@thomas.f/prnext 0.1.20-alpha → 0.1.21-alpha

package/build/standalone-copy.mjs

@@ -0,0 +1,48 @@
+import {lstat, realpath, mkdir, copyFile, stat} from 'node:fs/promises';
+import path from 'node:path';
+import {mapConcurrent} from './concurrent.mjs';
+
+const within = (root, file) => file === root || file.startsWith(root + path.sep);
+const version = info => [info.dev, info.ino, info.size, info.mtimeMs, info.ctimeMs];
+const unchanged = (left, right) => version(left).every((value, index) => value === version(right)[index]);
+
+/** Materialize a finite trace, keeping links deferred until all file writes settle. */
+export async function copyStandaloneTrace(files, {tracingRoot, relocate, maxFiles, maxBytes, concurrency = 8}, io = {lstat, realpath, mkdir, copyFile, stat}) {
+  const sources = Array.from(files);
+  if (sources.length > maxFiles) throw new Error('Standalone output exceeds 100000 files / 2 GiB. Narrow tracing includes.');
+  // Metadata can overlap, but admission and destination ordering remain exactly
+  // the trace's order. No bytes are copied before the whole budget is admitted.
+  const metadata = await mapConcurrent(sources, async source => {
+    const info = await io.lstat(source);
+    if (info.isSymbolicLink()) return {source, info, destination: await io.realpath(source)};
+    return {source, info};
+  }, concurrency);
+  let copiedFiles = 0, copiedBytes = 0;
+  const pendingLinks = [], groups = new Map();
+  for (const {source, info, destination} of metadata) {
+    if (info.isSymbolicLink() && !within(tracingRoot, source) && within(destination, tracingRoot)) continue;
+    const target = relocate(source);
+    if (++copiedFiles > maxFiles || (copiedBytes += info.size) > maxBytes) throw new Error('Standalone output exceeds 100000 files / 2 GiB. Narrow tracing includes.');
+    if (info.isSymbolicLink()) { pendingLinks.push([target, relocate(destination)]); continue; }
+    if (!info.isFile()) continue;
+    const key = process.platform === 'win32' ? target.toLowerCase() : target;
+    if (!groups.has(key)) groups.set(key, []);
+    groups.get(key).push({source, target, info});
+  }
+  const directories = new Map();
+  await mapConcurrent(groups.values(), async entries => {
+    // Alias collisions retain the old serial last-writer order. Unrelated files
+    // share a small I/O worker set and one mkdir promise per destination parent.
+    for (const {source, target, info} of entries) {
+      const before = await io.lstat(source);
+      if (!before.isFile() || !unchanged(info, before)) throw new Error('Standalone input changed before copying.');
+      const directory = path.dirname(target);
+      if (!directories.has(directory)) directories.set(directory, io.mkdir(directory, {recursive: true}));
+      await directories.get(directory);
+      await io.copyFile(source, target);
+      const [after, copied] = await Promise.all([io.lstat(source), io.stat(target)]);
+      if (!after.isFile() || !unchanged(before, after) || !copied.isFile() || copied.size !== before.size) throw new Error('Standalone input changed while copying.');
+    }
+  }, concurrency);
+  return {copiedFiles, copiedBytes, pendingLinks};
+}

package/build/standalone.mjs

@@ -7,6 +7,7 @@ import path from 'node:path';
 import { resolveNativeBinary } from '../native/resolve.mjs';
 import { createHash } from 'node:crypto';
 import { createRequire } from 'node:module';
+import {copyStandaloneTrace} from './standalone-copy.mjs';
 
 const slash = value => value.split(path.sep).join('/');
 const within = (root, file) => file === root || file.startsWith(root + path.sep);
@@ -219,28 +220,7 @@ export async function createStandalone({ projectRoot, stage, manifest, config })
     } else traceFiles.add(target);
   }
   await mkdir(output, { recursive: true });
-  let copiedBytes = 0;
-  let copiedFiles = 0;
-  const pendingLinks = [];
-  for (const source of traceFiles) {
-    const info = await lstat(source);
-    // NFT also emits ancestor aliases used by absolute workspace links, such as
-    // macOS /var -> /private/var. Their canonical children are already traced;
-    // these host directory aliases are not dependencies of the artifact.
-    // Real files and links to unrelated external workspaces still go through
-    // relocated(), which enforces the configured tracing boundary.
-    if (info.isSymbolicLink() && !within(tracingRoot, source) && within(await realpath(source), tracingRoot)) continue;
-    const target = relocated(source);
-    if (++copiedFiles > maxFiles || (copiedBytes += info.size) > maxBytes) throw new Error('Standalone output exceeds 100000 files / 2 GiB. Narrow tracing includes.');
-    if (info.isSymbolicLink()) {
-      const destination = await realpath(source);
-      pendingLinks.push([target, relocated(destination)]);
-      continue;
-    }
-    if (!info.isFile()) continue;
-    await mkdir(path.dirname(target), { recursive: true });
-    await copyFile(source, target);
-  }
+  let {copiedBytes, copiedFiles, pendingLinks} = await copyStandaloneTrace(traceFiles, {tracingRoot, relocate: relocated, maxFiles, maxBytes});
   const owners = new Set(bridges.values());
   const includedOwners = new Set();
   for (const file of traceFiles) for (let dir = path.dirname(file); dir !== path.dirname(dir); dir = path.dirname(dir)) if (owners.has(dir)) includedOwners.add(dir);

package/build/transform-cache.mjs

@@ -25,7 +25,14 @@ export async function withPersistentTransforms(root,{enabled=true,dev=false}={},
   return result;
 }
 function identity(kind,source,settings){return createHash('sha256').update(persistent.getStore()?.key||'memory').update(JSON.stringify([kind,settings,sourceMapsEnabled()])).update('\0').update(source).digest('hex');}
-function diskValue(key){const scope=persistent.getStore();if(!scope?.values.has(key))return;const value=scope.values.get(key);scope.values.delete(key);scope.values.set(key,value);diskHits++;hits++;return value;}
+function discard(key){const value=entries.get(key);if(value){entries.delete(key);bytes-=value.size;}}
+function validValue(value,validate){if(!validate)return true;try{return validate(value)===true;}catch{return false;}}
+function diskValue(key,validate){
+  const scope=persistent.getStore();if(!scope?.values.has(key))return;
+  const value=scope.values.get(key);scope.values.delete(key);
+  if(!validValue(value,validate)){scope.bytes-=Buffer.byteLength(value);scope.dirty=true;return;}
+  scope.values.set(key,value);diskHits++;hits++;return value;
+}
 function remember(key,output){
   const scope=persistent.getStore();if(!scope||typeof output!=='string')return;
   const size=Buffer.byteLength(output);if(size>128*1024)return;
@@ -38,16 +45,23 @@ function remember(key,output){
 // closure or mutable build metadata survives in the cache. Include all options
 // affecting output in settings, including build identity and target mode.
 export function cachedTransform(kind, source, settings, transform) {
+  return cachedValidatedTransform(kind,source,settings,undefined,transform);
+}
+
+/** Typed compiler facts may replay only structurally validated string records. */
+export function cachedValidatedTransform(kind, source, settings, validate, transform) {
   const key = identity(kind,source,settings);
   const found = entries.get(key);
-  if (found) {
+  if (found && validValue(found.output,validate)) {
     hits++; entries.delete(key); entries.set(key,found);
     if(persistent.getStore()&&!persistent.getStore().values.has(key))remember(key,found.output);
     return found.output;
   }
-  const saved=diskValue(key);if(saved!==undefined)return saved;
+  if(found)discard(key);
+  const saved=diskValue(key,validate);if(saved!==undefined)return saved;
   misses++;
   const output = transform();
+  if(!validValue(output,validate))throw new TypeError('Invalid typed compiler cache result');
   remember(key,output);
   // UTF-16 is an upper bound for the retained string payload. Metadata adds
   // engine overhead; the entry count also bounds that overhead.

package/cli.mjs

@@ -22,6 +22,7 @@ Use prnext for portable scripts; prn is a shortcut on compatible shells.
                                        Detect a completed browser build
   prnext build [directory] --adapter static --from .
                                        Build a plain HTML/CSS/JS site
+  prnext build [directory] --timings    Show time spent in React build phases
   prnext output [directory] [--json]    Read the versioned build output contract
   prnext start [directory] [options]    Start native Rust production server
   prnext pstart [directory] [options]   Start production persistently in the background
@@ -338,11 +339,16 @@ async function main() {
   }
   if (command === 'build') {
     const options = {};
+    let showTimings = false;
     for (let i = 0; i < args.length; i++) {
       const flag = args[i];
       if (flag === '--dev') options.dev = true;
       else if (flag === '--watch') options.watch = true;
       else if (flag === '--spa') options.spa = true;
+      else if (flag === '--timings') {
+        if (showTimings) throw new Error('Duplicate build option: --timings');
+        showTimings = true;
+      }
       else if (flag === '--adapter' || flag === '--from') {
         const value = args[++i];
         if (!value || value.startsWith('-')) throw new Error(`${flag} requires a value`);
@@ -356,6 +362,7 @@ async function main() {
     process.env.NODE_ENV = dev ? 'development' : 'production';
     const started = performance.now();
     if(options.watch){
+      if(showTimings)throw new Error('--timings reports one build. Run prnext build --timings without --watch.');
       if(dev)throw new Error('--watch builds production; use prnext dev for development.');
       const {watchProduction}=await import('./build/production-builder.mjs');
       delete options.watch;await watchProduction(root,options);return;
@@ -367,11 +374,17 @@ async function main() {
       else if (options.adapter === 'auto') options.adapter = 'react';
     }
     if (options.adapter === 'static') {
+      if(showTimings)throw new Error('--timings requires the React build adapter.');
       const { buildStatic } = await import('./build/static-adapter.mjs');
       await buildStatic(root, options);
     } else {
       const { build } = await import('./build/index.mjs');
       const result=await build(root, { ...options, dev, envMode });
+      if(showTimings&&result.buildTimings){
+        console.log('Build timings (milliseconds; nested phases are not additive):');
+        for(const[name,phase]of Object.entries(result.buildTimings.phases))console.log(`  ${name}: ${phase.milliseconds.toFixed(2)} (${phase.calls} ${phase.calls===1?'call':'calls'})`);
+        console.log(`  total: ${result.buildTimings.totalMilliseconds.toFixed(2)} (excludes CLI module startup)`);
+      }
       if(!dev&&result.compilationCache?.hits){
         const {hits,reusedBytes}=result.compilationCache;
         console.log(`Compilation cache: ${hits} ${hits===1?'graph':'graphs'} reused (${Math.ceil(reusedBytes/1024)} KiB).`);

package/compat/diagnostics.cjs

@@ -4,10 +4,11 @@ const directory = process.env.PRNEXT_INSPECT_DIR;
 const { threadId } = require('node:worker_threads');
 let queue = [], scheduled = false, writing = false, size;
 const limit = 1024 * 1024;
-if (directory) setInterval(() => {
-  const {rss, heapUsed} = process.memoryUsage();
-  record('process', {rssBytes:rss, heapUsedBytes:heapUsed});
-}, 5000).unref();
+if (directory) {
+  // No GC observer or periodic sampler exists when diagnostics are disabled.
+  const sampler = require('./runtime-sample.cjs').createRuntimeSampler();
+  setInterval(() => record('process', sampler.sample()), 5000).unref();
+}
 function record(type, fields = {}) {
   if (!directory || queue.length >= 256) return;
   const line = JSON.stringify({ time: Date.now(), pid: process.pid, type, ...fields }) + '\n';

package/compat/runtime-sample.cjs

@@ -0,0 +1,56 @@
+'use strict';
+
+// Constructed only for opt-in diagnostics. Samples contain numeric runtime
+// counters, never application values, request context or allocation stacks.
+function createRuntimeSampler() {
+  const { PerformanceObserver, performance } = require('node:perf_hooks');
+  const { threadId, resourceLimits } = require('node:worker_threads');
+  const { getHeapSpaceStatistics } = require('node:v8');
+  let count = 0, durationMs = 0, maxPauseMs = 0;
+  let previousTime = performance.now();
+  let previousLoop = performance.eventLoopUtilization();
+  let previousCpu = threadId === 0 ? process.cpuUsage() : undefined;
+  const consume = entries => {
+    for (const entry of entries) {
+      count++;
+      durationMs += entry.duration;
+      maxPauseMs = Math.max(maxPauseMs, entry.duration);
+    }
+  };
+  const observer = new PerformanceObserver(list => consume(list.getEntries()));
+  observer.observe({ entryTypes: ['gc'] });
+  return {
+    sample() {
+      consume(observer.takeRecords());
+      const now = performance.now();
+      const loop = performance.eventLoopUtilization();
+      const eventLoop = performance.eventLoopUtilization(loop, previousLoop);
+      const { rss, heapUsed, heapTotal, external, arrayBuffers } = process.memoryUsage();
+      const young = getHeapSpaceStatistics().find(space => space.space_name === 'new_space');
+      const value = {
+        node: process.version, v8: process.versions.v8, threadId,
+        intervalMs: now - previousTime,
+        rssBytes: rss, heapUsedBytes: heapUsed, heapTotalBytes: heapTotal,
+        externalBytes: external, arrayBufferBytes: arrayBuffers,
+        youngSpaceBytes: young?.space_size ?? 0,
+        workerLimits: { ...resourceLimits },
+        gc: { count, durationMs, maxPauseMs },
+        eventLoop,
+      };
+      // CPU usage is process-wide, including all worker threads. Emit it only
+      // in the main isolate so aggregators cannot count the RSC CPU twice.
+      if (previousCpu) {
+        const cpu = process.cpuUsage();
+        value.cpu = { scope: 'process', userMicros: cpu.user - previousCpu.user,
+          systemMicros: cpu.system - previousCpu.system };
+        previousCpu = cpu;
+      }
+      previousLoop = loop; previousTime = now;
+      count = durationMs = maxPauseMs = 0;
+      return value;
+    },
+    close() { observer.disconnect(); },
+  };
+}
+
+module.exports = { createRuntimeSampler };

package/compat/use-cache.cjs

@@ -93,14 +93,17 @@ async function invokeCache(id, kind, captures, args, callback, segment = '') {
     then(_resolve, reject) { reject(new Error("searchParams cannot be read inside 'use cache'; read them outside and pass their values as arguments")); },
   };
   if (encoded.key.length > MAX_BYTES) throw new Error("'use cache' arguments exceed 2 MiB");
-  const key = createHash('sha256').update(id).update(kind).update(codec === plainCodec ? ':v8:' : ':flight:').update(encoded.key).digest('hex');
+  const format=codec===plainCodec?':v8:':codec.cacheKeyVersion==='flight-primitives-v2'?':flight-primitives-v2:':':flight:';
+  const key = createHash('sha256').update(id).update(kind).update(format).update(encoded.key).digest('hex');
   const profiles = context.cacheLife || context.manifest?.config?.cacheLife || defaults;
   const scope = { kind, profiles, life: { ...profiles.default }, explicit: new Set(), tags: new Set() };
   let producedMetadata;
   const producer = async () => runCacheScope(async () => {
     const value = await codec.render(() => callback(...encoded.values), encoded, context);
     producedMetadata = metadata(scope, context);
-    return envelope(producedMetadata, Buffer.from(value));
+    // envelope owns its result immediately; an already owned codec Buffer need
+    // not be copied into another temporary Buffer before this synchronous copy.
+    return envelope(producedMetadata, Buffer.isBuffer(value)?value:Buffer.from(value));
   }, scope);
   let bytes, handlerMetadata;
   const custom = kind !== 'private' && !context.draftMode && Object.hasOwn(configured(context), kind);

package/docs/ai/compatibility.md

@@ -104,7 +104,7 @@ implemented through PRNext's generated route registry. Do not copy a full
 Next.js configuration template into a new application.
 
 The repository's reference tests build and run matching applications against
-Next.js 16.4.3, including mounted App navigation, form Actions and cookies,
+Next.js 16.4.4, including mounted App navigation, form Actions and cookies,
 metadata, Pages locale routing, redirects, APIs and selected webpack loader
 contracts. These executable examples cover specific behavior; they do not
 certify every Next.js application or plugin. `NextRequest.nextUrl` understands
@@ -112,10 +112,10 @@ data-route build IDs and locales, and request-cookie mutations synchronize the
 request header. Request cookies have different mutation results from response
 cookies; do not use them interchangeably.
 
-A locked real-application fixture additionally exercises Better Auth 1.7.14
+A locked real-application fixture additionally exercises Better Auth 1.7.15
 (email/password, session cookies and logout), Drizzle ORM 0.45.4 over SQLite
 through its proxy driver, next-intl 4.14.9 (server and client translations),
-and the MDX 3.1.1 webpack loader against Next.js 16.4.3. It covers authenticated
+and the MDX 3.1.1 webpack loader against Next.js 16.4.4. It covers authenticated
 Server Actions, user-owned rows, cookie/locale isolation, client navigation and
 Server Component `after()` callbacks. This is evidence for those workflows,
 not a guarantee for every plugin, provider or deployment configuration.

package/docs/ai/deployment.md

@@ -15,7 +15,7 @@ prnext output --json
 prnext start --hostname 127.0.0.1 --port 3000
 ```
 
-### Upgrading from 0.1.19-alpha
+### Upgrading from an earlier alpha
 
 Install matching framework/native versions, then rebuild and restart the complete
 application or standalone output. Keep Node and the React protocol peers aligned
@@ -24,14 +24,17 @@ their identities match; never delete `data.sqlite3` or invalidation history to
 perform an upgrade. Read the storage section below before pruning compiler caches.
 
 Persistent apps need a supervisor restart too. In a maintenance window for the
-whole `PRNEXT_PM_HOME`, run `prnext pdown` with that same home before replacing
-packages. It stops all managed apps and preserves saved settings and enabled
+whole `PRNEXT_PM_HOME`, run the old installation's `prnext pdown` with that same
+home before replacing packages. The 0.1.21 local protocol rejects an old
+supervisor rather than silently taking it over. Shutdown stops all managed apps
+and preserves saved settings and enabled
 entries; `prestart` alone keeps the already loaded supervisor code. Update and
-rebuild the installations that must return with 0.1.20, then launch `pstart` or
+rebuild the installations that must return with the new version, then launch `pstart` or
 `prestart` through the new CLI. It also restores all enabled entries, with their
 saved binary paths and health routes. Check `pstatus` and real health responses;
 a global CLI update does not replace each app's package or binary. Keep independent
-lifecycles in separate homes.
+lifecycles in separate homes. Do not stop unrelated Node processes or external
+databases, Redis, proxies and OS services as an automatic upgrade fallback.
 
 Set `server.publicOrigin` to the external HTTPS origin and `server.trustedProxies`
 to the immediate proxy's IP/CIDR addresses. The configured origin wins; forwarded

package/docs/ai/troubleshooting.md

@@ -185,6 +185,28 @@ exclude the full streaming body, and missing/dropped samples are not zero.
 `prnext analyze`, after building, rather than interpreting request time as
 compiler performance.
 
+The `flight` section of `prnext inspect --json` groups observed App Router
+payload sizes by route pattern and render phase. `flightP95Bytes` is the
+uncompressed Flight size for completed samples; `responseP95Bytes` is the
+uncompressed application output yielded by the HTML renderer. Cancelled, failed
+and timed-out samples remain visible separately and do not count as complete
+payloads. RSC and SSR can observe the same Flight stream: never add their sizes
+or request counts. `modelReadyP95Ms`, `shellReadyP95Ms` and `durationP95Ms`
+include rendering, application work and asynchronous waits, not isolated
+encoder/decoder CPU. Missing data stays `null`. The OTLP/JSON view includes
+`prnext.flight.response.size` in bytes with separate render-phase attributes.
+
+Large server-generated presentation trees can produce much more Flight data
+than compact public props. For a pure table, consider a small explicit
+`'use client'` presentation component receiving only the public fields it needs.
+Its initial document can still render on the server, while its implementation
+also joins the browser bundle. Measure the resulting Flight/HTML sizes,
+JavaScript transfer, browser execution and hydration together. Keep database
+access, credentials and private server logic outside that boundary. A count-only
+synthetic table does not predict savings for real row data; converting arbitrary
+Server Components automatically is not a safe optimization. Inspecting a route
+does not automatically rewrite it, enable caching or change its privacy policy.
+
 Initial-JS analysis includes required hydration imports and SSR-used dynamic
 chunks. Schema 2 reports per-prerendered-path samples and the maximum size for
 each compression metric; a route's file list can be the union of its samples.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thomas.f/prnext",
-  "version": "0.1.20-alpha",
+  "version": "0.1.21-alpha",
   "license": "MIT",
   "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
   "homepage": "https://prnext.dev",
@@ -135,38 +135,38 @@
     "@edge-runtime/vm": "5.0.0",
     "@jridgewell/trace-mapping": "0.3.31",
     "@mapbox/node-pre-gyp": "2.0.3",
-    "@rollup/pluginutils": "5.4.0",
-    "acorn": "8.18.0",
+    "@rollup/pluginutils": "5.5.1",
+    "acorn": "8.19.0",
     "acorn-import-attributes": "1.9.5",
     "async-sema": "3.1.1",
     "babel-plugin-react-compiler": "1.0.0",
     "bindings": "1.5.0",
-    "browserslist": "4.29.0",
-    "dotenv": "16.6.1",
+    "browserslist": "4.29.5",
+    "dotenv": "18.0.9",
     "dotenv-expand": "11.0.7",
     "esbuild": "^0.28.2",
     "estree-walker": "2.0.2",
     "get-tsconfig": "4.14.3",
-    "glob": "14.0.2",
+    "glob": "14.0.3",
     "graceful-fs": "4.2.11",
     "html-to-image": "1.11.13",
     "jsonc-parser": "3.3.1",
-    "lightningcss": "1.31.0",
+    "lightningcss": "1.33.0",
     "loader-runner": "4.3.2",
-    "minimatch": "11.0.1",
+    "minimatch": "11.0.4",
     "node-gyp-build": "4.8.4",
-    "oxc-parser": "0.155.0",
+    "oxc-parser": "0.156.0",
     "path-to-regexp": "6.3.0",
     "picomatch": "4.0.7",
-    "postcss": "8.5.28",
+    "postcss": "8.5.32",
     "postcss-flexbugs-fixes": "5.0.2",
-    "postcss-preset-env": "11.5.3",
-    "postcss-selector-parser": "7.1.6",
+    "postcss-preset-env": "11.6.2",
+    "postcss-selector-parser": "7.1.7",
     "postcss-value-parser": "4.2.0",
     "react-refresh": "0.19.0",
     "resolve-from": "5.0.0",
-    "schema-utils": "4.3.3",
-    "webpack": "5.111.1"
+    "schema-utils": "4.8.2",
+    "webpack": "5.112.2"
   },
   "peerDependencies": {
     "@redis/client": "^6.3.0",
@@ -184,12 +184,12 @@
     }
   },
   "optionalDependencies": {
-    "prnext-darwin-arm64": "0.1.20-alpha",
-    "prnext-darwin-x64": "0.1.20-alpha",
-    "prnext-linux-arm64-gnu": "0.1.20-alpha",
-    "prnext-linux-x64-gnu": "0.1.20-alpha",
-    "@thomas.f/prnext-win32-x64-msvc": "0.1.20-alpha",
-    "@thomas.f/prnext-win32-arm64-msvc": "0.1.20-alpha"
+    "prnext-darwin-arm64": "0.1.21-alpha",
+    "prnext-darwin-x64": "0.1.21-alpha",
+    "prnext-linux-arm64-gnu": "0.1.21-alpha",
+    "prnext-linux-x64-gnu": "0.1.21-alpha",
+    "@thomas.f/prnext-win32-x64-msvc": "0.1.21-alpha",
+    "@thomas.f/prnext-win32-arm64-msvc": "0.1.21-alpha"
   },
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"