@netlify/zip-it-and-ship-it 16.2.0 → 16.2.1

package/dist/runtimes/node/utils/zip.d.ts

@@ -1,3 +1,4 @@
+import { Stats } from 'fs';
 import { ArchiveFormat } from '../../../archive.js';
 import type { FeatureFlags } from '../../../feature_flags.js';
 import type { RuntimeCache } from '../../../utils/cache.js';
@@ -29,4 +30,13 @@ interface ZipNodeJsResult {
 export declare const zipNodeJs: ({ archiveFormat, ...options }: ZipNodeParameters & {
     archiveFormat: ArchiveFormat;
 }) => Promise<ZipNodeJsResult>;
+interface ArchiveEntry {
+    destPath: string;
+    srcFile: string;
+    stat: Stats;
+}
+export declare const resolveSymlinkedDestPaths: <T extends ArchiveEntry>(files: T[], { readTarget, rewrites, }?: {
+    readTarget?: (srcFile: string) => Promise<string>;
+    rewrites?: Map<string, string>;
+}) => Promise<T[]>;
 export {};

package/dist/runtimes/node/utils/zip.js

@@ -1,7 +1,7 @@
 import { Buffer } from 'buffer';
 import { mkdir, readlink as readLink, rm, symlink, writeFile } from 'fs/promises';
 import os from 'os';
-import { basename, dirname, extname, join } from 'path';
+import { basename, dirname, extname, isAbsolute, join, posix } from 'path';
 import { getPath as getV2APIPath } from '@netlify/serverless-functions-api';
 import { copyFile } from 'copy-file';
 import pMap from 'p-map';
@@ -66,19 +66,17 @@ const createDirectory = async function ({ aliases = new Map(), basePath, cache,
         addBootstrapFile(srcFiles, aliases);
     }
     const symlinks = new Map();
+    const statted = await Promise.all([...new Set(srcFiles)].map(async (srcFile) => ({
+        srcFile,
+        stat: await cachedLstat(cache.lstatCache, srcFile),
+        destPath: normalizeFilePath({ commonPrefix: basePath, path: aliases.get(srcFile) || srcFile, userNamespace }),
+    })));
     // Copying source files.
-    await pMap(srcFiles, async (srcFile) => {
-        const destPath = aliases.get(srcFile) || srcFile;
-        const normalizedDestPath = normalizeFilePath({
-            commonPrefix: basePath,
-            path: destPath,
-            userNamespace,
-        });
-        const absoluteDestPath = join(functionFolder, normalizedDestPath);
+    await pMap(await resolveSymlinkedDestPaths(statted, { rewrites }), async ({ srcFile, stat, destPath }) => {
+        const absoluteDestPath = join(functionFolder, destPath);
         if (rewrites.has(srcFile)) {
             return mkdirAndWriteFile(absoluteDestPath, rewrites.get(srcFile));
         }
-        const stat = await cachedLstat(cache.lstatCache, srcFile);
         // If the path is a symlink, find the link target and add the link to a
         // `symlinks` map, which we'll later use to create the symlinks in the
         // target directory. We can't do that right now because the target path
@@ -157,18 +155,15 @@ const createZipArchive = async function ({ aliases = new Map(), basePath, branch
     }
     const deduplicatedSrcFiles = [...new Set(srcFiles)];
     const srcFilesInfos = await Promise.all(deduplicatedSrcFiles.map((file) => addStat(cache, file)));
+    const entries = await resolveSymlinkedDestPaths(srcFilesInfos.map(({ srcFile, stat }) => ({
+        srcFile,
+        stat,
+        destPath: normalizeFilePath({ commonPrefix: basePath, path: aliases.get(srcFile) || srcFile, userNamespace }),
+    })), { rewrites });
     // We ensure this is not async, so that the archive's checksum is
     // deterministic. Otherwise it depends on the order the files were added.
-    srcFilesInfos.forEach(({ srcFile, stat }) => {
-        zipJsFile({
-            aliases,
-            archive,
-            commonPrefix: basePath,
-            rewrites,
-            srcFile,
-            stat,
-            userNamespace,
-        });
+    entries.forEach(({ srcFile, stat, destPath }) => {
+        zipJsFile({ archive, destPath, rewrites, srcFile, stat });
     });
     await endZip(archive, output);
     return { path: destPath, entryFilename, bootstrapVersion };
@@ -183,17 +178,85 @@ const addEntryFileToZip = function (archive, { contents, filename }) {
     const contentBuffer = Buffer.from(contents);
     addZipContent(archive, contentBuffer, filename);
 };
+// A tracer that resolves a module through a symlinked directory reports the path
+// it walked, not where the files really live. The archive then holds a link at
+// `node_modules/<pkg>` *and* files under that same path, which cannot both exist
+// once extracted — AWS Lambda rejects the whole bundle for it.
+//
+// Put those entries back on the path the link points at, which is the layout the
+// package manager produced in the first place: files in the store, `node_modules
+// /<pkg>` a link to them. Resolution then works the way it does locally.
+//
+// A link the archive cannot contain — absolute, or reaching above the bundle
+// root — is left alone; rewriting onto it would move entries out of the bundle.
+export const resolveSymlinkedDestPaths = async function (files, { readTarget = readLink, rewrites = new Map(), } = {}) {
+    const links = files.filter(({ stat }) => stat.isSymbolicLink());
+    if (links.length === 0) {
+        return files;
+    }
+    // Resolve in parallel, but record in `links` order: keying off whichever
+    // readlink finished first would make the output depend on IO timing, and the
+    // archive checksum has to be reproducible.
+    const targets = await Promise.all(links.map(({ srcFile }) => readTarget(srcFile)));
+    const realPaths = new Map();
+    links.forEach(({ destPath }, index) => {
+        const target = targets[index];
+        if (isAbsolute(target)) {
+            return;
+        }
+        const realPath = posix.normalize(posix.join(posix.dirname(destPath), target));
+        if (realPath.startsWith('..')) {
+            return;
+        }
+        realPaths.set(destPath, realPath);
+    });
+    if (realPaths.size === 0) {
+        return files;
+    }
+    // Longest first, so a link nested inside another wins over its parent.
+    const candidates = [...realPaths.entries()].sort(([a], [b]) => b.length - a.length);
+    // One rewrite can land under another link, so keep going until the path sits
+    // below none of them. Links that point at each other would otherwise spin
+    // here, so stop as soon as a path repeats.
+    const resolveDestPath = (destPath) => {
+        const visited = new Set([destPath]);
+        let current = destPath;
+        for (;;) {
+            const match = candidates.find(([link]) => current.startsWith(`${link}/`));
+            if (match === undefined) {
+                return current;
+            }
+            const next = match[1] + current.slice(match[0].length);
+            if (visited.has(next)) {
+                return current;
+            }
+            visited.add(next);
+            current = next;
+        }
+    };
+    const byDestPath = new Map();
+    for (const file of files) {
+        const destPath = resolveDestPath(file.destPath);
+        const resolved = destPath === file.destPath ? file : { ...file, destPath };
+        const existing = byDestPath.get(resolved.destPath);
+        // Two spellings of one package can now collapse onto a single path. Keep
+        // the entry whose contents were rewritten — nft patches package.json files
+        // into `rewrites`, and the unpatched twin would ship the wrong manifest.
+        if (existing === undefined || (!rewrites.has(existing.srcFile) && rewrites.has(resolved.srcFile))) {
+            byDestPath.set(resolved.destPath, resolved);
+        }
+    }
+    return [...byDestPath.values()];
+};
 const addStat = async function (cache, srcFile) {
     const stat = await cachedLstat(cache.lstatCache, srcFile);
     return { srcFile, stat };
 };
-const zipJsFile = function ({ aliases = new Map(), archive, commonPrefix, rewrites = new Map(), stat, srcFile, userNamespace, }) {
-    const destPath = aliases.get(srcFile) || srcFile;
-    const normalizedDestPath = normalizeFilePath({ commonPrefix, path: destPath, userNamespace });
+const zipJsFile = function ({ archive, destPath, rewrites = new Map(), stat, srcFile, }) {
     if (rewrites.has(srcFile)) {
-        addZipContent(archive, rewrites.get(srcFile), normalizedDestPath);
+        addZipContent(archive, rewrites.get(srcFile), destPath);
     }
     else {
-        addZipFile(archive, srcFile, normalizedDestPath, stat);
+        addZipFile(archive, srcFile, destPath, stat);
     }
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netlify/zip-it-and-ship-it",
-  "version": "16.2.0",
+  "version": "16.2.1",
   "description": "Zip it and ship it",
   "main": "./dist/main.js",
   "type": "module",
@@ -100,5 +100,5 @@
   "engines": {
     "node": ">=22.12.0"
   },
-  "gitHead": "b1c3e6b1ed61a7be7bc06e4a8e4b2e48f5882de3"
+  "gitHead": "d99b17e8a25b18687ce7b7657621dd22827304b7"
 }