type;
+      if (typeof File !== 'undefined' && value instanceof File) { node.name=value.name; node.lastModified=value.lastModified; }
+    } else if (typeof FormData !== 'undefined' && value instanceof FormData) { node.type='form'; node.items=await Promise.all([...value].map(async ([key,value])=>[key,await encode(value)])); }
+    else if (value instanceof Date || value instanceof Error || value instanceof RegExp || value instanceof ArrayBuffer || ArrayBuffer.isView(value)) { node.type='value'; node.value=value; }
+    else {
+      const prototype = Object.getPrototypeOf(value);
+      if (prototype !== Object.prototype && prototype !== null) throw new Error('Server Action closures can only capture plain objects and supported serializable values');
+      node.type='object'; node.nullPrototype=prototype===null;
+      node.items=await Promise.all(Object.keys(value).map(async name=>[name,await encode(value[name])]));
+      if (Object.getOwnPropertySymbols(value).length) throw new Error('Server Action closures cannot capture objects with symbol keys');
+    }
+    return { reference: index };
+  }
+  return { root: await encode(value), nodes };
+}
+
+async function decodeCaptures(graph) {
+  const actionTargets=[];
+  const promises=[];
+  const values = graph.nodes.map((node,index) => {
+    if (node.type==='action') return function(...args){return actionTargets[index](...args);};
+    if (node.type==='promise') {
+      const promise=new Promise((resolve,reject)=>{promises[index]={resolve,reject};});
+      promise.catch(()=>{});
+      return promise;
+    }
+    if (node.type==='array') return [];
+    if (node.type==='map') return new Map();
+    if (node.type==='set') return new Set();
+    if (node.type==='form') return new FormData();
+    if (node.type==='blob') return node.name === undefined ? new Blob([node.bytes],{type:node.mime}) : new File([node.bytes],node.name,{type:node.mime,lastModified:node.lastModified});
+    if (node.type==='value') return node.value;
+    return node.nullPrototype ? Object.create(null) : {};
+  });
+  const decode = value => Object.hasOwn(value,'reference') ? values[value.reference] : Object.hasOwn(value,'symbol') ? Symbol.for(value.symbol) : value.value;
+  for (let index=0;index<graph.nodes.length;index++) {
+    const node=graph.nodes[index], value=values[index];
+    if (node.type==='promise') promises[index][node.rejected?'reject':'resolve'](decode(node.result));
+    if (node.type==='array') for (const item of node.items) value.push(decode(item));
+    if (node.type==='map') for (const [key,item] of node.items) value.set(decode(key),decode(item));
+    if (node.type==='set') for (const item of node.items) value.add(decode(item));
+    if (node.type==='form') for (const [key,item] of node.items) value.append(key,decode(item));
+    if (node.type==='object') for (const [key,item] of node.items) Object.defineProperty(value,key,{value:decode(item),enumerable:true,configurable:true,writable:true});
+  }
+  if(graph.nodes.some(node=>node.type==='action')) {
+    const {loadActionReference}=await import('./action-reference.mjs');
+    for(let index=0;index<graph.nodes.length;index++) {
+      const node=graph.nodes[index];
+      if(node.type!=='action') continue;
+      const reference=await loadActionReference(node.id,decode(node.bound));
+      actionTargets[index]=reference;
+      for(const property of ['$$typeof','$$id','$$bound','$$location','bind']) {
+        const descriptor=Object.getOwnPropertyDescriptor(reference,property);
+        if(descriptor) Object.defineProperty(values[index],property,descriptor);
+      }
+    }
+  }
+  return decode(graph.root);
+}
+
+export async function encryptBoundArgs(id, captures) {
+  const secret = key();
+  const bytes = serialize(await encodeCaptures(captures));
+  if (bytes.length > LIMIT) throw new Error('Server Action closure exceeds the 16 MiB limit');
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv(`aes-${secret.length*8}-gcm`, secret, nonce);
+  cipher.setAAD(Buffer.from('prnext-server-action:' + id));
+  const ciphertext = Buffer.concat([cipher.update(bytes), cipher.final()]);
+  return 'v1.' + Buffer.concat([nonce,cipher.getAuthTag(),ciphertext]).toString('base64url');
+}
+
+export async function decryptBoundArgs(id, encrypted) {
+  const secret = key();
+  encrypted = await encrypted;
+  try {
+    if (typeof encrypted !== 'string' || !encrypted.startsWith('v1.') || encrypted.length > Math.ceil((LIMIT+28)*4/3)+3 || !/^[A-Za-z0-9_-]+$/.test(encrypted.slice(3))) throw new Error();
+    const bytes = Buffer.from(encrypted.slice(3),'base64url');
+    if (bytes.length < 28) throw new Error();
+    const decipher = createDecipheriv(`aes-${secret.length*8}-gcm`,secret,bytes.subarray(0,12));
+    decipher.setAAD(Buffer.from('prnext-server-action:' + id));
+    decipher.setAuthTag(bytes.subarray(12,28));
+    return await decodeCaptures(deserialize(Buffer.concat([decipher.update(bytes.subarray(28)),decipher.final()])));
+  } catch { throw new Error('Invalid encrypted Server Action closure'); }
+}
+
+export function bindEncryptedReference(reference, id, capture) {
+  let bound;
+  Object.defineProperty(reference,'$$bound',{configurable:true,get(){
+    if (!bound) bound=[encryptBoundArgs(id,capture())];
+    return bound;
+  }});
+  return reference;
+}

package/runtime/action-reference.mjs

@@ -0,0 +1,2 @@
+// Loaded lazily by closure decryption, after the RSC action registry exists.
+export { loadActionReference } from './action-server.mjs';

package/runtime/action-server.mjs

@@ -0,0 +1,161 @@
+import { decodeReply, decodeAction, decodeFormState, createTemporaryReferenceSet } from 'react-server-dom-webpack/server.node';
+import { pathToFileURL } from 'node:url';
+import path from 'node:path';
+import { createHash } from 'node:crypto';
+import { runRequestContext, currentRequest } from '../compat/headers.cjs';
+import { navigationResponse } from './navigation.mjs';
+import { appTimeoutError } from './app-errors.mjs';
+import { flushCacheWork } from '../compat/data-cache.cjs';
+
+export const MAX_ACTION_BYTES = 1024 * 1024;
+const modules = new Map();
+const loaders = new Map();
+const manifests = new WeakMap();
+
+function badRequest(message) { return Object.assign(new Error(message), { statusCode: 400 }); }
+
+globalThis.__webpack_require__ = id => {
+  if (!modules.has(id)) throw badRequest('Unknown Server Action module');
+  return modules.get(id);
+};
+globalThis.__webpack_chunk_load__ = id => {
+  if (!loaders.has(id)) return Promise.reject(badRequest('Unknown Server Action module'));
+  return loaders.get(id)();
+};
+
+export function actionManifest(request) {
+  const root = path.resolve(request.distDir);
+  const actions = request.actions;
+  const edge = request.cacheConfig?.runtime === 'edge';
+  const cached = request.production && actions && manifests.get(actions);
+  if (cached && cached.root === root && cached.edge === edge) return cached.value;
+  const entries = Object.create(null);
+  for (const [id, info] of Object.entries(request.actions || {})) {
+    if (typeof info?.module !== 'string' || typeof info?.export !== 'string') throw new Error('Invalid Server Action manifest');
+    const selected = request.cacheConfig?.runtime === 'edge' && info.edgeModule !== undefined ? info.edgeModule : info.module;
+    if (typeof selected !== 'string') throw new Error('Invalid Server Action runtime module');
+    const filename = path.resolve(root, selected);
+    if (!filename.startsWith(root + path.sep)) throw new Error('Server Action module is outside the build directory');
+    const url = pathToFileURL(filename).href;
+    if (!loaders.has(url)) loaders.set(url, async () => {
+      if (!modules.has(url)) modules.set(url, await import(url));
+    });
+    entries[id] = { id: url, chunks: [url, url], name: info.export };
+  }
+  // React's webpack decoder permits an "id#export" fallback. Reject unknown
+  // IDs on the first lookup, including inherited names and fabricated exports.
+  const value = new Proxy(entries, { get(target, id) {
+    if (typeof id !== 'string' || !Object.hasOwn(target, id)) throw badRequest('Unknown Server Action reference');
+    return target[id];
+  } });
+  if (request.production && actions) manifests.set(actions, { root, edge, value });
+  return value;
+}
+
+export function registerCacheClientModule(id, namespace) { modules.set(id, namespace); }
+
+export async function loadActionReference(id, bound = null) {
+  const manifest = actionManifest(currentRequest());
+  const reference = manifest[id];
+  await loaders.get(reference.id)();
+  const namespace = modules.get(reference.id);
+  if (!Object.hasOwn(namespace, reference.name) || typeof namespace[reference.name] !== 'function') throw badRequest('Invalid Server Action export');
+  const fn = namespace[reference.name];
+  if (bound === null) return fn;
+  const values = await bound;
+  if (!Array.isArray(values) || values.length > 1000) throw badRequest('Invalid Server Action bound arguments');
+  return fn.bind(null, ...values);
+}
+
+function errorPayload(error, production) {
+  const digest = createHash('sha256').update(String(error?.stack || error?.message || error)).digest('hex').slice(0, 16);
+  return { message: production ? 'An error occurred while executing this action. See the server logs for details.' : error?.message || String(error), digest };
+}
+
+async function actionBody(action, limit = MAX_ACTION_BYTES) {
+  if (!Number.isSafeInteger(limit) || limit < 1 || limit > 8 * 1024 * 1024) throw badRequest('Invalid Server Action body limit');
+  if ((action.body || '').length > Math.ceil(limit / 3) * 4) throw badRequest(`Server Action body exceeds the ${limit} byte limit`);
+  const bytes = Buffer.from(action.body || '', 'base64');
+  if (bytes.byteLength > limit) throw badRequest(`Server Action body exceeds the ${limit} byte limit`);
+  const contentType = action.contentType || 'text/plain';
+  if (/^(multipart\/form-data|application\/x-www-form-urlencoded)(?:;|$)/i.test(contentType)) {
+    try { return await new Response(bytes, { headers: { 'content-type': contentType } }).formData(); }
+    catch { throw badRequest('Malformed Server Action form data'); }
+  }
+  if (action.id && /^(text\/plain|application\/json)(?:;|$)/i.test(contentType)) return bytes.toString('utf8');
+  throw badRequest('Unsupported Server Action content type');
+}
+
+export async function invokeAction(request) {
+  const manifest = actionManifest(request);
+  const temporaryReferences = createTemporaryReferenceSet();
+  const body = await actionBody(request.action, request.serverActions?.bodySizeLimit);
+  return runRequestContext({ ...request, phase: 'action', mutableCookies: true }, async () => {
+    const context = currentRequest();
+    let operation;
+    try {
+      if (request.action.id) {
+        const reference = manifest[request.action.id];
+        const args = await decodeReply(body, manifest, { temporaryReferences, arraySizeLimit: 10_000 });
+        if (!Array.isArray(args) || args.length > 1000) throw badRequest('Invalid Server Action arguments');
+        await loaders.get(reference.id)();
+        const namespace = modules.get(reference.id);
+        if (!Object.hasOwn(namespace, reference.name) || typeof namespace[reference.name] !== 'function') throw badRequest('Invalid Server Action export');
+        operation = () => namespace[reference.name](...args);
+      } else {
+        operation = await decodeAction(body, manifest);
+        if (typeof operation !== 'function') throw badRequest('No Server Action was selected by the form');
+      }
+    } catch (error) {
+      if (error?.statusCode === 504) throw error;
+      if (error?.statusCode === 400) throw error;
+      throw badRequest('Invalid Server Action payload');
+    }
+
+    let actionResult;
+    let actionError;
+    let actionRedirect;
+    let actionNotFound;
+    let failure;
+    try { actionResult = await operation(); }
+    catch (error) {
+      const navigation = navigationResponse(error);
+      if (navigation?.headers?.location) {
+        const type = error.digest.split(';')[1];
+        actionRedirect = { url: navigation.headers.location, type: type === 'push' ? 'push' : 'replace' };
+      } else if (navigation?.status === 404) {
+        actionNotFound = true;
+      } else {
+        console.error('[prnext]', error?.stack || error);
+        actionError = errorPayload(error, request.production);
+        failure = { message: error?.message || String(error), stack: error?.stack, digest: error?.digest };
+      }
+    }
+    // An invalidation must finish before the updated component tree is read,
+    // including actions that redirect or report an application error.
+    await flushCacheWork(context);
+    const headers = new Headers(request.headers || {});
+    headers.set('cookie', context.cookies.toString());
+    let formState = null;
+    if (!request.action.id && !failure && !actionRedirect && !actionNotFound) formState = await decodeFormState(actionResult, body, manifest);
+    return { actionResult, actionError, actionRedirect, actionNotFound, failure, formState, temporaryReferences,
+      headers: Object.fromEntries(headers), setCookies: [...context.outgoingCookies.values()], native: !request.action.id };
+  });
+}
+
+export async function runAction(request) {
+  const timeoutMs = request.renderTimeoutMs ?? 25_000;
+  let timeout;
+  try {
+    return await Promise.race([
+      invokeAction(request),
+      new Promise((_, reject) => { timeout = setTimeout(() => {
+        const error = appTimeoutError('Server Action', timeoutMs);
+        // An async mutation cannot be cancelled safely; retire the isolate so
+        // its pending work never overlaps a subsequent request.
+        error.retireWorker = true;
+        reject(error);
+      }, timeoutMs); }),
+    ]);
+  } finally { clearTimeout(timeout); }
+}

package/runtime/action-ssr.mjs

@@ -0,0 +1,5 @@
+import { createServerReference as createReference } from 'react-server-dom-webpack/client.node';
+
+// The official proxy carries React's form action and useActionState signatures.
+// Invoking it during SSR is rejected by React instead of running a mutation.
+export function createServerReference(id) { return createReference(id); }