@thomas.f/prnext 0.1.18-alpha → 0.1.19-alpha

package/build/standalone.mjs

@@ -1,5 +1,6 @@
-import { nodeFileTrace } from '@vercel/nft';
-import resolver from '@vercel/nft/out/resolve-dependency.js';
+import { nodeFileTrace } from '../vendor/nft/out/index.js';
+import resolver from '../vendor/nft/out/resolve-dependency.js';
+import { CachedFileSystem } from '../vendor/nft/out/fs.js';
 import picomatch from 'picomatch';
 import { mkdir, readFile, writeFile, readdir, realpath, readlink, stat, lstat, copyFile, chmod, symlink, cp } from 'node:fs/promises';
 import path from 'node:path';
@@ -12,6 +13,10 @@ const within = (root, file) => file === root || file.startsWith(root + path.sep)
 const missing = error => error.code === 'ENOENT' || error.code === 'ENOTDIR';
 const maxFiles = 100_000;
 const maxBytes = 2 * 1024 ** 3;
+const linuxRuntimeProbes = new Set([
+  '/proc/self', '/proc/self/exe', '/usr/bin/ldd',
+  '/proc/version', '/proc/self/cgroup', '/.dockerenv', '/run/.containerenv',
+]);
 
 export async function resolveTraceDependency(...args) {
   const result = await resolver.default(...args);
@@ -75,6 +80,10 @@ export async function createStandalone({ projectRoot, stage, manifest, config })
   const warnings = new Set();
   let omittedWarnings = 0;
   const cache = {};
+  const traceFileSystem = new CachedFileSystem({ cache, fileIOConcurrency: 16 });
+  // libc and environment detectors read the running host, not application assets.
+  // Keep this exact and outside the tracing root; other external files still fail.
+  const systemProbe = file => process.platform === 'linux' && !within(tracingRoot, file) && linuxRuntimeProbes.has(file);
   const traceLocations = new Map();
   let traceReads = 0;
   let traceBytes = 0;
@@ -120,7 +129,16 @@ export async function createStandalone({ projectRoot, stage, manifest, config })
     for (const conditions of [['node'], ['node', 'react-server']]) {
       const result = await nodeFileTrace(entries, {
         base: path.parse(projectRoot).root, processCwd: projectRoot, conditions, cache, fileIOConcurrency: 16,
-        ignore(file) { const absolute = path.resolve(path.parse(projectRoot).root, file); return !within(stage, absolute) && (excluded.some(match => match(slash(absolute))) || /^\.env(?:\.|$)/.test(path.basename(absolute))); },
+        ignore(file) { const absolute = path.resolve(path.parse(projectRoot).root, file); return systemProbe(absolute) || !within(stage, absolute) && (excluded.some(match => match(slash(absolute))) || /^\.env(?:\.|$)/.test(path.basename(absolute))); },
+        // Share the metadata concurrency limit between stat and readlink.
+        stat: file => traceFileSystem.stat(file),
+        async readlink(file) {
+          // NFT follows symlinks before ignore(), so never follow these probes
+          // into /proc/<pid> or the build machine's Node executable.
+          if (systemProbe(file)) return null;
+          try { return await traceFileSystem.readlink(file); }
+          catch (error) { if (error.code === 'ENOTDIR') return null; throw error; }
+        },
         async readFile(file) {
           let info;
           try { info = await stat(file); } catch (error) { if (missing(error)) return null; throw error; }

package/build/webpack-graph.mjs

@@ -77,6 +77,13 @@ function pluginIdentity(plugin,webpack){
 export const webpackCompilerStats=()=>({contexts:sessions.size,created,reused,limit:sessionLimit,buildLimit:sessionBuildLimit});
 function queued(callback){const task=graphQueue.then(callback);graphQueue=task.catch(()=>{});return task;}
 export function closeWebpackCompiler(root){return queued(async()=>{
+  if(root!==undefined){
+    try{root=await realpath(root);}
+    catch(error){
+      if(error.code!=='ENOENT'&&error.code!=='ENOTDIR')throw error;
+      root=path.resolve(root);
+    }
+  }
   const closing=[];for(const[key,session]of sessions)if(root===undefined||session.root===root){sessions.delete(key);closing.push(session.dispose());}
   const results=await Promise.allSettled(closing),errors=results.filter(result=>result.status==='rejected').map(result=>result.reason);
   if(errors.length)throw new AggregateError(errors,'Unable to dispose webpack compiler sessions');
@@ -84,6 +91,9 @@ export function closeWebpackCompiler(root){return queued(async()=>{
 
 async function compileGraph(resolver,loads,options,{state,config,target}){
   return queued(async()=>{
+    // Ownership uses one canonical identity for invalidation and disposal.
+    // Compiler paths and graph fingerprints retain the caller's lexical root.
+    const ownerRoot=await realpath(state.root);
     const webpack=(await import('webpack')).default;
     let reusable=state.dev&&state.incremental,identity;
     if(reusable){try{identity=await buildCacheIdentity(state.root);}catch{}if(!identity)reusable=false;}
@@ -97,17 +107,17 @@ async function compileGraph(resolver,loads,options,{state,config,target}){
     // Unknown data structures, safe mode and unavailable identities all keep
     // compilation correct through a one-shot compiler. Hidden mutable closure
     // state cannot be fingerprinted: replace the plugin instance when it changes.
-    if(state.dev&&!reusable)for(const[key,session]of sessions)if(session.root===state.root){sessions.delete(key);await session.dispose();}
+    if(state.dev&&!reusable)for(const[key,session]of sessions)if(session.root===ownerRoot){sessions.delete(key);await session.dispose();}
     let session=reusable&&sessions.get(key);
     if(session&&session.builds>=sessionBuildLimit){sessions.delete(key);await session.dispose();session=undefined;}
     if(reusable){
-      for(const[old,previous]of sessions)if(previous.root===state.root&&(previous.identity!==identity||previous.base===base&&old!==key)){sessions.delete(old);await previous.dispose();}
+      for(const[old,previous]of sessions)if(previous.root===ownerRoot&&(previous.identity!==identity||previous.base===base&&old!==key)){sessions.delete(old);await previous.dispose();}
     }
     if(session){sessions.delete(key);reused++;}
     else{
       if(reusable)while(sessions.size>=sessionLimit){const[old,previous]=sessions.entries().next().value;sessions.delete(old);await previous.dispose();}
       session=await createGraphSession(state.root,{webpack,reusable,stage:state.stage});created++;
-      Object.assign(session,{root:state.root,base,identity,builds:0});
+      Object.assign(session,{root:ownerRoot,base,identity,builds:0});
     }
     if(reusable)sessions.set(key,session);
     try{session.builds++;return await session.run(resolver,loads,options,{state,config,target});}

package/cli.mjs

@@ -58,6 +58,8 @@ Migration options: --dry-run (preview), --no-install (prepare only), --json
   prnext migrate --check                Audit source compatibility without migrating
   prnext migrate --check --against URL --candidate URL [--routes paths.json]
                                        Compare GET responses before switching
+  prnext migrate --check --against URL --candidate URL --browser-scenarios ./scenarios.mjs
+                                       Run trusted application browser assertions
 Migration keeps Next.js and backs up package.json and existing lockfiles.
 Simple next dev/build/start scripts become prnext commands; custom shell scripts need a manual edit.
 Installation honors npm, pnpm, Yarn Classic/Berry and the workspace root.
@@ -191,13 +193,20 @@ async function main() {
         report.comparison = await compareServers({ ...options, routes });
         report.ok &&= report.comparison.ok;
       }
+      if (options.browserScenarios) {
+        const { runMigrationScenarios } = await import('./build/migration-scenarios.mjs');
+        report.browser = await runMigrationScenarios({ directory, ...options, scenarios: options.browserScenarios });
+        report.ok &&= report.browser.ok;
+      }
       if (options.json) console.log(JSON.stringify(report, null, 2));
       else {
         console.log(`PRNext migration check ${report.ok ? 'passed' : 'failed'}: ${directory}`);
         console.log(`${report.files} source files; ${report.routes.length} routes.`);
         for (const item of report.findings) console.log(`${item.severity.toUpperCase()} ${item.file || 'project'}${item.line ? ':' + item.line : ''}: ${item.message}\n  ${item.action}`);
         for (const result of report.comparison?.results || []) console.log(`${result.equal ? 'MATCH' : 'DIFFERENT'} ${result.route}: ${result.error || result.differences.join(', ') || 'responses match'}`);
-        for (const note of [...report.notes, ...(report.comparison ? [report.comparison.scope] : [])]) console.log(note);
+        for (const result of report.browser?.results || []) console.log(`BROWSER ${result.scenario} (${result.target}): ${result.status}${result.reason ? ' — ' + result.reason : ''}`);
+        if (report.browser?.reason) console.log(`BROWSER unknown: ${report.browser.reason}`);
+        for (const note of [...report.notes, ...(report.comparison ? [report.comparison.scope] : []), ...(report.browser ? [report.browser.scope] : [])]) console.log(note);
       }
       if (!report.ok) process.exitCode = 1;
       return;

package/compat/app-dynamic.cjs

@@ -19,7 +19,18 @@ function dynamic(input, options) {
   if (!opts.ssr && typeof React.useEffect !== 'function') {
     throw new Error('ssr: false is not supported with next/dynamic in Server Components. Move it into a Client Component.');
   }
-  const Lazy = React.lazy(() => Promise.resolve().then(opts.loader).then(moduleOf));
+  let Lazy;
+  if(process.env.NODE_ENV==='development'&&typeof window!=='undefined'&&typeof opts.__prnextDevIdentity==='string'){
+    const registry=globalThis.__PRNEXT_DEV_DYNAMIC__||=new Map();
+    let entry=registry.get(opts.__prnextDevIdentity);
+    if(!entry||entry.failed){
+      entry={loader:opts.loader};
+      entry.lazy=React.lazy(()=>Promise.resolve().then(()=>entry.loader()).then(moduleOf,error=>{entry.failed=true;throw error;}));
+      if(registry.size>=2048)registry.delete(registry.keys().next().value);
+      registry.set(opts.__prnextDevIdentity,entry);
+    }else entry.loader=opts.loader;
+    Lazy=entry.lazy;
+  }else Lazy=React.lazy(() => Promise.resolve().then(opts.loader).then(moduleOf));
   function DynamicComponent(props) {
     const fallback = opts.loading ? React.createElement(opts.loading, { isLoading: true, pastDelay: true, error: null }) : null;
     const child = React.createElement(Lazy, props);

package/compat/cache-handlers.cjs

@@ -80,7 +80,9 @@ async function read(entry, context) {
       if (size > MAX_BYTES) throw new Error('CacheEntry exceeds 2 MiB');
       chunks.push(Buffer.from(value));
     }
-    return Buffer.concat(chunks, size);
+    // Buffer.from above owns each chunk even when a custom producer reuses its
+    // Uint8Array on the next pull. Keep that copy, but do not copy it twice.
+    return chunks.length===1?chunks[0]:Buffer.concat(chunks, size);
   } finally {
     if (!complete) void reader.cancel().catch(() => {});
     reader.releaseLock();

package/compat/flight-delta.cjs

@@ -55,7 +55,9 @@ function collectStream(source,{onComplete,onCancel,onFinally,capture=true}={}) {
 async function deltaStream(source,base,{assess}={}) {
   const reader=source.getReader(), first=await reader.read();
   if(first.done)return {delta:false,body:new ReadableStream({start(c){c.close();}})};
-  let index=base instanceof Uint8Array&&base.length<=MAX_VALUE?createIndex(base):null;
+  // A short first chunk always selects ordinary Flight. Do not build a base
+  // index that this response cannot use, or wait for a later streaming chunk.
+  let index=first.value.length>=WINDOW&&base instanceof Uint8Array&&base.length<=MAX_VALUE?createIndex(base):null;
   const profitable=(raw,frames,initial)=>frames&&frames.reduce((n,b)=>n+b.length,0)+(initial?5:1)<raw.length*0.9&&(!assess||assess(raw,join(initial?[MAGIC,...frames,new Uint8Array([2])]:frames,frames.reduce((n,b)=>n+b.length,0)+(initial?5:0)))===true);
   const firstFrames=index&&first.value.length>=WINDOW?encodeChunk(first.value,base,index):null;
   let useDelta;

package/compat/index.d.ts

@@ -167,7 +167,7 @@ export interface NextConfig {
     implementation?: 'sass' | 'sass-embedded';
     [option: string]: unknown;
   };
-  experimental?: { nextScriptWorkers?: boolean; optimizePackageImports?: string[]; proxyClientMaxBodySize?: number | string; serverActions?: true | { allowedOrigins?: string[]; bodySizeLimit?: number | string } };
+  experimental?: { nextScriptWorkers?: boolean; /** App Router development only; compile literal client imports on first use. */ lazyDynamicImports?: boolean; optimizePackageImports?: string[]; proxyClientMaxBodySize?: number | string; serverActions?: true | { allowedOrigins?: string[]; bodySizeLimit?: number | string } };
   trailingSlash?: boolean;
   skipTrailingSlashRedirect?: boolean;
   skipMiddlewareUrlNormalize?: boolean;

package/compat/link.cjs

@@ -21,11 +21,11 @@ const Link = React.forwardRef(function Link({ href, as, children, replace, scrol
   const source = formatUrl(href);
   const requestPrefetch = React.useCallback((priority = 'intent') => {
     if (prefetch === false || process.env.NODE_ENV !== 'production') return;
-    if (app?.router.partialPrefetch) app.router.prefetch(target, { priority, full: prefetch === true });
+    if (app && (app.router.partialPrefetch || prefetch === true)) app.router.prefetch(target, { priority, full: prefetch === true });
     if (!app && pages) void pages.prefetch(source, as ? target : undefined, { locale, priority }).catch(() => {});
   }, [app, pages, source, target, as, locale, prefetch]);
   React.useEffect(() => {
-    if ((app ? !app.router.partialPrefetch : !pages) || prefetch === false || process.env.NODE_ENV !== 'production' || typeof IntersectionObserver === 'undefined' || !anchorRef.current) return;
+    if ((app ? !app.router.partialPrefetch && prefetch !== true : !pages) || prefetch === false || process.env.NODE_ENV !== 'production' || typeof IntersectionObserver === 'undefined' || !anchorRef.current) return;
     const observer = new IntersectionObserver(entries => {
       if (entries.some(entry => entry.isIntersecting)) { observer.disconnect(); requestPrefetch('viewport'); }
     }, { rootMargin: '200px' });

package/docs/ai/compatibility.md

@@ -236,6 +236,29 @@ by silently adding `--force` or `--legacy-peer-deps`.
 can run project code, and installed custom loaders still require a real build.
 The audit is not a sandbox for untrusted projects.
 
+The version 2 JSON report follows static imports from project sources into the
+installed packages they reference. It checks explicit PRNext adapters and their
+statically declared named exports, and includes the importing file, line and
+import chain when a dependency uses an unavailable API. It resolves selected
+Node, browser and React Server Component package conditions, including workspace
+symlinks, without importing those package modules. Unreferenced packages are not
+enumerated. Runtime branches, custom loader output and every possible bundler
+condition remain outside this check.
+
+A module-level `use server` directive is a server boundary even when a Client
+Component reaches it through a re-export. Its dependencies are still audited in
+the server context. A client dependency on a Node builtin needs an actual browser
+implementation; package `browser` mappings and installed shims are resolved
+before diagnosing it. Custom configuration aliases still require a build with
+that application's configuration.
+
+`evidence.state: "checked"` means the selected static graph was inspected, not
+that migration is certified. `"unknown"` identifies unresolved/computed imports,
+loader inputs or incomplete coverage. The graph is bounded to 2,000 modules,
+12,000 imports, 32 MiB of source reads and 32 import hops. Hitting a limit leaves
+the remaining coverage unknown. `ok` means no blocking diagnostic was found;
+inspect warnings and coverage even when it is true.
+
 ## Compare running applications
 
 Start the original application and the candidate on separate available ports.
@@ -258,6 +281,60 @@ in a real browser, test authorized and unauthorized states, and run the existing
 application tests. Keep the original setup available until the candidate is
 actually verified. Timings from this comparison are not controlled benchmarks.
 
+## Run application browser scenarios
+
+An explicit browser option can run the application's own assertions against
+each server. Install Playwright and its Chromium browser in the application
+using its normal development setup; PRNext never installs them for this check.
+Provide a trusted `.mjs`, `.cjs` or `.js` module inside the application directory:
+
+```js
+// migration.scenarios.mjs
+export default [
+  {
+    async run({page, baseURL}) {
+      await page.goto(`${baseURL}/sign-in`);
+      await page.getByLabel('Email').fill(process.env.MIGRATION_TEST_EMAIL);
+      await page.getByLabel('Password').fill(process.env.MIGRATION_TEST_PASSWORD);
+      await page.getByRole('button', {name: 'Sign in', exact: true}).click();
+      await page.getByRole('heading', {name: 'Dashboard', exact: true}).waitFor();
+      await page.getByRole('button', {name: 'Save note', exact: true}).click();
+      await page.getByText('Note saved', {exact: true}).waitFor();
+      await page.getByRole('button', {name: 'Sign out', exact: true}).click();
+      await page.getByRole('heading', {name: 'Sign in', exact: true}).waitFor();
+    },
+  },
+];
+```
+
+Replace the URLs and accessible names with the application's real controls.
+Supply dedicated test account values through the command's environment rather than
+command arguments or source files. Use isolated test databases: these explicit
+callbacks execute application code and can submit forms or mutate data.
+
+```sh
+prnext migrate --check --against http://localhost:3000 --candidate http://localhost:3001 --routes paths.json --browser-scenarios migration.scenarios.mjs --timeout 15000 --json
+```
+
+Only this option loads the scenario module and starts a browser. It requires
+the application's installed `playwright` or `@playwright/test`. Each callback
+receives a new isolated browser context for each target. Assert observable
+behavior inside the callback; its return value is ignored. A callback that
+fulfills passes for that target, and a thrown assertion fails. Both targets
+must pass independently; equal durations or response samples are not used to
+infer browser equivalence.
+
+The report records scenario numbers, targets and pass/fail results. It excludes
+application console output, raw error messages, request data, cookies and
+screenshots. Read or debug the original application test separately when a
+generic failure needs investigation. Keep credentials out of assertion labels
+and application-managed artifacts too. An unavailable browser or incomplete run
+is reported as unknown. There are at most 20 scenarios, a 100–60,000 ms budget
+per callback, a bounded startup period and a five-minute maximum for the worker.
+A timeout closes its context and ends the run before another target starts.
+The worker also closes its owned browser when it finishes. This is explicit
+execution of trusted test code, not a sandbox for an untrusted module.
+
 ## Boundaries that often matter
 
 React server/client directives in `.mts`/`.cts` are rejected; use `.ts`/`.tsx`.

package/docs/ai/routing.md

@@ -88,6 +88,9 @@ Client Components can participate in server rendering. Read `window`,
 `useEffect`, not unconditionally during render. Server and first browser render
 must agree. Use `.ts` or `.tsx` for `'use client'` and `'use server'` boundaries;
 PRNext rejects those directives in `.mts`/`.cts` instead of silently misbundling.
+The migration audit reports these unsupported boundaries too. It also checks
+`server-only` and `client-only` markers through imported helpers, respecting
+module-level Server Action boundaries and Node Route Handlers.
 
 ## Navigation and typed routes
 
@@ -110,6 +113,14 @@ without connection information retain bounded prefetching. `prefetch={false}`
 disables Link speculation, including hover and focus. None of these policies
 blocks a real click or changes authorization and private-data checks. App Link
 automatic prefetching retains its existing partial-rendering requirement.
+Set `prefetch={true}` to warm the full destination explicitly in an ordinary
+App Router application without `cacheComponents`. The same network limits
+apply, and development does not prefetch. Full prefetch warms modules and data;
+the click still sends a fresh server request before showing the destination.
+This includes prerendered pages whose access is controlled by a proxy: a
+prefetched response cannot authorize a later navigation after an HttpOnly
+cookie changes. Leave the prop unset to keep automatic behavior, or use `false`
+to disable speculation.
 
 ### Connection loss during App navigation
 

package/docs/ai/troubleshooting.md

@@ -2,6 +2,70 @@
 
 [AI documentation index](../../AI.md)
 
+## Compile large client imports only when used in development
+
+For App Router applications, the explicit experimental option below keeps
+literal client `import()` targets outside the initial browser graph. It defers
+their transformation and compilation, rather than only downloading an already
+compiled chunk later.
+
+```js
+// prnext.config.mjs
+export default {
+  experimental: { lazyDynamicImports: true }
+};
+```
+
+The option affects `prnext dev` only. Production keeps its ordinary dynamic
+chunks and does not use a development compilation endpoint. SSR also keeps its
+normal behavior. A `next/dynamic` component with `{ ssr: false }` is a useful
+candidate for an editor or other large browser-only feature; an import needed
+by SSR still needs its server compilation.
+
+On first use, the development server compiles the requested subgraph, publishes
+its immutable assets, and loads its CSS before resolving the import. Already
+loaded ESM dependencies are reused through their original module URLs, keeping
+shared objects and live bindings. Once activated, the module participates in
+subsequent JavaScript and stylesheet updates. A failed compilation can be
+requested again after correcting its source.
+
+Activated styles remain loaded for the generation, including when parallel
+slots select their own styles. Prefer CSS Modules or selectors scoped to the
+deferred feature when its global styles should not affect other components.
+
+The initial scope is App Router applications using the native compiler, with
+same-origin assets and no webpack hook or custom loaders. Literal imports from
+project `.js`, `.jsx`, `.mjs`, `.cjs`, `.ts` and `.tsx` sources are eligible;
+computed imports, import attributes, literal requests containing `?` or `#`,
+imports inside installed packages and typed `.mts`/`.cts` helpers keep the
+ordinary compiler behavior. The compiler keeps the distinct module identities
+of those literal query and fragment imports. If an alias or a transitive
+dependency introduces a resolved query or fragment suffix inside a deferred
+graph, activation returns an explicit error
+before reusing any shared export bridge. Disable the option for that graph;
+query and fragment identities in deferred graphs are not currently supported.
+The compiler does not silently duplicate a shared CommonJS dependency: that
+case returns an explicit error. Convert that shared dependency to ESM or disable
+the option.
+Server Actions first introduced only by a deferred graph also require a static
+import or the ordinary compiler, because the running server implementation
+cannot be extended by publishing browser assets alone.
+
+There are at most 128 registered imports and 4,096 static JavaScript dependency
+identities per generation. Deferred assets have a cumulative 128 MiB budget per
+active generation. Existing development request and generation limits still
+apply. Public requests contain opaque registered IDs, never source filenames;
+an unknown ID cannot initiate a deferred compilation. Static ESM export bridges
+have their own startup cost, so measure your application's initial build and
+first-use delay before keeping the option enabled.
+
+Deferred JSON imports share their native ESM namespace and default object across
+importers. Deferred assets are written outside the served directory and published
+as complete immutable files. This experimental path requires hardlinks within
+the development generation's filesystem; disable `lazyDynamicImports` if that
+filesystem cannot create them. A failed activation keeps existing assets intact
+and conservatively accounts for any publication whose outcome is uncertain.
+
 ## Collect a useful failure
 
 Read the installed version, command, working directory, Node version, manager,
@@ -54,6 +118,21 @@ repair. Verify the interactive result after the change.
 
 ## HMR and cache failures
 
+When an Action overlaps a refresh or navigation, its mutation result remains
+independent from whether its older render is applied. A newer interaction can
+release a superseded development commit wait; it never replays the mutation.
+
+For a development state publication failure, keep the private
+`.prnext-dev/<session>/diagnostics/state-publication.json` receipt. It records the
+operation phase, error code, bounded rename attempts and last published sequence,
+without source contents or a full source path. Windows transient rename failures
+are retried for up to two seconds; a permanent failure preserves the previous
+complete state file. After a replacement runtime has activated, publication
+failure still retires obsolete runtimes through the gateway and keeps the
+existing three-generation snapshot bound. In-flight requests drain before
+their old runtime closes. Record the actual code and phase instead of assuming
+an antivirus or file watcher caused the lock.
+
 Development compiles requested routes and preserves state for compatible edits;
 config/environment, custom Document or incompatible module changes can reload
 the document. Production prerendering and compression are not development HMR.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thomas.f/prnext",
-  "version": "0.1.18-alpha",
+  "version": "0.1.19-alpha",
   "license": "MIT",
   "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
   "homepage": "https://prnext.dev",
@@ -41,7 +41,8 @@
     "runtime/",
     "compat/",
     "native/",
-    "release/"
+    "release/",
+    "vendor/"
   ],
   "scripts": {
     "prepublishOnly": "node release/verify.mjs"
@@ -133,18 +134,28 @@
     "@babel/types": "^7.29.0",
     "@edge-runtime/vm": "5.0.0",
     "@jridgewell/trace-mapping": "0.3.31",
-    "@vercel/nft": "1.11.0",
+    "@mapbox/node-pre-gyp": "2.0.3",
+    "@rollup/pluginutils": "5.4.0",
+    "acorn": "8.18.0",
+    "acorn-import-attributes": "1.9.5",
+    "async-sema": "3.1.1",
     "babel-plugin-react-compiler": "1.0.0",
+    "bindings": "1.5.0",
     "browserslist": "4.29.0",
     "dotenv": "16.6.1",
     "dotenv-expand": "11.0.7",
     "esbuild": "^0.28.2",
+    "estree-walker": "2.0.2",
     "fontkit": "2.0.4",
     "get-tsconfig": "4.14.3",
+    "glob": "14.0.2",
+    "graceful-fs": "4.2.11",
     "html-to-image": "1.11.13",
     "jsonc-parser": "3.3.1",
     "lightningcss": "1.31.0",
     "loader-runner": "4.3.2",
+    "minimatch": "11.0.1",
+    "node-gyp-build": "4.8.4",
     "oxc-parser": "0.155.0",
     "path-to-regexp": "6.3.0",
     "picomatch": "4.0.7",
@@ -154,6 +165,7 @@
     "postcss-selector-parser": "7.1.6",
     "postcss-value-parser": "4.2.0",
     "react-refresh": "0.19.0",
+    "resolve-from": "5.0.0",
     "schema-utils": "4.3.3",
     "webpack": "5.111.1"
   },
@@ -169,12 +181,12 @@
     }
   },
   "optionalDependencies": {
-    "prnext-darwin-arm64": "0.1.18-alpha",
-    "prnext-darwin-x64": "0.1.18-alpha",
-    "prnext-linux-arm64-gnu": "0.1.18-alpha",
-    "prnext-linux-x64-gnu": "0.1.18-alpha",
-    "@thomas.f/prnext-win32-x64-msvc": "0.1.18-alpha",
-    "@thomas.f/prnext-win32-arm64-msvc": "0.1.18-alpha"
+    "prnext-darwin-arm64": "0.1.19-alpha",
+    "prnext-darwin-x64": "0.1.19-alpha",
+    "prnext-linux-arm64-gnu": "0.1.19-alpha",
+    "prnext-linux-x64-gnu": "0.1.19-alpha",
+    "@thomas.f/prnext-win32-x64-msvc": "0.1.19-alpha",
+    "@thomas.f/prnext-win32-arm64-msvc": "0.1.19-alpha"
   },
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"