@thomas.f/prnext 0.1.19-alpha → 0.1.20-alpha

package/compat/index.d.ts

@@ -14,6 +14,8 @@ export interface InstantSample {
 export type InstantConfig = boolean | { level?: 'warning' | 'experimental-error'; unstable_samples?: InstantSample[]; unstable_disableValidation?: true; unstable_disableDevValidation?: true; unstable_disableBuildValidation?: true };
 
 export interface ReactCompilerOptions {
+  /** Babel by default. The native Oxc backend is experimental and opt-in. */
+  backend?: 'babel' | 'oxc';
   compilationMode?: 'infer' | 'annotation';
   panicThreshold?: 'none' | 'critical_errors' | 'all_errors';
   /** PRNext requires matching React 19 peers. */
@@ -121,6 +123,8 @@ export interface Rewrite extends CustomRoute { destination: string }
 export type ConfigRedirect = CustomRoute & Redirect;
 /** Implemented project options. Unsupported behavior-changing options fail the build. */
 export interface NextConfig {
+  /** Public origin and transport peers permitted to set X-Forwarded-Host/Proto. */
+  server?: {publicOrigin?: string; trustedProxies?: readonly string[]};
   /** PRNext only. CLI > environment > build configuration > profile.
    * 0 disables the corresponding retirement; keepWarm retains one lane per used host.
    */
@@ -131,6 +135,10 @@ export interface NextConfig {
   workerPreload?: false | { routes: string[]; maxRssMb?: number; timeoutMs?: number };
   /** Keep bounded previous public hashed assets. false disables carry-over. Defaults: one hour, two generations, 64 MiB. */
   deploymentRetention?: false | {maxAge?: number; maxGenerations?: number; maxBytes?: number};
+  /** Common disk budget for regenerable compiler caches, in bytes (default 256 MiB).
+   * Applied after builds; active dev sessions/workers can defer reclamation.
+   * Runtime data, invalidations, page and image caches are excluded. */
+  compilationCache?: {maxDiskSize?: number};
   /** PRNext production prerender processes; maxMemoryMb bounds their combined observed memory. */
   prerender?: {workers?: number; maxMemoryMb?: number};
   /** Explicit App route patterns that must produce complete static HTML without browser JavaScript. */
@@ -167,7 +175,20 @@ export interface NextConfig {
     implementation?: 'sass' | 'sass-embedded';
     [option: string]: unknown;
   };
-  experimental?: { nextScriptWorkers?: boolean; /** App Router development only; compile literal client imports on first use. */ lazyDynamicImports?: boolean; optimizePackageImports?: string[]; proxyClientMaxBodySize?: number | string; serverActions?: true | { allowedOrigins?: string[]; bodySizeLimit?: number | string } };
+  experimental?: {
+    nextScriptWorkers?: boolean;
+    /** App Router development only; compile literal client imports on first use. */
+    lazyDynamicImports?: boolean;
+    /** Start App Route Handlers before upload EOF; mutations must handle aborted uploads. */
+    streamingRequestBodies?: boolean;
+    /** Serve certified public PPR document shells before starting Node. Requires cacheComponents. */
+    nativePprShell?: boolean;
+    /** Bound independent production CSS builds after graph discovery. Disabled by default. */
+    parallelBuilds?: boolean | {maxWorkers?: number; maxMemoryMb?: number};
+    optimizePackageImports?: string[];
+    proxyClientMaxBodySize?: number | string;
+    serverActions?: true | {allowedOrigins?: string[]; bodySizeLimit?: number | string};
+  };
   trailingSlash?: boolean;
   skipTrailingSlashRedirect?: boolean;
   skipMiddlewareUrlNormalize?: boolean;
@@ -216,6 +237,7 @@ export interface StaticBuildOptions {
 }
 export interface ReactCompilerReport {
   version: 1;
+  backend?: 'babel' | 'oxc';
   compilerVersion: string | null;
   enabled: boolean;
   buildId: string | null;
@@ -227,6 +249,7 @@ export interface ReactCompilerReport {
   summary: {files: number; functions: number; optimized: number; skipped: number; errors: number; diagnostics: number; mixed: number; transforms: number; cacheReuses: number};
   files: Array<{
     file: string; transforms: number; cacheReuses: number; targets: string[]; notes: string[];
+    diagnostics?: Array<{kind: 'CompileError' | 'CompileDiagnostic'; status: 'error' | 'diagnostic'; reason: string | null; category: string | null; targets: Array<'browser' | 'node' | 'edge' | 'unspecified'>}>;
     functions: Array<{
       name: string | null;
       start: {line: number; column: number} | null;

package/compat/navigation-authorization.cjs

@@ -1,9 +1,16 @@
 'use strict';
 const { createHmac } = require('node:crypto');
+function developmentNavigationSecret(actionKey) {
+  if (typeof actionKey !== 'string' || !actionKey) return undefined;
+  // The compiler retains this private key across generations of one dev
+  // session. Derive a separate purpose key so worker replacement cannot look
+  // like an account change, without publishing or reusing the encryption key.
+  return createHmac('sha256', actionKey).update('prnext:development:navigation-authorization:v1').digest('hex');
+}
 function navigationAuthorization(context, secret, cookieNames) {
   if (!secret || context?.staticState) return undefined;
   const names = cookieNames === undefined ? null : new Set(cookieNames);
   const cookies = context.cookies.getAll().filter(cookie => !names || names.has(cookie.name)).map(({ name, value }) => [name, value]).sort((a, b) => a[0].localeCompare(b[0]));
   return createHmac('sha256', secret).update(JSON.stringify([cookies, context.headers.get('authorization') || ''])).digest('hex');
 }
-module.exports = { navigationAuthorization };
+module.exports = { navigationAuthorization, developmentNavigationSecret };

package/docs/ai/compatibility.md

@@ -18,6 +18,13 @@ transpilation, image/font tooling and caching deserve targeted build and browser
 tests. Support for one configuration shape does not imply support for all
 upstream plugin behavior.
 
+When moving from 0.1.19-alpha, use the installed
+[upgrade checklist](deployment.md#upgrading-from-0119-alpha): rebuild matching
+artifacts, configure the public HTTPS origin and proxy trust, verify strict
+account transitions and review saved persistent health routes. Storage cleanup
+must preserve runtime data and invalidation history. Experimental performance
+options remain independent and opt-in.
+
 ## Instrumentation and tracing
 
 Use a single `instrumentation.ts`, `.js`, `.mjs` or `.cjs` at the project root
@@ -132,6 +139,66 @@ new source files and configuration changes restart the native watch generation.
 adding its generated declaration to the config. Compiler support does not imply
 that every application is ready for TypeScript 7's own language/config changes.
 
+## Experimental performance paths
+
+These options are independent and disabled by default. Enable them in the
+application's existing configuration, then qualify its actual workflows:
+
+```js
+export default {
+  cacheComponents: true,
+  experimental: {
+    nativePprShell: true,
+    streamingRequestBodies: true,
+    parallelBuilds: {maxWorkers: 4, maxMemoryMb: 1024},
+  },
+};
+```
+
+`nativePprShell` lets Rust send the exact certified build shell before starting
+Node, then resume its React continuation. The initial implementation covers
+concrete App PPR document GETs without query strings, cookies, authorization,
+middleware, rewrites, base paths, router-state/Flight/prefetch headers or CSP
+nonces. Generic parameter shells, Edge, external caches and unsupported requests
+keep the ordinary Node path. Prefixes and artifacts have checked hashes and
+bounded sizes; continuations use a private transport field, never an HTTP flag.
+Responses remain private and no-store. The cache generation must still be zero
+and the build artifact unexpired: any persisted invalidation disables this build
+snapshot optimization, including across server restarts. It does not disable
+PPR itself or invalidate an already committed response. Requests already using
+a snapshot finish with that same artifact when an invalidation races them.
+
+`streamingRequestBodies` makes `Request.body` available to Node App Route
+Handlers before upload EOF. It negotiates its own protocol capability and sends
+at most one 64 KiB frame per reader credit. Unsupported workers use the existing
+buffered path. Server Actions, Pages APIs and middleware-buffered requests retain
+their previous buffering behavior. Streaming handlers can begin application
+effects before a truncated or excessive upload is rejected: validate the input
+and complete authorization before committing a mutation. The total request limit
+remains 32 MiB. Existing ingress byte reservations are preserved; this feature
+does not promise a smaller V8 heap or higher memory admission concurrency. A
+cancelled or early-returned upload closes its single-use lane without replaying
+the mutation, while retaining the healthy Node host.
+
+`parallelBuilds` freezes App stylesheet plans after dependency discovery,
+deduplicates outputs and emits independent jobs with deterministic linking.
+Graph discovery itself remains ordered. Concurrency is bounded by CPU count,
+available memory and the configured worker/budget limits. `maxWorkers` accepts
+1–8; `maxMemoryMb` accepts 256–8192 and is an admission estimate, not a hard RSS
+limit for third-party code. Custom webpack/loaders, custom PostCSS pipelines and
+Sass callbacks retain serial execution. A failed job stops new admission and
+settles started jobs before the staging build is discarded; the last published
+build is preserved. An enabled build records its actual stylesheet job count
+and selected concurrency in `manifest.buildParallelism`.
+
+Development refreshes can also target the routes that import a changed Server
+Action or its transitive dependencies. Certification uses both dependency
+graphs before and after a change. An unrelated tab still applies a deferred
+generation before navigating to a changed route. Unknown or incomplete graphs,
+binding/runtime/route changes, global configuration, rewrites/middleware,
+internationalized or parallel/intercepting routing retain a global refresh.
+Server generations still publish as a whole; pending mutations are never replayed.
+
 ## React Compiler
 
 Enable the bundled official React Compiler in the project's existing config:
@@ -142,7 +209,7 @@ export default {
 };
 ```
 
-No separate compiler installation is required. The default is disabled;
+The default Babel backend needs no separate compiler installation. The default is disabled;
 `reactCompiler: false` preserves the uncompiled component path. Enabled builds
 optimize project-owned browser components in both Pages and App applications,
 in development and production. App Client Components also use the transform in
@@ -153,17 +220,43 @@ Components, Server Action modules, PRNext internals, generated entrypoints and
 npm packages are not compiled. Keep the matching React 19 peer versions required
 by the installed framework.
 
-Ordinary `.mts`/`.cts` hook helpers can be optimized; server/client directives
-in those extensions remain unsupported. Decorated `.mts`/`.cts` utility modules
+With the default Babel backend, ordinary `.mts`/`.cts` hook helpers can be
+optimized; server/client directives in those extensions remain unsupported.
+Decorated `.mts`/`.cts` utility modules
 keep their native compilation path while importing React components can still
 be optimized.
 
 For gradual adoption, use `reactCompiler: { compilationMode: 'annotation' }`, then
 put `"use memo";` at the beginning of each component or hook to optimize. In
 either mode, `"use no memo";` excludes an individual function. Supported object
-options are `compilationMode: 'infer' | 'annotation'`,
+options are `backend: 'babel' | 'oxc'`, `compilationMode: 'infer' | 'annotation'`,
 `panicThreshold: 'none' | 'critical_errors' | 'all_errors'` and `target: '19'`.
-Defaults are `'infer'`, `'none'` and `'19'`; other fields are rejected.
+Defaults are Babel, `'infer'`, `'none'` and `'19'`; other fields are rejected.
+
+The experimental native Rust backend is an explicit alternative:
+
+```sh
+npm install --save-dev oxc-transform-react@0.157.0
+```
+
+```js
+export default {
+  reactCompiler: { backend: 'oxc' },
+};
+```
+
+Oxc is an optional peer, so ordinary Babel builds do not install its compiler,
+WASM distribution or native binding. Run the installation above in the application
+project on the build machine, with optional platform dependencies enabled. A
+global CLI also resolves this project-local peer. This option
+requires the native binding; an absent or incompatible compiler, missing binding
+or compilation failure fails explicitly. PRNext never silently changes the backend. JSX remains available
+to the existing graph compiler, while this backend removes TypeScript syntax.
+App Client Component server rendering uses Oxc's SSR output; browser graphs use
+its client output. The same project boundaries and Server Action exclusions
+apply. Source maps, loader maps and the existing Fast Refresh pipeline remain
+part of the compilation path. Unsupported options are rejected rather than
+passed through to the native compiler.
 
 After a successful build, inspect the compiler's actual results:
 
@@ -172,8 +265,8 @@ prnext compiler
 prnext compiler --json
 ```
 
-The report names observed functions, their project-relative files, optimization
-or skip status, and the compiler's reasons. These are transform decisions;
+For Babel, the report names observed functions, their project-relative files,
+optimization or skip status, and the compiler's reasons. These are transform decisions;
 server-code removal and tree shaking can later omit a function from the browser
 bundle. Cached transforms retain their
 diagnostics and are identified as reused. Browser and server graphs do not
@@ -183,6 +276,12 @@ complete application coverage. Disabled compilation is reported explicitly.
 The report describes the last successful build, stays outside public assets and
 does not include source code. A failed build preserves the previous report.
 
+The Oxc report identifies the backend and package version, records native
+diagnostics at file scope, and states that function optimization totals are
+unavailable: its API does not expose Babel's function-success events. This is
+not a count of zero optimized functions. Cached native diagnostics are replayed;
+cache identities include the backend, compiler version and client/SSR mode.
+
 The compiler can skip code that cannot be safely optimized. Follow the Rules of
 React and check actual behavior rather than assuming every component was
 compiled. It reduces repeated component work; it does not guarantee faster
@@ -192,6 +291,10 @@ production build with the option enabled and disabled. Compilation adds build
 work; PRNext caches pure transforms with their compiler version and settings.
 
 See the [official React Compiler documentation](https://react.dev/learn/react-compiler).
+The [Oxc React Compiler guide](https://oxc.rs/docs/guide/usage/transformer/react-compiler.html)
+describes the experimental backend. Measure compilation and application behavior
+with the selected backend before adopting it; selecting Rust alone is not a
+measured speedup for a project.
 
 Only explicit private Next.js import adapters are supported. Do not add arbitrary
 `next/dist/...` imports or install another Next runtime to satisfy one: isolate

package/docs/ai/deployment.md

@@ -8,12 +8,90 @@ Build with the installed PRNext and run the resulting trusted output with its
 matching runtime:
 
 ```sh
+prnext check --production
 prnext typecheck
 prnext build
 prnext output --json
 prnext start --hostname 127.0.0.1 --port 3000
 ```
 
+### Upgrading from 0.1.19-alpha
+
+Install matching framework/native versions, then rebuild and restart the complete
+application or standalone output. Keep Node and the React protocol peers aligned
+with this package's metadata. Existing compiler entries are reused only when
+their identities match; never delete `data.sqlite3` or invalidation history to
+perform an upgrade. Read the storage section below before pruning compiler caches.
+
+Persistent apps need a supervisor restart too. In a maintenance window for the
+whole `PRNEXT_PM_HOME`, run `prnext pdown` with that same home before replacing
+packages. It stops all managed apps and preserves saved settings and enabled
+entries; `prestart` alone keeps the already loaded supervisor code. Update and
+rebuild the installations that must return with 0.1.20, then launch `pstart` or
+`prestart` through the new CLI. It also restores all enabled entries, with their
+saved binary paths and health routes. Check `pstatus` and real health responses;
+a global CLI update does not replace each app's package or binary. Keep independent
+lifecycles in separate homes.
+
+Set `server.publicOrigin` to the external HTTPS origin and `server.trustedProxies`
+to the immediate proxy's IP/CIDR addresses. The configured origin wins; forwarded
+host/protocol headers are trusted only from those peers. Rebuild after config
+changes and check redirects, secure cookies and authentication callbacks over
+the actual public URL. This does not establish a forwarded client-IP chain.
+
+Run production preflight, then test account A → sign out → account B with the
+actual `navigationCache.authCookies`, including shared layouts and browser
+history. Changed or unknown strict identities require a fresh document; cached
+PPR previews wait for fresh identity. Authorize protected reads and writes in
+the application as before.
+
+Use a dedicated complete HTTP 200 application health response for database/service
+readiness. `/_prnext/health` checks native readiness only; redirects no longer
+pass persistent health checks. Previously saved applications keep their health
+path, so a redirecting `/` must be replaced in the saved persistent settings.
+Observe the post-switch rollback window and exercise an explicit idempotent
+retry; a lost response can follow a successful write, and mutations are never
+automatically replayed. Keep schema changes compatible with the previous server.
+
+### Production preflight
+
+Run `prnext check --production --json` to collect deployment diagnostics without
+building or rewriting the application. It evaluates the production config and
+environment files, restores the calling process environment afterward, and checks
+installed dependencies, route conventions, the public origin, proxy trust,
+authentication retention settings and active experimental options. JSON diagnostics
+include `code`, `path`, `severity` and an action where one is needed. Errors fail
+the command; warnings require review and do not change its exit status.
+
+If a build already exists, preflight also compares its public origin, proxy and
+authentication retention settings with the current config and rejects a development artifact. Rebuild after
+changing deployment settings: `prnext start` reads the selected artifact and does
+not reevaluate the source configuration. Missing output is informational before
+the first build; unreadable existing metadata requires review.
+
+For authenticated App Router applications, explicitly list every session cookie
+name, including HTTPS variants used by the authentication library:
+
+```js
+export default {
+  navigationCache: {
+    authCookies: ['session-cookie-name', '__Secure-session-cookie-name'],
+  },
+};
+```
+
+Replace these example names with the application's actual cookies; PRNext does
+not infer authentication from cookie names. This enables strict retained-page
+state resets when the server's authorization identity changes. Test account A →
+sign out → account B with both active and retained pages, and confirm that private
+drafts disappear. Public applications can review the guidance or disable page
+retention with `navigationCache: false`.
+
+A successful preflight checks configuration, not external services or application
+authorization. Qualify the final build over public HTTPS, including authentication,
+health checks, failure recovery and rollback. Experimental warnings identify the
+options that need workload-specific validation; they are not performance claims.
+
 The default build directory is `.prnext`; `distDir` can change it. The private
 project output selector is `.prnext-output.json`. Do not assume `.next` layout,
 run `next start` on a PRNext build or hand-edit its manifests to bypass runtime
@@ -254,6 +332,69 @@ an explicit choice, not a reason to print credentials or copy `.env` into assets
 
 ## Observe before tuning
 
+### Installation and disk storage
+
+The default installation includes Babel React Compiler support. The Oxc React
+Compiler backend is an optional peer installed explicitly; read the
+[compatibility guide](compatibility.md) before selecting it. Keep optional native
+platform dependencies enabled. The framework's internal Fontkit bundle includes
+its provenance and dependency licenses under `vendor/fontkit`; applications do
+not need a separate Fontkit dependency for `next/font`.
+
+Production builds retain one OpenGraph renderer when needed. A bounded analysis
+of the compiled server graph may omit it only when the application can be
+certified not to use `ImageResponse`. Development, Edge, unknown external modules
+and computed loading keep it. No configuration change is needed. Deploy the
+standalone output alone when using `output: 'standalone'`; copying the complete
+ordinary build beside it duplicates those artifacts.
+
+Compiler caches share a **256 MiB** retention budget per project:
+
+```js
+export default {
+  compilationCache: {maxDiskSize: 128 * 1024 * 1024}, // bytes, 0–4 GiB
+};
+```
+
+PRNext applies the policy after a build, including failures, and after a clean
+development shutdown. It is a retention target, not a hard filesystem quota:
+active development, pinned V8 workers, busy files or an incomplete bounded scan
+can defer reclamation. Existing per-cache limits still apply. Eviction can make
+the next build slower; evicted downloaded fonts need network access again.
+Large JSON entries use bounded, checksummed compression; old raw records remain
+readable, and corrupt/incompatible records are cache misses.
+
+Inspect and preview changes without executing application configuration:
+
+```sh
+prnext cache --json
+prnext cache --prune --dry-run --max-bytes 67108864 --json
+prnext cache --prune --max-bytes 67108864
+```
+
+The CLI reads the policy saved by the last build. `--max-bytes` overrides only
+that purge; `0` removes eligible compiler records. Statistics cover recognized
+framework cache files, excluding unknown paths; `scanComplete: false` means a
+lower bound and prevents purging from an incomplete snapshot. Stop development
+before purging. Concurrent builds are protected by the publisher lock, active
+managed workers pin their namespace, and failed deletions can be retried.
+
+These commands never remove runtime data, `data.sqlite3`, page/image indexes,
+invalidation generations, tags or fill leases. Never delete/reset the data
+database to reclaim compiler storage: that can lose invalidation history. The
+runtime instead performs small incremental SQLite reclamation steps and bounded
+orphan-file maintenance on its own timer. Existing SQLite databases without
+incremental auto-vacuum retain their existing format; no full VACUUM runs on a
+request. Older page files without a verifiable reader lease are retained.
+
+Builds and dev sessions also journal their owned temporary directories. After a
+crash, later starts reclaim eligible entries only after a grace period and proof
+that their local owner/workers have exited. Unknown directories, foreign-host or
+unverifiable owners and uncommitted build backups are kept for recovery. Do not
+remove a recovery backup until the selected build has been checked.
+
+### Runtime observations
+
 Production rendering, API and regeneration admission use bounded queues grouped
 by resolved route pattern. Different parameter values share one pattern's
 waiting budget. Waiting patterns take turns as capacity becomes available;

package/docs/ai/quickstart.md

@@ -13,6 +13,11 @@ react-server-dom-webpack 19.3.1**. Its Node engine range is
 `^22.23.4 || ^24.22.1 || >=26.12.1`. Check the installed package manifest when
 upgrading; these requirements may change between releases.
 
+Optional peers are installed only for the features that use them:
+`@redis/client` for [shared Redis caching](data.md), and `oxc-transform-react`
+for the [experimental Oxc React Compiler](compatibility.md#react-compiler).
+The default Babel compiler needs no additional compiler installation.
+
 Published releases include a matching native component through optional
 dependencies for Windows, macOS and glibc Linux, on x64 and ARM64. Keep optional
 dependencies enabled. Consumers do not need Rust; building PRNext from its source

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thomas.f/prnext",
-  "version": "0.1.19-alpha",
+  "version": "0.1.20-alpha",
   "license": "MIT",
   "description": "Experimental Rust-powered runtime for Next.js apps, React and npm",
   "homepage": "https://prnext.dev",
@@ -146,7 +146,6 @@
     "dotenv-expand": "11.0.7",
     "esbuild": "^0.28.2",
     "estree-walker": "2.0.2",
-    "fontkit": "2.0.4",
     "get-tsconfig": "4.14.3",
     "glob": "14.0.2",
     "graceful-fs": "4.2.11",
@@ -173,20 +172,24 @@
     "@redis/client": "^6.3.0",
     "react": "19.3.1",
     "react-dom": "19.3.1",
-    "react-server-dom-webpack": "19.3.1"
+    "react-server-dom-webpack": "19.3.1",
+    "oxc-transform-react": "0.157.0"
   },
   "peerDependenciesMeta": {
     "@redis/client": {
       "optional": true
+    },
+    "oxc-transform-react": {
+      "optional": true
     }
   },
   "optionalDependencies": {
-    "prnext-darwin-arm64": "0.1.19-alpha",
-    "prnext-darwin-x64": "0.1.19-alpha",
-    "prnext-linux-arm64-gnu": "0.1.19-alpha",
-    "prnext-linux-x64-gnu": "0.1.19-alpha",
-    "@thomas.f/prnext-win32-x64-msvc": "0.1.19-alpha",
-    "@thomas.f/prnext-win32-arm64-msvc": "0.1.19-alpha"
+    "prnext-darwin-arm64": "0.1.20-alpha",
+    "prnext-darwin-x64": "0.1.20-alpha",
+    "prnext-linux-arm64-gnu": "0.1.20-alpha",
+    "prnext-linux-x64-gnu": "0.1.20-alpha",
+    "@thomas.f/prnext-win32-x64-msvc": "0.1.20-alpha",
+    "@thomas.f/prnext-win32-arm64-msvc": "0.1.20-alpha"
   },
   "engines": {
     "node": "^22.23.4 || ^24.22.1 || >=26.12.1"

package/release/fontkit.mjs

@@ -0,0 +1,31 @@
+import {createHash} from 'node:crypto';
+import {readFile, readdir} from 'node:fs/promises';
+import path from 'node:path';
+import {fileURLToPath} from 'node:url';
+
+const destination = fileURLToPath(new URL('../vendor/fontkit/', import.meta.url));
+const digest = bytes => createHash('sha256').update(bytes).digest('hex');
+
+/** Validate the shipped inventory without loading fontkit or its build dependencies. */
+export async function verifyVendoredFontkit(directory = destination) {
+  const provenance = JSON.parse(await readFile(path.join(directory, 'upstream.json'), 'utf8'));
+  if (provenance.schemaVersion !== 1 || provenance.name !== 'fontkit' || provenance.version !== '2.0.4'
+      || provenance.tool?.name !== 'esbuild' || !provenance.files?.['index.mjs']
+      || !provenance.files?.['NOTICE.txt'] || !provenance.files?.['SOURCE-NOTICES.txt']
+      || !provenance.packages?.fontkit || !provenance.packages?.brotli) throw new Error('Incomplete fontkit provenance.');
+  const actual = [];
+  async function visit(directory, prefix = '') {
+    for (const entry of await readdir(directory, {withFileTypes: true})) {
+      const name = prefix + entry.name;
+      if (entry.isDirectory()) await visit(path.join(directory, entry.name), name + '/');
+      else if (!entry.isFile()) throw new Error('Vendored fontkit files must be regular files.');
+      else if (name !== 'upstream.json') actual.push(name);
+    }
+  }
+  await visit(directory);
+  if (JSON.stringify(actual.sort()) !== JSON.stringify(Object.keys(provenance.files).sort())) throw new Error('Vendored fontkit inventory changed.');
+  for (const name of actual) {
+    if (digest(await readFile(path.join(directory, name))) !== provenance.files[name]) throw new Error(`Vendored fontkit differs from its reviewed build: ${name}`);
+  }
+  return {version: provenance.version, files: actual.length, bytes: (await readFile(path.join(directory, 'index.mjs'))).length};
+}

package/release/verify.mjs

@@ -3,6 +3,7 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { packageRoot, packageManifest, platforms, sourceCheckout } from '../native/resolve.mjs';
 import { verifyAiDocumentation } from './ai-docs.mjs';
+import { verifyVendoredFontkit } from './fontkit.mjs';
 
 export async function verifyPackage() {
   const pkg = packageManifest;
@@ -27,6 +28,8 @@ export async function verifyPackage() {
   }
   await exported(pkg.exports);
   await verifyAiDocumentation(packageRoot, pkg);
+  await verifyVendoredFontkit();
+  if (pkg.dependencies.fontkit || pkg.dependencies['oxc-transform-react'] || pkg.peerDependenciesMeta?.['oxc-transform-react']?.optional !== true) throw new Error('Fontkit must be bundled and the Oxc React compiler must remain an optional peer.');
   await access(path.join(packageRoot, 'runtime/profiles.json'));
   for (const name of ['index.node.mjs', 'resvg.wasm', 'hb.wasm', 'Geist-Regular.ttf', 'LICENSE', 'LICENSE.fflate', 'LICENSE.Geist', 'LICENSE.harfbuzzjs', 'LICENSE.satori', 'NOTICE.txt']) await access(path.join(packageRoot, 'runtime/og', name));
   if (pkg.dependencies['@vercel/og'] || (await readFile(path.join(packageRoot, 'runtime/og/index.node.mjs'), 'utf8')).includes('fflate@0.7.3')) throw new Error('OG renderer still depends on vulnerable upstream fflate. Run scripts/prepare-og.mjs.');

package/runtime/api.mjs

@@ -195,7 +195,7 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
   // IncomingMessage here duplicates URL, header and cookie work and allocates
   // an unused Duplex. Keep the existing Pages request path unchanged.
   const { request, bytes } = appHandler
-    ? { bytes: Buffer.isBuffer(body) ? body : Buffer.from(body || '', 'base64') }
+    ? { bytes: body instanceof ReadableStream ? body : Buffer.isBuffer(body) ? body : Buffer.from(body || '', 'base64') }
     : createRequest({ url, originalUrl: requestOriginal?.href, params, method, headers, body });
   if (!appHandler) {
     request.draftMode = cacheContext.draftMode;
@@ -226,7 +226,10 @@ async function runApiInner({ modulePath, route = {}, manifest = {}, production =
       throw abortError(lifecycle.controller.signal.reason);
     }
     const init = { method, headers, ...(lifecycle ? { signal: lifecycle.controller.signal } : {}) };
-    if (!['GET', 'HEAD'].includes(method) && bytes.length) init.body = bytes;
+    if (!['GET', 'HEAD'].includes(method) && (bytes instanceof ReadableStream || bytes.length)) {
+      init.body = bytes;
+      if (bytes instanceof ReadableStream) init.duplex = 'half';
+    }
     const timeout = lifecycle && setTimeout(() => lifecycle.controller.abort(apiTimeoutError('response headers', timeoutMs)), timeoutMs);
     timeout?.unref();
     const pendingResponse = runRequestContext({ url, method, headers, params, production, cacheComponents: manifest.config?.cacheComponents, cacheLife: manifest.config?.cacheLife, cacheHandlers: manifest.config?.cacheHandlers, cacheHandler: manifest.config?.cacheHandler, cacheMaxMemorySize: manifest.config?.cacheMaxMemorySize, distDir: path.dirname(path.dirname(modulePath)), signal: lifecycle?.controller.signal || signal, previewModeId: manifest.previewModeId, basePath: manifest.config?.basePath || '', routePattern: route.pattern, cacheConfig: route.cacheConfig, phase: 'route', cacheState: cacheContext.cacheState, staticState: cacheContext.staticState, mutableCookies: true }, async () => {