fix(deps): Next 16.3.0 → 16.3.1, and make the compiled-branch gate hard (#3983) (#4075)

* fix(deps): Next 16.3.0 -> 16.3.1, and make the compiled-branch gate hard (#3983) This is the fix for #3983. The defect was in the bundler, not in our source. Turbopack's value analyzer in 16.3.0 models a bare `return someAsyncFn()` tail call as `Promise<Promise<T>>`. That is always truthy, so a caller that `await`s it is analysed as always-true and every statement after the resulting conditional is eliminated as dead code. `isAppListingsEnabled` ends in exactly that shape, which is why `resolveStoreVisibilityScopeUninstrumented` lost two of its three returns, fell off the end, and produced `undefined` for every non-privileged caller — served as the whole catalog on one read path (`?? 'full'`) and as an empty store on the other (`?? 'none'`). Upstream: vercel/next.js#96601 "[turbopack] Collapse nested promises in the analyzer", backported as #96675, shipped in 16.3.1. MEASURED, not inferred. Two production builds of THIS commit on one machine, same Node 24.19.0, differing only in the pinned Next: 16.3.0 async function S(e){if(await p(e))return"full"} 16.3.1 async function w(e){return await c(e)?"full":await y(e)?"public-external":"none"} Both read out of the emitted `.next/server` chunks by source-map attribution and identified by their source neighbour `STORE_SCOPE_FLAGS`, never by minified name. Note the fixed form is a TERNARY — `grep 'return"public-external"'` returns zero on the FIXED build too, which is why the gate reads source maps. `package.json` already allowed 16.3.1 (`^16.3.0`); only the lockfile pinned 16.3.0, so the substance here is the lockfile. The floor is raised to `^16.3.1` so a fresh resolution cannot land back on the broken compiler. `patches/next@…` is renamed and its `patchedDependencies` key updated — that patch is the unrelated libvips/SVG one-liner (vercel/next.js#96681), it still applies cleanly, and 16.3.1 still does not carry the loader entry upstream, so it stays. `--warn-only` is removed from `scripts/assert-compiled-branches.mjs` in the same commit. It existed only because the 16.3.0 build genuinely violated the gate, and a permanently-red gate trains everyone to click through. Keeping the bump and the strictness atomic means the gate's strictness always matches the toolchain: a revert of the bump turns it red instead of silently passing. Verified on this commit: - gate exit 0 (hard, no --warn-only) against the 16.3.1 build - gate exit 1 against a 16.3.0 build of the same tree — watched red - `scripts/ci/assert-next-svg-patch-applied.mjs` OK on both installed copies - unit suite 1149 files / 18,123 tests passed, 0 failed Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(build): ship @swc/helpers' module-sync branch into the standalone image (#3983) The bump built clean, passed every source-level gate — unit suites, typecheck, ESLint + Prettier, schema drift, the event-engine pin, and the now-hard compiled-branch gate — and the container could not boot: Error: Cannot find module '.../@swc/helpers/esm/_interop_require_default.js' at ... next/dist/server/require-hook.js code: 'MODULE_NOT_FOUND' Same shape as the defect this PR exists to fix: a correct source tree producing a broken artefact, invisible to everything that reads source. ROOT CAUSE, measured on the published artefact rather than inferred. `output: 'standalone'` does not ship node_modules; it ships the subset @vercel/nft traced. nft resolves a bare specifier under the `require`/`default` conditions. Node (>= 22.10) additionally honours `module-sync` for a CJS `require`. When a package's `exports` map points those two at different files, the build traces one and the running process asks for the other. next/dist/shared/lib/constants.js does `require('@swc/helpers/_/_interop_require_default')`, reached from the generated server.js via `next` -> config.js -> constants.js, i.e. before any application code. The relevant delta is not next itself but next's own dependency: next 16.3.0 next 16.3.1 @swc/helpers 0.5.15 0.5.23 ./_/_interop_require_default {import,default} {module-sync,webpack,import,default} require.resolve() under CJS cjs/...cjs esm/...js Both resolutions were RUN, not reasoned about. nft still traced the cjs file, so the published image carried that package as exactly cjs/_interop_require_default.cjs, cjs/_interop_require_wildcard.cjs and package.json — no esm/ directory at all. Adding only the missing esm/ directory to that exact image, nothing else changed, boots it: "Next.js 16.3.1 ... Ready". FIX. `outputFileTracingIncludes` force-includes BOTH condition branches of EVERY installed @swc/helpers copy — not the one file missing today, because which helper Next requires and which branch each resolver picks are upstream details that move. Globs are version- and hash-agnostic (`@swc+helpers@*`), plus a flat form for a hoisted layout. ~950 KB per copy. Verified on a local production build of this commit: both copies land in .next/standalone with complete esm/ (108 and 105 files) and cjs/, and next's virtual store links the 0.5.23 copy. Attached to three existing API-route keys rather than a `'**'` key. copyTracedFiles unions every entry's traced set into the single .next/standalone node_modules, so one entry carrying it is enough, while `'**'` would make all 572 entries read/parse/rewrite their .nft.json concurrently — 826 MB of JSON in one Promise.all — on a build already tuned against OOM. GATE, because a glob is a silent no-op once it stops matching. scripts/ci/assert-standalone-boot-graph.mjs runs in the Dockerfile's RUNNER stage: the first gate in that file to run against the runtime filesystem rather than the build tree, and the only one that can see this class of defect. It reads the GENERATED server.js for the specifiers that process requires at module scope and loads them in a child rooted at the shipped tree — no package, version, virtual-store path or patch hash hardcoded, so it keeps covering this after the next bump. Exit 2, never 0, when it cannot observe its input. It must run in the runner and not the builder: /app there is byte-for-byte what ships, whereas the builder's complete node_modules sits above .next/standalone on the resolution path and can satisfy a require the image cannot. Watched red and green on real artefacts, not only fixtures: - exit 1 with this exact MODULE_NOT_FOUND against the published broken image; - exit 0 against the same image with only the esm/ directory added; - exit 0 against the local production build of this commit, isolated from any parent node_modules; - exit 1 again after deleting exactly esm/_interop_require_default.js from that same local build. src/tests/build/standalone-boot-graph.test.ts pins the MECHANISM (a module-sync/default split with only the default branch present) rather than the package, and all 5 of its cases were watched to fail against a neutered gate. NOT VERIFIED. Nothing about production: this is only true of production once it merges, is promoted main -> release, is built and is serving. The gate covers the ENTRYPOINT's require graph; route chunks load lazily, so a condition mismatch reachable only from a route would still surface at request time. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * chore: retrigger preview The previous preview run (pr-preview-4075-b2wnw) never scheduled: its build-image and typecheck pods sat Pending with ExceededNodeResources for 82 minutes and the run hit the 1h30m PipelineRunTimeout. No verdict was produced — this was build-pool capacity contention, not a code failure. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-09-20 22:08:18 +08:00 · 2026-08-18 15:07:05 -05:00
parent 11aa27cfc1
commit c78f85dd5a
9 changed files with 475 additions and 121 deletions
@@ -91,16 +91,16 @@ RUN node scripts/check-server-graph-singletons.mjs
 # when it cannot observe its input. Adding a gate is one entry in
 # `scripts/compiled-branch-watchlist.mjs`.
 #
-# 🔴 `--warn-only` because THIS BUILD CURRENTLY VIOLATES IT. The bundler defect behind
-# civitai#3983 is not fixed — `main` and `release` carry byte-identical source for that
-# function and both emit it truncated — so a hard gate here would fail every production
-# build immediately. It reports loudly and exits 0 instead. `--warn-only` does NOT
-# downgrade exit 2, so a gate that cannot see its own input still fails the build.
-#
-# REMOVE `--warn-only` as part of fixing the underlying defect. That flip is the
-# definition of done for civitai#3983, and it is the only thing that turns this from a log
-# line back into a gate.
-RUN node scripts/assert-compiled-branches.mjs --warn-only
+# HARD as of the Next 16.3.1 bump. It shipped `--warn-only` for exactly one build, because
+# 16.3.0's Turbopack value analyzer modelled a bare `return someAsyncFn()` tail call as
+# `Promise<Promise<T>>` — always truthy — so an awaiting caller was analysed as always-true
+# and every statement after the resulting conditional was eliminated as dead code
+# (vercel/next.js#96601, backported as #96675, shipped in 16.3.1). With 16.3.0 pinned the
+# gate genuinely failed every production build, and a permanently-red gate is worse than no
+# gate. With 16.3.1 pinned the build satisfies it, so the downgrade is removed in the same
+# commit as the bump: the gate's strictness now tracks the toolchain, and a revert of the
+# bump turns this red instead of silently passing.
+RUN node scripts/assert-compiled-branches.mjs

 # Bundle-size budget (report-only during the soak). Next 16 (Turbopack) emits
 # opaque hashed chunks and removed per-route build stats, so scripts/bundle-budget.mjs
@@ -181,6 +181,29 @@ COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 # They are published as the separate `maps` target above (fetched on-demand by
 # the cpuprofile resolver), keeping the prod pod lean (~761 MB smaller).

+# Boot-graph gate — the first gate in this file that runs against the RUNTIME filesystem
+# rather than the build tree, and the only one that can see this class of defect.
+#
+# `output: 'standalone'` ships the subset @vercel/nft traced, not node_modules. nft resolves a
+# bare specifier under `require`/`default`; Node (>= 22.10) additionally honours `module-sync`
+# for a CJS `require`. When a package's `exports` map points those at different files the build
+# traces one and the process asks for the other: the build is green, the source is correct,
+# every gate above passes, and the container crash-loops before the first line of application
+# code. That is exactly what the Next 16.3.1 bump did via @swc/helpers 0.5.15 -> 0.5.23
+# (civitai#4075) — a green PR whose only red signal was the preview deploy.
+#
+# It MUST run here and not in the builder: `/app` in this stage is byte-for-byte what ships,
+# whereas the builder's complete `/app/node_modules` sits above `.next/standalone` on the
+# resolution path and can satisfy a require the image cannot. Cheap (~2s) and needs no env: it
+# reads the GENERATED server.js for the specifiers that process requires at module scope and
+# loads them in a child rooted at `/app`. Nothing is hardcoded — no package, version,
+# virtual-store path or patch hash — so it keeps covering this after the next bump.
+#
+# Exits 2 (not 0) when it cannot observe its input, same rule as the build-output gates above.
+# The script is removed in the same layer chain so it is not part of the served image.
+COPY --from=builder /app/scripts/ci/assert-standalone-boot-graph.mjs /tmp/assert-standalone-boot-graph.mjs
+RUN node /tmp/assert-standalone-boot-graph.mjs /app && rm -f /tmp/assert-standalone-boot-graph.mjs
+
 USER nextjs
 EXPOSE 3000
 ENV PORT=3000
@@ -15,6 +15,51 @@ const withBundleAnalyzer = bundlAnalyzer({
  enabled: analyze,
 });

+/**
+ * Runtime files of every installed `@swc/helpers`, force-included into the standalone output.
+ *
+ * WHY. `output: 'standalone'` ships the subset @vercel/nft traced, not `node_modules`. nft
+ * resolves a bare specifier under the `require`/`default` conditions; Node (>= 22.10)
+ * additionally honours `module-sync` for a CJS `require`. When a package's `exports` map points
+ * those two at different files, the build traces one and the running process asks for the other.
+ *
+ * Next's own `dist/shared/lib/constants.js` does
+ * `require('@swc/helpers/_/_interop_require_default')`, reached from the generated `server.js`
+ * via `next` -> `config.js` -> `constants.js` — i.e. before any application code. On
+ * @swc/helpers 0.5.15 (next 16.3.0) that subpath exported only `{ import, default }` and both
+ * resolvers landed on `cjs/_interop_require_default.cjs`. 0.5.17+ added `module-sync` ->
+ * `esm/_interop_require_default.js`, and next 16.3.1 bumped its dependency to 0.5.23 — so the
+ * image shipped `cjs/` only and every pod crash-looped on
+ * `MODULE_NOT_FOUND .../@swc/helpers/esm/_interop_require_default.js` (civitai#4075) with the
+ * build, the unit suite, typecheck, ESLint and the compiled-branch gate all green.
+ *
+ * BOTH condition branches of EVERY copy, not the one file missing today: which helper Next
+ * requires, and which branch each resolver picks, are upstream details that move. ~950 KB per
+ * copy (426 files across the two copies installed today). Version- and hash-agnostic globs —
+ * `@swc+helpers@*` covers whatever the next bump resolves to, and the flat form covers a hoisted
+ * (non-pnpm) layout. A non-matching glob is a silent no-op, which is exactly why this is NOT the
+ * guard: the guard is
+ * `scripts/ci/assert-standalone-boot-graph.mjs`, run against the runtime filesystem in the
+ * Dockerfile's runner stage, which fails the build if this ever stops landing the files.
+ *
+ * ATTACHED TO EXISTING ROUTE KEYS ON PURPOSE. This is a process-wide boot dependency, not a
+ * route's, and `copyTracedFiles` unions every entry's traced set into the single
+ * `.next/standalone` node_modules — so any one entry carrying it is enough. A `'**'` key does
+ * match every route (keys are picomatch'd with `contains: true`), but it would make all 572
+ * entries read/parse/rewrite their `.nft.json` concurrently — 826 MB of JSON in one
+ * `Promise.all` — on a build already tuned against OOM. These keys are API routes: always
+ * present, never statically prerendered (an entry in `staticPages` has its includes skipped),
+ * and already include-keyed, so they cost no additional entry. Three of them for redundancy: if
+ * one route is ever renamed or removed the files still ship, and if all three go the boot gate
+ * turns the build red rather than letting a broken image out.
+ */
+const swcHelpersRuntimeFiles = [
+  './node_modules/@swc/helpers/esm/**/*',
+  './node_modules/@swc/helpers/cjs/**/*',
+  './node_modules/.pnpm/@swc+helpers@*/node_modules/@swc/helpers/esm/**/*',
+  './node_modules/.pnpm/@swc+helpers@*/node_modules/@swc/helpers/cjs/**/*',
+];
+
 /**
 * Don't be scared of the generics here.
 * All they do is to give us autocompletion when using this.
@@ -192,8 +237,8 @@ export default defineNextConfig(
      '/safety': ['./src/static-content/**/*'],
      '/region-blocked': ['./src/static-content/**/*'],
      '/content/[[...slug]]': ['./src/static-content/**/*'],
-      '/api/trpc/[trpc]': ['./src/static-content/**/*'],
-      '/api/v1/content/[[...slug]]': ['./src/static-content/**/*'],
+      '/api/trpc/[trpc]': ['./src/static-content/**/*', ...swcHelpersRuntimeFiles],
+      '/api/v1/content/[[...slug]]': ['./src/static-content/**/*', ...swcHelpersRuntimeFiles],
      // /api/og uses next/og's `ImageResponse`, which on the nodejs runtime
      // lazily require()s `next/dist/compiled/@vercel/og/index.node.js` (plus its
      // resvg/yoga WASM + fonts). @vercel/nft cannot follow that dynamic require,
@@ -209,6 +254,7 @@ export default defineNextConfig(
      '/api/og': [
        './node_modules/next/dist/compiled/@vercel/og/**/*',
        './node_modules/.pnpm/next@*/node_modules/next/dist/compiled/@vercel/og/**/*',
+        ...swcHelpersRuntimeFiles,
      ],
    },
    experimental: {
@@ -267,7 +267,7 @@
    "meilisearch": "0.33.0",
    "motion": "^11.11.17",
    "msgpackr": "^1.10.2",
-    "next": "^16.3.0",
+    "next": "^16.3.1",
    "nodemailer": "^6.8.0",
    "obscenity": "^0.4.5",
    "openai": "^4.73.0",
@@ -435,7 +435,7 @@
    ],
    "patchedDependencies": {
      "@mantine/hooks": "patches/@mantine__hooks.patch",
-      "next@16.3.0": "patches/next@16.3.0.patch"
+      "next@16.3.1": "patches/next@16.3.1.patch"
    }
  }
 }
@@ -20,9 +20,9 @@ patchedDependencies:
  '@mantine/hooks':
    hash: b45a85bd4d007c796b93eb90a75d3234b81cce13964921b25721734c7ed79f64
    path: patches/@mantine__hooks.patch
-  next@16.3.0:
+  next@16.3.1:
    hash: d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6
-    path: patches/next@16.3.0.patch
+    path: patches/next@16.3.1.patch

 importers:

@@ -66,7 +66,7 @@ importers:
        version: link:packages/civitai-flipt
      '@civitai/next-axiom':
        specifier: ^0.17.0
-        version: 0.17.0(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))
+        version: 0.17.0(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))
      '@civitai/shared':
        specifier: workspace:*
        version: link:packages/civitai-shared
@@ -156,7 +156,7 @@ importers:
        version: 16.3.0(bufferutil@4.0.9)(utf-8-validate@5.0.10)
      '@next/third-parties':
        specifier: ^15.0.3
-        version: 15.4.6(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1)
+        version: 15.4.6(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1)
      '@node-oauth/oauth2-server':
        specifier: ^5.3.0
        version: 5.3.0
@@ -312,7 +312,7 @@ importers:
        version: 11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2)
      '@trpc/next':
        specifier: ^11.17.0
-        version: 11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/react-query@11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(react@18.3.1)(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.2)
+        version: 11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/react-query@11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(react@18.3.1)(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.2)
      '@trpc/react-query':
        specifier: ^11.17.0
        version: 11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(react@18.3.1)(typescript@5.9.2)
@@ -345,7 +345,7 @@ importers:
        version: 1.0.4(chart.js@4.5.0)(dayjs@1.11.13)
      circular-dependency-plugin:
        specifier: ^5.2.2
-        version: 5.2.2(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6))
+        version: 5.2.2(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6))
      cloudflare:
        specifier: ^2.9.1
        version: 2.9.1
@@ -482,8 +482,8 @@ importers:
        specifier: ^1.10.2
        version: 1.11.5
      next:
-        specifier: ^16.3.0
-        version: 16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
+        specifier: ^16.3.1
+        version: 16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
      nodemailer:
        specifier: ^6.8.0
        version: 6.10.1
@@ -543,7 +543,7 @@ importers:
        version: 7.12.0(algoliasearch@4.25.2)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
      react-instantsearch-router-nextjs:
        specifier: 7.12.0
-        version: 7.12.0(algoliasearch@4.25.2)(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1)
+        version: 7.12.0(algoliasearch@4.25.2)(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1)
      react-intersection-observer:
        specifier: ^9.4.0
        version: 9.16.0(react-dom@18.3.1(react@18.3.1))(react@18.3.1)
@@ -673,7 +673,7 @@ importers:
        version: 9.9.0
      '@ladle/react':
        specifier: ^5.1.1
-        version: 5.1.1(@swc/helpers@0.5.17)(@types/node@24.13.3)(@types/react@18.0.14)(jiti@2.7.0)(lightningcss@1.32.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(typescript@5.9.2)(yaml@2.8.1)
+        version: 5.1.1(@swc/helpers@0.5.23)(@types/node@24.13.3)(@types/react@18.0.14)(jiti@2.7.0)(lightningcss@1.32.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(typescript@5.9.2)(yaml@2.8.1)
      '@next/eslint-plugin-next':
        specifier: ^15.5.19
        version: 15.5.19
@@ -811,7 +811,7 @@ importers:
        version: 3.0.2
      eslint-plugin-tailwindcss:
        specifier: ^3.15.1
-        version: 3.18.2(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2)))
+        version: 3.18.2(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2)))
      husky:
        specifier: ^9.1.1
        version: 9.1.7
@@ -847,10 +847,10 @@ importers:
        version: 2.3.0(prisma@6.13.0(typescript@5.9.2))
      tailwindcss:
        specifier: ^3.4.3
-        version: 3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2))
+        version: 3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2))
      ts-node:
        specifier: ^10.9.1
-        version: 10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2)
+        version: 10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2)
      tsx:
        specifier: ^4.19.2
        version: 4.20.3
@@ -1014,7 +1014,7 @@ importers:
        version: 8.57.1
      eslint-plugin-svelte:
        specifier: ^2.46.1
-        version: 2.46.1(eslint@8.57.1)(svelte@5.56.3(@typescript-eslint/types@8.60.1))(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@20.19.9)(typescript@5.9.3))
+        version: 2.46.1(eslint@8.57.1)(svelte@5.56.3(@typescript-eslint/types@8.60.1))(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@20.19.9)(typescript@5.9.3))
      prettier:
        specifier: ^3.9.6
        version: 3.9.6
@@ -1233,7 +1233,7 @@ importers:
        version: 1.0.5
      tsup:
        specifier: ^8.5.0
-        version: 8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.17))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1)
+        version: 8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.23))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1)
      tsx:
        specifier: ^4.19.2
        version: 4.20.3
@@ -1282,7 +1282,7 @@ importers:
        version: 20.19.9
      tsup:
        specifier: ^8.5.0
-        version: 8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.17))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1)
+        version: 8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.23))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1)
      tsx:
        specifier: ^4.19.2
        version: 4.20.3
@@ -1319,7 +1319,7 @@ importers:
        version: 20.19.9
      tsup:
        specifier: ^8.5.0
-        version: 8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.17))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1)
+        version: 8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.23))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1)
      tsx:
        specifier: ^4.19.2
        version: 4.20.3
@@ -3250,56 +3250,56 @@ packages:
  '@next/bundle-analyzer@16.3.0':
    resolution: {integrity: sha512-o8OiXKIATcSC6kHm5BIEmaDEDTFUDhpy9POQIbzAQTlb8NWwFhEQheTLFSbyQXxH2ywhjZ/e8EUlbOjj2k22Yg==}

-  '@next/env@16.3.0':
-    resolution: {integrity: sha512-o9r1S0BNiNreHP9Vs+Qnqd9kviDkJh8xIACY7UFZSmiGbbQRzPBBosvHzAU4TULHOIuOj/18RSsyz2qrREmIFw==}
+  '@next/env@16.3.1':
+    resolution: {integrity: sha512-35G3xwkQUb2oETSDjFXGrVugknoayLFBh7vSE+yAcl9IP2zT9wyGwq7297AYHR11kJld807t5f8AJBs6WBzXsQ==}

  '@next/eslint-plugin-next@15.5.19':
    resolution: {integrity: sha512-Ctwb4qYuMbHN/1oXLlTdMchwG8h8Xzwq+wGZZMgF3o6+uwyBKAI2c96bdOsl+C62PaUD0Jkh+QpNkhUeDlam0Q==}

-  '@next/swc-darwin-arm64@16.3.0':
-    resolution: {integrity: sha512-55hpqq18bEVAlxedlTt3tFqZmKg2nUXT1kn1G/BGEy0R13h3LwtwHPVzzjG6P4LLeOHE32PFDQUVaJEWvBEZBw==}
+  '@next/swc-darwin-arm64@16.3.1':
+    resolution: {integrity: sha512-ABMIu2zQ7cnNIHm5ivKGwZwUrm0pAai3yiJ/gK/rF1c1VP9UOnj7XECbMKFdVKp9I9eMYq9NoDs1WXOoowxzJw==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [darwin]

-  '@next/swc-darwin-x64@16.3.0':
-    resolution: {integrity: sha512-SOi96kSaF5T+0wW4koiM1bWzSPwjzTesC1p3df+FjdOi5LIQkBK/blxh7HdoKnNuI4PURF1OO7TZqtfnbWDSgw==}
+  '@next/swc-darwin-x64@16.3.1':
+    resolution: {integrity: sha512-gNG21e/UnrroeScbY/QndUEdl0mF1FRibW7BBeYUz/5ABCepjqDdEdgr592vpzMtCn/m7FTjYq3TN4TpyDnutw==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [darwin]

-  '@next/swc-linux-arm64-gnu@16.3.0':
-    resolution: {integrity: sha512-P0gZAoPMF4dyTRzhmkV4PrqVzSOB6t4mC1oI3c4dqijJ+OVEVx5clIXAKR4/uQpsqw2KKM/0D5tVumcR2r5blg==}
+  '@next/swc-linux-arm64-gnu@16.3.1':
+    resolution: {integrity: sha512-6B6Lw016iwNUQuaJoraMMTLh6TwHzFUtxipSScD1F3YyymcrRWkobodRS2ftIOkF5vrs4zNlyUrTC5YZQ9Lz5w==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [linux]

-  '@next/swc-linux-arm64-musl@16.3.0':
-    resolution: {integrity: sha512-tXXGKJw0m37O0eKJARVTX/TheKPhz0QFVtVVZXmOig+9YKLQOSP6hvf2pxv5DO7CLEJyTHx3Pg043CDQkv1G4Q==}
+  '@next/swc-linux-arm64-musl@16.3.1':
+    resolution: {integrity: sha512-JUiPXZKK9wOhjf4MgDiH29GZLxfqOesbLtHq2pDxwH/WwscTRV2ToymnOTh1egzaZf0ueUf8T2+CeYTGHjW0Iw==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [linux]

-  '@next/swc-linux-x64-gnu@16.3.0':
-    resolution: {integrity: sha512-pjGxK5EY7yWml78ALejFkWmgHsU7wbFQrISiugpH6FbUJhgEvw3xFZ/EBAtLl7QtL0WdQKiG9eWJ3mOKGTukHw==}
+  '@next/swc-linux-x64-gnu@16.3.1':
+    resolution: {integrity: sha512-Uog9jsrmIRIL/lfvIp9htmskSNC7JcQsMVucXL2V2YY1y/D9IUN3LPEafqy0zRJ2cIU1SQ0V6F6TlffQ+pLAGg==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [linux]

-  '@next/swc-linux-x64-musl@16.3.0':
-    resolution: {integrity: sha512-sjo++Xx+lomlPs3HRsHWhVDyGG6ms1kGW5EtHLERdII8AyG1i+f6aq68xHREO6AEMlhjTNEWBSmfJfqm9orf7g==}
+  '@next/swc-linux-x64-musl@16.3.1':
+    resolution: {integrity: sha512-6yy3FT13KgUFOj5H8bl8w/6nKiJwHIvbtwh1V+1acsu+7y4tJjnemSa6mhsh53BeoVrlozE+fMgZhXH46WmjMA==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [linux]

-  '@next/swc-win32-arm64-msvc@16.3.0':
-    resolution: {integrity: sha512-C5JSgiO54wURdaxdEUIXqkz04uMqC9UmPX1gtDrV/5Tf1UowdWYI8uA5hfFbPolTlp0q4KZ60xlHePNibf0VIw==}
+  '@next/swc-win32-arm64-msvc@16.3.1':
+    resolution: {integrity: sha512-iOoN1QecUoGNZik536U/vtK43YwgyrCsGIkth52yIkl612n+0C9MjSnJbQAikISpb+WYRooBVhaDlUW7iZoKog==}
    engines: {node: '>= 10'}
    cpu: [arm64]
    os: [win32]

-  '@next/swc-win32-x64-msvc@16.3.0':
-    resolution: {integrity: sha512-fDOggsweNb5SSw0ZKVk6U+gxSyGFFlIBY/LBc1r8GUj4u/6t6oArL+Pmkg0MBnsgR+KkdsURilVH4F3GXUGepA==}
+  '@next/swc-win32-x64-msvc@16.3.1':
+    resolution: {integrity: sha512-d/k+PpAriUPaeMJJOG7HUSdqfEX46FEPWU1p3/nm2ACmXhj9hFEWdFODUBIpkuijXYkfL90qZzTqVPRp4BW/hw==}
    engines: {node: '>= 10'}
    cpu: [x64]
    os: [win32]
@@ -4744,12 +4744,12 @@ packages:
  '@swc/counter@0.1.3':
    resolution: {integrity: sha512-e2BR4lsJkkRlKZ/qCHPw9ZaSxc0MVUd7gtbtaB7aMvHeJVYe8sOB8DBZkP2DtISHGSku9sCK6T6cnY0CtXrOCQ==}

-  '@swc/helpers@0.5.15':
-    resolution: {integrity: sha512-JQ5TuMi45Owi4/BIMAJBoSQoOJu12oOk/gADqlcUL9JEdHB8vyjUSsxqeNXnmXHjYKMi2WcYtezGEEhqUI/E2g==}
-
  '@swc/helpers@0.5.17':
    resolution: {integrity: sha512-5IKx/Y13RsYd+sauPb2x+U/xZikHjolzfuDgTAl/Tdf3Q8rslRvC19NKDLgAJQ6wsqADk10ntlv08nPFw/gO/A==}

+  '@swc/helpers@0.5.23':
+    resolution: {integrity: sha512-5lSsMOTXURePglDfvuAQUqkGek9Hg2kksOYay2m0+XR++b2NWYL/4sWyuvVBIs8oKnJaxkdi9whaL/sqN13afw==}
+
  '@swc/types@0.1.25':
    resolution: {integrity: sha512-iAoY/qRhNH8a/hBvm3zKj9qQ4oc2+3w1unPJa2XvTK3XjeLXtzcCingVPw/9e5mn1+0yPqxcBGp9Jf0pkfMb1g==}

@@ -9231,8 +9231,8 @@ packages:
  neo-async@2.6.2:
    resolution: {integrity: sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==}

-  next@16.3.0:
-    resolution: {integrity: sha512-NEdGOzH+08eTXMUp9UYkA99Nhi5N6Thrhc1jgFOQgfgnGK/dA2hRwBpXep+exdFQrnwlRf/3Wixyp8lLBUpE2A==}
+  next@16.3.1:
+    resolution: {integrity: sha512-hsAp0i7Rh+/dhe7DGIeN2YlpLM1DP4MNxti9EtDMtqcO612X81MvvEj388/oTce9U1EcEIOWDlGq0zRwrBKvuA==}
    engines: {node: '>=20.9.0'}
    hasBin: true
    peerDependencies:
@@ -13199,9 +13199,9 @@ snapshots:
    dependencies:
      fast-xml-parser: 5.10.1

-  '@civitai/next-axiom@0.17.0(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))':
+  '@civitai/next-axiom@0.17.0(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))':
    dependencies:
-      next: 16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
+      next: 16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
      whatwg-fetch: 3.6.20

  '@clavata/sdk@0.2.3':
@@ -14153,7 +14153,7 @@ snapshots:
      react: 18.3.1
      react-dom: 18.3.1(react@18.3.1)

-  '@ladle/react@5.1.1(@swc/helpers@0.5.17)(@types/node@24.13.3)(@types/react@18.0.14)(jiti@2.7.0)(lightningcss@1.32.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(typescript@5.9.2)(yaml@2.8.1)':
+  '@ladle/react@5.1.1(@swc/helpers@0.5.23)(@types/node@24.13.3)(@types/react@18.0.14)(jiti@2.7.0)(lightningcss@1.32.0)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(typescript@5.9.2)(yaml@2.8.1)':
    dependencies:
      '@babel/code-frame': 7.27.1
      '@babel/core': 7.29.0
@@ -14166,7 +14166,7 @@ snapshots:
      '@mdx-js/mdx': 3.1.1
      '@mdx-js/react': 3.1.1(@types/react@18.0.14)(react@18.3.1)
      '@vitejs/plugin-react': 4.7.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(yaml@2.8.1))
-      '@vitejs/plugin-react-swc': 3.11.0(@swc/helpers@0.5.17)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(yaml@2.8.1))
+      '@vitejs/plugin-react-swc': 3.11.0(@swc/helpers@0.5.23)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(yaml@2.8.1))
      axe-core: 4.10.3
      boxen: 8.0.1
      chokidar: 4.0.3
@@ -14393,39 +14393,39 @@ snapshots:
      - bufferutil
      - utf-8-validate

-  '@next/env@16.3.0': {}
+  '@next/env@16.3.1': {}

  '@next/eslint-plugin-next@15.5.19':
    dependencies:
      fast-glob: 3.3.1

-  '@next/swc-darwin-arm64@16.3.0':
+  '@next/swc-darwin-arm64@16.3.1':
    optional: true

-  '@next/swc-darwin-x64@16.3.0':
+  '@next/swc-darwin-x64@16.3.1':
    optional: true

-  '@next/swc-linux-arm64-gnu@16.3.0':
+  '@next/swc-linux-arm64-gnu@16.3.1':
    optional: true

-  '@next/swc-linux-arm64-musl@16.3.0':
+  '@next/swc-linux-arm64-musl@16.3.1':
    optional: true

-  '@next/swc-linux-x64-gnu@16.3.0':
+  '@next/swc-linux-x64-gnu@16.3.1':
    optional: true

-  '@next/swc-linux-x64-musl@16.3.0':
+  '@next/swc-linux-x64-musl@16.3.1':
    optional: true

-  '@next/swc-win32-arm64-msvc@16.3.0':
+  '@next/swc-win32-arm64-msvc@16.3.1':
    optional: true

-  '@next/swc-win32-x64-msvc@16.3.0':
+  '@next/swc-win32-x64-msvc@16.3.1':
    optional: true

-  '@next/third-parties@15.4.6(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1)':
+  '@next/third-parties@15.4.6(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1)':
    dependencies:
-      next: 16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
+      next: 16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
      react: 18.3.1
      third-party-capital: 1.0.20

@@ -16232,7 +16232,7 @@ snapshots:
  '@swc/core-win32-x64-msvc@1.15.11':
    optional: true

-  '@swc/core@1.15.11(@swc/helpers@0.5.17)':
+  '@swc/core@1.15.11(@swc/helpers@0.5.23)':
    dependencies:
      '@swc/counter': 0.1.3
      '@swc/types': 0.1.25
@@ -16247,15 +16247,15 @@ snapshots:
      '@swc/core-win32-arm64-msvc': 1.15.11
      '@swc/core-win32-ia32-msvc': 1.15.11
      '@swc/core-win32-x64-msvc': 1.15.11
-      '@swc/helpers': 0.5.17
+      '@swc/helpers': 0.5.23

  '@swc/counter@0.1.3': {}

-  '@swc/helpers@0.5.15':
+  '@swc/helpers@0.5.17':
    dependencies:
      tslib: 2.8.1

-  '@swc/helpers@0.5.17':
+  '@swc/helpers@0.5.23':
    dependencies:
      tslib: 2.8.1

@@ -16623,11 +16623,11 @@ snapshots:
      '@trpc/server': 11.17.0(typescript@5.9.2)
      typescript: 5.9.2

-  '@trpc/next@11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/react-query@11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(react@18.3.1)(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.2)':
+  '@trpc/next@11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/react-query@11.17.0(@tanstack/react-query@5.101.0(react@18.3.1))(@trpc/client@11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(react@18.3.1)(typescript@5.9.2))(@trpc/server@11.17.0(typescript@5.9.2))(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(typescript@5.9.2)':
    dependencies:
      '@trpc/client': 11.17.0(@trpc/server@11.17.0(typescript@5.9.2))(typescript@5.9.2)
      '@trpc/server': 11.17.0(typescript@5.9.2)
-      next: 16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
+      next: 16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
      react: 18.3.1
      react-dom: 18.3.1(react@18.3.1)
      typescript: 5.9.2
@@ -17321,10 +17321,10 @@ snapshots:
  '@unrs/resolver-binding-win32-x64-msvc@1.11.1':
    optional: true

-  '@vitejs/plugin-react-swc@3.11.0(@swc/helpers@0.5.17)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(yaml@2.8.1))':
+  '@vitejs/plugin-react-swc@3.11.0(@swc/helpers@0.5.23)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(yaml@2.8.1))':
    dependencies:
      '@rolldown/pluginutils': 1.0.0-beta.27
-      '@swc/core': 1.15.11(@swc/helpers@0.5.17)
+      '@swc/core': 1.15.11(@swc/helpers@0.5.23)
      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(sass@1.90.0)(sugarss@5.0.1(postcss@8.5.6))(terser@5.48.0)(tsx@4.20.3)(yaml@2.8.1)
    transitivePeerDependencies:
      - '@swc/helpers'
@@ -18338,9 +18338,9 @@ snapshots:

  chrome-trace-event@1.0.4: {}

-  circular-dependency-plugin@5.2.2(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)):
+  circular-dependency-plugin@5.2.2(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)):
    dependencies:
-      webpack: 5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)
+      webpack: 5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)

  citty@0.1.6:
    dependencies:
@@ -19372,7 +19372,7 @@ snapshots:
      string.prototype.matchall: 4.0.12
      string.prototype.repeat: 1.0.0

-  eslint-plugin-svelte@2.46.1(eslint@8.57.1)(svelte@5.56.3(@typescript-eslint/types@8.60.1))(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@20.19.9)(typescript@5.9.3)):
+  eslint-plugin-svelte@2.46.1(eslint@8.57.1)(svelte@5.56.3(@typescript-eslint/types@8.60.1))(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@20.19.9)(typescript@5.9.3)):
    dependencies:
      '@eslint-community/eslint-utils': 4.9.1(eslint@8.57.1)
      '@jridgewell/sourcemap-codec': 1.5.5
@@ -19381,7 +19381,7 @@ snapshots:
      esutils: 2.0.3
      known-css-properties: 0.35.0
      postcss: 8.5.6
-      postcss-load-config: 3.1.4(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@20.19.9)(typescript@5.9.3))
+      postcss-load-config: 3.1.4(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@20.19.9)(typescript@5.9.3))
      postcss-safe-parser: 6.0.0(postcss@8.5.6)
      postcss-selector-parser: 6.1.2
      semver: 7.8.1
@@ -19391,11 +19391,11 @@ snapshots:
    transitivePeerDependencies:
      - ts-node

-  eslint-plugin-tailwindcss@3.18.2(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2))):
+  eslint-plugin-tailwindcss@3.18.2(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2))):
    dependencies:
      fast-glob: 3.3.3
      postcss: 8.5.6
-      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2))
+      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2))

  eslint-scope@5.1.1:
    dependencies:
@@ -21926,10 +21926,10 @@ snapshots:

  neo-async@2.6.2: {}

-  next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0):
+  next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0):
    dependencies:
-      '@next/env': 16.3.0
-      '@swc/helpers': 0.5.15
+      '@next/env': 16.3.1
+      '@swc/helpers': 0.5.23
      baseline-browser-mapping: 2.10.33
      caniuse-lite: 1.0.30001793
      postcss: 8.5.23
@@ -21937,14 +21937,14 @@ snapshots:
      react-dom: 18.3.1(react@18.3.1)
      styled-jsx: 5.1.6(@babel/core@7.29.0)(react@18.3.1)
    optionalDependencies:
-      '@next/swc-darwin-arm64': 16.3.0
-      '@next/swc-darwin-x64': 16.3.0
-      '@next/swc-linux-arm64-gnu': 16.3.0
-      '@next/swc-linux-arm64-musl': 16.3.0
-      '@next/swc-linux-x64-gnu': 16.3.0
-      '@next/swc-linux-x64-musl': 16.3.0
-      '@next/swc-win32-arm64-msvc': 16.3.0
-      '@next/swc-win32-x64-msvc': 16.3.0
+      '@next/swc-darwin-arm64': 16.3.1
+      '@next/swc-darwin-x64': 16.3.1
+      '@next/swc-linux-arm64-gnu': 16.3.1
+      '@next/swc-linux-arm64-musl': 16.3.1
+      '@next/swc-linux-x64-gnu': 16.3.1
+      '@next/swc-linux-x64-musl': 16.3.1
+      '@next/swc-win32-arm64-msvc': 16.3.1
+      '@next/swc-win32-x64-msvc': 16.3.1
      '@opentelemetry/api': 1.9.0
      '@playwright/test': 1.57.0
      sass: 1.90.0
@@ -22474,21 +22474,21 @@ snapshots:
      camelcase-css: 2.0.1
      postcss: 8.5.6

-  postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@20.19.9)(typescript@5.9.3)):
+  postcss-load-config@3.1.4(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@20.19.9)(typescript@5.9.3)):
    dependencies:
      lilconfig: 2.1.0
      yaml: 1.10.2
    optionalDependencies:
      postcss: 8.5.6
-      ts-node: 10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@20.19.9)(typescript@5.9.3)
+      ts-node: 10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@20.19.9)(typescript@5.9.3)

-  postcss-load-config@4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2)):
+  postcss-load-config@4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2)):
    dependencies:
      lilconfig: 3.1.3
      yaml: 2.8.1
    optionalDependencies:
      postcss: 8.5.6
-      ts-node: 10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2)
+      ts-node: 10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2)

  postcss-load-config@6.0.1(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(yaml@2.8.1):
    dependencies:
@@ -23104,10 +23104,10 @@ snapshots:
      react: 18.3.1
      use-sync-external-store: 1.5.0(react@18.3.1)

-  react-instantsearch-router-nextjs@7.12.0(algoliasearch@4.25.2)(next@16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1):
+  react-instantsearch-router-nextjs@7.12.0(algoliasearch@4.25.2)(next@16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0))(react@18.3.1):
    dependencies:
      instantsearch.js: 4.73.0(algoliasearch@4.25.2)
-      next: 16.3.0(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
+      next: 16.3.1(patch_hash=d4cabfb715b050babab8b116679e9bd883334feb7bdf383883679c3cf22f94c6)(@babel/core@7.29.0)(@opentelemetry/api@1.9.0)(@playwright/test@1.57.0)(@types/node@24.13.3)(react-dom@18.3.1(react@18.3.1))(react@18.3.1)(sass@1.90.0)
      react-instantsearch-core: 7.12.0(algoliasearch@4.25.2)(react@18.3.1)
    transitivePeerDependencies:
      - algoliasearch
@@ -24329,7 +24329,7 @@ snapshots:
    optionalDependencies:
      tailwind-merge: 3.6.0

-  tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2)):
+  tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2)):
    dependencies:
      '@alloc/quick-lru': 5.2.0
      arg: 5.0.2
@@ -24348,7 +24348,7 @@ snapshots:
      postcss: 8.5.6
      postcss-import: 15.1.0(postcss@8.5.6)
      postcss-js: 4.0.1(postcss@8.5.6)
-      postcss-load-config: 4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2))
+      postcss-load-config: 4.0.2(postcss@8.5.6)(ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2))
      postcss-nested: 6.2.0(postcss@8.5.6)
      postcss-selector-parser: 6.1.2
      resolve: 1.22.10
@@ -24406,15 +24406,15 @@ snapshots:
      - encoding
      - supports-color

-  terser-webpack-plugin@5.6.1(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)):
+  terser-webpack-plugin@5.6.1(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)):
    dependencies:
      '@jridgewell/trace-mapping': 0.3.31
      jest-worker: 27.5.1
      schema-utils: 4.3.3
      terser: 5.48.0
-      webpack: 5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)
+      webpack: 5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)
    optionalDependencies:
-      '@swc/core': 1.15.11(@swc/helpers@0.5.17)
+      '@swc/core': 1.15.11(@swc/helpers@0.5.23)
      cssnano: 7.1.0(postcss@8.5.6)
      esbuild: 0.25.8
      lightningcss: 1.32.0
@@ -24577,7 +24577,7 @@ snapshots:

  ts-mixer@6.0.4: {}

-  ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@20.19.9)(typescript@5.9.3):
+  ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@20.19.9)(typescript@5.9.3):
    dependencies:
      '@cspotcode/source-map-support': 0.8.1
      '@tsconfig/node10': 1.0.11
@@ -24595,10 +24595,10 @@ snapshots:
      v8-compile-cache-lib: 3.0.1
      yn: 3.1.1
    optionalDependencies:
-      '@swc/core': 1.15.11(@swc/helpers@0.5.17)
+      '@swc/core': 1.15.11(@swc/helpers@0.5.23)
    optional: true

-  ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.17))(@types/node@24.13.3)(typescript@5.9.2):
+  ts-node@10.9.2(@swc/core@1.15.11(@swc/helpers@0.5.23))(@types/node@24.13.3)(typescript@5.9.2):
    dependencies:
      '@cspotcode/source-map-support': 0.8.1
      '@tsconfig/node10': 1.0.11
@@ -24616,7 +24616,7 @@ snapshots:
      v8-compile-cache-lib: 3.0.1
      yn: 3.1.1
    optionalDependencies:
-      '@swc/core': 1.15.11(@swc/helpers@0.5.17)
+      '@swc/core': 1.15.11(@swc/helpers@0.5.23)

  tsc-alias@1.9.1:
    dependencies:
@@ -24651,7 +24651,7 @@ snapshots:

  tsscmp@1.0.6: {}

-  tsup@8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.17))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1):
+  tsup@8.5.1(@swc/core@1.15.11(@swc/helpers@0.5.23))(jiti@2.7.0)(postcss@8.5.23)(tsx@4.20.3)(typescript@5.9.3)(yaml@2.8.1):
    dependencies:
      bundle-require: 5.1.0(esbuild@0.27.7)
      cac: 6.7.14
@@ -24671,7 +24671,7 @@ snapshots:
      tinyglobby: 0.2.15
      tree-kill: 1.2.2
    optionalDependencies:
-      '@swc/core': 1.15.11(@swc/helpers@0.5.17)
+      '@swc/core': 1.15.11(@swc/helpers@0.5.23)
      postcss: 8.5.23
      typescript: 5.9.3
    transitivePeerDependencies:
@@ -25401,7 +25401,7 @@ snapshots:

  webpack-sources@3.5.0: {}

-  webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6):
+  webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6):
    dependencies:
      '@types/eslint-scope': 3.7.7
      '@types/estree': 1.0.9
@@ -25425,7 +25425,7 @@ snapshots:
      neo-async: 2.6.2
      schema-utils: 4.3.3
      tapable: 2.3.3
-      terser-webpack-plugin: 5.6.1(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.17))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6))
+      terser-webpack-plugin: 5.6.1(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6)(webpack@5.101.0(@swc/core@1.15.11(@swc/helpers@0.5.23))(cssnano@7.1.0(postcss@8.5.6))(esbuild@0.25.8)(lightningcss@1.32.0)(postcss@8.5.6))
      watchpack: 2.5.1
      webpack-sources: 3.5.0
    transitivePeerDependencies:
@@ -13,18 +13,21 @@
 * libvips block on first image-optimizer use and re-enables only six RASTER loaders; SVG is
 * not among them, so every `ImageResponse` in the process throws
 * `Input buffer contains unsupported image format` from then on. We carry upstream
- * vercel/next.js#96681 as `patches/next@16.3.0.patch` until we are on a Next that contains it.
+ * vercel/next.js#96681 as `patches/next@16.3.1.patch` until we are on a Next that contains it.
 *
 * The assertion is deliberately "the installed Next unblocks SVG", NOT "our patch file is on
- * disk" and NOT "we are on 16.3.0":
+ * disk" and NOT "we are on any particular version":
 *
 *   - reading `node_modules` rather than `patches/` is the whole point — a patch that exists
 *     but did not APPLY (unregistered key, failed hunk, a stale lockfile hash) is exactly the
 *     silent failure this catches, and a patch-file grep would sail through it;
 *   - staying version-agnostic means the guard does not have to be retired in the same commit
- *     that bumps Next. On >= 16.3.1 the entry is present upstream and this still passes; the
- *     patch itself is separately version-pinned, so the bump fails the install rather than
- *     silently carrying a stale patch.
+ *     that bumps Next. If a future Next ships the loader entry itself, this still passes with
+ *     the patch retired; the patch is separately version-pinned through
+ *     `pnpm.patchedDependencies`, so a bump fails the install rather than silently carrying a
+ *     stale patch. (Measured on the 16.3.0 -> 16.3.1 bump: the patch still applies, and the
+ *     installed 16.3.1 carries exactly ONE occurrence of the loader entry per copy — i.e. the
+ *     patch is what puts it there, upstream still does not.)
 *
 * BOTH BUILDS, SKIPPING WHAT IS ABSENT. Next ships this module twice — `dist/server/` (CJS)
 * and `dist/esm/server/`. A full `pnpm install` has both; the production standalone image has
@@ -112,7 +115,7 @@ function formatReport(report) {
 const FAILURE_EXPLANATION =
  `FAIL: the installed Next does not unblock the libvips SVG loader (${REQUIRED_LOADER}).\n` +
  'Every `next/og` ImageResponse — i.e. all of /api/og — will return 500 as soon as anything\n' +
-  'touches the image optimizer in that process. Check that `patches/next@16.3.0.patch` is\n' +
+  'touches the image optimizer in that process. Check that `patches/next@<version>.patch` is\n' +
  'still registered under `pnpm.patchedDependencies` in package.json and that\n' +
  '`pnpm install` applied it; this reads node_modules, so a patch file that exists but did\n' +
  'not apply fails here. See src/tests/api/og.image-optimizer-sharp.test.ts for the outage.';
@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+/**
+ * Blocking guard: every module the standalone entrypoint statically requires can actually be
+ * LOADED from the shipped filesystem.
+ *
+ * WHY THIS EXISTS. `output: 'standalone'` does not ship `node_modules`; it ships the subset
+ * @vercel/nft traced. nft resolves a bare specifier with its own condition set, and Node
+ * resolves the same specifier at runtime with ITS condition set. When the two disagree, the
+ * build traces one file and the process asks for a different one — the build is green, every
+ * source-level gate is green, and the container cannot boot.
+ *
+ * That is not hypothetical. Next's `dist/shared/lib/constants.js` does
+ * `require('@swc/helpers/_/_interop_require_default')`. On `@swc/helpers` 0.5.15 that subpath
+ * exported `{ import, default }`, so a CJS require and nft both landed on
+ * `cjs/_interop_require_default.cjs`. 0.5.17+ added a `module-sync` condition pointing at
+ * `esm/_interop_require_default.js`; Node (>= 22.10) honours `module-sync` for `require`,
+ * nft does not. Next 16.3.1 bumped its own `@swc/helpers` dependency 0.5.15 -> 0.5.23, so the
+ * traced image carried only `cjs/` and the pod crash-looped on
+ * `MODULE_NOT_FOUND .../@swc/helpers/esm/_interop_require_default.js` before the first line of
+ * application code ran (civitai#4075).
+ *
+ * WHAT IT ASSERTS, AND WHY THAT IS THE RIGHT INVARIANT. It does not name a package, a version,
+ * a pnpm virtual-store directory or a patch hash — every one of those rots. It reads the
+ * GENERATED `server.js` for the specifiers that process actually requires at module scope, and
+ * loads them in a child process rooted at the shipped tree. So it tracks whatever Next emits:
+ * if a future Next requires something else, or a future dependency flips another condition, the
+ * same assertion covers it with no edit here.
+ *
+ * WHERE IT MUST RUN. Against the runtime filesystem — the runner stage, where `/app` is exactly
+ * what ships — NOT against the builder, whose complete `node_modules` sits above `.next/standalone`
+ * on the resolution path and can satisfy a require the shipped image cannot.
+ *
+ * Exit codes: 0 pass, 1 a required module could not be loaded, 2 the check could not observe its
+ * input (no root, no `node_modules`, no specifiers found) — a scan that sees nothing must not
+ * report health.
+ */
+
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { builtinModules } from 'node:module';
+import { join, resolve } from 'node:path';
+
+const CHILD_TIMEOUT_MS = 180_000;
+
+const root = resolve(process.argv[2] ?? '.next/standalone');
+const entry = join(root, 'server.js');
+
+/** Node builtins are always resolvable and prove nothing about the trace. */
+const BUILTINS = new Set([...builtinModules, ...builtinModules.map((m) => `node:${m}`)]);
+
+function fail2(message) {
+  console.error(`FAIL (cannot observe input): ${message}`);
+  process.exit(2);
+}
+
+if (!existsSync(root)) fail2(`standalone root ${root} does not exist`);
+if (!existsSync(entry)) fail2(`${entry} does not exist — this is not a standalone output tree`);
+if (!existsSync(join(root, 'node_modules')))
+  fail2(`${join(root, 'node_modules')} does not exist — nothing was traced into this tree`);
+
+const source = readFileSync(entry, 'utf8');
+
+// Only UNINDENTED lines. The generated server.js is flat, so column 0 is module scope — which
+// keeps two things out: a lazily-required module inside a function body (requiring it eagerly
+// here could fail for reasons that are not a trace gap, and a gate that is permanently red is
+// worse than no gate), and any `require('…')` that happens to sit inside the inlined
+// `const nextConfig = {…}` JSON on its own line. Specifiers never contain whitespace or a
+// scheme; anything that does is text, not a module.
+const specifiers = [
+  ...new Set(
+    source
+      .split('\n')
+      .filter((line) => /^\S/.test(line))
+      .flatMap((line) =>
+        [...line.matchAll(/\brequire\(\s*['"]([^'"]+)['"]\s*\)/g)].map((m) => m[1])
+      )
+      .filter((s) => !BUILTINS.has(s) && !/\s|:\/\//.test(s))
+  ),
+];
+
+if (specifiers.length === 0)
+  fail2(
+    `found no non-builtin require() specifier in ${entry}. Either Next changed how it emits the ` +
+      'standalone entrypoint or this file is not the entrypoint; either way this check proved nothing.'
+  );
+
+console.log(`standalone root : ${root}`);
+console.log(`entrypoint      : ${entry}`);
+console.log(`specifiers      : ${specifiers.join(', ')}`);
+
+// Load them the way the real process does: a child rooted at the shipped tree, so resolution
+// walks the shipped node_modules and nothing above it.
+const probe = specifiers
+  .map((s) => `require(${JSON.stringify(s)}); console.log('  ok  ' + ${JSON.stringify(s)});`)
+  .join('\n');
+
+const child = spawnSync(process.execPath, ['-e', probe], {
+  cwd: root,
+  encoding: 'utf8',
+  timeout: CHILD_TIMEOUT_MS,
+  env: { ...process.env, NEXT_TELEMETRY_DISABLED: '1' },
+});
+
+if (child.stdout) process.stdout.write(child.stdout);
+
+if (child.status === 0) {
+  console.log(`\nOK: all ${specifiers.length} entrypoint module(s) load from the shipped tree.`);
+  process.exit(0);
+}
+
+if (child.stderr) process.stderr.write(child.stderr);
+console.error(
+  `\nFAIL: the standalone entrypoint's own require graph does not load from ${root}` +
+    (child.signal ? ` (child killed by ${child.signal})` : ` (exit ${child.status})`) +
+    '.\n' +
+    'The container will crash-loop on boot before any application code runs. A MODULE_NOT_FOUND\n' +
+    'here means @vercel/nft traced a different file than Node resolves — typically an `exports`\n' +
+    'condition mismatch (`module-sync`/`import` vs `require`). Fix it by force-including the\n' +
+    "package's runtime files via `outputFileTracingIncludes` in next.config.mjs; do not pin the\n" +
+    'virtual-store path or version, use a wildcard so it survives the next bump.'
+);
+process.exit(1);
@@ -22,8 +22,9 @@ import type { NextApiRequest, NextApiResponse } from 'next';
 * `Input buffer contains unsupported image format` — and `/api/og` returns 500
 * for the rest of that pod's life. Upstream: vercel/next.js#96301 introduced it,
 * vercel/next.js#96681 fixes it by adding `'VipsForeignLoadSvg'` to the unblock
- * list. We carry that one-line fix as `patches/next@16.3.0.patch` until we are on
- * a Next release that contains it (stable 16.3.1 is not out yet).
+ * list. We carry that one-line fix as `patches/next@16.3.1.patch` until we are on
+ * a Next release that contains it — 16.3.1 still does not, so the bump to it
+ * renamed the patch and kept it.
 *
 * WHY THIS TEST IS SHAPED THE WAY IT IS. 🔴 The ordering is the whole test.
 * Rendering an `ImageResponse` in a fresh process SUCCEEDS even on a broken
@@ -0,0 +1,159 @@
+import { spawnSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterAll, beforeAll, describe, expect, it } from 'vitest';
+
+/**
+ * Regression guard for the civitai#4075 boot crash, and for the gate that catches it.
+ *
+ * WHAT BROKE. `output: 'standalone'` does not ship `node_modules`; it ships the subset
+ * @vercel/nft traced. nft resolves a bare specifier under the `require`/`default` conditions.
+ * Node (>= 22.10) additionally honours `module-sync` for a CJS `require`. When a package's
+ * `exports` map points those two at different files, the build traces one file and the running
+ * process asks for the other.
+ *
+ * Next's own `dist/shared/lib/constants.js` does
+ * `require('@swc/helpers/_/_interop_require_default')`, reached from the generated `server.js`
+ * via `next` -> `config.js` -> `constants.js`. On @swc/helpers 0.5.15 (next 16.3.0) that subpath
+ * exported only `{ import, default }` and both resolvers landed on
+ * `cjs/_interop_require_default.cjs`. 0.5.17+ added `module-sync` ->
+ * `esm/_interop_require_default.js`, and next 16.3.1 bumped its dependency to 0.5.23. The image
+ * therefore shipped `cjs/` only and every pod crash-looped with
+ * `MODULE_NOT_FOUND .../@swc/helpers/esm/_interop_require_default.js` before the first line of
+ * application code ran.
+ *
+ * 🔴 WHY NO SOURCE-LEVEL TEST COULD HAVE CAUGHT IT. The source tree was correct, the lockfile
+ * was correct, the build succeeded, and the unit suite, typecheck, ESLint and the compiled-branch
+ * gate were all green. The defect exists only in the file SET of the produced artefact. The only
+ * red signal was the deploy.
+ *
+ * WHAT THIS TEST PINS. Not the specific package — @swc/helpers is the instance, not the class,
+ * and naming it here would make this test rot on the next bump. It builds a miniature standalone
+ * tree that reproduces the MECHANISM (a `module-sync`/`default` split where only the `default`
+ * branch was "traced") and asserts that `scripts/ci/assert-standalone-boot-graph.mjs`:
+ *
+ *   - goes RED (exit 1) on it, naming the module that could not be found;
+ *   - goes GREEN (exit 0) on the same tree once the `module-sync` target is present;
+ *   - exits 2 — never 0 — when it cannot observe its input.
+ *
+ * The gate itself was additionally watched red and green against the real published PR image:
+ * `docker run --rm -v <script>:/probe.mjs --entrypoint node <image> /probe.mjs /app` exited 1 with
+ * this exact MODULE_NOT_FOUND on the broken image, and 0 on the same image with the missing
+ * `esm/` directory added and nothing else changed.
+ */
+
+const SCRIPT = join(process.cwd(), 'scripts/ci/assert-standalone-boot-graph.mjs');
+
+function run(...args: string[]) {
+  // spawnSync, not execFileSync: the latter throws on a non-zero exit, which is the outcome
+  // half these cases are asserting.
+  return spawnSync(process.execPath, [SCRIPT, ...args], { encoding: 'utf8' });
+}
+
+/**
+ * A miniature standalone tree: an entrypoint that requires one package, and a package whose
+ * `exports` map splits `module-sync` (what Node picks for a CJS require) from `default` (what
+ * the tracer picks). `traceModuleSync: false` is the shipped-image bug — the `default` branch is
+ * present, the `module-sync` branch is not.
+ */
+function makeTree(root: string, { traceModuleSync }: { traceModuleSync: boolean }) {
+  const pkg = join(root, 'node_modules', 'condition-split');
+  mkdirSync(join(pkg, 'cjs'), { recursive: true });
+  mkdirSync(join(pkg, 'esm'), { recursive: true });
+
+  writeFileSync(
+    join(pkg, 'package.json'),
+    JSON.stringify({
+      name: 'condition-split',
+      version: '1.0.0',
+      type: 'module',
+      exports: {
+        '.': {
+          'module-sync': './esm/index.js',
+          import: './esm/index.js',
+          default: './cjs/index.cjs',
+        },
+      },
+    })
+  );
+  writeFileSync(join(pkg, 'cjs', 'index.cjs'), 'exports._ = 1;\n');
+  if (traceModuleSync) writeFileSync(join(pkg, 'esm', 'index.js'), 'export const _ = 1;\n');
+
+  writeFileSync(
+    join(root, 'server.js'),
+    ["const path = require('path')", "require('condition-split')", 'console.log(path.sep)'].join(
+      '\n'
+    )
+  );
+}
+
+let dir: string;
+
+beforeAll(() => {
+  dir = mkdtempSync(join(tmpdir(), 'standalone-boot-graph-'));
+});
+
+afterAll(() => {
+  rmSync(dir, { recursive: true, force: true });
+});
+
+describe('scripts/ci/assert-standalone-boot-graph.mjs', () => {
+  it('is red when the module-sync target was not traced into the tree', () => {
+    const root = join(dir, 'broken');
+    makeTree(root, { traceModuleSync: false });
+
+    const res = run(root);
+
+    expect(res.status).toBe(1);
+    // The specific failure, not merely "something failed": a different defect passing this
+    // assertion would make the red arm meaningless.
+    expect(`${res.stdout}${res.stderr}`).toContain('MODULE_NOT_FOUND');
+    expect(`${res.stdout}${res.stderr}`).toContain('esm/index.js');
+    expect(res.stderr).toContain('does not load from');
+  });
+
+  it('is green on the same tree once the module-sync target is present', () => {
+    const root = join(dir, 'fixed');
+    makeTree(root, { traceModuleSync: true });
+
+    const res = run(root);
+
+    expect(res.stderr).toBe('');
+    expect(res.status).toBe(0);
+    // Positive control: it really loaded the package rather than skipping it.
+    expect(res.stdout).toContain('ok  condition-split');
+    expect(res.stdout).toContain('OK: all 1 entrypoint module(s) load');
+  });
+
+  it('never reports a builtin-only entrypoint as healthy', () => {
+    const root = join(dir, 'builtins-only');
+    mkdirSync(join(root, 'node_modules'), { recursive: true });
+    writeFileSync(join(root, 'server.js'), "const path = require('path')\nconsole.log(path.sep)\n");
+
+    const res = run(root);
+
+    // 2, not 0: a check with nothing to observe must not certify the artefact.
+    expect(res.status).toBe(2);
+    expect(res.stderr).toContain('cannot observe input');
+  });
+
+  it('exits 2 when the standalone root or entrypoint is absent', () => {
+    expect(run(join(dir, 'no-such-dir')).status).toBe(2);
+
+    const empty = join(dir, 'empty');
+    mkdirSync(empty, { recursive: true });
+    expect(run(empty).status).toBe(2);
+  });
+
+  it('exits 2 when nothing was traced into the tree at all', () => {
+    const root = join(dir, 'no-node-modules');
+    mkdirSync(root, { recursive: true });
+    writeFileSync(join(root, 'server.js'), "require('condition-split')\n");
+
+    const res = run(root);
+
+    expect(res.status).toBe(2);
+    expect(res.stderr).toContain('node_modules');
+  });
+});