@thomas.f/prnext 0.1.18-alpha → 0.1.20-alpha

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thomas.f/prnext",
-  "version": "0.1.18-alpha",
+  "version": "0.1.20-alpha",
   "license": "MIT",
   "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
   "homepage": "https://prnext.dev",
@@ -41,7 +41,8 @@
     "runtime/",
     "compat/",
     "native/",
-    "release/"
+    "release/",
+    "vendor/"
   ],
   "scripts": {
     "prepublishOnly": "node release/verify.mjs"
@@ -133,18 +134,27 @@
     "@babel/types": "^7.29.0",
     "@edge-runtime/vm": "5.0.0",
     "@jridgewell/trace-mapping": "0.3.31",
-    "@vercel/nft": "1.11.0",
+    "@mapbox/node-pre-gyp": "2.0.3",
+    "@rollup/pluginutils": "5.4.0",
+    "acorn": "8.18.0",
+    "acorn-import-attributes": "1.9.5",
+    "async-sema": "3.1.1",
     "babel-plugin-react-compiler": "1.0.0",
+    "bindings": "1.5.0",
     "browserslist": "4.29.0",
     "dotenv": "16.6.1",
     "dotenv-expand": "11.0.7",
     "esbuild": "^0.28.2",
-    "fontkit": "2.0.4",
+    "estree-walker": "2.0.2",
     "get-tsconfig": "4.14.3",
+    "glob": "14.0.2",
+    "graceful-fs": "4.2.11",
     "html-to-image": "1.11.13",
     "jsonc-parser": "3.3.1",
     "lightningcss": "1.31.0",
     "loader-runner": "4.3.2",
+    "minimatch": "11.0.1",
+    "node-gyp-build": "4.8.4",
     "oxc-parser": "0.155.0",
     "path-to-regexp": "6.3.0",
     "picomatch": "4.0.7",
@@ -154,6 +164,7 @@
     "postcss-selector-parser": "7.1.6",
     "postcss-value-parser": "4.2.0",
     "react-refresh": "0.19.0",
+    "resolve-from": "5.0.0",
     "schema-utils": "4.3.3",
     "webpack": "5.111.1"
   },
@@ -161,20 +172,24 @@
     "@redis/client": "^6.3.0",
     "react": "19.3.1",
     "react-dom": "19.3.1",
-    "react-server-dom-webpack": "19.3.1"
+    "react-server-dom-webpack": "19.3.1",
+    "oxc-transform-react": "0.157.0"
   },
   "peerDependenciesMeta": {
     "@redis/client": {
       "optional": true
+    },
+    "oxc-transform-react": {
+      "optional": true
     }
   },
   "optionalDependencies": {
-    "prnext-darwin-arm64": "0.1.18-alpha",
-    "prnext-darwin-x64": "0.1.18-alpha",
-    "prnext-linux-arm64-gnu": "0.1.18-alpha",
-    "prnext-linux-x64-gnu": "0.1.18-alpha",
-    "@thomas.f/prnext-win32-x64-msvc": "0.1.18-alpha",
-    "@thomas.f/prnext-win32-arm64-msvc": "0.1.18-alpha"
+    "prnext-darwin-arm64": "0.1.20-alpha",
+    "prnext-darwin-x64": "0.1.20-alpha",
+    "prnext-linux-arm64-gnu": "0.1.20-alpha",
+    "prnext-linux-x64-gnu": "0.1.20-alpha",
+    "@thomas.f/prnext-win32-x64-msvc": "0.1.20-alpha",
+    "@thomas.f/prnext-win32-arm64-msvc": "0.1.20-alpha"
   },
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"

package/release/fontkit.mjs

@@ -0,0 +1,31 @@
+import {createHash} from 'node:crypto';
+import {readFile, readdir} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const destination = fileURLToPath(new URL('../vendor/fontkit/', import.meta.url));
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+
+/** Validate the shipped inventory without loading fontkit or its build dependencies. */
+export async function verifyVendoredFontkit(directory = destination) {
+  const provenance = JSON.parse(await readFile(path.join(directory, 'upstream.json'), 'utf8'));
+  if (provenance.schemaVersion !== 1 || provenance.name !== 'fontkit' || provenance.version !== '2.0.4'
+      || provenance.tool?.name !== 'esbuild' || !provenance.files?.['index.mjs']
+      || !provenance.files?.['NOTICE.txt'] || !provenance.files?.['SOURCE-NOTICES.txt']
+      || !provenance.packages?.fontkit || !provenance.packages?.brotli) throw new Error('Incomplete fontkit provenance.');
+  const actual = [];
+  async function visit(directory, prefix = '') {
+    for (const entry of await readdir(directory, {withFileTypes: true})) {
+      const name = prefix + entry.name;
+      if (entry.isDirectory()) await visit(path.join(directory, entry.name), name + '/');
+      else if (!entry.isFile()) throw new Error('Vendored fontkit files must be regular files.');
+      else if (name !== 'upstream.json') actual.push(name);
+    }
+  }
+  await visit(directory);
+  if (JSON.stringify(actual.sort()) !== JSON.stringify(Object.keys(provenance.files).sort())) throw new Error('Vendored fontkit inventory changed.');
+  for (const name of actual) {
+    if (digest(await readFile(path.join(directory, name))) !== provenance.files[name]) throw new Error(`Vendored fontkit differs from its reviewed build: ${name}`);
+  }
+  return {version: provenance.version, files: actual.length, bytes: (await readFile(path.join(directory, 'index.mjs'))).length};
+}

package/release/verify.mjs

@@ -3,6 +3,7 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { packageRoot, packageManifest, platforms, sourceCheckout } from '../native/resolve.mjs';
 import { verifyAiDocumentation } from './ai-docs.mjs';
+import { verifyVendoredFontkit } from './fontkit.mjs';
 
 export async function verifyPackage() {
   const pkg = packageManifest;
@@ -27,6 +28,8 @@ export async function verifyPackage() {
   }
   await exported(pkg.exports);
   await verifyAiDocumentation(packageRoot, pkg);
+  await verifyVendoredFontkit();
+  if (pkg.dependencies.fontkit || pkg.dependencies['oxc-transform-react'] || pkg.peerDependenciesMeta?.['oxc-transform-react']?.optional !== true) throw new Error('Fontkit must be bundled and the Oxc React compiler must remain an optional peer.');
   await access(path.join(packageRoot, 'runtime/profiles.json'));
   for (const name of ['index.node.mjs', 'resvg.wasm', 'hb.wasm', 'Geist-Regular.ttf', 'LICENSE', 'LICENSE.fflate', 'LICENSE.Geist', 'LICENSE.harfbuzzjs', 'LICENSE.satori', 'NOTICE.txt']) await access(path.join(packageRoot, 'runtime/og', name));
   if (pkg.dependencies['@vercel/og'] || (await readFile(path.join(packageRoot, 'runtime/og/index.node.mjs'), 'utf8')).includes('fflate@0.7.3')) throw new Error('OG renderer still depends on vulnerable upstream fflate. Run scripts/prepare-og.mjs.');

package/runtime/api.mjs

@@ -195,7 +195,7 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
   // IncomingMessage here duplicates URL, header and cookie work and allocates
   // an unused Duplex. Keep the existing Pages request path unchanged.
   const { request, bytes } = appHandler
-    ? { bytes: Buffer.isBuffer(body) ? body : Buffer.from(body || '', 'base64') }
+    ? { bytes: body instanceof ReadableStream ? body : Buffer.isBuffer(body) ? body : Buffer.from(body || '', 'base64') }
     : createRequest({ url, originalUrl: requestOriginal?.href, params, method, headers, body });
   if (!appHandler) {
     request.draftMode = cacheContext.draftMode;
@@ -226,7 +226,10 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
       throw abortError(lifecycle.controller.signal.reason);
     }
     const init = { method, headers, ...(lifecycle ? { signal: lifecycle.controller.signal } : {}) };
-    if (!['GET', 'HEAD'].includes(method) && bytes.length) init.body = bytes;
+    if (!['GET', 'HEAD'].includes(method) && (bytes instanceof ReadableStream || bytes.length)) {
+      init.body = bytes;
+      if (bytes instanceof ReadableStream) init.duplex = 'half';
+    }
     const timeout = lifecycle && setTimeout(() => lifecycle.controller.abort(apiTimeoutError('response headers', timeoutMs)), timeoutMs);
     timeout?.unref();
     const pendingResponse = runRequestContext({ url, method, headers, params, production, cacheComponents: manifest.config?.cacheComponents, cacheLife: manifest.config?.cacheLife, cacheHandlers: manifest.config?.cacheHandlers, cacheHandler: manifest.config?.cacheHandler, cacheMaxMemorySize: manifest.config?.cacheMaxMemorySize, distDir: path.dirname(path.dirname(modulePath)), signal: lifecycle?.controller.signal || signal, previewModeId: manifest.previewModeId, basePath: manifest.config?.basePath || '', routePattern: route.pattern, cacheConfig: route.cacheConfig, phase: 'route', cacheState: cacheContext.cacheState, staticState: cacheContext.staticState, mutableCookies: true }, async () => {