perf: bundle analyzer + Server-Timing measurement rail (perf round 2, phase 0)

[BigSimmo]

Summary

Phase 0 (measurement/enablement) of the round-2 site-performance initiative — no behavior change, just the rails every later phase is measured against.

• Bundle analyzer: @next/bundle-analyzer (devDependency) behind ANALYZE=true, lazy-imported via an async config wrapper so pruned production runtimes never load it. npm run build:analyze wraps the normal webpack build cross-platform.
• Server-Timing headers on /api/answer and /api/search/universal, built from latency fields the pipeline already computes (answer.latencyTimings, per-domain latencyMs). Only short metric names and millisecond durations are emitted — no query text or user data crosses the trust boundary (sanitizer + unit tests included). The SSE stream route already ships latencyTimings inside its final event, so it needs no header.

Baseline (webpack prod build, this branch)

• Total client JS: 4795.4 KB raw / 1133.9 KB gzip across 178 chunks
• Chunk 2419 (337.1 KB raw / 88.2 KB gzip) contains the DocumentManagerPanel suite + SettingsDialog — the phase-1 split target
• Analyzer HTML + full chunk TSV captured out-of-tree for before/after comparison

Verification

• npm run verify:cheap: runtime/actions/sitemap/lint/typecheck green; vitest 1416 passed with 2 machine-load timeout flakes (public-access-deep, rag-classifier-memo) that fail identically on clean HEAD (5 tests fail there) — pre-existing, not introduced here
• New tests/server-timing.test.ts passes (header sanitization + mapping)
• Full production build succeeds with ANALYZE=true (report written to .next/analyze/)

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds reusable Server-Timing header utilities and integrates latency reporting into answer and universal-search APIs. Adds an optional bundle analyzer build command and conditional Next.js configuration, plus updates the production-readiness checklist runtime metadata.

Changes

Server timing instrumentation

Layer / File(s)	Summary
Server-Timing utilities and validation src/lib/server-timing.ts, tests/server-timing.test.ts	Defines typed timing entries, sanitizes and formats headers, maps answer latency fields, and tests validation, rounding, omission, and fallback behavior.
API response timing integration src/app/api/answer/route.ts, src/app/api/search/universal/route.ts	Adds elapsed route timing to answer responses and group/total timings to universal-search responses through optional Server-Timing headers.

Bundle analysis build tooling

Layer / File(s)	Summary
Optional bundle analyzer build flow next.config.ts, package.json, scripts/build-analyze.mjs, docs/production-readiness-checklist.md	Adds an ANALYZE=true build wrapper, conditionally applies @next/bundle-analyzer, registers its development dependency, and updates the documented Next.js target and review date.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant AnswerRoute
  participant ServerTiming
  participant NextResponse

  Client->>AnswerRoute: POST /api/answer
  AnswerRoute->>ServerTiming: latency timings and elapsed duration
  ServerTiming-->>AnswerRoute: sanitized Server-Timing header
  AnswerRoute->>NextResponse: answer JSON with optional header
  NextResponse-->>Client: response

Loading

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 2 warnings)

Check name	Status	Explanation	Resolution
Verification Claims	❌ Error	PR description has vague pass claims (“New tests/server-timing.test.ts passes”, “Full production build succeeds with ANALYZE=true”) instead of exact ran/passed wording.	Rewrite verification bullets as explicit “Ran : passed” or “Not run: reason” entries, e.g. “Ran npm run verify:cheap: passed”.
Description check	⚠️ Warning	It covers summary and verification, but omits the required Clinical Governance Preflight section for answer/search changes.	Add the Clinical Governance Preflight checklist and complete the required checkbox-based Verification section from the template.
Docstring Coverage	⚠️ Warning	Docstring coverage is 20.00% which is insufficient. The required threshold is 70.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (8 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the bundle-analyzer and Server-Timing performance infrastructure changes.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Generated And Sensitive Files	✅ Passed	Only expected source/docs changes and package-lock updates were found; no tracked secrets, .env, .next, build, cache, or browser artifacts.
Risky Git Or Deployment Actions	✅ Passed	Diff only updates runtime/date and adds analyzer/Server-Timing code; no force-push, hard reset, branch-deletion, destructive clean, or unconfirmed deployment guidance appears in changed files.
Supabase Project And Schema Safety	✅ Passed	Touched files only add headers/docs; Supabase target stays sjrfecxgysukkwxsowpy and there are no migrations, RLS, or policy changes.
Runtime And Package Manager Integrity	✅ Passed	Package manager stays npm with package-lock.json preserved; engine-strict remains enabled and Node 24/npm 11 requirements are unchanged.
Api Route Failure Handling	✅ Passed	Both touched API routes validate input, handle auth/rate limits, and return deterministic JSON errors; universal search also degrades per-domain failures via timeouts/allSettled.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/site-performance-speed-61d154

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch claude/site-performance-speed-61d154

---

_{Comment @coderabbitai help to get the list of available commands.}