@thomas.f/prnext 0.1.19-alpha → 0.1.21-alpha

package/runtime/development.mjs

@@ -20,11 +20,14 @@ import {createDevRuntimePool} from './dev-runtime-pool.mjs';
 import {tryDevCssUpdate} from '../build/dev-css-update.mjs';
 import {devBuildReason} from './dev-build-reasons.mjs';
 import {publishDependencyGraph,affectedDependencies,canSkipUnopenedRoutes} from './dev-dependency-graph.mjs';
+import {selectiveDevelopmentRoutes} from './dev-route-selection.mjs';
 import {prepareDevNotification} from './dev-notification.mjs';
 import {writeAtomicFile} from './atomic-file.mjs';
 import {lazyImportIdentifier,materializeDevImport} from './dev-lazy-imports.mjs';
 import {discardLazyBuild} from './dev-lazy-staging.mjs';
+import {createDevelopmentQueue} from './development-queue.mjs';
 import {pruneDevelopmentStyles} from './dev-style-retention.mjs';
+import {createDevelopmentSessionOwner,pruneDevelopmentSessions,createRetiredGenerationCleanup} from './dev-session-retention.mjs';
 
 const packageRoot=fileURLToPath(new URL('../',import.meta.url));
 export function developmentRoute(routes,raw,config={}) {
@@ -83,7 +86,9 @@ function serverOptions(args) {
   return {hostname,port,backend,hostAi,profile,safe};
 }
 export async function develop(projectRoot,args,binary) {
-  return withBuildLock(projectRoot,root=>runDevelopment(root,args,binary),{development:true});
+  let entered=false;
+  try{return await withBuildLock(projectRoot,root=>{entered=true;return runDevelopment(root,args,binary);},{development:true});}
+  finally{if(entered)try{const {pruneCompilationStorage}=await import('../build/compilation-storage.mjs');await pruneCompilationStorage(projectRoot);}catch{/* Optional compilation-cache maintenance cannot change shutdown correctness. */}}
 }
 async function runDevelopment(projectRoot,args,binary) {
   const root=await realpath(projectRoot),options=serverOptions(args),session=randomUUID();
@@ -95,16 +100,21 @@ async function runDevelopment(projectRoot,args,binary) {
   // The session is ours; never clean a path obtained from application config.
   const container=path.join(root,'.prnext-dev'),info=await lstat(container).catch(error=>{if(error.code!=='ENOENT')throw error;});
   if(info&&(!info.isDirectory()||info.isSymbolicLink()))throw Error('Development directory must be a real directory');
+  await pruneDevelopmentSessions(root);
   await mkdir(home,{recursive:true});
+  const sessionOwner=createDevelopmentSessionOwner(home,{session});
+  if(options.safe)sessionOwner.disable();
   await mkdir(diagnosticsDirectory,{recursive:true,mode:0o700});
   let compiler,gateway,watcher,timer,tools,hostRelay,hostRelayTask,stopping=false,current,discovery,typeChecker,readyState={state:'building'},typeErrors=[],sequence=0;
   let dependencyIndexValid=false;
   const lifecycle=new AbortController();
-  let queue=Promise.resolve(),stateQueue=Promise.resolve(),output='.prnext',changes=new Set(),active=new Map(),failed=new Set();
+  const compilationQueue=createDevelopmentQueue({isStopping:()=>stopping});
+  let stateQueue=Promise.resolve(),output='.prnext',changes=new Set(),active=new Map(),failed=new Set();
   const failedPaths=new Set();
   const requestedImports=new Set();
   const generations=[],styleGenerations=[],retiring=new Set(),pins=new Map(),routeCache=new Map(),filter=createDevChangeFilter(root,{directoryEventsAreRecursive:process.platform==='darwin',ignore:relative=>relative===output||relative.startsWith(output+'/')});
-  const compilerBroker=await createDevCompilerBroker({compile:(pattern,sources)=>serialized(async()=>{
+  const retiredCleanup=createRetiredGenerationCleanup({root,home,gateway:{request:(...args)=>gateway.request(...args)},stop});
+  const compilerBroker=await createDevCompilerBroker({compile:(pattern,sources,admission)=>serialized(async()=>{
     if(stopping)throw Error('Development is stopping');
     if(!discovery)await discover();
     const patterns=[...new Set([pattern,...sources])];
@@ -113,11 +123,11 @@ async function runDevelopment(projectRoot,args,binary) {
     for(const value of patterns)active.set(value,Date.now());
     if(!current||patterns.some(p=>!current.patterns.has(p)))await rebuild([...active.keys()]);
     return current.directory;
-  })});
-  const runtimePool=createDevRuntimePool({binary,root,home,environment:{PRNEXT_DEV_COMPILER:compilerBroker.descriptor,PRNEXT_INSPECT_DIR:diagnosticsDirectory,...(options.profile?{PRNEXT_PROFILE:options.profile}:{})},onChild:child=>captureOutput({stderr:child.stderr,once:child.once.bind(child)},'runtime',{forwardStdout:false})});
+  },admission)});
+  const runtimePool=createDevRuntimePool({binary,root,home,environment:{PRNEXT_DEV_COMPILER:compilerBroker.descriptor,PRNEXT_INSPECT_DIR:diagnosticsDirectory,...(options.profile?{PRNEXT_PROFILE:options.profile}:{})},onBeforeChild:()=>sessionOwner.beforeSpawn(),onReady:(child,info,ticket)=>sessionOwner.spawned(ticket,child,[info.pid]),onChild:child=>captureOutput({stderr:child.stderr,once:child.once.bind(child)},'runtime',{forwardStdout:false})});
   const toolSnapshot=()=>({...readyState,safeMode:options.safe,sequence:readyState.sequence??sequence,session,typeErrors,
     routes:(discovery?.project.routes||[]).filter(route=>!route.internal).map(route=>({path:(discovery.config.basePath||'')+(route.pattern==='/'?'/':route.pattern),kind:route.kind,source:route.file?path.relative(root,route.file).replaceAll(path.sep,'/'):undefined,compiled:current?.patterns.has(route.pattern)||false,pinned:[...pins.values()].some(pin=>pin.pattern===route.pattern)})),
-    cache:{activeRoutes:active.size,pinnedRoutes:new Set([...pins.values()].map(pin=>pin.pattern)).size,retainedGenerations:generations.length,lookupEntries:routeCache.size,compiler:readyState.compiler,transforms:readyState.transforms,persistentTransforms:true,dependencyIndex:dependencyIndexValid?{valid:true,...current?.manifest.devDependencyIndex}:{valid:false}}});
+    cache:{activeRoutes:active.size,pinnedRoutes:new Set([...pins.values()].map(pin=>pin.pattern)).size,retainedGenerations:generations.length,retiredCleanupPending:retiredCleanup.pending,lookupEntries:routeCache.size,compiler:readyState.compiler,transforms:readyState.transforms,persistentTransforms:true,dependencyIndex:dependencyIndexValid?{valid:true,...current?.manifest.devDependencyIndex}:{valid:false}}});
   function captureOutput(child,source,{forwardStdout=true}={}){
     for(const [stream,level] of [[child.stdout,'info'],[child.stderr,'error']]){
       stream?.setEncoding('utf8');
@@ -151,12 +161,14 @@ async function runDevelopment(projectRoot,args,binary) {
     });
     stateQueue=task.catch(()=>{});return task;
   };
-  const serialized=run=>{const task=queue.then(()=>{if(stopping)throw Error('Development is stopping');return run();});queue=task.catch(()=>{});return task;};
+  const serialized=(run,admission)=>compilationQueue.enqueue(run,admission);
   async function compilerRequest(type,values={}){
     if(!compiler||compiler.exitCode!==null||compiler.signalCode){
       const cache=await privateCacheDirectory(root,'dev-compiler-v8');
       await pruneCompilerCache(cache);
+      const ticket=sessionOwner.beforeSpawn();
       compiler=spawn(process.execPath,[path.join(packageRoot,'build/dev-worker.mjs')],{stdio:['pipe','pipe','pipe','ipc'],windowsHide:true,env:{...process.env,NODE_ENV:process.env.NODE_ENV||'development',...(options.safe?{PRNEXT_BUILD_CACHE:'0'}:{}),...(cache?{NODE_COMPILE_CACHE:cache}:{})}});
+      sessionOwner.spawned(ticket,compiler);
       captureOutput(compiler,'compiler');
     }
     const child=compiler;
@@ -174,14 +186,17 @@ async function runDevelopment(projectRoot,args,binary) {
     if(options.safe)discovery={...discovery,eager:true};
     const {writeTypedRoutes}=await import('../build/typed-routes.mjs');
     await writeTypedRoutes(root,discovery.project,discovery.config);
-    if(!typeChecker||typeChecker.inactive){const {startTypeChecker}=await import('../build/typescript-dev.mjs');typeChecker=await startTypeChecker(root,discovery.config,errors=>{typeErrors=errors;if(!stopping)void writeState().catch(console.error);});}
+    if(!typeChecker||typeChecker.inactive){const {startTypeChecker}=await import('../build/typescript-dev.mjs');typeChecker=await startTypeChecker(root,discovery.config,errors=>{typeErrors=errors;if(!stopping)void writeState().catch(console.error);},{onBeforeChild:()=>sessionOwner.beforeSpawn(),onChild:(child,ticket)=>sessionOwner.spawned(ticket,child)});}
   }
   async function launch(manifest,directory){
     const runtime=options.safe?undefined:await runtimePool.take(directory).catch(error=>{tools?.addServerLog('warn','Worker warmup was unavailable; starting a fresh worker.',{process:'runtime'});return undefined;});
+    if(!runtime)sessionOwner.disable();
     const env={...process.env,NODE_ENV:process.env.NODE_ENV||'development',PRNEXT_INSPECT_DIR:diagnosticsDirectory,PRNEXT_DEV_COMPILER:compilerBroker.descriptor};
     delete env.PRNEXT_DEV_BROKER;
     if(runtime)env.PRNEXT_DEV_BROKER=runtime.descriptor;
+    const ticket=sessionOwner.beforeSpawn();
     const child=spawn(binary,['start',root,'--build-dir',directory,'--worker',path.join(root,directory,'runtime/worker.mjs'),'--node',process.execPath,'--hostname','127.0.0.1','--port','0','--shutdown-on-stdin-eof',...options.backend],{stdio:['pipe','pipe','pipe'],windowsHide:true,env});
+    sessionOwner.spawned(ticket,child);
     captureOutput(child,'runtime',{forwardStdout:false});
     let output='';
     const port=await new Promise((resolve,reject)=>{
@@ -193,6 +208,8 @@ async function runDevelopment(projectRoot,args,binary) {
     return {id:manifest.buildId,child,runtime,port,directory};
   }
   async function rebuild(patterns,changedFiles=[],affectedRoutes,affectedModules,cause){
+    void retiredCleanup.retry();
+    if(retiredCleanup.pending>=64)throw Error('Development snapshots could not be removed. Close applications locking these files, then retry.');
     const startedAt=Date.now(),started=performance.now(),phases={};let mark=started;
     let reason=devBuildReason({initial:!current,safe:options.safe,changed:changedFiles,cause});
     await writeState({state:'building',reason});
@@ -233,7 +250,11 @@ async function runDevelopment(projectRoot,args,binary) {
       const previous=current;current=next;current.compiler=result.compiler;current.transforms=result.transforms;generations.push(next);failed.clear();failedPaths.clear();
       current.manifest=manifest;current.changed=changed;current.patterns=new Set(discovery.eager?discovery.project.routes.map(route=>route.pattern):patterns);
       for(const id of requestedImports)if(!manifest.devLazy?.modules.some(item=>item.id===id))requestedImports.delete(id);
-      const affected=Object.keys(manifest.app?.actions||{}).length?undefined:affectedRoutes;
+      let affected;
+      if(dependencyIndexValid&&affectedRoutes) {
+        const nextAffected=await affectedDependencies(gateway,changedFiles).catch(()=>undefined);
+        affected=selectiveDevelopmentRoutes(previous?.manifest,manifest,{changed:changedFiles,affectedRoutes,affectedModules,nextAffected});
+      }
       current.affectedRoutes=affected;
       try{
         await writeState({state:'ready',reason,buildId:manifest.buildId,clientManifest:manifest.devClient,sequence:manifest.devSequence,session,changed,affectedRoutes:affected,listenerPid:gateway.child.pid,compiler:result.compiler,transforms:result.transforms,routes:manifest.routes.filter(route=>!route.internal&&!route.devDeferred).map(route=>route.pattern)});
@@ -250,7 +271,7 @@ async function runDevelopment(projectRoot,args,binary) {
         while(generations.length>3){const old=generations.shift();
           // A deferred request may itself be awaiting this build. Never wait for
           // its generation lease while holding the serialized compiler queue.
-          const cleanup=(async()=>{await gateway.request('retire',{generation:old.id});await old.runtime?.close();await stop(old.child);await gateway.request('forget',{generation:old.id});await rm(path.join(root,old.directory),{recursive:true,force:true,maxRetries:10,retryDelay:100});})().catch(error=>{if(!stopping)console.warn('Development generation cleanup: '+error.message);}).finally(()=>retiring.delete(cleanup));retiring.add(cleanup);
+          const cleanup=retiredCleanup.enqueue(old).finally(()=>retiring.delete(cleanup));retiring.add(cleanup);
         }
       }
       await watcher?.refresh();
@@ -258,7 +279,7 @@ async function runDevelopment(projectRoot,args,binary) {
     }catch(error){if(!stopping){tools?.recordBuild({sequence,reason:reason.summary,reasonCode:reason.code,time:Date.now(),startedAt,duration:performance.now()-started,phases,state:'error'});tools?.addServerLog('error',error.message,{process:'compiler'});console.error('Build failed: '+error.message);await writeState({state:'error',reason,error:error.message});}throw error;}
   }
   const updateInfo=()=>({buildId:current.manifest.buildId,clientManifest:current.manifest.devClient,pagesManifest:current.manifest.pagesManifest,sequence:current.manifest.devSequence,session,changed:current.changed,cssOnly:current.cssOnly,affectedRoutes:current.affectedRoutes});
-  async function ensure(raw,client,exact=false){
+  async function ensure(raw,client,exact=false,admission={}){
     if(new URL(raw,'http://local').pathname.startsWith('/_prnext/lazy/'))return serialized(async()=>{
       const id=lazyImportIdentifier(raw);
       if(!id||!current)throw Error('Unknown deferred import identifier');
@@ -270,7 +291,7 @@ async function runDevelopment(projectRoot,args,binary) {
       finally{try{await discardLazyBuild(root,built);}catch(error){if(failure){failure.cleanupError=error;failure.message+='; deferred compiler staging cleanup also failed';}else throw error;}}
       requestedImports.add(id);
       return {lazy};
-    });
+    },admission);
     const resolve=()=>exact?discovery.project.routes.find(route=>route.pattern===raw):findRoute(raw);
     const warm=discovery&&resolve();
     if(!stopping&&current&&warm&&active.has(warm.pattern)&&current.patterns.has(warm.pattern)){
@@ -296,7 +317,7 @@ async function runDevelopment(projectRoot,args,binary) {
       try{await rebuild([...active.keys()]);}catch(error){if(route){failed.add(route.pattern);active.delete(route.pattern);}throw error;}
     }
     return updateInfo();
-  });}
+  },admission);}
   async function changed(){
     try{
     const pending=[...changes];changes.clear();
@@ -329,8 +350,8 @@ async function runDevelopment(projectRoot,args,binary) {
       // Keep each native data-cache bridge alive until its externally owned
       // Node process has drained after() work and cache fills on stdin EOF.
       await runtimePool.close();
-      await Promise.all([tools?.close(),...generations.map(g=>stop(g.child)),...retiring]);
-      await queue.catch(()=>{});await compilerBroker.close();await stateQueue;await rm(home,{recursive:true,force:true,maxRetries:10,retryDelay:100});await rm(stateFile,{force:true});
+      await Promise.all([tools?.close(),...generations.map(g=>stop(g.child)),...retiring,retiredCleanup.close()]);
+      await compilationQueue.idle();await compilerBroker.close();await stateQueue;await rm(home,{recursive:true,force:true,maxRetries:10,retryDelay:100});await rm(stateFile,{force:true});
     })();return closing;
   };
   const fatal=error=>{if(!stopping){console.error(error.message);process.exitCode=1;void shutdown();}};
@@ -344,7 +365,7 @@ async function runDevelopment(projectRoot,args,binary) {
       return {...updateInfo(),...result};
     })});
     await writeState({state:'building',session});
-    gateway=new DevGateway(binary,root,{...options,onEnsure:ensure,onFatal:fatal,
+    gateway=new DevGateway(binary,root,{...options,onEnsure:(raw,client,admission)=>ensure(raw,client,false,admission),onFatal:fatal,onBeforeChild:()=>sessionOwner.beforeSpawn(),onChild:(child,ticket)=>sessionOwner.spawned(ticket,child),
       onOpen:message=>{const route=discovery&&findRoute(message.path);if(route)pins.set(message.client,{pattern:route.pattern,connection:message.connection});},
       onClose:message=>{if(pins.get(message.client)?.connection===message.connection)pins.delete(message.client);}});
     const listener=await gateway.ready;

package/runtime/env.mjs

@@ -57,6 +57,15 @@ export function loadEnvConfig(projectRoot, { dev = false, env = process.env, mod
   return { combinedEnv: env, parsedEnv, loadedEnvFiles };
 }
 
+/** Native runtime settings need the same project env as its Node workers.
+ * Return a fresh object: persistent apps must never share loaded credentials.
+ */
+export function productionEnvironment(projectRoot, {env=process.env}={}) {
+  const combined={...env,NODE_ENV:env.NODE_ENV||'production'};
+  loadEnvConfig(projectRoot,{dev:false,env:combined});
+  return combined;
+}
+
 export function shouldWatchProjectFile(filename) {
   if (!filename) return false;
   const parts = String(filename).split(/[\\/]/);

package/runtime/flight-delta.mjs

@@ -1,5 +1,5 @@
 import { randomBytes, createHmac } from 'node:crypto';
-import { deflateRawSync } from 'node:zlib';
+import { deflateRaw } from 'node:zlib';
 import { TYPE, MAX_VALUE, collectStream, deltaStream } from '../compat/flight-delta.cjs';
 
 export function createFlightStore({maxBytes=32*1024*1024,maxEntries=64,ttl=30000,maxCaptures=8,maxEncoders=2,now=Date.now,setTimer=setTimeout,clearTimer=clearTimeout}={}) {
@@ -39,7 +39,34 @@ export function createFlightStore({maxBytes=32*1024*1024,maxEntries=64,ttl=30000
   };
 }
 const store=createFlightStore();
-export function compressedDeltaPolicy(acceptEncoding='') {
+const compress=value=>new Promise((resolve,reject)=>deflateRaw(value,{level:1},(error,result)=>error?reject(error):resolve(result)));
+
+// At most two probes (four small zlib jobs) across all stores and requests.
+// Admission never queues: a saturated probe keeps ordinary Flight. An aborted
+// caller stops waiting, but its slot remains occupied until native work ends.
+export function createCompressionProbe({maxConcurrent=2,compress:run=compress}={}) {
+  if(!Number.isInteger(maxConcurrent)||maxConcurrent<1||maxConcurrent>8||typeof run!=='function')throw new TypeError('Invalid Flight compression probe policy');
+  let active=0;
+  const probe=(raw,encoded,signal)=>{
+    signal?.throwIfAborted();
+    if(raw.length>64*1024||encoded.length+32>=raw.length||active>=maxConcurrent)return false;
+    active++;
+    const work=Promise.allSettled([Promise.resolve().then(()=>run(encoded)),Promise.resolve().then(()=>run(raw))])
+      .then(results=>results.every(result=>result.status==='fulfilled')&&results[0].value.length+32<results[1].value.length*0.9)
+      .finally(()=>{active--;});
+    if(!signal)return work;
+    return new Promise((resolve,reject)=>{
+      const abort=()=>{signal.removeEventListener('abort',abort);reject(signal.reason);};
+      signal.addEventListener('abort',abort,{once:true});
+      if(signal.aborted)abort();
+      work.then(resolve,reject).finally(()=>signal.removeEventListener('abort',abort));
+    });
+  };
+  Object.defineProperty(probe,'inFlight',{get:()=>active});
+  return probe;
+}
+const compressionProbe=createCompressionProbe();
+export function compressedDeltaPolicy(acceptEncoding='',{signal}={}) {
   const compressed=acceptEncoding.split(',').some(value=>{
     const [name,...parameters]=value.trim().toLowerCase().split(';');
     return /^(gzip|deflate|br|zstd|\*)$/.test(name)&&!parameters.some(p=>/^\s*q\s*=\s*0(?:\.0*)?\s*$/.test(p));
@@ -48,8 +75,7 @@ export function compressedDeltaPolicy(acceptEncoding='') {
   // This conservative, bounded probe is not the response compressor. It avoids
   // choosing thousands of references to JSON that gzip already compresses well.
   // A large/expensive chunk keeps ordinary Flight instead of delaying a flush.
-  return (raw,encoded)=>raw.length<=64*1024&&encoded.length+32<raw.length&&
-    deflateRawSync(encoded,{level:1}).length+32<deflateRawSync(raw,{level:1}).length*0.9;
+  return (raw,encoded)=>compressionProbe(raw,encoded,signal);
 }
 export async function differentialFlight(response,options,cache=store) {
   const headers=new Headers(options.headers), outgoing=new Headers(response.headers);
@@ -64,7 +90,7 @@ export async function differentialFlight(response,options,cache=store) {
       controller.enqueue(raw instanceof Uint8Array?raw:raw instanceof ArrayBuffer?new Uint8Array(raw):new TextEncoder().encode(String(raw??'')));controller.close();
     }});
     const collected=collectStream(body,{capture:!!releaseCapture,onComplete:bytes=>cache.set(token,identity,bytes),onFinally:releaseCapture});
-    encoded=base?await deltaStream(collected,base,{assess:compressedDeltaPolicy(headers.get('accept-encoding')||'')}):{delta:false,body:collected};
+    encoded=base?await deltaStream(collected,base,{assess:compressedDeltaPolicy(headers.get('accept-encoding')||'',{signal:options.signal})}):{delta:false,body:collected};
     if(!encoded.delta)releaseEncoder?.();
     else encoded.body=collectStream(encoded.body,{capture:false,onFinally:releaseEncoder});
   }catch(error){releaseEncoder?.();releaseCapture?.();throw error;}

package/runtime/flight-diagnostics.mjs

@@ -0,0 +1,48 @@
+import diagnostics from '../compat/diagnostics.cjs';
+
+const phases = new Set(['ssr', 'rsc']);
+const outcomes = new Set(['completed', 'failed', 'cancelled', 'timedOut']);
+const count = value => Number.isSafeInteger(value) && value >= 0 ? Math.min(value, 32 * 1024 * 1024) : 0;
+
+// Disabled in the ordinary request path. No body, URL, parameters, nonce, model,
+// client references or request context is retained, even when enabled. Timings
+// include asynchronous rendering/waiting; they are NOT isolated encoder CPU.
+export function createFlightMeasurement(request, phase, options) {
+  if (!(options?.enabled ?? diagnostics.enabled) || !phases.has(phase)) return;
+  const now = options?.now ?? (() => performance.now());
+  const record = options?.record ?? diagnostics.record;
+  const started = now();
+  const route = typeof request?.routePattern === 'string' ? request.routePattern.slice(0, 256) : '<unattributed>';
+  const method = /^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS)$/.test(request?.method) ? request.method : '_OTHER';
+  let ended = false, firstChunkMs, modelReadyMs, shellReadyMs, ppr;
+  const elapsed = () => Math.max(0, Math.min(86400000, now() - started));
+  const metrics = {
+    flightBytes: 0, flightChunks: 0, responseBytes: 0, peakQueuedBytes: 0,
+    chunk(bytes) {
+      if (ended) return;
+      firstChunkMs ??= elapsed();
+      metrics.flightBytes += count(bytes);
+      metrics.flightChunks++;
+    },
+    mark(name) {
+      if (ended) return;
+      if (name === 'modelReady') modelReadyMs ??= elapsed();
+      else if (name === 'shellReady') shellReadyMs ??= elapsed();
+    },
+    partial(mode) { if (!ended && ['direct', 'normalized'].includes(mode)) ppr = mode; },
+    finish(outcome, status) {
+      if (ended || !outcomes.has(outcome)) return;
+      ended = true;
+      const event = { route, method, phase, outcome, durationMs: elapsed(),
+        flightBytes: count(metrics.flightBytes), flightChunks: count(metrics.flightChunks),
+        responseBytes: count(metrics.responseBytes), peakQueuedBytes: count(metrics.peakQueuedBytes),
+        ...(Number.isInteger(status) && status >= 100 && status <= 599 ? {status} : {}),
+        ...(firstChunkMs !== undefined ? {firstChunkMs} : {}),
+        ...(modelReadyMs !== undefined ? {modelReadyMs} : {}),
+        ...(shellReadyMs !== undefined ? {shellReadyMs} : {}), ...(ppr ? {ppr} : {}) };
+      // Diagnostics must never replace a response/error with an export failure.
+      try { record('flight', event); } catch {}
+    },
+  };
+  return metrics;
+}

package/runtime/flight-tap.mjs

@@ -1,7 +1,7 @@
 // Share Flight allocations with the SSR decoder, then group only already
 // available bootstrap bytes. Never wait for a future Suspense chunk to fill a
 // block. The queue's pre-shell ceiling remains the overall response budget.
-export function flightTap(source) {
+export function flightTap(source, metrics) {
   const reader=source.getReader(),queue=[];
   let head=0,bytes=0,done=false,failure,outputStarted=false,wakeData,wakeSpace,cancelled;
   const finish=error=>{done=true;failure=error;wakeData?.();wakeData=undefined;wakeSpace?.();wakeSpace=undefined;};
@@ -11,17 +11,22 @@ export function flightTap(source) {
       while(!done&&outputStarted&&bytes>=128*1024)await new Promise(resolve=>{wakeSpace=resolve;});
       if(done){if(failure)controller.error(failure);else controller.close();return;}
       const next=await reader.read();if(next.done){finish();controller.close();return;}
-      queue.push(next.value);bytes+=next.value.byteLength;wakeData?.();wakeData=undefined;controller.enqueue(next.value);
+      queue.push(next.value);bytes+=next.value.byteLength;
+      if(metrics){metrics.chunk(next.value.byteLength);metrics.peakQueuedBytes=Math.max(metrics.peakQueuedBytes,bytes);}
+      wakeData?.();wakeData=undefined;controller.enqueue(next.value);
     }catch(error){finish(error);controller.error(error);}},cancel,
   },{highWaterMark:0});
   return {body,cancel,startOutput(){outputStarted=true;},async next(){
     while(head===queue.length&&!done)await new Promise(resolve=>{wakeData=resolve;});
     if(head<queue.length){
-      const parts=[];let size=0;
-      do{const value=queue[head];queue[head++]=undefined;parts.push(value);size+=value.byteLength;}while(head<queue.length&&size+queue[head].byteLength<=32*1024);
+      const first=queue[head];queue[head++]=undefined;
+      let size=first.byteLength,parts;
+      while(head<queue.length&&size+queue[head].byteLength<=32*1024){
+        parts??=[first];const value=queue[head];queue[head++]=undefined;parts.push(value);size+=value.byteLength;
+      }
       bytes-=size;if(head===queue.length){queue.length=0;head=0;}else if(head>=64){queue.splice(0,head);head=0;}
       wakeSpace?.();wakeSpace=undefined;
-      return {value:parts.length===1?parts[0]:Buffer.concat(parts,size),done:false};
+      return {value:parts?Buffer.concat(parts,size):first,done:false};
     }
     if(failure)throw failure;return {done:true};
   }};

package/runtime/html-envelope.mjs

@@ -1,9 +1,39 @@
 import { MAX_RESPONSE_BYTES } from './http.mjs';
 
+const flightScriptEndText = '");document.currentScript.remove()</script>';
+const flightScriptEnd = Buffer.from(flightScriptEndText);
+
+// nonceAttribute is already escaped by the response's HTML renderer. Keep its
+// tiny prefix per response, not a full base64 script string for each chunk.
+// The returned Buffer is owned by the caller and can go straight to transport.
+export function flightBootstrap(nonceAttribute = '') {
+  const start = `<script${nonceAttribute}>(self.__PRNEXT_FLIGHT_STREAM__||=[]).push("`;
+  let prefix, first = true;
+  return value => {
+    if (!(value instanceof Uint8Array) || value.byteLength > MAX_RESPONSE_BYTES) throw new TypeError('Invalid Flight bootstrap bytes');
+    const bytes = Buffer.isBuffer(value) ? value : Buffer.from(value.buffer, value.byteOffset, value.byteLength);
+    const encoded = bytes.toString('base64');
+    // Most tiny responses finish with one frame. Keep their short original
+    // encoding path instead of paying for a reusable prefix plus three writes.
+    if (first && bytes.byteLength <= 2048) { first = false; return Buffer.from(start + encoded + flightScriptEndText); }
+    first = false;
+    prefix ??= Buffer.from(start);
+    const result = Buffer.allocUnsafe(prefix.length + encoded.length + flightScriptEnd.length);
+    prefix.copy(result);
+    result.write(encoded, prefix.length, encoded.length, 'ascii');
+    flightScriptEnd.copy(result, prefix.length + encoded.length);
+    return result;
+  };
+}
+
 // A raw element cannot be interrupted with a Flight script. Keep its chunks
 // until its closing tag arrives, but only scan newly received characters.
 // Joining and rescanning a growing inline script on every chunk is quadratic.
 const whitespace = /\s/;
+// Complete, unquoted ordinary markup needs no per-tag JS scan. Reject every
+// raw/document/comment candidate (including split prefixes) before this path.
+// Quoted attributes and incomplete tags keep the general streaming parser.
+const specialMarkup = /<(?:!|\?|\/(?:body|html)|script|style|textarea|title|svg|math)/i;
 function holdRaw(state, text) {
   if (!text) return;
   // Compact small chunks in tiers: even single-character input cannot retain
@@ -60,6 +90,10 @@ export function htmlEnvelope({ resumed = false } = {}) {
     append(text) {
       received += Buffer.byteLength(text);
       if (received > MAX_RESPONSE_BYTES) throw new Error('HTML response exceeds the 16 MiB PRNext limit');
+      if (!pending && !rawPending) {
+        if (!text.includes('<') || !text.includes('"') && !text.includes("'") &&
+            !specialMarkup.test(text) && text.lastIndexOf('>') > text.lastIndexOf('<')) return text;
+      }
       let ready = '';
       if (rawPending) {
         const end = rawEnd(text, rawPending);

package/runtime/loopback-rpc.mjs

@@ -0,0 +1,92 @@
+import net from 'node:net';
+import {createHmac,randomBytes,timingSafeEqual} from 'node:crypto';
+
+const protocol='prnext-loopback-v2',noncePattern=/^[a-f0-9]{64}$/;
+const nonce=()=>randomBytes(32).toString('hex');
+const authenticationError=()=>Object.assign(Error('Loopback peer authentication failed'),{code:'ERR_PRNEXT_PEER_AUTH'});
+const proof=(token,context,role,client,server,...body)=>createHmac('sha256',token).update(JSON.stringify([protocol,context,role,client,server,...body])).digest('hex');
+function matches(supplied,expected){return typeof supplied==='string'&&noncePattern.test(supplied)&&timingSafeEqual(Buffer.from(supplied,'hex'),Buffer.from(expected,'hex'));}
+function encode(value,limit){const body=JSON.stringify(value);if(typeof body!=='string'||Buffer.byteLength(body)>limit)throw Error('Loopback control body is too large');return body;}
+function send(socket,value){socket.write(JSON.stringify({protocol,...value})+'\n');}
+
+function frames(socket,limit,receive,fail){
+  let buffer=Buffer.alloc(0);
+  socket.on('data',chunk=>{
+    try{
+      buffer=Buffer.concat([buffer,chunk]);
+      for(;;){
+        const end=buffer.indexOf(10),maximum=limit();
+        if(end<0){if(buffer.length>maximum)throw Error('Loopback control frame is too large');return;}
+        if(end>maximum)throw Error('Loopback control frame is too large');
+        const message=JSON.parse(buffer.subarray(0,end).toString('utf8'));buffer=buffer.subarray(end+1);
+        if(!message||message.protocol!==protocol)throw authenticationError();
+        receive(message);if(socket.destroyed)return;
+      }
+    }catch(error){fail(error);}
+  });
+}
+
+// One fresh transcript authorizes exactly one payload. Role and context labels
+// prevent reflection and cross-service reuse; both nonces prevent replay across
+// connections and watchdog restarts. The first client frame contains only a
+// nonce; the command follows a verified server proof. The key is never sent.
+export function requestLoopback({port,token},request,{context,timeout=120000,signal,maxRequestBytes=65536,maxResponseBytes=1024*1024}={}) {
+  if(signal?.aborted)return Promise.reject(signal.reason||Error('Loopback request aborted'));
+  let body;try{body=encode(request,maxRequestBytes);}catch(error){return Promise.reject(error);}
+  return new Promise((resolve,reject)=>{
+    const socket=net.connect({host:'127.0.0.1',port});
+    const client=nonce();let server,state='challenge',finished=false;
+    const finish=(error,value)=>{if(finished)return;finished=true;clearTimeout(handshake);clearTimeout(total);signal?.removeEventListener('abort',abort);socket.destroy();error?reject(error):resolve(value);};
+    const abort=()=>finish(signal.reason||Error('Loopback request aborted'));
+    const total=setTimeout(()=>finish(Error('Loopback request timed out')),timeout);
+    const handshake=setTimeout(()=>finish(authenticationError()),Math.min(5000,timeout));
+    signal?.addEventListener('abort',abort,{once:true});
+    socket.once('connect',()=>send(socket,{type:'hello',client}));
+    socket.on('error',error=>finish(error));
+    socket.on('end',()=>finish(state==='challenge'?authenticationError():Error('Loopback peer disconnected')));
+    socket.on('close',()=>{if(!finished)finish(state==='challenge'?authenticationError():Error('Loopback peer disconnected'));});
+    frames(socket,()=>state==='challenge'?1024:2*maxResponseBytes+1024,message=>{
+      if(state==='challenge'){
+        if(message.type!=='challenge'||typeof message.server!=='string'||!noncePattern.test(message.server)||!matches(message.proof,proof(token,context,'server',client,message.server)))throw authenticationError();
+        server=message.server;state='response';clearTimeout(handshake);
+        send(socket,{type:'request',body,proof:proof(token,context,'request',client,server,body)});
+        return;
+      }
+      if(state!=='response'||message.type!=='response'||typeof message.body!=='string'||Buffer.byteLength(message.body)>maxResponseBytes||!matches(message.proof,proof(token,context,'response',client,server,body,message.body)))throw authenticationError();
+      const result=JSON.parse(message.body);state='done';
+      if(!result||typeof result.ok!=='boolean')throw Error('Invalid loopback response');
+      finish(result.ok?null:Error(typeof result.error==='string'?result.error:'Loopback request failed'),result.value);
+    },error=>finish(error));
+  });
+}
+
+export function serveLoopback(socket,{token,context,handle,timeout=125000,handshakeTimeout=5000,maxRequestBytes=65536,maxResponseBytes=1024*1024}) {
+  const controller=new AbortController();let client,server,requestBody,state='hello';
+  const deadlineMs=Date.now()+timeout;
+  const close=()=>{state='closed';controller.abort();socket.destroy();};
+  const total=setTimeout(close,timeout),handshake=setTimeout(close,Math.min(handshakeTimeout,timeout));
+  socket.on('error',()=>{});
+  socket.once('close',()=>{state='closed';clearTimeout(total);clearTimeout(handshake);controller.abort();});
+  socket.on('end',close);
+  frames(socket,()=>state==='hello'?1024:2*maxRequestBytes+1024,message=>{
+    if(state==='hello'){
+      if(message.type!=='hello'||typeof message.client!=='string'||!noncePattern.test(message.client))throw authenticationError();
+      client=message.client;server=nonce();state='request';
+      send(socket,{type:'challenge',server,proof:proof(token,context,'server',client,server)});return;
+    }
+    if(state!=='request'||message.type!=='request'||typeof message.body!=='string'||Buffer.byteLength(message.body)>maxRequestBytes||!matches(message.proof,proof(token,context,'request',client,server,message.body)))throw authenticationError();
+    requestBody=message.body;const request=JSON.parse(requestBody);
+    if(!request||typeof request!=='object'||Array.isArray(request))throw Error('Invalid loopback request');
+    clearTimeout(handshake);state='busy';
+    const reply=result=>{
+      if(state!=='busy')return;
+      let body;
+      try{body=encode(result,maxResponseBytes);}catch{body=encode({ok:false,error:'Loopback response is too large'},maxResponseBytes);}
+      state='done';socket.end(JSON.stringify({protocol,type:'response',body,proof:proof(token,context,'response',client,server,requestBody,body)})+'\n');
+    };
+    Promise.resolve().then(()=>{
+      if(controller.signal.aborted)throw Error('Loopback client disconnected');
+      return handle(request,{signal:controller.signal,deadlineMs});
+    }).then(value=>reply({ok:true,value}),error=>reply({ok:false,error:String(error.message).slice(0,2048)})).catch(close);
+  },close);
+}

package/runtime/native-ppr.mjs

@@ -0,0 +1,88 @@
+import {createHash} from 'node:crypto';
+import {readFile, stat} from 'node:fs/promises';
+import path from 'node:path';
+import {escapeHtml} from './http.mjs';
+
+export const NATIVE_PPR_ARTIFACT_BYTES = 2 * 1024 * 1024;
+export const NATIVE_PPR_PREFIX_BYTES = 128 * 1024;
+export const sha256 = bytes => createHash('sha256').update(bytes).digest('hex');
+
+// Only immutable build JSON is retained, after the caller verified the current
+// file bytes. No live model, decoder, request context or continuation is cached.
+export class NativePprArtifactCache {
+  constructor({maxEntries=8,maxBytes=4*1024*1024,maxEntryBytes=1024*1024,maxNodes=8192}={}) {
+    for(const value of [maxEntries,maxBytes,maxEntryBytes,maxNodes])if(!Number.isSafeInteger(value)||value<0)throw new TypeError('Invalid native PPR parsing cache budget');
+    this.maxEntries=maxEntries;this.maxBytes=maxBytes;this.maxEntryBytes=maxEntryBytes;this.maxNodes=maxNodes;
+    this.entries=new Map();this.bytes=0;this.hits=0;this.parses=0;
+  }
+  parse(filename,bytes,route,descriptor) {
+    const key=JSON.stringify([filename,descriptor.artifactHash,route.client||null]);
+    let entry=this.entries.get(key);
+    if(entry){this.hits++;this.entries.delete(key);this.entries.set(key,entry);}
+    else{
+      this.parses++;
+      const artifact=JSON.parse(bytes);
+      const prefix=Buffer.from(partialShell(artifact,route).replace(/<\/body><\/html>$/i,''));
+      entry={artifact,prefixHash:sha256(prefix),identity:sha256(artifact.flight)};
+      if(artifact.version!==1||!artifact.postponed||artifact.complete||artifact.generic||entry.prefixHash!==descriptor.prefixHash||entry.identity!==descriptor.identity)throw new Error('Invalid native PPR snapshot');
+      // Reserve substantial expansion for JSON slots/strings before walking.
+      // This is a conservative admission estimate, not an exact V8 heap size.
+      let size=bytes.length*16+key.length*2+256;
+      if(this.maxEntries&&size<=Math.min(this.maxBytes,this.maxEntryBytes)){
+        const pending=[artifact],objects=[];let nodes=1,eligible=this.maxNodes>0;
+        while(eligible&&pending.length){
+          const value=pending.pop();objects.push(value);size+=128;
+          // JSON arrays are dense: reject wide arrays before enumerating keys
+          // or allocating any list of their primitive/object children.
+          if(Array.isArray(value)&&value.length>this.maxNodes-nodes){eligible=false;break;}
+          for(const name in value){
+            if(!Object.hasOwn(value,name))continue;
+            if(++nodes>this.maxNodes){eligible=false;break;}
+            const child=value[name];size+=16+name.length*2+(typeof child==='string'?child.length*2:0);
+            if(size>Math.min(this.maxBytes,this.maxEntryBytes)){eligible=false;break;}
+            if(child&&typeof child==='object'){
+              if(Array.isArray(child)&&child.length>this.maxNodes-nodes){eligible=false;break;}
+              pending.push(child);
+            }
+          }
+        }
+        if(eligible&&!pending.length&&size<=Math.min(this.maxBytes,this.maxEntryBytes)){
+          for(const value of objects)Object.freeze(value);
+          while(this.entries.size&&(this.entries.size>=this.maxEntries||this.bytes+size>this.maxBytes)){
+            const [oldKey,old]=this.entries.entries().next().value;this.entries.delete(oldKey);this.bytes-=old.size;
+          }
+          entry.size=size;this.entries.set(key,entry);this.bytes+=size;
+        }
+      }
+    }
+    // Descriptor bindings remain authoritative even when the public JSON hit.
+    if(entry.prefixHash!==descriptor.prefixHash||entry.identity!==descriptor.identity)throw new Error('Invalid native PPR snapshot');
+    return entry.artifact;
+  }
+}
+const parsedArtifacts=new NativePprArtifactCache();
+
+export function partialShell(artifact, route) {
+  const bootstrap = '<script>self.__PRNEXT_FLIGHT_STREAM__=self.__PRNEXT_FLIGHT_STREAM__||[];</script>' +
+    (route.client ? `<script type="module" async src="${escapeHtml(route.client)}"></script>` : '');
+  const end = artifact.shell.lastIndexOf('</body>');
+  if (end < 0 || !/<\/body><\/html>$/i.test(artifact.shell)) throw new Error('Invalid partial prerender document');
+  return artifact.shell.slice(0, end) + bootstrap + artifact.shell.slice(end);
+}
+
+// This is a private transport field, never an HTTP header. Rust has already
+// checked cache generation and committed these exact build bytes. Pinning the
+// same artifact gives the request one snapshot even if invalidation races Node.
+export async function nativePprArtifact({renderMode, manifest, route, url, distDir},cache=parsedArtifacts) {
+  if (!renderMode?.startsWith('native-ppr:')) return null;
+  if (!manifest.config?.nativePprShell || manifest.dev || !/^[a-f\d]{64}$/.test(renderMode.slice(11))) throw new Error('Invalid native PPR continuation');
+  const pathname = new URL(url).pathname;
+  const descriptor = manifest.config.nativePprArtifacts?.find(item => item.routeId === route.id && item.path === pathname && item.artifactHash === renderMode.slice(11));
+  if (!descriptor || new URL(url).search || descriptor.artifact !== route.ppr?.[pathname]) throw new Error('Native PPR artifact does not match the route');
+  const filename = path.resolve(distDir, descriptor.artifact);
+  if (!descriptor.artifact.startsWith('static/') || !filename.startsWith(path.resolve(distDir) + path.sep) || (await stat(filename)).size > NATIVE_PPR_ARTIFACT_BYTES) throw new Error('Invalid native PPR artifact path or size');
+  const bytes = await readFile(filename);
+  if (bytes.length > NATIVE_PPR_ARTIFACT_BYTES || sha256(bytes) !== descriptor.artifactHash) throw new Error('Native PPR artifact changed after publication');
+  const artifact = cache.parse(filename,bytes,route,descriptor);
+  return {artifact, descriptor};
+}

package/runtime/og/NOTICE.txt

@@ -1,4 +1,4 @@
-Image renderer: @vercel/og 1.0.3 (https://github.com/vercel/og), with bundled Satori 0.33.5 (https://github.com/vercel/satori). PRNext replaces embedded fflate 0.7.3 with fflate 0.7.5, bundles it, adds Node CommonJS globals and includes adjacent WASM/font assets. Optional sharp backends require librsvg 2.63.2 or newer; otherwise rendering uses resvg. Upstream bundled licenses are retained. Rebuild: node scripts/prepare-og.mjs.
+Image renderer: @vercel/og 1.0.3 (https://github.com/vercel/og), with bundled Satori 0.33.5 (https://github.com/vercel/satori). PRNext replaces embedded fflate 0.7.3 with fflate 0.7.5, bundles and minifies it with function/class names preserved, adds Node CommonJS globals and includes adjacent WASM/font assets. Optional sharp backends require librsvg 2.63.2 or newer; otherwise rendering uses resvg. Upstream bundled licenses are retained. Rebuild: node scripts/prepare-og.mjs.
 Geist Regular 1.800: Copyright 2024 The Geist Project Authors (https://github.com/vercel/geist-font.git), SIL OFL 1.1; LICENSE.Geist is the upstream OFL.txt.
 HarfBuzzJS 0.10.0: https://github.com/harfbuzz/harfbuzzjs; see LICENSE.harfbuzzjs.
 resvg-js 2.4.1: https://github.com/yisibl/resvg-js/tree/v2.4.1, MPL-2.0 (LICENSE).