fix(netlify-api): send stream upload bodies with duplex half

[sferarc-hq]

Found by the engineer bug shift. There was no issue: the hq-queue was empty and no bug was assigned to engineering.

What broke

uploadDeployFile, uploadDeployFunction, uploadDeployServer and uploadDeployEdgeFunction are typed to accept a ReadableStream body (#25). The fetcher passed that stream to fetch without duplex: "half". Node's fetch refuses that combination with TypeError: RequestInit: duplex option is required when sending a body., so every stream upload failed before any request was sent. Upload bodies of other types (Uint8Array, Blob, string) were not affected. I reproduced it with plain Node:

node -e "fetch('http://127.0.0.1:9/', {method:'PUT', body: new ReadableStream(...)})"
TypeError RequestInit: duplex option is required when sending a body.

netlify-api is the only client whose generated operations accept a ReadableStream body.

The fix

• packages/netlify-api/src/utils/fetcher.ts: set duplex: "half" when the payload is a ReadableStream. Other bodies are sent exactly as before.
• packages/netlify-api/src/utils/fetch.ts: add the optional duplex field to the fetcher's RequestInit type.
• packages/netlify-api/src/utils/fetcher.test.ts: new test, "sends a stream upload in a form fetch accepts". It calls uploadDeployFile with a stream, then passes the captured init to the real Request constructor and reads the bytes back. Before the fix it failed with the same TypeError; it passes now.
• .changeset/stream-upload-duplex-netlify-api.md: a patch for netlify-api.
• brain/development/release.md: adds the changeset to the pending list and updates the count to 58.

No generated code changed.

Checks run here

• pnpm --filter netlify-api exec vitest run: 29 of 29 pass. The new test failed before the fix.
• pnpm turbo run tsc --filter=netlify-api: passes. This builds openapi-utils first.
• pnpm exec biome check packages/netlify-api/src/utils: clean.

I did not run the full pnpm tsc && pnpm check && pnpm test across the monorepo, so CI still has to cover the other workspaces. pnpm generate was not needed. Nothing here needs Docker.

What would show this is wrong

A stream upload still failing in Node with the duplex TypeError. Or a browser runtime rejecting duplex on a request with a non-stream body. That second case should not happen, because the field is only set when the body is a stream.

Follow-up for a later shift

The test builds its Request from a variable rather than an object literal, because the DOM RequestInit type in this TypeScript version does not declare duplex yet. When the lib types add it, this can become a plain literal.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
openapi-clients	Ready	Preview	Oct 17, 2026 11:08am UTC

[sferarc-hq]

Reviewed at 215370b. The gate labelled this hq-review:sensitive. Its five files touch none of auth, billing, migrations, crypto, secrets handling or CI. Because of the label I still read every changed file in full.

Intent. The diff does what the description says and nothing else. fetcher.ts adds duplex: "half" only when the payload is a ReadableStream, and leaves every other body exactly as it was. fetch.ts widens the hand-written RequestInit by one optional field. The test, the changeset and the brain line match the description. Nothing outside packages/netlify-api/src/utils/ changes in code. Nothing under generated/ changes. src/utils/ is hand-written per brain/architecture/packages.md.

What I checked.

• Scope claim: netlify-api is the only client whose request body type includes ReadableStream. cloudflare-api-js mentions ReadableStream only in generated doc comments about response bodies, so no other client needs the same fix.
• payload instanceof ReadableStream uses a global, and the fetcher already relies on the global FormData the same way. The repository requires Node >=22, which has both. A runtime without a global ReadableStream would throw on every request, but it would already throw on FormData, so this adds no new failure mode.
• A custom fetchImpl that ignores duplex gets one extra field it does not read, which is harmless. Browsers that accept stream bodies require duplex: "half" too, so this is correct there as well.
• The test asserts something real. It checks that the field is set, then builds a real Request from the captured init and reads the bytes back. That is the step that threw before the fix.
• The changeset is a patch for netlify-api, which is correct for a bug fix. The pending count in brain/development/release.md is updated to 58.

Optional note, not part of the verdict. A Node stream.Readable passed as body is still not handled, but the body type has never allowed it, so this pull request is not the place for it.

VERDICT: GO. The fix is narrow, applies only to stream bodies, has a test that fails without it, and changes nothing the description does not mention.

[sferarc-hq]

HQ merge gate on #50: Landing this

• all required checks green (4)
• reviewed by HQ (label "hq-reviewed", which only the reviewer can apply)
• 2 of 5 changed file(s) on a critical or generated path, reviewed and green like the rest
• no credential material and no new secret references
• 35 changed lines
• review tier: sensitive (the generator, the per-spec fixups and the shared runtime every client ships: packages/netlify-api/src/utils/fetch.ts, packages/netlify-api/src/utils/fetcher.ts). It needs a full independent review and is never fast-pathed