@thomas.f/prnext 0.1.19-alpha → 0.1.21-alpha

package/runtime/og/upstream.json

@@ -0,0 +1,115 @@
+{
+  "schemaVersion": 1,
+  "name": "@vercel/og",
+  "inputs": {
+    "sourceSha256": "3269eb15ca135a0eb7e07ddf8af0b35711d6e75c56b84c6a6727c5626d59409c",
+    "packages": {
+      "@vercel/og": {
+        "version": "1.0.3",
+        "integrity": "sha512-/iYJ34PDu4lty1TXdL86qHEw8viveHTllG1PWLuJX8tSFfqKL7kyVJeUORJmQ250bHB0h+alcalXUlza3c/NSA=="
+      },
+      "fflate": {
+        "version": "0.7.5",
+        "integrity": "sha512-QieYf//cis6ywHNi5qW1+PXPQ4bC+XVJAtS4AXIML8P76GroEiOxm/oQtn1f02UkJY1+KsXMJcC+R2v/Eg4G3g=="
+      }
+    },
+    "components": [
+      {
+        "name": "@vercel/og",
+        "version": "1.0.3"
+      },
+      {
+        "name": "@resvg/resvg-wasm",
+        "version": "2.4.1"
+      },
+      {
+        "name": "@shuding/opentype.js",
+        "version": "1.4.0-beta.0"
+      },
+      {
+        "name": "base64-js",
+        "version": "0.0.8"
+      },
+      {
+        "name": "camelize",
+        "version": "1.0.1"
+      },
+      {
+        "name": "color-name",
+        "version": "1.1.4"
+      },
+      {
+        "name": "css-background-parser",
+        "version": "0.1.0"
+      },
+      {
+        "name": "css-box-shadow",
+        "version": "1.0.0-3"
+      },
+      {
+        "name": "css-color-keywords",
+        "version": "1.0.0"
+      },
+      {
+        "name": "css-gradient-parser",
+        "version": "0.0.17"
+      },
+      {
+        "name": "css-to-react-native",
+        "version": "3.2.0"
+      },
+      {
+        "name": "escape-html",
+        "version": "1.0.3"
+      },
+      {
+        "name": "fflate",
+        "version": "0.7.5"
+      },
+      {
+        "name": "harfbuzzjs",
+        "version": "0.10.0"
+      },
+      {
+        "name": "hex-rgb",
+        "version": "4.3.0"
+      },
+      {
+        "name": "linebreak",
+        "version": "1.1.0"
+      },
+      {
+        "name": "parse-css-color",
+        "version": "0.2.1"
+      },
+      {
+        "name": "postcss-value-parser",
+        "version": "4.2.0"
+      },
+      {
+        "name": "satori",
+        "version": "0.33.5"
+      },
+      {
+        "name": "tiny-inflate",
+        "version": "1.0.3"
+      },
+      {
+        "name": "unicode-trie",
+        "version": "2.0.0"
+      }
+    ]
+  },
+  "files": {
+    "Geist-Regular.ttf": "bde046ddd9f20be35b0bd56cc79eb752b967fb6661a3fe76cb067bb09f871d76",
+    "hb.wasm": "d2ab975172d6103e7624e8f7f03fea2316eca6fe562e1b80fc7f7058b283a6d0",
+    "index.node.mjs": "4fae6c6a5e3b6514b6a303bb2f9f5c945114aed0549724191a8ef127238e075b",
+    "LICENSE": "1f256ecad192880510e84ad60474eab7589218784b9a50bc7ceee34c2b91f1d5",
+    "LICENSE.fflate": "62249119bb7df6e54300f37a37145c26a6d4420410aac8881a119c5b427cf751",
+    "LICENSE.Geist": "c683bfbcc7e087f5d37a54ef628f10387c451a83ddc459b151403a164ac46c90",
+    "LICENSE.harfbuzzjs": "c85596583d1b7e4cfb4f21165ce0988aabd72e80a8c3a2ab6aaeedc1965e8288",
+    "LICENSE.satori": "1f256ecad192880510e84ad60474eab7589218784b9a50bc7ceee34c2b91f1d5",
+    "NOTICE.txt": "bcc9a8f06053c81502b72a618ca004794027ec85ae94d4bbe81890f7dcdb8ec8",
+    "resvg.wasm": "9c1f8f54b842fcda3b72b06eba94a20b907958c443d73178da32b21ccb57b9bb"
+  }
+}

package/runtime/persistent/client.mjs

@@ -4,6 +4,7 @@ import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { initializeHome, rpc, delay, environment, validName, validHealthPath } from './common.mjs';
 import { resolveNativeBinary } from '../../native/resolve.mjs';
+import {nativeHealthPath} from './health.mjs';
 
 export const persistentHelp = `Persistent apps (ordinary prn start stays in the foreground):
   prn pstart [directory] [options]   Start a built app in the background
@@ -18,7 +19,8 @@ export const persistentHelp = `Persistent apps (ordinary prn start stays in the
 
 pstart options: --name NAME --port 3000 --hostname 127.0.0.1 --workers 1
   --profile balanced|speed|memory|classic --inspect
-  --health-path / --health-timeout 15000 --drain-timeout 30000 (milliseconds)
+  --health-path /api/health (optional application probe after the native readiness check)
+  --health-timeout 15000 --drain-timeout 30000 (milliseconds)
   --rollback-window 15000 (post-switch monitoring; 0 disables, maximum 120000 ms)
 prestart/pstop/plogs default to the app in the current directory.
 plogs options: --lines 100 --follow. App environment comes from its .env files.
@@ -62,7 +64,7 @@ async function ensure(connection) {
     child.on('error', () => {}); child.unref();
   }
   for (let i = 0; i < 200; i++) {
-    try { const result = await rpc(connection, { command: 'ping' }, 1500); if (result.version !== 1) throw new Error('Supervisor protocol mismatch. Run prn pdown before upgrading.'); if (result.ready) return; }
+    try { const result = await rpc(connection, { command: 'ping' }, 1500); if (result.version !== 2) throw new Error('Supervisor protocol mismatch. Stop the supervisor with its current PRNext version before upgrading.'); if (result.ready) return; }
     catch (error) { if (!['ECONNREFUSED', 'ECONNRESET'].includes(error.code)) throw error; }
     await delay(100);
   }
@@ -157,7 +159,7 @@ export async function persistentCommand(command, argv) {
   if (command === 'pstart') {
     const root = await realpath(path.resolve(target || '.'));
     const name = validName(options.name || path.basename(root).replace(/[^a-zA-Z0-9_-]/g, '-').replace(/^[^a-zA-Z0-9]+/, '').slice(0, 64));
-    request = { command: 'start', config: { name, root, binary: await resolveNativeBinary(), node: process.execPath, port: options.port || 3000, hostname: options.hostname || '127.0.0.1', workers: options.workers || 1, profile: options.profile || process.env.PRNEXT_PROFILE || 'balanced', inspect: !!options.inspect, healthPath: options['health-path'] || '/', healthTimeout: options['health-timeout'] || 15000, drainTimeout: options['drain-timeout'] || 30000, rollbackWindow: options['rollback-window'] ?? 15000 } };
+    request = { command: 'start', config: { name, root, binary: await resolveNativeBinary(), node: process.execPath, port: options.port || 3000, hostname: options.hostname || '127.0.0.1', workers: options.workers || 1, profile: options.profile || process.env.PRNEXT_PROFILE || 'balanced', inspect: !!options.inspect, healthPath: options['health-path'] || nativeHealthPath, healthTimeout: options['health-timeout'] || 15000, drainTimeout: options['drain-timeout'] || 30000, rollbackWindow: options['rollback-window'] ?? 15000 } };
   } else request = { command: ({ prestart: 'restart', pstop: 'stop', pdelete: 'delete' })[command], name: target, all: !!options.all, root: target || options.all ? undefined : await realpath(process.cwd()) };
   await ensure(connection);
   const report = await rpc(connection, request);

package/runtime/persistent/common.mjs

@@ -1,9 +1,9 @@
 import { mkdir, readFile, writeFile, realpath, rm } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { createHash, randomBytes, randomUUID } from 'node:crypto';
-import net from 'node:net';
 import path from 'node:path';
 import { rename } from '../fs.mjs';
+import { requestLoopback } from '../loopback-rpc.mjs';
 
 export const delay = ms => new Promise(resolve => setTimeout(resolve, ms));
 export const homeDirectory = () => path.resolve(process.env.PRNEXT_PM_HOME || path.join(homedir(), '.prnext', 'processes'));
@@ -47,21 +47,10 @@ export function validHealthPath(value) {
   return value;
 }
 export async function rpc(connection, request, timeout = 120000) {
-  return new Promise((resolve, reject) => {
-    const socket = net.connect({ host: '127.0.0.1', port: connection.port });
-    socket.setEncoding('utf8');
-    let buffer = '', finished = false;
-    const finish = (error, value) => { if (finished) return; finished = true; socket.destroy(); error ? reject(error) : resolve(value); };
-    socket.setTimeout(timeout, () => finish(new Error('Supervisor request timed out. Check prn plogs --supervisor.')));
-    socket.on('error', error => finish(error));
-    socket.once('connect', () => socket.write(JSON.stringify({ ...request, token: connection.token }) + '\n'));
-    socket.on('data', chunk => {
-      buffer += chunk.toString();
-      if (buffer.length > 1024 * 1024) return finish(new Error('Supervisor response is too large'));
-      if (!buffer.includes('\n')) return;
-      try { const result = JSON.parse(buffer.slice(0, buffer.indexOf('\n'))); finish(result.ok ? null : new Error(result.error || 'Supervisor request failed'), result.value); }
-      catch (error) { finish(error); }
-    });
-    socket.on('end', () => { if (!finished) finish(new Error('Supervisor disconnected')); });
-  });
+  try { return await requestLoopback(connection, request, { context: 'persistent-supervisor', timeout }); }
+  catch (error) {
+    if (error.code === 'ERR_PRNEXT_PEER_AUTH') error.message = 'Cannot authenticate the supervisor control listener. If an older PRNext supervisor is running, stop it with that version\'s prn pdown before upgrading; saved apps are preserved.';
+    else if (error.message === 'Loopback request timed out') error.message = 'Supervisor request timed out. Check prn plogs --supervisor.';
+    throw error;
+  }
 }

package/runtime/persistent/daemon.mjs

@@ -1,5 +1,4 @@
 import { spawn } from 'node:child_process';
-import { request } from 'node:http';
 import { cp, mkdir, readFile, rm, realpath } from 'node:fs/promises';
 import { randomUUID, createHash } from 'node:crypto';
 import path from 'node:path';
@@ -7,6 +6,8 @@ import { readBuildDirectory } from '../build-directory.mjs';
 import { atomicJSON, delay, environment, validName, validHealthPath } from './common.mjs';
 import { RotatingLog } from './logger.mjs';
 import {nativeGateway,stopNativeProxy} from './native-proxy.mjs';
+import {health} from './health.mjs';
+import {productionEnvironment} from '../env.mjs';
 
 const home = process.argv[2];
 const registry = path.join(home, 'apps.json');
@@ -75,18 +76,9 @@ async function snapshot(app) {
     if (path.relative(root, container).startsWith('..') || path.isAbsolute(path.relative(root, container))) throw new Error('Managed builds must remain inside the project');
     await cp(source, destination, { recursive: true, verbatimSymlinks: true, filter: file => file !== path.join(source, 'standalone') });
     if (await readFile(path.join(source, 'manifest.json'), 'utf8') !== before || await readFile(path.join(destination, 'manifest.json'), 'utf8') !== before) throw new Error('Build changed while copying. Finish prn build, then retry prn prestart.');
-    return { relative, buildId: manifest.buildId || null };
+    return { relative, buildId: manifest.buildId || null, server: manifest.config?.server || {} };
   } catch (error) { await removeSnapshot(app, relative); throw error; }
 }
-function health(generation, config, timeout) {
-  return new Promise((resolve, reject) => {
-    const req = request({ host: '127.0.0.1', port: generation.port, path: config.healthPath, method: 'GET', headers: { host: `${config.hostname.includes(':') ? '[' + config.hostname + ']' : config.hostname}:${config.port}` }, signal: AbortSignal.timeout(timeout) }, res => {
-      const ok = res.statusCode >= 200 && res.statusCode < 400;
-      res.destroy(); ok ? resolve() : reject(new Error(`Health check ${config.healthPath} returned HTTP ${res.statusCode}`));
-    });
-    req.once('error', reject); req.end();
-  });
-}
 async function stopGeneration(app, generation, drain = true) {
   if (generation.stopping) return generation.stopping;
   generation.expected = true;
@@ -123,7 +115,7 @@ async function launch(app) {
   const build = await snapshot(app);
   const child = spawn(config.binary, ['start', config.root, '--build-dir', build.relative, '--hostname', '127.0.0.1', '--port', '0', '--node', config.node, '--workers', String(config.workers), '--profile', config.profile, '--shutdown-on-stdin-eof'], {
     cwd: config.root, windowsHide: true, detached: process.platform !== 'win32', stdio: ['pipe', 'pipe', 'pipe'],
-    env: { ...environment(), NODE_ENV: 'production', ...(config.inspect ? { PRNEXT_INSPECT_DIR: path.join(config.root, '.prnext-cache/inspect') } : {}) },
+    env: { ...productionEnvironment(config.root,{env:{...environment(),NODE_ENV:'production'}}), ...(config.inspect ? { PRNEXT_INSPECT_DIR: path.join(config.root, '.prnext-cache/inspect') } : {}) },
   });
   child.stdin.on('error', () => {});
   const generation = { child, ...build, active: 0, dead: false, expected: false, port: null, startedAt: Date.now() };

package/runtime/persistent/health.mjs

@@ -0,0 +1,58 @@
+import {request} from 'node:http';
+
+export const nativeHealthPath = '/_prnext/health';
+const nativeLimit = 4096, applicationLimit = 65536;
+
+// Connect directly to the private generation. A redirect, partial response or
+// open-ended body cannot certify that a process is ready to receive traffic.
+function probe(generation, config, healthPath, timeout, native) {
+  return new Promise((resolve, reject) => {
+    let finished = false, response;
+    const finish = error => {
+      if (finished) return;
+      finished = true;
+      if (error) { response?.destroy(); req.destroy(); reject(error); }
+      else resolve();
+    };
+    const req = request({host:'127.0.0.1', port:generation.port, path:healthPath,
+      method:'GET', headers:{host:`${config.hostname.includes(':')?'['+config.hostname+']':config.hostname}:${config.port}`, accept:'application/json', 'accept-encoding':'identity', connection:'close'},
+      signal:AbortSignal.timeout(Math.max(1, timeout))}, res => {
+      response = res;
+      if (res.statusCode !== 200) return finish(new Error(`Health check ${healthPath} returned HTTP ${res.statusCode}`));
+      if (res.headers['content-encoding'] && res.headers['content-encoding'] !== 'identity') return finish(new Error(`Health check ${healthPath} returned an encoded body`));
+      const limit = native ? nativeLimit : applicationLimit;
+      const declared = res.headers['content-length'];
+      if (declared !== undefined && (!/^\d+$/.test(declared) || Number(declared) > limit)) return finish(new Error(`Health check ${healthPath} body exceeds ${limit} bytes`));
+      const chunks = []; let size = 0;
+      res.on('data', chunk => {
+        size += chunk.length;
+        if (size > limit) return finish(new Error(`Health check ${healthPath} body exceeds ${limit} bytes`));
+        if (native) chunks.push(chunk);
+      });
+      res.once('error', finish);
+      res.once('aborted', () => finish(new Error(`Health check ${healthPath} response was incomplete`)));
+      res.once('end', () => {
+        if (!res.complete) return finish(new Error(`Health check ${healthPath} response was incomplete`));
+        if (native) {
+          if (!/^application\/json(?:\s*;|$)/i.test(res.headers['content-type'] || '')) return finish(new Error(`Health check ${healthPath} must return application/json`));
+          let body;
+          try { body = JSON.parse(Buffer.concat(chunks, size).toString('utf8')); } catch { return finish(new Error(`Health check ${healthPath} returned invalid JSON`)); }
+          if (!body || Array.isArray(body) || body.schemaVersion !== 1 || body.status !== 'ready') return finish(new Error(`Health check ${healthPath} did not report ready`));
+          if (body.buildId !== undefined && generation.buildId && body.buildId !== generation.buildId) return finish(new Error(`Health check ${healthPath} returned a different build`));
+        }
+        finish();
+      });
+    });
+    req.once('error', finish); req.end();
+  });
+}
+
+export async function health(generation, config, timeout) {
+  const deadline = Date.now() + timeout;
+  await probe(generation, config, nativeHealthPath, timeout, true);
+  if (config.healthPath !== nativeHealthPath) {
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error('Application health check exceeded its deadline');
+    await probe(generation, config, config.healthPath, remaining, false);
+  }
+}

package/runtime/persistent/native-proxy.mjs

@@ -53,7 +53,7 @@ export async function nativeGateway(config,options){
   manager??=new NativeProxy(config.binary,options);await manager.ready;
   const app=config.name;await manager.request('listen',{app,hostname:config.hostname,port:config.port});
   return {pid:manager.pid,
-    activate:g=>manager.request('activate',{app,generation:g.relative,port:g.port}),
+    activate:g=>manager.request('activate',{app,generation:g.relative,port:g.port,server:g.server}),
     pause:g=>manager.request('pause',{app,...(g?{generation:g.relative}:{})}),
     retire:(g,timeout)=>manager.request('retire',{app,generation:g.relative,timeout},timeout+5000),
     counts:async()=> (await manager.request('status',{app})).generations,

package/runtime/persistent/watchdog.mjs

@@ -1,10 +1,10 @@
 import { fork } from 'node:child_process';
 import { createServer } from 'node:net';
-import { timingSafeEqual } from 'node:crypto';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
 import { initializeHome, environment, delay } from './common.mjs';
 import { RotatingLog } from './logger.mjs';
+import { serveLoopback } from '../loopback-rpc.mjs';
 
 const connection = await initializeHome(process.argv[2]);
 const log = new RotatingLog(path.join(connection.home, 'logs', 'supervisor.log'));
@@ -12,35 +12,20 @@ const pending = new Map(), children = new Set(), sockets = new Set();
 const shutdownReplies = [];
 let daemon, ready = false, closing = false, counter = 0, heartbeat = Date.now(), failures = 0, restartTimer;
 const server = createServer(socket => {
-  socket.setEncoding('utf8');
   sockets.add(socket); socket.once('close', () => sockets.delete(socket));
-  socket.setTimeout(125000, () => socket.destroy());
-  let buffer = '', received = false;
-  socket.on('error', () => {});
-  socket.on('data', chunk => {
-    if (received) return;
-    buffer += chunk.toString();
-    if (buffer.length > 65536) { socket.destroy(); return; }
-    if (!buffer.includes('\n')) return;
-    received = true;
-    let message;
-    const reply = result => socket.end(JSON.stringify(result) + '\n');
-    try {
-      message = JSON.parse(buffer.slice(0, buffer.indexOf('\n')));
-      const supplied = Buffer.from(typeof message.token === 'string' ? message.token : '');
-      const expected = Buffer.from(connection.token);
-      if (supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) throw new Error('Invalid supervisor credentials');
-      delete message.token;
-      if (message.command === 'ping') { reply({ ok: true, value: { version: 1, pid: process.pid, daemonPid: daemon?.pid || null, ready } }); return; }
-      if (message.command === 'shutdown') { shutdownReplies.push(reply); void shutdown(); return; }
+  serveLoopback(socket, { token: connection.token, context: 'persistent-supervisor', handle: async message => {
+      if (message.command === 'ping') return { version: 2, pid: process.pid, daemonPid: daemon?.pid || null, ready };
+      if (message.command === 'shutdown') return new Promise(resolve => { shutdownReplies.push(resolve); void shutdown(); });
       if (!ready || !daemon?.connected) throw new Error('Supervisor is recovering. Retry shortly.');
       if (pending.size >= 32) throw new Error('Supervisor is busy. Retry shortly.');
       const id = ++counter;
-      pending.set(id, reply);
-      socket.once('close', () => pending.delete(id));
-      daemon.send({ type: 'request', id, request: message }, error => { if (error) { pending.delete(id); reply({ ok: false, error: error.message }); } });
-    } catch (error) { reply({ ok: false, error: error.message }); }
-  });
+      return new Promise((resolve, reject) => {
+        const reply = result => result.ok ? resolve(result.value) : reject(Error(result.error || 'Supervisor request failed'));
+        pending.set(id, reply);
+        socket.once('close', () => { pending.delete(id); reject(Error('Supervisor client disconnected')); });
+        daemon.send({ type: 'request', id, request: message }, error => { if (error) { pending.delete(id); reject(error); } });
+      });
+  } });
 });
 server.maxConnections = 64;
 try { await new Promise((resolve, reject) => { server.once('error', reject); server.listen(connection.port, '127.0.0.1', resolve); }); }
@@ -100,7 +85,7 @@ async function shutdown() {
   log.message('Supervisor stopped.');
   await new Promise(resolve => log.end(resolve));
   server.close();
-  for (const reply of shutdownReplies) reply({ ok: true, value: 'Supervisor stopped; enabled apps will return on the next launch.' });
+  for (const reply of shutdownReplies) reply('Supervisor stopped; enabled apps will return on the next launch.');
   await delay(50);
   for (const socket of sockets) socket.destroy();
   process.exit(0);

package/runtime/prewarm.mjs

@@ -0,0 +1,35 @@
+// Framework preparation only: never import a route, render an app component or call
+// application code. Imports cannot be unloaded or interrupted inside V8; the
+// native parent bounds bootstrap and owns cancellation of the entire child.
+export async function prewarmFramework({ routes, options, load, signal }, {
+  now = () => performance.now(), rss = () => process.memoryUsage().rss,
+} = {}) {
+  if (!Number.isFinite(options?.timeoutMs) || options.timeoutMs <= 0 || options.timeoutMs > 30000
+    || !Number.isFinite(options?.maxRssMb) || options.maxRssMb <= 0 || options.maxRssMb > 2048) {
+    throw new TypeError('Invalid framework prewarm budget');
+  }
+  const started = now(), deadline = started + options.timeoutMs, loaded = [];
+  const available = () => signal?.aborted ? 'cancelled'
+    : now() >= deadline ? 'timeout'
+    : rss() >= options.maxRssMb * 1024 * 1024 ? 'rss' : undefined;
+  const result = reason => ({ ready: !reason, reason, loaded, durationMs: Math.max(0, now() - started) });
+  const nodeRoutes = routes.filter(route => (route.cacheConfig?.runtime ?? route.handlerConfig?.runtime) !== 'edge');
+  const modules = [];
+  if (nodeRoutes.some(route => route.router === 'app' && route.kind === 'page')) modules.push('app-render');
+  if (nodeRoutes.some(route => route.router !== 'app' && route.kind === 'page')) modules.push('render');
+  if (nodeRoutes.some(route => route.kind === 'api')) modules.push('api');
+  for (const name of modules) {
+    let reason = available();
+    if (reason) return result(reason);
+    const module = await load(name);
+    reason = available();
+    if (reason) return result(reason);
+    if (name === 'app-render') {
+      await module.prewarmAppRenderer({ ...options, timeoutMs: Math.max(1, deadline - now()), signal });
+      reason = available();
+      if (reason) return result(reason);
+    }
+    loaded.push(name);
+  }
+  return result(available());
+}

package/runtime/project-lock.mjs

@@ -0,0 +1,71 @@
+import { mkdir, writeFile, rename, rm, realpath, lstat, open } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { hostname } from 'node:os';
+import path from 'node:path';
+
+const LOCK = '.prnext-build.lock';
+const busy = message => Object.assign(new Error(message), { code: 'PRNEXT_BUILD_LOCKED' });
+function alive(pid) {
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return error.code !== 'ESRCH'; }
+}
+async function owner(directory) {
+  const info = await lstat(directory);
+  if (!info.isDirectory() || info.isSymbolicLink()) throw busy(`The project lock is not a real directory. Check ${path.basename(directory)} before retrying.`);
+  const file = await open(path.join(directory, 'owner.json'), 'r');
+  try {
+    if ((await file.stat()).size > 4096) throw new Error('oversized owner');
+    const value = JSON.parse(await file.readFile('utf8'));
+    if (!Number.isSafeInteger(value.pid) || value.pid < 1 || typeof value.host !== 'string' || !/^[a-f0-9-]{36}$/.test(value.token)) throw new Error('invalid owner');
+    return value;
+  } finally { await file.close(); }
+}
+
+/** One publisher per canonical project, covering React and direct static imports. */
+export async function withBuildLock(directory, action, {development = false} = {}) {
+  const root = await realpath(directory), lock = path.join(root, development ? '.prnext-dev.lock' : LOCK);
+  const identity = { pid: process.pid, host: hostname(), token: randomUUID(), createdAt: new Date().toISOString() };
+  const prepared = path.join(root, `.prnext-lock-${identity.token}`);
+  await mkdir(prepared, { mode: 0o700 });
+  try {
+    await writeFile(path.join(prepared, 'owner.json'), JSON.stringify(identity), { flag: 'wx', mode: 0o600 });
+    for (let attempt = 0; ; attempt++) {
+      try { await rename(prepared, lock); break; }
+      catch (error) {
+        if (!['EEXIST', 'ENOTEMPTY', 'EPERM', 'EACCES'].includes(error.code)) throw error;
+        let previous;
+        try { previous = await owner(lock); }
+        catch (cause) {
+          if (cause.code === 'ENOENT' && attempt < 8) continue;
+          throw busy(`Cannot verify the project lock. Check ${path.basename(lock)} before retrying.`);
+        }
+        if (previous.host !== identity.host || alive(previous.pid)) throw busy(development ? `A development server is already running for this project (PID ${previous.pid}). Stop it before starting another.` : `A build is already running for this project (PID ${previous.pid}). Wait for it to finish.`);
+        // Exactly one contender can recover this generation. Never delete a lock
+        // merely because it is old: long builds and suspended processes are valid.
+        let claim;
+        try { claim = await open(path.join(lock, 'recovery'), 'wx', 0o600); }
+        catch (cause) {
+          if (cause.code === 'ENOENT' && attempt < 8) continue;
+          throw busy(`Project lock recovery is in progress. Retry shortly; if recovery was interrupted, check ${path.basename(lock)} manually.`);
+        }
+        const retired = path.join(root, `.prnext-lock-retired-${identity.token}`);
+        try {
+          await claim.writeFile(JSON.stringify(identity)); await claim.close(); claim = null;
+          const current = await owner(lock);
+          if (current.token !== previous.token) {
+            // Do not unlink through this path: the new owner can release and
+            // another generation can appear between our read and the unlink.
+            throw busy('The build lock changed during recovery. Retry the build.');
+          }
+          await rename(lock, retired);
+          await rm(retired, { recursive: true });
+        } finally { await claim?.close(); }
+      }
+    }
+    try { return await action(root); }
+    finally {
+      // Ownership must still match before releasing a lock.
+      if ((await owner(lock)).token === identity.token) await rm(lock, { recursive: true });
+    }
+  } finally { await rm(prepared, { recursive: true, force: true }); }
+}

package/runtime/request-transport.mjs

@@ -1,41 +1,121 @@
 const MAX_HEADER = 256 * 1024;
 const MAX_BODY = 32 * 1024 * 1024;
+export const REQUEST_BODY_CHUNK = 64 * 1024;
 const EMPTY_BODY = Buffer.alloc(0);
+export const requestBodyState = Symbol('PRNext request body state');
 
-// Awaiting the consumer preserves socket backpressure. At most one body is
-// assembled, and binary bytes never pass through JSON strings or base64.
-export async function* requestFrames(source, { authenticate } = {}) {
-  let fragments = [], size = 0, input, body, offset = 0;
-  for await (const chunk of source) {
-    let cursor = 0;
-    while (cursor < chunk.length) {
-      if (body) {
-        const length = Math.min(body.length - offset, chunk.length - cursor);
-        chunk.copy(body, offset, cursor, cursor + length);
-        cursor += length; offset += length;
-        if (offset !== body.length) continue;
-        input.body = body; body = undefined; offset = 0;
-        yield input; input = undefined;
-        continue;
+// One owner reads a lane. Streaming bodies borrow this reader until their
+// invocation finishes; body bytes are never parsed as request metadata.
+function laneReader(source) {
+  const iterator = source[Symbol.asyncIterator]?.() || source[Symbol.iterator]();
+  let chunk = EMPTY_BODY, offset = 0, ended = false;
+  async function available() {
+    while (offset === chunk.length && !ended) {
+      const next = await iterator.next(); ended = !!next.done;
+      chunk = ended ? EMPTY_BODY : next.value; offset = 0;
+      if (!Buffer.isBuffer(chunk)) chunk = Buffer.from(chunk);
+    }
+    return !ended;
+  }
+  return {
+    async line(limit) {
+      const parts = []; let size = 0;
+      while (await available()) {
+        const end = chunk.indexOf(10, offset), stop = end < 0 ? chunk.length : end;
+        const part = chunk.subarray(offset, stop); size += part.length;
+        if (size > limit) throw new Error('Request transport header exceeds limit');
+        parts.push(part); offset = end < 0 ? stop : end + 1;
+        if (end >= 0) return (parts.length === 1 ? parts[0] : Buffer.concat(parts, size)).toString();
+      }
+      if (size) throw new Error('Truncated request transport header');
+      return undefined;
+    },
+    async exact(length) {
+      if (length === 0) return EMPTY_BODY;
+      const result = Buffer.allocUnsafe(length); let written = 0;
+      while (written < length) {
+        if (!await available()) throw new Error('Truncated request transport body');
+        const count = Math.min(length - written, chunk.length - offset);
+        chunk.copy(result, written, offset, offset + count); written += count; offset += count;
       }
-      const end = chunk.indexOf(10, cursor);
-      const part = chunk.subarray(cursor, end < 0 ? chunk.length : end);
-      size += part.length;
-      if (size > (authenticate ? 256 : MAX_HEADER)) throw new Error('Request transport header exceeds limit');
-      fragments.push(part);
-      cursor = end < 0 ? chunk.length : end + 1;
-      if (end < 0) continue;
-      const line = fragments.length === 1 ? part.toString() : Buffer.concat(fragments, size).toString();
-      fragments = []; size = 0;
-      if (authenticate) { authenticate(line); authenticate = undefined; continue; }
-      if (!line.trim()) continue;
-      input = JSON.parse(line);
-      if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Invalid request frame');
-      if (input.bodyLength === undefined) { yield input; input = undefined; continue; }
+      return result;
+    },
+    destroy() { source.destroy?.(); },
+  };
+}
+
+function streamingBody(reader, input, credit) {
+  const descriptor = input.bodyStream;
+  if (!descriptor || descriptor.version !== 1 || Object.keys(descriptor).some(key => !['version', 'length', 'maxBytes'].includes(key)) ||
+      descriptor.maxBytes !== MAX_BODY || !(descriptor.length === null || Number.isSafeInteger(descriptor.length) && descriptor.length >= 0 && descriptor.length <= MAX_BODY) ||
+      input.bodyLength !== undefined || input.body !== undefined || !Number.isSafeInteger(input.id) || input.id < 1 || ['GET', 'HEAD'].includes(input.method)) {
+    throw new Error('Invalid streaming request descriptor');
+  }
+  let controller, complete = false, total = 0, cancelled = false;
+  const state = { get complete() { return complete; }, get bytes() { return total; }, cancel() {
+    if (complete || cancelled) return;
+    cancelled = true;
+    try { controller?.error(new Error('Request body transport cancelled')); } catch {}
+    reader.destroy();
+  } };
+  const body = new ReadableStream({
+    start(value) { controller = value; },
+    async pull(value) {
+      try {
+        // A single explicit credit authorizes one frame. No speculative read
+        // consumes an upload while the application is not reading.
+        await credit({ id: input.id, type: 'bodycredit', length: REQUEST_BODY_CHUNK });
+        const header = await reader.exact(4), length = header.readUInt32BE();
+        if (length === 0xffffffff) {
+          const code = (await reader.exact(1))[0];
+          const kinds = { 1: ['PRNEXT_BODY_LIMIT', 413], 2: ['PRNEXT_BODY_TIMEOUT', 408], 3: ['PRNEXT_BODY_READ', 400], 4: ['PRNEXT_BODY_LENGTH', 400] };
+          if (!kinds[code]) throw new Error('Invalid request body error frame');
+          throw Object.assign(new Error('Request body transport failed'), { code: kinds[code][0], statusCode: kinds[code][1] });
+        }
+        if (length === 0) {
+          if (descriptor.length !== null && total !== descriptor.length) throw new Error('Request body length mismatch');
+          complete = true; value.close(); return;
+        }
+        if (length > REQUEST_BODY_CHUNK || total + length > MAX_BODY || descriptor.length !== null && total + length > descriptor.length) throw new Error('Request body exceeds its transport budget');
+        const bytes = await reader.exact(length); total += bytes.length; value.enqueue(bytes);
+      } catch (error) {
+        if (cancelled) return;
+        value.error(error);
+        if (!/^PRNEXT_BODY_(LIMIT|TIMEOUT|READ|LENGTH)$/.test(error.code || '')) reader.destroy();
+      }
+    },
+    async cancel() { cancelled = true; await credit({ id: input.id, type: 'bodycancel' }); },
+  }, { highWaterMark: 0 });
+  Object.defineProperty(input, requestBodyState, { value: state });
+  return body;
+}
+
+export async function* requestFrames(source, { authenticate, streamBodies = false, credit } = {}) {
+  const reader = laneReader(source);
+  if (authenticate) {
+    const token = await reader.line(256);
+    if (token === undefined) throw new Error('Truncated request authentication');
+    authenticate(token);
+  }
+  for (;;) {
+    const line = await reader.line(MAX_HEADER);
+    if (line === undefined) return;
+    if (!line.trim()) continue;
+    const input = JSON.parse(line);
+    if (!input || typeof input !== 'object' || Array.isArray(input)) throw new Error('Invalid request frame');
+    if (input.bodyStream !== undefined) {
+      if (!authenticate || !streamBodies || typeof credit !== 'function') throw new Error('Streaming request protocol was not negotiated');
+      input.body = streamingBody(reader, input, credit);
+      try { yield input; }
+      finally { input[requestBodyState].cancel(); }
+      // Streaming upload lanes are single-use: an early response cannot turn
+      // unread upload bytes into another request. The Node host stays warm.
+      return;
+    }
+    if (input.bodyLength !== undefined) {
       if (!Number.isSafeInteger(input.bodyLength) || input.bodyLength < 0 || input.bodyLength > MAX_BODY) throw new Error('Invalid request body length');
-      if (input.bodyLength === 0) { input.body = EMPTY_BODY; yield input; input = undefined; }
-      else body = Buffer.allocUnsafe(input.bodyLength);
+      input.body = await reader.exact(input.bodyLength);
     }
+    yield input;
   }
-  if (size || body || authenticate) throw new Error('Truncated request transport frame');
 }