@thomas.f/prnext 0.1.12-alpha → 0.1.15-alpha

package/compat/index.d.ts

@@ -118,6 +118,8 @@ export interface NextConfig {
   workerRetirement?: { idleSeconds?: number; laneIdleSeconds?: number; keepWarm?: boolean };
   /** Next dev page-retention hints; PRNext builds all routes without that eviction queue. */
   onDemandEntries?: { maxInactiveAge?: number; pagesBufferLength?: number };
+  /** Disable the Next development indicator. Error overlays and Fast Refresh remain enabled. */
+  devIndicators?: false;
   i18n?: { locales: string[]; defaultLocale: string; localeDetection?: boolean; domains?: Array<{domain: string; defaultLocale: string; locales?: string[]; http?: boolean}> };
   webpack?: (config: import('webpack').Configuration, context: { buildId: string; dev: boolean; isServer: boolean; nextRuntime?: 'nodejs' | 'edge'; webpack: typeof import('webpack'); defaultLoaders: {babel: {loader: string}} }) => import('webpack').Configuration | Promise<import('webpack').Configuration>;
   turbopack?: { root?: string; rules?: Record<string, TurbopackRule | TurbopackRule[]>; resolveAlias?: Record<string, string | { browser: string }>; resolveExtensions?: string[] };
@@ -141,7 +143,7 @@ export interface NextConfig {
     implementation?: 'sass' | 'sass-embedded';
     [option: string]: unknown;
   };
-  experimental?: { nextScriptWorkers?: boolean; serverActions?: true | { allowedOrigins?: string[]; bodySizeLimit?: number | string } };
+  experimental?: { nextScriptWorkers?: boolean; optimizePackageImports?: string[]; proxyClientMaxBodySize?: number | string; serverActions?: true | { allowedOrigins?: string[]; bodySizeLimit?: number | string } };
   trailingSlash?: boolean;
   skipTrailingSlashRedirect?: boolean;
   skipMiddlewareUrlNormalize?: boolean;
@@ -166,4 +168,33 @@ export interface NextConfig {
   rewrites?: () => Rewrite[] | { beforeFiles?: Rewrite[]; afterFiles?: Rewrite[]; fallback?: Rewrite[] } | Promise<Rewrite[] | { beforeFiles?: Rewrite[]; afterFiles?: Rewrite[]; fallback?: Rewrite[] }>;
 }
 export type PRNextConfig = NextConfig;
+/** Public build envelope; internal manifest fields are adapter-specific. */
+export type BuildOutput = {
+  version: 1;
+  buildId: string;
+  manifest: 'manifest.json';
+} & ({
+  adapter: 'react';
+  assets: 'assets';
+  server: { entry: 'runtime/worker.mjs'; runtimeContract: 'runtime-contract.json' };
+  fallback: null;
+} | {
+  adapter: 'static';
+  assets: 'static';
+  server: null;
+  fallback: null | 'index.html';
+});
+export interface StaticBuildOptions {
+  from?: string;
+  spa?: boolean;
+  distDir?: string;
+  dev?: false;
+}
+export interface BuildResult { buildId: string; outputDirectory: string; }
+export interface StaticBuildResult extends BuildResult { files: number; bytes: number; }
+export function build(projectRoot: string, options: StaticBuildOptions & { adapter: 'static' }): Promise<StaticBuildResult>;
+export function build(projectRoot: string, options?: { adapter?: 'react'; dev?: boolean; envMode?: 'production' | 'development' | 'test' }): Promise<BuildResult>;
+export function buildStatic(projectRoot: string, options?: StaticBuildOptions): Promise<StaticBuildResult>;
+export function readBuildOutput(buildDirectory: string): Promise<BuildOutput>;
+export function validateBuildOutput(value: unknown): BuildOutput;
 export type { DocumentContext, DocumentInitialProps, DocumentProps } from './document.cjs';

package/compat/server.cjs

@@ -1,5 +1,6 @@
 'use strict';
 const { NextRequest, NextResponse, NextURL } = require('./server-primitives.cjs');
+const { after } = require('./after.cjs');
 
 async function connection() {
   const context = require('./headers.cjs').currentRequest();
@@ -10,4 +11,4 @@ async function connection() {
   dynamicUsage('connection()', context);
 }
 
-module.exports = { NextRequest, NextResponse, NextURL, connection };
+module.exports = { NextRequest, NextResponse, NextURL, connection, after };

package/compat/server.d.cts

@@ -35,3 +35,5 @@ export interface MiddlewareConfig {
 export interface ProxyConfig { matcher?: MiddlewareConfig['matcher'] }
 /** Exclude the following render from prerendering until a request is available. */
 export function connection(): Promise<void>;
+/** Post-response work in Node Route Handlers. Other after() lifecycles fail explicitly. */
+export function after(task: Promise<unknown> | (() => unknown)): void;

package/index.mjs

@@ -1 +1,3 @@
 export { build } from './build/index.mjs';
+export { buildStatic } from './build/static-adapter.mjs';
+export { readBuildOutput, validateBuildOutput } from './build/output-contract.mjs';

package/native/launch.mjs

@@ -0,0 +1,19 @@
+// A production CLI has nothing to supervise once the native server starts.
+// On supported Linux Node releases, replace it instead of retaining a Node heap.
+// Keep the portable parent/pipe lifecycle for Windows, older Node, IPC callers
+// and instrumentation which may own descriptors or need JS exit handlers.
+export function replaceWithNative(binary, args, env, runtime = process) {
+  const options = [...(runtime.execArgv || []), env.NODE_OPTIONS || ''].join(' ');
+  // Only heap sizing is known not to require the Node launcher's lifetime.
+  // Be conservative for all other Node flags, including future diagnostics,
+  // loaders, preloads, permissions and signal-triggered reports/snapshots.
+  const customRuntime = options.replace(/(?:^|\s)--max[-_](?:semi|old)[-_]space[-_]size(?:=|\s+)\d+(?=\s|$)/g, '').trim();
+  if (runtime.platform !== 'linux' || typeof runtime.execve !== 'function'
+    || typeof runtime.send === 'function' || env.NODE_V8_COVERAGE || customRuntime) return false;
+  // execve keeps stdin/out/err and the PID. No parent pipe is needed: signals
+  // reach Rust directly, and its worker pipes still supervise every Node child.
+  // The marker also makes an old native binary fail clearly instead of using
+  // this lifecycle without the Linux parent-death guard it requires.
+  runtime.execve(binary, [binary, ...args, '--cli-exec'], env);
+  return true; // Only reached by injected test runtimes; real execve never returns.
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thomas.f/prnext",
-  "version": "0.1.12-alpha",
+  "version": "0.1.15-alpha",
   "license": "MIT",
   "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
   "homepage": "https://prnext.dev",
@@ -111,7 +111,6 @@
     "@babel/types": "^7.29.0",
     "@edge-runtime/vm": "5.0.0",
     "@vercel/nft": "1.11.0",
-    "@vercel/og": "1.0.3",
     "dotenv": "16.6.1",
     "dotenv-expand": "11.0.7",
     "esbuild": "^0.28.2",
@@ -133,14 +132,14 @@
     "react-server-dom-webpack": "19.3.0"
   },
   "optionalDependencies": {
-    "prnext-darwin-arm64": "0.1.12-alpha",
-    "prnext-darwin-x64": "0.1.12-alpha",
-    "prnext-linux-arm64-gnu": "0.1.12-alpha",
-    "prnext-linux-x64-gnu": "0.1.12-alpha",
-    "@thomas.f/prnext-win32-x64-msvc": "0.1.12-alpha",
-    "@thomas.f/prnext-win32-arm64-msvc": "0.1.12-alpha"
+    "prnext-darwin-arm64": "0.1.15-alpha",
+    "prnext-darwin-x64": "0.1.15-alpha",
+    "prnext-linux-arm64-gnu": "0.1.15-alpha",
+    "prnext-linux-x64-gnu": "0.1.15-alpha",
+    "@thomas.f/prnext-win32-x64-msvc": "0.1.15-alpha",
+    "@thomas.f/prnext-win32-arm64-msvc": "0.1.15-alpha"
   },
   "engines": {
-    "node": ">=22"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   }
 }

package/release/verify.mjs

@@ -22,6 +22,8 @@ export async function verifyPackage() {
   }
   await exported(pkg.exports);
   await access(path.join(packageRoot, 'runtime/profiles.json'));
+  for (const name of ['index.node.mjs', 'resvg.wasm', 'hb.wasm', 'Geist-Regular.ttf', 'LICENSE', 'LICENSE.fflate', 'LICENSE.Geist', 'LICENSE.harfbuzzjs', 'LICENSE.satori', 'NOTICE.txt']) await access(path.join(packageRoot, 'runtime/og', name));
+  if (pkg.dependencies['@vercel/og'] || (await readFile(path.join(packageRoot, 'runtime/og/index.node.mjs'), 'utf8')).includes('fflate@0.7.3')) throw new Error('OG renderer still depends on vulnerable upstream fflate. Run scripts/prepare-og.mjs.');
   const source = sourceCheckout();
   if (source) {
     const cargo = await readFile(path.join(source, 'crates/prnext/Cargo.toml'), 'utf8');

package/runtime/api.mjs

@@ -131,7 +131,7 @@ async function runStreamingPagesApi(handler, request, { method, signal, timeoutM
   const timer = setTimeout(() => cancelRequest(apiTimeoutError('response headers', timeoutMs)), timeoutMs);
   timer.unref();
   if (controller.signal.aborted) cancelRequest(abortError(controller.signal.reason));
-  else trackRequestWork(Promise.resolve().then(() => handler(request, response)), signal).then(result => {
+  else trackRequestWork(Promise.resolve().then(() => handler(request, response)), signal, { timeoutMs }).then(result => {
     if (result !== undefined && result !== response && !response.writableEnded) {
       throw new Error('Pages API handlers must send their response with res.send(), res.json(), or res.end()');
     }
@@ -178,6 +178,7 @@ function parseBody(bytes, contentType = '') {
 }
 
 export function runApi(options) {
+  if (options.timeoutMs === undefined && options.route?.cacheConfig?.maxDuration) options = { ...options, timeoutMs: options.route.cacheConfig.maxDuration * 1000 };
   return withCacheRequest(options, options.route?.router === 'app' ? 'route' : 'pages', context => runApiInner(options, context));
 }
 
@@ -189,11 +190,19 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
   const mod = (pages && loadedPagesModule(modulePath)) || await withSignal(loadModule(modulePath, pages), stream ? signal : undefined);
   const requestOriginal = originalUrl ? new URL(originalUrl, url) : undefined;
   if (requestOriginal) requestOriginal.pathname = removeBasePath(requestOriginal.pathname, manifest.config?.basePath || '');
-  const { request, bytes } = createRequest({ url, originalUrl: requestOriginal?.href, params, method, headers, body });
-  request.draftMode = cacheContext.draftMode;
-  request.previewData = cacheContext.previewData;
-  request.preview = cacheContext.previewData !== false;
-  if (typeof mod.default !== 'function') {
+  const appHandler = typeof mod.default !== 'function';
+  // App Route Handlers receive a NextRequest below. Constructing the Pages
+  // IncomingMessage here duplicates URL, header and cookie work and allocates
+  // an unused Duplex. Keep the existing Pages request path unchanged.
+  const { request, bytes } = appHandler
+    ? { bytes: Buffer.isBuffer(body) ? body : Buffer.from(body || '', 'base64') }
+    : createRequest({ url, originalUrl: requestOriginal?.href, params, method, headers, body });
+  if (!appHandler) {
+    request.draftMode = cacheContext.draftMode;
+    request.previewData = cacheContext.previewData;
+    request.preview = cacheContext.previewData !== false;
+  }
+  if (appHandler) {
     const {NextRequest, proxyRouteRequest} = await appRequestPrimitives();
     if (route.router === 'app' && manifest.dev) {
       const listing = await collectStaticParams({ page: mod, pageConfig: route.handlerConfig, segments: [] }, route.pattern);
@@ -221,6 +230,7 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
     const timeout = lifecycle && setTimeout(() => lifecycle.controller.abort(apiTimeoutError('response headers', timeoutMs)), timeoutMs);
     timeout?.unref();
     const pendingResponse = runRequestContext({ url, method, headers, params, production, cacheComponents: manifest.config?.cacheComponents, cacheLife: manifest.config?.cacheLife, cacheHandlers: manifest.config?.cacheHandlers, cacheHandler: manifest.config?.cacheHandler, cacheMaxMemorySize: manifest.config?.cacheMaxMemorySize, distDir: path.dirname(path.dirname(modulePath)), signal: lifecycle?.controller.signal || signal, previewModeId: manifest.previewModeId, basePath: manifest.config?.basePath || '', routePattern: route.pattern, cacheConfig: route.cacheConfig, phase: 'route', cacheState: cacheContext.cacheState, staticState: cacheContext.staticState, mutableCookies: true }, async () => {
+      currentRequest().afterScope = cacheContext.afterScope;
       let result;
       try { result = await handler(proxyRouteRequest(new NextRequest(requestOriginal || url, init), currentRequest()), { params: Promise.resolve(params) }); }
       catch (error) {
@@ -245,7 +255,10 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
     if (lifecycle) pendingResponse.then(({ result }) => {
       if (lifecycle.controller.signal.aborted) result?.body?.cancel(lifecycle.controller.signal.reason).catch(() => {});
     }, () => {});
-    trackRequestWork(pendingResponse, signal);
+    // A client disconnect does not cancel arbitrary npm/database promises.
+    // Let them settle within this route's existing deadline before retiring the
+    // shared worker; the shorter orphan guard would interrupt other visitors.
+    trackRequestWork(pendingResponse, signal, { timeoutMs });
     let result, changedCookies, runInContext;
     try {
       ({ result, changedCookies, runInContext } = await withSignal(pendingResponse, lifecycle?.controller.signal));

package/runtime/app-render.mjs

@@ -7,7 +7,7 @@ import { addBasePath, removeBasePath } from '../compat/paths.cjs';
 import { isDynamicBailout } from '../compat/dynamic-bailout.cjs';
 import { Readable } from 'node:stream';
 import { Worker } from 'node:worker_threads';
-import { workerMetadata } from './worker-metadata.mjs';
+import { workerMetadata, freezeClientModules, isImmutableClientModules } from './worker-metadata.mjs';
 import { workerArtifacts } from './worker-artifacts.mjs';
 import path from 'node:path';
 import { PARTIAL_PREFETCH_TYPE, PARTIAL_PREFETCH_BYTES } from './app-prefetch.mjs';
@@ -40,6 +40,7 @@ const edgeManifests = new WeakMap();
 const emptyManifest = Object.freeze({});
 let nextId = 0;
 const pending = new Map();
+const noop = () => {};
 // Avoid temporary arrays on every completion/cancellation at high concurrency.
 function hasPending(worker, minimum = 1, cancelledOnly = false) {
   let count = 0;
@@ -72,14 +73,14 @@ function flightDecoder(production) {
     // React's development decoder guards module initialization with NODE_ENV.
     // This require is synchronous; restore the host before any stream work.
     process.env.NODE_ENV = production ? 'production' : 'development';
-    let decoder = require(filename).createFromNodeStream;
-    if (typeof decoder !== 'function') {
+    let decoder = require(filename);
+    if (typeof decoder.createFromNodeStream !== 'function') {
       // A consumer may have previously required the guarded development file
       // in production, leaving an empty module in Node's cache.
       delete require.cache[filename];
-      decoder = require(filename).createFromNodeStream;
+      decoder = require(filename);
     }
-    if (typeof decoder !== 'function') throw new Error('React Flight decoder is unavailable for the requested render mode');
+    if (typeof decoder.createFromNodeStream !== 'function') throw new Error('React Flight decoder is unavailable for the requested render mode');
     flightDecoders.set(production, decoder);
     return decoder;
   } finally {
@@ -182,7 +183,7 @@ function getWorker(production) {
     }
     if (type === 'chunk') {
       try { request.channel.chunk(chunk, byteOffset, byteLength); }
-      catch (error) { request.channel.error(error); current.postMessage({ id, type: 'cancel' }); request.cancel(error); }
+      catch (error) { request.channel.error(error); current.postMessage({ id, type: 'cancel' }); request.cancel(error); return; }
       if (!done) return;
     }
     if (request.completed) {
@@ -194,6 +195,8 @@ function getWorker(production) {
     // work can legitimately continue afterwards and retains its own bounds;
     // supervise isolate responsiveness, not total background-task duration.
     clearTimeout(request.timeout);
+    // A destroyed Timeout can still own its AsyncLocalStorage frame.
+    request.timeout = undefined;
     request.releaseWorkWatch = workWatchdog.add();
     request.detach?.();
     if (type === 'end' || done) request.channel.end();
@@ -219,7 +222,11 @@ function getWorker(production) {
     // Keep only settlement bookkeeping after sending the body. The
     // isolate can still be flushing cache writes after its terminal frame.
     request.channel = undefined;
-    request.resolve = request.reject = () => {};
+    // Both closures capture the original response promise / AbortSignal.
+    // Detaching the listener alone does not release those references while
+    // legitimate background work keeps this entry in the pending map.
+    request.cancel = request.detach = undefined;
+    request.resolve = request.reject = noop;
   });
   current.on('error', fail);
   current.on('exit', code => fail(new Error(`App Router worker exited (${code})`), true));
@@ -227,12 +234,41 @@ function getWorker(production) {
   return current;
 }
 
+// Stdio workers can retain referenced MessagePorts after rendering (including
+// diagnostics piped from the RSC isolate). EOF must drain real cache/after()
+// settlement before explicitly closing those isolates, not wait for Node's
+// incidental event-loop liveness or terminate unfinished application work.
+export async function drainAppRuntime() {
+  while (pending.size) await Promise.all([...pending.values()].map(request => request.settled));
+  await closeAppRuntime();
+}
+
 export function closeAppRuntime() {
   const current = [...workers.values()];
   return Promise.all(current.map(worker => lifecycles.get(worker).terminate()));
 }
 
-export async function renderFlight(request, { softTimeoutMs = 25_000, hardTimeoutMs = 28_000, signal } = {}) {
+function requestDeadline(entry, lifecycle, id, hardTimeoutMs, delayMs) {
+  // Keep this callback outside renderFlight's request closure: cancelled work
+  // retains its hard deadline, but must not thereby retain the HTTP signal or
+  // response promise until an unrelated cache write settles.
+  return setTimeout(() => {
+    // A blocking npm dependency cannot honor an AbortSignal. Retire the
+    // isolate at the hard deadline so subsequent requests can recover.
+    void lifecycle.terminate(appTimeoutError('RSC worker', hardTimeoutMs)).finally(entry.settle).catch(error => console.error('[prnext] RSC worker termination failed:', error));
+    pending.delete(id);
+    entry.lease.release();
+    const error = appTimeoutError('RSC worker', hardTimeoutMs);
+    if (entry.completed) console.error('[prnext] RSC background work failed:', error);
+    entry.channel?.error(error);
+    entry.detach?.();
+    entry.reject(error);
+  }, delayMs);
+}
+
+export async function renderFlight(request, { softTimeoutMs, hardTimeoutMs, signal, deferFinalizer } = {}) {
+  softTimeoutMs ??= request.cacheConfig?.maxDuration ? request.cacheConfig.maxDuration * 1000 : 25_000;
+  hardTimeoutMs ??= request.cacheConfig?.maxDuration ? request.cacheConfig.maxDuration * 1000 : 28_000;
   const deadline = performance.now() + hardTimeoutMs;
   let current, lifecycle, lease;
   for (;;) {
@@ -254,20 +290,10 @@ export async function renderFlight(request, { softTimeoutMs = 25_000, hardTimeou
     current.ref();
     const id = ++nextId;
     let settle;
-    trackRequestWork(new Promise(resolve => { settle = resolve; }), signal, { deadline, supervised: true });
-    const timeout = setTimeout(() => {
-      // A blocking npm dependency cannot honor an AbortSignal. Retire the
-      // isolate at the hard deadline so subsequent requests can recover.
-      void lifecycle.terminate(appTimeoutError('RSC worker', hardTimeoutMs)).finally(settle).catch(error => console.error('[prnext] RSC worker termination failed:', error));
-      pending.delete(id);
-      lease.release();
-      const error = appTimeoutError('RSC worker', hardTimeoutMs);
-      if (entry.completed) console.error('[prnext] RSC background work failed:', error);
-      entry.channel?.error(error);
-      entry.detach?.();
-      reject(error);
-    }, Math.max(0, deadline - performance.now()));
-    const entry = { worker: current, resolve, reject, timeout, operation: request.operation, lease, settle };
+    const settled = new Promise(resolve => { settle = resolve; });
+    trackRequestWork(settled, signal, { deadline, supervised: true });
+    const entry = { worker: current, resolve, reject, operation: request.operation, lease, settle, settled };
+    const timeout = entry.timeout = requestDeadline(entry, lifecycle, id, hardTimeoutMs, Math.max(0, deadline - performance.now()));
     function cancel(reason) {
       if (entry.cancelled) return;
       // Keep the independent deadline until the isolate confirms settlement.
@@ -278,7 +304,11 @@ export async function renderFlight(request, { softTimeoutMs = 25_000, hardTimeou
       // Pause new work at 16 abandoned requests while their acknowledgements
       // settle. Existing mutation/cache work keeps its original hard deadline.
       if (!hasPending(current) && !lifecycle.retiring) current.unref();
-      reject(reason instanceof Error ? reason : new Error('App Router response was cancelled'));
+      entry.reject(reason instanceof Error ? reason : new Error('App Router response was cancelled'));
+      // Settlement/deadline tracking remains live, but a disconnected caller
+      // no longer needs its stream, promise or signal retained by this entry.
+      entry.channel = entry.cancel = entry.detach = undefined;
+      entry.resolve = entry.reject = noop;
     }
     entry.cancel = cancel;
     if (request.stream) entry.channel = parentStreamChannel(current, id, cancel);
@@ -294,6 +324,10 @@ export async function renderFlight(request, { softTimeoutMs = 25_000, hardTimeou
     pending.set(id, entry);
     try {
       const wire = { ...request, renderTimeoutMs: Math.min(softTimeoutMs, Math.max(1, deadline - performance.now())) };
+      if (request.action && deferFinalizer) {
+        wire.waitForResponse = true;
+        deferFinalizer(() => { if (pending.has(id)) current.postMessage({ id, type: 'after-response' }); });
+      }
       if (request.production) {
         const artifactId = artifacts.get(current)(wire.partialFlight);
         if (artifactId !== undefined) { wire.partialFlightId = artifactId; delete wire.partialFlight; }
@@ -317,11 +351,12 @@ export async function renderFlight(request, { softTimeoutMs = 25_000, hardTimeou
 }
 
 export async function decodeFlight(body, clientModules = {}, distDir, { production = process.env.NODE_ENV === 'production' } = {}) {
-  const ids = Object.keys(clientModules);
   let cached = ssrManifests.get(clientModules);
   // Keep only the manifest's module mapping, never a decoded React model or
   // request context. Weak ownership releases it with the build manifest.
-  if (!cached || cached.distDir !== distDir || ids.length !== cached.paths.size || ids.some(id => cached.paths.get(id) !== clientModules[id].ssrModule)) {
+  const immutable = isImmutableClientModules(clientModules);
+  const ids = cached && cached.distDir === distDir && cached.immutable && immutable ? null : Object.keys(clientModules);
+  if (!cached || cached.distDir !== distDir || (ids && (ids.length !== cached.paths.size || ids.some(id => cached.paths.get(id) !== clientModules[id].ssrModule)))) {
     const moduleMap = Object.create(null), paths = new Map();
     for (const id of ids) {
       const item = clientModules[id];
@@ -332,13 +367,20 @@ export async function decodeFlight(body, clientModules = {}, distDir, { producti
       moduleMap[id] = { '*': { id: moduleUrl, chunks: [moduleUrl, moduleUrl], name: '*' } };
       paths.set(id, item.ssrModule);
     }
-    cached = { distDir, paths, moduleMap };
+    cached = { distDir, paths, moduleMap, immutable };
     ssrManifests.set(clientModules, cached);
-  }
+  } else if (immutable) cached.immutable = true;
   // Hosts can build/render both modes in one process. The encoded protocol,
   // rather than the host's current environment or import cache, selects React.
   const decoder = flightDecoder(Boolean(production));
-  return decoder(body instanceof ReadableStream ? Readable.fromWeb(body) : Readable.from([body]), { moduleMap: cached.moduleMap, serverModuleMap: null, moduleLoading: null });
+  const serverConsumerManifest = { moduleMap: cached.moduleMap, serverModuleMap: null, moduleLoading: null };
+  // React's Node decoder can consume Web streams directly. Keep the Flight
+  // bytes in their original stream instead of allocating a Node Readable,
+  // forwarding its events and buffering a second queue for each response.
+  if (body instanceof ReadableStream && typeof decoder.createFromReadableStream === 'function') {
+    return decoder.createFromReadableStream(body, { serverConsumerManifest });
+  }
+  return decoder.createFromNodeStream(body instanceof ReadableStream ? Readable.fromWeb(body) : Readable.from([body]), serverConsumerManifest);
 }
 
 export async function renderHtml(tree, router, { timeoutMs = 25_000, formState = null, staticGeneration = false, nonce, strictMode = true } = {}) {
@@ -414,13 +456,16 @@ export async function renderAppPage(options) {
   return response;
 }
 
-async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distDir = path.dirname(path.dirname(modulePath)), url = 'http://localhost/', originalUrl, params = {}, method = 'GET', headers = {}, routingRequestHeaders, routingResolver, body = '', production = process.env.NODE_ENV === 'production', stream = false, signal }) {
+async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distDir = path.dirname(path.dirname(modulePath)), url = 'http://localhost/', originalUrl, params = {}, method = 'GET', headers = {}, routingRequestHeaders, routingResolver, body = '', production = process.env.NODE_ENV === 'production', stream = false, signal, deferFinalizer }) {
   let clientModules = manifest.app?.clientModules || emptyManifest;
   if (route.cacheConfig?.runtime === 'edge') {
     let edge = !manifest.dev && edgeManifests.get(clientModules);
     if (!edge) {
       edge = Object.fromEntries(Object.entries(clientModules).map(([id, item]) => [id, item.edgeSsrModule ? { ...item, ssrModule: item.edgeSsrModule } : item]));
-      if (!manifest.dev) edgeManifests.set(clientModules, edge);
+      if (!manifest.dev) {
+        if (isImmutableClientModules(clientModules)) freezeClientModules(edge);
+        edgeManifests.set(clientModules, edge);
+      }
     }
     clientModules = edge;
   }
@@ -490,7 +535,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
   if (stream && (!request.action || request.action.id)) {
     let progressive;
     try {
-      progressive = await renderFlight({ ...request, stream: true }, { signal });
+      progressive = await renderFlight({ ...request, stream: true }, { signal, deferFinalizer });
       const rsc = Object.entries(headers).some(([name, value]) => name.toLowerCase() === 'rsc' && value === '1');
       if (rsc || request.action?.id) {
         if (method === 'HEAD') await progressive.body.cancel();
@@ -514,7 +559,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
     }
   }
   let result;
-  try { result = await renderFlight(request, { signal }); }
+  try { result = await renderFlight(request, { signal, deferFinalizer }); }
   catch (error) {
     const result = navigationResponse(error);
     if (result) return { ...result, headers: { ...responseHeaders, ...result.headers, ...error.responseHeaders } };
@@ -531,7 +576,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
   let html, model, recovery = false;
   try {
     model = await decodeFlight(result.body, clientModules, distDir, { production });
-    html = await renderHtml(model.tree, model.router, { formState: model.formState, nonce: request.nonce, strictMode: manifest.config?.reactStrictMode !== false });
+    html = await renderHtml(model.tree, model.router, { timeoutMs: route.cacheConfig?.maxDuration ? route.cacheConfig.maxDuration * 1000 : undefined, formState: model.formState, nonce: request.nonce, strictMode: manifest.config?.reactStrictMode !== false });
   } catch (error) {
     if (error?.statusCode === 504) throw error;
     const navigation = navigationResponse(error);

package/runtime/app-route-plan.mjs

@@ -0,0 +1,45 @@
+// Cache only the compiler-owned, immutable routing scaffold. Component modules,
+// configuration, request parameters and rendered trees are never memoized here.
+const plans = new WeakMap();
+const liveTrees = new WeakSet();
+const ownValue = (object, name) => Object.getOwnPropertyDescriptor(object, name)?.value;
+function frozenRecord(value) {
+  if (!value || typeof value !== 'object' || !Object.isFrozen(value)) return false;
+  const prototype = Object.getPrototypeOf(value);
+  if (Array.isArray(value) ? prototype !== Array.prototype : prototype !== Object.prototype && prototype !== null) return false;
+  if (Array.isArray(value) && Object.hasOwn(value, Symbol.iterator)) return false;
+  return Reflect.ownKeys(value).every(key => 'value' in Object.getOwnPropertyDescriptor(value, key));
+}
+
+/** Mutable development/custom trees continue through the live traversal. */
+export function appRoutePlan(root) {
+  if (!root || !Object.isFrozen(root)) return null;
+  const existing = plans.get(root);
+  if (existing) return existing;
+  if (liveTrees.has(root)) return null;
+  const pages = [], nodes = new Map(), rootLayouts = new Set();
+  let sequence = 0;
+  function visit(node, chain, branch, hasLayout) {
+    if (!frozenRecord(node)) return false;
+    const children = ownValue(node, 'children'), slots = ownValue(node, 'slots'), files = ownValue(node, 'files');
+    if (!Array.isArray(children) || !frozenRecord(children) || !frozenRecord(slots) || !frozenRecord(files)
+      || typeof ownValue(node, 'path') !== 'string' || typeof ownValue(node, 'pattern') !== 'string'
+      || typeof ownValue(node, 'segment') !== 'string' || nodes.has(node)) return false;
+    // Bound retained chains even for hand-written frozen manifests.
+    if (sequence >= 4096 || chain.length >= 64) return false;
+    const next = [...chain, node], start = sequence++;
+    const info = { start, end: start, depth: chain.length, branch, slots: Object.entries(slots), metadataSlots: Object.entries(slots).sort(([a], [b]) => a.localeCompare(b)) };
+    nodes.set(node, info);
+    if (files.layout && !hasLayout) rootLayouts.add(node.path);
+    if (files.page) pages.push({ node, chain: next, start, branch,
+      score: node.pattern.split('/').filter(Boolean).reduce((sum, value) => sum + (value.startsWith('[[...') ? 0 : value.startsWith('[...') ? 1 : value.startsWith('[') ? 3 : 6), 0) });
+    for (const child of children) if (!visit(child, next, branch, hasLayout || !!files.layout)) return false;
+    for (const child of Object.values(slots)) if (!visit(child, next, child, hasLayout || !!files.layout)) return false;
+    info.end = sequence;
+    return true;
+  }
+  if (!visit(root, [], root, false)) { liveTrees.add(root); return null; }
+  const plan = { pages, nodes, rootLayouts };
+  plans.set(root, plan);
+  return plan;
+}

package/runtime/app-routing-state.mjs

@@ -1,26 +1,98 @@
 // Route matching and navigation state do not need React or metadata rendering.
 import { removeBasePath } from '../compat/paths.cjs';
 
-export function matchAppPattern(pattern, pathname, prefix = false) {
-  const expected = pattern.split('/').filter(Boolean), raw = pathname.split('/').filter(Boolean);
-  let parts;
-  try { parts = raw.map(decodeURIComponent); } catch { return null; }
-  const params = {};
-  for (let index = 0; index < expected.length; index++) {
-    const segment = expected[index];
+// Only trusted route syntax is cached, never URLs, decoded parameters or request
+// state. Bound the shared lookup's entry count and retained text/segments.
+const patterns = new Map();
+// Live manifest entries own their parsed syntax weakly. Large route tables must
+// not churn the bounded cross-call cache once for every saved parallel slot.
+// Their lifetime follows the existing manifest; no old manifest is retained.
+// Re-read the pattern on each use so mutable development manifests stay live.
+const routePatterns = new WeakMap();
+let patternCharacters = 0, patternSegments = 0;
+function compilePattern(pattern) {
+  let compiled = patterns.get(pattern);
+  if (compiled) return compiled;
+  const segments = pattern.split('/').filter(Boolean);
+  const kinds = new Uint8Array(segments.length);
+  let score = 0;
+  for (let index = 0; index < segments.length; index++) {
+    const segment = segments[index];
+    if (segment[0] !== '[') { score += 6; continue; }
+    score += segment.startsWith('[[...') ? 0 : segment.startsWith('[...') ? 1 : 3;
     const optional = /^\[\[\.\.\.([^\]]+)\]\]$/.exec(segment);
     const catchAll = /^\[\.\.\.([^\]]+)\]$/.exec(segment);
     if (optional || catchAll) {
-      if (catchAll && index >= parts.length) return null;
-      if (index < parts.length) params[(optional || catchAll)[1]] = parts.slice(index);
-      return params;
+      kinds[index] = optional ? 3 : 2;
+      segments[index] = (optional || catchAll)[1];
+    } else {
+      const dynamic = /^\[([^\]]+)\]$/.exec(segment);
+      if (dynamic) { kinds[index] = 1; segments[index] = dynamic[1]; }
+    }
+  }
+  compiled = { segments, kinds, score, characters: pattern.length };
+  if (pattern.length <= 2048 && segments.length <= 64) {
+    while (patterns.size >= 1024 || patternCharacters + pattern.length > 128 * 1024 || patternSegments + segments.length > 8192) {
+      const oldest = patterns.keys().next().value;
+      const removed = patterns.get(oldest);
+      patterns.delete(oldest);
+      patternCharacters -= removed.characters;
+      patternSegments -= removed.segments.length;
     }
-    const dynamic = /^\[([^\]]+)\]$/.exec(segment);
-    if (index >= parts.length) return null;
-    if (dynamic) params[dynamic[1]] = parts[index];
-    else if (segment !== parts[index]) return null;
+    patterns.set(pattern, compiled);
+    patternCharacters += pattern.length;
+    patternSegments += segments.length;
   }
-  return prefix || expected.length === parts.length ? params : null;
+  return compiled;
+}
+
+function pathSegments(pathname) {
+  const raw = pathname.split('/').filter(Boolean);
+  try { return raw.map(decodeURIComponent); }
+  catch { return null; }
+}
+
+function compiledRoute(route) {
+  const pattern = route.pattern;
+  const cached = routePatterns.get(route);
+  if (cached && cached.pattern === pattern) return cached.compiled;
+  const compiled = compilePattern(pattern);
+  if (pattern.length <= 2048 && compiled.segments.length <= 64) routePatterns.set(route, { pattern, compiled });
+  else routePatterns.delete(route);
+  return compiled;
+}
+
+function matchesParts({ segments, kinds }, parts, prefix = false, params) {
+  for (let index = 0; index < segments.length; index++) {
+    const kind = kinds[index];
+    if (kind >= 2) {
+      if (kind === 2 && index >= parts.length) return false;
+      if (params && index < parts.length) params[segments[index]] = parts.slice(index);
+      return true;
+    }
+    if (index >= parts.length) return false;
+    if (kind === 1) { if (params) params[segments[index]] = parts[index]; }
+    else if (segments[index] !== parts[index]) return false;
+  }
+  return prefix || segments.length === parts.length;
+}
+
+export function matchAppPattern(pattern, pathname, prefix = false) {
+  const compiled = compilePattern(pattern), parts = pathSegments(pathname);
+  if (!parts) return null;
+  const params = {};
+  return matchesParts(compiled, parts, prefix, params) ? params : null;
+}
+
+/** Decode a request pathname once; each match still owns its parameter values. */
+export function createAppMatcher(pathname) {
+  const parts = pathSegments(pathname);
+  return (pattern, prefix = false) => {
+    const compiled = compilePattern(pattern);
+    if (!parts) return null;
+    const params = {};
+    return matchesParts(compiled, parts, prefix, params) ? params : null;
+  };
 }
 
 export function readRouterState(request) {
@@ -49,13 +121,21 @@ export function advancedRoutingSources(request, routes) {
   const modules = new Set();
   for (const saved of Object.values(state.slots)) {
     const pathname = new URL(saved.url, 'http://prnext.local').pathname;
-    const route = routes.filter(item => item.router === 'app' && item.kind === 'page' && !item.internal && matchAppPattern(item.pattern, pathname))
-      .sort((a, b) => score(b.pattern) - score(a.pattern))[0];
+    const parts = pathSegments(pathname);
+    if (!parts) continue;
+    let route, bestScore = -1;
+    for (let index = 0, length = routes.length; index < length; index++) {
+      if (!(index in routes)) continue;
+      const item = routes[index];
+      if (item.router !== 'app' || item.kind !== 'page' || item.internal) continue;
+      const compiled = compiledRoute(item);
+      // The original stable sort kept the first route when scores were equal.
+      // Lower-scoring routes cannot replace a match already found.
+      if (compiled.score <= bestScore || !matchesParts(compiled, parts)) continue;
+      route = item;
+      bestScore = compiled.score;
+    }
     if (route) modules.add(route.module);
   }
   return [...modules];
 }
-
-function score(pattern) {
-  return pattern.split('/').filter(Boolean).reduce((sum, value) => sum + (value.startsWith('[[...') ? 0 : value.startsWith('[...') ? 1 : value.startsWith('[') ? 3 : 6), 0);
-}