@thomas.f/prnext 0.1.11-alpha → 0.1.13-alpha

package/runtime/app-render.mjs

@@ -1,4 +1,5 @@
 import React from 'react';
+import diagnostics from '../compat/diagnostics.cjs';
 import { runtimeProfile } from './profile.mjs';
 import { fontPreloads } from './font-preload.mjs';
 import { advancedRoutingSources } from './app-routing-state.mjs';
@@ -6,7 +7,7 @@ import { addBasePath, removeBasePath } from '../compat/paths.cjs';
 import { isDynamicBailout } from '../compat/dynamic-bailout.cjs';
 import { Readable } from 'node:stream';
 import { Worker } from 'node:worker_threads';
-import { workerMetadata } from './worker-metadata.mjs';
+import { workerMetadata, freezeClientModules, isImmutableClientModules } from './worker-metadata.mjs';
 import { workerArtifacts } from './worker-artifacts.mjs';
 import path from 'node:path';
 import { PARTIAL_PREFETCH_TYPE, PARTIAL_PREFETCH_BYTES } from './app-prefetch.mjs';
@@ -25,16 +26,21 @@ import { partialArtifact, partialShell } from './app-partial.mjs';
 import { partialKeyMap } from './app-partial-model.mjs';
 import { partialIdentity } from './partial-artifact-cache.mjs';
 import { isDraftRequest } from '../compat/draft.cjs';
+import { createRscLifecycle } from './rsc-lifecycle.mjs';
+import { trackRequestWork } from './request-work.mjs';
+import { createRscWorkWatchdog } from './rsc-work-watchdog.mjs';
 
 installFetchCache();
 
 const workers = new Map();
+const lifecycles = new WeakMap();
 const metadata = new WeakMap();
 const artifacts = new WeakMap();
 const edgeManifests = new WeakMap();
 const emptyManifest = Object.freeze({});
 let nextId = 0;
 const pending = new Map();
+const noop = () => {};
 // Avoid temporary arrays on every completion/cancellation at high concurrency.
 function hasPending(worker, minimum = 1, cancelledOnly = false) {
   let count = 0;
@@ -67,14 +73,14 @@ function flightDecoder(production) {
     // React's development decoder guards module initialization with NODE_ENV.
     // This require is synchronous; restore the host before any stream work.
     process.env.NODE_ENV = production ? 'production' : 'development';
-    let decoder = require(filename).createFromNodeStream;
-    if (typeof decoder !== 'function') {
+    let decoder = require(filename);
+    if (typeof decoder.createFromNodeStream !== 'function') {
       // A consumer may have previously required the guarded development file
       // in production, leaving an empty module in Node's cache.
       delete require.cache[filename];
-      decoder = require(filename).createFromNodeStream;
+      decoder = require(filename);
     }
-    if (typeof decoder !== 'function') throw new Error('React Flight decoder is unavailable for the requested render mode');
+    if (typeof decoder.createFromNodeStream !== 'function') throw new Error('React Flight decoder is unavailable for the requested render mode');
     flightDecoders.set(production, decoder);
     return decoder;
   } finally {
@@ -97,6 +103,7 @@ globalThis.__webpack_chunk_load__ = id => {
 
 function getWorker(production) {
   if (workers.has(production)) return workers.get(production);
+  const created = diagnostics.enabled ? performance.now() : 0;
   const current = new Worker(new URL('./rsc-worker.mjs', import.meta.url), {
     execArgv: ['--conditions=react-server'], stdout: true, stderr: true,
     // Production nursery policy; an explicit Node semi-space flag takes
@@ -105,37 +112,68 @@ function getWorker(production) {
     env: { ...process.env, NODE_ENV: production ? 'production' : 'development' },
   });
   workers.set(production, current);
+  if (diagnostics.enabled) {
+    current.once('online', () => diagnostics.record('wake', {phase:'rsc-online', durationMs:performance.now()-created}));
+    const ready = message => {
+      if (message.type !== 'rsc-ready') return;
+      diagnostics.record('wake', {phase:'rsc-ready', durationMs:performance.now()-created});
+      current.off('message', ready);
+    };
+    current.on('message', ready);
+  }
+  let workWatchdog;
+  const lifecycle = createRscLifecycle(() => { workWatchdog?.close(); return current.terminate(); });
+  workWatchdog = createRscWorkWatchdog({
+    probe: token => current.postMessage({ type: 'work-probe', token }),
+    retire: error => {
+      console.error('[prnext] RSC background worker stopped responding:', error);
+      return lifecycle.terminate(error);
+    },
+  });
+  lifecycles.set(current, lifecycle);
   metadata.set(current, workerMetadata(current));
   artifacts.set(current, workerArtifacts(current));
   // The HTTP worker's stdout belongs to its Rust transport. User code and React
   // diagnostics in the separate RSC environment must never corrupt that stream.
   current.stdout.pipe(process.stderr);
   current.stderr.pipe(process.stderr);
-  function fail(error) {
-    if (workers.get(production) === current) workers.delete(production);
+  function fail(error, exited = false) {
+    // Keep a retiring isolate registered until its actual exit; callers may
+    // wait for replacement but cannot start an unbounded series of retirees.
+    if (exited && workers.get(production) === current) workers.delete(production);
+    lifecycle.close(error);
+    workWatchdog.close();
     for (const [id, request] of pending) {
       if (request.worker !== current) continue;
       clearTimeout(request.timeout);
       pending.delete(id);
+      request.lease.release();
+      request.settle();
+      request.releaseWorkWatch?.();
       request.detach?.();
       request.channel?.error(error);
       request.reject(error);
     }
   }
-  current.on('message', ({ id, type, chunk, byteOffset, byteLength, done, body, status, rscError, boundaryIndex, headers, error, staticParams, staticMetadata, navigation }) => {
+  current.on('message', ({ id, type, token, chunk, byteOffset, byteLength, done, body, status, rscError, boundaryIndex, headers, error, staticParams, staticMetadata, navigation }) => {
+    if (type === 'work-responsive') { workWatchdog.ack(token); return; }
     const request = pending.get(id);
     if (!request || request.worker !== current) return;
     // A timed-out mutation can still be running after its HTTP caller leaves.
     // Its retirement marker must be honored before discarding cancelled output.
     if (error?.retireWorker) {
-      if (workers.get(production) === current) workers.delete(production);
-      void current.terminate();
+      void lifecycle.terminate(new Error(error.message)).catch(error => console.error('[prnext] RSC worker termination failed:', error));
     }
     if (request.cancelled && type !== 'settled') return;
     if (type === 'settled') {
-      if (!request.cancelled) return;
       pending.delete(id); clearTimeout(request.timeout);
-      if (!hasPending(current)) current.unref();
+      request.lease.release();
+      request.detach?.();
+      request.settle();
+      request.releaseWorkWatch?.();
+      // terminate() keeps its exit event referenced. A late settlement must
+      // not undo that reference while build publication awaits shutdown.
+      if (!hasPending(current) && !lifecycle.retiring) current.unref();
       return;
     }
     if (type === 'start') {
@@ -145,11 +183,21 @@ function getWorker(production) {
     }
     if (type === 'chunk') {
       try { request.channel.chunk(chunk, byteOffset, byteLength); }
-      catch (error) { request.channel.error(error); current.postMessage({ id, type: 'cancel' }); }
+      catch (error) { request.channel.error(error); current.postMessage({ id, type: 'cancel' }); request.cancel(error); return; }
       if (!done) return;
     }
-    pending.delete(id);
+    if (request.completed) {
+      if (error) console.error('[prnext] RSC background work failed:', error.stack || error.message);
+      return;
+    }
+    request.completed = true;
+    // The response deadline ends with its successful terminal frame. Cache
+    // work can legitimately continue afterwards and retains its own bounds;
+    // supervise isolate responsiveness, not total background-task duration.
     clearTimeout(request.timeout);
+    // A destroyed Timeout can still own its AsyncLocalStorage frame.
+    request.timeout = undefined;
+    request.releaseWorkWatch = workWatchdog.add();
     request.detach?.();
     if (type === 'end' || done) request.channel.end();
     else if (error) {
@@ -171,51 +219,98 @@ function getWorker(production) {
       // ArrayBuffer overload: a view of the transferred allocation, no copy.
       request.resolve({ body: Buffer.from(body), status: status || 200, rscError, boundaryIndex, headers, staticMetadata, navigation });
     }
-    if (!hasPending(current)) current.unref();
+    // Keep only settlement bookkeeping after sending the body. The
+    // isolate can still be flushing cache writes after its terminal frame.
+    request.channel = undefined;
+    // Both closures capture the original response promise / AbortSignal.
+    // Detaching the listener alone does not release those references while
+    // legitimate background work keeps this entry in the pending map.
+    request.cancel = request.detach = undefined;
+    request.resolve = request.reject = noop;
   });
   current.on('error', fail);
-  current.on('exit', code => fail(new Error(`App Router worker exited (${code})`)));
+  current.on('exit', code => fail(new Error(`App Router worker exited (${code})`), true));
   current.unref();
   return current;
 }
 
+// Stdio workers can retain referenced MessagePorts after rendering (including
+// diagnostics piped from the RSC isolate). EOF must drain real cache/after()
+// settlement before explicitly closing those isolates, not wait for Node's
+// incidental event-loop liveness or terminate unfinished application work.
+export async function drainAppRuntime() {
+  while (pending.size) await Promise.all([...pending.values()].map(request => request.settled));
+  await closeAppRuntime();
+}
+
 export function closeAppRuntime() {
   const current = [...workers.values()];
-  workers.clear();
-  return Promise.all(current.map(worker => worker.terminate()));
+  return Promise.all(current.map(worker => lifecycles.get(worker).terminate()));
+}
+
+function requestDeadline(entry, lifecycle, id, hardTimeoutMs, delayMs) {
+  // Keep this callback outside renderFlight's request closure: cancelled work
+  // retains its hard deadline, but must not thereby retain the HTTP signal or
+  // response promise until an unrelated cache write settles.
+  return setTimeout(() => {
+    // A blocking npm dependency cannot honor an AbortSignal. Retire the
+    // isolate at the hard deadline so subsequent requests can recover.
+    void lifecycle.terminate(appTimeoutError('RSC worker', hardTimeoutMs)).finally(entry.settle).catch(error => console.error('[prnext] RSC worker termination failed:', error));
+    pending.delete(id);
+    entry.lease.release();
+    const error = appTimeoutError('RSC worker', hardTimeoutMs);
+    if (entry.completed) console.error('[prnext] RSC background work failed:', error);
+    entry.channel?.error(error);
+    entry.detach?.();
+    entry.reject(error);
+  }, delayMs);
 }
 
-export function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs = 28_000, signal } = {}) {
+export async function renderFlight(request, { softTimeoutMs, hardTimeoutMs, signal, deferFinalizer } = {}) {
+  softTimeoutMs ??= request.cacheConfig?.maxDuration ? request.cacheConfig.maxDuration * 1000 : 25_000;
+  hardTimeoutMs ??= request.cacheConfig?.maxDuration ? request.cacheConfig.maxDuration * 1000 : 28_000;
+  const deadline = performance.now() + hardTimeoutMs;
+  let current, lifecycle, lease;
+  for (;;) {
+    signal?.throwIfAborted();
+    current = getWorker(Boolean(request.production));
+    lifecycle = lifecycles.get(current);
+    if (lifecycle.retiring) {
+      await lifecycle.waitForRetirement({ signal, timeoutMs: deadline - performance.now() });
+      continue;
+    }
+    try { lease = await lifecycle.acquire({ signal, timeoutMs: deadline - performance.now() }); }
+    catch (error) { if (lifecycle.retiring) continue; throw error; }
+    if (lifecycle.closed) { lease.release(); continue; }
+    break;
+  }
   return new Promise((resolve, reject) => {
-    const current = getWorker(Boolean(request.production));
+    if (signal?.aborted) { lease.release(); reject(signal.reason); return; }
+    if (performance.now() >= deadline) { lease.release(); reject(appTimeoutError('RSC admission', hardTimeoutMs)); return; }
     current.ref();
     const id = ++nextId;
-    const timeout = setTimeout(() => {
-      // A blocking npm dependency cannot honor an AbortSignal. Retire the
-      // isolate at the hard deadline so subsequent requests can recover.
-      if (workers.get(Boolean(request.production)) === current) workers.delete(Boolean(request.production));
-      void current.terminate();
-      pending.delete(id);
-      const error = appTimeoutError('RSC worker', hardTimeoutMs);
-      entry.channel?.error(error);
-      entry.detach?.();
-      reject(error);
-    }, hardTimeoutMs);
-    const entry = { worker: current, resolve, reject, timeout, operation: request.operation };
+    let settle;
+    const settled = new Promise(resolve => { settle = resolve; });
+    trackRequestWork(settled, signal, { deadline, supervised: true });
+    const entry = { worker: current, resolve, reject, operation: request.operation, lease, settle, settled };
+    const timeout = entry.timeout = requestDeadline(entry, lifecycle, id, hardTimeoutMs, Math.max(0, deadline - performance.now()));
     function cancel(reason) {
+      if (entry.cancelled) return;
       // Keep the independent deadline until the isolate confirms settlement.
       // A disconnected client must not disable recovery of blocked npm code.
       entry.cancelled = true;
+      lease.cancel();
       entry.detach?.();
-      // HTTP callers can leave faster than arbitrary npm work can unwind.
-      // Bound abandoned work independently of the admission of live requests.
-      if (hasPending(current, 16, true)) {
-        if (workers.get(Boolean(request.production)) === current) workers.delete(Boolean(request.production));
-        void current.terminate();
-      }
-      if (!hasPending(current)) current.unref();
-      reject(reason instanceof Error ? reason : new Error('App Router response was cancelled'));
+      // Pause new work at 16 abandoned requests while their acknowledgements
+      // settle. Existing mutation/cache work keeps its original hard deadline.
+      if (!hasPending(current) && !lifecycle.retiring) current.unref();
+      entry.reject(reason instanceof Error ? reason : new Error('App Router response was cancelled'));
+      // Settlement/deadline tracking remains live, but a disconnected caller
+      // no longer needs its stream, promise or signal retained by this entry.
+      entry.channel = entry.cancel = entry.detach = undefined;
+      entry.resolve = entry.reject = noop;
     }
+    entry.cancel = cancel;
     if (request.stream) entry.channel = parentStreamChannel(current, id, cancel);
     if (signal) {
       const onAbort = () => {
@@ -225,11 +320,14 @@ export function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs =
       };
       entry.detach = () => signal.removeEventListener('abort', onAbort);
       signal.addEventListener('abort', onAbort, { once: true });
-      if (signal.aborted) { clearTimeout(timeout); onAbort(); return; }
     }
     pending.set(id, entry);
     try {
-      const wire = { ...request, renderTimeoutMs: softTimeoutMs };
+      const wire = { ...request, renderTimeoutMs: Math.min(softTimeoutMs, Math.max(1, deadline - performance.now())) };
+      if (request.action && deferFinalizer) {
+        wire.waitForResponse = true;
+        deferFinalizer(() => { if (pending.has(id)) current.postMessage({ id, type: 'after-response' }); });
+      }
       if (request.production) {
         const artifactId = artifacts.get(current)(wire.partialFlight);
         if (artifactId !== undefined) { wire.partialFlightId = artifactId; delete wire.partialFlight; }
@@ -243,19 +341,22 @@ export function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs =
     catch (error) {
       clearTimeout(timeout);
       pending.delete(id);
+      lease.release();
+      settle();
       entry.detach?.();
       reject(error);
-      if (!hasPending(current)) current.unref();
+      if (!hasPending(current) && !lifecycle.retiring) current.unref();
     }
   });
 }
 
 export async function decodeFlight(body, clientModules = {}, distDir, { production = process.env.NODE_ENV === 'production' } = {}) {
-  const ids = Object.keys(clientModules);
   let cached = ssrManifests.get(clientModules);
   // Keep only the manifest's module mapping, never a decoded React model or
   // request context. Weak ownership releases it with the build manifest.
-  if (!cached || cached.distDir !== distDir || ids.length !== cached.paths.size || ids.some(id => cached.paths.get(id) !== clientModules[id].ssrModule)) {
+  const immutable = isImmutableClientModules(clientModules);
+  const ids = cached && cached.distDir === distDir && cached.immutable && immutable ? null : Object.keys(clientModules);
+  if (!cached || cached.distDir !== distDir || (ids && (ids.length !== cached.paths.size || ids.some(id => cached.paths.get(id) !== clientModules[id].ssrModule)))) {
     const moduleMap = Object.create(null), paths = new Map();
     for (const id of ids) {
       const item = clientModules[id];
@@ -266,13 +367,20 @@ export async function decodeFlight(body, clientModules = {}, distDir, { producti
       moduleMap[id] = { '*': { id: moduleUrl, chunks: [moduleUrl, moduleUrl], name: '*' } };
       paths.set(id, item.ssrModule);
     }
-    cached = { distDir, paths, moduleMap };
+    cached = { distDir, paths, moduleMap, immutable };
     ssrManifests.set(clientModules, cached);
-  }
+  } else if (immutable) cached.immutable = true;
   // Hosts can build/render both modes in one process. The encoded protocol,
   // rather than the host's current environment or import cache, selects React.
   const decoder = flightDecoder(Boolean(production));
-  return decoder(body instanceof ReadableStream ? Readable.fromWeb(body) : Readable.from([body]), { moduleMap: cached.moduleMap, serverModuleMap: null, moduleLoading: null });
+  const serverConsumerManifest = { moduleMap: cached.moduleMap, serverModuleMap: null, moduleLoading: null };
+  // React's Node decoder can consume Web streams directly. Keep the Flight
+  // bytes in their original stream instead of allocating a Node Readable,
+  // forwarding its events and buffering a second queue for each response.
+  if (body instanceof ReadableStream && typeof decoder.createFromReadableStream === 'function') {
+    return decoder.createFromReadableStream(body, { serverConsumerManifest });
+  }
+  return decoder.createFromNodeStream(body instanceof ReadableStream ? Readable.fromWeb(body) : Readable.from([body]), serverConsumerManifest);
 }
 
 export async function renderHtml(tree, router, { timeoutMs = 25_000, formState = null, staticGeneration = false, nonce, strictMode = true } = {}) {
@@ -348,13 +456,16 @@ export async function renderAppPage(options) {
   return response;
 }
 
-async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distDir = path.dirname(path.dirname(modulePath)), url = 'http://localhost/', originalUrl, params = {}, method = 'GET', headers = {}, routingRequestHeaders, routingResolver, body = '', production = process.env.NODE_ENV === 'production', stream = false, signal }) {
+async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distDir = path.dirname(path.dirname(modulePath)), url = 'http://localhost/', originalUrl, params = {}, method = 'GET', headers = {}, routingRequestHeaders, routingResolver, body = '', production = process.env.NODE_ENV === 'production', stream = false, signal, deferFinalizer }) {
   let clientModules = manifest.app?.clientModules || emptyManifest;
   if (route.cacheConfig?.runtime === 'edge') {
     let edge = !manifest.dev && edgeManifests.get(clientModules);
     if (!edge) {
       edge = Object.fromEntries(Object.entries(clientModules).map(([id, item]) => [id, item.edgeSsrModule ? { ...item, ssrModule: item.edgeSsrModule } : item]));
-      if (!manifest.dev) edgeManifests.set(clientModules, edge);
+      if (!manifest.dev) {
+        if (isImmutableClientModules(clientModules)) freezeClientModules(edge);
+        edgeManifests.set(clientModules, edge);
+      }
     }
     clientModules = edge;
   }
@@ -424,7 +535,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
   if (stream && (!request.action || request.action.id)) {
     let progressive;
     try {
-      progressive = await renderFlight({ ...request, stream: true }, { signal });
+      progressive = await renderFlight({ ...request, stream: true }, { signal, deferFinalizer });
       const rsc = Object.entries(headers).some(([name, value]) => name.toLowerCase() === 'rsc' && value === '1');
       if (rsc || request.action?.id) {
         if (method === 'HEAD') await progressive.body.cancel();
@@ -448,7 +559,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
     }
   }
   let result;
-  try { result = await renderFlight(request, { signal }); }
+  try { result = await renderFlight(request, { signal, deferFinalizer }); }
   catch (error) {
     const result = navigationResponse(error);
     if (result) return { ...result, headers: { ...responseHeaders, ...result.headers, ...error.responseHeaders } };
@@ -465,7 +576,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
   let html, model, recovery = false;
   try {
     model = await decodeFlight(result.body, clientModules, distDir, { production });
-    html = await renderHtml(model.tree, model.router, { formState: model.formState, nonce: request.nonce, strictMode: manifest.config?.reactStrictMode !== false });
+    html = await renderHtml(model.tree, model.router, { timeoutMs: route.cacheConfig?.maxDuration ? route.cacheConfig.maxDuration * 1000 : undefined, formState: model.formState, nonce: request.nonce, strictMode: manifest.config?.reactStrictMode !== false });
   } catch (error) {
     if (error?.statusCode === 504) throw error;
     const navigation = navigationResponse(error);

package/runtime/app-route-plan.mjs

@@ -0,0 +1,45 @@
+// Cache only the compiler-owned, immutable routing scaffold. Component modules,
+// configuration, request parameters and rendered trees are never memoized here.
+const plans = new WeakMap();
+const liveTrees = new WeakSet();
+const ownValue = (object, name) => Object.getOwnPropertyDescriptor(object, name)?.value;
+function frozenRecord(value) {
+  if (!value || typeof value !== 'object' || !Object.isFrozen(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  if (Array.isArray(value) ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) return false;
+  if (Array.isArray(value) && Object.hasOwn(value, Symbol.iterator)) return false;
+  return Reflect.ownKeys(value).every(key => 'value' in Object.getOwnPropertyDescriptor(value, key));
+}
+
+/** Mutable development/custom trees continue through the live traversal. */
+export function appRoutePlan(root) {
+  if (!root || !Object.isFrozen(root)) return null;
+  const existing = plans.get(root);
+  if (existing) return existing;
+  if (liveTrees.has(root)) return null;
+  const pages = [], nodes = new Map(), rootLayouts = new Set();
+  let sequence = 0;
+  function visit(node, chain, branch, hasLayout) {
+    if (!frozenRecord(node)) return false;
+    const children = ownValue(node, 'children'), slots = ownValue(node, 'slots'), files = ownValue(node, 'files');
+    if (!Array.isArray(children) || !frozenRecord(children) || !frozenRecord(slots) || !frozenRecord(files)
+      || typeof ownValue(node, 'path') !== 'string' || typeof ownValue(node, 'pattern') !== 'string'
+      || typeof ownValue(node, 'segment') !== 'string' || nodes.has(node)) return false;
+    // Bound retained chains even for hand-written frozen manifests.
+    if (sequence >= 4096 || chain.length >= 64) return false;
+    const next = [...chain, node], start = sequence++;
+    const info = { start, end: start, depth: chain.length, branch, slots: Object.entries(slots), metadataSlots: Object.entries(slots).sort(([a], [b]) => a.localeCompare(b)) };
+    nodes.set(node, info);
+    if (files.layout && !hasLayout) rootLayouts.add(node.path);
+    if (files.page) pages.push({ node, chain: next, start, branch,
+      score: node.pattern.split('/').filter(Boolean).reduce((sum, value) => sum + (value.startsWith('[[...') ? 0 : value.startsWith('[...') ? 1 : value.startsWith('[') ? 3 : 6), 0) });
+    for (const child of children) if (!visit(child, next, branch, hasLayout || !!files.layout)) return false;
+    for (const child of Object.values(slots)) if (!visit(child, next, child, hasLayout || !!files.layout)) return false;
+    info.end = sequence;
+    return true;
+  }
+  if (!visit(root, [], root, false)) { liveTrees.add(root); return null; }
+  const plan = { pages, nodes, rootLayouts };
+  plans.set(root, plan);
+  return plan;
+}

package/runtime/app-routing-state.mjs

@@ -1,26 +1,98 @@
 // Route matching and navigation state do not need React or metadata rendering.
 import { removeBasePath } from '../compat/paths.cjs';
 
-export function matchAppPattern(pattern, pathname, prefix = false) {
-  const expected = pattern.split('/').filter(Boolean), raw = pathname.split('/').filter(Boolean);
-  let parts;
-  try { parts = raw.map(decodeURIComponent); } catch { return null; }
-  const params = {};
-  for (let index = 0; index < expected.length; index++) {
-    const segment = expected[index];
+// Only trusted route syntax is cached, never URLs, decoded parameters or request
+// state. Bound the shared lookup's entry count and retained text/segments.
+const patterns = new Map();
+// Live manifest entries own their parsed syntax weakly. Large route tables must
+// not churn the bounded cross-call cache once for every saved parallel slot.
+// Their lifetime follows the existing manifest; no old manifest is retained.
+// Re-read the pattern on each use so mutable development manifests stay live.
+const routePatterns = new WeakMap();
+let patternCharacters = 0, patternSegments = 0;
+function compilePattern(pattern) {
+  let compiled = patterns.get(pattern);
+  if (compiled) return compiled;
+  const segments = pattern.split('/').filter(Boolean);
+  const kinds = new Uint8Array(segments.length);
+  let score = 0;
+  for (let index = 0; index < segments.length; index++) {
+    const segment = segments[index];
+    if (segment[0] !== '[') { score += 6; continue; }
+    score += segment.startsWith('[[...') ? 0 : segment.startsWith('[...') ? 1 : 3;
     const optional = /^\[\[\.\.\.([^\]]+)\]\]$/.exec(segment);
     const catchAll = /^\[\.\.\.([^\]]+)\]$/.exec(segment);
     if (optional || catchAll) {
-      if (catchAll && index >= parts.length) return null;
-      if (index < parts.length) params[(optional || catchAll)[1]] = parts.slice(index);
-      return params;
+      kinds[index] = optional ? 3 : 2;
+      segments[index] = (optional || catchAll)[1];
+    } else {
+      const dynamic = /^\[([^\]]+)\]$/.exec(segment);
+      if (dynamic) { kinds[index] = 1; segments[index] = dynamic[1]; }
+    }
+  }
+  compiled = { segments, kinds, score, characters: pattern.length };
+  if (pattern.length <= 2048 && segments.length <= 64) {
+    while (patterns.size >= 1024 || patternCharacters + pattern.length > 128 * 1024 || patternSegments + segments.length > 8192) {
+      const oldest = patterns.keys().next().value;
+      const removed = patterns.get(oldest);
+      patterns.delete(oldest);
+      patternCharacters -= removed.characters;
+      patternSegments -= removed.segments.length;
     }
-    const dynamic = /^\[([^\]]+)\]$/.exec(segment);
-    if (index >= parts.length) return null;
-    if (dynamic) params[dynamic[1]] = parts[index];
-    else if (segment !== parts[index]) return null;
+    patterns.set(pattern, compiled);
+    patternCharacters += pattern.length;
+    patternSegments += segments.length;
   }
-  return prefix || expected.length === parts.length ? params : null;
+  return compiled;
+}
+
+function pathSegments(pathname) {
+  const raw = pathname.split('/').filter(Boolean);
+  try { return raw.map(decodeURIComponent); }
+  catch { return null; }
+}
+
+function compiledRoute(route) {
+  const pattern = route.pattern;
+  const cached = routePatterns.get(route);
+  if (cached && cached.pattern === pattern) return cached.compiled;
+  const compiled = compilePattern(pattern);
+  if (pattern.length <= 2048 && compiled.segments.length <= 64) routePatterns.set(route, { pattern, compiled });
+  else routePatterns.delete(route);
+  return compiled;
+}
+
+function matchesParts({ segments, kinds }, parts, prefix = false, params) {
+  for (let index = 0; index < segments.length; index++) {
+    const kind = kinds[index];
+    if (kind >= 2) {
+      if (kind === 2 && index >= parts.length) return false;
+      if (params && index < parts.length) params[segments[index]] = parts.slice(index);
+      return true;
+    }
+    if (index >= parts.length) return false;
+    if (kind === 1) { if (params) params[segments[index]] = parts[index]; }
+    else if (segments[index] !== parts[index]) return false;
+  }
+  return prefix || segments.length === parts.length;
+}
+
+export function matchAppPattern(pattern, pathname, prefix = false) {
+  const compiled = compilePattern(pattern), parts = pathSegments(pathname);
+  if (!parts) return null;
+  const params = {};
+  return matchesParts(compiled, parts, prefix, params) ? params : null;
+}
+
+/** Decode a request pathname once; each match still owns its parameter values. */
+export function createAppMatcher(pathname) {
+  const parts = pathSegments(pathname);
+  return (pattern, prefix = false) => {
+    const compiled = compilePattern(pattern);
+    if (!parts) return null;
+    const params = {};
+    return matchesParts(compiled, parts, prefix, params) ? params : null;
+  };
 }
 
 export function readRouterState(request) {
@@ -49,13 +121,21 @@ export function advancedRoutingSources(request, routes) {
   const modules = new Set();
   for (const saved of Object.values(state.slots)) {
     const pathname = new URL(saved.url, 'http://prnext.local').pathname;
-    const route = routes.filter(item => item.router === 'app' && item.kind === 'page' && !item.internal && matchAppPattern(item.pattern, pathname))
-      .sort((a, b) => score(b.pattern) - score(a.pattern))[0];
+    const parts = pathSegments(pathname);
+    if (!parts) continue;
+    let route, bestScore = -1;
+    for (let index = 0, length = routes.length; index < length; index++) {
+      if (!(index in routes)) continue;
+      const item = routes[index];
+      if (item.router !== 'app' || item.kind !== 'page' || item.internal) continue;
+      const compiled = compiledRoute(item);
+      // The original stable sort kept the first route when scores were equal.
+      // Lower-scoring routes cannot replace a match already found.
+      if (compiled.score <= bestScore || !matchesParts(compiled, parts)) continue;
+      route = item;
+      bestScore = compiled.score;
+    }
     if (route) modules.add(route.module);
   }
   return [...modules];
 }
-
-function score(pattern) {
-  return pattern.split('/').filter(Boolean).reduce((sum, value) => sum + (value.startsWith('[[...') ? 0 : value.startsWith('[...') ? 1 : value.startsWith('[') ? 3 : 6), 0);
-}