next-leak 0.12.2 → 0.13.1

package/README.md

@@ -193,7 +193,10 @@ entry, so the route reads as flat whatever it retains, and that false negative
 lands on exactly the leaks being reported now (`use cache`, `cacheComponents`
 and ISR all key on the params). If your app answers 404 for params it never
 prerendered, the run says so through its non-2xx count; drop the marker then.
-When a run skips a route it prints the same fragment.
+When the build prerendered nothing for a route, the value is `REPLACE-ME-{n}`:
+put the shape of a real value in place of `REPLACE-ME` and keep the `-{n}`, or
+the run measures a single cache entry. When a run skips a route it prints the
+same fragment.
 
 ```json
 ```
@@ -240,7 +243,7 @@ separates them, because each one has a different fix:
 | One-time warm-up growth (JIT, lazy caches) | `stable` | The first cycle is excluded from the verdict; warm-up flattens, leaks keep climbing |
 | A route that is expensive, not leaky | `failed` under load it cannot sustain, flat once concurrency fits | Real leaks survive forced GC at any concurrency; saturation disappears when load drops |
 | Growth that pauses and resumes (stepwise) | `leak` | A healthy route gives back 20-30% of its growth; a stepwise leak gives back nothing |
-| A cache filling up under the load that measures it | `saturating` | A bounded store grows by less each cycle as new keys get rarer; a leak does not decelerate |
+| A cache filling up under the load that measures it | `saturating` | A bounded store grows by less each cycle as new keys get rarer; a leak does not decelerate. A bend that lands on a steady rate above the gate is a leak under the fill, and stays `leak` |
 | Memory a forced GC reclaims that production never reclaims in time | `pressure` | Every verdict sample is post-GC; the peaks are sampled under load, and a ceiling every settled cycle comes back to is a regime, not an episode |
 | Native/buffer memory with a flat JS heap | `leak (external)` or an explicit RSS note | Heap, `external` and RSS are sampled and judged separately |
 | A leak in your code vs a dependency vs Next itself | `culprit: src/app/x/page.tsx (your code)` — or the package, or framework internals | Retainer chains mapped through the build's source maps |
@@ -271,7 +274,15 @@ separates them, because each one has a different fix:
   alternative was calling it a leak: a `use cache` route measured on Next
   16.3.3 came out at +603 MB per 1000 requests that was entirely the cache
   storing what it had been asked to store — the same route dropped to +88 MB
-  once the payload was removed. Because the shape requires every cycle to clear
+  once the payload was removed. The bend has to head for zero, though: a store
+  filling on top of a leak bends too, and then holds the leak's rate for as
+  long as the load runs. So when the last third of the window (at least three
+  cycles) sits at one steady rate at or above the gate, within 1.5x of itself,
+  the route stays `leak`. Measured on the reproduction for
+  [#99335](https://github.com/vercel/next.js/issues/99335), an ISR route
+  keeping every new path's cache control in an unbounded map: it closed on four
+  cycles of ~2.2 MB, twice the gate, and used to be called `saturating`, with
+  no issue draft. Because the shape requires every cycle to clear
   the growth gate, a decelerating curve always ends the window still growing,
   so where it settles is outside what was measured: these routes are
   **measured again** with twice the cycles, like `inconclusive` ones. No issue
@@ -388,7 +399,11 @@ A route with a revalidation period serves its cache unless the request carries
 the build's own `x-prerender-revalidate` header. Measured on that same app: the
 identical run reports `leak` with the header and `stable` without it. next-leak
 reads `previewModeId` from `.next/prerender-manifest.json` and drives those
-routes itself; a header you set in `next-leak.config.json` wins untouched. When
+routes itself; a header you set in `next-leak.config.json` wins untouched. A
+dynamic template with nothing prerendered (`generateStaticParams()` returning
+`[]`) counts too: the build records no period for it, but its blocking fallback
+caches every new param on first request, so `{n}` fills that cache while it is
+measured and the report says so. When
 the manifest cannot supply one, the route is reported `not exercised` with no
 verdict, because a flat curve measured against a static cache says nothing about
 the app.

package/dist/bootstrap.js

@@ -1,100 +1,15 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
+import {
+  requestProbe,
+  startControlServer
+} from "./chunk-IKWF7SSB.js";
 import "./chunk-6XYFBOL2.js";
 
 // src/bootstrap.ts
 import { mkdir, writeFile } from "fs/promises";
-import http2 from "http";
-import https from "https";
-import path2 from "path";
-
-// src/control-server.ts
 import http from "http";
+import https from "https";
 import path from "path";
-import { writeHeapSnapshot } from "v8";
-var g = globalThis;
-var tick = () => new Promise((resolve) => setImmediate(resolve));
-async function forceGc(passes = 3) {
-  if (typeof g.gc !== "function") {
-    return false;
-  }
-  for (let i = 0; i < passes; i += 1) {
-    g.gc();
-    await tick();
-  }
-  return true;
-}
-var requestProbe = globalThis;
-function sampleMemory(gcExposed) {
-  const usage = process.memoryUsage();
-  return {
-    gcExposed,
-    heapUsed: usage.heapUsed,
-    rss: usage.rss,
-    external: usage.external,
-    arrayBuffers: usage.arrayBuffers,
-    pid: process.pid,
-    ppid: process.ppid,
-    argv: process.argv,
-    cwd: process.cwd(),
-    ...requestProbe.__nextLeakServedRequests === void 0 ? {} : { servedRequests: requestProbe.__nextLeakServedRequests }
-  };
-}
-async function startControlServer(options) {
-  const write = options.writeSnapshot ?? writeHeapSnapshot;
-  const server = http.createServer((request, response) => {
-    void handle(request, response);
-  });
-  async function handle(request, response) {
-    const url = new URL(request.url ?? "/", "http://control.local");
-    const respond = (status, body) => {
-      response.writeHead(status, { "content-type": "application/json" });
-      response.end(JSON.stringify(body));
-    };
-    try {
-      if (url.pathname === "/gc") {
-        const gcExposed = await forceGc();
-        respond(200, sampleMemory(gcExposed));
-        return;
-      }
-      if (url.pathname === "/mem") {
-        respond(200, sampleMemory(typeof g.gc === "function"));
-        return;
-      }
-      if (url.pathname === "/snapshot") {
-        const name = url.searchParams.get("name");
-        if (name === null || name === "") {
-          respond(400, { error: "missing ?name=<label>" });
-          return;
-        }
-        const gcExposed = await forceGc();
-        const sample = sampleMemory(gcExposed);
-        const file = write(
-          path.join(options.snapshotDir, `${path.basename(name)}.heapsnapshot`)
-        );
-        respond(200, { file, sample });
-        return;
-      }
-      respond(404, { error: `unknown path ${url.pathname}` });
-    } catch (cause) {
-      respond(500, { error: cause instanceof Error ? cause.message : String(cause) });
-    }
-  }
-  await new Promise((resolve, reject) => {
-    server.once("error", reject);
-    server.listen(0, "127.0.0.1", resolve);
-  });
-  server.unref();
-  const address = server.address();
-  if (address === null || typeof address === "string") {
-    throw new Error("control server has no bound port");
-  }
-  return {
-    port: address.port,
-    close: () => new Promise((resolve, reject) => {
-      server.close((error) => error ? reject(error) : resolve());
-    })
-  };
-}
 
 // src/request-probe.ts
 function countServedRequests(module) {
@@ -110,18 +25,22 @@ function countServedRequests(module) {
 
 // src/bootstrap.ts
 var workDir = process.env["NEXT_LEAK_DIR"];
+var token = process.env["NEXT_LEAK_TOKEN"];
 function installRequestProbe() {
   requestProbe.__nextLeakServedRequests = 0;
-  countServedRequests(http2);
+  countServedRequests(http);
   countServedRequests(https);
 }
 if (workDir !== void 0 && workDir !== "") {
   try {
     await mkdir(workDir, { recursive: true });
-    const server = await startControlServer({ snapshotDir: workDir });
+    if (token === void 0 || token === "") {
+      throw new Error("NEXT_LEAK_TOKEN is not set, and the channel does not start without it");
+    }
+    const server = await startControlServer({ snapshotDir: workDir, token });
     installRequestProbe();
     await writeFile(
-      path2.join(workDir, `control-${process.pid}.json`),
+      path.join(workDir, `control-${process.pid}.json`),
       JSON.stringify({ port: server.port, pid: process.pid })
     );
   } catch (cause) {

package/dist/build-report.d.ts

@@ -1,12 +1,8 @@
 import { type BuildAttribution, type BuildAttributionGap } from "./build-attribution.js";
 import type { BuildRunResult } from "./build-run.js";
 /**
- * Renders the build report.
- *
- * Says "worker rss" everywhere rather than "heap" or "retained": these samples
- * are resident memory with no forced collection behind them, and calling them
- * retention would borrow a precision the measurement does not have. RSS is
- * still the honest axis here — it is what a CI runner's limit is enforced
- * against and what the OOM killer reads.
+ * The report as it is written to the terminal. The build's output and the
+ * names in the attribution come from the measured app, so the text goes
+ * through `terminalSafe` whichever branch produced it.
  */
 export declare function formatBuildReport(result: BuildRunResult, attribution?: BuildAttribution | BuildAttributionGap | null): string;

package/dist/{chunk-ULTMNWRX.js → chunk-FJVY5MKV.js}

@@ -3,7 +3,7 @@ import {
   assessPeakPressure,
   describePeakPressure,
   retainedAfterLoad
-} from "./chunk-E464SO7G.js";
+} from "./chunk-VTKOO3YJ.js";
 
 // src/issue-report.ts
 import path from "path";
@@ -24,22 +24,26 @@ function ownerLabel(attribution) {
     return "unattributed";
   }
   const source = attribution.source ? ` \u2014 ${codeSpan(attribution.source)}` : "";
-  const packageName = attribution.packageName ? ` \u2014 ${attribution.packageName}` : "";
+  const packageName = attribution.packageName ? ` \u2014 ${codeSpan(attribution.packageName)}` : "";
   return `${attribution.owner}${source}${packageName}`;
 }
+function publicDetail(detail, run) {
+  return detail.replaceAll(run.workDir, publicWorkDir(run)).replaceAll(run.appDir, "<app-dir>").replaceAll(/[\r\n]+/g, " ");
+}
 function blamedParty(owner, culprit) {
   if (owner === "app") {
     return `**your own code** (${codeSpan(culprit?.source ?? "app code")})`;
   }
-  return `the dependency **${culprit?.packageName ?? "a dependency"}**`;
+  const packageName = culprit?.packageName;
+  return `the dependency **${packageName ? codeSpan(packageName) : "a dependency"}**`;
 }
-function missingEvidence(route) {
+function missingEvidence(route, run) {
   if (route.attributionGap === void 0) {
     return "- (no findings above thresholds)";
   }
   const cause = route.attributionGap.reason === "snapshot-unavailable" ? "the final heap snapshot was never taken" : "the heap snapshots could not be read";
   return `- **Attribution unavailable** \u2014 ${cause}, so this run cannot name what retains the memory. This is not a finding that nothing grew: the diff was never computed. The growth figure above is unaffected.
-  - ${route.attributionGap.detail}`;
+  - ${publicDetail(route.attributionGap.detail, run)}`;
 }
 function evidenceRows(route) {
   const findings = [...route.diff?.grownNodes ?? [], ...route.diff?.newNodes ?? []];
@@ -128,7 +132,7 @@ The first cycle is excluded from the verdict (engine warm-up).
 
 ### Heap evidence
 
-${evidenceRows(route) || missingEvidence(route)}
+${evidenceRows(route) || missingEvidence(route, run)}
 ${signatures === "" ? "" : `
 **Matched known causes:**
 ${signatures}

package/dist/{chunk-HDCOHSBY.js → chunk-GBRBWUZZ.js}

@@ -1,4 +1,7 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
+import {
+  CONTROL_TOKEN_HEADER
+} from "./chunk-IKWF7SSB.js";
 import {
   assessConfidence,
   classifyMemoryTrend,
@@ -8,13 +11,13 @@ import {
   resolveCycles,
   warrantsIssueDraft,
   withdrawnByDisagreement
-} from "./chunk-QUFL2FXU.js";
+} from "./chunk-GU7IJUNY.js";
 import {
   assessPeakPressure,
   assessPressureVerdict,
   describePeakPressure,
   retainedAfterLoad
-} from "./chunk-E464SO7G.js";
+} from "./chunk-VTKOO3YJ.js";
 import {
   __commonJS,
   __esm,
@@ -93199,6 +93202,16 @@ async function extractModuleRegistry(nextServerDir) {
   return registry;
 }
 
+// src/terminal-text.ts
+import { stripVTControlCharacters } from "util";
+var CONTROL_CHARACTER = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f]/g;
+function terminalSafe(text) {
+  return stripVTControlCharacters(text.replaceAll("\r\n", "\n")).replaceAll(
+    CONTROL_CHARACTER,
+    (character) => `\\x${character.charCodeAt(0).toString(16).padStart(2, "0")}`
+  );
+}
+
 // src/manifests.ts
 import { z as z2 } from "zod";
 var appPathsManifestSchema = z2.record(z2.string(), z2.string());
@@ -93222,6 +93235,10 @@ var prerenderManifestSchema = z2.looseObject({
       srcRoute: z2.string().nullable().optional()
     })
   ).optional(),
+  // Read only for `fallback`, and left untyped: its shape has changed across
+  // Next versions (`null`, `false`, an HTML path, a PPR shell), and a template
+  // the tool cannot classify must not fail the whole manifest.
+  dynamicRoutes: z2.record(z2.string(), z2.looseObject({ fallback: z2.unknown().optional() })).optional(),
   preview: z2.looseObject({ previewModeId: z2.string() }).optional()
 });
 var INTERNAL_PATHS = /* @__PURE__ */ new Set(["/_global-error", "/_not-found"]);
@@ -93392,6 +93409,7 @@ This only changes how the build is packaged \u2014 not how your app behaves.`
 
 // src/launcher.ts
 import { spawn } from "child_process";
+import { randomBytes } from "crypto";
 import { readdir as readdir2, readFile as readFile3 } from "fs/promises";
 import path3 from "path";
 import { pathToFileURL } from "url";
@@ -93489,6 +93507,7 @@ async function pollUntil(deadline, describe, probe, failed) {
 async function launchInstrumented(options) {
   const hostname = options.hostname ?? "127.0.0.1";
   const readyTimeoutMs = options.readyTimeoutMs ?? DEFAULT_READY_TIMEOUT_MS;
+  const controlToken = randomBytes(32).toString("hex");
   const child = spawn(
     process.execPath,
     [
@@ -93506,7 +93525,8 @@ async function launchInstrumented(options) {
         NODE_ENV: "production",
         PORT: String(options.appPort),
         HOSTNAME: hostname,
-        NEXT_LEAK_DIR: options.workDir
+        NEXT_LEAK_DIR: options.workDir,
+        NEXT_LEAK_TOKEN: controlToken
       },
       stdio: ["ignore", "ignore", "pipe"]
     }
@@ -93550,7 +93570,9 @@ ${stderrTailBuffer}`;
             const parsed = controlFileSchema.parse(
               JSON.parse(await readFile3(path3.join(options.workDir, entry), "utf8"))
             );
-            const response = await fetch(`http://127.0.0.1:${parsed.port}/gc`);
+            const response = await fetch(`http://127.0.0.1:${parsed.port}/gc`, {
+              headers: { [CONTROL_TOKEN_HEADER]: controlToken }
+            });
             if (response.ok) {
               return parsed.port;
             }
@@ -93584,6 +93606,7 @@ ${stderrTailBuffer}`;
       pid: child.pid ?? -1,
       appPort: options.appPort,
       controlPort,
+      controlToken,
       explainExit: () => {
         if (!exited) {
           return null;
@@ -93922,6 +93945,12 @@ function parseCliArgs(argv) {
       }
     };
   }
+  if (options.attributeBuild) {
+    return {
+      kind: "error",
+      message: `option "--attribute" applies only to "next-leak build": a run already names what it retains \u2014 see --help`
+    };
+  }
   return { kind: "run", options };
 }
 
@@ -94251,7 +94280,7 @@ function describeProgress(bytes) {
 function describeDuration(ms) {
   return ms >= 36e5 ? `${Math.round(ms / 36e5)}h` : `${Math.round(ms / 1e3)}s`;
 }
-function get(port, pathname, deadlineMs, watch) {
+function get({ port, token }, pathname, deadlineMs, watch) {
   return new Promise((resolve, reject) => {
     let settled = false;
     const settle = (outcome) => {
@@ -94266,7 +94295,8 @@ function get(port, pathname, deadlineMs, watch) {
         reject(outcome.error);
       }
     };
-    const request2 = http.get({ host: "127.0.0.1", port, path: pathname }, (response) => {
+    const headers = { [CONTROL_TOKEN_HEADER]: token };
+    const request2 = http.get({ host: "127.0.0.1", port, path: pathname, headers }, (response) => {
       const chunks = [];
       response.on("data", (chunk) => chunks.push(chunk));
       response.once(
@@ -94336,8 +94366,8 @@ function get(port, pathname, deadlineMs, watch) {
     );
   });
 }
-async function request(port, pathname, deadlineMs = deadlineFor(pathname), watch) {
-  const response = await get(port, pathname, deadlineMs, watch);
+async function request(control, pathname, deadlineMs = deadlineFor(pathname), watch) {
+  const response = await get(control, pathname, deadlineMs, watch);
   if (response.status !== 200) {
     throw new ControlError(`control channel ${pathname} responded ${response.status}`);
   }
@@ -94347,8 +94377,8 @@ async function request(port, pathname, deadlineMs = deadlineFor(pathname), watch
     throw new ControlError(`control channel ${pathname} answered with malformed JSON`);
   }
 }
-async function requestGc(port) {
-  const sample = sampleSchema.parse(await request(port, "/gc"));
+async function requestGc(control) {
+  const sample = sampleSchema.parse(await request(control, "/gc"));
   if (!sample.gcExposed) {
     throw new ControlError(
       "the measured process is running without --expose-gc; samples would be meaningless"
@@ -94356,14 +94386,14 @@ async function requestGc(port) {
   }
   return sample;
 }
-async function requestMemory(port) {
-  return sampleSchema.parse(await request(port, "/mem"));
+async function requestMemory(control) {
+  return sampleSchema.parse(await request(control, "/mem"));
 }
-async function requestSnapshot(port, name, workDir) {
+async function requestSnapshot(control, name, workDir) {
   const pathname = `/snapshot?name=${encodeURIComponent(name)}`;
   const parsed = snapshotResponseSchema.parse(
     await request(
-      port,
+      control,
       pathname,
       deadlineFor(pathname),
       workDir === void 0 ? void 0 : productionWatch(snapshotPathFor(workDir, name))
@@ -94488,7 +94518,7 @@ var UNRECLAIMED_SETTLE_MS = SETTLE_POLL_MS;
 function unreclaimedSettleFor(idleMs) {
   return Math.min(UNRECLAIMED_SETTLE_MS, Math.floor(idleMs / 4));
 }
-function pollPeak(controlPort, phase, deps) {
+function pollPeak(control, phase, deps) {
   const peak = {
     phase,
     heapUsed: 0,
@@ -94506,7 +94536,7 @@ function pollPeak(controlPort, phase, deps) {
       }
       let sample;
       try {
-        sample = await deps.readMemory(controlPort);
+        sample = await deps.readMemory(control);
       } catch {
         return;
       }
@@ -94525,7 +94555,7 @@ function pollPeak(controlPort, phase, deps) {
     }
   };
 }
-async function waitUntilSettled(controlPort, maxIdleMs, deps) {
+async function waitUntilSettled(control, maxIdleMs, deps) {
   const deadline = Date.now() + maxIdleMs;
   let previous = null;
   let polls = 0;
@@ -94533,7 +94563,7 @@ async function waitUntilSettled(controlPort, maxIdleMs, deps) {
     await deps.sleep(Math.min(SETTLE_POLL_MS, Math.max(deadline - Date.now(), 0)));
     let current;
     try {
-      current = (await requestGc(controlPort)).heapUsed;
+      current = (await requestGc(control)).heapUsed;
     } catch {
       return { status: "unknown", polls };
     }
@@ -94592,6 +94622,7 @@ async function runRitual(options, deps = defaultDeps) {
     }
     app = await deps.launch({ ...launchOptions, appPort: options.appPort + 1 });
   }
+  const control = { port: app.controlPort, token: app.controlToken };
   const timings = [];
   const loadOutcomes = [];
   const settleOutcomes = [];
@@ -94661,13 +94692,13 @@ async function runRitual(options, deps = defaultDeps) {
     );
     const baseline = await timed(
       "baseline snapshot",
-      () => requestSnapshot(app.controlPort, "baseline", options.workDir)
+      () => requestSnapshot(control, "baseline", options.workDir)
     );
     memorySamples.push(baseline.sample);
     baselineSnapshot = baseline.file;
     for (let cycle = 1; cycle <= cycles; cycle += 1) {
       await timed(`cycle ${cycle} load`, async () => {
-        const poller = pollPeak(app.controlPort, `cycle ${cycle}`, deps);
+        const poller = pollPeak(control, `cycle ${cycle}`, deps);
         try {
           await loadCycle(`cycle ${cycle}`, loadRequests);
         } finally {
@@ -94678,30 +94709,30 @@ async function runRitual(options, deps = defaultDeps) {
       await timed(`cycle ${cycle} unreclaimed read`, async () => {
         await deps.sleep(unreclaimedSettleMs);
         try {
-          unreclaimedSamples.push(await deps.readMemory(app.controlPort));
+          unreclaimedSamples.push(await deps.readMemory(control));
         } catch {
           unreclaimedLost = true;
         }
       });
       const settle = await timed(
         `cycle ${cycle} settle`,
-        () => waitUntilSettled(app.controlPort, idleMs - unreclaimedSettleMs, deps)
+        () => waitUntilSettled(control, idleMs - unreclaimedSettleMs, deps)
       );
       settleOutcomes.push({ phase: `cycle ${cycle}`, ...settle });
       if (cycle === cycles) {
         try {
           const after = await timed(
             "after snapshot",
-            () => requestSnapshot(app.controlPort, "after", options.workDir)
+            () => requestSnapshot(control, "after", options.workDir)
           );
           afterSnapshot = after.file;
           memorySamples.push(after.sample);
         } catch (cause) {
           snapshotFailure = cause instanceof Error ? cause.message : String(cause);
-          memorySamples.push(await requestGc(app.controlPort));
+          memorySamples.push(await requestGc(control));
         }
       } else {
-        memorySamples.push(await requestGc(app.controlPort));
+        memorySamples.push(await requestGc(control));
       }
       cyclesCompleted = cycle;
     }
@@ -94865,7 +94896,7 @@ function renderConfigSkeleton(routeTemplates, manifest = void 0) {
     const values = {};
     for (const segment of segments) {
       const prerendered = sampled?.[segment.name];
-      values[segment.name] = prerendered === void 0 ? PLACEHOLDER : varyingValueFrom(prerendered);
+      values[segment.name] = varyingValueFrom(prerendered ?? PLACEHOLDER);
     }
     routes[template] = values;
   }
@@ -94874,6 +94905,12 @@ function renderConfigSkeleton(routeTemplates, manifest = void 0) {
 function hasPlaceholders(skeleton) {
   return skeleton.includes(PLACEHOLDER);
 }
+function writtenConfigNote(skeleton) {
+  if (hasPlaceholders(skeleton)) {
+    return `replace each ${PLACEHOLDER} with the shape of a value that exists in your app, and keep the \`-{n}\` after it: a fixed value measures one cache entry and reads as flat whatever the route retains`;
+  }
+  return "`{n}` gives every request a different value: a prerendered one serves the warm cache and reads as flat whatever the route retains. Use `{n%200}` to revisit a fixed set of keys, and drop the marker only if the app 404s on params it never prerendered.";
+}
 
 // src/unreclaimed-retention.ts
 var MB = 1024 * 1024;
@@ -94971,10 +95008,10 @@ function ownerLabel(attribution) {
   }
 }
 function revalidationLines(route) {
-  if (route.revalidatedEverySeconds === void 0) {
+  if (route.servedFromIsrCache !== true) {
     return [];
   }
-  const every = `revalidates every ${route.revalidatedEverySeconds}s`;
+  const every = route.revalidatedEverySeconds === void 0 ? "caches each new key on its first request" : `revalidates every ${route.revalidatedEverySeconds}s`;
   return route.revalidationDriven === true ? [
     `      driven through ISR revalidation (${every}; without it the load would serve the cache) \u2014 this is Next's revalidation path, so a leak that only happens on the path your users take is not in this number`
   ] : [
@@ -95005,7 +95042,7 @@ function cacheLines(route) {
     lines.push(
       `      the load served keys this route had never cached, so some of this growth is cache residency; bound it with {n%N} in next-leak.config.json`
     );
-    if (route.revalidatedEverySeconds !== void 0) {
+    if (route.servedFromIsrCache === true) {
       lines.push(
         `      on this route {n%N} does not isolate that: a bounded key set is served from the ISR cache, so the run would drive revalidation and measure a different path. Compare the two runs rather than trusting either number alone`
       );
@@ -95146,7 +95183,7 @@ function skippedGuidanceLines(report) {
   if (skeleton === null) {
     return [];
   }
-  const editing = hasPlaceholders(skeleton) ? ` Replace each ${"REPLACE-ME"} with a value that exists in your app.` : ` The shapes come from paths your build already prerendered; \`{n}\` makes every request use a different one, because reusing a prerendered value serves the warm cache and reads as flat whatever the route retains. Use \`{n%200}\` instead to revisit a fixed set of 200 keys, and drop the marker only if the app 404s on params it never prerendered.`;
+  const editing = hasPlaceholders(skeleton) ? ` Replace each ${"REPLACE-ME"} with the shape of a value that exists in your app, and keep the \`-{n}\` after it: a fixed value measures one cache entry and reads as flat whatever the route retains.` : ` The shapes come from paths your build already prerendered; \`{n}\` makes every request use a different one, because reusing a prerendered value serves the warm cache and reads as flat whatever the route retains. Use \`{n%200}\` instead to revisit a fixed set of 200 keys, and drop the marker only if the app 404s on params it never prerendered.`;
   return [
     "",
     `${needConfig.length} route(s) need sample params. Write this to next-leak.config.json in the app directory:${editing}`,
@@ -95233,7 +95270,7 @@ function formatReport(report) {
       `  next-leak ${report.appDir} --routes ${routeList} --cycles ${moreCycles}`
     );
   }
-  return lines.join("\n");
+  return terminalSafe(lines.join("\n"));
 }
 
 // src/environment.ts
@@ -95374,8 +95411,11 @@ function revalidateSecondsFor(manifest, route) {
   }
   return null;
 }
+function cachesOnDemand(manifest, route) {
+  return manifest?.dynamicRoutes?.[route]?.fallback === null;
+}
 function revalidates(manifest, route) {
-  return revalidateSecondsFor(manifest, route) !== null;
+  return revalidateSecondsFor(manifest, route) !== null || cachesOnDemand(manifest, route);
 }
 function planRevalidation(manifest, route, userHeaders, requestPath) {
   const userSupplied = Object.keys(userHeaders ?? {}).some(
@@ -95392,9 +95432,11 @@ function planRevalidation(manifest, route, userHeaders, requestPath) {
   }
   const previewModeId = manifest?.preview?.previewModeId;
   if (previewModeId === void 0 || previewModeId === "") {
+    const seconds = revalidateSecondsFor(manifest, route);
+    const cached = seconds === null ? "is served from the ISR cache" : `revalidates every ${seconds}s`;
     return {
       kind: "cannot-drive",
-      reason: `revalidates every ${revalidateSecondsFor(manifest, route)}s, but the build's prerender-manifest.json carries no previewModeId \u2014 load would serve the cache and measure nothing. Set "${REVALIDATE_HEADER}" in next-leak.config.json to drive it.`
+      reason: `${cached}, but the build's prerender-manifest.json carries no previewModeId \u2014 load would serve the cache and measure nothing. Set "${REVALIDATE_HEADER}" in next-leak.config.json to drive it.`
     };
   }
   return { kind: "drive", headers: { [REVALIDATE_HEADER]: previewModeId } };
@@ -95512,6 +95554,7 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
   const { deps, options, target, workDir, routeConfig, registry, nextVersion, progress } = context;
   const plan = planRevalidation(target.prerender, route.path, routeConfig.headers, requestPath);
   const revalidateSeconds = revalidateSecondsFor(target.prerender, route.path);
+  const servedFromIsrCache = revalidates(target.prerender, route.path);
   const bounded = boundedMarkerOf(requestPath);
   const driven = plan.kind === "drive" ? plan.headers : {};
   const cacheDriven = plan.kind === "no-cache-to-drive" || plan.kind === "drive" && bounded === null;
@@ -95554,7 +95597,7 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
     warmupRequests: options.warmupRequests ?? RITUAL_DEFAULTS.warmupRequests,
     // Decides whether the cache-residency remedy exists on this route: bounding
     // the keys of an ISR route hands the requests back to the cache.
-    revalidatesFromCache: revalidateSeconds !== null,
+    revalidatesFromCache: servedFromIsrCache,
     ...routeConfig.abandonAfterMs !== void 0 && {
       abandonAfterMs: routeConfig.abandonAfterMs
     },
@@ -95597,6 +95640,7 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
     memorySamples: result.memorySamples,
     peaks: result.peaks,
     ...revalidateSeconds !== null && { revalidatedEverySeconds: revalidateSeconds },
+    ...servedFromIsrCache && { servedFromIsrCache: true },
     ...plan.kind === "drive" && { revalidationDriven: true },
     ...bounded !== null && { keyCardinality: bounded.bound },
     unreclaimedSamples: result.unreclaimedSamples,
@@ -95624,8 +95668,8 @@ async function measureRoute(context, route, requestPath, index, pass = void 0) {
   };
 }
 async function writeEvidenceBundle(report, workDir) {
-  const { renderHtmlReport } = await import("./html-report-MSEC3ZI4.js");
-  const { renderIssueMarkdown } = await import("./issue-report-JXVLP7CV.js");
+  const { renderHtmlReport } = await import("./html-report-VNTPHLO3.js");
+  const { renderIssueMarkdown } = await import("./issue-report-4RW5YOT3.js");
   for (const route of report.routes) {
     if (route.status === "measured" && warrantsIssueDraft(route)) {
       const file = path9.join(workDir, `ISSUE-${routeSlug(route.route)}.md`);
@@ -95897,6 +95941,7 @@ export {
   sourceIndexAt,
   extractChunkModules,
   extractModuleRegistry,
+  terminalSafe,
   appPathsManifestSchema,
   routesManifestSchema,
   discoverPagesRoutes,
@@ -95920,7 +95965,7 @@ export {
   runRitual,
   runSelfCheck,
   renderConfigSkeleton,
-  hasPlaceholders,
+  writtenConfigNote,
   formatReport,
   captureEnvironment,
   loadSignatures,

package/dist/{chunk-QUFL2FXU.js → chunk-GU7IJUNY.js}

@@ -11,6 +11,8 @@ var STEPWISE_MAX_DRAWDOWN_RATIO = 0.1;
 var ACQUITTAL_MAX_GROWTH_MULTIPLE = 8;
 var SATURATION_MIN_CYCLES = 3;
 var SATURATION_MAX_FINAL_RATIO = 0.5;
+var SETTLED_TAIL_MIN_CYCLES = 3;
+var SETTLED_TAIL_MAX_SPREAD = 1.5;
 function maxDrawdown(samples) {
   let peak = samples[1] ?? 0;
   let worst = 0;
@@ -46,8 +48,20 @@ function isSaturating(deltas, minGrowth) {
   if (last > first * SATURATION_MAX_FINAL_RATIO) {
     return false;
   }
+  if (hasSettledAboveGate(deltas, minGrowth)) {
+    return false;
+  }
   return isHeadingDown(deltas);
 }
+function hasSettledAboveGate(deltas, minGrowth) {
+  const size = Math.max(SETTLED_TAIL_MIN_CYCLES, Math.ceil(deltas.length / 3));
+  const tail = deltas.slice(-size);
+  const smallest = Math.min(...tail);
+  if (smallest < minGrowth) {
+    return false;
+  }
+  return Math.max(...tail) <= smallest * SETTLED_TAIL_MAX_SPREAD;
+}
 function hasArrivedWithoutResuming(deltas, minGrowth) {
   const stop = deltas.findIndex((delta) => delta <= 0);
   if (stop === -1) {

package/dist/chunk-IKWF7SSB.js

@@ -0,0 +1,114 @@
+import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
+
+// src/control-server.ts
+import { timingSafeEqual } from "crypto";
+import http from "http";
+import path from "path";
+import { writeHeapSnapshot } from "v8";
+var g = globalThis;
+var tick = () => new Promise((resolve) => setImmediate(resolve));
+async function forceGc(passes = 3) {
+  if (typeof g.gc !== "function") {
+    return false;
+  }
+  for (let i = 0; i < passes; i += 1) {
+    g.gc();
+    await tick();
+  }
+  return true;
+}
+var requestProbe = globalThis;
+function sampleMemory(gcExposed) {
+  const usage = process.memoryUsage();
+  return {
+    gcExposed,
+    heapUsed: usage.heapUsed,
+    rss: usage.rss,
+    external: usage.external,
+    arrayBuffers: usage.arrayBuffers,
+    pid: process.pid,
+    ppid: process.ppid,
+    argv: process.argv,
+    cwd: process.cwd(),
+    ...requestProbe.__nextLeakServedRequests === void 0 ? {} : { servedRequests: requestProbe.__nextLeakServedRequests }
+  };
+}
+var CONTROL_TOKEN_HEADER = "x-next-leak-token";
+async function startControlServer(options) {
+  if (options.token === "") {
+    throw new Error("the control server needs a token and was given an empty one");
+  }
+  const write = options.writeSnapshot ?? writeHeapSnapshot;
+  const expected = Buffer.from(options.token);
+  const carriesToken = (request) => {
+    const header = request.headers[CONTROL_TOKEN_HEADER];
+    if (typeof header !== "string") {
+      return false;
+    }
+    const given = Buffer.from(header);
+    return given.length === expected.length && timingSafeEqual(given, expected);
+  };
+  const server = http.createServer((request, response) => {
+    void handle(request, response);
+  });
+  async function handle(request, response) {
+    const url = new URL(request.url ?? "/", "http://control.local");
+    const respond = (status, body) => {
+      response.writeHead(status, { "content-type": "application/json" });
+      response.end(JSON.stringify(body));
+    };
+    if (!carriesToken(request)) {
+      respond(403, { error: `missing or wrong ${CONTROL_TOKEN_HEADER} header` });
+      return;
+    }
+    try {
+      if (url.pathname === "/gc") {
+        const gcExposed = await forceGc();
+        respond(200, sampleMemory(gcExposed));
+        return;
+      }
+      if (url.pathname === "/mem") {
+        respond(200, sampleMemory(typeof g.gc === "function"));
+        return;
+      }
+      if (url.pathname === "/snapshot") {
+        const name = url.searchParams.get("name");
+        if (name === null || name === "") {
+          respond(400, { error: "missing ?name=<label>" });
+          return;
+        }
+        const gcExposed = await forceGc();
+        const sample = sampleMemory(gcExposed);
+        const file = write(
+          path.join(options.snapshotDir, `${path.basename(name)}.heapsnapshot`)
+        );
+        respond(200, { file, sample });
+        return;
+      }
+      respond(404, { error: `unknown path ${url.pathname}` });
+    } catch (cause) {
+      respond(500, { error: cause instanceof Error ? cause.message : String(cause) });
+    }
+  }
+  await new Promise((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(0, "127.0.0.1", resolve);
+  });
+  server.unref();
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    throw new Error("control server has no bound port");
+  }
+  return {
+    port: address.port,
+    close: () => new Promise((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    })
+  };
+}
+
+export {
+  requestProbe,
+  CONTROL_TOKEN_HEADER,
+  startControlServer
+};

package/dist/{chunk-VKPGB5MG.js → chunk-QNNVRQ4L.js}

@@ -2,12 +2,12 @@ import { createRequire as __nextLeakCreateRequire } from 'node:module';import {
 import {
   effectiveVerdict,
   withdrawnByDisagreement
-} from "./chunk-QUFL2FXU.js";
+} from "./chunk-GU7IJUNY.js";
 import {
   assessPeakPressure,
   describePeakPressure,
   retainedAfterLoad
-} from "./chunk-E464SO7G.js";
+} from "./chunk-VTKOO3YJ.js";
 
 // src/html-report.ts
 var MB = 1024 * 1024;

package/dist/{chunk-E464SO7G.js → chunk-VTKOO3YJ.js}

@@ -20,23 +20,16 @@ function assessPeakPressure(input) {
   const heapLimitBytes = input.maxOldSpaceMb * MB;
   const peakHeap = maxOf(sampled, (peak) => peak.heapUsed);
   const peakRss = maxOf(sampled, (peak) => peak.rss);
-  if (reachesHeapCeiling(peakHeap, heapLimitBytes)) {
-    return {
-      class: "heap",
-      peakBytes: peakHeap,
-      retainedBytes: input.retainedHeapBytes,
-      heapLimitBytes
-    };
-  }
-  if (reachesRssCeiling(peakRss, input.retainedHeapBytes)) {
-    return {
-      class: "rss",
-      peakBytes: peakRss,
-      retainedBytes: input.retainedHeapBytes,
-      heapLimitBytes
-    };
+  const pressureClass = sustainedClass(input) ?? (reachesHeapCeiling(peakHeap, heapLimitBytes) ? "heap" : reachesRssCeiling(peakRss, input.retainedHeapBytes) ? "rss" : null);
+  if (pressureClass === null) {
+    return null;
   }
-  return null;
+  return {
+    class: pressureClass,
+    peakBytes: pressureClass === "heap" ? peakHeap : peakRss,
+    retainedBytes: input.retainedHeapBytes,
+    heapLimitBytes
+  };
 }
 var PRESSURE_MIN_SETTLED_CYCLES = 2;
 var reachesCeiling = (peak, pressureClass, input) => pressureClass === "heap" ? reachesHeapCeiling(peak.heapUsed, input.maxOldSpaceMb * MB) : reachesRssCeiling(peak.rss, input.retainedHeapBytes);
@@ -50,19 +43,15 @@ function isSustained(input, pressureClass) {
   }
   return settled.every((peak) => reachesCeiling(peak, pressureClass, input));
 }
+var PRESSURE_CLASSES = ["heap", "rss"];
+function sustainedClass(input) {
+  return PRESSURE_CLASSES.find((pressureClass) => isSustained(input, pressureClass)) ?? null;
+}
 function assessPressureVerdict(input) {
   if (input.trend.verdict !== "stable" && input.trend.verdict !== "saturating") {
     return input.trend;
   }
-  const pressure = assessPeakPressure({
-    peaks: input.peaks,
-    retainedHeapBytes: input.retainedHeapBytes,
-    maxOldSpaceMb: input.maxOldSpaceMb
-  });
-  if (pressure === null) {
-    return input.trend;
-  }
-  if (!isSustained(input, pressure.class)) {
+  if (sustainedClass(input) === null) {
     return input.trend;
   }
   return { ...input.trend, verdict: "pressure" };

package/dist/cli.js

@@ -12,7 +12,6 @@ import {
   extractModuleRegistry,
   formatReport,
   freePort,
-  hasPlaceholders,
   helpText,
   killActiveChildren,
   parseCliArgs,
@@ -20,13 +19,16 @@ import {
   renderConfigSkeleton,
   runMeasurement,
   runSelfCheck,
+  terminalSafe,
   unregisterChild,
-  validateTarget
-} from "./chunk-HDCOHSBY.js";
+  validateTarget,
+  writtenConfigNote
+} from "./chunk-GBRBWUZZ.js";
+import "./chunk-IKWF7SSB.js";
 import {
   classifyTrend
-} from "./chunk-QUFL2FXU.js";
-import "./chunk-E464SO7G.js";
+} from "./chunk-GU7IJUNY.js";
+import "./chunk-VTKOO3YJ.js";
 import "./chunk-6XYFBOL2.js";
 
 // src/cli.ts
@@ -254,7 +256,7 @@ function attributionLines(attribution) {
   }
   return lines;
 }
-function formatBuildReport(result, attribution = null) {
+function buildReportText(result, attribution = null) {
   const lines = [`next-leak build \xB7 ${result.appDir}`, ""];
   if (result.strippedCapWarning !== null) {
     lines.push(`  \u25B2 ${result.strippedCapWarning}`, "");
@@ -332,6 +334,9 @@ function formatBuildReport(result, attribution = null) {
   );
   return lines.join("\n");
 }
+function formatBuildReport(result, attribution = null) {
+  return terminalSafe(buildReportText(result, attribution));
+}
 
 // src/build-run.ts
 import { spawn } from "child_process";
@@ -868,12 +873,12 @@ async function runBuildCommand(appDir, outputDir, attribute) {
     // is worth asking for, not worth risking every run for.
     ...attribute && { workDir },
     signal: aborter.signal,
-    onProgress: (message) => console.error(`\xB7 ${message}`)
+    onProgress: (message) => console.error(`\xB7 ${terminalSafe(message)}`)
   });
   const attribution = await attributeBuildCapture(
     result,
     appDir,
-    (message) => console.error(`\xB7 ${message}`)
+    (message) => console.error(`\xB7 ${terminalSafe(message)}`)
   );
   console.log(formatBuildReport(result, attribution));
   if (aborter.signal.aborted) {
@@ -902,13 +907,7 @@ ${skeleton}`
     return;
   }
   console.log(`wrote ${file}`);
-  if (hasPlaceholders(skeleton)) {
-    console.log("replace each REPLACE-ME with a value that exists in your app");
-  } else {
-    console.log(
-      "`{n}` gives every request a different value: a prerendered one serves the warm cache and reads as flat whatever the route retains. Use `{n%200}` to revisit a fixed set of keys, and drop the marker only if the app 404s on params it never prerendered."
-    );
-  }
+  console.log(writtenConfigNote(skeleton));
 }
 async function main() {
   const parsed = parseCliArgs(process.argv.slice(2));
@@ -949,9 +948,9 @@ async function main() {
       ...options.idleSeconds !== null && { idleMs: options.idleSeconds * 1e3 },
       ...options.maxOldSpaceMb !== null && { maxOldSpaceMb: options.maxOldSpaceMb }
     });
-    console.error(`\xB7 ${check.summary}`);
+    console.error(`\xB7 ${terminalSafe(check.summary)}`);
     if (!check.passed) {
-      console.error(`error: ${check.summary}`);
+      console.error(`error: ${terminalSafe(check.summary)}`);
       process.exitCode = 1;
       return;
     }
@@ -977,7 +976,7 @@ async function main() {
     ...options.diffAll && { diffAll: true },
     ...options.noResolve && { resolveInconclusive: false },
     ...options.output !== null && { outputDir: options.output },
-    onProgress: (message) => console.error(`\xB7 ${message}`)
+    onProgress: (message) => console.error(`\xB7 ${terminalSafe(message)}`)
   });
   console.log(formatReport(report));
   if (aborter.signal.aborted) {
@@ -995,7 +994,7 @@ try {
   await main();
 } catch (cause) {
   if (cause instanceof TargetError || cause instanceof RouteConfigError) {
-    console.error(`error: ${cause.message}`);
+    console.error(`error: ${terminalSafe(cause.message)}`);
   } else {
     console.error(cause);
   }

package/dist/control-client.d.ts

@@ -1,4 +1,9 @@
-import type { HeapSample } from "./control-server.js";
+import { type HeapSample } from "./control-server.js";
+/** Where a measured process listens for control requests, and the secret it expects. */
+export type ControlChannel = {
+    port: number;
+    token: string;
+};
 declare function deadlineFor(pathname: string): number;
 /** Where the control server will put `<name>.heapsnapshot`, so the client can watch it grow. */
 export declare function snapshotPathFor(workDir: string, name: string): string;
@@ -13,14 +18,14 @@ export type SnapshotWatch = {
     /** How often to look. */
     pollMs: number;
 };
-declare function request(port: number, pathname: string, deadlineMs?: number, watch?: SnapshotWatch): Promise<unknown>;
+declare function request(control: ControlChannel, pathname: string, deadlineMs?: number, watch?: SnapshotWatch): Promise<unknown>;
 /** Forces GC in the measured process and returns a settled memory sample. */
-export declare function requestGc(port: number): Promise<HeapSample>;
+export declare function requestGc(control: ControlChannel): Promise<HeapSample>;
 /**
  * Reads memory without collecting. Used to poll a process under load, where a
  * forced GC would change the number being read.
  */
-export declare function requestMemory(port: number): Promise<HeapSample>;
+export declare function requestMemory(control: ControlChannel): Promise<HeapSample>;
 /**
  * Forces GC, writes a named heap snapshot, and returns its path and sample.
  *
@@ -29,7 +34,7 @@ export declare function requestMemory(port: number): Promise<HeapSample>;
  * the call falls back to the plain wall-clock bound, which cannot tell a big
  * snapshot from a wedged process.
  */
-export declare function requestSnapshot(port: number, name: string, workDir?: string): Promise<{
+export declare function requestSnapshot(control: ControlChannel, name: string, workDir?: string): Promise<{
     file: string;
     sample: HeapSample;
 }>;

package/dist/control-server.d.ts

@@ -33,9 +33,13 @@ export type HeapSample = {
 export declare const requestProbe: typeof globalThis & {
     __nextLeakServedRequests?: number;
 };
+/** Header that carries the shared secret on every control request. */
+export declare const CONTROL_TOKEN_HEADER = "x-next-leak-token";
 export type ControlServerOptions = {
     /** Directory where heap snapshots are written. */
     snapshotDir: string;
+    /** Secret the launcher generated for this run; a request without it is refused. */
+    token: string;
     /** Injectable for tests; defaults to `v8.writeHeapSnapshot`. */
     writeSnapshot?: (file: string) => string;
 };
@@ -50,5 +54,11 @@ export type ControlServer = {
  * - `GET /mem` — respond with a memory sample WITHOUT collecting.
  * - `GET /snapshot?name=<label>` — force GC, write `<label>.heapsnapshot`
  *   into `snapshotDir`, respond `{ file, sample }` only once fully written.
+ *
+ * Every request must carry the run's token. The socket is bound to loopback,
+ * which keeps other machines out and nobody else: any local process can reach
+ * it, and so can a web page open in a browser on the same machine. Without
+ * the token either could read the process's argv and working directory, or
+ * ask for heap snapshots until the disk is full.
  */
 export declare function startControlServer(options: ControlServerOptions): Promise<ControlServer>;

package/dist/{html-report-MSEC3ZI4.js → html-report-VNTPHLO3.js}

@@ -1,9 +1,9 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   renderHtmlReport
-} from "./chunk-VKPGB5MG.js";
-import "./chunk-QUFL2FXU.js";
-import "./chunk-E464SO7G.js";
+} from "./chunk-QNNVRQ4L.js";
+import "./chunk-GU7IJUNY.js";
+import "./chunk-VTKOO3YJ.js";
 import "./chunk-6XYFBOL2.js";
 export {
   renderHtmlReport

package/dist/index.js

@@ -41,17 +41,18 @@ import {
   sourceIndexAt,
   summarizeBaseline,
   validateTarget
-} from "./chunk-HDCOHSBY.js";
+} from "./chunk-GBRBWUZZ.js";
+import "./chunk-IKWF7SSB.js";
 import {
   renderHtmlReport
-} from "./chunk-VKPGB5MG.js";
+} from "./chunk-QNNVRQ4L.js";
 import {
   classifyTrend
-} from "./chunk-QUFL2FXU.js";
+} from "./chunk-GU7IJUNY.js";
 import {
   renderIssueMarkdown
-} from "./chunk-ULTMNWRX.js";
-import "./chunk-E464SO7G.js";
+} from "./chunk-FJVY5MKV.js";
+import "./chunk-VTKOO3YJ.js";
 import "./chunk-6XYFBOL2.js";
 export {
   LaunchError,

package/dist/{issue-report-JXVLP7CV.js → issue-report-4RW5YOT3.js}

@@ -1,8 +1,8 @@
 import { createRequire as __nextLeakCreateRequire } from 'node:module';import { fileURLToPath as __nextLeakFileURLToPath } from 'node:url';import { dirname as __nextLeakDirname } from 'node:path';const require = __nextLeakCreateRequire(import.meta.url);const __filename = __nextLeakFileURLToPath(import.meta.url);const __dirname = __nextLeakDirname(__filename);
 import {
   renderIssueMarkdown
-} from "./chunk-ULTMNWRX.js";
-import "./chunk-E464SO7G.js";
+} from "./chunk-FJVY5MKV.js";
+import "./chunk-VTKOO3YJ.js";
 import "./chunk-6XYFBOL2.js";
 export {
   renderIssueMarkdown

package/dist/launcher.d.ts

@@ -49,6 +49,8 @@ export type LaunchedApp = {
     pid: number;
     appPort: number;
     controlPort: number;
+    /** Secret the control channel expects on every request; generated per launch. */
+    controlToken: string;
     /**
      * Why the measured process is gone, or null while it is alive. Without it
      * a child that died mid-run surfaces as "fetch failed", which reads like a

package/dist/manifests.d.ts

@@ -34,6 +34,9 @@ export declare const prerenderManifestSchema: z.ZodObject<{
         initialRevalidateSeconds: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodLiteral<false>]>>;
         srcRoute: z.ZodOptional<z.ZodNullable<z.ZodString>>;
     }, z.core.$loose>>>;
+    dynamicRoutes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        fallback: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$loose>>>;
     preview: z.ZodOptional<z.ZodObject<{
         previewModeId: z.ZodString;
     }, z.core.$loose>>;

package/dist/peak-pressure.d.ts

@@ -80,17 +80,17 @@ export type PressureVerdictInput = {
  * requests, because a forced GC handed all of it back before every sample. That
  * is the trap next-leak exists to warn other people about.
  *
- * Three conditions, and no threshold of its own: the ceiling rules are
+ * Two conditions, and no threshold of its own: the ceiling rules are
  * `assessPeakPressure`'s, asked of each cycle instead of the highest reading.
  *
  * - **The post-GC verdict is `stable` or `saturating`.** `leak` is already the
  *   worse news and `inconclusive` is an admission that the series did not
  *   decide — promoting *that* to an accusation would be inventing a finding out
  *   of a measurement that failed.
- * - **The peak is far enough from what the route retains to be remarked on** —
- *   `assessPeakPressure`, thresholds unchanged.
- * - **Every settled cycle reached that ceiling**, not just the highest one.
- *   This is the condition that makes the verdict safe. A single high peak is an
+ * - **Every settled cycle reached the same ceiling**, not just the highest one.
+ *   This is the condition that makes the verdict safe, and it contains the one
+ *   that used to stand beside it: if every settled cycle reached a ceiling, so
+ *   did the highest reading of the run. A single high peak is an
  *   episode and gets only the note; a process that returns to the ceiling every
  *   time it serves traffic is describing what it does under load, which is the
  *   thing a container is sized against.

package/dist/ritual.d.ts

@@ -1,3 +1,4 @@
+import { type ControlChannel } from "./control-client.js";
 import type { HeapSample } from "./control-server.js";
 import { launchInstrumented } from "./launcher.js";
 import { runAbandonPhase, type AbandonOrigin } from "./abandon-load.js";
@@ -164,7 +165,7 @@ export type RitualDeps = {
     abandon: typeof runAbandonPhase;
     sleep: (ms: number) => Promise<void>;
     /** GC-free read, polled while the app is under load. */
-    readMemory: (port: number) => Promise<HeapSample>;
+    readMemory: (control: ControlChannel) => Promise<HeapSample>;
 };
 /**
  * The pre-collection wait, taken *out of* the idle rather than added to it.

package/dist/route-guidance.d.ts

@@ -38,3 +38,5 @@ export declare function sampleValuesFromManifest(manifest: PrerenderManifest | u
 export declare function renderConfigSkeleton(routeTemplates: readonly string[], manifest?: PrerenderManifest | undefined): string | null;
 /** Whether a rendered skeleton still needs the user to fill anything in. */
 export declare function hasPlaceholders(skeleton: string): boolean;
+/** What `--write-config` prints after writing a skeleton: how to edit it. */
+export declare function writtenConfigNote(skeleton: string): string;

package/dist/runner.d.ts

@@ -113,6 +113,12 @@ export type RouteReport = {
      * cache and one measured against a re-render are different experiments.
      */
     revalidatedEverySeconds?: number;
+    /**
+     * Set on every route served from the ISR cache, including a dynamic
+     * template that caches each new key with no prerendered entry to carry
+     * its period — the period is then absent, but the cache is in play.
+     */
+    servedFromIsrCache?: true;
     /**
      * Whether the load carried the build's own revalidation header. Set apart
      * from the period because the two answer different questions: the period

package/dist/terminal-text.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Text as it can be written to a terminal.
+ *
+ * Heap node names, source paths, route names and the build's own output all
+ * come from the measured app, and a terminal obeys what it is sent: an escape
+ * sequence in a string name can clear the screen, move the cursor over a
+ * verdict already printed, or retitle the window. next-leak writes no
+ * sequences of its own, so none that reaches the output is ours to keep.
+ *
+ * A complete sequence is an instruction, not text, and is dropped. A control
+ * character left on its own is shown as `\xNN`: it was in the value, and a
+ * reader comparing the report against `run.json` should still find it.
+ */
+export declare function terminalSafe(text: string): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "next-leak",
-  "version": "0.12.2",
+  "version": "0.13.1",
   "description": "Find out whether your Next.js app actually leaks memory — how much, on which route, and whose fault it is.",
   "keywords": [
     "nextjs",