@thomas.f/prnext 0.1.19-alpha → 0.1.21-alpha

package/runtime/rsc-worker.mjs

@@ -32,6 +32,7 @@ import { PartialTemplates, canResumePartialDirectly, partialTemplateReuse } from
 import { createAfterScope } from '../compat/after.cjs';
 import {renderKeyFor} from './app-render-key.mjs';
 import { selectAppStyles } from './app-style-selection.mjs';
+import {createFlightMeasurement} from './flight-diagnostics.mjs';
 
 installFetchCache();
 if (process.env.PRNEXT_INSPECT_DIR) parentPort.postMessage({type:'rsc-ready'});
@@ -173,7 +174,24 @@ function errorBoundary(entry, error, production, before = Infinity) {
   return index < 0 ? null : { kind: 'error', index, error: publicError(error, production) };
 }
 
-async function renderFlight(request, fallback = null, channel = null) {
+function renderFlight(request, fallback = null, channel = null) {
+  const measurement=createFlightMeasurement(request,'rsc');
+  if(!measurement)return renderFlightModel(request,fallback,channel);
+  return observeFlightModel(request,fallback,channel,measurement);
+}
+async function observeFlightModel(request,fallback,channel,measurement){
+  let status;
+  try{
+    const result=await renderFlightModel(request,fallback,channel,measurement,measurement?value=>{status=value;}:undefined);
+    measurement?.finish('completed',result?.status??status);
+    return result;
+  }catch(error){
+    const reason=channel?.signal?.reason;
+    measurement?.finish(error?.statusCode===504||reason?.statusCode===504?'timedOut':channel?.signal?.aborted?'cancelled':'failed',status??error?.statusCode);
+    throw error;
+  }
+}
+async function renderFlightModel(request, fallback, channel,measurement,onStatus) {
   return runRequestContext({ ...request, phase: 'render' }, async () => {
     const cacheContext = currentRequest();
     try {
@@ -220,7 +238,9 @@ async function renderFlight(request, fallback = null, channel = null) {
           const stored = request.production
             ? await partialTemplates.get(request.partialFlight, consumer.serverConsumerManifest, decode, renderSignal)
             : await decode();
-          const live = !model.routing && canResumePartialDirectly(stored) ? model : await createFromReadableStream(boundedPartialFlight(renderToReadableStream(model, bundlerConfig, {
+          const direct=!model.routing&&canResumePartialDirectly(stored);
+          measurement?.partial(direct?'direct':'normalized');
+          const live = direct ? model : await createFromReadableStream(boundedPartialFlight(renderToReadableStream(model, bundlerConfig, {
             signal: renderSignal,
             onError(error) { return publicError(error, request.production).digest; },
           })), consumer);
@@ -295,9 +315,14 @@ async function renderFlight(request, fallback = null, channel = null) {
                 let offset = 0;
                 for (const item of batch) { value.set(item, offset); offset += item.byteLength; }
               }
-              if (!channel.started) channel.start({ status: request.partialFlight ? 200 : fallback?.kind === 'not-found' || (entry.routing && renderError?.digest === 'NEXT_HTTP_ERROR_FALLBACK;404') ? 404 : renderError || fallback?.kind === 'error' ? 500 : request.responseStatus || 200,
-                rscError: Boolean(ordinaryRenderError(renderError)), boundaryIndex: fallback?.index, headers: request.responseHeaders });
+              if (!channel.started) {
+                const status=request.partialFlight?200:fallback?.kind==='not-found'||(entry.routing&&renderError?.digest==='NEXT_HTTP_ERROR_FALLBACK;404')?404:renderError||fallback?.kind==='error'?500:request.responseStatus||200;
+                onStatus?.(status);
+                channel.start({status,rscError:Boolean(ordinaryRenderError(renderError)),boundaryIndex:fallback?.index,headers:request.responseHeaders});
+              }
+              const emittedBytes=measurement?value.byteLength:0;
               await channel.write(value, abort.signal, Boolean(next.result?.done));
+              measurement?.chunk(emittedBytes);
               continue;
             }
             // The byte stream hands ownership of each Uint8Array to its reader.
@@ -315,7 +340,7 @@ async function renderFlight(request, fallback = null, channel = null) {
           if (channel?.started && renderError.statusCode !== 504) { channel.end(); return; }
           if (renderError.digest === 'NEXT_HTTP_ERROR_FALLBACK;404' && !entry.routing) {
             const boundary = (entry.segments || []).findLastIndex((segment, index) => index < (fallback?.index ?? Infinity) && segment.notFound);
-            if (boundary >= 0) return renderFlight({ ...request, cacheState: cacheContext.cacheState, staticState: cacheContext.staticState }, { kind: 'not-found', index: boundary }, channel);
+            if (boundary >= 0) return renderFlightModel({ ...request, cacheState: cacheContext.cacheState, staticState: cacheContext.staticState }, { kind: 'not-found', index: boundary }, channel,measurement,onStatus);
           } else if (ordinaryRenderError(renderError)) {
             if (cacheContext.staticState) throw renderError;
             // Preserve the original errored Flight tree. React's browser
@@ -329,7 +354,7 @@ async function renderFlight(request, fallback = null, channel = null) {
           }
         }
         if (channel) {
-          if (!channel.started) channel.start({ status: request.responseStatus || 200, headers: request.responseHeaders });
+          if (!channel.started) {onStatus?.(request.responseStatus||200);channel.start({ status: request.responseStatus || 200, headers: request.responseHeaders });}
           channel.end();
           return;
         }
@@ -340,6 +365,7 @@ async function renderFlight(request, fallback = null, channel = null) {
         for (const chunk of chunks) {
           body.set(chunk, offset);
           offset += chunk.byteLength;
+          measurement?.chunk(chunk.byteLength);
         }
         return { body: body.buffer, status: staticNavigation?.status || (fallback?.kind === 'not-found' || (entry.routing && renderError?.digest === 'NEXT_HTTP_ERROR_FALLBACK;404') ? 404 : renderError || fallback?.kind === 'error' ? 500 : request.responseStatus || 200),
           rscError: Boolean(ordinaryRenderError(renderError)), boundaryIndex: fallback?.index, headers: { ...request.responseHeaders, ...staticNavigation?.headers },
@@ -409,11 +435,35 @@ const activeRequests = new Set();
 const responseCompletions = new Map();
 const manifests = new Map();
 const artifacts = new Map();
+const preloading = new Map();
 parentPort.on('message', async ({ id, request, type, value, token }) => {
   if(type==='telemetry-flush'){await drainTraces();parentPort.postMessage({type:'telemetry-flushed',token});return;}
+  if(type==='preload-cancel'){preloading.get(id)?.abort(new Error('Framework prewarm was cancelled'));return;}
   if(type==='preload'){
-    try{await preloadModules(value.files,value.options,file=>routeEntry({modulePath:file,production:true}));parentPort.postMessage({type:'preloaded',id});}
-    catch(error){parentPort.postMessage({type:'preloaded',id,error:error.message});}return;
+    const abort=new AbortController();preloading.set(id,abort);let timer,reader,reply,transfer;
+    try{
+      if(value.options.frameworkWarmup){
+        if(value.files.length||!Number.isFinite(value.options.timeoutMs)||value.options.timeoutMs<=0||value.options.timeoutMs>30000||!Number.isFinite(value.options.maxRssMb)||value.options.maxRssMb<=0||value.options.maxRssMb>2048)throw new TypeError('Invalid synthetic renderer prewarm');
+        const deadline=performance.now()+value.options.timeoutMs;
+        const available=()=>{abort.signal.throwIfAborted();if(performance.now()>=deadline||process.memoryUsage().rss>=value.options.maxRssMb*1024*1024)throw new Error('Synthetic renderer prewarm budget exhausted');};
+        timer=setTimeout(()=>abort.abort(new Error('Synthetic renderer prewarm timed out')),value.options.timeoutMs);
+        available();
+        // Host elements and literals only: no routeEntry, application imports,
+        // fetches, caches, contexts or handlers participate in this warm-up.
+        const model={tree:React.createElement('html',null,React.createElement('head'),React.createElement('body',null,React.createElement('main',null,React.createElement('ul',null,Array.from({length:8},(_,index)=>React.createElement('li',{key:index},'PRNext framework '+index)))))),router:{pathname:'/_prnext-prewarm',query:{}}};
+        reader=renderToReadableStream(model,{}, {signal:abort.signal,onError:()=> 'PRNEXT_FRAMEWORK_PREWARM'}).getReader();
+        const chunks=[];let length=0;
+        for(;;){available();const next=await reader.read();if(next.done)break;length+=next.value.byteLength;if(length>65536)throw new Error('Synthetic renderer prewarm Flight exceeds its byte budget');chunks.push(new Uint8Array(next.value));}
+        available();const bytes=new Uint8Array(length);let offset=0;for(const chunk of chunks){bytes.set(chunk,offset);offset+=chunk.length;}
+        await reader.cancel();reader=undefined;
+        reply={type:'preloaded',id,frameworkFlight:bytes.buffer};transfer=[bytes.buffer];
+      }else{
+        abort.signal.throwIfAborted();await preloadModules(value.files,value.options,file=>routeEntry({modulePath:file,production:true}));abort.signal.throwIfAborted();reply={type:'preloaded',id};
+      }
+    }catch(error){reply={type:'preloaded',id,error:error.message};}
+    finally{clearTimeout(timer);await reader?.cancel().catch(()=>{});preloading.delete(id);}
+    parentPort.postMessage(reply,transfer);
+    return;
   }
   if (type === 'after-response') { responseCompletions.get(id)?.(); return; }
   // Only the host arms these probes, while completed responses still have

package/runtime/storage-path.mjs

@@ -0,0 +1,36 @@
+import {lstat, realpath} from 'node:fs/promises';
+import path from 'node:path';
+
+const normalized = filename => process.platform === 'win32' ? path.resolve(filename).toLowerCase() : path.resolve(filename);
+export const sameStoragePath = (left, right) => normalized(left) === normalized(right);
+const ordinary = info => info?.isDirectory() && !info.isSymbolicLink();
+const identity = (left, right) => left.dev === right.dev && left.ino === right.ino && left.birthtimeMs === right.birthtimeMs;
+
+/** Callers supply canonical roots and explicit descendants, never glob results. */
+export async function captureStorageDirectory(directory) {
+  try {
+    directory = path.resolve(directory);
+    const info = await lstat(directory);
+    if (!ordinary(info) || !sameStoragePath(await realpath(directory), directory)) return null;
+    const current = await lstat(directory);
+    if (!ordinary(current) || !identity(info, current)) return null;
+    return {directory, dev: info.dev, ino: info.ino, birthtimeMs: info.birthtimeMs};
+  } catch { return null; }
+}
+
+/** Recheck ancestors around each filesystem operation. Node does not expose an
+ * atomic openat/unlinkat boundary: these guards reject observed replacements,
+ * but are not isolation from a malicious process with the same filesystem rights. */
+export async function verifyStorageDirectories(snapshots) {
+  if (!Array.isArray(snapshots) || !snapshots.length) return false;
+  for (const snapshot of snapshots) {
+    if (!snapshot) return false;
+    try {
+      const info = await lstat(snapshot.directory);
+      if (!ordinary(info) || !identity(info, snapshot) || !sameStoragePath(await realpath(snapshot.directory), snapshot.directory)) return false;
+      const current = await lstat(snapshot.directory);
+      if (!ordinary(current) || !identity(current, snapshot)) return false;
+    } catch { return false; }
+  }
+  return true;
+}

package/runtime/trace.mjs

@@ -2,6 +2,7 @@ import {isControlError} from './navigation.mjs';
 import {AsyncLocalStorage} from 'node:async_hooks';
 import {randomBytes} from 'node:crypto';
 import {createRequire} from 'node:module';
+import {channel} from 'node:diagnostics_channel';
 const scope=new AsyncLocalStorage(),rawFetch=globalThis.fetch;
 let api;
 try{api=createRequire(import.meta.url)('@opentelemetry/api');}catch{}
@@ -9,6 +10,17 @@ const endpoint=process.env.OTEL_EXPORTER_OTLP_TRACES_ENDPOINT||(process.env.OTEL
 const protocol=process.env.OTEL_EXPORTER_OTLP_TRACES_PROTOCOL||process.env.OTEL_EXPORTER_OTLP_PROTOCOL;
 const enabled=process.env.OTEL_SDK_DISABLED!=='true'&&endpoint&&(!protocol||protocol==='http/json');
 const queue=[];let timer,flushing;
+const diagnostics=channel('prnext.telemetry');
+const counters={droppedSpans:0,rejectedSpans:0,exportAttempts:0,exportFailures:0,failedBatches:0,exportedSpans:0};
+let lastWarning=-Infinity;
+export function telemetryDiagnostics(){return {enabled:!!enabled,queuedSpans:queue.length,...counters};}
+function notify(reason){
+  const snapshot=telemetryDiagnostics();
+  // This local channel and fixed-field warning never pass through the exporter.
+  // No collector URL, headers, exception or request attributes are included.
+  if(diagnostics.hasSubscribers)diagnostics.publish({reason,...snapshot});
+  if(reason!=='exported'&&Date.now()-lastWarning>=10000){lastWarning=Date.now();try{console.error('[prnext] telemetry '+JSON.stringify({reason,...snapshot}));}catch{}}
+}
 const epoch=BigInt(Date.now())*1000000n-process.hrtime.bigint();
 const nanos=()=>String(epoch+process.hrtime.bigint());
 export function parseTraceparent(value){
@@ -23,9 +35,25 @@ export function propagatedFetch(input,init){
   return [input,{...init,headers}];
 }
 function enqueue(span){
-  if(!enabled||!span.flags||queue.length>=1024)return;
+  if(!enabled||!span.flags)return;
+  if(queue.length>=1024){counters.droppedSpans++;notify('queue_full');return;}
   queue.push(span);if(!timer)timer=setTimeout(()=>{timer=undefined;void flushTraces();},200).unref();
 }
+async function collectorResult(response,count){
+  const reader=response.body?.getReader();if(!reader)return {rejected:0,warning:false};
+  const chunks=[];let size=0;
+  try{while(true){const {done,value}=await reader.read();if(done)break;size+=value.byteLength;if(size>16384)throw Error('collector response too large');chunks.push(value);}}
+  catch(error){await reader.cancel().catch(()=>{});throw error;}finally{reader.releaseLock();}
+  const body=size?JSON.parse(Buffer.concat(chunks,size).toString('utf8')):{};
+  if(!body||typeof body!=='object'||Array.isArray(body))throw Error('invalid collector response');
+  const partial=body.partialSuccess??body.partial_success;if(partial==null)return {rejected:0,warning:false};
+  if(typeof partial!=='object'||Array.isArray(partial))throw Error('invalid collector partial success');
+  const raw=partial.rejectedSpans??partial.rejected_spans??0;
+  if(typeof raw!=='number'&&!(typeof raw==='string'&&/^\d{1,20}$/.test(raw)))throw Error('invalid collector rejection count');
+  const rejected=Number(raw);
+  if(!Number.isSafeInteger(rejected)||rejected<0||rejected>count)throw Error('invalid collector rejection count');
+  return {rejected,warning:typeof(partial.errorMessage??partial.error_message)==='string'&&!!(partial.errorMessage??partial.error_message)};
+}
 export async function flushTraces(){
   if(flushing)return flushing;
   if(!queue.length)return;
@@ -36,15 +64,27 @@ export async function flushTraces(){
   const spans=queue.splice(0,128);
   flushing=(async()=>{
     const body=JSON.stringify({resourceSpans:[{resource:{attributes:[{key:'service.name',value:{stringValue:process.env.OTEL_SERVICE_NAME||'prnext'}}]},scopeSpans:[{scope:{name:'prnext.runtime'},spans}]}]});
+    let exported=false;
     for(let attempt=0;attempt<3;attempt++){
-      let retry=false;
+      let retry=false,receivedSuccess=false,accepted;
+      counters.exportAttempts++;
       try{
         const response=await rawFetch(endpoint,{method:'POST',redirect:'error',headers,body,signal:AbortSignal.timeout(1000)});
-        retry=[429,502,503,504].includes(response.status);await response.body?.cancel();
-      }catch{retry=true;} // Telemetry failure never changes an application response.
+        receivedSuccess=response.ok;
+        if(receivedSuccess)accepted=await collectorResult(response,spans.length);
+        else{retry=[429,502,503,504].includes(response.status);await response.body?.cancel();}
+      }catch{retry=!receivedSuccess;} // Never replay a successful/partial acknowledgement.
+      if(accepted){
+        exported=true;counters.exportedSpans+=spans.length-accepted.rejected;
+        if(accepted.rejected){counters.rejectedSpans+=accepted.rejected;counters.droppedSpans+=accepted.rejected;counters.exportFailures++;counters.failedBatches++;notify('collector_rejected');}
+        else notify(accepted.warning?'collector_warning':'exported');
+        break;
+      }
+      counters.exportFailures++;
       if(!retry)break;
       if(attempt<2)await new Promise(resolve=>setTimeout(resolve,100*2**attempt).unref());
     }
+    if(!exported){counters.failedBatches++;counters.droppedSpans+=spans.length;notify('export_failed');}
   })().finally(()=>{flushing=undefined;if(queue.length&&!timer)timer=setTimeout(()=>{timer=undefined;void flushTraces();},200).unref();});
   return flushing;
 }

package/runtime/worker.mjs

@@ -7,6 +7,7 @@ import {deferredCompiler} from './dev-compiler-broker.mjs';
 import { requestFrames } from './request-transport.mjs';
 import {scheduleCompileCacheFlush} from './compile-cache.mjs';
 import {preloadModules} from './preload.mjs';
+import {prewarmFramework} from './prewarm.mjs';
 import { requestWork } from './request-work.mjs';
 import { freezeClientModules } from './worker-metadata.mjs';
 import { AsyncResource } from 'node:async_hooks';
@@ -70,6 +71,29 @@ const routes = new Map(manifest.routes.map(route => [route.id, route]));
 const prerendered = new Set((manifest.prerendered || []).map(item => item.path));
 const deployment={distDir,manifest,routes,prerendered,modules:new Map()};
 const deployments=new Map([[distDir,deployment]]);
+const prewarmRequested = process.env.PRNEXT_WORKER_PREWARM === '1';
+delete process.env.PRNEXT_WORKER_PREWARM;
+async function rendererFor(selected,name){
+  if(selected.modules.has(name))return selected.modules.get(name);
+  const pending=workScope.runInAsyncScope(()=>runtimeModule(name,selected.distDir));
+  selected.modules.set(name,pending);
+  try{const module=await pending;selected.modules.set(name,module);return module;}
+  catch(error){if(selected.modules.get(name)===pending)selected.modules.delete(name);throw error;}
+}
+async function prepareFramework(signal) {
+  const configured = manifest.config?.workerPreload;
+  const options = { maxRssMb: configured?.maxRssMb ?? 256, timeoutMs: Math.min(15000, configured?.timeoutMs ?? 15000) };
+  const result = await prewarmFramework({ routes: manifest.routes, options, signal,
+    load: name => rendererFor(deployment, name) });
+  if (diagnostics.enabled) diagnostics.record('wake', { phase: 'framework-prewarm', ...result });
+  if (!result.ready) console.warn(`[prnext] Framework prewarm incomplete (${result.reason}); normal requests remain available.`);
+  return result.ready;
+}
+let frameworkPrewarmed = false;
+if (production && prewarmRequested) {
+  try { frameworkPrewarmed = await prepareFramework(); }
+  catch { console.warn('[prnext] Framework prewarm failed; normal requests remain available.'); }
+}
 const compileDeferred=!production&&compilerDescriptor?deferredCompiler(compilerDescriptor,{root:projectRoot,home:path.dirname(distDir)}):undefined;
 async function deferredDeployment(route,signal,sources=[]){
   if(!compileDeferred)throw Error('Deferred development compiler is unavailable');
@@ -91,15 +115,8 @@ async function drainRuntime(){
 
 async function handleRequest(input, output, signalController, responseComplete, selected=deployment) {
   const {manifest,distDir,routes,prerendered}=selected;
-  const renderer=async name=>{
-    if(selected.modules.has(name))return selected.modules.get(name);
-    // Imports share one pending job, then retain only the namespace. Starting
-    // outside the visitor's ALS scope prevents the module cache retaining it.
-    const pending=workScope.runInAsyncScope(()=>runtimeModule(name,distDir));
-    selected.modules.set(name,pending);
-    try{const module=await pending;selected.modules.set(name,module);return module;}
-    catch(error){if(selected.modules.get(name)===pending)selected.modules.delete(name);throw error;}
-  };
+  // Bootstrap and requests share pending imports outside the visitor's ALS.
+  const renderer=name=>rendererFor(selected,name);
   let responseStarted = false;
   const finalizers = new Set();
   try {
@@ -108,10 +125,8 @@ async function handleRequest(input, output, signalController, responseComplete,
       const options=manifest.config?.workerPreload||(frameworkOnly?{routes:[],maxRssMb:256,timeoutMs:15000}:undefined);
       if(!production||!options){await output(input.id,{status:204,body:''},input);return;}
       if(frameworkOnly){
-        if(manifest.routes.some(route=>route.router==='app'&&route.kind==='page'))await(await renderer('app-render')).prewarmAppRenderer(options);
-        if(manifest.routes.some(route=>route.kind==='page'&&route.router!=='app'))await renderer('render');
-        if(manifest.routes.some(route=>route.kind==='api'))await renderer('api');
-        scheduleCompileCacheFlush();await output(input.id,{status:204,body:''},input);return;
+        frameworkPrewarmed = await prepareFramework(signalController.signal);
+        scheduleCompileCacheFlush();await output(input.id,{status:frameworkPrewarmed?204:503,body:''},input);return;
       }
       const selected=options.routes.map(pattern=>manifest.routes.find(route=>route.pattern===pattern&&!route.internal)).filter(Boolean);
       const deadline=performance.now()+options.timeoutMs;
@@ -142,6 +157,9 @@ async function handleRequest(input, output, signalController, responseComplete,
       ? { ...manifest.middleware, id: '__prnext_middleware', kind: 'middleware' }
       : routes.get(input.routeId);
     if (!route) { await output(input.id, { status: 404, body: 'Not Found' }, input); return; }
+    if (input.bodyStream && (route.router !== 'app' || route.kind !== 'api' || input.renderMode || !manifest.config?.streamingRequestBodies)) {
+      throw new Error('Streaming request bodies require an enabled App Route Handler');
+    }
     const sourceModules=!production&&route.router==='app'&&route.kind==='page'?advancedRoutingSources({...input,basePath:manifest.config?.basePath||''},manifest.routes):[];
     const deferredSources=sourceModules.length?manifest.routes.filter(candidate=>candidate.devDeferred&&sourceModules.includes(candidate.module)).map(candidate=>candidate.pattern):[];
     if(route.devDeferred||deferredSources.length){
@@ -197,7 +215,9 @@ async function handleRequest(input, output, signalController, responseComplete,
     // The application's scope was aborted above, but the lane is still valid
     // for its one error/redirect response. Do not mistake that cleanup signal
     // for a client disconnect while writing the replacement headers.
-    await output(input?.id ?? null, navigationResponse(error) || errorResponse(error, production), { ...input, production });
+    const ingressFailure = /^PRNEXT_BODY_(LIMIT|TIMEOUT|READ|LENGTH)$/.test(error?.code || '')
+      ? { status: error.statusCode, headers: { 'content-type': 'text/plain; charset=utf-8' }, body: 'Request body transport failed' } : undefined;
+    await output(input?.id ?? null, ingressFailure || navigationResponse(error) || errorResponse(error, production), { ...input, production });
     responseComplete?.();
   } finally {
     if (finalizers.size) {
@@ -261,7 +281,7 @@ if (token && laneLimit > 1) {
           const candidate = Buffer.from(line);
           if (candidate.length !== expected.length || !timingSafeEqual(candidate, expected)) throw new Error('Worker authentication failed');
           clearTimeout(authTimer); socket.write('ready\n');
-        } })) {
+        }, streamBodies: true, credit: frame => new Promise((resolve, reject) => socket.write(JSON.stringify(frame) + '\n', error => error ? reject(error) : resolve())) })) {
           if (invocations.size >= laneLimit) throw new Error('Worker invocation capacity exceeded');
           controller = new AbortController();
           const active = controller;
@@ -339,10 +359,10 @@ if (token && laneLimit > 1) {
   });
   server.listen(0, '127.0.0.1', () => {
     if(!production&&typeof globalThis.__PRNEXT_DEV_WORKER_READY__==='function'){
-      globalThis.__PRNEXT_DEV_WORKER_READY__({port:server.address().port,binary:true,gracefulShutdown:true});
+      globalThis.__PRNEXT_DEV_WORKER_READY__({port:server.address().port,binary:true,gracefulShutdown:true,requestBodyStream:1});
       delete globalThis.__PRNEXT_DEV_WORKER_READY__;
     }
-    writeProtocol(JSON.stringify({ port: server.address().port, binary: true, heartbeat: true, activity: reportActivity, gracefulShutdown: true }) + '\n');
+    writeProtocol(JSON.stringify({ port: server.address().port, binary: true, heartbeat: true, activity: reportActivity, gracefulShutdown: true, requestBodyStream: 1, frameworkPrewarmed }) + '\n');
     heartbeat = setInterval(() => {
       // Coalesce the idle transition with the existing heartbeat. Normal
       // request completion adds no stdout messages, and short cache bursts

package/vendor/fontkit/NOTICE.txt

@@ -0,0 +1,5 @@
+Fontkit 2.0.4 Node create() bundle, generated by scripts/prepare-fontkit.mjs.
+Upstream: https://github.com/foliojs/fontkit
+The original code is bundled/minified without patches. Source copyright notices, dependency licenses, README license declarations and exact versions/integrities are retained alongside it.
+fontkit, dfa and brotli declare MIT in their package metadata/README and publish no separate license file. brotli also contains Google Apache-2.0 source notices, retained in SOURCE-NOTICES.txt; the Apache-2.0 text is included with @swc/helpers.
+Use upstream.json to audit/update this bundled dependency when security fixes are released.

package/vendor/fontkit/SOURCE-NOTICES.txt

@@ -0,0 +1,209 @@
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Bit reading helpers
+*/
+
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Collection of static dictionary words.
+*/
+
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Lookup table to map the previous two bytes to a context id.
+
+   There are four different context modeling modes defined here:
+     CONTEXT_LSB6: context id is the least significant 6 bits of the last byte,
+     CONTEXT_MSB6: context id is the most significant 6 bits of the last byte,
+     CONTEXT_UTF8: second-order context model tuned for UTF8-encoded text,
+     CONTEXT_SIGNED: second-order context model tuned for signed integers.
+
+   The context id for the UTF8 context model is calculated as follows. If p1
+   and p2 are the previous two bytes, we calcualte the context as
+
+     context = kContextLookup[p1] | kContextLookup[p2 + 256].
+
+   If the previous two bytes are ASCII characters (i.e. < 128), this will be
+   equivalent to
+
+     context = 4 * context1(p1) + context2(p2),
+
+   where context1 is based on the previous byte in the following way:
+
+     0  : non-ASCII control
+     1  : \t, \n, \r
+     2  : space
+     3  : other punctuation
+     4  : " '
+     5  : %
+     6  : ( < [ {
+     7  : ) > ] }
+     8  : , ; :
+     9  : .
+     10 : =
+     11 : number
+     12 : upper-case vowel
+     13 : upper-case consonant
+     14 : lower-case vowel
+     15 : lower-case consonant
+
+   and context2 is based on the second last byte:
+
+     0 : control, space
+     1 : punctuation
+     2 : upper-case letter, number
+     3 : lower-case letter
+
+   If the last byte is ASCII, and the second last byte is not (in a valid UTF8
+   stream it will be a continuation byte, value between 128 and 191), the
+   context is the same as if the second last byte was an ASCII control or space.
+
+   If the last byte is a UTF8 lead byte (value >= 192), then the next byte will
+   be a continuation byte and the context id is 2 or 3 depending on the LSB of
+   the last byte and to a lesser extent on the second last byte if it is ASCII.
+
+   If the last byte is a UTF8 continuation byte, the second last byte can be:
+     - continuation byte: the next byte is probably ASCII or lead byte (assuming
+       4-byte UTF8 characters are rare) and the context id is 0 or 1.
+     - lead byte (192 - 207): next byte is ASCII or lead byte, context is 0 or 1
+     - lead byte (208 - 255): next byte is continuation byte, context is 2 or 3
+
+   The possible value combinations of the previous two bytes, the range of
+   context ids and the type of the next byte is summarized in the table below:
+
+   |--------\-----------------------------------------------------------------|
+   |         \                         Last byte                              |
+   | Second   \---------------------------------------------------------------|
+   | last byte \    ASCII            |   cont. byte        |   lead byte      |
+   |            \   (0-127)          |   (128-191)         |   (192-)         |
+   |=============|===================|=====================|==================|
+   |  ASCII      | next: ASCII/lead  |  not valid          |  next: cont.     |
+   |  (0-127)    | context: 4 - 63   |                     |  context: 2 - 3  |
+   |-------------|-------------------|---------------------|------------------|
+   |  cont. byte | next: ASCII/lead  |  next: ASCII/lead   |  next: cont.     |
+   |  (128-191)  | context: 4 - 63   |  context: 0 - 1     |  context: 2 - 3  |
+   |-------------|-------------------|---------------------|------------------|
+   |  lead byte  | not valid         |  next: ASCII/lead   |  not valid       |
+   |  (192-207)  |                   |  context: 0 - 1     |                  |
+   |-------------|-------------------|---------------------|------------------|
+   |  lead byte  | not valid         |  next: cont.        |  not valid       |
+   |  (208-)     |                   |  context: 2 - 3     |                  |
+   |-------------|-------------------|---------------------|------------------|
+
+   The context id for the signed context mode is calculated as:
+
+     context = (kContextLookup[512 + p1] << 3) | kContextLookup[512 + p2].
+
+   For any context modeling modes, the context ids can be calculated by |-ing
+   together two lookups from one table using context model dependent offsets:
+
+     context = kContextLookup[offset1 + p1] | kContextLookup[offset2 + p2].
+
+   where offset1 and offset2 are dependent on the context mode.
+*/
+
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Lookup tables to map prefix codes to value ranges. This is used during
+   decoding of the block lengths, literal insertion lengths and copy lengths.
+*/
+
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+   Transformations on dictionary words.
+*/
+
+/* Copyright 2013 Google Inc. All Rights Reserved.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+/**
+   * The font's copyright information
+   * @type {string}
+   */
+
+/******************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */