@thomas.f/prnext 0.1.19-alpha → 0.1.20-alpha

package/runtime/app-client.mjs

@@ -26,6 +26,7 @@ const PREFETCH_LIMIT = 8;
 const PREFETCH_LIFETIME = 30_000;
 let application;
 let strictMode = true;
+const navigationStreams = new WeakMap();
 
 function loadClientModule(source) {
   if (typeof source === 'function') return source();
@@ -144,10 +145,11 @@ function NormalStyles({ css, fonts }) {
 
 function AppRoot({ model, controller, committed, url, globalErrorComponent, globalErrorCss, retentionEpoch, retentionAuthorizationEpoch }) {
   const [hydrated, setHydrated] = React.useState(false);
+  const flight = navigationStreams.get(model);
   const cache = React.useRef(null);
   if (!cache.current) cache.current = createActivityCache({ limit: controller._navigationCache?.maxEntries, ttl: controller._navigationCache?.ttlMs });
   const activityCache = React.useMemo(() => ({ cache: cache.current, epoch: retentionEpoch, authorizationEpoch: retentionAuthorizationEpoch,
-    authorizationKey: model.authorizationKey, strictAuthorization: controller._navigationCache?.authCookies !== undefined }), [retentionEpoch, retentionAuthorizationEpoch, model.authorizationKey]);
+    authorizationKey: model.authorizationKey, strictAuthorization: controller._navigationCache?.authCookies !== undefined, flight }), [retentionEpoch, retentionAuthorizationEpoch, model.authorizationKey, flight]);
   const previewDynamic = React.useCallback(() => { throw model.partialPreview.suspended; }, [model.partialPreview]);
   useLayoutEffect(() => {
     if (process.env.NODE_ENV === 'development' && model.instantDiagnostics?.length) globalThis.__PRNEXT_DEV__?.reportError(Object.assign(new Error(model.instantDiagnostics.join('\n')), { digest: 'PRNEXT_INSTANT_BLOCKING' }));
@@ -255,13 +257,13 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
   // entry with the previous view's routing state on the next scroll event.
   let historyRouting = currentRouting;
   let currentModel = initialModel;
-  let committedView = { model: initialModel, routing: currentRouting, url: currentUrl.href };
-  let pendingView;
+  let committedView = { model: initialModel, routing: currentRouting, url: currentUrl.href, retentionEpoch: 0, authorizationEpoch: 0 };
+  let pendingView, pendingNavigation;
   const historyFocus = new Map();
   let currentKey = window.history.state?.__prnext?.key || 0;
   let nextKey = currentKey + 1;
   let navigation = 0;
-  let activeRequest, finishNavigation, finishCommit, pageHidden = false, notifyingPrefetch = false;
+  let activeRequest, finishNavigation, finishCommit, documentTimer, pageHidden = false, notifyingPrefetch = false, documentFallback = false;
   const prefetches = new Map(), scheduler = createPrefetchScheduler();
   const partialSegments = (typeof __PRNEXT_CACHE_COMPONENTS__ === 'undefined' ? cacheComponents : __PRNEXT_CACHE_COMPONENTS__) ? new Map() : null;
   let segmentBytes = 0;
@@ -278,23 +280,49 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
     }
   }
 
-  function renderView(model, url, { token = navigation, canonical = true, committed } = {}) {
-    const view = { model, token };
+  function renderView(model, url, { token = navigation, canonical = true, kind = 'navigation', committed } = {}) {
+    const flight = navigationStreams.get(model), view = { model, token, kind, committed: false };
     pendingView = view;
+    const promote = () => {
+      if (token !== navigation || pendingView !== view || !view.committed || flight?.complete === false) return;
+      pendingView = undefined;
+      if (flight) flight.committed = undefined;
+      // A committed loading shell can still contain rows owned by a live
+      // fetch. Keep the last fully received view available before aborting it.
+      // Authorized PPR previews likewise never become the canonical model.
+      if (canonical) committedView = { model, routing: model.routing, url, retentionEpoch: controller._retentionEpoch, authorizationEpoch: controller._authorizationEpoch };
+    };
+    if (flight) flight.committed = promote;
     startTransition(() => root.render(appView({ model, controller, url, globalErrorComponent, globalErrorCss,
       committed: () => {
         if (token !== navigation || pendingView !== view) return;
-        pendingView = undefined;
-        // A PPR preview is authorized UI, but not the completed route model
-        // from which a later navigation should inherit its layout cache.
-        if (canonical) committedView = { model, routing: model.routing, url };
+        view.committed = true;
+        promote();
         committed?.();
       },
     })));
   }
 
   function abandonPendingView() {
-    if (!pendingView) return;
+    if (!pendingView) return true;
+    const flight = navigationStreams.get(pendingView.model);
+    const strictAuthorization = controller._navigationCache?.authCookies !== undefined;
+    if (flight) flight.committed = undefined;
+    if (pendingView.kind === 'action' && committedView.authorizationEpoch === controller._authorizationEpoch &&
+        (!strictAuthorization || committedView.model.authorizationKey === currentModel.authorizationKey)) {
+      // An action's received result can invoke a returned action before React
+      // commits its UI. This response is never owned/aborted by activeRequest;
+      // adopt its model instead of rolling back the prior mutation's epoch.
+      pendingView = undefined;
+      committedView = { model: currentModel, routing: currentRouting, url: currentUrl.href, retentionEpoch: controller._retentionEpoch, authorizationEpoch: controller._authorizationEpoch };
+      return true;
+    }
+    // A new authorized shell or explicit invalidation can make the last full
+    // model private to an obsolete session. Reauthorize through a document
+    // request instead of briefly restoring that model while C is pending.
+    if ((strictAuthorization && committedView.model.authorizationKey !== currentModel.authorizationKey) ||
+        committedView.retentionEpoch !== controller._retentionEpoch ||
+        committedView.authorizationEpoch !== controller._authorizationEpoch) return false;
     pendingView = undefined;
     currentModel = committedView.model;
     currentRouting = committedView.routing;
@@ -302,8 +330,46 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
     // the root model. Replace that suspended render before abort rejects its
     // remaining rows; it must not poison the retained layout or page cache.
     root.render(appView({ model: committedView.model, controller, url: committedView.url, globalErrorComponent, globalErrorCss }));
+    return true;
+  }
+
+  function fallbackDocument(url, replace = true, defer = false) {
+    // The invalidated document stays blocked until its replacement arrives.
+    // Repeated synchronous actions must neither dispatch nor start reloads.
+    if (documentFallback) return;
+    documentFallback = true;
+    navigation++;
+    activeRequest?.abort();
+    appStyleManager(document).cancel();
+    finishNavigation?.(); finishNavigation = undefined;
+    invalidatePrefetches();
+    flightTransport.clear();
+    if (controller._navigationCache?.authCookies !== undefined) document.documentElement.style.visibility = 'hidden';
+    const request = () => {
+      documentTimer = undefined;
+      if (pageHidden) return;
+      if (replace) window.location.replace(url);
+      else window.location.assign(url);
+    };
+    // An executed action must settle its promise chain before document
+    // replacement suspends the old realm. Its POST guard is already latched.
+    if (defer) documentTimer = setTimeout(request, 0);
+    else request();
+  }
+
+  function requiresAuthorizedDocument(model) {
+    if (controller._navigationCache?.authCookies === undefined) return false;
+    const identity = model?.authorizationKey;
+    // Activity entries are only part of the retained tree: shared client
+    // layouts and server layout-cache props can also belong to the old user.
+    // An unidentified static model cannot prove that HttpOnly cookies stayed
+    // the same. Cross this boundary before adopting any cached layout state.
+    return typeof identity !== 'string' || !identity || identity !== currentModel.authorizationKey ||
+      committedView.authorizationEpoch !== controller._authorizationEpoch;
   }
 
+  const actionReloadError = () => new Error('The session changed while this page was loading. Reload before repeating the action.');
+
   const flightTransport = createFlightTransport();
   async function requestFlight(url, signal, routing = currentRouting, onPartial, {skipEnsure=false,fullFlight=false}={}) {
     if(process.env.NODE_ENV==='development'&&!routing?.refresh&&!skipEnsure)await globalThis.__PRNEXT_DEV__?.ensureRoute?.(url.href);
@@ -326,12 +392,14 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
     }
     await onPartial?.(response, destination);
     let model;
-    try { model = assertModel(await createFromFetch(Promise.resolve(exported?response:await flightTransport.response(response,base)), flightOptions)); }
+    const flight = { complete: false };
+    try { model = assertModel(await createFromFetch(Promise.resolve(await flightTransport.response(response,base,{onEnd(){flight.complete = true;flight.committed?.();}})), flightOptions)); }
     catch(error) {
       if(!delta||fullFlight||signal?.aborted)throw error;
       flightTransport.clear();
       return requestFlight(url,signal,routing,onPartial,{skipEnsure:true,fullFlight:true});
     }
+    navigationStreams.set(model, flight);
     model.router.basePath = basePath;
     const rewrite = readRewriteHeader(response);
     if (rewrite) model.rewrite = rewrite;
@@ -408,15 +476,20 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
 
   function callServer(id, args) {
     if (!root) return Promise.reject(new Error('Server Actions cannot run during initial rendering'));
+    if (pageHidden || documentFallback) return Promise.reject(actionReloadError());
     const token = ++navigation;
     finishCommit?.();
     const target = new URL(window.location.href);
     saveScroll();
-    abandonPendingView();
+    const restored = abandonPendingView();
     activeRequest?.abort();
     appStyleManager(document).cancel();
     finishNavigation?.(); finishNavigation = undefined;
     activeRequest = undefined;
+    if (!restored) {
+      fallbackDocument(target.href);
+      return Promise.reject(actionReloadError());
+    }
     purgeRetainedPages();
     // Mutations are dispatched in order, including Set-Cookie effects required
     // by a subsequent action. Capture their route priority when invoked: a
@@ -427,6 +500,7 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
   }
 
   async function dispatchAction(id, args, token, target) {
+    if (pageHidden || documentFallback) throw actionReloadError();
     const release = scheduler.navigation();
     try { return await performAction(id, args, token, target); } finally { release(); }
   }
@@ -448,6 +522,7 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
     invalidatePrefetches();
     const temporaryReferences = createTemporaryReferenceSet();
     const body = await encodeReply(args, { temporaryReferences });
+    if (pageHidden || documentFallback) throw actionReloadError();
     const response = await fetch(target.href, {
       method: 'POST',
       headers: { ...deploymentHeaders(deploymentId), 'Next-Action': id, RSC: '1', Accept: 'text/x-component', ...(currentRouting ? { 'x-prnext-router-state': encodeURIComponent(JSON.stringify({ ...currentRouting, refresh: true })) } : {}) },
@@ -474,8 +549,21 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
     };
     if (process.env.NODE_ENV === 'development') await waitForDevelopmentUpdate();
     controller._retentionEpoch++;
+    const validOutcome = model && typeof model === 'object' && (Object.hasOwn(model, 'tree') || Object.hasOwn(model, 'actionResult') || model.actionError || model.actionRedirect || model.routingInvalid);
+    if (!validOutcome) throw new Error('The Server Action response did not contain a result');
+    if (Object.hasOwn(model, 'tree') && !model.routingInvalid) assertModel(model);
+    if (requiresAuthorizedDocument(model)) {
+      // A queued action or newer navigation can supersede the render token,
+      // but cannot make an observed account change safe to ignore. Complete
+      // this one POST and block the queue before any subsequent mutation.
+      const latest = pendingNavigation?.token === navigation ? pendingNavigation : undefined;
+      const redirected = token === navigation && model.actionRedirect ? navigationUrl(model.actionRedirect.url) : undefined;
+      const destination = latest?.url || redirected?.href || window.location.href;
+      fallbackDocument(destination, latest ? latest.replace : redirected ? model.actionRedirect.type === 'replace' : true, true);
+      return outcome();
+    }
     if (model?.routingInvalid || (model?.rootLayout && currentModel.rootLayout && model.rootLayout !== currentModel.rootLayout)) {
-      if (token === navigation) window.location.replace(target.href);
+      if (token === navigation) fallbackDocument(target.href);
       return outcome();
     }
     if (model?.actionRedirect) {
@@ -497,7 +585,7 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
       currentModel = model;
       historyRouting = currentRouting;
       appStyleManager(document).handoff(model.globalError ? [] : model.css || []);
-      renderView(model, target.href, { token });
+      renderView(model, target.href, { token, kind: 'action' });
     }
     if (model?.actionError) return outcome();
     // Flight's JSON reviver removes object fields encoded as $undefined. A
@@ -509,21 +597,26 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
   }
 
   async function navigate(href, { replace = false, scroll = true, pop = false, savedScroll, savedRouting, refresh = false } = {}) {
-    if (pageHidden) return;
+    if (pageHidden || documentFallback) return;
     const target = navigationUrl(href);
     if (!isApplicationURL(target, window.location.origin, basePath) || isHtmlDocumentRoute(htmlOnlyRoutes, removeBasePath(target.pathname, basePath))) {
-      if (replace) window.location.replace(target.href);
-      else window.location.assign(target.href);
+      fallbackDocument(target.href, replace);
       return;
     }
     const token = ++navigation;
+    const intent = { token, url: target.href, replace: replace || pop || refresh };
+    pendingNavigation = intent;
     finishCommit?.();
     saveScroll();
-    abandonPendingView();
+    const restored = abandonPendingView();
     activeRequest?.abort();
     appStyleManager(document).cancel();
     finishNavigation?.(); finishNavigation = undefined;
     activeRequest = undefined;
+    if (!restored) {
+      fallbackDocument(target.href, replace || pop || refresh);
+      return;
+    }
 
     function updateHistory(destination) {
       historyRouting = currentRouting;
@@ -545,6 +638,7 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
         target.pathname === committedUrl.pathname && target.search === committedUrl.search) {
       updateHistory(target);
       if (scroll) scrollToTarget(target, savedScroll);
+      if (pendingNavigation === intent) pendingNavigation = undefined;
       return;
     }
 
@@ -575,6 +669,10 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
           const abort = new AbortController();
           activeRequest = abort;
           result = await navigateFlight(target, abort.signal, currentRouting, async (response, destination) => {
+            // A cached shell (including any cached authorization key) cannot
+            // establish this request's live session identity. Strict account
+            // isolation waits for the freshly authorized Flight model instead.
+            if (controller._navigationCache?.authCookies !== undefined) return;
             if (!preview || token !== navigation || response.headers.get('x-prnext-ppr-id') !== preview.id ||
                 (preview.model.rootLayout && currentModel.rootLayout && preview.model.rootLayout !== currentModel.rootLayout)) return;
             // Auth, middleware and rewrites ran again. A changed target or a
@@ -599,6 +697,11 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
       if (token !== navigation) return;
       if (!isApplicationURL(result.url, window.location.origin, basePath)) throw new Error('The navigation destination requires a document request');
       if (result.model.rootLayout && currentModel.rootLayout && result.model.rootLayout !== currentModel.rootLayout) throw new Error('A different root layout requires a document request');
+      if (requiresAuthorizedDocument(result.model)) {
+        activeRequest?.abort();
+        fallbackDocument(result.url.href, replace || pop || refresh);
+        return;
+      }
       prepareLayoutCache(result.model, currentModel);
       await appStyleManager(document).prepare(result.model.globalError ? [] : result.model.css || [], activeRequest?.signal);
       if (token !== navigation) return;
@@ -629,22 +732,29 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
       }
       // Pages Router routes, public files, and unavailable Flight endpoints use
       // a normal document navigation, including the browser's redirect handling.
-      if (replace || pop || refresh) window.location.replace(target.href);
-      else window.location.assign(target.href);
+      fallbackDocument(target.href, replace || pop || refresh);
     } finally {
+      if (pendingNavigation === intent) pendingNavigation = undefined;
       if (finishNavigation === releaseNavigation) finishNavigation = undefined;
       releaseNavigation();
     }
   }
 
   function purgeRetainedPages() {
+    if (pageHidden || documentFallback) return false;
     saveScroll();
-    abandonPendingView();
+    if (!abandonPendingView()) {
+      activeRequest?.abort();
+      fallbackDocument(currentUrl.href);
+      return false;
+    }
     controller._retentionEpoch++;
     historyFocus.clear();
+    if (committedView.model === currentModel && committedView.authorizationEpoch === controller._authorizationEpoch) committedView = { ...committedView, retentionEpoch: controller._retentionEpoch };
     // This only updates retention for the already committed model. It must
     // not become a new pending Flight view or a development commit barrier.
     startTransition(() => root.render(appView({ model: currentModel, controller, url: committedView.url, globalErrorComponent, globalErrorCss })));
+    return true;
   }
 
   const controller = {
@@ -656,13 +766,13 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
     replace: (href, options) => { void navigate(navigationUrl(href), { ...options, replace: true }); },
     refresh: () => {
       invalidatePrefetches();
-      purgeRetainedPages();
+      if (!purgeRetainedPages()) return;
       void navigate(new URL(window.location.href), { refresh: true });
     },
     back: () => { saveScroll(); window.history.back(); },
     forward: () => { saveScroll(); window.history.forward(); },
     prefetch(href, options = {}) {
-      if (pageHidden) return;
+      if (pageHidden || documentFallback) return;
       const target = navigationUrl(href);
       if (!isApplicationURL(target, window.location.origin, basePath) || isHtmlDocumentRoute(htmlOnlyRoutes, removeBasePath(target.pathname, basePath))) return;
       target.hash = '';
@@ -727,8 +837,22 @@ async function startApp({ deploymentId, htmlOnlyRoutes, clientModules = {}, base
   window.addEventListener('popstate', event => {
     void navigate(new URL(window.location.href), { pop: true, savedScroll: event.state?.__prnext?.scroll, savedRouting: event.state?.__prnext?.routing });
   });
-  window.addEventListener('pagehide', () => { saveScroll(); pageHidden = true; navigation++; finishCommit?.(); abandonPendingView(); activeRequest?.abort(); appStyleManager(document).cancel(); finishNavigation?.(); finishNavigation = undefined; invalidatePrefetches(); });
-  window.addEventListener('pageshow', event => { pageHidden = false; if (event.persisted) controller.refresh(); });
+  window.addEventListener('pagehide', () => {
+    saveScroll(); pageHidden = true; navigation++; finishCommit?.(); abandonPendingView();
+    clearTimeout(documentTimer); documentTimer = undefined;
+    activeRequest?.abort(); appStyleManager(document).cancel(); finishNavigation?.(); finishNavigation = undefined; invalidatePrefetches();
+    // A cached document may contain an account's shared layout state. Keep it
+    // hidden if restored from BFCache until the next document authorizes it.
+    if (controller._navigationCache?.authCookies !== undefined) document.documentElement.style.visibility = 'hidden';
+  });
+  window.addEventListener('pageshow', event => {
+    pageHidden = false;
+    if (!event.persisted) return;
+    if (controller._navigationCache?.authCookies !== undefined) {
+      documentFallback = false;
+      fallbackDocument(window.location.href);
+    } else controller.refresh();
+  });
   window.addEventListener('prnext:invalidate-navigation', () => { controller._authorizationEpoch++; controller.refresh(); });
   let scrollFrame;
   window.addEventListener('scroll', () => {

package/runtime/app-partial.mjs

@@ -8,9 +8,10 @@ import { appContent } from './app-content.mjs';
 import { runRequestContext, currentRequest } from '../compat/headers.cjs';
 import { cachedValue, cacheGeneration, flushCacheWork } from '../compat/data-cache.cjs';
 import { partialModel, preparePartialModel } from './app-partial-model.mjs';
-import { MAX_RESPONSE_BYTES, escapeHtml } from './http.mjs';
+import { escapeHtml, MAX_RESPONSE_BYTES } from './http.mjs';
 import { fontPreloads } from './font-preload.mjs';
 import { PartialArtifactCache } from './partial-artifact-cache.mjs';
+export {partialShell} from './native-ppr.mjs';
 
 const artifacts = new Map();
 const parsedArtifacts = new PartialArtifactCache();
@@ -32,7 +33,6 @@ async function readArtifact(file) {
   }
   return value;
 }
-
 async function bytes(stream) {
   const chunks = [];
   let length = 0;
@@ -120,11 +120,3 @@ export async function partialArtifact({ request, route, manifest, filename, iden
     } finally { await flushCacheWork(context); }
   });
 }
-
-export function partialShell(artifact, route) {
-  const bootstrap = '<script>self.__PRNEXT_FLIGHT_STREAM__=self.__PRNEXT_FLIGHT_STREAM__||[];</script>' +
-    (route.client ? `<script type="module" async src="${escapeHtml(route.client)}"></script>` : '');
-  const end = artifact.shell.lastIndexOf('</body>');
-  if (end < 0 || !/<\/body><\/html>$/i.test(artifact.shell)) throw new Error('Invalid partial prerender document');
-  return artifact.shell.slice(0, end) + bootstrap + artifact.shell.slice(end);
-}

package/runtime/app-prefetch.mjs

@@ -1,6 +1,7 @@
 // Prefetch contains only prerendered segments. Request-dependent holes are
 // resolved by a fresh, authenticated navigation; they never enter this cache.
 import { PARTIAL_PREFETCH_BYTES } from './app-prefetch-constants.mjs';
+import { decodeBase64 } from '../compat/base64.cjs';
 export { PARTIAL_PREFETCH_TYPE, PARTIAL_PREFETCH_BYTES, PARTIAL_PREFETCH_CACHE_BYTES } from './app-prefetch-constants.mjs';
 
 export async function readPartialPrefetch(response) {
@@ -27,7 +28,6 @@ export async function readPartialPrefetch(response) {
 }
 
 export function partialFlightStream(base64) {
-  const binary = atob(base64);
-  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));
+  const bytes = decodeBase64(base64);
   return new ReadableStream({ start(controller) { controller.enqueue(bytes); controller.close(); } });
 }

package/runtime/app-render.mjs

@@ -1,7 +1,8 @@
 import {reportRequestError,acknowledgeRequestError} from './instrumentation.mjs';
 import {currentTraceparent} from './trace.mjs';
 import React from 'react';
-import { randomUUID, createHmac, randomBytes } from 'node:crypto';
+import { randomUUID, createHmac } from 'node:crypto';
+import { developmentNavigationSecret } from '../compat/navigation-authorization.cjs';
 import diagnostics from '../compat/diagnostics.cjs';
 import { rscResourceLimits } from './profile.mjs';
 import { fontPreloads } from './font-preload.mjs';
@@ -28,6 +29,7 @@ import { installFetchCache } from './fetch-cache.mjs';
 import { partialArtifact, partialShell } from './app-partial.mjs';
 import { partialKeyMap } from './app-partial-model.mjs';
 import { partialIdentity } from './partial-artifact-cache.mjs';
+import {nativePprArtifact} from './native-ppr.mjs';
 import { isDraftRequest } from '../compat/draft.cjs';
 import { createRscLifecycle } from './rsc-lifecycle.mjs';
 import { trackRequestWork } from './request-work.mjs';
@@ -43,7 +45,6 @@ const metadata = new WeakMap();
 const artifacts = new WeakMap();
 const edgeManifests = new WeakMap();
 const emptyManifest = Object.freeze({});
-const developmentAuthorizationSecret = randomBytes(32).toString('hex');
 let nextId = 0;
 const pending = new Map();
 const noop = () => {};
@@ -506,7 +507,7 @@ export async function renderAppPage(options) {
   return differentialFlight(response, options);
 }
 
-async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distDir = path.dirname(path.dirname(modulePath)), url = 'http://localhost/', originalUrl, params = {}, method = 'GET', headers = {}, routingRequestHeaders, routingResolver, body = '', production = process.env.NODE_ENV === 'production', stream = false, signal, deferFinalizer }) {
+async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distDir = path.dirname(path.dirname(modulePath)), url = 'http://localhost/', originalUrl, params = {}, method = 'GET', headers = {}, routingRequestHeaders, routingResolver, body = '', production = process.env.NODE_ENV === 'production', stream = false, signal, deferFinalizer, renderMode }) {
   if (route.htmlOnly) return { status:409, headers:{'content-type':'text/plain; charset=utf-8','cache-control':'private, no-store','x-prnext-document-navigation':'1'}, body:Buffer.from('This HTML-only page requires its prerendered document.') };
   let clientModules = manifest.app?.clientModules || emptyManifest;
   if (route.cacheConfig?.runtime === 'edge') {
@@ -522,7 +523,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
   }
   const responseHeaders = { 'cache-control': 'private, no-cache, no-store, max-age=0', vary: 'RSC' };
   const request = { modulePath, routePattern: route.pattern, cacheConfig: route.cacheConfig, css: route.css || [], cssScopes: route.cssScopes || [], fonts: route.fonts || [], nonce: scriptNonce(headers), basePath: manifest.config?.basePath || '', trailingSlash: manifest?.config?.trailingSlash || false, skipTrailingSlashRedirect: manifest?.config?.skipTrailingSlashRedirect || false, url, originalUrl, params, method, headers, clientModules, production,
-    distDir, traceparent:currentTraceparent(), instrumentation:manifest.instrumentation, strictMode: manifest.config?.reactStrictMode !== false, cacheComponents: manifest.config?.cacheComponents, navigationCache: manifest.config?.navigationCache, authorizationSecret: production ? manifest.app?.actionKey : developmentAuthorizationSecret, partialPrefetching: manifest.config?.partialPrefetching, cacheLife: manifest.config?.cacheLife, cacheHandlers: manifest.config?.cacheHandlers, cacheHandler: manifest.config?.cacheHandler, cacheMaxMemorySize: manifest.config?.cacheMaxMemorySize, serverActions: manifest.config?.serverActions, previewModeId: manifest.previewModeId, actions: manifest.app?.actions || emptyManifest, actionKey: manifest.app?.actionKey };
+    distDir, traceparent:currentTraceparent(), instrumentation:manifest.instrumentation, strictMode: manifest.config?.reactStrictMode !== false, cacheComponents: manifest.config?.cacheComponents, navigationCache: manifest.config?.navigationCache, authorizationSecret: production ? manifest.app?.actionKey : developmentNavigationSecret(manifest.app?.actionKey), partialPrefetching: manifest.config?.partialPrefetching, cacheLife: manifest.config?.cacheLife, cacheHandlers: manifest.config?.cacheHandlers, cacheHandler: manifest.config?.cacheHandler, cacheMaxMemorySize: manifest.config?.cacheMaxMemorySize, serverActions: manifest.config?.serverActions, previewModeId: manifest.previewModeId, actions: manifest.app?.actions || emptyManifest, actionKey: manifest.app?.actionKey };
   if (route.parallel) {
     request.routingResolver = routingResolver;
     request.skipProxyUrlNormalize = manifest.config?.skipProxyUrlNormalize;
@@ -554,6 +555,8 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
     }
   }
   const header = name => Object.entries(headers).find(([key]) => key.toLowerCase() === name)?.[1];
+  const native = await nativePprArtifact({renderMode, manifest, route, url, distDir});
+  if (native) request.nativePpr = native.descriptor;
   if (request.partialPrefetching && manifest.app?.actionKey) {
     // Preview identity includes authorization, but exposes no cookie material or
     // guessable credential hash. A changed login cannot reveal an old preview.
@@ -591,7 +594,7 @@ async function renderAppPageInner({ modulePath, route = {}, manifest = {}, distD
     const generic = route.pprGeneric?.find(item => Object.entries(item.params).every(([name, value]) => JSON.stringify(params[name]) === JSON.stringify(value)));
     const filename = (!originalUrl ? route.ppr?.[pathname] : undefined) || generic?.file;
     if (filename || route.pprFallback) {
-      const artifact = await partialArtifact({ request, route, manifest, filename, identity: filename === generic?.file ? filename : `${pathname}:${originalUrl ? new URL(originalUrl).pathname : ''}`, signal,
+      const artifact = native?.artifact || await partialArtifact({ request, route, manifest, filename, identity: filename === generic?.file ? filename : `${pathname}:${originalUrl ? new URL(originalUrl).pathname : ''}`, signal,
         regenerate: async build => (await import('./app-static.mjs')).prerenderAppRoute({ modulePath, route, manifest, distDir, production, renderMode:'isr',
           path: build?.generic?.path || pathname, originalUrl: build?.generic ? undefined : originalUrl,
           params: build?.generic?.params || params, partialParams: build?.generic?.unknown }),
@@ -672,6 +675,7 @@ async function renderPartialAppPage({ request, route, artifact, responseHeaders,
   const keys = [...partialKeyMap(artifact.keyScopes, request.params, removeBasePath(new URL(request.url).pathname, request.basePath))];
   const partialRequest = { ...request, partialFlight: artifact.flight, ...(keys.length ? { partialKeys: keys } : {}) };
   const headers = { ...artifact.headers, ...responseHeaders, 'x-prnext-prerender': artifact.complete ? 'complete' : 'partial', 'content-type': rsc ? 'text/x-component; charset=utf-8' : 'text/html; charset=utf-8' };
+  if (request.nativePpr) headers['x-prnext-native-ppr'] = request.nativePpr.artifactHash;
   const identity = partialIdentity(artifact);
   headers['x-prnext-ppr-id'] = identity;
   if (prefetch) {
@@ -703,7 +707,7 @@ async function renderPartialAppPage({ request, route, artifact, responseHeaders,
   let rendered;
   const cancel = async reason => { abort.abort(reason || new Error('Partial response cancelled')); await rendered?.cancel?.(reason); };
   const body = (async function* () {
-    let sent = 0;
+    let sent = request.nativePpr ? Buffer.byteLength(shell.replace(/<\/body><\/html>$/i, '')) : 0;
     const bounded = chunk => {
       sent += chunk.byteLength;
       if (sent > MAX_RESPONSE_BYTES) throw new Error('Response exceeds the 16 MiB PRNext limit');
@@ -712,7 +716,7 @@ async function renderPartialAppPage({ request, route, artifact, responseHeaders,
     try {
       // The committed bytes come straight from prerender. Even a blocked
       // request component cannot hold back this shared document shell.
-      yield bounded(Buffer.from(shell.replace(/<\/body><\/html>$/i, '')));
+      if (!request.nativePpr) yield bounded(Buffer.from(shell.replace(/<\/body><\/html>$/i, '')));
       const result = await continueFlight(combinedSignal, true);
       rendered = await renderProgressiveAppHtml({ result, request, route, responseHeaders, decodeFlight, signal: combinedSignal,
         partial: { shell, postponed: artifact.postponed, shellSent: true, resumeKeys: keys.map(([from, to]) => [to, from]) } });

package/runtime/app-stream-channel.mjs

@@ -1,5 +1,6 @@
 // One initial transferable chunk, then one chunk per reader pull. The initial
 // credit removes a round trip while keeping the queue bounded to 64 KiB.
+import { ownFlightStream } from '../compat/flight-delta.cjs';
 export const APP_STREAM_CHUNK_BYTES = 64 * 1024;
 
 export function workerStreamChannel(port, id) {
@@ -62,7 +63,7 @@ export function parentStreamChannel(port, id, cancelled) {
   let controller;
   let settlePull;
   let closed = false;
-  const body = new ReadableStream({
+  const body = ownFlightStream(new ReadableStream({
     start(value) { controller = value; },
     pull() {
       return new Promise(resolve => {
@@ -76,7 +77,7 @@ export function parentStreamChannel(port, id, cancelled) {
       port.postMessage({ id, type: 'cancel' });
       cancelled(reason);
     },
-  }, { highWaterMark: 0 });
+  }, { highWaterMark: 0 }));
   return {
     body,
     chunk(buffer, offset = 0, length = buffer?.byteLength) {

package/runtime/app-styles.mjs

@@ -32,7 +32,23 @@ export function appStyleManager(document, { timeout = 15_000 } = {}) {
       if (!records.length) sheets.delete(href);
     }
   }
-  function acquire(href, before, replace = false) {
+  // Initial HTML can contain many sheets. Index it once per synchronous
+  // prepare/commit operation, lazily when an untracked URL needs adoption.
+  // Never retain this snapshot across operations: external links may change.
+  function initialSheets() {
+    let index;
+    return (href, tracked) => {
+      if (!index) {
+        index = new Map();
+        for (const link of document.querySelectorAll('link[rel="stylesheet"]')) {
+          const url = link.href, links = index.get(url) || [];
+          links.push(link); index.set(url, links);
+        }
+      }
+      return index.get(href)?.find(link => !tracked.has(link));
+    };
+  }
+  function acquire(href, before, replace = false, initial = initialSheets()) {
     const records = sheets.get(href) || [];
     const current = records.at(-1);
     if (current && !replace) return current;
@@ -40,7 +56,7 @@ export function appStyleManager(document, { timeout = 15_000 } = {}) {
     // in place until commit. Discard older abandoned candidates immediately.
     if (replace) for (const record of [...records]) if (!record.active && !record.recovery && !reserved(record)) remove(href, record);
     const tracked = new Set(records.map(record => record.link));
-    const existing = replace ? undefined : [...document.querySelectorAll('link[rel="stylesheet"]')].find(link => link.href === href && !tracked.has(link));
+    const existing = replace ? undefined : initial(href, tracked);
     const link = existing || document.createElement('link');
     const sheet = { link, active: !!existing, ready: !!existing?.sheet, recovery: false };
     const retained = sheets.get(href) || [];
@@ -77,6 +93,7 @@ export function appStyleManager(document, { timeout = 15_000 } = {}) {
     async prepare(values = [], signal) {
       if (signal?.aborted) throw aborted();
       const wanted = urls(values);
+      const initial = initialSheets();
       const prepared = [];
       let before;
       // Establish cascade order before downloading. Re-inserting an already
@@ -85,7 +102,7 @@ export function appStyleManager(document, { timeout = 15_000 } = {}) {
       // when an existing sheet would otherwise need to move across that suffix.
       for (let index = wanted.length - 1; index >= 0; index--) {
         const href = wanted[index];
-        let sheet = acquire(href, before);
+        let sheet = acquire(href, before, false, initial);
         if (before && !(sheet.link.compareDocumentPosition(before) & 4)) sheet = acquire(href, before, true);
         prepared.push(sheet.promise);
         before = sheet.link;
@@ -113,12 +130,13 @@ export function appStyleManager(document, { timeout = 15_000 } = {}) {
     commit(values = []) {
       cleanup++;
       const wanted = new Set(urls(values));
+      const initial = initialSheets();
       const handedUrls = [...handed.keys()];
       const pinned = wanted.size === handed.size && [...wanted].every((href, index) => handedUrls[index] === href) ? handed : null;
       for (const href of wanted) {
         const records = sheets.get(href) || [];
         const prior = !pinned && handed.size ? records.find(record => record.active) || records.find(record => record.recovery) : undefined;
-        const sheet = pinned?.get(href) || prior || records.findLast(record => record.ready) || acquire(href);
+        const sheet = pinned?.get(href) || prior || records.findLast(record => record.ready) || acquire(href, undefined, false, initial);
         // Initial HTML links are render-blocking. A missing sheet is restored
         // on explicit recovery; normal navigation always prepares first.
         sheet.active = true; sheet.recovery = false; sheet.link.media = '';

package/runtime/compile-cache-retention.mjs

@@ -0,0 +1,53 @@
+import {lstat,opendir,unlink,realpath} from 'node:fs/promises';
+import path from 'node:path';
+import {captureStorageDirectory,verifyStorageDirectories,sameStoragePath} from './storage-path.mjs';
+import {withBuildLock} from './project-lock.mjs';
+
+/** Bounded maintenance of a known, disposable compiler namespace. Open V8
+ * cache readers remain valid; an evicted future lookup is a cache miss. */
+export async function pruneCompilerCache(directory,{maxBytes=64*1024*1024,maxFiles=2048}={}){
+  if(!directory)return;
+  try{
+    const snapshot=await captureStorageDirectory(directory);if(!snapshot)return;
+    return await withBuildLock(directory,async canonical=>{
+      if(!sameStoragePath(canonical,directory)||!await verifyStorageDirectories([snapshot]))return;
+      return prune(canonical,{maxBytes,maxFiles});
+    });
+  }
+  catch{/* A busy or unverifiable maintenance owner wins; never wait on it. */}
+}
+async function prune(directory,{maxBytes,maxFiles}){
+  try{
+    const files=[];let scanned=0,complete=true;
+    const input=await lstat(directory);if(!input.isDirectory()||input.isSymbolicLink())return;
+    directory=await realpath(directory);
+    const initial=await captureStorageDirectory(directory);if(!initial)return;
+    async function collect(folder,depth,parents){
+      if(depth>3){complete=false;return;}
+      const snapshot=await captureStorageDirectory(folder),guards=[...parents,snapshot];
+      if(!snapshot||!await verifyStorageDirectories(guards)){complete=false;return;}
+      const entries=await opendir(folder);
+      for await(const entry of entries){
+        if(++scanned>8192){complete=false;break;}
+        if(entry.name.startsWith('.'))continue;
+        const name=path.join(folder,entry.name),info=await lstat(name).catch(()=>null);
+        if(!info||info.isSymbolicLink())continue;
+        if(info.isDirectory())await collect(name,depth+1,guards);
+        else if(info.isFile())files.push({name,size:info.size,time:info.mtimeMs,ino:info.ino,dev:info.dev,guards});
+        if(!complete)break;
+      }
+      if(!await verifyStorageDirectories(guards))complete=false;
+    }
+    const info=await lstat(directory);if(!info.isDirectory()||info.isSymbolicLink())return;
+    await collect(directory,0,[initial]);if(!complete)return;
+    files.sort((a,b)=>b.time-a.time);let bytes=0,retained=0;
+    for(let i=0;i<files.length;i++){
+      const file=files[i];
+      if(retained>=maxFiles||bytes+file.size>maxBytes){
+        if(!await verifyStorageDirectories(file.guards))return;
+        const current=await lstat(file.name).catch(()=>null);
+        if(current?.isFile()&&!current.isSymbolicLink()&&current.ino===file.ino&&current.dev===file.dev&&current.mtimeMs===file.time&&current.size===file.size&&sameStoragePath(await realpath(file.name),file.name)&&await verifyStorageDirectories(file.guards))await unlink(file.name).catch(()=>{});
+      }else{bytes+=file.size;retained++;}
+    }
+  }catch{/* Compiler cache retention cannot fail a request or build. */}
+}