Will Binns-Smith

Build and analyze in one pass (#99962) ## Summary Build application output and analyzer assets in one pass with `next build --analyze`. Keep the user's emitted source-map setting separate from internal map generation, retaining partial maps for analysis alongside full maps when needed. Preserve emitted JavaScript, CSS, source-map bytes, and filenames across normal and analyzed builds for all source-map emission settings. ## Verification - Rebuilt the native binding and passed focused production tests for artifact equality and snapshot replay (4 tests). - Passed Rust policy, minifier, and printer regression tests, Cargo checks, Next.js source types, formatting, and lint. - Root type checking reports missing `node-fetch` in two preexisting temporary test fixtures. <!-- NEXT_JS_LLM --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>

bundle-analyzer: add compare view with treemap diff (#93521) Adds a compare mode to the bundle analyzer. When the user picks a historical snapshot from the new baseline picker in the top bar, the UI switches into compare mode: routes are diff'd by name and size, and the per-route view shows a `DiffTreemap` that colors each source tile by its change status (added/removed/grew/shrank/unchanged). The compare sidebar shows the import chain for the selected tile on either the baseline ("A") or current ("B") side. Route totals are fetched in parallel so the route picker can sort by largest impact and classify routes as `changed`/`identical` rather than just name-presence. <!-- NEXT_JS_LLM_PR --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com>

lazy server hmr (#96566) ## Summary Make Turbopack server HMR demand-driven. Server updates are now compiled and applied when the next relevant request writes an endpoint, instead of eagerly evaluating changed server modules after every file change. This replaces the aggregate server HMR subscription with an on-demand update API, while preserving incremental updates and falling back to full cache eviction when a restart is required. Test Plan: added an e2e test <!-- NEXT_JS_LLM --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com>

Bundle Analyzer Agent Skill: Show modules in generated JS/CSS files (#99173) ## Summary Before this PR, an agent could see a route's generated files and follow imports to find modules relevant to that route. It could not reliably tell **which exact modules landed in a particular JavaScript or CSS file**. This PR adds that per-file mapping, so an agent can trace a large generated file back to the modules it contains. Files that cannot be mapped are marked as such rather than shown as empty. The graph checks the module information before reporting a match. ## Verification - The broad graph-dump converter unit suite is removed in the root and not reintroduced here; existing e2e and producer code are unchanged. The snapshot-selection unit suite is removed too, without replacement tests; its targeted mocked-history/path coverage is intentionally dropped. Neither analyzer unit suite remains; Next package no-emit types pass. Unique removed edge-case coverage was explicitly accepted. - Earlier stack verification included Rust analyzer tests, analyzer e2e and a full build; these are historical results, not validation of the new signed heads. **New-head CI is pending.** <!-- NEXT_JS_LLM --> <!-- fleet d7bdbc2b-b0bc-4591-99eb-dccb0fa49c73 --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com>

Add server-only leak pass to next-bundle-optimizer (#100330) ## Summary The bundle optimizer ranks client code by size, so it misses small modules that shouldn't be in the browser at all: a database schema, a token-signing helper, an agent's system prompt. This adds a size-independent leak pass to step 4 that walks every client-reachable module in the analyzer export and checks it against content heuristics. Matches are reported in a separate "Possible server-only leaks" section with route, shortest import chain, matched heuristics and compressed bytes. They stay out of the size ranking and deltas, and the agent leaves flagged modules and their import chains untouched in both modes, since moving them is the owner's call and a size metric can't verify it. The scan lives inline in SKILL.md rather than in a reference file. It runs on every invocation, and in eval runs the agent skipped a reference pointer in fix mode and missed a finding. Also rewords one existing sentence in step 4's Done line. Evals: - `agent-059-bundle-audit-server-leaks`: audit mode. Two leaks (prompt-like schema descriptions under `lib/server`, agent instructions reached through a shared util) sit well below a lodash import in size. Negative controls cover UI copy under `description`/`instructions`/`prompt` keys, a `NEXT_PUBLIC_` read and a `server-only` module used only by a Server Component. - `agent-060-bundle-fix-server-leaks`: fix mode on the same app. Checks the lodash fix still happens, the leaks are reported as unfixed, and none of the flagged modules or their importers are edited. ## Verification - `pnpm eval agent-059-bundle-audit-server-leaks`: `skills` passes, `baseline` and `agents-md` fail - `pnpm eval agent-060-bundle-fix-server-leaks`: `skills` passes, `baseline` and `agents-md` fail (both edit the flagged modules) - Not rerun: both evals after dropping the env-read case and the `/pricing` route from the fixtures <!-- NEXT_JS_LLM --> --------- Co-authored-by: vercel[bot] <35613825+vercel[bot]@users.noreply.github.com>

Reload on missed Turbopack startup CSS updates (#99963) ### What? Recover missed Turbopack startup CSS edits with a full page reload, while keeping ordinary CSS HMR state-preserving. Related: #99893; reuses the version-mismatch recovery introduced in #97966. ### Why? CSS can finish loading before the browser starts HMR. An edit in that window leaves old CSS in the page, but initializing the browser from the current WebSocket version hides the mismatch. The initial HTML needs to carry the version it actually rendered, and the server must observe CSS before any browser subscribes. ### How? - Capture the client HMR version before rendering and emit `__nextHmrInitialVersion` in an inline script **only in dev-server HTML with Turbopack HMR**, using safe serialization, the existing CSP nonce and Pages crossOrigin precedence. - Use the HTML version as the first-connection fallback. Previously observed WebSocket versions retain priority on reconnect. A stale subscription reuses the existing reload message/handler. - Await CSS-inclusive observation before serving HTML: App route client output, Pages route client output, and Pages' global `_app` client output. Pages chunks exclude dependencies already provided by `_app`, so the global observer is necessary for a truly fresh Pages-first load. - Reuse existing subscription ownership/deduplication and per-cycle client-version accounting. Successful observation sends no refresh/build-success message and does not invalidate the server-component cache. Subscriptions remain disabled for one-shot compilation. A genuinely missed startup JS output change can use the same recovery path. - Remove the previous startup stylesheet reconciliation/readiness machinery and restore the original CSS loader. Remove Pages' duplicate reload action; its existing guarded hot-middleware listener already handles the message before and after hydration. ### Verification Final local runs use isolated packages: - **Turbopack: 26 passed** — repeated App → Pages → App startup races, independent fresh Pages-only startup recovery, controlled delayed Pages greeting delivery, no-edit controls, global `_app` JS/CSS-dependency/error/config recovery, and all app-document rendering tests. - **Cache Components: 14 passed** — both startup/lifecycle fixtures. - **Pages/MCP regressions: 41 passed, 10 snapshots** — full/hot reload, error pages, syntax/runtime recovery and compile_route. - **Webpack: 30 passed, 10 snapshots**; **production/start: 12 passed**. Twelve local dev-Turbopack HMR cases are appropriately gated in those modes; both unconditional HTML-absence assertions still run. - **14 units passed**, including await-before-HTML, dedicated global key, absent/dev-disabled hooks, setup rejection and cleanup-key semantics. - Full bootstrap, root/Next/runtime types, ESLint, Prettier and whitespace checks passed. No snapshots changed. Pre-fix isolated tests reproduced the missing crossOrigin and fresh Pages-first `HTML 0 / greeting 0` failures. Tests now await actual first greeting/subscription evidence rather than treating hydration or socket-open as message readiness. They still require a newer first greeting, the original HTML subscription version, exactly one recovery navigation, current CSS, ordinary CSS state preservation and a real reconnect. Each race browser closes before file restoration so it cannot mask later startup detection. Coverage limits: controlled delayed delivery is proven for Pages, not App. Live custom/default `_app` endpoint-identity add/remove and native subscription counts were not instrumented; code/dependency changes, config replacement and cleanup-key semantics are covered. Switching between distinct global CSS imports already produces competing reloads with or without the new observer; that pre-existing behavior is a separate follow-up, not ordinary same-file CSS HMR. Local browser runs used Chromium. Native/runtime source is unchanged in this follow-up; four earlier local **dev-profile** Rust snapshots are historical evidence, not a new release-with-assertions run. No agent CI reruns were performed, and local verification does not claim remote CI success. <!-- NEXT_JS_LLM --> <!-- fleet 12f26da0-c82d-4bee-b78c-c8151440ae25 --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com> Co-authored-by: Luke Sandberg <lukesandberg@users.noreply.github.com>

Bundle Analyzer Agent Skill: Add browser initial-load eval (#99178) ## Summary Add a click-gated CodeMirror eval that measures cold browser JavaScript before and after optimization. Require lazy loading, preload on hover, working editing, and a 200,000-byte initial-load budget. Share measurement and setup helpers under `evals/lib/bundle-optimizer/`. Require invocation of `next-bundle-optimizer` in the skills treatment. ## Verification - Root and eval TypeScript checks pass on the rebased stack. - Formatting, focused ESLint, and local setup/transcript checks pass. - Remote agent evals not rerun after these updates. - Bootstrap build blocked by a registry 401 while resolving `@pnpm/exe@10.33.0`. <!-- NEXT_JS_LLM --> <!-- fleet d7bdbc2b-b0bc-4591-99eb-dccb0fa49c73 --> <!-- fleet ea768377-d71c-4a15-90b2-f4d50d4f6a1c --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com>

Keep HMR instructions typed until serialization (#96569) Stacked on #96686. ## What? Keep HMR update instructions as typed Rust values until they cross the client protocol serialization boundary. The JSON wire format remains unchanged. ## Why? HMR aggregation currently operates on `serde_json::Value`, so it has to inspect serialized `type` fields and clone values out of JSON objects. This loses type information before aggregation and makes unsupported instruction variants easy to overlook. Keeping instructions typed lets aggregation use concrete equality and hashing, preserves stable ordering while deduplicating updates, and falls back to a total update when it encounters an instruction type it cannot aggregate. ## How? - Add `UpdateInstructionValue`, a type-erased serializable value with typed downcasting and equality. - Represent chunk-list and merged ECMAScript updates with owned, hashable values backed by frozen collections. - Aggregate typed instructions with first-seen ordering for merged updates and last-writer-wins values for chunk updates. - Serialize instructions only when producing the HMR protocol message. - Add unit coverage for downcasting, equality, hashing, aggregation behavior, and the existing JSON protocol shape. ## Verification - Unit tests cover the new typed values and aggregation behavior. - Serialization tests confirm the client-facing HMR messages are unchanged. - CI <!-- NEXT_JS_LLM -->

Bundle Analyzer Agent Skill: Expose more route details in analyze data (#99172) ## Summary Export typed App, Pages and API endpoint roots and nested client references from analyzer route provenance into JSON Lines `route.entries`. Keep server/shared roles separate from verified client bootstrap identities: a client reference is not another endpoint or evidence of an observed initial request. Preserve UI binary artifacts internally while agents consume semantic records. ## Verification - This layer: root TypeScript and converter unit 5/5; targeted Rust analyzer tests 3/3. Completed stack: analyzer e2e 7/7 (App, Pages, API), full build 18/18. New-head CI pending. <!-- NEXT_JS_LLM --> <!-- fleet d7bdbc2b-b0bc-4591-99eb-dccb0fa49c73 --> <!-- fleet ea768377-d71c-4a15-90b2-f4d50d4f6a1c --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com>

Bundle Analyzer Agent Skill: Trace conditional async and worker chunk loading (#99174) ## Summary Make the bundle analyzer explain how emitted chunks can load other chunks. This gives the initial-load optimizer skill the relationships it needs to distinguish startup code from conditionally loaded code and trace why a dependency is reachable. - Export typed load relationships for dynamic imports, async manifests, and service-worker registration. - Tie async triggers to the actual dynamically imported module. - Preserve unresolved relationships and worker modules compiled in separate graphs so missing data is not mistaken for “nothing loads.” This builds on the preceding branch’s client chunk groups and machine-readable graph export. The relationships describe possible loads at build time; browser measurements are still needed to establish what actually loads initially. ## Verification - Previously reported: Next.js package no-emit types passed. - Native dev/prod analyzer e2e and a full Rust build were not run locally due to sandbox disk capacity. Current-head CI must validate them; earlier-head results do not verify this stack. - Analyzer graph-dump and snapshot-selection unit suites were removed earlier in the stack. Their malformed-data, stream, collision, packaging, and mocked-history/path coverage has no replacement. <!-- NEXT_JS_LLM --> <!-- fleet d7bdbc2b-b0bc-4591-99eb-dccb0fa49c73 --> <!-- fleet ea768377-d71c-4a15-90b2-f4d50d4f6a1c --> --------- Co-authored-by: vercel-fleet-prod[bot] <318278635+vercel-fleet-prod[bot]@users.noreply.github.com> Co-authored-by: Will Binns-Smith <755844+wbinnssmith@users.noreply.github.com>