@thomas.f/prnext 0.1.12-alpha → 0.1.15-alpha

package/runtime/og-backend.mjs

@@ -0,0 +1,8 @@
+// Older native sharp backends can be supplied by the consuming application.
+// Fall back to the bundled resvg renderer unless librsvg includes its RCE fix.
+export function safeSvgBackend(backend) {
+  const version = backend?.versions?.rsvg;
+  if (typeof version !== 'string' || !/^\d+\.\d+\.\d+$/.test(version)) return false;
+  const [major, minor, patch] = version.split('.').map(Number);
+  return major > 2 || (major === 2 && (minor > 63 || (minor === 63 && patch >= 2)));
+}

package/runtime/og-loader.mjs

@@ -1,17 +1,4 @@
-// Upstream's Node bundle contains HarfBuzz's CommonJS globals and an adjacent
-// hb.wasm reference. Resolve these explicitly for direct prnext/og consumers.
-// Production builds prepare a relocatable module instead and avoid this loader.
-import { createRequire } from 'node:module';
-import { readFile } from 'node:fs/promises';
-import { pathToFileURL } from 'node:url';
-import path from 'node:path';
+// Ship the reviewed renderer instead of resolving upstream's vulnerable pin.
 export async function loadImageRenderer() {
-  const require = createRequire(import.meta.url);
-  const entry = require.resolve('@vercel/og');
-  const fontDirectory = path.dirname(entry);
-  const satori = createRequire(entry).resolve('satori');
-  const harfbuzzDirectory = path.dirname(createRequire(satori).resolve('harfbuzzjs/hb.wasm'));
-  const source = (await readFile(entry, 'utf8')).replaceAll('import.meta.url', JSON.stringify(pathToFileURL(entry).href));
-  const globals = `import {createRequire as __prnextRequire} from 'node:module';const require=__prnextRequire(${JSON.stringify(pathToFileURL(path.join(fontDirectory, 'index.node.js')).href)}),__filename=${JSON.stringify(entry)},__dirname=${JSON.stringify(harfbuzzDirectory)};\n`;
-  return import('data:text/javascript;base64,' + Buffer.from(globals + source).toString('base64'));
+  return import('./og/index.node.mjs');
 }

package/runtime/request-transport.mjs

@@ -1,5 +1,5 @@
 const MAX_HEADER = 256 * 1024;
-const MAX_BODY = 8 * 1024 * 1024;
+const MAX_BODY = 32 * 1024 * 1024;
 const EMPTY_BODY = Buffer.alloc(0);
 
 // Awaiting the consumer preserves socket backpressure. At most one body is

package/runtime/route-static.mjs

@@ -30,7 +30,7 @@ function canonicalOptions(options) {
 
 function deadline(options, phase) {
   const controller = new AbortController();
-  const timeoutMs = options.timeoutMs ?? 25_000;
+  const timeoutMs = options.timeoutMs ?? (options.route?.cacheConfig?.maxDuration ? options.route.cacheConfig.maxDuration * 1000 : 25_000);
   // Keep the timer alive while awaiting an otherwise handle-free import or
   // generator so Node reports the timeout rather than exiting on pending TLA.
   const timer = setTimeout(() => controller.abort(apiTimeoutError(phase, timeoutMs)), timeoutMs);

package/runtime/rsc-worker.mjs

@@ -24,6 +24,7 @@ import { installFetchCache } from './fetch-cache.mjs';
 import { flightConsumer } from './cache-components-rsc.mjs';
 import { partialModel, isPartialHole, boundedPartialFlight } from './app-partial-model.mjs';
 import { PartialTemplates, canResumePartialDirectly, partialTemplateReuse } from './partial-template.mjs';
+import { createAfterScope } from '../compat/after.cjs';
 
 installFetchCache();
 if (process.env.PRNEXT_INSPECT_DIR) parentPort.postMessage({type:'rsc-ready'});
@@ -75,7 +76,7 @@ function createTree(entry, request, fallback = null) {
   const pageKey = `${request.routePattern || new URL(request.url).pathname}:${JSON.stringify(request.params || {})}`;
   const keyScopes = [];
   const instantTrees = [];
-  const instantDisabled = [entry.pageConfig, ...segments.map(segment => segment.staticConfig)].some(config => config?.instant && typeof config.instant === 'object' && (config.instant.unstable_disableValidation || (request.production ? config.instant.unstable_disableBuildValidation : config.instant.unstable_disableDevValidation)));
+  const instantDisabled = request.instantValidation && [entry.pageConfig, ...segments.map(segment => segment.staticConfig)].some(config => config?.instant && typeof config.instant === 'object' && (config.instant.unstable_disableValidation || (request.production ? config.instant.unstable_disableBuildValidation : config.instant.unstable_disableDevValidation)));
   function keyScope(prefix, values, liveProps) {
     const key = prefix + JSON.stringify(values);
     keyScopes.push({ key, prefix, names: Object.keys(values), ...(liveProps ? { liveProps } : {}) });
@@ -98,8 +99,9 @@ function createTree(entry, request, fallback = null) {
     scopes.set(segment, `${segment.path || ''}:${JSON.stringify(scopedParams.get(segment))}`);
     if (request.partialParams?.length) for (const prefix of ['', 'error:', 'navigation:', 'layout:']) keyScope(`${prefix}${segment.path || ''}:`, scopedParams.get(segment), prefix === 'layout:' ? ['segments'] : undefined);
   }
-  let instantConfig = entry.pageConfig?.instant;
-  for (const segment of [...(fallback ? segments.slice(0, fallback.index + 1) : segments)].reverse()) {
+  let instantConfig = request.instantValidation ? entry.pageConfig?.instant : undefined;
+  for (let index = fallback ? Math.min(fallback.index, segments.length - 1) : segments.length - 1; index >= 0; index--) {
+    const segment = segments[index];
     if (segment.loading) tree = React.createElement(React.Suspense, {
       fallback: React.createElement(component(segment.loading, 'loading')),
     }, tree);
@@ -126,7 +128,7 @@ function createTree(entry, request, fallback = null) {
       if (request.cacheComponents && segment === rootLayout) tree = React.createElement(React.Fragment, null, head, tree);
       tree = React.createElement(component(segment.layout, 'layout'), { params: staticParams(scopedParams.get(segment)), key: scopes.get(segment) }, tree);
       if (entry.LayoutProvider) tree = React.createElement(entry.LayoutProvider, { key: `layout:${scopes.get(segment)}`,
-        segments: { children: selectedLayoutSegments(segments.slice(segments.indexOf(segment) + 1), request.params) } }, tree);
+        segments: { children: selectedLayoutSegments(segments, request.params, segments.indexOf(segment) + 1) } }, tree);
     }
   }
   // Keep module namespaces out of development owner props: they can contain
@@ -381,9 +383,11 @@ async function handleRequest(request, channel = null) {
 
 const streamChannels = new Map();
 const activeRequests = new Set();
+const responseCompletions = new Map();
 const manifests = new Map();
 const artifacts = new Map();
 parentPort.on('message', async ({ id, request, type, value, token }) => {
+  if (type === 'after-response') { responseCompletions.get(id)?.(); return; }
   // Only the host arms these probes, while completed responses still have
   // tracked cache work. There is no timer or heartbeat in an idle RSC isolate.
   if (type === 'work-probe') { parentPort.postMessage({ type: 'work-responsive', token }); return; }
@@ -400,6 +404,17 @@ parentPort.on('message', async ({ id, request, type, value, token }) => {
     if (request[field + 'Id'] !== undefined) request[field] = manifests.get(request[field + 'Id']);
   }
   const channel = request.stream && (!request.action || request.action.id) ? workerStreamChannel(parentPort, id) : null;
+  let responseDone, responseTimer;
+  if (request.action && request.cacheConfig?.runtime !== 'edge') {
+    const timeoutMs = request.renderTimeoutMs ?? 25000;
+    request.afterScope = createAfterScope({ timeoutMs, onComplete: flushCacheWork,
+      onTimeout: error => parentPort.postMessage({ id, error: { message: error.message, retireWorker: true } }) });
+    if (request.waitForResponse) responseDone = new Promise(resolve => {
+      const finish = () => { clearTimeout(responseTimer); resolve(); };
+      responseCompletions.set(id, finish);
+      responseTimer = setTimeout(finish, timeoutMs);
+    });
+  }
   activeRequests.add(id);
   if (channel) streamChannels.set(id, channel);
   try {
@@ -422,6 +437,14 @@ parentPort.on('message', async ({ id, request, type, value, token }) => {
       code: error?.code, staticMode: error?.staticMode, dynamicReason: error?.dynamicReason,
     } });
   } finally {
+    // Flight completion can precede HTML decoding and socket backpressure.
+    // The HTTP worker acknowledges the actual response end/error/disconnect.
+    // Keep the RSC lease until bounded after-response work has settled.
+    if (request.afterScope) {
+      try { await responseDone; await request.afterScope.finish(); }
+      catch (error) { console.error('[prnext] Server Action after() failed:', error?.stack || error); }
+    }
+    clearTimeout(responseTimer); responseCompletions.delete(id);
     streamChannels.delete(id); activeRequests.delete(id);
     // A streamed terminal frame can precede asynchronous cache writes. Only
     // this acknowledgement confirms that all request work has actually ended.

package/runtime/stream-utils.mjs

@@ -1,3 +1,5 @@
+const immediate = () => new Promise(resolve => setImmediate(resolve));
+
 export const STREAM_CHUNK_BYTES = 64 * 1024;
 
 export function abortError(reason = 'Response body was canceled') {
@@ -48,6 +50,7 @@ export function streamingBody(source, { signal, onCancel, onComplete, timeoutMs
 
   function clean() {
     clearTimeout(timer);
+    timer = undefined;
     signal?.removeEventListener('abort', aborted);
     chunk = undefined;
     if (reader) {
@@ -70,10 +73,14 @@ export function streamingBody(source, { signal, onCancel, onComplete, timeoutMs
   }
 
   function touch() {
-    clearTimeout(timer);
     if (timeoutMs > 0) {
-      timer = setTimeout(() => stop(apiTimeoutError('response idle', timeoutMs), true), timeoutMs);
-      timer.unref?.();
+      // Keep one request-scoped timer: splitting or reading another chunk must
+      // extend the same idle deadline without allocating another async resource.
+      if (timer) timer.refresh();
+      else {
+        timer = setTimeout(() => stop(apiTimeoutError('response idle', timeoutMs), true), timeoutMs);
+        timer.unref?.();
+      }
     }
   }
   function aborted() { stop(signal.reason, true); }
@@ -87,6 +94,7 @@ export function streamingBody(source, { signal, onCancel, onComplete, timeoutMs
       if (stopped) return { done: true, value: undefined };
       if (nextInProgress) throw new Error('Response body reads must be sequential');
       nextInProgress = true;
+      let emptyReads = 0;
       try {
         while (!chunk || offset >= chunk.byteLength) {
           chunk = undefined;
@@ -105,6 +113,17 @@ export function streamingBody(source, { signal, onCancel, onComplete, timeoutMs
           if (!(next.value instanceof Uint8Array)) throw new TypeError('Response body chunks must be Uint8Array values');
           chunk = next.value;
           offset = 0;
+          if (!chunk.byteLength && ++emptyReads === 32) {
+            // Empty, immediately resolved reads produce no writable I/O and
+            // can otherwise starve cancellation, idle timers and other lanes.
+            // They are not progress: keep the original idle deadline running.
+            emptyReads = 0;
+            await immediate();
+            if (stopped) {
+              if (failure) throw failure;
+              return { done: true, value: undefined };
+            }
+          }
         }
         const value = chunk.subarray(offset, Math.min(offset + STREAM_CHUNK_BYTES, chunk.byteLength));
         offset += value.byteLength;

package/runtime/transport.mjs

@@ -1,5 +1,8 @@
+const yieldToEvents = () => new Promise(resolve => setImmediate(resolve));
+
 export const MAX_STREAM_CHUNK = 64 * 1024;
 const MAX_CONTROL_BYTES = 64 * 1024;
+const STREAM_YIELD_CHUNKS = 32;
 const NO_BODY = new Set([204, 205, 304]);
 
 export class ProtocolWriteError extends Error {
@@ -85,6 +88,15 @@ export function createProtocolOutput(write, { cork, uncork } = {}) {
       }
       await send(head);
       responseStarted = true;
+      let chunksSinceYield = 0;
+      const yieldStream = async () => {
+        // A writable callback may settle on nextTick without polling I/O.
+        // Bound ready producer/write chains so other lanes can authenticate,
+        // timers can run and disconnects can abort this producer promptly.
+        chunksSinceYield = 0;
+        await yieldToEvents();
+        signalController?.signal.throwIfAborted();
+      };
       // Iterate the producer directly: an intermediate async generator adds
       // promise reactions and Buffer views for every already bounded chunk.
       // Each write still settles before the next chunk or producer read.
@@ -93,6 +105,7 @@ export function createProtocolOutput(write, { cork, uncork } = {}) {
           const value = bytes(responseBody);
           for (let offset = 0; offset < value.length; offset += MAX_STREAM_CHUNK) {
             await sendChunk(id, value.subarray(offset, offset + MAX_STREAM_CHUNK));
+            if (++chunksSinceYield === STREAM_YIELD_CHUNKS) await yieldStream();
           }
         } else {
           if (typeof responseBody[Symbol.asyncIterator] !== 'function' && typeof responseBody[Symbol.iterator] !== 'function') {
@@ -102,9 +115,12 @@ export function createProtocolOutput(write, { cork, uncork } = {}) {
             const value = bytes(item);
             if (value.length <= MAX_STREAM_CHUNK) {
               if (value.length) await sendChunk(id, value);
+              // Empty iterable chunks also consume work without writing bytes.
+              if (++chunksSinceYield === STREAM_YIELD_CHUNKS) await yieldStream();
             } else {
               for (let offset = 0; offset < value.length; offset += MAX_STREAM_CHUNK) {
                 await sendChunk(id, value.subarray(offset, offset + MAX_STREAM_CHUNK));
+                if (++chunksSinceYield === STREAM_YIELD_CHUNKS) await yieldStream();
               }
             }
           }

package/runtime/worker-metadata.mjs

@@ -1,5 +1,28 @@
 // Only build manifests belong here. Never register headers, models, closures or
 // request contexts. Eviction is ordered on the same MessagePort as requests.
+const immutableClientManifests = new WeakSet();
+
+// Production build metadata comes from JSON and does not change until a new
+// worker loads the next build. Only explicitly sealed maps can skip validation;
+// callers using mutable manifests (including development) keep the old checks.
+export function freezeClientModules(value) {
+  if (!value || typeof value !== 'object') return value;
+  if (immutableClientManifests.has(value)) return value;
+  const entries = Object.getOwnPropertyDescriptors(value);
+  // An accessor may change even on a frozen object. Do not trust such a map.
+  if (!Object.values(entries).every(entry => Object.hasOwn(entry, 'value') &&
+      entry.value && typeof entry.value === 'object' &&
+      typeof Object.getOwnPropertyDescriptor(entry.value, 'ssrModule')?.value === 'string')) return value;
+  for (const entry of Object.values(entries)) Object.freeze(entry.value);
+  Object.freeze(value);
+  immutableClientManifests.add(value);
+  return value;
+}
+
+export function isImmutableClientModules(value) {
+  return immutableClientManifests.has(value);
+}
+
 export function workerMetadata(port, limit = 32) {
   const entries = new Map();
   let sequence = 0;

package/runtime/worker.mjs

@@ -2,6 +2,7 @@
 // prnext-concurrency:512
 import { requestFrames } from './request-transport.mjs';
 import { requestWork } from './request-work.mjs';
+import { freezeClientModules } from './worker-metadata.mjs';
 import { AsyncResource } from 'node:async_hooks';
 const workScope = new AsyncResource('PRNextWorkObserver', { triggerAsyncId: 0 });
 import { readFile } from 'node:fs/promises';
@@ -35,6 +36,7 @@ loadEnvConfig(projectRoot, { dev: !!manifest.dev });
 // browser graph and the RSC worker's mode, including dev launched from CI.
 process.env.NODE_ENV = manifest.dev ? 'development' : 'production';
 const production = !manifest.dev;
+if (production) freezeClientModules(manifest.app?.clientModules);
 // Load each renderer beside the application only when that request needs it.
 // Middleware and API workers do not pay for React or the Pages/App renderers.
 const runtimeModule = async name => {
@@ -58,6 +60,7 @@ let incrementalRuntime;
 
 async function handleRequest(input, output, signalController, responseComplete) {
   let responseStarted = false;
+  const finalizers = new Set();
   try {
     if (input.renderMode === 'incremental-cache' && input.routeId === '__prnext_incremental_cache') {
       incrementalRuntime ??= await runtimeModule('incremental-cache');
@@ -76,7 +79,7 @@ async function handleRequest(input, output, signalController, responseComplete)
     if (route.router !== 'app' && !['isr', 'error404', 'error500'].includes(input.renderMode) && route.fallback === false && !prerendered.has(requestedPath) && !prerendered.has(requestedPath.replace(/\/$/, '') || '/')) {
       await output(input.id, { status: 404, body: 'Not Found' }, input); return;
     }
-    const options = { ...input, modulePath: path.resolve(distDir, route.module), route, production, manifest, distDir, signal: signalController.signal };
+    const options = { ...input, modulePath: path.resolve(distDir, route.module), route, production, manifest, distDir, signal: signalController.signal, deferFinalizer: finalize => finalizers.add(finalize) };
     let result;
     if (isMiddleware) {
       middlewareRuntime ??= await import(pathToFileURL(path.join(distDir, 'runtime/middleware.mjs')).href);
@@ -105,11 +108,9 @@ async function handleRequest(input, output, signalController, responseComplete)
     input.body = undefined;
     options.body = undefined;
     responseStarted = true;
-    try {
-      await output(input.id, result, { ...input, production, signalController });
-      responseComplete?.();
-    }
-    finally { await result.finalizeCache?.(); }
+    if (result.finalizeCache) finalizers.add(result.finalizeCache);
+    await output(input.id, result, { ...input, production, signalController });
+    responseComplete?.();
   } catch (error) {
     const cancelled = signalController.signal.aborted || error instanceof ProtocolWriteError;
     signalController.abort(error);
@@ -122,6 +123,21 @@ async function handleRequest(input, output, signalController, responseComplete)
     // for its one error/redirect response. Do not mistake that cleanup signal
     // for a client disconnect while writing the replacement headers.
     await output(input?.id ?? null, navigationResponse(error) || errorResponse(error, production), { ...input, production });
+    responseComplete?.();
+  } finally {
+    if (finalizers.size) {
+      const pending = (async () => {
+        for (const finalize of finalizers) {
+          try { await finalize(); }
+          catch (error) { console.error('[prnext] Post-response work failed:', error?.stack || error); }
+        }
+      })();
+      // Release this socket's response lane while retaining worker activity.
+      // Otherwise an immediate follow-up request waits behind after() work.
+      const track = signalController.signal[requestWork];
+      if (track) track(pending);
+      else await pending;
+    }
   }
 }
 
@@ -173,7 +189,7 @@ if (token && laneLimit > 1) {
           if (invocations.size >= laneLimit) throw new Error('Worker invocation capacity exceeded');
           controller = new AbortController();
           const active = controller;
-          let pendingWork = 0, unsupervisedWork = 0, finished = false;
+          let pendingWork = 0, unsupervisedWork = 0, finished = false, backgroundDeadline = 0;
           invocations.add(active);
           announceActivity();
           active.signal[requestWork] = (promise, options) => {
@@ -183,6 +199,10 @@ if (token && laneLimit > 1) {
             // legitimate cache work merely because its HTTP body has ended.
             const supervised = options?.supervised === true;
             if (!supervised) unsupervisedWork++;
+            if (!supervised && Number.isFinite(options?.timeoutMs) && options.timeoutMs > 0 && options.timeoutMs <= 300000) {
+              backgroundDeadline = Math.max(backgroundDeadline, performance.now() + options.timeoutMs);
+              if (active.signal.aborted) { clearTimeout(workTimer); retireIfAbandoned(); }
+            }
             const settled = () => {
               pendingWork--;
               if (!supervised) unsupervisedWork--;
@@ -199,7 +219,7 @@ if (token && laneLimit > 1) {
             if (pendingWork && !unsupervisedWork) return;
             workTimer = setTimeout(() => {
               if (invocations.has(active) && (!pendingWork || unsupervisedWork)) process.exit(70);
-            }, 5000);
+            }, Math.max(5000, backgroundDeadline - performance.now()));
             workTimer.unref();
           };
           active.signal.addEventListener('abort', retireIfAbandoned, { once: true });
@@ -209,7 +229,7 @@ if (token && laneLimit > 1) {
             if (!pendingWork) { invocations.delete(active); clearTimeout(workTimer); }
             else {
               if (unsupervisedWork && !active.signal.aborted) {
-                workTimer = setTimeout(() => { if (invocations.has(active) && unsupervisedWork) process.exit(70); }, 30000);
+                workTimer = setTimeout(() => { if (invocations.has(active) && unsupervisedWork) process.exit(70); }, Math.max(30000, backgroundDeadline - performance.now()));
                 workTimer.unref();
               }
             }
@@ -259,4 +279,11 @@ if (token && laneLimit > 1) {
     try { await handleRequest(input, output, new AbortController()); }
     catch (error) { console.error('[prnext] Worker transport failed:', error?.stack || error); process.exit(1); }
   }
+  // The maintenance/ISR transport is serial and awaits its own finalizers.
+  // RSC settlement can still outlive its terminal frame; drain it explicitly
+  // before closing the isolate's MessagePorts after parent EOF.
+  if (appRuntime || appStaticRuntime) {
+    const runtime = appRuntime || await runtimeModule('app-render');
+    await runtime.drainAppRuntime();
+  }
 }