next-leak 0.1.3 → 0.3.0

package/dist/{chunk-5ZYZW2BL.js → chunk-WXAFXVWS.js}

@@ -1,4 +1,8 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
+import {
+  assessPeakPressure,
+  describePeakPressure
+} from "./chunk-XHPUAMJG.js";
 
 // src/issue-report.ts
 import path from "path";
@@ -41,6 +45,21 @@ function renderIssueMarkdown(route, run) {
 next-leak audits its own run and reports these limits. They do not overturn the verdict above, but they bound how much weight it carries:
 
 ` + route.confidence.warnings.map((warning) => `- ${warning.detail}`).join("\n") + `
+`;
+  const retainedHeap = route.memorySamples.at(-1)?.heapUsed;
+  const pressure = retainedHeap === void 0 || route.peaks === void 0 ? null : assessPeakPressure({
+    peaks: route.peaks,
+    retainedHeapBytes: retainedHeap,
+    maxOldSpaceMb: parameters.maxOldSpaceMb
+  });
+  const peakSection = pressure === null ? "" : `
+### Peak memory under load
+
+Sampled during the load phases, without forcing collection: ${describePeakPressure(pressure)}. Per cycle:
+
+` + route.peaks.filter((peak) => peak.polls > 0).map(
+    (peak) => `- ${peak.phase}: heap ${(peak.heapUsed / MB).toFixed(1)} MB, external ${(peak.external / MB).toFixed(1)} MB, arrayBuffers ${(peak.arrayBuffers / MB).toFixed(1)} MB, rss ${(peak.rss / MB).toFixed(1)} MB`
+  ).join("\n") + `
 `;
   const curve = route.samples.map((sample) => (sample / MB).toFixed(1)).join(" \u2192 ");
   const deltas = route.trend.deltas.map((delta) => `+${(delta / MB).toFixed(2)}`).join(", ");
@@ -60,7 +79,7 @@ OS: ${environment.platform} ${environment.arch}${environment.cpuModel ? ` (${env
 Memory: ${(environment.totalMemoryBytes / (1024 * MB)).toFixed(0)} GB
 Next.js: ${environment.nextVersion ?? "unknown"}
 next-leak: ${environment.nextLeakVersion}
-Deployment: output "standalone", node --expose-gc --max-old-space-size=512
+Deployment: output "standalone", node --expose-gc --max-old-space-size=${parameters.maxOldSpaceMb}
 \`\`\`
 
 ### To Reproduce
@@ -72,6 +91,8 @@ Deployment: output "standalone", node --expose-gc --max-old-space-size=512
 2. next-leak boots \`.next/standalone/server.js\` in a fresh process per route and runs, against \`${route.requestPath}\`:
    warm-up ${parameters.warmupRequests} requests \u2192 forced GC \u2192 baseline heap snapshot \u2192
    ${parameters.cycles} \xD7 [${parameters.loadRequests} requests at ${parameters.connections} connections \u2192 ${(parameters.idleMs / 1e3).toFixed(0)}s idle \u2192 forced GC \u2192 post-GC sample] \u2192 final snapshot.
+3. A cycle counts as growing when it retains at least ${(parameters.minGrowthPerCycle / 1024).toFixed(0)} KiB
+   (the gate for this run's ${parameters.loadRequests} requests per cycle); the warm-up cycle is excluded.
 
 ### Current vs. Expected behavior
 
@@ -87,7 +108,7 @@ ${evidenceRows(route) || "- (no findings above thresholds)"}
 ${signatures === "" ? "" : `
 **Matched known causes:**
 ${signatures}
-`}${caveats}
+`}${peakSection}${caveats}
 ### Verify it yourself
 
 Raw snapshots (Chrome DevTools \u2192 Memory \u2192 Load, compare baseline vs after):

package/dist/chunk-XHPUAMJG.js

@@ -0,0 +1,46 @@
+import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
+
+// src/peak-pressure.ts
+var MB = 1024 * 1024;
+var HEAP_LIMIT_SHARE = 0.75;
+var RSS_OVER_RETAINED = 8;
+var RSS_FLOOR_BYTES = 512 * MB;
+var maxOf = (peaks, read) => peaks.reduce((highest, peak) => Math.max(highest, read(peak)), 0);
+function assessPeakPressure(input) {
+  const sampled = input.peaks.filter((peak) => peak.polls > 0);
+  if (sampled.length === 0) {
+    return null;
+  }
+  const heapLimitBytes = input.maxOldSpaceMb * MB;
+  const peakHeap = maxOf(sampled, (peak) => peak.heapUsed);
+  const peakRss = maxOf(sampled, (peak) => peak.rss);
+  if (peakHeap >= heapLimitBytes * HEAP_LIMIT_SHARE) {
+    return {
+      class: "heap",
+      peakBytes: peakHeap,
+      retainedBytes: input.retainedHeapBytes,
+      heapLimitBytes
+    };
+  }
+  if (peakRss >= RSS_FLOOR_BYTES && peakRss >= input.retainedHeapBytes * RSS_OVER_RETAINED) {
+    return {
+      class: "rss",
+      peakBytes: peakRss,
+      retainedBytes: input.retainedHeapBytes,
+      heapLimitBytes
+    };
+  }
+  return null;
+}
+var mb = (bytes) => `${(bytes / MB).toFixed(1)} MB`;
+function describePeakPressure(pressure) {
+  if (pressure.class === "heap") {
+    return `peaked at ${mb(pressure.peakBytes)} heap under load against a ${mb(pressure.heapLimitBytes)} limit (retains ${mb(pressure.retainedBytes)}) \u2014 the run came close to the heap ceiling even though nothing was retained; peaks are the highest value sampled, not a guaranteed maximum`;
+  }
+  return `peaked at ${mb(pressure.peakBytes)} rss under load while retaining ${mb(pressure.retainedBytes)} \u2014 a container sized on what it retains dies on what it reaches; peaks are the highest value sampled, not a guaranteed maximum`;
+}
+
+export {
+  assessPeakPressure,
+  describePeakPressure
+};

package/dist/cli-args.d.ts

@@ -5,6 +5,7 @@ export type CliRunOptions = {
     requests: number | null;
     connections: number | null;
     idleSeconds: number | null;
+    maxOldSpaceMb: number | null;
     quick: boolean;
     diffAll: boolean;
     output: string | null;

package/dist/cli.js

@@ -9,8 +9,9 @@ import {
   killActiveChildren,
   parseCliArgs,
   runMeasurement
-} from "./chunk-ZFYIR423.js";
-import "./chunk-2BQZCZ4Z.js";
+} from "./chunk-2BQ5KXIJ.js";
+import "./chunk-E5ZKAANQ.js";
+import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 
 // src/cli.ts
@@ -97,6 +98,7 @@ async function main() {
     ...options.requests !== null && { loadRequests: options.requests },
     ...options.connections !== null && { connections: options.connections },
     ...options.idleSeconds !== null && { idleMs: options.idleSeconds * 1e3 },
+    ...options.maxOldSpaceMb !== null && { maxOldSpaceMb: options.maxOldSpaceMb },
     ...options.diffAll && { diffAll: true },
     ...options.output !== null && { outputDir: options.output },
     onProgress: (message) => console.error(`\xB7 ${message}`)

package/dist/confidence.d.ts

@@ -1,5 +1,6 @@
+import type { HeapSample } from "./control-server.js";
 import type { LoadOutcome, SettleOutcome } from "./ritual.js";
-import type { TrendResult, TrendVerdict } from "./trend.js";
+import { type TrendResult, type TrendVerdict } from "./trend.js";
 /**
  * Why a measurement may not support its own verdict.
  *
@@ -11,8 +12,10 @@ import type { TrendResult, TrendVerdict } from "./trend.js";
  *   mid-stream teardown path was never reached
  * `spiky-growth`        — one cycle dominates, so the mean describes little
  * `near-threshold`      — growth barely clears the noise floor
+ * `near-heap-ceiling`   — the heap approached the cap the process ran under,
+ *   so the curve was measured against a ceiling instead of running free
  */
-export type WarningCode = "unsettled" | "settle-unverified" | "load-incomplete" | "abandon-ineffective" | "abandon-before-response" | "spiky-growth" | "near-threshold";
+export type WarningCode = "unsettled" | "settle-unverified" | "load-incomplete" | "abandon-ineffective" | "abandon-before-response" | "spiky-growth" | "near-threshold" | "near-heap-ceiling";
 export type MeasurementWarning = {
     code: WarningCode;
     detail: string;
@@ -36,6 +39,10 @@ export type ConfidenceInput = {
     abandonAfterMs?: number;
     /** Threshold the verdict used, for the noise-floor check. */
     minGrowthPerCycle?: number;
+    /** Post-GC samples, for the heap-ceiling check. */
+    memorySamples?: readonly HeapSample[];
+    /** Old-space cap the measured process ran under (MB). */
+    maxOldSpaceMb?: number;
 };
 /**
  * The verdict a route's evidence actually supports.

package/dist/control-client.d.ts

@@ -1,6 +1,11 @@
 import type { HeapSample } from "./control-server.js";
 /** Forces GC in the measured process and returns a settled memory sample. */
 export declare function requestGc(port: number): Promise<HeapSample>;
+/**
+ * Reads memory without collecting. Used to poll a process under load, where a
+ * forced GC would change the number being read.
+ */
+export declare function requestMemory(port: number): Promise<HeapSample>;
 /** Forces GC, writes a named heap snapshot, and returns its path and sample. */
 export declare function requestSnapshot(port: number, name: string): Promise<{
     file: string;

package/dist/control-server.d.ts

@@ -26,6 +26,7 @@ export type ControlServer = {
  * Internal control channel booted inside the measured app's process.
  *
  * - `GET /gc` — force GC, respond with a memory sample.
+ * - `GET /mem` — respond with a memory sample WITHOUT collecting.
  * - `GET /snapshot?name=<label>` — force GC, write `<label>.heapsnapshot`
  *   into `snapshotDir`, respond `{ file, sample }` only once fully written.
  */

package/dist/{html-report-26DU7JFW.js → html-report-KQGUDYK5.js}

@@ -1,8 +1,9 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   renderHtmlReport
-} from "./chunk-C3KH5Z2W.js";
-import "./chunk-2BQZCZ4Z.js";
+} from "./chunk-BUNQT6VK.js";
+import "./chunk-E5ZKAANQ.js";
+import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 export {
   renderHtmlReport

package/dist/index.js

@@ -13,7 +13,6 @@ import {
   captureEnvironment,
   checkRuntime,
   classifySource,
-  classifyTrend,
   decodeMappings,
   decodeVlqLine,
   diffAgainstBaseline,
@@ -40,14 +39,17 @@ import {
   sourceIndexAt,
   summarizeBaseline,
   validateTarget
-} from "./chunk-ZFYIR423.js";
+} from "./chunk-2BQ5KXIJ.js";
 import {
   renderHtmlReport
-} from "./chunk-C3KH5Z2W.js";
-import "./chunk-2BQZCZ4Z.js";
+} from "./chunk-BUNQT6VK.js";
+import {
+  classifyTrend
+} from "./chunk-E5ZKAANQ.js";
 import {
   renderIssueMarkdown
-} from "./chunk-5ZYZW2BL.js";
+} from "./chunk-WXAFXVWS.js";
+import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 export {
   LaunchError,

package/dist/{issue-report-FUTEOHN5.js → issue-report-HKA26WNV.js}

@@ -1,7 +1,8 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   renderIssueMarkdown
-} from "./chunk-5ZYZW2BL.js";
+} from "./chunk-WXAFXVWS.js";
+import "./chunk-XHPUAMJG.js";
 import "./chunk-6XYFBOL2.js";
 export {
   renderIssueMarkdown

package/dist/launcher.d.ts

@@ -1,3 +1,12 @@
+/**
+ * Old-space cap for measured processes, when the caller does not pick one.
+ *
+ * Small on purpose: a leak that would take a production container an hour to
+ * kill reaches a 512 MB ceiling in minutes. It is a default, not a constant —
+ * an app whose legitimate working set is larger cannot be measured under it,
+ * so `--max-old-space` exists and the chosen value is recorded in `run.json`.
+ */
+export declare const DEFAULT_MAX_OLD_SPACE_MB = 512;
 export type LaunchOptions = {
     /** Absolute path to the standalone `server.js` (or any PORT/HOSTNAME-honoring server). */
     serverPath: string;
@@ -16,6 +25,13 @@ export type LaunchedApp = {
     pid: number;
     appPort: number;
     controlPort: number;
+    /**
+     * Why the measured process is gone, or null while it is alive. Without it
+     * a child that died mid-run surfaces as "fetch failed", which reads like a
+     * bug in the tool and hides the finding — most often that the app blew
+     * through the heap limit the run configured.
+     */
+    explainExit: () => string | null;
     /** SIGTERM, then SIGKILL after a grace period. Resolves when the child exited. */
     close: () => Promise<void>;
 };
@@ -31,6 +47,13 @@ export declare function killActiveChildren(): void;
  * the messenger, and should say so instead of printing 20 lines of trace.
  */
 export declare function explainStartupFailure(stderr: string): string;
+/**
+ * Same idea as `explainStartupFailure`, for a process that died *during* a
+ * run. Heap exhaustion is the one death this tool can name outright, and it
+ * is a finding rather than an accident: the app did not fit in the limit the
+ * run gave it.
+ */
+export declare function explainRuntimeFailure(stderr: string, maxOldSpaceMb: number): string;
 /**
  * Spawns the measured server in a fresh child process with GC exposed and the
  * control-channel bootstrap preloaded, and waits until both the app port and

package/dist/peak-pressure.d.ts

@@ -0,0 +1,42 @@
+import type { PeakSample } from "./ritual.js";
+/**
+ * Which ceiling the process came closest to.
+ *
+ * `heap` is the only class bounded by `--max-old-space`; `rss` is what a
+ * container kills. `external`/`arrayBuffers` live in rss, which is why they
+ * are reported through it instead of against a limit that does not apply to
+ * them (vercel/next.js#92287: a healthy heap next to 4.3 GB of arrayBuffers).
+ */
+export type PeakPressureClass = "heap" | "rss";
+export type PeakPressure = {
+    class: PeakPressureClass;
+    /** Highest value observed for that class, across cycles (bytes). */
+    peakBytes: number;
+    /** Retained heap the verdict was computed on (bytes). */
+    retainedBytes: number;
+    /** Heap limit in force, in bytes. */
+    heapLimitBytes: number;
+};
+export type PeakPressureInput = {
+    peaks: readonly PeakSample[];
+    /** Post-GC heapUsed of the final sample: what the route actually retains. */
+    retainedHeapBytes: number;
+    maxOldSpaceMb: number;
+};
+/**
+ * Whether a route's peak is far enough from the memory its verdict was
+ * computed on to be worth saying out loud.
+ *
+ * Deliberately outside the verdict: `leak`/`stable`/`inconclusive` are
+ * statements about retention after GC, calibrated against real leaks with no
+ * false positives, and a peak is a different axis. A process that climbs to
+ * 3.5 GB and hands it all back is honestly `stable` — and still OOM-killed in
+ * a 1 GB container.
+ */
+export declare function assessPeakPressure(input: PeakPressureInput): PeakPressure | null;
+/**
+ * One line, phrased so it never contradicts the verdict next to it. A peak is
+ * the highest value *sampled*: a spike shorter than the poll interval is not
+ * observed, so this is a lower bound.
+ */
+export declare function describePeakPressure(pressure: PeakPressure): string;

package/dist/ritual.d.ts

@@ -17,6 +17,8 @@ export type RitualOptions = {
     connections?: number;
     cycles?: number;
     idleMs?: number;
+    /** Old-space cap for the measured process (MB). Default: 512. */
+    maxOldSpaceMb?: number;
     /** Headers sent with every request during warm-up and load. */
     headers?: Record<string, string>;
     /** Emulate clients that disconnect before the response arrives. */
@@ -52,6 +54,24 @@ export type SettleOutcome = {
     /** GC polls taken before converging or giving up. */
     polls: number;
 };
+/**
+ * Highest memory observed *during* a load cycle, per class.
+ *
+ * Every other number in a run is taken after idle and a forced GC, which is
+ * what a verdict about retention needs. It is also blind to the process that
+ * climbs to 3.5 GB under load and hands it all back: `stable`, and dead in a
+ * 1 GB container. A peak is a lower bound — a spike shorter than the poll
+ * interval is never seen.
+ */
+export type PeakSample = {
+    phase: string;
+    heapUsed: number;
+    external: number;
+    arrayBuffers: number;
+    rss: number;
+    /** Readings taken; 0 means the poller never got one. */
+    polls: number;
+};
 export type RitualResult = {
     route: string;
     /** Wall-clock per phase, so slow runs can be explained instead of guessed. */
@@ -64,24 +84,46 @@ export type RitualResult = {
     samples: number[];
     /** Full memory samples in the same order. */
     memorySamples: HeapSample[];
+    /** Highest memory seen during each load cycle, sampled without collecting. */
+    peaks: PeakSample[];
     baselineSnapshot: string;
     afterSnapshot: string;
     trend: TrendResult;
     requestsPerCycle: number;
+    /**
+     * The gate (bytes per cycle) this verdict was judged against. Travels with
+     * the result so the confidence audit grades against the same number the
+     * verdict used, and so the report can print what it measured against.
+     */
+    minGrowthPerCycle: number;
 };
 /** Injectable seams for unit tests; production uses the real implementations. */
 export type RitualDeps = {
     launch: typeof launchInstrumented;
     load: typeof runLoadPhase;
     sleep: (ms: number) => Promise<void>;
+    /** GC-free read, polled while the app is under load. */
+    readMemory: (port: number) => Promise<HeapSample>;
 };
-/** Single source of truth for ritual defaults — reports must echo them. */
+/**
+ * Single source of truth for ritual defaults — reports must echo them.
+ *
+ * `cycles` is 4 rather than the minimum 3 because of how much the verdict
+ * actually sees: the sample array is `[baseline, ...cycles]` and
+ * `classifyTrend` drops the warm-up delta, leaving `cycles - 1` numbers. At 3
+ * cycles that is **two** deltas, and `anyFlatOrDown` needs only one of the two
+ * to be non-positive to call a route stable — one noisy cycle flips the
+ * verdict. Four cycles give three deltas, which is what the real-app
+ * validation ran with. The 3-cycle minimum stays available for users who want
+ * a faster, weaker read.
+ */
 export declare const RITUAL_DEFAULTS: {
     readonly warmupRequests: 200;
     readonly loadRequests: 5000;
     readonly connections: 100;
-    readonly cycles: 3;
+    readonly cycles: 4;
     readonly idleMs: 30000;
+    readonly maxOldSpaceMb: 512;
 };
 /**
  * Runs the validated phase-0 ritual against one route in a fresh process:

package/dist/runner.d.ts

@@ -4,9 +4,9 @@ import type { HeapSample } from "./control-server.js";
 import { type MeasurementEnvironment } from "./environment.js";
 import { diffSnapshotFiles, type HeapDiff } from "./heap-diff.js";
 import { extractModuleRegistry } from "./module-registry.js";
-import { runRitual, type LoadOutcome, type PhaseTiming, type SettleOutcome } from "./ritual.js";
+import { runRitual, type LoadOutcome, type PeakSample, type PhaseTiming, type SettleOutcome } from "./ritual.js";
 import { readNextVersion, type MatchedSignature } from "./signatures.js";
-import type { TrendResult } from "./trend.js";
+import { type TrendResult } from "./trend.js";
 export type RouteReport = {
     route: string;
     status: "skipped";
@@ -28,6 +28,11 @@ export type RouteReport = {
      * different fix than a heap leak.
      */
     memorySamples: HeapSample[];
+    /**
+     * Highest memory reached *during* each load cycle. Every other number
+     * here is post-GC; this is the one a container limit is judged against.
+     */
+    peaks: PeakSample[];
     /** RSS growth per 1000 requests, computed like the heap figure. */
     rssPer1000Requests: number;
     /** Wall-clock per phase — explains where a long run spent its time. */
@@ -61,6 +66,18 @@ export type RunParameters = {
     connections: number;
     cycles: number;
     idleMs: number;
+    /**
+     * Old-space cap of each measured process (MB). Part of the measurement
+     * regime: a run near its ceiling is not the same experiment as one with
+     * headroom, so it belongs on the record.
+     */
+    maxOldSpaceMb: number;
+    /**
+     * Per-cycle growth gate the verdicts were judged against (bytes). Derived
+     * from `loadRequests`; recorded because a verdict whose threshold is not
+     * printed cannot be audited or reproduced.
+     */
+    minGrowthPerCycle: number;
 };
 export type RunReport = {
     appDir: string;
@@ -88,6 +105,8 @@ export type RunOptions = {
     connections?: number;
     cycles?: number;
     idleMs?: number;
+    /** Old-space cap for each measured process (MB). Default 512. */
+    maxOldSpaceMb?: number;
     /** Also diff routes with a stable verdict. Default false: diffs are slow. */
     diffAll?: boolean;
     /** Only measure routes matching these templates or prefixes. */

package/dist/trend.d.ts

@@ -16,9 +16,44 @@ export type TrendResult = {
     source?: "heap" | "external";
 };
 export type TrendOptions = {
-    /** Minimum per-cycle growth (bytes) considered leak-like. Default: 256 KiB. */
+    /**
+     * Minimum per-cycle growth (bytes) considered leak-like. Defaults to the
+     * noise floor alone — callers that know how much traffic ran should pass
+     * `minGrowthFor(requestsPerCycle)` instead.
+     */
     minGrowthPerCycle?: number;
 };
+/**
+ * Smallest per-cycle growth distinguishable from measurement noise.
+ *
+ * This is a property of the *instrument*, not of the leak: post-GC samples
+ * jitter by roughly this much regardless of how much traffic ran, so no amount
+ * of load makes growth below it meaningful.
+ */
+export declare const MIN_GROWTH_NOISE_FLOOR: number;
+/**
+ * Growth rate that counts as leak-like, per 1000 requests.
+ *
+ * This is a property of the *leak*: a route that retains memory per request
+ * grows in proportion to the traffic it served, so the gate has to scale with
+ * it. 51.2 KiB is the rate that leaves the default profile (5000 requests per
+ * cycle) on exactly the 256 KiB gate this tool was validated against.
+ */
+export declare const MIN_GROWTH_PER_1000_REQUESTS: number;
+/**
+ * The gate a per-cycle delta must clear to count as growth.
+ *
+ * `max` rather than a sum, because the two terms bound different things: the
+ * floor is what the instrument can resolve, the rate is what the leak should
+ * produce. Below ~5000 requests per cycle the floor dominates and the run is
+ * noise-limited — which is a real limit of measuring less traffic, not a
+ * threshold that can be lowered.
+ *
+ * Without this, the verdict silently depended on `--requests`: the same route
+ * leaking 100 KiB per 1000 requests printed the same headline in every mode
+ * but came out `stable` at 2000 requests per cycle and `leak` at 5000.
+ */
+export declare function minGrowthFor(requestsPerCycle: number): number;
 /**
  * Classifies a series of post-GC retained-heap samples — baseline first, then
  * one sample per load cycle — as leaking or stable.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-leak",
-  "version": "0.1.3",
+  "version": "0.3.0",
   "description": "Find out whether your Next.js app actually leaks memory — how much, on which route, and whose fault it is.",
   "keywords": [
     "nextjs",
@@ -27,14 +27,15 @@
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "files": [
-    "dist"
+    "dist",
+    "THIRD-PARTY-NOTICES.md"
   ],
   "engines": {
     "node": ">=22"
   },
   "packageManager": "pnpm@10.20.0",
   "scripts": {
-    "build": "tsup && tsc -p tsconfig.build.json",
+    "build": "tsup && tsc -p tsconfig.build.json && node scripts/generate-notices.mjs && node scripts/check-bundle.mjs",
     "dev": "tsup --watch",
     "test": "vitest run",
     "test:watch": "vitest",