@thomas.f/prnext 0.1.19-alpha → 0.1.21-alpha

package/build/font-files.mjs

@@ -183,7 +183,7 @@ async function google(name, options, context) {
 }
 
 async function fallbackMetrics(faces, fallbackName) {
-  const { create } = await import('fontkit');
+  const { create } = await import('../vendor/fontkit/index.mjs');
   // Prefer an upright face near the normal text weight for a shared fallback.
   const candidates = [...faces].sort((a, b) => Number(a.style === 'italic') - Number(b.style === 'italic') || Math.abs((parseFloat(a.weight) || 400) - 400) - Math.abs((parseFloat(b.weight) || 400) - 400));
   for (const face of candidates) {

package/build/index.mjs

@@ -5,13 +5,18 @@ import { rename } from '../runtime/fs.mjs';
 import { writeRuntimeContract } from './runtime-contract.mjs';
 import { writeBuildOutput } from './output-contract.mjs';
 import { bundleRuntime } from './bundle-runtime.mjs';
+import {withBuildTimings, measureBuildPhase} from './build-timings.mjs';
+import {mapConcurrent} from './concurrent.mjs';
 import {withPersistentTransforms} from './transform-cache.mjs';
+import {withCompilationStorage,configureCompilationStorage} from './compilation-storage.mjs';
+import {reclaimBuildStages,trackBuildStage} from './build-retention.mjs';
 import {applicationEntry, frameworkImportName, frameworkRuntimeImportPattern} from './framework-imports.mjs';
 import { expandLocales, localizedStaticPaths } from './i18n.mjs';
 import { build as bundle, withCompilation, configureCompiler, compilerSource,buildAnalysisRecords,buildAnalysisRoutes,devDependencies,devStylePlans,devStyleDependencies,devModules,readCompilerFile,compilationGraphCacheReport } from './compiler.mjs';
 import {retainDeploymentAssets} from './deployment-assets.mjs';
 import {selectHtmlOnlyRoutes} from './html-only-config.mjs';
 import {writeBuildAnalysis} from './analyze.mjs';
+import {prepareNativePprShells} from './native-ppr.mjs';
 import {routeFiles} from './dev-discovery.mjs';
 import {tryBuildLazyGraph,rememberLazyBuildContext,forgetLazyBuildContext} from './dev-lazy-build.mjs';
 import {writeTypedRoutes} from './typed-routes.mjs';
@@ -23,7 +28,7 @@ import { randomUUID, randomBytes, createHash } from 'node:crypto';
 import { prepareBuildDirectory, OUTPUT_POINTER } from '../runtime/build-directory.mjs';
 import { moduleResolutionPlugin } from './module-resolution.mjs';
 import { scanProject } from './scan.mjs';
-import { stripServerCode, assertSupportedSource, rewriteServerChunks } from './transform.mjs';
+import { stripServerCode, assertSupportedSource, rewriteServerChunkOutputFiles } from './transform.mjs';
 import { transformDynamicImports } from './dynamic.mjs';
 import { createCssModules } from './css-modules.mjs';
 import { createFonts } from './fonts.mjs';
@@ -37,7 +42,7 @@ import { compileCustomRoutes } from './custom-routes.mjs';
 import { compileMiddleware } from './middleware.mjs';
 import { prepareScriptWorkers } from './script-workers.mjs';
 import { prepareMetadataRoutes } from './metadata-routes.mjs';
-import { prepareImageResponse } from './og.mjs';
+import { prepareImageResponse, imageResponseRequirement } from './og.mjs';
 import { prepareCacheHandler, prepareCacheHandlers } from './cache-handlers.mjs';
 import { npmPackagesPlugin } from './npm-packages.mjs';
 import { createRefreshTransform, createSourceLocationTransform, devSingletonsPlugin, devClientFile } from './dev.mjs';
@@ -74,7 +79,7 @@ async function copyRuntimeFiles(stage,{development=true}={}) {
   if (failed) throw failed.reason;
 }
 
-function compatibilityPlugin({ browser, pageFiles, projectRoot, documentFile, serverOnlyFiles, fonts, refresh, locations, reactCompiler }) {
+function compatibilityPlugin({ browser, pageFiles, projectRoot, documentFile, serverOnlyFiles, fonts, refresh, locations, reactCompiler, nativeCompiler = false }) {
   return {
     name: 'prnext-pages-compatibility',
     setup(esbuild) {
@@ -108,8 +113,13 @@ function compatibilityPlugin({ browser, pageFiles, projectRoot, documentFile, se
         // loaders. Keep that entire graph original: an uppercase JSX utility
         // may be called normally there, outside a React render. Browser render
         // graphs receive memoization before instrumentation and JSX lowering.
-        const compiled=browser && reactCompiler && args.path!==documentFile && !serverOnlyFiles.has(args.path) ? await reactCompiler(original,args.path,{loaderOutput:args.prnextSource!==undefined}) : original;
-        const source = await fonts.transform(locations?await locations(compiled,args.path):compiled, args.path);
+        const compile = browser && reactCompiler && args.path!==documentFile && !serverOnlyFiles.has(args.path);
+        // Oxc can hoist static JSX without a source-map position. Attach the
+        // same original inspector attributes as SSR before that transformation.
+        const locateFirst = !!(compile && nativeCompiler && locations);
+        const input = locateFirst ? await locations(original,args.path) : original;
+        const compiled = compile ? await reactCompiler(input,args.path,{loaderOutput:args.prnextSource!==undefined}) : input;
+        const source = await fonts.transform(locations && !locateFirst ? await locations(compiled,args.path) : compiled, args.path);
         assertSupportedSource(source, args.path);
         const dynamicSource = transformDynamicImports(source, args.path, { projectRoot, mode: browser ? 'browser' : 'server' });
         let contents = browser && pageFiles.has(args.path) ? stripServerCode(dynamicSource, args.path) : dynamicSource;
@@ -179,9 +189,10 @@ export function build(projectRoot, options = {}) {
     const envMode = options.envMode || (process.env.NODE_ENV === 'test' ? 'test' : options.dev ? 'development' : 'production');
     process.env.NODE_ENV = options.dev ? 'development' : 'production';
     try { return await withBuildLock(projectRoot, async root => {
+      await reclaimBuildStages(root);
       const started=performance.now();
-      const result=await withPersistentTransforms(root,{dev:!!options.dev},()=>withCompilation(() => buildProject(root, { ...options, envMode })));
-      return {...result,durationMs:Math.round(performance.now()-started)};
+      const measured=await withBuildTimings(()=>withCompilationStorage(root,()=>withPersistentTransforms(root,{dev:!!options.dev},()=>withCompilation(() => buildProject(root, { ...options, envMode })))));
+      return {...measured.result,durationMs:Math.round(performance.now()-started),buildTimings:measured.timings};
     }); }
     finally { restore(); }
   });
@@ -197,21 +208,22 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
       devInputs,devSession,devActionSecret,incremental});
     if (deferred) return deferred;
   }
-  const config = await loadProjectConfig(projectRoot, { dev, envMode, devInputs });
+  const config = await measureBuildPhase('configuration',()=>loadProjectConfig(projectRoot, { dev, envMode, devInputs }));
+  configureCompilationStorage(config.compilationCache);
   const tsconfig = config.typescript ? await projectTsconfig(projectRoot, config) : undefined;
   const environment = defineEnvironment(config);
-  const publicPaths = { trailingSlash: config.trailingSlash, skipTrailingSlashRedirect: config.skipTrailingSlashRedirect, basePath: config.basePath, assetPrefix: config.assetPrefix, assetBase: publicAssetBase(config) };
+  const publicPaths = { server: config.server, trailingSlash: config.trailingSlash, skipTrailingSlashRedirect: config.skipTrailingSlashRedirect, basePath: config.basePath, assetPrefix: config.assetPrefix, assetBase: publicAssetBase(config) };
   const customRoutes = await compileCustomRoutes(config);
   const buildId = await generateBuildId(config, { dev });
   const scanOptions={basePath:config.basePath,pageExtensions:config.pageExtensions,i18n:config.i18n};
   let project,deferredRoutes=[];
   if(dev && Array.isArray(devRoutes)) {
-    const discovery=await scanProject(projectRoot,{...scanOptions,devAppFiles:new Set()});
-    project=await scanProject(projectRoot,{...scanOptions,devAppFiles:routeFiles(discovery,devRoutes)});
+    const discovery=await measureBuildPhase('discovery',()=>scanProject(projectRoot,{...scanOptions,devAppFiles:new Set()}));
+    project=await measureBuildPhase('discovery',()=>scanProject(projectRoot,{...scanOptions,devAppFiles:routeFiles(discovery,devRoutes)}));
     await writeTypedRoutes(projectRoot,discovery,config);
     deferredRoutes=discovery.routes.filter(route=>!devRoutes.includes(route.pattern)&&!route.internal&&!route.errorStatus);
     project.routes=project.routes.filter(route=>devRoutes.includes(route.pattern)||route.internal||route.errorStatus);
-  } else project=await scanProject(projectRoot,scanOptions);
+  } else project=await measureBuildPhase('discovery',()=>scanProject(projectRoot,scanOptions));
   if(dev&&config.experimental.lazyDynamicImports){
     if(project.routes.some(route=>route.router!=='app'&&!route.internal))throw Error('experimental.lazyDynamicImports currently requires an App Router-only application.');
     if(config.webpack||Object.keys(config.turbopack?.rules||{}).length)throw Error('experimental.lazyDynamicImports currently requires the native compiler without webpack hooks or custom loaders.');
@@ -222,12 +234,14 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
   const stage = path.join(project.root, `.prnext-build-${randomUUID()}`);
   const destination = await prepareBuildDirectory(project.root, config.distDir);
   const backup = path.join(project.root, `.prnext-backup-${randomUUID()}`);
+  const recovery=await trackBuildStage(project.root,{stage,backup}).catch(()=>null);
+  try {
   await mkdir(path.join(stage, '.entries'), { recursive: true });
   await mkdir(path.join(stage, 'static'), { recursive: true });
   await addBuiltinPagesErrors(project, stage);
   const manifest = { version: 1, dev, buildId, cacheId: randomUUID(), previewModeId: randomUUID().replaceAll('-', ''), previewModeEncryptionKey: randomBytes(32).toString('hex'),
     ...(dev && Array.isArray(devRoutes) ? {devOnDemand:true} : {}), ...(dev && devSession ? {devSequence,devSession} : {}), ...(dev ? {devForceRefresh,devAffectedModules,devIndicators:config.devIndicators,...(devTools?{devTools}:{})} : {}),
-    config: { i18n: config.i18n, skipMiddlewareUrlNormalize: config.skipMiddlewareUrlNormalize, compress: config.compress, poweredByHeader: config.poweredByHeader, reactStrictMode: config.reactStrictMode, cacheComponents: config.cacheComponents, partialPrefetching: config.partialPrefetching, navigationCache: config.navigationCache, cacheLife: config.cacheLife, htmlOnly:config.htmlOnly, images: config.images, ...publicPaths }, customRoutes, routes: [], prerendered: [],
+    config: { i18n: config.i18n, skipMiddlewareUrlNormalize: config.skipMiddlewareUrlNormalize, compress: config.compress, poweredByHeader: config.poweredByHeader, reactStrictMode: config.reactStrictMode, cacheComponents: config.cacheComponents, partialPrefetching: config.partialPrefetching, navigationCache: config.navigationCache, cacheLife: config.cacheLife, htmlOnly:config.htmlOnly, images: config.images, streamingRequestBodies: config.experimental.streamingRequestBodies, nativePprShell: config.experimental.nativePprShell, ...publicPaths }, customRoutes, routes: [], prerendered: [],
     ...(project.pagesErrors ? { pagesErrors: project.pagesErrors } : {}) };
   // Its build-unique name is known before bundling and avoids a hash cycle
   // between page entry URLs and the manifest that lists those entries.
@@ -246,11 +260,10 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
   const cssModules = createCssModules({ projectRoot: project.root, stage, assetBase: publicPaths.assetBase, sassOptions: config.sassOptions, cssEngine:config.cssEngine,dev,config });
   configureCompiler({config,root:project.root,stage,buildId,dev,incremental,devInputs,tsconfig,assetBase:publicPaths.assetBase});
   try {
-    await copyRuntimeFiles(stage,{development:dev});
+    await measureBuildPhase('runtime-inputs',()=>copyRuntimeFiles(stage,{development:dev}));
     // Runtime copies must work even when dotenv is nested beneath the PRNext
     // package instead of hoisted beside the application's dependencies.
     await bundle({ entryPoints: [path.join(packageRoot, 'runtime/env.mjs')], outfile: path.join(stage, 'runtime/env.mjs'), bundle: true, platform: 'node', format: 'esm', target: 'node22', logLevel: 'silent', banner: { js: "import {createRequire as __prnextCreateRequire} from 'node:module';const require=__prnextCreateRequire(import.meta.url);" } });
-    await prepareImageResponse(stage);
     manifest.config.serverActions = config.experimental.serverActions;
     if(config.workerMemory && !dev)manifest.config.workerMemory=config.workerMemory;
     if (config.workerRetirement) manifest.config.workerRetirement = config.workerRetirement;
@@ -280,14 +293,16 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
     }
     const common = { absWorkingDir: project.root, bundle: true, logLevel: 'silent', jsx: 'automatic', loader: assetLoaders, assetNames: '[name]-[hash]', publicPath: publicPaths.assetBase, metafile: true, define: { 'process.env.NODE_ENV': JSON.stringify(dev ? 'development' : 'production'), ...environment } };
     if (Object.keys(serverEntries).length) {
-      const server = await bundle({ ...common, entryPoints: serverEntries, outdir: path.join(stage, 'server'), outExtension: { '.js': '.mjs' }, platform: 'node', format: 'esm', splitting: true, chunkNames: 'chunk-[hash]', banner: { js: "import {createRequire as __prnextCreateRequire} from 'node:module';const require=__prnextCreateRequire(import.meta.url);" }, target: 'node22', sourcemap: dev, plugins: [moduleResolutionPlugin(config.turbopack, project.root), images.plugin(), fonts.plugin(), compatibilityPlugin({ browser: false, pageFiles, projectRoot: project.root, documentFile: project.document, serverOnlyFiles, fonts, locations, reactCompiler }), npmPackagesPlugin({ pages: true, projectRoot: project.root, transpilePackages: config.transpilePackages, serverExternalPackages: config.serverExternalPackages }), cssModules.plugin(false)] });
+      const server = await measureBuildPhase('pages-server',()=>bundle({ ...common, write: false, entryPoints: serverEntries, outdir: path.join(stage, 'server'), outExtension: { '.js': '.mjs' }, platform: 'node', format: 'esm', splitting: true, chunkNames: 'chunk-[hash]', banner: { js: "import {createRequire as __prnextCreateRequire} from 'node:module';const require=__prnextCreateRequire(import.meta.url);" }, target: 'node22', sourcemap: dev, plugins: [moduleResolutionPlugin(config.turbopack, project.root), images.plugin(), fonts.plugin(), compatibilityPlugin({ browser: false, pageFiles, projectRoot: project.root, documentFile: project.document, serverOnlyFiles, fonts, locations, reactCompiler }), npmPackagesPlugin({ pages: true, projectRoot: project.root, transpilePackages: config.transpilePackages, serverExternalPackages: config.serverExternalPackages }), cssModules.plugin(false)] }));
       fonts.record(server.metafile);
       const serverChunks = new Set(Object.keys(server.metafile.outputs).filter(file => file.endsWith('.mjs')).map(file => path.basename(file)));
-      for (const [output, metadata] of Object.entries(server.metafile.outputs)) {
-        if (!output.endsWith('.mjs') || !metadata.imports.some(item => !item.external)) continue;
-        const file = path.resolve(project.root, output);
-        await rewriteServerChunks(file, serverChunks, publicPaths.assetBase);
-      }
+      const importers = new Set(Object.entries(server.metafile.outputs).filter(([output, metadata])=>output.endsWith('.mjs')&&metadata.imports.some(item=>!item.external)).map(([output])=>path.resolve(project.root,output)));
+      // All buffers are transformed before their first write. Settle every owned
+      // writer before stage cleanup on failure, including external sourcemaps.
+      await measureBuildPhase('pages-output',async()=>{
+        const outputs = rewriteServerChunkOutputFiles(server.outputFiles,serverChunks,publicPaths.assetBase,importers);
+        await mapConcurrent(outputs,async file=>{await mkdir(path.dirname(file.path),{recursive:true});await writeFile(file.path,file.contents);},8);
+      });
       // Image/font imports must resolve to the same public URLs on both render paths.
       await mkdir(path.join(stage, 'assets'), { recursive: true });
       for (const [output, metadata] of Object.entries(server.metafile.outputs)) {
@@ -295,7 +310,7 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
       }
     }
     if (Object.keys(clientEntries).length) {
-      const browser = await bundle({ ...common, entryPoints: clientEntries, outdir: path.join(stage, 'assets'), entryNames: '[name]-[hash]', chunkNames: 'chunk-[hash]', platform: 'browser', format: 'esm', target: ['es2022'], splitting: true, minify: !dev, sourcemap: dev || config.productionBrowserSourceMaps, define: { 'process.env': '{}', ...common.define }, plugins: [moduleResolutionPlugin(config.turbopack, project.root), ...(dev ? [devSingletonsPlugin()] : []), images.plugin(), fonts.plugin(), compatibilityPlugin({ browser: true, pageFiles, projectRoot: project.root, documentFile: project.document, serverOnlyFiles, fonts, refresh, locations, reactCompiler }), cssModules.plugin(true)] });
+      const browser = await measureBuildPhase('pages-browser',()=>bundle({ ...common, entryPoints: clientEntries, outdir: path.join(stage, 'assets'), entryNames: '[name]-[hash]', chunkNames: 'chunk-[hash]', platform: 'browser', format: 'esm', target: ['es2022'], splitting: true, minify: !dev, sourcemap: dev || config.productionBrowserSourceMaps, define: { 'process.env': '{}', ...common.define }, plugins: [moduleResolutionPlugin(config.turbopack, project.root), ...(dev ? [devSingletonsPlugin()] : []), images.plugin(), fonts.plugin(), compatibilityPlugin({ browser: true, pageFiles, projectRoot: project.root, documentFile: project.document, serverOnlyFiles, fonts, refresh, locations, reactCompiler, nativeCompiler: config.reactCompiler?.backend === 'oxc' }), cssModules.plugin(true)] }));
       fonts.record(browser.metafile);
       const byEntry = new Map(Object.entries(clientEntries).map(([id, file]) => [path.resolve(file), id]));
       for (const [output, metadata] of Object.entries(browser.metafile.outputs)) {
@@ -309,10 +324,10 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
         if (metadata.cssBundle) route.css.push(publicPaths.assetBase + '/' + path.basename(metadata.cssBundle));
       }
     }
-    await compileMiddleware({ project, stage, manifest, dev, moduleResolution: config.turbopack, defineEnvironment: environment });
+    await measureBuildPhase('middleware',()=>compileMiddleware({ project, stage, manifest, dev, moduleResolution: config.turbopack, defineEnvironment: environment }));
     if (manifest.middleware) manifest.middleware.bodySizeLimit = config.experimental.proxyClientMaxBodySize;
-    await prepareMetadataRoutes(project, stage);
-    await compileApp({ project, stage, manifest, reactCompiler: config.reactCompiler, moduleResolution: config.turbopack, cssModules, fonts, images, dev, devActionSecret:dev?devActionSecret:undefined, defineEnvironment: environment, productionBrowserSourceMaps: config.productionBrowserSourceMaps, serverExternalPackages: config.serverExternalPackages, lazyDynamicImports:dev&&config.experimental.lazyDynamicImports,devLazyRequest,devLazyActivated });
+    await measureBuildPhase('metadata',()=>prepareMetadataRoutes(project, stage));
+    await measureBuildPhase('app',async()=>compileApp({ project, stage, manifest, reactCompiler: config.reactCompiler, moduleResolution: config.turbopack, cssModules, fonts, images, dev, devActionSecret:dev?devActionSecret:undefined, defineEnvironment: environment, productionBrowserSourceMaps: config.productionBrowserSourceMaps, serverExternalPackages: config.serverExternalPackages, lazyDynamicImports:dev&&config.experimental.lazyDynamicImports,devLazyRequest,devLazyActivated, parallelBuilds: !dev && config.experimental.parallelBuilds && await cssModules.parallelSafe() ? config.experimental.parallelBuilds : false }));
     if(manifest.devLazy){
       const css=Object.values(manifest.devLazy.outputs).flatMap(module=>module.css);
       for(const route of manifest.routes)if(route.router==='app'&&route.kind==='page'){
@@ -328,24 +343,28 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
       const selected=manifest.routes.find(route=>!route.internal&&route.pattern===pattern);
       if(!selected||selected.cacheConfig?.runtime==='edge'||selected.handlerConfig?.runtime==='edge')throw new Error(`workerPreload route ${pattern} must be an existing Node route.`);
     }
-    await compileInstrumentation({root:project.root,stage,manifest,config,dev,environment});
+    await measureBuildPhase('instrumentation',()=>compileInstrumentation({root:project.root,stage,manifest,config,dev,environment}));
     if(deferredRoutes.length){
       for(const route of deferredRoutes){
         const module=`server/dev-deferred-${route.id}.mjs`;await writeFile(path.join(stage,module),'export {};\n');
         manifest.routes.push({id:route.id,pattern:route.pattern,kind:route.kind,router:route.router,module,devDeferred:true,css:[],cacheConfig:{maxDuration:120}});
       }
     }
-    await checkTypeScript(project.root, config, { dev, tsconfig });
+    await measureBuildPhase('types',()=>checkTypeScript(project.root, config, { dev, tsconfig }));
     fonts.attach(manifest);
     expandLocales(manifest);
+    const imageResponse = await imageResponseRequirement(stage, {dev, manifest});
+    if (imageResponse.included) await prepareImageResponse(stage);
+    else await rm(path.join(stage, 'compat/og.cjs'), {force: true});
     // All runtime preparation must finish before its shared modules are built;
     // no staged renderer has been imported before this production-only point.
-    if (!dev) await bundleRuntime(stage,{projectRoot:project.root,sourceDirectory:path.join(packageRoot,'runtime')});
+    if (!dev) await measureBuildPhase('runtime-bundle',()=>bundleRuntime(stage,{projectRoot:project.root,sourceDirectory:path.join(packageRoot,'runtime'),imageResponse:imageResponse.included}));
     // Node caches CJS React by filename, not NODE_ENV. Once development metadata
     // imports load it, subsequent production renders need a clean process too.
     if(dev) developmentModulesLoaded = true;
-    if(!dev) Object.assign(manifest,await (incremental || developmentModulesLoaded ? isolatedPrerender : prerenderProduction)(project.root,stage,manifest,{prerender:config.prerender}));
-    else {await prerender(stage, manifest, dev);await prerenderApp(stage, manifest, dev);}
+    if(!dev) Object.assign(manifest,await measureBuildPhase('prerender',()=>(incremental || developmentModulesLoaded ? isolatedPrerender : prerenderProduction)(project.root,stage,manifest,{prerender:config.prerender})));
+    else await measureBuildPhase('prerender',async()=>{await prerender(stage, manifest, dev);await prerenderApp(stage, manifest, dev);});
+    if (!dev) await measureBuildPhase('native-ppr',()=>prepareNativePprShells(stage, manifest));
     const pages = manifest.routes.filter(route => route.kind === 'page' && route.router !== 'app' && !route.internal && !route.devDeferred);
     const publicPage = route => ({ ...(route.locale ? {locale:route.locale,originalPattern:route.originalPattern} : {}), id: route.id, pattern: route.pattern, client: route.client, css: route.css, ...(route.fonts ? { fonts: route.fonts } : {}), ssg: !!route.ssg, ssp: !!route.ssp, gip: !!route.gip, appGip: !!route.appGip });
     if (pages.length || manifest.pagesErrors) {
@@ -387,7 +406,7 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
     }
     // A report belongs to this successful staging generation, never to the
     // runtime manifest or public assets. Publishing the stage is atomic below.
-    if(!dev)await retainDeploymentAssets({stage,destination,manifest,policy:config.deploymentRetention});
+    if(!dev)await measureBuildPhase('retention',()=>retainDeploymentAssets({stage,destination,manifest,policy:config.deploymentRetention}));
     const compilationCache=compilationGraphCacheReport();
     if(!dev)await writeFile(path.join(stage,'compilation-cache-report.json'),JSON.stringify(compilationCache,null,2)+'\n');
     const compilerReport=await writeReactCompilerReport(stage,reactCompilerReport());
@@ -396,9 +415,9 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
     await writeBuildOutput(stage, manifest);
     // Offline compression is a deployment optimization. Recompressing source
     // maps and every entry after a save stalls Fast Refresh for no local benefit.
-    if (!dev && config.compress) await precompressBuild(stage, manifest, {cacheDirectory:path.join(project.root,'.prnext-cache/precompress-v1')});
-    if(!dev)await writeBuildAnalysis({root:project.root,stage,destination,manifest,records:buildAnalysisRecords(),routeInputs:buildAnalysisRoutes(),precompressed:config.compress});
-    if (config.output === 'standalone' && !dev) await (await import('./standalone-runner.mjs')).prepareStandalone({ projectRoot: project.root, stage, manifest, config });
+    if (!dev && config.compress) await measureBuildPhase('precompression',()=>precompressBuild(stage, manifest, {cacheDirectory:path.join(project.root,'.prnext-cache/precompress-v1')}));
+    if(!dev)await measureBuildPhase('analysis',()=>writeBuildAnalysis({root:project.root,stage,destination,manifest,records:buildAnalysisRecords(),routeInputs:buildAnalysisRoutes(),precompressed:config.compress}));
+    if (config.output === 'standalone' && !dev) await measureBuildPhase('standalone',async()=>(await import('./standalone-runner.mjs')).prepareStandalone({ projectRoot: project.root, stage, manifest, config }));
     const exporting = config.output === 'export' && !dev ? await import('./static-export.mjs') : null;
     const exportSource = exporting && await exporting.prepareStaticExport({ project, stage, manifest, config });
     let hadDestination = false;
@@ -420,12 +439,14 @@ async function buildProject(projectRoot, { dev = false, envMode, incremental = f
       throw error;
     } finally { await rm(pointerTemporary, {force:true}); }
     await exported?.commit();
-    if (hadDestination) await rm(backup, { recursive: true, force: true });
+    await recovery?.committed().catch(()=>{});
+    if(!recovery&&hadDestination)await rm(backup,{recursive:true,force:true});
     if(dev&&!devLazyRequest)rememberLazyBuildContext(project.root,{manifest,config,environment,tsconfig,envMode});
     return { ...manifest, outputDirectory: destination, durationMs: Math.round(performance.now() - started),reactCompilerReport:compilerReport,compilationCache };
   } catch (error) {
-    await rm(stage, { recursive: true, force: true });
+    if(!recovery)await rm(stage, { recursive: true, force: true });
     if (error.errors) error.message = error.errors.map(item => `${item.location ? `${item.location.file}:${item.location.line}: ` : ''}${item.text}`).join('\n');
     throw error;
   }
+  }finally{await recovery?.cleanup();}
 }

package/build/inspect.mjs

@@ -70,6 +70,8 @@ export async function inspectProject(directory) {
     notes: ['Enable measurements with prn start --inspect (or prn dev --inspect), visit routes, then run prn inspect again.',
       'HTTP and fetch durations end when response headers are ready. Samples are bounded and can span server sessions; they are not full-response benchmarks.',
       'Request-stage samples additionally separate admission, worker first byte, response headers and complete body consumption, with completion/cancellation/deadline outcomes. Stages overlap; do not add their durations. Body completion means the HTTP layer consumed the application body, not remote delivery.',
+      'Flight sizes are uncompressed application bytes observed while reading the stream. RSC and SSR observe the same payload separately: do not add their sizes or counts. Size quantiles include completed samples only; failed/cancelled samples may be partial.',
+      'Flight model-ready, shell-ready and duration timings include application work, queueing and asynchronous waits; they are not isolated serialization CPU. Browser execution, hydration, compressed transfer and remote delivery are not measured.',
       'Fetch destinations omit queries and credentials. Runtime cache tags/paths are hashed; matching identifiers link reads to invalidations. No diagnostic HTTP endpoint is exposed.'] };
 }
 export function printInspection(report) {
@@ -77,6 +79,7 @@ export function printInspection(report) {
   console.log(`Recorded sample: ${report.summary.requests} HTTP requests; p50 ${report.summary.p50Ms ?? 'n/a'} ms; p95 ${report.summary.p95Ms ?? 'n/a'} ms (response headers); ${report.summary.errors} server errors.`);
   if(report.summary.wakeP95Ms !== null) console.log(`Worker startup p95: ${report.summary.wakeP95Ms} ms.`);
   if(report.summary.workerRssBytes !== null) console.log(`Latest recorded worker RSS: ${(report.summary.workerRssBytes/1048576).toFixed(1)} MiB. Native server memory is not included.`);
+  for(const sample of report.flight||[])console.log(`FLIGHT ${sample.route} (${sample.phase}): ${sample.completed} completed sample(s), p95 ${sample.flightP95Bytes===null?'n/a':(sample.flightP95Bytes/1000).toFixed(1)+' kB'}; ${sample.failed} failed, ${sample.cancelled} cancelled, ${sample.timedOut} timed out; model ready p95 ${sample.modelReadyP95Ms??'n/a'} ms, shell ready p95 ${sample.shellReadyP95Ms??'n/a'} ms (includes waiting).`);
   for(const stage of report.requestStages||[]) console.log(`STAGE ${stage.stage}: ${stage.samples} sample(s), p95 ${stage.p95Ms ?? 'n/a'} ms; ${stage.completed} completed, ${stage.failed} failed, ${stage.cancelled} cancelled, ${stage.timedOut} timed out.`);
   for(const budget of report.budgets||[])console.log(`BUDGET ${budget.budget}: ${budget.used ?? 'n/a'}/${budget.limit ?? 'n/a'} ${budget.unit}, ${budget.waiting ?? 'n/a'} waiting; ${budget.rejected ?? 'n/a'} rejected, ${budget.timedOut ?? 'n/a'} timed out, ${budget.cancelledWaits ?? 'n/a'} cancelled waits.`);
   for(const finding of report.findings)console.log(`${finding.level.toUpperCase()}: ${finding.message} ${finding.action}`);

package/build/inspection-summary.mjs

@@ -1,3 +1,4 @@
+import {summarizeFlight,flightMetrics} from './flight-summary.mjs';
 const quantile = (values, q) => values.length ? Math.round([...values].sort((a,b)=>a-b)[Math.ceil(values.length*q)-1]*100)/100 : null;
 const durations = events => events.map(e=>e.durationMs).filter(v=>Number.isFinite(v)&&v>=0);
 const stages=['admission','renderStart','bodyAdmission','bodyRead','workerQueue','workerFirstByte','workerHeaders','httpHeaders','responseBody','requestTotal'];
@@ -21,6 +22,7 @@ function currentBudgets(snapshot) {
   });
 }
 export function summarizeDiagnostics(events, snapshots = []) {
+  const flightReport=summarizeFlight(events);
   const http=events.filter(e=>e.type==='http'), times=durations(http);
   const wake=durations(events.filter(e=>e.type==='wake'&&e.phase==='node-ready'));
   const processes=new Map();
@@ -34,13 +36,16 @@ export function summarizeDiagnostics(events, snapshots = []) {
     queuedJobs:current?last.workers?.queuedJobs??null:null,activeJobs:current?last.workers?.activeJobs??null:null, runtimeSampleAt:last?.unixMs??null,
     completedResponseP95Ms:quantile(durations(stageSample.filter(e=>e.stage==='requestTotal'&&e.outcome==='completed')),.95),cancelledResponses:totals?.cancelled??null,timedOutResponses:totals?.timedOut??null};
   const findings=[];
+  for(const route of flightReport.flight)if(route.completed>=3&&route.flightP95Bytes>=131072)findings.push({level:'info',code:'LARGE_FLIGHT',
+    message:`${route.route} (${route.phase}) has a sampled Flight p95 of ${(route.flightP95Bytes/1000).toFixed(1)} kB.`,
+    action:'Inspect the rendered model and repeated presentation markup. Compare explicit public-prop client boundaries with their browser JavaScript and hydration costs; private server code must stay on the server.'});
   if(!http.length)findings.push({level:'info',code:'NO_SAMPLE',message:'No HTTP sample recorded.',action:'Start with --inspect, visit the site and run inspect again.'});
   if(summary.queuedJobs>0)findings.push({level:'warning',code:'WORKER_QUEUE',message:`${summary.queuedJobs} jobs are waiting for a worker.`,action:'Check slow routes and available CPU/RAM before increasing concurrency.'});
   if(summary.p95Ms>=1000)findings.push({level:'warning',code:'SLOW_HEADERS',message:'The slowest 5% of recorded responses take at least one second to prepare headers.',action:'Inspect route and fetch timings below; this includes queueing and startup.'});
   if(summary.errors)findings.push({level:'warning',code:'SERVER_ERRORS',message:`${summary.errors} recorded requests returned a server error.`,action:'Check application logs for the same sample period.'});
   if(summary.wakeP95Ms>=1000)findings.push({level:'info',code:'SLOW_WAKE',message:'Recorded worker startup p95 exceeds one second.',action:'Review startup imports or use keep-warm if the extra memory is acceptable.'});
   if(summary.timedOutResponses>0)findings.push({level:'warning',code:'RESPONSE_DEADLINES',message:`${summary.timedOutResponses} recorded HTTP responses reached their request deadline.`,action:'Compare admission, worker and body timings before increasing the configured timeout.'});
-  return {summary,findings,requestStages,budgets:current?currentBudgets(last):null,stageSample,metricSample:http.filter(e=>Number.isFinite(e.durationMs)&&e.durationMs>=0&&e.durationMs<=86400000&&validTime(e.time)).map(e=>({route:typeof e.route==='string'?e.route.slice(0,256):'<unmatched>',method:/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS|CONNECT|TRACE)$/.test(e.method)?e.method:'_OTHER',durationMs:e.durationMs,time:e.time}))};
+  return {summary,findings,requestStages,...flightReport,budgets:current?currentBudgets(last):null,stageSample,metricSample:http.filter(e=>Number.isFinite(e.durationMs)&&e.durationMs>=0&&e.durationMs<=86400000&&validTime(e.time)).map(e=>({route:typeof e.route==='string'?e.route.slice(0,256):'<unmatched>',method:/^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS|CONNECT|TRACE)$/.test(e.method)?e.method:'_OTHER',durationMs:e.durationMs,time:e.time}))};
 }
 
 /** OTLP/JSON Metrics export of a bounded local sample, never a complete traffic counter. */
@@ -66,5 +71,5 @@ export function inspectionMetrics(report) {
     group.count++;group.sum+=value;group.min=Math.min(group.min,value);group.max=Math.max(group.max,value);group.start=Math.min(group.start,event.time);group.end=Math.max(group.end,event.time);group.buckets[index<0?bounds.length:index]++;
   }
   const stagePoints=[...stageGroups.values()].map(g=>({attributes:[{key:'prnext.request.stage',value:{stringValue:g.stage}},{key:'prnext.request.outcome',value:{stringValue:g.outcome}}],startTimeUnixNano:String(BigInt(g.start)*1000000n),timeUnixNano:String(BigInt(g.end)*1000000n),count:String(g.count),sum:g.sum,min:g.min,max:g.max,explicitBounds:bounds,bucketCounts:g.buckets.map(String)}));
-  return {resourceMetrics:[{resource:{attributes:[{key:'service.name',value:{stringValue:'prnext'}},{key:'prnext.inspect.sampled',value:{boolValue:true}}]},scopeMetrics:[{scope:{name:'prnext.inspect',version:'1'},metrics:[{name:'prnext.http.response.headers.duration',description:'Bounded diagnostic sample of time until response headers; excludes response body streaming.',unit:'s',histogram:{aggregationTemporality:1,dataPoints}},{name:'prnext.request.stage.duration',description:'Bounded diagnostic sample of request stages and terminal outcomes; stages overlap and must not be added together.',unit:'s',histogram:{aggregationTemporality:1,dataPoints:stagePoints}}]}]}]};
+  return {resourceMetrics:[{resource:{attributes:[{key:'service.name',value:{stringValue:'prnext'}},{key:'prnext.inspect.sampled',value:{boolValue:true}}]},scopeMetrics:[{scope:{name:'prnext.inspect',version:'1'},metrics:[{name:'prnext.http.response.headers.duration',description:'Bounded diagnostic sample of time until response headers; excludes response body streaming.',unit:'s',histogram:{aggregationTemporality:1,dataPoints}},{name:'prnext.request.stage.duration',description:'Bounded diagnostic sample of request stages and terminal outcomes; stages overlap and must not be added together.',unit:'s',histogram:{aggregationTemporality:1,dataPoints:stagePoints}},flightMetrics(report.flightSample||[])]}]}]};
 }

package/build/native-discovery.mjs

@@ -1,7 +1,7 @@
 import { readdir, readFile, realpath } from 'node:fs/promises';
 import { builtinModules, createRequire } from 'node:module';
 import path from 'node:path';
-import { analyzeSource } from './source-analysis.mjs';
+import { analyzeSourceSummary } from './source-analysis.mjs';
 
 const builtins = new Set([...builtinModules, ...builtinModules.map(name => 'node:' + name)]);
 
@@ -15,6 +15,7 @@ export function createNativeDiscovery({ projectRoot, isClientSource }) {
   const sourceImports = new Map(), entryNative = new Map(), declaredNative = new Map();
   const resolvers = new Map();
   let sourceBytes = 0;
+  let declaredVisits=0,declaredProofHits=0;
   const isApplication = directory => {
     const relative = path.relative(directory, projectRoot);
     return relative === '' || (!relative.startsWith('..' + path.sep) && relative !== '..' && !path.isAbsolute(relative));
@@ -27,7 +28,7 @@ export function createNativeDiscovery({ projectRoot, isClientSource }) {
       const size = Buffer.byteLength(source);
       if (size > 8 * 1024 ** 2 || (sourceBytes += size) > 64 * 1024 ** 2) throw new Error('Native npm import analysis exceeds its 8 MiB file / 64 MiB source budget. Separate the native loader into a server-only package.');
       // The compiler accepts JSX in JavaScript npm entries, including .js.
-      const { imports, computedRequire } = analyzeSource(source, /\.[cm]?js$/.test(file) ? file + '.jsx' : file);
+      const { imports, computedRequire } = analyzeSourceSummary(source,file);
       // Keep edges, not the AST, so the shared parser can bound its retained cache.
       return { imports, computedRequire };
     })());
@@ -111,20 +112,30 @@ export function createNativeDiscovery({ projectRoot, isClientSource }) {
     return dependencyRoots.get(key);
   }
 
-  async function nativeReachable(owner, visited = new Set()) {
+  const nativePresent=new Set(),nativeAbsent=new Set();
+  async function nativeReachable(owner, visited) {
+    if(nativePresent.has(owner.directory)){declaredProofHits++;return true;}
+    if(nativeAbsent.has(owner.directory)){declaredProofHits++;return false;}
     if (visited.has(owner.directory)) return false;
     visited.add(owner.directory);
-    if ((await filesFor(owner.directory)).native) return true;
+    declaredVisits++;
+    if ((await filesFor(owner.directory)).native) {nativePresent.add(owner.directory);return true;}
     const names = new Set([...Object.keys(owner.metadata.dependencies || {}), ...Object.keys(owner.metadata.optionalDependencies || {})]);
     for (const name of names) {
       const dependency = await resolveDependency(owner.directory, name);
-      if (dependency && await nativeReachable(dependency, visited)) return true;
+      if (dependency && await nativeReachable(dependency, visited)) {nativePresent.add(owner.directory);return true;}
     }
     return false;
   }
 
   function declaredNativeFor(owner) {
-    if (!declaredNative.has(owner.directory)) declaredNative.set(owner.directory, nativeReachable(owner));
+    if (!declaredNative.has(owner.directory)) declaredNative.set(owner.directory, (async()=>{
+      const visited=new Set(),result=await nativeReachable(owner,visited);
+      // A recursive false inside a cycle proves nothing by itself. Only a
+      // completely native-free root closure can certify all its visited nodes.
+      if(!result)for(const directory of visited)nativeAbsent.add(directory);
+      return result;
+    })());
     return declaredNative.get(owner.directory);
   }
 
@@ -172,6 +183,7 @@ export function createNativeDiscovery({ projectRoot, isClientSource }) {
   }
 
   return {
+    stats(){return {declaredVisits,declaredProofHits,nativePresent:nativePresent.size,nativeAbsent:nativeAbsent.size};},
     setResolver(mode, resolve) { resolvers.set(mode, resolve); },
     canExternalizeDirectory,
     async externalOwner(file, mode) {

package/build/native-ppr.mjs

@@ -0,0 +1,32 @@
+import {readFile, writeFile, stat} from 'node:fs/promises';
+import path from 'node:path';
+import {partialShell, sha256, NATIVE_PPR_ARTIFACT_BYTES, NATIVE_PPR_PREFIX_BYTES} from '../runtime/native-ppr.mjs';
+
+// Only concrete build-time shells are certified. Runtime regeneration, generic
+// params, middleware and external caches stay on the authoritative Node path.
+export async function prepareNativePprShells(stage, manifest) {
+  delete manifest.config.nativePprArtifacts;
+  if (!manifest.config.nativePprShell || !manifest.config.cacheComponents || manifest.dev || manifest.middleware || manifest.config.basePath || manifest.config.cacheHandler || Object.keys(manifest.config.cacheHandlers || {}).length) return;
+  const descriptors = [];
+  let total = 0;
+  for (const route of [...manifest.routes].sort((a, b) => a.id.localeCompare(b.id))) {
+    if (route.kind !== 'page' || route.router !== 'app' || route.internal || route.parallel || route.cacheConfig?.runtime === 'edge') continue;
+    for (const [pathname, artifactFile] of Object.entries(route.ppr || {}).sort(([a], [b]) => a.localeCompare(b))) {
+      if (descriptors.length >= 32) break;
+      const file = path.resolve(stage, artifactFile);
+      if (!artifactFile.startsWith('static/') || !file.startsWith(path.resolve(stage) + path.sep) || (await stat(file)).size > NATIVE_PPR_ARTIFACT_BYTES) continue;
+      const bytes = await readFile(file);
+      const artifact = JSON.parse(bytes);
+      if (artifact.version !== 1 || !artifact.postponed || artifact.complete || artifact.generic || artifact.externalCache || artifact.revalidate === 0 || typeof artifact.flight !== 'string' || Object.keys(artifact.headers || {}).length) continue;
+      const prefix = Buffer.from(partialShell(artifact, route).replace(/<\/body><\/html>$/i, ''));
+      if (prefix.length > NATIVE_PPR_PREFIX_BYTES || total + prefix.length > 4 * 1024 * 1024) continue;
+      if (!Number.isSafeInteger(artifact.generatedAt) || artifact.generatedAt < 0 || !(artifact.revalidate == null || artifact.revalidate === false || Number.isSafeInteger(artifact.revalidate) && artifact.revalidate > 0)) continue;
+      const prefixHash = sha256(prefix);
+      const prefixFile = `static/native-ppr-${prefixHash}.html`;
+      await writeFile(path.join(stage, prefixFile), prefix);
+      descriptors.push({routeId: route.id, path: pathname, artifact: artifactFile, artifactHash: sha256(bytes), prefix: prefixFile, prefixHash, identity: sha256(artifact.flight), generatedAt: artifact.generatedAt, revalidate: artifact.revalidate ?? false});
+      total += prefix.length;
+    }
+  }
+  manifest.config.nativePprArtifacts = descriptors;
+}

package/build/npm-packages.mjs

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { builtinModules, createRequire } from 'node:module';
-import {analyzeSource} from './source-analysis.mjs';
+import {analyzeSourceSummary} from './source-analysis.mjs';
 import { createNativeDiscovery } from './native-discovery.mjs';
 import {frameworkImportPattern} from './framework-imports.mjs';
 
@@ -25,7 +25,7 @@ export function npmPackagesPlugin({ pages = false, projectRoot, transpilePackage
       sourceBytes += Buffer.byteLength(source);
       if (sourceBytes > 64 * 1024 * 1024) throw new Error('npm compilation analysis exceeded 64 MiB of source. Separate large runtime dependencies using serverExternalPackages.');
       if (Buffer.byteLength(source) > 8 * 1024 * 1024) throw new Error(`npm source ${file} exceeds the 8 MiB analysis limit. Configure serverExternalPackages for packages that do not use Next APIs.`);
-      const {imports,computedRequire,frameworkBoundary}=analyzeSource(source,file);
+      const {imports,computedRequire,frameworkBoundary}=analyzeSourceSummary(source,file);
       return {imports,computedRequire,frameworkBoundary};
     })());
     return sources.get(file);

package/build/og.mjs

@@ -1,6 +1,126 @@
-import { cp, mkdir } from 'node:fs/promises';
+import { cp, mkdir, readdir, lstat, open } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
+import { builtinModules } from 'node:module';
+import { analyzeSource } from './source-analysis.mjs';
+
+const packageRoot = fileURLToPath(new URL('../', import.meta.url));
+const inside = (root, file) => file === root || file.startsWith(root + path.sep);
+const builtins = new Set([...builtinModules, ...builtinModules.map(name => 'node:' + name)]);
+const unsafeBuiltins = /^(?:node:)?(?:vm|worker_threads|child_process)$/;
+const react = /^(?:react|react-dom|react-server-dom-webpack)(?:\/|$)/;
+const maxFiles = 4096, maxBytes = 64 * 1024 * 1024, maxFileBytes = 8 * 1024 * 1024;
+
+/** Certification examines the actual emitted server graph, never source-text
+ * matches. An unknown loader/dependency is an inclusion, not an omission. The
+ * installed framework modules are a fixed boundary; application graph roots,
+ * middleware, instrumentation, cache handlers and client SSR are all inspected. */
+export async function imageResponseRequirement(stage, {dev = false, manifest = {}} = {}) {
+  const included = reason => ({included: true, reason});
+  if (dev) return included('development');
+  if (manifest.middleware?.runtime === 'edge' || manifest.routes?.some(route => route.handlerConfig?.runtime === 'edge' || route.cacheConfig?.runtime === 'edge')) return included('edge-runtime');
+  stage = path.resolve(stage);
+  const pending = [], seen = new Set();
+  let bytes = 0;
+  try {
+    for (const name of ['server', 'app-ssr', 'app-ssr-edge']) {
+      const directory = path.join(stage, name);
+      let entries;
+      try { const info = await lstat(directory); if (!info.isDirectory() || info.isSymbolicLink()) return included('unverified-output'); entries = await readdir(directory, {withFileTypes: true}); }
+      catch (error) { if (error.code === 'ENOENT') continue; throw error; }
+      if (entries.some(entry => !entry.isFile())) return included('unverified-output');
+      for (const entry of entries) if (/\.(?:[cm]?js)$/.test(entry.name)) pending.push(path.join(directory, entry.name));
+    }
+    for (const entry of [manifest.middleware?.module, manifest.config?.cacheHandler, ...Object.values(manifest.config?.cacheHandlers || {})]) if (entry) pending.push(path.resolve(stage, entry));
+    while (pending.length) {
+      const file = pending.pop();
+      if (seen.has(file)) continue;
+      if (!inside(stage, file) || seen.size >= maxFiles) return included('unverified-output');
+      seen.add(file);
+      // An actual application import of the compatibility layer or loader is
+      // sufficient evidence, even if the ImageResponse binding is only dynamic.
+      if (file === path.join(stage, 'compat/og.cjs') || file === path.join(stage, 'runtime/og-loader.mjs') || inside(path.join(stage, 'runtime/og'), file)) return included('image-response-import');
+      const relative = path.relative(stage, file);
+      const frameworkFile = relative.startsWith('compat' + path.sep) || relative.startsWith('runtime' + path.sep);
+      if (frameworkFile) {
+        // Only exact installed files are trusted. Configured output overrides
+        // and missing/unknown framework modules retain the complete renderer.
+        const known = path.join(packageRoot, relative), [a, b] = await Promise.all([lstat(file), lstat(known)]);
+        if (!a.isFile() || a.isSymbolicLink() || !b.isFile() || b.isSymbolicLink() || a.size !== b.size) return included('unverified-framework');
+        const [actual, expected] = await Promise.all([readBounded(file, maxFileBytes), readBounded(known, maxFileBytes)]);
+        if (!actual.equals(expected)) return included('unverified-framework');
+        continue;
+      }
+      const info = await lstat(file);
+      if (!info.isFile() || info.isSymbolicLink() || info.size > maxFileBytes || (bytes += info.size) > maxBytes) return included('unverified-output');
+      const source = await readBounded(file, maxFileBytes), analysis = analyzeSource(source.toString(), file);
+      if (hasUnknownLoading(analysis.program)) return included('dynamic-loader');
+      for (const dependency of analysis.imports) {
+        const specifier = dependency.path;
+        if (typeof specifier !== 'string' || specifier.includes('\0') || unsafeBuiltins.test(specifier)) return included('unverified-dependency');
+        if (builtins.has(specifier) || react.test(specifier)) continue;
+        if (/^(?:next|prnext|@thomas\.f\/prnext)\/og(?:\.js)?$/.test(specifier)) return included('image-response-import');
+        if (!specifier.startsWith('.')) return included('external-dependency');
+        const target = path.resolve(path.dirname(file), specifier);
+        // JSON/data imports cannot load executable OG code. Other extensions
+        // and extensionless resolution are deliberately not guessed.
+        if (target.endsWith('.json')) {
+          if (!inside(stage, target) || !(await lstat(target)).isFile()) return included('unverified-dependency');
+          continue;
+        }
+        if (!/\.(?:[cm]?js)$/.test(target)) return included('unverified-dependency');
+        pending.push(target);
+      }
+    }
+    return {included: false, reason: 'certified-unused', files: seen.size, bytes};
+  } catch { return included('unverified-output'); }
+}
+
+async function readBounded(filename, limit) {
+  const file = await open(filename, 'r');
+  try {
+    const before = await file.stat();
+    if (!before.isFile() || before.size > limit) throw Error('ImageResponse graph exceeds its file budget');
+    const buffer = Buffer.alloc(before.size + 1);
+    let length = 0;
+    while (length < buffer.length) { const next = await file.read(buffer, length, buffer.length - length, null); if (!next.bytesRead) break; length += next.bytesRead; }
+    const after = await file.stat();
+    if (length !== before.size || before.size !== after.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs) throw Error('ImageResponse graph changed during certification');
+    return buffer.subarray(0, length);
+  } finally { await file.close(); }
+}
+
+function hasUnknownLoading(program) {
+  const factories = new Set(program.body.filter(node => node.type === 'ImportDeclaration' && ['module', 'node:module'].includes(node.source?.value)).flatMap(node => node.specifiers.filter(item => item.type === 'ImportSpecifier' && item.imported?.name === 'createRequire').map(item => item.local.name)));
+  const stack = [[program, null]];
+  while (stack.length) {
+    const [node, parent] = stack.pop();
+    if (node.type === 'Identifier' && (['eval', 'Function', 'Reflect'].includes(node.name) || /webpack_require/.test(node.name))) return true;
+    if (node.type === 'MemberExpression' && (node.property?.name ?? node.property?.value) === 'constructor') return true;
+    if (node.type === 'ImportExpression' && typeof node.source?.value !== 'string') return true;
+    if ((node.type === 'NewExpression' || node.type === 'CallExpression') && (node.callee?.name === 'eval' || node.callee?.name === 'Function' || ['eval', 'Function', 'constructor', 'runInContext', 'runInNewContext', 'compileFunction', 'dlopen', 'getBuiltinModule'].includes(node.callee?.property?.name ?? node.callee?.property?.value))) return true;
+    if (node.type === 'CallExpression' && factories.has(node.callee?.name) && (parent?.type !== 'VariableDeclarator' || parent.id?.name !== 'require')) return true;
+    if (node.type === 'ImportDeclaration' && ['module', 'node:module'].includes(node.source?.value) && node.specifiers.some(item => item.type !== 'ImportSpecifier' || item.imported?.name !== 'createRequire')) return true;
+    if (node.type === 'Identifier' && /^_*require\d*$/.test(node.name)) {
+      const binding = parent?.type === 'VariableDeclarator' && parent.id === node && parent.init?.type === 'CallExpression' && factories.has(parent.init.callee?.name);
+      const call = node.name === 'require' && parent?.type === 'CallExpression' && parent.callee === node;
+      if (!binding && (!call || parent.arguments.length !== 1 || typeof parent.arguments[0]?.value !== 'string')) return true;
+    }
+    if (node.type === 'CallExpression' && node.callee?.type === 'MemberExpression' && ['require', '_load', 'createRequire'].includes(node.callee.property?.name)) return true;
+    if (node.type === 'Identifier' && factories.has(node.name)) {
+      const specifier = parent?.type === 'ImportSpecifier';
+      const call = parent?.type === 'CallExpression' && parent.callee === node && parent.arguments.length === 1 && parent.arguments[0]?.type === 'MemberExpression' && parent.arguments[0].object?.type === 'MetaProperty' && parent.arguments[0].property?.name === 'url';
+      if (!specifier && !call) return true;
+    }
+    if (node.type === 'VariableDeclarator' && node.init?.type === 'CallExpression' && factories.has(node.init.callee?.name) && node.id?.name !== 'require') return true;
+    for (const value of Object.values(node)) {
+      if (Array.isArray(value)) { for (const item of value) if (item?.type) stack.push([item, node]); }
+      else if (value?.type) stack.push([value, node]);
+    }
+  }
+  return false;
+}
+
 export async function prepareImageResponse(stage) {
   const target = path.join(stage, 'runtime/og');
   await mkdir(target, { recursive: true });