@thomas.f/prnext 0.1.18-alpha → 0.1.20-alpha

package/runtime/og/upstream.json

@@ -0,0 +1,115 @@
+{
+  "schemaVersion": 1,
+  "name": "@vercel/og",
+  "inputs": {
+    "sourceSha256": "3269eb15ca135a0eb7e07ddf8af0b35711d6e75c56b84c6a6727c5626d59409c",
+    "packages": {
+      "@vercel/og": {
+        "version": "1.0.3",
+        "integrity": "sha512-/iYJ34PDu4lty1TXdL86qHEw8viveHTllG1PWLuJX8tSFfqKL7kyVJeUORJmQ250bHB0h+alcalXUlza3c/NSA=="
+      },
+      "fflate": {
+        "version": "0.7.5",
+        "integrity": "sha512-QieYf//cis6ywHNi5qW1+PXPQ4bC+XVJAtS4AXIML8P76GroEiOxm/oQtn1f02UkJY1+KsXMJcC+R2v/Eg4G3g=="
+      }
+    },
+    "components": [
+      {
+        "name": "@vercel/og",
+        "version": "1.0.3"
+      },
+      {
+        "name": "@resvg/resvg-wasm",
+        "version": "2.4.1"
+      },
+      {
+        "name": "@shuding/opentype.js",
+        "version": "1.4.0-beta.0"
+      },
+      {
+        "name": "base64-js",
+        "version": "0.0.8"
+      },
+      {
+        "name": "camelize",
+        "version": "1.0.1"
+      },
+      {
+        "name": "color-name",
+        "version": "1.1.4"
+      },
+      {
+        "name": "css-background-parser",
+        "version": "0.1.0"
+      },
+      {
+        "name": "css-box-shadow",
+        "version": "1.0.0-3"
+      },
+      {
+        "name": "css-color-keywords",
+        "version": "1.0.0"
+      },
+      {
+        "name": "css-gradient-parser",
+        "version": "0.0.17"
+      },
+      {
+        "name": "css-to-react-native",
+        "version": "3.2.0"
+      },
+      {
+        "name": "escape-html",
+        "version": "1.0.3"
+      },
+      {
+        "name": "fflate",
+        "version": "0.7.5"
+      },
+      {
+        "name": "harfbuzzjs",
+        "version": "0.10.0"
+      },
+      {
+        "name": "hex-rgb",
+        "version": "4.3.0"
+      },
+      {
+        "name": "linebreak",
+        "version": "1.1.0"
+      },
+      {
+        "name": "parse-css-color",
+        "version": "0.2.1"
+      },
+      {
+        "name": "postcss-value-parser",
+        "version": "4.2.0"
+      },
+      {
+        "name": "satori",
+        "version": "0.33.5"
+      },
+      {
+        "name": "tiny-inflate",
+        "version": "1.0.3"
+      },
+      {
+        "name": "unicode-trie",
+        "version": "2.0.0"
+      }
+    ]
+  },
+  "files": {
+    "Geist-Regular.ttf": "bde046ddd9f20be35b0bd56cc79eb752b967fb6661a3fe76cb067bb09f871d76",
+    "hb.wasm": "d2ab975172d6103e7624e8f7f03fea2316eca6fe562e1b80fc7f7058b283a6d0",
+    "index.node.mjs": "4fae6c6a5e3b6514b6a303bb2f9f5c945114aed0549724191a8ef127238e075b",
+    "LICENSE": "1f256ecad192880510e84ad60474eab7589218784b9a50bc7ceee34c2b91f1d5",
+    "LICENSE.fflate": "62249119bb7df6e54300f37a37145c26a6d4420410aac8881a119c5b427cf751",
+    "LICENSE.Geist": "c683bfbcc7e087f5d37a54ef628f10387c451a83ddc459b151403a164ac46c90",
+    "LICENSE.harfbuzzjs": "c85596583d1b7e4cfb4f21165ce0988aabd72e80a8c3a2ab6aaeedc1965e8288",
+    "LICENSE.satori": "1f256ecad192880510e84ad60474eab7589218784b9a50bc7ceee34c2b91f1d5",
+    "NOTICE.txt": "bcc9a8f06053c81502b72a618ca004794027ec85ae94d4bbe81890f7dcdb8ec8",
+    "resvg.wasm": "9c1f8f54b842fcda3b72b06eba94a20b907958c443d73178da32b21ccb57b9bb"
+  }
+}

package/runtime/persistent/client.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { initializeHome, rpc, delay, environment, validName, validHealthPath } from './common.mjs';
 import { resolveNativeBinary } from '../../native/resolve.mjs';
+import {nativeHealthPath} from './health.mjs';
 
 export const persistentHelp = `Persistent apps (ordinary prn start stays in the foreground):
   prn pstart [directory] [options]   Start a built app in the background
@@ -18,7 +19,8 @@ export const persistentHelp = `Persistent apps (ordinary prn start stays in the
 
 pstart options: --name NAME --port 3000 --hostname 127.0.0.1 --workers 1
   --profile balanced|speed|memory|classic --inspect
-  --health-path / --health-timeout 15000 --drain-timeout 30000 (milliseconds)
+  --health-path /api/health (optional application probe after the native readiness check)
+  --health-timeout 15000 --drain-timeout 30000 (milliseconds)
   --rollback-window 15000 (post-switch monitoring; 0 disables, maximum 120000 ms)
 prestart/pstop/plogs default to the app in the current directory.
 plogs options: --lines 100 --follow. App environment comes from its .env files.
@@ -157,7 +159,7 @@ export async function persistentCommand(command, argv) {
   if (command === 'pstart') {
     const root = await realpath(path.resolve(target || '.'));
     const name = validName(options.name || path.basename(root).replace(/[^a-zA-Z0-9_-]/g, '-').replace(/^[^a-zA-Z0-9]+/, '').slice(0, 64));
-    request = { command: 'start', config: { name, root, binary: await resolveNativeBinary(), node: process.execPath, port: options.port || 3000, hostname: options.hostname || '127.0.0.1', workers: options.workers || 1, profile: options.profile || process.env.PRNEXT_PROFILE || 'balanced', inspect: !!options.inspect, healthPath: options['health-path'] || '/', healthTimeout: options['health-timeout'] || 15000, drainTimeout: options['drain-timeout'] || 30000, rollbackWindow: options['rollback-window'] ?? 15000 } };
+    request = { command: 'start', config: { name, root, binary: await resolveNativeBinary(), node: process.execPath, port: options.port || 3000, hostname: options.hostname || '127.0.0.1', workers: options.workers || 1, profile: options.profile || process.env.PRNEXT_PROFILE || 'balanced', inspect: !!options.inspect, healthPath: options['health-path'] || nativeHealthPath, healthTimeout: options['health-timeout'] || 15000, drainTimeout: options['drain-timeout'] || 30000, rollbackWindow: options['rollback-window'] ?? 15000 } };
   } else request = { command: ({ prestart: 'restart', pstop: 'stop', pdelete: 'delete' })[command], name: target, all: !!options.all, root: target || options.all ? undefined : await realpath(process.cwd()) };
   await ensure(connection);
   const report = await rpc(connection, request);

package/runtime/persistent/daemon.mjs

@@ -1,5 +1,4 @@
 import { spawn } from 'node:child_process';
-import { request } from 'node:http';
 import { cp, mkdir, readFile, rm, realpath } from 'node:fs/promises';
 import { randomUUID, createHash } from 'node:crypto';
 import path from 'node:path';
@@ -7,6 +6,8 @@ import { readBuildDirectory } from '../build-directory.mjs';
 import { atomicJSON, delay, environment, validName, validHealthPath } from './common.mjs';
 import { RotatingLog } from './logger.mjs';
 import {nativeGateway,stopNativeProxy} from './native-proxy.mjs';
+import {health} from './health.mjs';
+import {productionEnvironment} from '../env.mjs';
 
 const home = process.argv[2];
 const registry = path.join(home, 'apps.json');
@@ -78,15 +79,6 @@ async function snapshot(app) {
     return { relative, buildId: manifest.buildId || null };
   } catch (error) { await removeSnapshot(app, relative); throw error; }
 }
-function health(generation, config, timeout) {
-  return new Promise((resolve, reject) => {
-    const req = request({ host: '127.0.0.1', port: generation.port, path: config.healthPath, method: 'GET', headers: { host: `${config.hostname.includes(':') ? '[' + config.hostname + ']' : config.hostname}:${config.port}` }, signal: AbortSignal.timeout(timeout) }, res => {
-      const ok = res.statusCode >= 200 && res.statusCode < 400;
-      res.destroy(); ok ? resolve() : reject(new Error(`Health check ${config.healthPath} returned HTTP ${res.statusCode}`));
-    });
-    req.once('error', reject); req.end();
-  });
-}
 async function stopGeneration(app, generation, drain = true) {
   if (generation.stopping) return generation.stopping;
   generation.expected = true;
@@ -123,7 +115,7 @@ async function launch(app) {
   const build = await snapshot(app);
   const child = spawn(config.binary, ['start', config.root, '--build-dir', build.relative, '--hostname', '127.0.0.1', '--port', '0', '--node', config.node, '--workers', String(config.workers), '--profile', config.profile, '--shutdown-on-stdin-eof'], {
     cwd: config.root, windowsHide: true, detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'],
-    env: { ...environment(), NODE_ENV: 'production', ...(config.inspect ? { PRNEXT_INSPECT_DIR: path.join(config.root, '.prnext-cache/inspect') } : {}) },
+    env: { ...productionEnvironment(config.root,{env:{...environment(),NODE_ENV:'production'}}), ...(config.inspect ? { PRNEXT_INSPECT_DIR: path.join(config.root, '.prnext-cache/inspect') } : {}) },
   });
   child.stdin.on('error', () => {});
   const generation = { child, ...build, active: 0, dead: false, expected: false, port: null, startedAt: Date.now() };

package/runtime/persistent/health.mjs

@@ -0,0 +1,58 @@
+import {request} from 'node:http';
+
+export const nativeHealthPath = '/_prnext/health';
+const nativeLimit = 4096, applicationLimit = 65536;
+
+// Connect directly to the private generation. A redirect, partial response or
+// open-ended body cannot certify that a process is ready to receive traffic.
+function probe(generation, config, healthPath, timeout, native) {
+  return new Promise((resolve, reject) => {
+    let finished = false, response;
+    const finish = error => {
+      if (finished) return;
+      finished = true;
+      if (error) { response?.destroy(); req.destroy(); reject(error); }
+      else resolve();
+    };
+    const req = request({host:'127.0.0.1', port:generation.port, path:healthPath,
+      method:'GET', headers:{host:`${config.hostname.includes(':')?'['+config.hostname+']':config.hostname}:${config.port}`, accept:'application/json', 'accept-encoding':'identity', connection:'close'},
+      signal:AbortSignal.timeout(Math.max(1, timeout))}, res => {
+      response = res;
+      if (res.statusCode !== 200) return finish(new Error(`Health check ${healthPath} returned HTTP ${res.statusCode}`));
+      if (res.headers['content-encoding'] && res.headers['content-encoding'] !== 'identity') return finish(new Error(`Health check ${healthPath} returned an encoded body`));
+      const limit = native ? nativeLimit : applicationLimit;
+      const declared = res.headers['content-length'];
+      if (declared !== undefined && (!/^\d+$/.test(declared) || Number(declared) > limit)) return finish(new Error(`Health check ${healthPath} body exceeds ${limit} bytes`));
+      const chunks = []; let size = 0;
+      res.on('data', chunk => {
+        size += chunk.length;
+        if (size > limit) return finish(new Error(`Health check ${healthPath} body exceeds ${limit} bytes`));
+        if (native) chunks.push(chunk);
+      });
+      res.once('error', finish);
+      res.once('aborted', () => finish(new Error(`Health check ${healthPath} response was incomplete`)));
+      res.once('end', () => {
+        if (!res.complete) return finish(new Error(`Health check ${healthPath} response was incomplete`));
+        if (native) {
+          if (!/^application\/json(?:\s*;|$)/i.test(res.headers['content-type'] || '')) return finish(new Error(`Health check ${healthPath} must return application/json`));
+          let body;
+          try { body = JSON.parse(Buffer.concat(chunks, size).toString('utf8')); } catch { return finish(new Error(`Health check ${healthPath} returned invalid JSON`)); }
+          if (!body || Array.isArray(body) || body.schemaVersion !== 1 || body.status !== 'ready') return finish(new Error(`Health check ${healthPath} did not report ready`));
+          if (body.buildId !== undefined && generation.buildId && body.buildId !== generation.buildId) return finish(new Error(`Health check ${healthPath} returned a different build`));
+        }
+        finish();
+      });
+    });
+    req.once('error', finish); req.end();
+  });
+}
+
+export async function health(generation, config, timeout) {
+  const deadline = Date.now() + timeout;
+  await probe(generation, config, nativeHealthPath, timeout, true);
+  if (config.healthPath !== nativeHealthPath) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error('Application health check exceeded its deadline');
+    await probe(generation, config, config.healthPath, remaining, false);
+  }
+}

package/runtime/project-lock.mjs

@@ -0,0 +1,71 @@
+import { mkdir, writeFile, rename, rm, realpath, lstat, open } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import path from 'node:path';
+
+const LOCK = '.prnext-build.lock';
+const busy = message => Object.assign(new Error(message), { code: 'PRNEXT_BUILD_LOCKED' });
+function alive(pid) {
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error.code !== 'ESRCH'; }
+}
+async function owner(directory) {
+  const info = await lstat(directory);
+  if (!info.isDirectory() || info.isSymbolicLink()) throw busy(`The project lock is not a real directory. Check ${path.basename(directory)} before retrying.`);
+  const file = await open(path.join(directory, 'owner.json'), 'r');
+  try {
+    if ((await file.stat()).size > 4096) throw new Error('oversized owner');
+    const value = JSON.parse(await file.readFile('utf8'));
+    if (!Number.isSafeInteger(value.pid) || value.pid < 1 || typeof value.host !== 'string' || !/^[a-f0-9-]{36}$/.test(value.token)) throw new Error('invalid owner');
+    return value;
+  } finally { await file.close(); }
+}
+
+/** One publisher per canonical project, covering React and direct static imports. */
+export async function withBuildLock(directory, action, {development = false} = {}) {
+  const root = await realpath(directory), lock = path.join(root, development ? '.prnext-dev.lock' : LOCK);
+  const identity = { pid: process.pid, host: hostname(), token: randomUUID(), createdAt: new Date().toISOString() };
+  const prepared = path.join(root, `.prnext-lock-${identity.token}`);
+  await mkdir(prepared, { mode: 0o700 });
+  try {
+    await writeFile(path.join(prepared, 'owner.json'), JSON.stringify(identity), { flag: 'wx', mode: 0o600 });
+    for (let attempt = 0; ; attempt++) {
+      try { await rename(prepared, lock); break; }
+      catch (error) {
+        if (!['EEXIST', 'ENOTEMPTY', 'EPERM', 'EACCES'].includes(error.code)) throw error;
+        let previous;
+        try { previous = await owner(lock); }
+        catch (cause) {
+          if (cause.code === 'ENOENT' && attempt < 8) continue;
+          throw busy(`Cannot verify the project lock. Check ${path.basename(lock)} before retrying.`);
+        }
+        if (previous.host !== identity.host || alive(previous.pid)) throw busy(development ? `A development server is already running for this project (PID ${previous.pid}). Stop it before starting another.` : `A build is already running for this project (PID ${previous.pid}). Wait for it to finish.`);
+        // Exactly one contender can recover this generation. Never delete a lock
+        // merely because it is old: long builds and suspended processes are valid.
+        let claim;
+        try { claim = await open(path.join(lock, 'recovery'), 'wx', 0o600); }
+        catch (cause) {
+          if (cause.code === 'ENOENT' && attempt < 8) continue;
+          throw busy(`Project lock recovery is in progress. Retry shortly; if recovery was interrupted, check ${path.basename(lock)} manually.`);
+        }
+        const retired = path.join(root, `.prnext-lock-retired-${identity.token}`);
+        try {
+          await claim.writeFile(JSON.stringify(identity)); await claim.close(); claim = null;
+          const current = await owner(lock);
+          if (current.token !== previous.token) {
+            // Do not unlink through this path: the new owner can release and
+            // another generation can appear between our read and the unlink.
+            throw busy('The build lock changed during recovery. Retry the build.');
+          }
+          await rename(lock, retired);
+          await rm(retired, { recursive: true });
+        } finally { await claim?.close(); }
+      }
+    }
+    try { return await action(root); }
+    finally {
+      // Ownership must still match before releasing a lock.
+      if ((await owner(lock)).token === identity.token) await rm(lock, { recursive: true });
+    }
+  } finally { await rm(prepared, { recursive: true, force: true }); }
+}

package/runtime/request-transport.mjs

@@ -1,41 +1,121 @@
 const MAX_HEADER = 256 * 1024;
 const MAX_BODY = 32 * 1024 * 1024;
+export const REQUEST_BODY_CHUNK = 64 * 1024;
 const EMPTY_BODY = Buffer.alloc(0);
+export const requestBodyState = Symbol('PRNext request body state');
 
-// Awaiting the consumer preserves socket backpressure. At most one body is
-// assembled, and binary bytes never pass through JSON strings or base64.
-export async function* requestFrames(source, { authenticate } = {}) {
-  let fragments = [], size = 0, input, body, offset = 0;
-  for await (const chunk of source) {
-    let cursor = 0;
-    while (cursor < chunk.length) {
-      if (body) {
-        const length = Math.min(body.length - offset, chunk.length - cursor);
-        chunk.copy(body, offset, cursor, cursor + length);
-        cursor += length; offset += length;
-        if (offset !== body.length) continue;
-        input.body = body; body = undefined; offset = 0;
-        yield input; input = undefined;
-        continue;
+// One owner reads a lane. Streaming bodies borrow this reader until their
+// invocation finishes; body bytes are never parsed as request metadata.
+function laneReader(source) {
+  const iterator = source[Symbol.asyncIterator]?.() || source[Symbol.iterator]();
+  let chunk = EMPTY_BODY, offset = 0, ended = false;
+  async function available() {
+    while (offset === chunk.length && !ended) {
+      const next = await iterator.next(); ended = !!next.done;
+      chunk = ended ? EMPTY_BODY : next.value; offset = 0;
+      if (!Buffer.isBuffer(chunk)) chunk = Buffer.from(chunk);
+    }
+    return !ended;
+  }
+  return {
+    async line(limit) {
+      const parts = []; let size = 0;
+      while (await available()) {
+        const end = chunk.indexOf(10, offset), stop = end < 0 ? chunk.length : end;
+        const part = chunk.subarray(offset, stop); size += part.length;
+        if (size > limit) throw new Error('Request transport header exceeds limit');
+        parts.push(part); offset = end < 0 ? stop : end + 1;
+        if (end >= 0) return (parts.length === 1 ? parts[0] : Buffer.concat(parts, size)).toString();
+      }
+      if (size) throw new Error('Truncated request transport header');
+      return undefined;
+    },
+    async exact(length) {
+      if (length === 0) return EMPTY_BODY;
+      const result = Buffer.allocUnsafe(length); let written = 0;
+      while (written < length) {
+        if (!await available()) throw new Error('Truncated request transport body');
+        const count = Math.min(length - written, chunk.length - offset);
+        chunk.copy(result, written, offset, offset + count); written += count; offset += count;
       }
-      const end = chunk.indexOf(10, cursor);
-      const part = chunk.subarray(cursor, end < 0 ? chunk.length : end);
-      size += part.length;
-      if (size > (authenticate ? 256 : MAX_HEADER)) throw new Error('Request transport header exceeds limit');
-      fragments.push(part);
-      cursor = end < 0 ? chunk.length : end + 1;
-      if (end < 0) continue;
-      const line = fragments.length === 1 ? part.toString() : Buffer.concat(fragments, size).toString();
-      fragments = []; size = 0;
-      if (authenticate) { authenticate(line); authenticate = undefined; continue; }
-      if (!line.trim()) continue;
-      input = JSON.parse(line);
-      if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Invalid request frame');
-      if (input.bodyLength === undefined) { yield input; input = undefined; continue; }
+      return result;
+    },
+    destroy() { source.destroy?.(); },
+  };
+}
+
+function streamingBody(reader, input, credit) {
+  const descriptor = input.bodyStream;
+  if (!descriptor || descriptor.version !== 1 || Object.keys(descriptor).some(key => !['version', 'length', 'maxBytes'].includes(key)) ||
+      descriptor.maxBytes !== MAX_BODY || !(descriptor.length === null || Number.isSafeInteger(descriptor.length) && descriptor.length >= 0 && descriptor.length <= MAX_BODY) ||
+      input.bodyLength !== undefined || input.body !== undefined || !Number.isSafeInteger(input.id) || input.id < 1 || ['GET', 'HEAD'].includes(input.method)) {
+    throw new Error('Invalid streaming request descriptor');
+  }
+  let controller, complete = false, total = 0, cancelled = false;
+  const state = { get complete() { return complete; }, get bytes() { return total; }, cancel() {
+    if (complete || cancelled) return;
+    cancelled = true;
+    try { controller?.error(new Error('Request body transport cancelled')); } catch {}
+    reader.destroy();
+  } };
+  const body = new ReadableStream({
+    start(value) { controller = value; },
+    async pull(value) {
+      try {
+        // A single explicit credit authorizes one frame. No speculative read
+        // consumes an upload while the application is not reading.
+        await credit({ id: input.id, type: 'bodycredit', length: REQUEST_BODY_CHUNK });
+        const header = await reader.exact(4), length = header.readUInt32BE();
+        if (length === 0xffffffff) {
+          const code = (await reader.exact(1))[0];
+          const kinds = { 1: ['PRNEXT_BODY_LIMIT', 413], 2: ['PRNEXT_BODY_TIMEOUT', 408], 3: ['PRNEXT_BODY_READ', 400], 4: ['PRNEXT_BODY_LENGTH', 400] };
+          if (!kinds[code]) throw new Error('Invalid request body error frame');
+          throw Object.assign(new Error('Request body transport failed'), { code: kinds[code][0], statusCode: kinds[code][1] });
+        }
+        if (length === 0) {
+          if (descriptor.length !== null && total !== descriptor.length) throw new Error('Request body length mismatch');
+          complete = true; value.close(); return;
+        }
+        if (length > REQUEST_BODY_CHUNK || total + length > MAX_BODY || descriptor.length !== null && total + length > descriptor.length) throw new Error('Request body exceeds its transport budget');
+        const bytes = await reader.exact(length); total += bytes.length; value.enqueue(bytes);
+      } catch (error) {
+        if (cancelled) return;
+        value.error(error);
+        if (!/^PRNEXT_BODY_(LIMIT|TIMEOUT|READ|LENGTH)$/.test(error.code || '')) reader.destroy();
+      }
+    },
+    async cancel() { cancelled = true; await credit({ id: input.id, type: 'bodycancel' }); },
+  }, { highWaterMark: 0 });
+  Object.defineProperty(input, requestBodyState, { value: state });
+  return body;
+}
+
+export async function* requestFrames(source, { authenticate, streamBodies = false, credit } = {}) {
+  const reader = laneReader(source);
+  if (authenticate) {
+    const token = await reader.line(256);
+    if (token === undefined) throw new Error('Truncated request authentication');
+    authenticate(token);
+  }
+  for (;;) {
+    const line = await reader.line(MAX_HEADER);
+    if (line === undefined) return;
+    if (!line.trim()) continue;
+    const input = JSON.parse(line);
+    if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Invalid request frame');
+    if (input.bodyStream !== undefined) {
+      if (!authenticate || !streamBodies || typeof credit !== 'function') throw new Error('Streaming request protocol was not negotiated');
+      input.body = streamingBody(reader, input, credit);
+      try { yield input; }
+      finally { input[requestBodyState].cancel(); }
+      // Streaming upload lanes are single-use: an early response cannot turn
+      // unread upload bytes into another request. The Node host stays warm.
+      return;
+    }
+    if (input.bodyLength !== undefined) {
       if (!Number.isSafeInteger(input.bodyLength) || input.bodyLength < 0 || input.bodyLength > MAX_BODY) throw new Error('Invalid request body length');
-      if (input.bodyLength === 0) { input.body = EMPTY_BODY; yield input; input = undefined; }
-      else body = Buffer.allocUnsafe(input.bodyLength);
+      input.body = await reader.exact(input.bodyLength);
     }
+    yield input;
   }
-  if (size || body || authenticate) throw new Error('Truncated request transport frame');
 }

package/runtime/storage-path.mjs

@@ -0,0 +1,36 @@
+import {lstat, realpath} from 'node:fs/promises';
+import path from 'node:path';
+
+const normalized = filename => process.platform === 'win32' ? path.resolve(filename).toLowerCase() : path.resolve(filename);
+export const sameStoragePath = (left, right) => normalized(left) === normalized(right);
+const ordinary = info => info?.isDirectory() && !info.isSymbolicLink();
+const identity = (left, right) => left.dev === right.dev && left.ino === right.ino && left.birthtimeMs === right.birthtimeMs;
+
+/** Callers supply canonical roots and explicit descendants, never glob results. */
+export async function captureStorageDirectory(directory) {
+  try {
+    directory = path.resolve(directory);
+    const info = await lstat(directory);
+    if (!ordinary(info) || !sameStoragePath(await realpath(directory), directory)) return null;
+    const current = await lstat(directory);
+    if (!ordinary(current) || !identity(info, current)) return null;
+    return {directory, dev: info.dev, ino: info.ino, birthtimeMs: info.birthtimeMs};
+  } catch { return null; }
+}
+
+/** Recheck ancestors around each filesystem operation. Node does not expose an
+ * atomic openat/unlinkat boundary: these guards reject observed replacements,
+ * but are not isolation from a malicious process with the same filesystem rights. */
+export async function verifyStorageDirectories(snapshots) {
+  if (!Array.isArray(snapshots) || !snapshots.length) return false;
+  for (const snapshot of snapshots) {
+    if (!snapshot) return false;
+    try {
+      const info = await lstat(snapshot.directory);
+      if (!ordinary(info) || !identity(info, snapshot) || !sameStoragePath(await realpath(snapshot.directory), snapshot.directory)) return false;
+      const current = await lstat(snapshot.directory);
+      if (!ordinary(current) || !identity(current, snapshot)) return false;
+    } catch { return false; }
+  }
+  return true;
+}

package/runtime/trace.mjs

@@ -2,6 +2,7 @@ import {isControlError} from './navigation.mjs';
 import {AsyncLocalStorage} from 'node:async_hooks';
 import {randomBytes} from 'node:crypto';
 import {createRequire} from 'node:module';
+import {channel} from 'node:diagnostics_channel';
 const scope=new AsyncLocalStorage(),rawFetch=globalThis.fetch;
 let api;
 try{api=createRequire(import.meta.url)('@opentelemetry/api');}catch{}
@@ -9,6 +10,17 @@ const endpoint=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT||(process.env.OTEL
 const protocol=process.env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL||process.env.OTEL_EXPORTER_OTLP_PROTOCOL;
 const enabled=process.env.OTEL_SDK_DISABLED!=='true'&&endpoint&&(!protocol||protocol==='http/json');
 const queue=[];let timer,flushing;
+const diagnostics=channel('prnext.telemetry');
+const counters={droppedSpans:0,rejectedSpans:0,exportAttempts:0,exportFailures:0,failedBatches:0,exportedSpans:0};
+let lastWarning=-Infinity;
+export function telemetryDiagnostics(){return {enabled:!!enabled,queuedSpans:queue.length,...counters};}
+function notify(reason){
+  const snapshot=telemetryDiagnostics();
+  // This local channel and fixed-field warning never pass through the exporter.
+  // No collector URL, headers, exception or request attributes are included.
+  if(diagnostics.hasSubscribers)diagnostics.publish({reason,...snapshot});
+  if(reason!=='exported'&&Date.now()-lastWarning>=10000){lastWarning=Date.now();try{console.error('[prnext] telemetry '+JSON.stringify({reason,...snapshot}));}catch{}}
+}
 const epoch=BigInt(Date.now())*1000000n-process.hrtime.bigint();
 const nanos=()=>String(epoch+process.hrtime.bigint());
 export function parseTraceparent(value){
@@ -23,9 +35,25 @@ export function propagatedFetch(input,init){
   return [input,{...init,headers}];
 }
 function enqueue(span){
-  if(!enabled||!span.flags||queue.length>=1024)return;
+  if(!enabled||!span.flags)return;
+  if(queue.length>=1024){counters.droppedSpans++;notify('queue_full');return;}
   queue.push(span);if(!timer)timer=setTimeout(()=>{timer=undefined;void flushTraces();},200).unref();
 }
+async function collectorResult(response,count){
+  const reader=response.body?.getReader();if(!reader)return {rejected:0,warning:false};
+  const chunks=[];let size=0;
+  try{while(true){const {done,value}=await reader.read();if(done)break;size+=value.byteLength;if(size>16384)throw Error('collector response too large');chunks.push(value);}}
+  catch(error){await reader.cancel().catch(()=>{});throw error;}finally{reader.releaseLock();}
+  const body=size?JSON.parse(Buffer.concat(chunks,size).toString('utf8')):{};
+  if(!body||typeof body!=='object'||Array.isArray(body))throw Error('invalid collector response');
+  const partial=body.partialSuccess??body.partial_success;if(partial==null)return {rejected:0,warning:false};
+  if(typeof partial!=='object'||Array.isArray(partial))throw Error('invalid collector partial success');
+  const raw=partial.rejectedSpans??partial.rejected_spans??0;
+  if(typeof raw!=='number'&&!(typeof raw==='string'&&/^\d{1,20}$/.test(raw)))throw Error('invalid collector rejection count');
+  const rejected=Number(raw);
+  if(!Number.isSafeInteger(rejected)||rejected<0||rejected>count)throw Error('invalid collector rejection count');
+  return {rejected,warning:typeof(partial.errorMessage??partial.error_message)==='string'&&!!(partial.errorMessage??partial.error_message)};
+}
 export async function flushTraces(){
   if(flushing)return flushing;
   if(!queue.length)return;
@@ -36,15 +64,27 @@ export async function flushTraces(){
   const spans=queue.splice(0,128);
   flushing=(async()=>{
     const body=JSON.stringify({resourceSpans:[{resource:{attributes:[{key:'service.name',value:{stringValue:process.env.OTEL_SERVICE_NAME||'prnext'}}]},scopeSpans:[{scope:{name:'prnext.runtime'},spans}]}]});
+    let exported=false;
     for(let attempt=0;attempt<3;attempt++){
-      let retry=false;
+      let retry=false,receivedSuccess=false,accepted;
+      counters.exportAttempts++;
       try{
         const response=await rawFetch(endpoint,{method:'POST',redirect:'error',headers,body,signal:AbortSignal.timeout(1000)});
-        retry=[429,502,503,504].includes(response.status);await response.body?.cancel();
-      }catch{retry=true;} // Telemetry failure never changes an application response.
+        receivedSuccess=response.ok;
+        if(receivedSuccess)accepted=await collectorResult(response,spans.length);
+        else{retry=[429,502,503,504].includes(response.status);await response.body?.cancel();}
+      }catch{retry=!receivedSuccess;} // Never replay a successful/partial acknowledgement.
+      if(accepted){
+        exported=true;counters.exportedSpans+=spans.length-accepted.rejected;
+        if(accepted.rejected){counters.rejectedSpans+=accepted.rejected;counters.droppedSpans+=accepted.rejected;counters.exportFailures++;counters.failedBatches++;notify('collector_rejected');}
+        else notify(accepted.warning?'collector_warning':'exported');
+        break;
+      }
+      counters.exportFailures++;
       if(!retry)break;
       if(attempt<2)await new Promise(resolve=>setTimeout(resolve,100*2**attempt).unref());
     }
+    if(!exported){counters.failedBatches++;counters.droppedSpans+=spans.length;notify('export_failed');}
   })().finally(()=>{flushing=undefined;if(queue.length&&!timer)timer=setTimeout(()=>{timer=undefined;void flushTraces();},200).unref();});
   return flushing;
 }

package/runtime/worker.mjs

@@ -142,6 +142,9 @@ async function handleRequest(input, output, signalController, responseComplete,
       ? { ...manifest.middleware, id: '__prnext_middleware', kind: 'middleware' }
       : routes.get(input.routeId);
     if (!route) { await output(input.id, { status: 404, body: 'Not Found' }, input); return; }
+    if (input.bodyStream && (route.router !== 'app' || route.kind !== 'api' || input.renderMode || !manifest.config?.streamingRequestBodies)) {
+      throw new Error('Streaming request bodies require an enabled App Route Handler');
+    }
     const sourceModules=!production&&route.router==='app'&&route.kind==='page'?advancedRoutingSources({...input,basePath:manifest.config?.basePath||''},manifest.routes):[];
     const deferredSources=sourceModules.length?manifest.routes.filter(candidate=>candidate.devDeferred&&sourceModules.includes(candidate.module)).map(candidate=>candidate.pattern):[];
     if(route.devDeferred||deferredSources.length){
@@ -197,7 +200,9 @@ async function handleRequest(input, output, signalController, responseComplete,
     // The application's scope was aborted above, but the lane is still valid
     // for its one error/redirect response. Do not mistake that cleanup signal
     // for a client disconnect while writing the replacement headers.
-    await output(input?.id ?? null, navigationResponse(error) || errorResponse(error, production), { ...input, production });
+    const ingressFailure = /^PRNEXT_BODY_(LIMIT|TIMEOUT|READ|LENGTH)$/.test(error?.code || '')
+      ? { status: error.statusCode, headers: { 'content-type': 'text/plain; charset=utf-8' }, body: 'Request body transport failed' } : undefined;
+    await output(input?.id ?? null, ingressFailure || navigationResponse(error) || errorResponse(error, production), { ...input, production });
     responseComplete?.();
   } finally {
     if (finalizers.size) {
@@ -261,7 +266,7 @@ if (token && laneLimit > 1) {
           const candidate = Buffer.from(line);
           if (candidate.length !== expected.length || !timingSafeEqual(candidate, expected)) throw new Error('Worker authentication failed');
           clearTimeout(authTimer); socket.write('ready\n');
-        } })) {
+        }, streamBodies: true, credit: frame => new Promise((resolve, reject) => socket.write(JSON.stringify(frame) + '\n', error => error ? reject(error) : resolve())) })) {
           if (invocations.size >= laneLimit) throw new Error('Worker invocation capacity exceeded');
           controller = new AbortController();
           const active = controller;
@@ -339,10 +344,10 @@ if (token && laneLimit > 1) {
   });
   server.listen(0, '127.0.0.1', () => {
     if(!production&&typeof globalThis.__PRNEXT_DEV_WORKER_READY__==='function'){
-      globalThis.__PRNEXT_DEV_WORKER_READY__({port:server.address().port,binary:true,gracefulShutdown:true});
+      globalThis.__PRNEXT_DEV_WORKER_READY__({port:server.address().port,binary:true,gracefulShutdown:true,requestBodyStream:1});
       delete globalThis.__PRNEXT_DEV_WORKER_READY__;
     }
-    writeProtocol(JSON.stringify({ port: server.address().port, binary: true, heartbeat: true, activity: reportActivity, gracefulShutdown: true }) + '\n');
+    writeProtocol(JSON.stringify({ port: server.address().port, binary: true, heartbeat: true, activity: reportActivity, gracefulShutdown: true, requestBodyStream: 1 }) + '\n');
     heartbeat = setInterval(() => {
       // Coalesce the idle transition with the existing heartbeat. Normal
       // request completion adds no stdout messages, and short cache bursts

package/vendor/fontkit/NOTICE.txt

@@ -0,0 +1,5 @@
+Fontkit 2.0.4 Node create() bundle, generated by scripts/prepare-fontkit.mjs.
+Upstream: https://github.com/foliojs/fontkit
+The original code is bundled/minified without patches. Source copyright notices, dependency licenses, README license declarations and exact versions/integrities are retained alongside it.
+fontkit, dfa and brotli declare MIT in their package metadata/README and publish no separate license file. brotli also contains Google Apache-2.0 source notices, retained in SOURCE-NOTICES.txt; the Apache-2.0 text is included with @swc/helpers.
+Use upstream.json to audit/update this bundled dependency when security fixes are released.