@thomas.f/prnext 0.1.13-alpha → 0.1.15-alpha

package/build/static-adapter.mjs

@@ -0,0 +1,100 @@
+import { constants } from 'node:fs';
+import { copyFile, lstat, mkdir, readdir, realpath, rm, stat, writeFile } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { rename } from '../runtime/fs.mjs';
+import { OUTPUT_POINTER, prepareBuildDirectory, readBuildDirectory, validateDistDir } from '../runtime/build-directory.mjs';
+import { writeBuildOutput } from './output-contract.mjs';
+import { precompressBuild } from './precompress.mjs';
+import { withBuildLock } from './build-lock.mjs';
+
+const MAX_FILES = 20000, MAX_BYTES = 512 * 1024 * 1024;
+const inside = (root, file) => file.startsWith(root + path.sep);
+const urlFor = file => '/' + file.split('/').map(encodeURIComponent).join('/');
+
+/** Import an already-built public directory. Never evaluate its config or code. */
+export async function buildStatic(directory, { from = 'dist', spa = false, distDir, dev = false } = {}) {
+  return withBuildLock(directory, root => importStatic(root, { from, spa, distDir, dev }));
+}
+
+async function importStatic(directory, { from, spa, distDir, dev }) {
+  if (dev) throw new Error('The static adapter imports production files; use the source framework for development.');
+  if (typeof spa !== 'boolean') throw new TypeError('spa must be a boolean');
+  const root = await realpath(directory);
+  // Reuse the output-directory restrictions to keep imports within this project
+  // and away from source/dependency/repository trees.
+  const relative = validateDistDir(from);
+  const output = distDir === undefined ? await readBuildDirectory(root) : validateDistDir(distDir);
+  const source = path.join(root, relative), destination = await prepareBuildDirectory(root, output);
+  if (source === destination || inside(source, destination) || inside(destination, source)) throw new Error('Static input and PRNext output directories must not overlap.');
+  let ancestor = root;
+  for (const part of relative.split('/')) {
+    ancestor = path.join(ancestor, part);
+    const entry = await lstat(ancestor);
+    if (entry.isSymbolicLink() || !entry.isDirectory()) throw new Error('Static input must use real directories, not symbolic links.');
+  }
+  if (!inside(root, await realpath(source))) throw new Error('Static input must stay inside the project.');
+  const index = await lstat(path.join(source, 'index.html')).catch(() => null);
+  if (!index?.isFile() || index.isSymbolicLink()) throw new Error('Static input needs index.html. Run your framework build first and select its public output with --from.');
+
+  const id = randomUUID(), stage = path.join(root, `.prnext-build-${id}`);
+  const backup = path.join(root, `.prnext-backup-${id}`), pointer = path.join(root, `.prnext-output-${id}.tmp`);
+  const manifest = { version: 1, buildId: id, config: { staticOnly: true, staticFallback: spa, compress: true, poweredByHeader: true }, routes: [], prerendered: [] };
+  const paths = new Set();
+  let count = 0, bytes = 0, previous = false, published = false;
+  const add = (url, file) => {
+    if (paths.has(url)) throw new Error(`Ambiguous static URL ${url}; remove the conflicting file or HTML alias.`);
+    paths.add(url);
+    manifest.prerendered.push({ path: url, file: `static/${file}`, revalidate: false });
+  };
+  async function copy(folder = '', depth = 0) {
+    if (depth > 64) throw new Error('Static input exceeds 64 directory levels.');
+    for (const name of (await readdir(path.join(source, folder))).sort()) {
+      if (name.includes('\\') || /[\x00-\x1f\x7f:]/.test(name) ||
+          name.startsWith('.') && !(folder === '' && name === '.well-known') ||
+          ['node_modules', '_prnext', '_next'].includes(name) || folder === '' && name === 'server') {
+        throw new Error(`Static input contains a private, reserved or server path: ${folder ? folder + '/' : ''}${name}. Select only browser-ready files.`);
+      }
+      const file = folder ? `${folder}/${name}` : name;
+      const entry = await lstat(path.join(source, file));
+      if (entry.isSymbolicLink()) throw new Error(`Static input cannot contain symbolic links: ${file}`);
+      if (entry.isDirectory()) { await copy(file, depth + 1); continue; }
+      if (!entry.isFile()) throw new Error(`Static input must contain regular files: ${file}`);
+      if (++count > MAX_FILES || (bytes += entry.size) > MAX_BYTES) throw new Error('Static input exceeds 20,000 files or 512 MiB.');
+      const target = path.join(stage, 'static', file);
+      await mkdir(path.dirname(target), { recursive: true });
+      await copyFile(path.join(source, file), target, constants.COPYFILE_EXCL);
+      const after = await lstat(path.join(source, file));
+      if (!after.isFile() || after.size !== entry.size || after.mtimeMs !== entry.mtimeMs || (await stat(target)).size !== entry.size) throw new Error(`Static input changed while being imported: ${file}. Retry after its build finishes.`);
+      add(urlFor(file), file);
+      if (file === 'index.html') add('/', file);
+      else if (file.endsWith('/index.html')) add(urlFor(file.slice(0, -11)), file);
+      else if (file.endsWith('.html')) add(urlFor(file.slice(0, -5)), file);
+    }
+  }
+  try {
+    await mkdir(stage);
+    await copy();
+    await writeFile(path.join(stage, 'manifest.json'), JSON.stringify(manifest, null, 2) + '\n');
+    await writeBuildOutput(stage, manifest, { adapter: 'static', spa });
+    await precompressBuild(stage, manifest, { cacheDirectory: path.join(root, '.prnext-cache/precompress-v1') });
+    // A failed import leaves the previously published build and pointer intact.
+    previous = await lstat(destination).then(() => true, error => { if (error.code === 'ENOENT') return false; throw error; });
+    await writeFile(pointer, JSON.stringify({ distDir: output }) + '\n', { flag: 'wx' });
+    if (previous) await rename(destination, backup);
+    try {
+      await rename(stage, destination);
+      published = true;
+      await rename(pointer, path.join(root, OUTPUT_POINTER));
+    } catch (error) {
+      if (published) await rename(destination, stage);
+      if (previous) await rename(backup, destination);
+      throw error;
+    }
+    if (previous) await rm(backup, { recursive: true, force: true });
+    return { ...manifest, outputDirectory: destination, files: count, bytes };
+  } finally {
+    await rm(pointer, { force: true });
+    await rm(stage, { recursive: true, force: true });
+  }
+}

package/cli.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { rename } from './runtime/fs.mjs';
 import { spawn } from 'node:child_process';
-import { readFile, writeFile, rm } from 'node:fs/promises';
+import { readFile, writeFile, rm, mkdir, readdir } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { resolveNativeBinary, packageManifest } from './native/resolve.mjs';
@@ -16,6 +16,9 @@ const help = `PRNext ${packageManifest.version}
 Use prnext for portable scripts; prn is a shortcut on compatible shells.
 
   prnext build [directory]              Build React/TypeScript and static HTML
+  prnext build [directory] --adapter static [--from dist] [--spa]
+                                       Import an existing public build directory
+  prnext output [directory] [--json]    Read the versioned build output contract
   prnext start [directory] [options]    Start native Rust production server
   prnext pstart [directory] [options]   Start production persistently in the background
   prnext prestart [name]                Replace a persistent app after a health check
@@ -27,7 +30,7 @@ Use prnext for portable scripts; prn is a shortcut on compatible shells.
   prnext dev [directory] [options]      Rebuild and restart on source changes
   prnext routes [directory]             Display compiled routes
   prnext check [directory] [--json]      Check an existing Next project before building
-  prnext inspect [directory] [--json]    Explain routes, cache decisions and timings
+  prnext inspect [directory] [--json|--otlp] Explain routes, health and sampled timings
   prnext host [prnext.host.json]         Host built apps by hostname; wake on demand
   prnext host [config] --check           Validate hosting configuration and builds
   prnext host [config] --status [--json]  Show memory, process and idle status
@@ -52,7 +55,7 @@ Memory favors lower RAM under concurrency, accepting more waiting and CPU per re
 Without an option: PRNEXT_PROFILE, legacy PRNEXT_MEMORY_PROFILE=compact, then balanced.
 Classic preserves the former standard settings; standard remains an alias. Legacy compact remains accepted.
 Development includes React Fast Refresh, stylesheet updates and an error overlay.
-Requires Node >=22. Published packages include the native server for supported platforms.
+Requires Node 22.23.4+, 24.22.1+ or 26.12.1+. Published packages include the native server for supported platforms.
 Rust is only needed when building the framework from source.
 `;
 
@@ -147,19 +150,36 @@ async function main() {
     if (!report.ok) process.exitCode = 1;
     return;
   }
-  if (!['build', 'start', 'dev', 'routes', 'check', 'inspect'].includes(command)) throw new Error(`Unknown command: ${command}\n${help}`);
+  if (!['build', 'start', 'dev', 'routes', 'check', 'inspect', 'output'].includes(command)) throw new Error(`Unknown command: ${command}\n${help}`);
   const args = [...argv];
   const root = path.resolve(args[0] && !args[0].startsWith('-') ? args.shift() : '.');
+  if (command === 'output') {
+    if (args.some(arg => arg !== '--json')) throw new Error('output accepts only [directory] and --json');
+    const { readBuildOutput } = await import('./build/output-contract.mjs');
+    const output = await readBuildOutput(path.join(root, await readBuildDirectory(root)));
+    if (args.includes('--json')) console.log(JSON.stringify(output, null, 2));
+    else console.log(`PRNext output v${output.version}: ${output.adapter}\nBuild: ${output.buildId}\nManifest: ${output.manifest}\nAssets: ${output.assets}\nServer: ${output.server?.entry || 'none'}\nSPA fallback: ${output.fallback || 'disabled'}`);
+    return;
+  }
   if (command === 'inspect') {
-    if (args.some(arg => arg !== '--json')) throw new Error('inspect accepts only [directory] and --json');
-    const { inspectProject, printInspection } = await import('./build/inspect.mjs');
+    if (args.some(arg => !['--json', '--otlp'].includes(arg)) || args.includes('--json') && args.includes('--otlp')) throw new Error('inspect accepts [directory] and either --json or --otlp');
+    const { inspectProject, printInspection, inspectionMetrics } = await import('./build/inspect.mjs');
     const report = await inspectProject(root);
-    if (args.includes('--json')) console.log(JSON.stringify(report, null, 2)); else printInspection(report);
+    if (args.includes('--otlp')) console.log(JSON.stringify(inspectionMetrics(report), null, 2));
+    else if (args.includes('--json')) console.log(JSON.stringify(report, null, 2)); else printInspection(report);
     return;
   }
   if (['start', 'dev'].includes(command) && args.includes('--inspect')) {
     args.splice(args.indexOf('--inspect'), 1);
     process.env.PRNEXT_INSPECT_DIR = path.join(root, '.prnext-cache/inspect');
+    await mkdir(process.env.PRNEXT_INSPECT_DIR, {recursive:true, mode:0o700});
+    process.env.PRNEXT_METRICS_FILE ||= path.join(process.env.PRNEXT_INSPECT_DIR, `metrics-${process.pid}.jsonl`);
+    const old = (await readdir(process.env.PRNEXT_INSPECT_DIR)).filter(name => /^metrics-\d+\.jsonl$/.test(name));
+    for (const name of old.slice(0, Math.max(0, old.length - 4))) {
+      const pid = Number(name.slice(8,-6));
+      try { process.kill(pid, 0); }
+      catch (error) { if (error.code === 'ESRCH') await rm(path.join(process.env.PRNEXT_INSPECT_DIR,name),{force:true}); }
+    }
   }
   if (command === 'build' || command === 'dev') {
     // Build plugins such as Contentlayer read cwd/INIT_CWD rather than webpack's
@@ -183,13 +203,30 @@ async function main() {
     return;
   }
   if (command === 'build') {
-    const dev = args.includes('--dev');
-    if (args.some(arg => arg !== '--dev')) throw new Error('build accepts only [directory] and --dev');
+    const options = {};
+    for (let i = 0; i < args.length; i++) {
+      const flag = args[i];
+      if (flag === '--dev') options.dev = true;
+      else if (flag === '--spa') options.spa = true;
+      else if (flag === '--adapter' || flag === '--from') {
+        const value = args[++i];
+        if (!value || value.startsWith('-')) throw new Error(`${flag} requires a value`);
+        const key = flag.slice(2);
+        if (options[key] !== undefined) throw new Error(`Duplicate build option: ${flag}`);
+        options[key] = value;
+      } else throw new Error(`Unknown build option: ${flag}`);
+    }
+    const dev = !!options.dev;
     const envMode = process.env.NODE_ENV === 'test' ? 'test' : undefined;
     process.env.NODE_ENV = dev ? 'development' : 'production';
-    const { build } = await import('./build/index.mjs');
     const started = performance.now();
-    await build(root, { dev, envMode });
+    if (options.adapter === 'static') {
+      const { buildStatic } = await import('./build/static-adapter.mjs');
+      await buildStatic(root, options);
+    } else {
+      const { build } = await import('./build/index.mjs');
+      await build(root, { ...options, dev, envMode });
+    }
     console.log(`PRNext built ${root} in ${((performance.now() - started) / 1000).toFixed(2)}s`);
     return;
   }

package/compat/diagnostics.cjs

@@ -4,6 +4,10 @@ const directory = process.env.PRNEXT_INSPECT_DIR;
 const { threadId } = require('node:worker_threads');
 let queue = [], scheduled = false, writing = false, size;
 const limit = 1024 * 1024;
+if (directory) setInterval(() => {
+  const {rss, heapUsed} = process.memoryUsage();
+  record('process', {rssBytes:rss, heapUsedBytes:heapUsed});
+}, 5000).unref();
 function record(type, fields = {}) {
   if (!directory || queue.length >= 256) return;
   const line = JSON.stringify({ time: Date.now(), pid: process.pid, type, ...fields }) + '\n';

package/compat/index.d.ts

@@ -168,4 +168,33 @@ export interface NextConfig {
   rewrites?: () => Rewrite[] | { beforeFiles?: Rewrite[]; afterFiles?: Rewrite[]; fallback?: Rewrite[] } | Promise<Rewrite[] | { beforeFiles?: Rewrite[]; afterFiles?: Rewrite[]; fallback?: Rewrite[] }>;
 }
 export type PRNextConfig = NextConfig;
+/** Public build envelope; internal manifest fields are adapter-specific. */
+export type BuildOutput = {
+  version: 1;
+  buildId: string;
+  manifest: 'manifest.json';
+} & ({
+  adapter: 'react';
+  assets: 'assets';
+  server: { entry: 'runtime/worker.mjs'; runtimeContract: 'runtime-contract.json' };
+  fallback: null;
+} | {
+  adapter: 'static';
+  assets: 'static';
+  server: null;
+  fallback: null | 'index.html';
+});
+export interface StaticBuildOptions {
+  from?: string;
+  spa?: boolean;
+  distDir?: string;
+  dev?: false;
+}
+export interface BuildResult { buildId: string; outputDirectory: string; }
+export interface StaticBuildResult extends BuildResult { files: number; bytes: number; }
+export function build(projectRoot: string, options: StaticBuildOptions & { adapter: 'static' }): Promise<StaticBuildResult>;
+export function build(projectRoot: string, options?: { adapter?: 'react'; dev?: boolean; envMode?: 'production' | 'development' | 'test' }): Promise<BuildResult>;
+export function buildStatic(projectRoot: string, options?: StaticBuildOptions): Promise<StaticBuildResult>;
+export function readBuildOutput(buildDirectory: string): Promise<BuildOutput>;
+export function validateBuildOutput(value: unknown): BuildOutput;
 export type { DocumentContext, DocumentInitialProps, DocumentProps } from './document.cjs';

package/index.mjs

@@ -1 +1,3 @@
 export { build } from './build/index.mjs';
+export { buildStatic } from './build/static-adapter.mjs';
+export { readBuildOutput, validateBuildOutput } from './build/output-contract.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thomas.f/prnext",
-  "version": "0.1.13-alpha",
+  "version": "0.1.15-alpha",
   "license": "MIT",
   "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
   "homepage": "https://prnext.dev",
@@ -111,7 +111,6 @@
     "@babel/types": "^7.29.0",
     "@edge-runtime/vm": "5.0.0",
     "@vercel/nft": "1.11.0",
-    "@vercel/og": "1.0.3",
     "dotenv": "16.6.1",
     "dotenv-expand": "11.0.7",
     "esbuild": "^0.28.2",
@@ -133,14 +132,14 @@
     "react-server-dom-webpack": "19.3.0"
   },
   "optionalDependencies": {
-    "prnext-darwin-arm64": "0.1.13-alpha",
-    "prnext-darwin-x64": "0.1.13-alpha",
-    "prnext-linux-arm64-gnu": "0.1.13-alpha",
-    "prnext-linux-x64-gnu": "0.1.13-alpha",
-    "@thomas.f/prnext-win32-x64-msvc": "0.1.13-alpha",
-    "@thomas.f/prnext-win32-arm64-msvc": "0.1.13-alpha"
+    "prnext-darwin-arm64": "0.1.15-alpha",
+    "prnext-darwin-x64": "0.1.15-alpha",
+    "prnext-linux-arm64-gnu": "0.1.15-alpha",
+    "prnext-linux-x64-gnu": "0.1.15-alpha",
+    "@thomas.f/prnext-win32-x64-msvc": "0.1.15-alpha",
+    "@thomas.f/prnext-win32-arm64-msvc": "0.1.15-alpha"
   },
   "engines": {
-    "node": ">=22"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   }
 }

package/release/verify.mjs

@@ -22,6 +22,8 @@ export async function verifyPackage() {
   }
   await exported(pkg.exports);
   await access(path.join(packageRoot, 'runtime/profiles.json'));
+  for (const name of ['index.node.mjs', 'resvg.wasm', 'hb.wasm', 'Geist-Regular.ttf', 'LICENSE', 'LICENSE.fflate', 'LICENSE.Geist', 'LICENSE.harfbuzzjs', 'LICENSE.satori', 'NOTICE.txt']) await access(path.join(packageRoot, 'runtime/og', name));
+  if (pkg.dependencies['@vercel/og'] || (await readFile(path.join(packageRoot, 'runtime/og/index.node.mjs'), 'utf8')).includes('fflate@0.7.3')) throw new Error('OG renderer still depends on vulnerable upstream fflate. Run scripts/prepare-og.mjs.');
   const source = sourceCheckout();
   if (source) {
     const cargo = await readFile(path.join(source, 'crates/prnext/Cargo.toml'), 'utf8');

package/runtime/api.mjs

@@ -131,7 +131,7 @@ async function runStreamingPagesApi(handler, request, { method, signal, timeoutM
   const timer = setTimeout(() => cancelRequest(apiTimeoutError('response headers', timeoutMs)), timeoutMs);
   timer.unref();
   if (controller.signal.aborted) cancelRequest(abortError(controller.signal.reason));
-  else trackRequestWork(Promise.resolve().then(() => handler(request, response)), signal).then(result => {
+  else trackRequestWork(Promise.resolve().then(() => handler(request, response)), signal, { timeoutMs }).then(result => {
     if (result !== undefined && result !== response && !response.writableEnded) {
       throw new Error('Pages API handlers must send their response with res.send(), res.json(), or res.end()');
     }
@@ -255,7 +255,10 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
     if (lifecycle) pendingResponse.then(({ result }) => {
       if (lifecycle.controller.signal.aborted) result?.body?.cancel(lifecycle.controller.signal.reason).catch(() => {});
     }, () => {});
-    trackRequestWork(pendingResponse, signal);
+    // A client disconnect does not cancel arbitrary npm/database promises.
+    // Let them settle within this route's existing deadline before retiring the
+    // shared worker; the shorter orphan guard would interrupt other visitors.
+    trackRequestWork(pendingResponse, signal, { timeoutMs });
     let result, changedCookies, runInContext;
     try {
       ({ result, changedCookies, runInContext } = await withSignal(pendingResponse, lifecycle?.controller.signal));

package/runtime/cloud/archive.mjs

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { deflateRawSync } from 'node:zlib';
 import { createHash } from 'node:crypto';
 import picomatch from 'picomatch';
+import { prospectivePath } from './state.mjs';
 
 const MiB = 1048576;
 const alwaysExcluded = (name) =>
@@ -96,7 +97,7 @@ export async function archiveProject(
 ) {
   const root = await realpath(directory);
   if (outputFile) {
-    const relative = path.relative(root,path.resolve(outputFile));
+    const relative = path.relative(root,await prospectivePath(outputFile));
     if (!relative || relative !== '..' && !relative.startsWith(`..${path.sep}`) && !path.isAbsolute(relative)) throw new Error('Temporary archive must be outside the project.');
   }
   const output = outputFile ? await open(outputFile, 'wx', 0o600) : null;

package/runtime/cloud/client.mjs

@@ -10,6 +10,7 @@ import { detectEnvFiles, readDeploymentEnv, confirmEnvImport } from './environme
 import {
   cloudOrigin,
   credentialPath,
+  prospectivePath,
   linkPath,
   readState,
   writeState,
@@ -35,24 +36,6 @@ Source excludes secrets/build output and respects root .gitignore/.prnextignore.
 `;
 const clean = (value) =>
   String(value || '').replace(/[\x00-\x08\x0b-\x1f\x7f]/g, '');
-
-async function resolveCredentialDirectory(directory) {
-  let existing = directory;
-  const missing = [];
-  for (;;) {
-    try {
-      return path.join(await realpath(existing), ...missing);
-    } catch (error) {
-      const parent = path.dirname(existing);
-      if (error.code !== 'ENOENT' || parent === existing) throw error;
-      // Resolve existing ancestors even when the credential directory has not
-      // been created yet (macOS /var aliases, Windows short paths, symlinks).
-      missing.unshift(path.basename(existing));
-      existing = parent;
-    }
-  }
-}
-
 export function parseCloudArgs(command, argv) {
   const options = { directory: '.', timeout: 600 };
   const flags = new Map([
@@ -582,7 +565,7 @@ export async function cloudCommand(
   try {
     if (['deploy', 'update'].includes(command)) {
       const requestedHome = path.dirname(credentialPath(origin, env));
-      const actualHome = await resolveCredentialDirectory(requestedHome);
+      const actualHome = await prospectivePath(requestedHome);
       const credentialsRelative = path.relative(directory, actualHome);
       if (
         !credentialsRelative ||

package/runtime/cloud/state.mjs

@@ -1,9 +1,24 @@
-import { mkdir, lstat, readFile, writeFile, rm, chmod } from 'node:fs/promises';
+import { mkdir, lstat, readFile, realpath, writeFile, rm, chmod } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import path from 'node:path';
 import { createHash, randomBytes } from 'node:crypto';
 import { rename } from '../fs.mjs';
 
+// Resolve existing parents too when a destination has not been created yet.
+// On macOS, for example, /var and /private/var refer to the same directory.
+export async function prospectivePath(value) {
+  let parent = path.resolve(value);
+  const missing = [];
+  for (;;) {
+    try { return path.join(await realpath(parent), ...missing); }
+    catch (error) {
+      if (error.code !== 'ENOENT' || path.dirname(parent) === parent) throw error;
+      missing.unshift(path.basename(parent));
+      parent = path.dirname(parent);
+    }
+  }
+}
+
 export function cloudOrigin(value = 'https://app.prnext.dev') {
   let url;
   try {