@tschk/moonshine-deploy-vercel 0.4.0 → 0.4.4

package/README.md

@@ -18,3 +18,17 @@ route becomes a separate function; `revalidation` is not supported.
 
 See [docs/DEPLOYMENT.md](../../docs/DEPLOYMENT.md) and
 [docs/MANIFEST.md](../../docs/MANIFEST.md).
+
+Native manifests support only the Node runtime. The adapter bundles one standalone
+Node 22 function (`index.mjs`) containing the native renderer and route modules.
+Build Output filesystem routing serves public client assets first, then sends
+requests through the complete loader/action/middleware pipeline, including routes
+marked static. No React or Solid runtime is included. For native builds, only files within the build's `public` directory can enter
+Vercel static output. Legacy explicit external asset registrations remain supported,
+while the build's `dist` directory and registered server entry are excluded.
+
+Native Edge, request context, islands/hydration, and cache/revalidation options are
+rejected. Local acceptance runs the relocated function under actual Node HTTP with
+a small filesystem-routing harness; this does not emulate Vercel infrastructure
+or establish a public deployment. Legacy rendering requires the optional
+`@tschk/moonshine-react` peer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tschk/moonshine-deploy-vercel",
-  "version": "0.4.0",
+  "version": "0.4.4",
   "license": "ISC",
   "type": "module",
   "main": "./src/index.ts",
@@ -15,18 +15,25 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@tschk/moonshine-compiler": "^0.3.6",
-    "@tschk/moonshine-framework": "^0.3.6",
-    "@tschk/moonshine-react": "^0.3.6",
-    "@tschk/moonshine-router": "^0.3.6",
-    "@tschk/moonshine-server": "^0.3.6"
+    "@tschk/moonshine-framework": "^0.4.4",
+    "@tschk/moonshine-router": "^0.4.4",
+    "@tschk/moonshine-server": "^0.4.4",
+    "@tschk/moonshine-deploy-node": "^0.4.4"
   },
   "devDependencies": {
     "@types/bun": "1.3.14",
     "typescript": "7.0.2",
-    "@tschk/moonshine-adapter-conformance": "^0.3.6"
+    "@tschk/moonshine-adapter-conformance": "^0.4.4"
   },
   "files": [
     "src"
-  ]
+  ],
+  "peerDependencies": {
+    "@tschk/moonshine-react": "^0.4.4"
+  },
+  "peerDependenciesMeta": {
+    "@tschk/moonshine-react": {
+      "optional": true
+    }
+  }
 }

package/src/index.ts

@@ -1,13 +1,19 @@
-import { copyFile, mkdir, writeFile } from "node:fs/promises";
-import { dirname, isAbsolute, resolve } from "node:path";
+import { copyFile, mkdir, realpath, rm, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+import { fileURLToPath } from "node:url";
 import { tryServeStatic } from "@tschk/moonshine-server";
-import { reactRenderer, type RenderContext } from "@tschk/moonshine-react";
-import type {
-  DeploymentAdapter,
-  MoonshineManifest,
-  RouteArtifact,
-  Harness,
-  HarnessFactory,
+
+import {
+  type DeploymentAdapter,
+  type MoonshineManifest,
+  type RenderContext,
+  type RouteArtifact,
+  type Harness,
+  type HarnessFactory,
+  resolveManifestFiles,
+  copyAssets,
+  validateRuntime,
+  validateCapabilities,
 } from "@tschk/moonshine-framework";
 
 type VercelRoute = {
@@ -20,92 +26,6 @@ type VercelConfig = {
   routes: VercelRoute[];
 };
 
-function resolveManifestFiles(
-  manifest: MoonshineManifest,
-  projectRoot: string,
-): MoonshineManifest {
-  return {
-    ...manifest,
-    routes: manifest.routes.map((route) => ({
-      ...route,
-      file: isAbsolute(route.file)
-        ? route.file
-        : resolve(projectRoot, route.file),
-      ...(route.dataFile && {
-        dataFile: isAbsolute(route.dataFile)
-          ? route.dataFile
-          : resolve(projectRoot, route.dataFile),
-      }),
-      ...(route.layouts && {
-        layouts: route.layouts.map((layout) =>
-          isAbsolute(layout) ? layout : resolve(projectRoot, layout),
-        ),
-      }),
-      ...(route.middleware && {
-        middleware: route.middleware.map((middleware) =>
-          isAbsolute(middleware)
-            ? middleware
-            : resolve(projectRoot, middleware),
-        ),
-      }),
-      ...(route.errorBoundary && {
-        errorBoundary: isAbsolute(route.errorBoundary)
-          ? route.errorBoundary
-          : resolve(projectRoot, route.errorBoundary),
-      }),
-    })),
-  };
-}
-
-async function copyAssets(
-  assets: MoonshineManifest["assets"],
-  outDir: string,
-): Promise<void> {
-  await Promise.all(
-    assets.map(async (asset) => {
-      const source = isAbsolute(asset.file)
-        ? asset.file
-        : resolve(outDir, asset.file);
-      const target = resolve(
-        outDir,
-        (asset.path ?? asset.file).replace(/^\/+/, ""),
-      );
-      await mkdir(dirname(target), { recursive: true });
-      if (source !== target) {
-        await copyFile(source, target);
-      }
-    }),
-  );
-}
-
-function validateRuntime(
-  adapter: DeploymentAdapter,
-  manifest: MoonshineManifest,
-): void {
-  const errors: string[] = [];
-  for (const route of manifest.routes) {
-    if (!adapter.runtimes.includes(route.runtime)) {
-      errors.push(
-        `${adapter.name} adapter does not support route "${route.path}" with runtime "${route.runtime}"; supported runtimes: ${adapter.runtimes.join(", ")}`,
-      );
-    }
-  }
-  if (errors.length) throw new Error(errors.join("\n"));
-}
-
-function validateCapabilities(
-  adapter: DeploymentAdapter,
-  manifest: MoonshineManifest,
-): void {
-  for (const capability of manifest.capabilities) {
-    if (!adapter.capabilities.includes(capability)) {
-      throw new Error(
-        `${adapter.name} adapter does not support capability "${capability}"; supported capabilities: ${adapter.capabilities.join(", ")}`,
-      );
-    }
-  }
-}
-
 function routeToRegex(path: string): string {
   return `^${path
     .replace(/\//g, "\\/")
@@ -132,7 +52,7 @@ async function mapConcurrent<T, R>(
   fn: (item: T) => Promise<R>,
   concurrency: number,
 ): Promise<R[]> {
-  const results = new Array<R>(items.length);
+  const results: R[] = Array.from({ length: items.length });
   const errors: unknown[] = [];
   let index = 0;
 
@@ -163,18 +83,189 @@ async function prerenderRoute(route: RouteArtifact): Promise<string> {
     data: {},
     signal: new AbortController().signal,
   };
+  const { reactRenderer } = await import("@tschk/moonshine-react");
   return reactRenderer.prerender(context);
 }
 
+function validateAssetPath(path: string): void {
+  let decoded = path;
+  try {
+    decoded = decodeURIComponent(path);
+  } catch {
+    /* Literal percent filenames are valid. */
+  }
+  for (const value of [path, decoded]) {
+    if (
+      !value.startsWith("/") ||
+      value.includes("\\") ||
+      Array.from(value).some(
+        (char) => char.charCodeAt(0) < 32 || char.charCodeAt(0) === 127,
+      ) ||
+      value.split("/").includes("..")
+    )
+      throw new Error(`Invalid public asset path: ${path}`);
+  }
+}
+
+/** Native output exposes only public files; legacy registries exclude server bundles. */
+async function copyPublicAssets(
+  manifest: MoonshineManifest,
+  outDir: string,
+  staticDir: string,
+) {
+  await Promise.all(
+    manifest.assets.map(async (asset) => {
+      const source = await realpath(
+        isAbsolute(asset.file) ? asset.file : resolve(outDir, asset.file),
+      );
+      const directory = resolve(
+        outDir,
+        manifest.renderer === "native" ? "public" : "dist",
+      );
+      const canonicalDirectory = await realpath(directory).catch(
+        () => directory,
+      );
+      const sourcePath = relative(canonicalDirectory, source);
+      const withinDirectory =
+        sourcePath !== ".." &&
+        !sourcePath.startsWith(`..${sep}`) &&
+        !isAbsolute(sourcePath);
+      if (manifest.renderer === "native" ? !withinDirectory : withinDirectory)
+        return;
+      if (manifest.renderer !== "native" && manifest.entries.server) {
+        const entry = resolve(outDir, manifest.entries.server);
+        if (source === (await realpath(entry).catch(() => entry))) return;
+      }
+      validateAssetPath(asset.path);
+      const publicDirectory = resolve(outDir, "public");
+      const canonicalPublic = await realpath(publicDirectory).catch(
+        () => publicDirectory,
+      );
+      const publicPath = relative(canonicalPublic, source);
+      const withinPublic =
+        publicPath !== ".." &&
+        !publicPath.startsWith(`..${sep}`) &&
+        !isAbsolute(publicPath);
+      const canonicalUrl =
+        "/" + publicPath.split(sep).map(encodeURIComponent).join("/");
+      const preservePublicFilename =
+        withinPublic &&
+        (manifest.renderer === "native" || asset.path === canonicalUrl);
+      const target = resolve(
+        staticDir,
+        preservePublicFilename ? publicPath : asset.path.replace(/^\/+/, ""),
+      );
+      const targetPath = relative(staticDir, target);
+      if (
+        !targetPath ||
+        targetPath === ".." ||
+        targetPath.startsWith(`..${sep}`) ||
+        isAbsolute(targetPath)
+      )
+        throw new Error(`Invalid public asset path: ${asset.path}`);
+      await mkdir(dirname(target), { recursive: true });
+      if (source !== target) await copyFile(source, target);
+    }),
+  );
+}
+
+async function buildNativeFunction(
+  manifest: MoonshineManifest,
+  outDir: string,
+) {
+  const output = resolve(outDir, ".vercel/output");
+  const funcDir = resolve(output, "functions/moonshine.func");
+  const staticDir = resolve(output, "static");
+  await mkdir(funcDir, { recursive: true });
+  await mkdir(staticDir, { recursive: true });
+  await writeFile(
+    resolve(outDir, "manifest.json"),
+    JSON.stringify(manifest) + "\n",
+  );
+  await copyPublicAssets(manifest, outDir, staticDir);
+  const entryPath = resolve(outDir, "vercel-native.ts");
+  await writeFile(
+    entryPath,
+    `import { createRequestHandler } from "@tschk/moonshine-server";
+import { createNodeHandler } from ${JSON.stringify(fileURLToPath(import.meta.resolve("@tschk/moonshine-deploy-node")))};
+import { modules, renderer } from "./dist/server.js";
+import manifest from "./manifest.json" with { type: "json" };
+const fetch = createRequestHandler({ manifest, modules, renderer });
+export default createNodeHandler({ fetch });
+`,
+  );
+  const result = await Bun.build({
+    entrypoints: [entryPath],
+    outdir: funcDir,
+    naming: "index.mjs",
+    target: "node",
+    packages: "bundle",
+  });
+  if (!result.success)
+    throw new AggregateError(
+      result.logs,
+      "Native Vercel Node function bundle failed",
+    );
+  await writeFile(
+    resolve(funcDir, ".vc-config.json"),
+    JSON.stringify(
+      {
+        runtime: "nodejs22.x",
+        handler: "index.mjs",
+        launcherType: "Nodejs",
+        supportsResponseStreaming: true,
+      },
+      null,
+      2,
+    ) + "\n",
+  );
+  await writeFile(
+    resolve(output, "config.json"),
+    JSON.stringify(
+      {
+        version: 3,
+        routes: [{ handle: "filesystem" }, { src: "/.*", dest: "/moonshine" }],
+      },
+      null,
+      2,
+    ) + "\n",
+  );
+}
+
 export const vercelAdapter: DeploymentAdapter = {
   name: "vercel",
   runtimes: ["node", "vercel-edge"],
   capabilities: ["streaming", "islands", "edge"],
   build: async (manifest, outDir) => {
+    if (manifest.renderer === "native") {
+      if (manifest.routes.some((route) => route.runtime !== "node"))
+        throw new Error("Native Vercel supports only the Node runtime");
+      if (manifest.requestContext)
+        throw new Error("Native Vercel request context is not supported");
+      if (manifest.routes.some((route) => route.mode === "island"))
+        throw new Error("Native island hydration is not implemented");
+      if (
+        manifest.routes.some((route) => route.cache) ||
+        manifest.capabilities.includes("revalidation")
+      )
+        throw new Error(
+          "Native Vercel caching/revalidation is not implemented",
+        );
+    }
     validateRuntime(vercelAdapter, manifest);
     validateCapabilities(vercelAdapter, manifest);
 
     await mkdir(outDir, { recursive: true });
+    await rm(resolve(outDir, ".vercel/output"), {
+      recursive: true,
+      force: true,
+    });
+    if (manifest.renderer === "native") {
+      await buildNativeFunction(manifest, outDir);
+      return;
+    }
+    for (const asset of manifest.assets) validateAssetPath(asset.path);
+    await copyAssets(manifest.assets, outDir);
     const projectRoot = resolve(outDir, "..");
     const resolvedManifest = resolveManifestFiles(manifest, projectRoot);
 
@@ -182,7 +273,6 @@ export const vercelAdapter: DeploymentAdapter = {
       resolve(outDir, "manifest.json"),
       JSON.stringify(resolvedManifest, null, 2) + "\n",
     );
-    await copyAssets(manifest.assets, outDir);
 
     const vercelOutput = resolve(outDir, ".vercel/output");
     const staticDir = resolve(vercelOutput, "static");
@@ -196,9 +286,15 @@ export const vercelAdapter: DeploymentAdapter = {
     const routesConfig = await mapConcurrent(
       resolvedManifest.routes,
       async (route) => {
-        if (route.mode === "static" && !route.path.includes("*")) {
-          const html = await prerenderRoute(route);
+        if (
+          route.mode === "static" &&
+          !route.path.includes("*") &&
+          !route.path.includes(":")
+        ) {
+          // Allocate the output slug before awaiting so concurrent workers
+          // cannot race on `usedSlugs`.
           const slug = staticSlug(route.path, usedSlugs);
+          const html = await prerenderRoute(route);
           await writeFile(resolve(staticDir, `${slug}.html`), html);
           return {
             src: routeToRegex(route.path),
@@ -242,21 +338,7 @@ export default { fetch };
     );
     config.routes.push(...routesConfig);
 
-    await Promise.all(
-      resolvedManifest.assets.map(async (asset) => {
-        const source = isAbsolute(asset.file)
-          ? asset.file
-          : resolve(outDir, asset.file);
-        const target = resolve(
-          staticDir,
-          (asset.path ?? asset.file).replace(/^\/+/, ""),
-        );
-        await mkdir(dirname(target), { recursive: true });
-        if (source !== target) {
-          await copyFile(source, target);
-        }
-      }),
-    );
+    await copyPublicAssets(resolvedManifest, outDir, staticDir);
 
     await writeFile(
       resolve(vercelOutput, "manifest.json"),
@@ -278,7 +360,8 @@ const fetch = createRequestHandler({
   staticDir: join(import.meta.dir, ".vercel/output/static"),
 });
 
-Bun.serve({ port: Number(process.env.PORT) || 0, fetch });
+const envPort = Number(process.env.PORT);
+Bun.serve({ port: Number.isInteger(envPort) && envPort >= 0 && envPort <= 65535 ? envPort : 0, fetch });
 `;
     await writeFile(resolve(outDir, "server.ts"), serverEntry);
   },
@@ -294,7 +377,12 @@ export const vercelHarness: HarnessFactory = (fetch, options) => {
         (request.method === "GET" || request.method === "HEAD") &&
         pathname !== "/"
       ) {
-        const res = await tryServeStatic(options.staticDir, pathname);
+        const res = await tryServeStatic(
+          options.staticDir,
+          pathname,
+          undefined,
+          request.method,
+        );
         if (res) return res;
       }
       return fetch(request);