@thomas.f/prnext 0.1.19-alpha → 0.1.21-alpha

package/build/parallel-plan.mjs

@@ -0,0 +1,55 @@
+import {availableParallelism, freemem} from 'node:os';
+import {mapConcurrent} from './concurrent.mjs';
+import {mkdir, writeFile} from 'node:fs/promises';
+import path from 'node:path';
+import {createHash} from 'node:crypto';
+
+// Budget admission, not a claim to cap esbuild/PostCSS process RSS. A single
+// heavy custom transform can exceed its estimate, so unknown hooks stay serial.
+export function buildPlanConcurrency(options, {cpus = availableParallelism(), freeBytes = freemem()} = {}) {
+  if (!options) return 1;
+  return Math.max(1, Math.min(options.maxWorkers, cpus, Math.floor(options.maxMemoryMb / 256), Math.floor(freeBytes / (512 * 1024 * 1024))));
+}
+
+export function immutableStylePlan(routes, getPlan) {
+  const jobs = new Map();
+  const plannedRoutes = routes.map(route => Object.freeze({id: route.id, parallel: !!route.parallel,
+    scopes: Object.freeze(getPlan(route).map(scope => {
+      const styles = Object.freeze([...scope.styles]);
+      const signature = JSON.stringify(styles);
+      if (!jobs.has(signature)) jobs.set(signature, Object.freeze({signature, styles}));
+      return Object.freeze({signature, path: scope.path, kind: scope.kind});
+    })),
+  }));
+  return Object.freeze({routes: Object.freeze(plannedRoutes), jobs: Object.freeze([...jobs.values()])});
+}
+
+export async function executeStylePlan(plan, run, options) {
+  const concurrency = buildPlanConcurrency(options);
+  const outputs = await mapConcurrent(plan.jobs, run, concurrency);
+  return {outputs: new Map(plan.jobs.map((job, index) => [job.signature, outputs[index]])), concurrency};
+}
+
+// Independent CSS graphs can emit the same url() asset. Compile in parallel,
+// but publish each exact output once. Keep only hashes and settled promises,
+// not all completed bundles, so memory stays bounded by admitted jobs.
+export function createStyleOutputWriter(directory) {
+  const root = path.resolve(directory), outputs = new Map();
+  return async files => {
+    for (const file of files) {
+      const target = path.resolve(file.path), relative = path.relative(root, target);
+      if (!relative || relative === '..' || relative.startsWith('..' + path.sep) || path.isAbsolute(relative)) throw new Error('Style output escaped its build directory');
+      const key = process.platform === 'win32' ? target.toLowerCase() : target;
+      const hash = createHash('sha256').update(file.contents).digest('hex');
+      const previous = outputs.get(key);
+      if (previous) {
+        if (previous.hash !== hash) throw new Error(`Conflicting style output: ${relative}`);
+        await previous.written;
+      } else {
+        const written = (async () => {await mkdir(path.dirname(target), {recursive: true}); await writeFile(target, file.contents);})();
+        outputs.set(key, {hash, written});
+        await written;
+      }
+    }
+  };
+}

package/build/persistent-cache.mjs

@@ -6,10 +6,15 @@ import {open,lstat,mkdir,realpath,readFile,readdir,rename,unlink} from 'node:fs/
 import path from 'node:path';
 import {fileURLToPath} from 'node:url';
 import {createRequire} from 'node:module';
+import {deflateRaw,inflateRaw} from 'node:zlib';
+import {promisify} from 'node:util';
+export {pruneCompilerCache} from '../runtime/compile-cache-retention.mjs';
 
 export const cacheHash=value=>createHash('sha256').update(value).digest('hex');
 const packageRoot=fileURLToPath(new URL('../',import.meta.url)),require=createRequire(import.meta.url);
 const MAX_DISK=64*1024*1024;
+const compress=promisify(deflateRaw),decompress=promisify(inflateRaw);
+const MAGIC=Buffer.from('PRNC2\0'),HEADER=MAGIC.length+4+32+32;
 let frameworkIdentity;
 async function frameworkHash(){
   frameworkIdentity??=(async()=>{
@@ -59,45 +64,45 @@ export async function privateCacheDirectory(root,kind){
     return directory;
   }catch{return null;}
 }
-/** Best-effort V8 cache retention; never follow links or traverse app sources. */
-export async function pruneCompilerCache(directory,{maxBytes=64*1024*1024,maxFiles=2048}={}){
-  if(!directory)return;
-  try{
-    const files=[];let scanned=0;
-    async function collect(folder,depth){
-      if(depth>3||scanned>=8192)return;
-      for(const entry of await readdir(folder,{withFileTypes:true})){
-        if(++scanned>8192)break;
-        const name=path.join(folder,entry.name),info=await lstat(name).catch(()=>null);
-        if(!info||info.isSymbolicLink())continue;
-        if(info.isDirectory())await collect(name,depth+1);
-        else if(info.isFile())files.push({name,size:info.size,time:info.mtimeMs});
-      }
-    }
-    const info=await lstat(directory);if(!info.isDirectory()||info.isSymbolicLink())return;
-    await collect(directory,0);files.sort((a,b)=>b.time-a.time);let bytes=0;
-    for(let i=0;i<files.length;i++){bytes+=files[i].size;if(i>=maxFiles||bytes>maxBytes)await unlink(files[i].name).catch(()=>{});}
-  }catch{/* Optional caches must never prevent compilation. */}
-}
 export async function readCacheRecord(directory,key,limit=16*1024*1024){
-  if(!directory||!/^[a-f0-9]{64}$/.test(key))return null;
+  if(!directory||!/^[a-f0-9]{64}$/.test(key)||!Number.isSafeInteger(limit)||limit<1||limit>64*1024*1024)return null;
   let file;
   try{
     const name=path.join(directory,key+'.json'),info=await lstat(name);
     if(!info.isFile()||info.isSymbolicLink()||info.size>limit)return null;
     file=await open(name,fsConstants.O_RDONLY|(fsConstants.O_NOFOLLOW||0));
     const stat=await file.stat();if(!stat.isFile()||stat.size>limit)return null;
-    const record=JSON.parse(await file.readFile('utf8'));
+    const body=await file.readFile();
+    if(body.subarray(0,MAGIC.length).equals(MAGIC)){
+      if(body.length<HEADER)return null;
+      const size=body.readUInt32BE(MAGIC.length);
+      if(size>limit||body.subarray(MAGIC.length+4,MAGIC.length+36).toString('hex')!==key)return null;
+      const payload=await decompress(body.subarray(HEADER),{maxOutputLength:Math.max(1,size)});
+      if(payload.length!==size||cacheHash(payload)!==body.subarray(MAGIC.length+36,HEADER).toString('hex'))return null;
+      return JSON.parse(payload.toString('utf8'));
+    }
+    const record=JSON.parse(body.toString('utf8'));
     if(record.version!==1||record.key!==key||typeof record.payload!=='string'||cacheHash(record.payload)!==record.checksum)return null;
     return JSON.parse(record.payload);
   }catch{return null;}finally{await file?.close().catch(()=>{});}
 }
 export async function writeCacheRecord(directory,key,value,limit=16*1024*1024,{maxFiles=64}={}){
-  if(!directory||!/^[a-f0-9]{64}$/.test(key))return false;
+  if(!directory||!/^[a-f0-9]{64}$/.test(key)||!Number.isSafeInteger(limit)||limit<1||limit>64*1024*1024)return false;
   if(!Number.isInteger(maxFiles)||maxFiles<1||maxFiles>4096)return false;
   const filename=path.join(directory,key+'.json'),temporary=filename+'.'+randomUUID()+'.tmp';
   try{
-    const payload=JSON.stringify(value),body=JSON.stringify({version:1,key,checksum:cacheHash(payload),payload});
+    const payload=JSON.stringify(value);if(payload===undefined||Buffer.byteLength(payload)>limit)return false;
+    let body=JSON.stringify({version:1,key,checksum:cacheHash(payload),payload});
+    // Large, repetitive JSON benefits from one encoding instead of embedding a
+    // second escaped JSON string. Keep small records compatible with v1.
+    if(Buffer.byteLength(payload)>=16384){
+      const bytes=Buffer.from(payload),packed=await compress(bytes,{level:1});
+      if(packed.length+HEADER<bytes.length*0.9){
+        const header=Buffer.alloc(HEADER);MAGIC.copy(header);header.writeUInt32BE(bytes.length,MAGIC.length);
+        Buffer.from(key,'hex').copy(header,MAGIC.length+4);Buffer.from(cacheHash(bytes),'hex').copy(header,MAGIC.length+36);
+        body=Buffer.concat([header,packed]);
+      }
+    }
     if(Buffer.byteLength(body)>limit)return false;
     const file=await open(temporary,'wx',0o600);try{await file.writeFile(body);}finally{await file.close();}
     await rename(temporary,filename);

package/build/production-check.mjs

@@ -0,0 +1,34 @@
+import {isIP} from 'node:net';
+
+/** Configuration checks only: external proxies, databases and sessions need live tests. */
+export function productionDiagnostics(config,project,{env=process.env}={}){
+  const diagnostics=[];
+  const locations={'production-static':'output','production-origin':'server.publicOrigin','production-origin-https':'server.publicOrigin','production-proxy':'server.trustedProxies','production-proxy-range':'server.trustedProxies','production-auth-cookies':'navigationCache.authCookies','production-action-origins':'experimental.serverActions.allowedOrigins','production-source-maps':'productionBrowserSourceMaps'};
+  const add=(id,severity,message,action,location)=>diagnostics.push({id,code:id,path:location||locations[id]||'production',severity,message,...(action?{action}:{})});
+  if(config.output==='export'){
+    add('production-static','info','Static export does not run the PRNext HTTP server.','Check HTTPS, headers and health checks at the static host.');
+  }else{
+    const origin=config.server?.publicOrigin;
+    if(!origin)add('production-origin','warning','The public server origin is not configured.','Set server.publicOrigin to the public HTTPS origin used by redirects, authentication callbacks and request URLs.');
+    else{
+      const url=new URL(origin),hostname=url.hostname,loopback=hostname==='localhost'||hostname==='[::1]'||(isIP(hostname)===4&&hostname.startsWith('127.'));
+      if(url.protocol!=='https:'&&!loopback)add('production-origin-https','warning','The public server origin uses HTTP.','Use an HTTPS public origin and test secure cookies and authentication callbacks through the real proxy.');
+      else add('production-origin','info','The public server origin is configured.');
+    }
+    if(config.server?.trustedProxies?.length)add('production-proxy','info','Forwarded host and protocol are accepted only from the configured proxy addresses.','Bind the application to the private interface and configure the proxy to replace forwarded headers.');
+    if(config.server?.trustedProxies?.some(value=>/\/0$/.test(value)))add('production-proxy-range','error','A trusted proxy range includes every remote address.','Replace /0 ranges with the exact proxy IP addresses or private CIDRs.');
+  }
+  if(project?.routes.some(route=>route.router==='app')&&config.output!=='export'){
+    if(config.navigationCache?.maxEntries>0&&!config.navigationCache?.authCookies?.length)add('production-auth-cookies','warning','Retained App pages have no explicit authentication cookie names.','For authenticated applications, set navigationCache.authCookies to the exact session cookie names, including secure variants. Test account A → sign out → account B without retaining private drafts.');
+    else if(config.navigationCache?.authCookies?.length)add('production-auth-cookies','info','Authentication cookie changes enable strict retained-page state resets.','Test account A → sign out → account B in the browser; this check does not verify application session behavior.');
+    if(config.experimental?.serverActions?.allowedOrigins?.some(value=>value.includes('*')))add('production-action-origins','warning','Server Actions allow wildcard origin patterns.','Use the narrowest trusted host patterns and test rejected cross-origin mutations.');
+  }
+  const experiments=['nextScriptWorkers','lazyDynamicImports','streamingRequestBodies','nativePprShell','parallelBuilds'].filter(key=>config.experimental?.[key]);
+  if(config.reactCompiler?.backend==='oxc')experiments.push('reactCompiler.backend=oxc');
+  if(config.partialPrefetching)experiments.push('partialPrefetching');
+  if(env.PRNEXT_SSR_STREAM==='node')experiments.push('PRNEXT_SSR_STREAM=node');
+  for(const option of experiments)add('production-experimental','warning',`Experimental option enabled: ${option}.`,'Qualify this exact option on the deployment workload and keep its documented fallback available.',option.includes('=')?option.split('=')[0]:option==='partialPrefetching'?option:'experimental.'+option);
+  if(config.productionBrowserSourceMaps)add('production-source-maps','warning','Production browser source maps are enabled.','Confirm that exposing original browser sources is intentional.');
+  add('production-validation','info','Configuration preflight does not prove production readiness.','Build the final artifact, test public HTTPS, account changes, health checks, rollback and application dependencies before switching traffic.');
+  return diagnostics;
+}

package/build/react-compiler-report.mjs

@@ -30,9 +30,10 @@ export const withReactCompilerReporting = run => reports.run({ files: new Map(),
 export function configureReactCompilerReporting({ root, config, buildId, dev, compilerVersion }) {
   const state = reports.getStore();
   if (state) Object.assign(state, { root: path.resolve(root), enabled: !!config?.reactCompiler,
-    options: config?.reactCompiler || null, buildId, dev: !!dev, compilerVersion });
+    options: config?.reactCompiler || null, buildId, dev: !!dev, compilerVersion, backend: config?.reactCompiler?.backend || 'babel' });
 }
 export const withReactCompilerGraph = (target, run) => graphs.run(target, run);
+export const reactCompilerGraphTarget = () => graphs.getStore();
 
 /** Capture a narrow, source-free subset of the pinned compiler's public events. */
 export function compilerEvent(event, functions, { moduleOptOut = false, root = '' } = {}) {
@@ -70,7 +71,7 @@ export function recordReactCompilerTransform(file, payload, { cacheHit = false }
   if (!state.files.has(relative) && state.files.size >= FILE_LIMIT) { state.truncated = true; return; }
   let record = state.files.get(relative);
   if (!record) state.files.set(relative, record = { file: relative, transforms: 0, cacheReuses: 0,
-    targets: new Set(), notes: new Set(), functions: new Map() });
+    targets: new Set(), notes: new Set(), functions: new Map(), diagnostics: new Map() });
   record.transforms++; record.cacheReuses += Number(cacheHit);
   const target = graphs.getStore() || 'unspecified';
   record.targets.add(target);
@@ -93,6 +94,16 @@ export function recordReactCompilerTransform(file, payload, { cacheHit = false }
     if (fn.events.size < EVENT_LIMIT && state.eventCount < TOTAL_EVENT_LIMIT) { fn.events.set(detailKey, { ...detail, targets: new Set([target]) }); state.eventCount++; }
     else state.truncated = true;
   }
+  // Oxc reports native diagnostics, not function-success events. Keep these at
+  // file scope rather than inventing function identities or optimized counts.
+  for (const event of payload.diagnostics || []) {
+    const detail = { kind: event.kind, status: event.status, reason: event.reason, category: event.category };
+    const key = JSON.stringify(detail);
+    if (record.diagnostics.has(key)) { record.diagnostics.get(key).targets.add(target); continue; }
+    if (record.diagnostics.size < EVENT_LIMIT && state.eventCount < TOTAL_EVENT_LIMIT) {
+      record.diagnostics.set(key, { ...detail, targets: new Set([target]) }); state.eventCount++;
+    } else state.truncated = true;
+  }
   if (payload.truncated) state.truncated = true;
 }
 export function recordReactCompilerGraph(result) {
@@ -115,13 +126,14 @@ export function reactCompilerReport() {
   if (!state) return null;
   const files = [...state.files.values()].sort((a, b) => a.file.localeCompare(b.file)).map(file => ({
     file: file.file, transforms: file.transforms, cacheReuses: file.cacheReuses, targets: [...file.targets].sort(), notes: [...file.notes].sort(),
+    diagnostics: [...file.diagnostics.values()].map(({ targets, ...event }) => ({ ...event, targets: [...targets].sort() })),
     functions: [...file.functions.values()].map(fn => ({ name: fn.name, start: fn.start, end: fn.end,
       status: fn.statuses.size === 1 ? [...fn.statuses][0] : 'mixed', targets: [...fn.targets].sort(),
       events: [...fn.events.values()].map(({ targets, ...event }) => ({ ...event, targets: [...targets].sort() })) }))
       .sort((a, b) => (a.start?.line || 0) - (b.start?.line || 0) || (a.start?.column || 0) - (b.start?.column || 0)),
   }));
   const summary = summarize(files);
-  return { version: 1, compilerVersion: state.compilerVersion || null, enabled: !!state.enabled,
+  return { version: 1, backend: state.backend || 'babel', compilerVersion: state.compilerVersion || null, enabled: !!state.enabled,
     buildId: state.buildId || null, mode: state.dev ? 'development' : 'production', scope: 'observed-transforms',
     options: state.enabled ? state.options : null, truncated: state.truncated, summary, files,
     graphs: [...state.graphs.values()].map(graph => ({ target: graph.target, metadataAvailable: graph.metadataAvailable,
@@ -178,9 +190,15 @@ function validReport(report) {
   const targets = value => Array.isArray(value) && value.length <= 4 && value.every(target => ['browser', 'node', 'edge', 'unspecified'].includes(target));
   const validPosition = value => value === null || keys(value, ['line', 'column']) && !!position(value);
   const options = report?.options;
-  const validOptions = options === null || options === true || keys(options, ['compilationMode', 'panicThreshold', 'target'])
+  const validOptions = options === null || options === true || keys(options, ['backend', 'compilationMode', 'panicThreshold', 'target'])
+    && (options.backend === undefined || ['babel', 'oxc'].includes(options.backend))
     && ['infer', 'annotation'].includes(options.compilationMode) && ['none', 'critical_errors', 'all_errors'].includes(options.panicThreshold) && options.target === '19';
-  return keys(report, ['version', 'compilerVersion', 'enabled', 'buildId', 'mode', 'scope', 'options', 'truncated', 'summary', 'files', 'graphs'])
+  const validDiagnostic = event => keys(event, ['kind', 'status', 'reason', 'category', 'targets'])
+    && ['CompileError', 'CompileDiagnostic'].includes(event.kind) && ['error', 'diagnostic'].includes(event.status)
+    && boundedText(event.reason) && boundedText(event.category) && targets(event.targets);
+  return keys(report, ['version', 'backend', 'compilerVersion', 'enabled', 'buildId', 'mode', 'scope', 'options', 'truncated', 'summary', 'files', 'graphs'])
+    && (report.backend === undefined || ['babel', 'oxc'].includes(report.backend))
+    && (report.backend || 'babel') === (options?.backend || 'babel')
     && report.version === 1 && report.scope === 'observed-transforms' && typeof report.enabled === 'boolean' && validOptions
     && typeof report.truncated === 'boolean' && ['development', 'production'].includes(report.mode)
     && boundedText(report.buildId) && boundedText(report.compilerVersion)
@@ -189,8 +207,9 @@ function validReport(report) {
     && Array.isArray(report.files) && report.files.length <= FILE_LIMIT && report.summary.files === report.files.length
     && report.files.every(file => file && typeof file === 'object')
     && new Set(report.files.map(file => file.file)).size === report.files.length
-    && report.files.every(file => keys(file, ['file', 'transforms', 'cacheReuses', 'targets', 'notes', 'functions'])
+    && report.files.every(file => keys(file, ['file', 'transforms', 'cacheReuses', 'targets', 'notes', 'functions', 'diagnostics'])
       && safePath(file.file) && count(file.transforms) && count(file.cacheReuses) && file.cacheReuses <= file.transforms && targets(file.targets)
+      && (file.diagnostics === undefined || Array.isArray(file.diagnostics) && file.diagnostics.length <= EVENT_LIMIT && file.diagnostics.every(validDiagnostic))
       && Array.isArray(file.notes) && file.notes.length <= 16 && file.notes.every(boundedText)
       && Array.isArray(file.functions) && file.functions.length <= FUNCTION_LIMIT && file.functions.every(fn => keys(fn, ['name', 'start', 'end', 'status', 'targets', 'events'])
         && boundedText(fn.name) && statuses.has(fn.status) && validPosition(fn.start) && validPosition(fn.end) && targets(fn.targets)
@@ -208,18 +227,22 @@ function validReport(report) {
 function summarize(files) {
   const summary = { files: files.length, functions: 0, optimized: 0, skipped: 0, errors: 0, diagnostics: 0, mixed: 0, transforms: 0, cacheReuses: 0 };
   for (const file of files) { summary.transforms += file.transforms; summary.cacheReuses += file.cacheReuses;
-    for (const fn of file.functions) { summary.functions++; summary[({ error: 'errors', diagnostic: 'diagnostics' })[fn.status] || fn.status]++; } }
+    for (const fn of file.functions) { summary.functions++; summary[({ error: 'errors', diagnostic: 'diagnostics' })[fn.status] || fn.status]++; }
+    for (const diagnostic of file.diagnostics || []) summary[diagnostic.status === 'error' ? 'errors' : 'diagnostics']++;
+  }
   return summary;
 }
 export function printReactCompilerReport(report, { details = false, log = console.log } = {}) {
   if (!report.enabled) { log('React Compiler: disabled. Enable reactCompiler in the application configuration.'); return; }
   const summary = report.summary;
-  log(`React Compiler ${report.compilerVersion}: ${summary.optimized} optimized, ${summary.skipped} skipped, ${summary.errors} errors, ${summary.diagnostics} diagnostics, ${summary.mixed} mixed.`);
+  if (report.backend === 'oxc') log(`React Compiler oxc ${report.compilerVersion}: function optimization totals unavailable; ${summary.errors} errors, ${summary.diagnostics} diagnostics.`);
+  else log(`React Compiler ${report.compilerVersion}: ${summary.optimized} optimized, ${summary.skipped} skipped, ${summary.errors} errors, ${summary.diagnostics} diagnostics, ${summary.mixed} mixed.`);
   log(`Observed transforms only: ${summary.files} files; ${summary.cacheReuses}/${summary.transforms} transforms reused cached compiler results.${report.truncated ? ' Report truncated at its safety limit.' : ''}`);
   if (report.graphs.some(graph => graph.unobservedInputs || !graph.metadataAvailable)) log('Some graph inputs were not observed by React Compiler; totals do not describe every application component.');
   if (details) for (const file of report.files) {
     log(file.file);
     for (const fn of file.functions) log(`  ${fn.name || '(anonymous)'}${fn.start ? ':' + fn.start.line : ''}: ${fn.status}${fn.events.some(event => event.reason) ? ' — ' + [...new Set(fn.events.map(event => event.reason).filter(Boolean))].join('; ') : ''}`);
+    for (const diagnostic of file.diagnostics || []) log(`  ${diagnostic.status}: ${diagnostic.reason || diagnostic.category || 'Oxc diagnostic'}`);
     for (const note of file.notes) log('  ' + note);
   }
 }

package/build/react-compiler.mjs

@@ -1,19 +1,21 @@
 import { realpath } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import { cachedAsyncTransform } from './transform-cache.mjs';
 import { extractSourceMap, inlineSourceMap, sourceMapsEnabled } from './source-maps.mjs';
-import { compilerEvent, recordReactCompilerTransform } from './react-compiler-report.mjs';
+import { compilerEvent, recordReactCompilerTransform, reactCompilerGraphTarget } from './react-compiler-report.mjs';
 
 const require = createRequire(import.meta.url);
-// Only metadata is loaded here. Disabled builds do not load Babel or the compiler.
+// Oxc is an optional peer. Disabled/Babel builds must not resolve it at all.
 export const REACT_COMPILER_VERSION = require('babel-plugin-react-compiler/package.json').version;
+export const OXC_REACT_COMPILER_VERSION = require('../package.json').peerDependencies['oxc-transform-react'];
 const BABEL_VERSION = require('@babel/core/package.json').version;
 const frameworkRoot = fileURLToPath(new URL('../', import.meta.url));
-const options = new Set(['compilationMode', 'panicThreshold', 'target']);
+const options = new Set(['backend', 'compilationMode', 'panicThreshold', 'target']);
 let implementation;
-const REPORT_CACHE_VERSION = 1;
+const oxcImplementations = new Map();
+const REPORT_CACHE_VERSION = 2;
 const optOutDirective = directives => directives?.map(item => item.value.value).find(value => value === 'use no memo' || value === 'use no forget') || false;
 
 function functionLocations(ast) {
@@ -48,14 +50,37 @@ export function normalizeReactCompilerConfig(value) {
     if (!options.has(key)) throw new TypeError(`reactCompiler.${String(key)} is not supported by PRNext.`);
   }
   const compilationMode = input.compilationMode === undefined ? 'infer' : input.compilationMode;
+  const backend = input.backend === undefined ? 'babel' : input.backend;
   const panicThreshold = input.panicThreshold === undefined ? 'none' : input.panicThreshold;
   const target = input.target === undefined ? '19' : input.target;
   if (!['infer', 'annotation'].includes(compilationMode)) throw new TypeError('reactCompiler.compilationMode must be infer or annotation.');
   if (!['none', 'critical_errors', 'all_errors'].includes(panicThreshold)) throw new TypeError('reactCompiler.panicThreshold must be none, critical_errors or all_errors.');
   if (target !== '19') throw new TypeError("reactCompiler.target must be '19'; PRNext requires React 19.");
-  return Object.freeze({ compilationMode, panicThreshold, target });
+  if (!['babel', 'oxc'].includes(backend)) throw new TypeError('reactCompiler.backend must be babel or oxc.');
+  return Object.freeze({ ...(backend === 'oxc' ? { backend } : {}), compilationMode, panicThreshold, target });
 }
 
+function oxcDependency(projectRoot) {
+  const candidates = projectRoot ? [createRequire(path.join(path.resolve(projectRoot), 'package.json')), require] : [require];
+  let metadata, owner, missing;
+  for (const candidate of candidates) {
+    try { metadata = candidate('oxc-transform-react/package.json'); owner = candidate; break; }
+    catch (cause) {
+      if (cause.code !== 'MODULE_NOT_FOUND' && cause.code !== 'ERR_MODULE_NOT_FOUND') throw cause;
+      missing = cause;
+    }
+  }
+  if (!owner) throw Object.assign(new Error(`reactCompiler.backend="oxc" requires oxc-transform-react@${OXC_REACT_COMPILER_VERSION}. Install it with npm install --save-dev oxc-transform-react@${OXC_REACT_COMPILER_VERSION}, or select backend:"babel".`, {cause: missing}), {code: 'PRNEXT_OXC_MISSING'});
+  if (metadata.name !== 'oxc-transform-react' || metadata.version !== OXC_REACT_COMPILER_VERSION) {
+    throw Object.assign(new Error(`reactCompiler.backend="oxc" requires oxc-transform-react@${OXC_REACT_COMPILER_VERSION}; found ${metadata.version || 'an unknown version'}. Install the supported version with npm install --save-dev oxc-transform-react@${OXC_REACT_COMPILER_VERSION}.`), {code: 'PRNEXT_OXC_VERSION'});
+  }
+  // Resolve and import from the same dependency owner. A global CLI must use
+  // its application's peer, while nested framework installations still work.
+  return {version: metadata.version, entry: owner.resolve('oxc-transform-react')};
+}
+
+export const reactCompilerVersion = (config, projectRoot) => config?.backend === 'oxc' ? oxcDependency(projectRoot).version : REACT_COMPILER_VERSION;
+
 function inside(root, filename) {
   const relative = path.relative(root, filename);
   return relative !== '' && relative !== '..' && !relative.startsWith('..' + path.sep) && !path.isAbsolute(relative);
@@ -75,14 +100,74 @@ function loadImplementation() {
   return implementation;
 }
 
+function loadOxcImplementation(dependency) {
+  if (!oxcImplementations.has(dependency.entry)) oxcImplementations.set(dependency.entry, Promise.all([import(pathToFileURL(dependency.entry).href), import('oxc-parser')]).then(([compiler, parser]) => {
+    if (compiler.__napiBindingTarget !== 'native') throw new Error('reactCompiler.backend="oxc" requires the native platform binding. Install optional dependencies or select backend:"babel".');
+    return { transform: compiler.transform, parse: parser.parseSync };
+  }).catch(cause => {
+    throw new Error(`Cannot load the native oxc-transform-react@${OXC_REACT_COMPILER_VERSION} compiler. Reinstall it with optional dependencies enabled on this platform, or select backend:"babel". ${cause.message}`, {cause});
+  }));
+  return oxcImplementations.get(dependency.entry);
+}
+
+/** Compose only source-map coordinates; application strings never enter this path. */
+async function composeOxcMap(output, input) {
+  if (!input || !output) return output;
+  const { TraceMap, decodedMappings, originalPositionFor, sourceContentFor, encodedMap } = await import('@jridgewell/trace-mapping');
+  const previous = new TraceMap(input), current = new TraceMap(output);
+  const sources = [], contents = [], names = [];
+  const mappings = decodedMappings(current).map(line => line.map(segment => {
+    if (segment.length < 4) return [segment[0]];
+    const position = originalPositionFor(previous, { line: segment[2] + 1, column: segment[3] });
+    if (position.source === null || position.line === null || position.column === null) return [segment[0]];
+    let source = sources.indexOf(position.source);
+    if (source < 0) { source = sources.length; sources.push(position.source); contents.push(sourceContentFor(previous, position.source)); }
+    const mapped = [segment[0], source, position.line - 1, position.column];
+    const name = position.name || (segment.length > 4 ? current.names[segment[4]] : null);
+    if (name) { let index = names.indexOf(name); if (index < 0) { index = names.length; names.push(name); } mapped.push(index); }
+    return mapped;
+  }));
+  return encodedMap(new TraceMap({ version: 3, sources, sourcesContent: contents, names, mappings }));
+}
+
+async function transformOxc(source, filename, normalized, { mapped, outputMode, loaderOutput, root, dependency }) {
+  const { transform, parse } = await loadOxcImplementation(dependency);
+  const { code, map } = extractSourceMap(source);
+  const lang = /\.tsx$/i.test(filename) ? 'tsx' : /\.[cm]?ts$/i.test(filename) ? 'ts' : 'jsx';
+  // The native transform does not expose directives. Inspect its original input
+  // with the existing Rust parser, never Babel, before entering executable modules.
+  const parsed = parse(filename, code, { lang, sourceType: 'unambiguous' });
+  const directives = [];
+  if (!parsed.errors.length) for (const statement of parsed.program.body) {
+    if (!statement.directive) break;
+    directives.push(statement.directive);
+  }
+  if (directives.includes('use server')) return { code: source, events: [], notes: ['Server Action module excluded.'] };
+  const result = await transform(filename, code, { lang, sourceType: 'unambiguous', jsx: 'preserve', sourcemap: mapped,
+    reactCompiler: { compilationMode: normalized.compilationMode, panicThreshold: normalized.panicThreshold,
+      target: normalized.target, outputMode, reportDiagnostics: true, sources: [''] } });
+  const diagnostics = result.errors.slice(0, 16).map(error => compilerEvent({
+    kind: result.fatal ? 'CompileError' : 'CompileDiagnostic', reason: error.message, detail: { category: 'Oxc' },
+  }, [], { root })).filter(Boolean);
+  const notes = ['Experimental Oxc backend; upstream does not expose per-function optimization events. Function optimization totals are unavailable.',
+    `Oxc output mode: ${outputMode}. TypeScript syntax is removed; JSX is preserved for the graph compiler.`];
+  if (normalized.compilationMode === 'annotation') notes.push('Annotation mode only selects functions with "use memo".');
+  if (loaderOutput) notes.push('Locations refer to JavaScript produced by the configured loader.');
+  return { code: result.fatal ? source : mapped ? inlineSourceMap(result.code, await composeOxcMap(result.map, map)) : result.code,
+    events: [], diagnostics, notes, fatal: result.fatal, truncated: result.errors.length > 16 };
+}
+
 /**
- * Run the official compiler on application source before JSX lowering, React
- * Refresh and framework instrumentation. JSX/TypeScript/module format remain
- * intact for the existing graph compiler. No app Babel configuration is loaded.
+ * Compile application source before JSX lowering and React Refresh. The Oxc
+ * development path instruments original JSX first, before native hoisting.
+ * JSX remains available to the graph compiler; Oxc also removes TypeScript.
+ * No application Babel configuration is loaded.
  */
 export function createReactCompilerTransform(projectRoot, config, { dev = false } = {}) {
   const normalized = normalizeReactCompilerConfig(config);
   if (!normalized) return async source => source;
+  const dependency = normalized.backend === 'oxc' ? oxcDependency(projectRoot) : null;
+  const compilerVersion = dependency?.version || REACT_COMPILER_VERSION;
   const root = path.resolve(projectRoot);
   const canonicalRoot = realpath(root).catch(error => {
     if (error.code === 'ENOENT') return root;
@@ -102,10 +187,15 @@ export function createReactCompilerTransform(projectRoot, config, { dev = false
       throw error;
     });
     if (excluded(actualRoot, actualFile) || inside(await canonicalFramework, actualFile)) return source;
+    const backend = normalized.backend || 'babel';
+    const graph = reactCompilerGraphTarget();
+    const outputMode = graph === 'node' || graph === 'edge' ? 'ssr' : 'client';
     let cacheHit = true;
     const serialized = await cachedAsyncTransform('react-compiler-report', source,
-      [REPORT_CACHE_VERSION, REACT_COMPILER_VERSION, BABEL_VERSION, normalized, root, actualRoot, filename, actualFile, !!dev, !!loaderOutput], async () => {
+      [REPORT_CACHE_VERSION, backend, compilerVersion, dependency?.entry, backend === 'babel' ? BABEL_VERSION : null,
+        normalized, root, actualRoot, filename, actualFile, !!dev, !!loaderOutput, backend === 'oxc' ? outputMode : null], async () => {
         cacheHit = false;
+        if (backend === 'oxc') return JSON.stringify(await transformOxc(source, filename, normalized, { mapped: sourceMapsEnabled(), outputMode, loaderOutput, root, dependency }));
         const { babel, compiler } = await loadImplementation();
         const mapped = sourceMapsEnabled();
         const { code, map } = extractSourceMap(source);
@@ -134,6 +224,7 @@ export function createReactCompilerTransform(projectRoot, config, { dev = false
       });
     const payload = JSON.parse(serialized);
     recordReactCompilerTransform(inside(root, filename) ? filename : path.resolve(root, path.relative(actualRoot, actualFile)), payload, { cacheHit });
+    if (payload.fatal) throw new Error(`React Compiler (oxc ${OXC_REACT_COMPILER_VERSION}) failed for ${filename}: ${payload.diagnostics.map(value => value.reason).join('; ') || 'Native compilation failed.'}`);
     return payload.code;
   };
 }

package/build/server-config.mjs

@@ -0,0 +1,35 @@
+import { isIP } from 'node:net';
+
+export function validateServerConfig(value) {
+  if (value === undefined) return { trustedProxies: [] };
+  if (!value || typeof value !== 'object' || Array.isArray(value) || Object.keys(value).some(key => !['publicOrigin', 'trustedProxies'].includes(key))) {
+    throw new TypeError('server must be an object with publicOrigin and trustedProxies.');
+  }
+  let publicOrigin;
+  if (value.publicOrigin !== undefined) {
+    const source = value.publicOrigin;
+    let url;
+    try { url = new URL(source); } catch { /* validated below */ }
+    if (typeof source !== 'string' || /[\s\\\u0000-\u001f\u007f]/.test(source) || !url || !['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.pathname !== '/' || url.search || url.hash || source.includes('?') || source.includes('#')) {
+      throw new TypeError('server.publicOrigin must be an HTTP(S) origin without credentials, path, query or fragment, for example https://example.com.');
+    }
+    publicOrigin = url.origin;
+  }
+  const ranges = value.trustedProxies ?? [];
+  if (!Array.isArray(ranges) || ranges.length > 32 || ranges.some(range => {
+    if (typeof range !== 'string' || range.length > 64) return true;
+    const [address, bits, ...extra] = range.split('/');
+    const family = isIP(address);
+    return !family || extra.length || bits !== undefined && (!/^(0|[1-9]\d*)$/.test(bits) || Number(bits) > (family === 4 ? 32 : 128));
+  })) throw new TypeError('server.trustedProxies must contain at most 32 explicit IP addresses or CIDR ranges.');
+  const normalized = ranges.map(range => {
+    const [address, bits] = range.split('/');
+    if (isIP(address) !== 6) return range;
+    const mapped = /^\[::ffff:([\da-f]+):([\da-f]+)\]$/i.exec(new URL(`http://[${address}]`).hostname);
+    if (!mapped) return range;
+    if (bits !== undefined && Number(bits) < 96) throw new TypeError('Mapped IPv4 proxy CIDR ranges need a prefix of at least 96 bits.');
+    const high = parseInt(mapped[1], 16), low = parseInt(mapped[2], 16);
+    return `${high >>> 8}.${high & 255}.${low >>> 8}.${low & 255}${bits === undefined ? '' : '/' + (Number(bits) - 96)}`;
+  });
+  return { ...(publicOrigin ? { publicOrigin } : {}), trustedProxies: [...new Set(normalized)] };
+}