@thomas.f/prnext 0.1.19-alpha → 0.1.21-alpha

package/docs/ai/troubleshooting.md

@@ -185,6 +185,28 @@ exclude the full streaming body, and missing/dropped samples are not zero.
 `prnext analyze`, after building, rather than interpreting request time as
 compiler performance.
 
+The `flight` section of `prnext inspect --json` groups observed App Router
+payload sizes by route pattern and render phase. `flightP95Bytes` is the
+uncompressed Flight size for completed samples; `responseP95Bytes` is the
+uncompressed application output yielded by the HTML renderer. Cancelled, failed
+and timed-out samples remain visible separately and do not count as complete
+payloads. RSC and SSR can observe the same Flight stream: never add their sizes
+or request counts. `modelReadyP95Ms`, `shellReadyP95Ms` and `durationP95Ms`
+include rendering, application work and asynchronous waits, not isolated
+encoder/decoder CPU. Missing data stays `null`. The OTLP/JSON view includes
+`prnext.flight.response.size` in bytes with separate render-phase attributes.
+
+Large server-generated presentation trees can produce much more Flight data
+than compact public props. For a pure table, consider a small explicit
+`'use client'` presentation component receiving only the public fields it needs.
+Its initial document can still render on the server, while its implementation
+also joins the browser bundle. Measure the resulting Flight/HTML sizes,
+JavaScript transfer, browser execution and hydration together. Keep database
+access, credentials and private server logic outside that boundary. A count-only
+synthetic table does not predict savings for real row data; converting arbitrary
+Server Components automatically is not a safe optimization. Inspecting a route
+does not automatically rewrite it, enable caching or change its privacy policy.
+
 Initial-JS analysis includes required hydration imports and SSR-used dynamic
 chunks. Schema 2 reports per-prerendered-path samples and the maximum size for
 each compression metric; a route's file list can be the union of its samples.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thomas.f/prnext",
-  "version": "0.1.19-alpha",
+  "version": "0.1.21-alpha",
   "license": "MIT",
   "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
   "homepage": "https://prnext.dev",
@@ -135,58 +135,61 @@
     "@edge-runtime/vm": "5.0.0",
     "@jridgewell/trace-mapping": "0.3.31",
     "@mapbox/node-pre-gyp": "2.0.3",
-    "@rollup/pluginutils": "5.4.0",
-    "acorn": "8.18.0",
+    "@rollup/pluginutils": "5.5.1",
+    "acorn": "8.19.0",
     "acorn-import-attributes": "1.9.5",
     "async-sema": "3.1.1",
     "babel-plugin-react-compiler": "1.0.0",
     "bindings": "1.5.0",
-    "browserslist": "4.29.0",
-    "dotenv": "16.6.1",
+    "browserslist": "4.29.5",
+    "dotenv": "18.0.9",
     "dotenv-expand": "11.0.7",
     "esbuild": "^0.28.2",
     "estree-walker": "2.0.2",
-    "fontkit": "2.0.4",
     "get-tsconfig": "4.14.3",
-    "glob": "14.0.2",
+    "glob": "14.0.3",
     "graceful-fs": "4.2.11",
     "html-to-image": "1.11.13",
     "jsonc-parser": "3.3.1",
-    "lightningcss": "1.31.0",
+    "lightningcss": "1.33.0",
     "loader-runner": "4.3.2",
-    "minimatch": "11.0.1",
+    "minimatch": "11.0.4",
     "node-gyp-build": "4.8.4",
-    "oxc-parser": "0.155.0",
+    "oxc-parser": "0.156.0",
     "path-to-regexp": "6.3.0",
     "picomatch": "4.0.7",
-    "postcss": "8.5.28",
+    "postcss": "8.5.32",
     "postcss-flexbugs-fixes": "5.0.2",
-    "postcss-preset-env": "11.5.3",
-    "postcss-selector-parser": "7.1.6",
+    "postcss-preset-env": "11.6.2",
+    "postcss-selector-parser": "7.1.7",
     "postcss-value-parser": "4.2.0",
     "react-refresh": "0.19.0",
     "resolve-from": "5.0.0",
-    "schema-utils": "4.3.3",
-    "webpack": "5.111.1"
+    "schema-utils": "4.8.2",
+    "webpack": "5.112.2"
   },
   "peerDependencies": {
     "@redis/client": "^6.3.0",
     "react": "19.3.1",
     "react-dom": "19.3.1",
-    "react-server-dom-webpack": "19.3.1"
+    "react-server-dom-webpack": "19.3.1",
+    "oxc-transform-react": "0.157.0"
   },
   "peerDependenciesMeta": {
     "@redis/client": {
       "optional": true
+    },
+    "oxc-transform-react": {
+      "optional": true
     }
   },
   "optionalDependencies": {
-    "prnext-darwin-arm64": "0.1.19-alpha",
-    "prnext-darwin-x64": "0.1.19-alpha",
-    "prnext-linux-arm64-gnu": "0.1.19-alpha",
-    "prnext-linux-x64-gnu": "0.1.19-alpha",
-    "@thomas.f/prnext-win32-x64-msvc": "0.1.19-alpha",
-    "@thomas.f/prnext-win32-arm64-msvc": "0.1.19-alpha"
+    "prnext-darwin-arm64": "0.1.21-alpha",
+    "prnext-darwin-x64": "0.1.21-alpha",
+    "prnext-linux-arm64-gnu": "0.1.21-alpha",
+    "prnext-linux-x64-gnu": "0.1.21-alpha",
+    "@thomas.f/prnext-win32-x64-msvc": "0.1.21-alpha",
+    "@thomas.f/prnext-win32-arm64-msvc": "0.1.21-alpha"
   },
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"

package/release/fontkit.mjs

@@ -0,0 +1,31 @@
+import {createHash} from 'node:crypto';
+import {readFile, readdir} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const destination = fileURLToPath(new URL('../vendor/fontkit/', import.meta.url));
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+
+/** Validate the shipped inventory without loading fontkit or its build dependencies. */
+export async function verifyVendoredFontkit(directory = destination) {
+  const provenance = JSON.parse(await readFile(path.join(directory, 'upstream.json'), 'utf8'));
+  if (provenance.schemaVersion !== 1 || provenance.name !== 'fontkit' || provenance.version !== '2.0.4'
+      || provenance.tool?.name !== 'esbuild' || !provenance.files?.['index.mjs']
+      || !provenance.files?.['NOTICE.txt'] || !provenance.files?.['SOURCE-NOTICES.txt']
+      || !provenance.packages?.fontkit || !provenance.packages?.brotli) throw new Error('Incomplete fontkit provenance.');
+  const actual = [];
+  async function visit(directory, prefix = '') {
+    for (const entry of await readdir(directory, {withFileTypes: true})) {
+      const name = prefix + entry.name;
+      if (entry.isDirectory()) await visit(path.join(directory, entry.name), name + '/');
+      else if (!entry.isFile()) throw new Error('Vendored fontkit files must be regular files.');
+      else if (name !== 'upstream.json') actual.push(name);
+    }
+  }
+  await visit(directory);
+  if (JSON.stringify(actual.sort()) !== JSON.stringify(Object.keys(provenance.files).sort())) throw new Error('Vendored fontkit inventory changed.');
+  for (const name of actual) {
+    if (digest(await readFile(path.join(directory, name))) !== provenance.files[name]) throw new Error(`Vendored fontkit differs from its reviewed build: ${name}`);
+  }
+  return {version: provenance.version, files: actual.length, bytes: (await readFile(path.join(directory, 'index.mjs'))).length};
+}

package/release/verify.mjs

@@ -3,6 +3,7 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { packageRoot, packageManifest, platforms, sourceCheckout } from '../native/resolve.mjs';
 import { verifyAiDocumentation } from './ai-docs.mjs';
+import { verifyVendoredFontkit } from './fontkit.mjs';
 
 export async function verifyPackage() {
   const pkg = packageManifest;
@@ -27,6 +28,8 @@ export async function verifyPackage() {
   }
   await exported(pkg.exports);
   await verifyAiDocumentation(packageRoot, pkg);
+  await verifyVendoredFontkit();
+  if (pkg.dependencies.fontkit || pkg.dependencies['oxc-transform-react'] || pkg.peerDependenciesMeta?.['oxc-transform-react']?.optional !== true) throw new Error('Fontkit must be bundled and the Oxc React compiler must remain an optional peer.');
   await access(path.join(packageRoot, 'runtime/profiles.json'));
   for (const name of ['index.node.mjs', 'resvg.wasm', 'hb.wasm', 'Geist-Regular.ttf', 'LICENSE', 'LICENSE.fflate', 'LICENSE.Geist', 'LICENSE.harfbuzzjs', 'LICENSE.satori', 'NOTICE.txt']) await access(path.join(packageRoot, 'runtime/og', name));
   if (pkg.dependencies['@vercel/og'] || (await readFile(path.join(packageRoot, 'runtime/og/index.node.mjs'), 'utf8')).includes('fflate@0.7.3')) throw new Error('OG renderer still depends on vulnerable upstream fflate. Run scripts/prepare-og.mjs.');

package/runtime/api.mjs

@@ -195,7 +195,7 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
   // IncomingMessage here duplicates URL, header and cookie work and allocates
   // an unused Duplex. Keep the existing Pages request path unchanged.
   const { request, bytes } = appHandler
-    ? { bytes: Buffer.isBuffer(body) ? body : Buffer.from(body || '', 'base64') }
+    ? { bytes: body instanceof ReadableStream ? body : Buffer.isBuffer(body) ? body : Buffer.from(body || '', 'base64') }
     : createRequest({ url, originalUrl: requestOriginal?.href, params, method, headers, body });
   if (!appHandler) {
     request.draftMode = cacheContext.draftMode;
@@ -226,7 +226,10 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
       throw abortError(lifecycle.controller.signal.reason);
     }
     const init = { method, headers, ...(lifecycle ? { signal: lifecycle.controller.signal } : {}) };
-    if (!['GET', 'HEAD'].includes(method) && bytes.length) init.body = bytes;
+    if (!['GET', 'HEAD'].includes(method) && (bytes instanceof ReadableStream || bytes.length)) {
+      init.body = bytes;
+      if (bytes instanceof ReadableStream) init.duplex = 'half';
+    }
     const timeout = lifecycle && setTimeout(() => lifecycle.controller.abort(apiTimeoutError('response headers', timeoutMs)), timeoutMs);
     timeout?.unref();
     const pendingResponse = runRequestContext({ url, method, headers, params, production, cacheComponents: manifest.config?.cacheComponents, cacheLife: manifest.config?.cacheLife, cacheHandlers: manifest.config?.cacheHandlers, cacheHandler: manifest.config?.cacheHandler, cacheMaxMemorySize: manifest.config?.cacheMaxMemorySize, distDir: path.dirname(path.dirname(modulePath)), signal: lifecycle?.controller.signal || signal, previewModeId: manifest.previewModeId, basePath: manifest.config?.basePath || '', routePattern: route.pattern, cacheConfig: route.cacheConfig, phase: 'route', cacheState: cacheContext.cacheState, staticState: cacheContext.staticState, mutableCookies: true }, async () => {