@vercel/build-utils 13.27.1 → 13.27.2

package/dist/max-duration.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Vercel Functions have historically had a hard timeout limit of 900 seconds
+ * (15 minutes), which has long doubled as the client-side upper bound for
+ * `maxDuration` in `vercel.json` and zero-config function detection.
+ *
+ * The authoritative limit is enforced by server-side validation at deploy time.
+ * The CLI and `@vercel/build-utils` cannot know that limit at build time, so
+ * this client-side bound is intentionally coarse — it exists only to give fast
+ * local feedback on obviously-invalid values.
+ */
+export declare const DEFAULT_MAX_DURATION_LIMIT = 900;
+/**
+ * Internal env var used to skip the client-side `maxDuration` upper-bound check.
+ * When set to `'1'`, the client-side maximum ({@link DEFAULT_MAX_DURATION_LIMIT})
+ * is not applied and validation defers to the server, so the limit can be
+ * adjusted centrally without requiring users to upgrade their CLI. The lower
+ * bound and integer checks are always enforced regardless of this flag.
+ */
+export declare const SKIP_MAX_DURATION_LIMIT_ENV = "VERCEL_CLI_SKIP_MAX_DURATION_LIMIT";
+/**
+ * Returns the client-side upper bound for `maxDuration` in seconds, or
+ * `undefined` when the bound is skipped via {@link SKIP_MAX_DURATION_LIMIT_ENV}
+ * (server-side validation governs the real limit in that case). The lower bound
+ * and integer checks are always enforced by callers regardless of this flag.
+ */
+export declare function getMaxDurationLimit(): number | undefined;
+/**
+ * Returns the JSON Schema fragment used to validate a function's `maxDuration`
+ * in `vercel.json`. When the client-side upper bound is active the integer
+ * branch includes a `maximum`; when skipped via
+ * {@link SKIP_MAX_DURATION_LIMIT_ENV} the `maximum` is omitted so any positive
+ * integer passes schema validation and the server enforces the limit.
+ */
+export declare function getMaxDurationSchema(): {
+    oneOf: ({
+        maximum?: number | undefined;
+        type: string;
+        minimum: number;
+        enum?: undefined;
+    } | {
+        type: string;
+        enum: string[];
+    })[];
+};

package/dist/max-duration.js

@@ -0,0 +1,54 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var max_duration_exports = {};
+__export(max_duration_exports, {
+  DEFAULT_MAX_DURATION_LIMIT: () => DEFAULT_MAX_DURATION_LIMIT,
+  SKIP_MAX_DURATION_LIMIT_ENV: () => SKIP_MAX_DURATION_LIMIT_ENV,
+  getMaxDurationLimit: () => getMaxDurationLimit,
+  getMaxDurationSchema: () => getMaxDurationSchema
+});
+module.exports = __toCommonJS(max_duration_exports);
+const DEFAULT_MAX_DURATION_LIMIT = 900;
+const SKIP_MAX_DURATION_LIMIT_ENV = "VERCEL_CLI_SKIP_MAX_DURATION_LIMIT";
+function getMaxDurationLimit() {
+  if (process.env[SKIP_MAX_DURATION_LIMIT_ENV] === "1") {
+    return void 0;
+  }
+  return DEFAULT_MAX_DURATION_LIMIT;
+}
+function getMaxDurationSchema() {
+  const limit = getMaxDurationLimit();
+  return {
+    oneOf: [
+      {
+        type: "integer",
+        minimum: 1,
+        ...limit !== void 0 ? { maximum: limit } : {}
+      },
+      { type: "string", enum: ["max"] }
+    ]
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DEFAULT_MAX_DURATION_LIMIT,
+  SKIP_MAX_DURATION_LIMIT_ENV,
+  getMaxDurationLimit,
+  getMaxDurationSchema
+});

package/dist/node-entrypoint.d.ts

@@ -1,14 +1,15 @@
 import type FileFsRef from './file-fs-ref';
 /**
  * Check if a Node.js/TypeScript file is a valid API entrypoint by detecting
- * export patterns that correspond to supported handler shapes:
- * - Default function export (req, res handler)
- * - Named HTTP method exports (GET, POST, etc.)
- * - Fetch export
- * - module.exports / exports assignments
+ * the handler export shapes supported by `@vercel/node`:
+ * - Default export (`(req, res)` handler, Web handler, or object of handlers)
+ * - Named HTTP method exports (`GET`, `POST`, …) or a `fetch` export
+ * - `module.exports = <fn>`
+ * - A server that calls `.listen()`
  *
- * Returns `true` on error as a safe default — if we can't read the file,
- * let the existing build pipeline handle it.
+ * Returns `true` on error as a safe default — if we can't read or confidently
+ * analyze the file, let the existing build pipeline handle it rather than risk
+ * dropping a real Vercel Function.
  */
 export declare function isNodeEntrypoint(file: FileFsRef | {
     fsPath?: string;

package/dist/node-entrypoint.js

@@ -32,26 +32,48 @@ __export(node_entrypoint_exports, {
 });
 module.exports = __toCommonJS(node_entrypoint_exports);
 var import_fs = __toESM(require("fs"));
+var import_es_module_lexer = require("es-module-lexer");
+var import_cjs_module_lexer = require("cjs-module-lexer");
 var import_debug = __toESM(require("./debug"));
-const HTTP_METHODS = "GET|HEAD|OPTIONS|POST|PUT|DELETE|PATCH";
-const VALID_EXPORT_PATTERNS = [
-  // ESM default export: export default function handler() {}
-  /export\s+default\b/,
-  // CJS default export: module.exports = (req, res) => {}
-  /module\.exports\s*=/,
-  // ESM named HTTP method or fetch exports: export function GET() {}
-  new RegExp(
-    `export\\s+(?:async\\s+)?(?:function|const|let|var)\\s+(?:${HTTP_METHODS}|fetch)\\b`
-  ),
-  // ESM re-exports: export { GET } or export { handler as default }
-  new RegExp(`export\\s*\\{[^}]*\\b(?:${HTTP_METHODS}|fetch|default)\\b`),
-  // CJS named exports: exports.GET = ... or module.exports.GET = ...
-  new RegExp(`(?:module\\.)?exports\\.(?:${HTTP_METHODS}|fetch|default)\\s*=`),
-  // Server handler: http.createServer(...).listen() with no exports
-  /http\.createServer\s*\(/
+var import_strip_comments_and_literals = require("./strip-comments-and-literals");
+const HANDLER_EXPORTS = /* @__PURE__ */ new Set([
+  "GET",
+  "HEAD",
+  "OPTIONS",
+  "POST",
+  "PUT",
+  "DELETE",
+  "PATCH",
+  "fetch",
+  "default"
+]);
+const EXTRA_HANDLER_PATTERNS = [
+  /\bmodule\.exports\s*=(?!=)/,
+  /\.listen\s*\(/,
+  /\bexport\s*=(?!=)/,
+  /\bexport\s*\*\s*from\b/
 ];
-function stripComments(content) {
-  return content.replace(/\/\/.*$/gm, "").replace(/\/\*[\s\S]*?\*\//g, "");
+async function getHandlerExportNames(content) {
+  const names = /* @__PURE__ */ new Set();
+  let esmUnparsed = false;
+  await import_es_module_lexer.init;
+  try {
+    const [, exports] = (0, import_es_module_lexer.parse)(content);
+    for (const { n } of exports) {
+      if (n)
+        names.add(n);
+    }
+  } catch {
+    esmUnparsed = true;
+  }
+  await (0, import_cjs_module_lexer.init)();
+  try {
+    for (const name of (0, import_cjs_module_lexer.parse)(content).exports) {
+      names.add(name);
+    }
+  } catch {
+  }
+  return { names, esmUnparsed };
 }
 async function isNodeEntrypoint(file) {
   try {
@@ -61,8 +83,15 @@ async function isNodeEntrypoint(file) {
     const content = await import_fs.default.promises.readFile(fsPath, "utf-8");
     if (!content.trim())
       return false;
-    const stripped = stripComments(content);
-    return VALID_EXPORT_PATTERNS.some((pattern) => pattern.test(stripped));
+    const { names, esmUnparsed } = await getHandlerExportNames(content);
+    for (const name of names) {
+      if (HANDLER_EXPORTS.has(name))
+        return true;
+    }
+    if (esmUnparsed)
+      return true;
+    const code = (0, import_strip_comments_and_literals.stripCommentsAndLiterals)(content);
+    return EXTRA_HANDLER_PATTERNS.some((pattern) => pattern.test(code));
   } catch (err) {
     (0, import_debug.default)(`Failed to check Node.js entrypoint: ${err}`);
     return true;

package/dist/schemas.d.ts

@@ -22,15 +22,13 @@ export declare const functionsSchema: {
                 };
                 maxDuration: {
                     oneOf: ({
+                        maximum?: number | undefined;
                         type: string;
                         minimum: number;
-                        maximum: number;
                         enum?: undefined;
                     } | {
                         type: string;
                         enum: string[];
-                        minimum?: undefined;
-                        maximum?: undefined;
                     })[];
                 };
                 regions: {

package/dist/schemas.js

@@ -23,6 +23,7 @@ __export(schemas_exports, {
   packageManifestSchema: () => packageManifestSchema
 });
 module.exports = __toCommonJS(schemas_exports);
+var import_max_duration = require("./max-duration");
 const triggerEventSchemaV1 = {
   type: "object",
   properties: {
@@ -114,12 +115,7 @@ const functionsSchema = {
           minimum: 128,
           maximum: 10240
         },
-        maxDuration: {
-          oneOf: [
-            { type: "integer", minimum: 1, maximum: 900 },
-            { type: "string", enum: ["max"] }
-          ]
-        },
+        maxDuration: (0, import_max_duration.getMaxDurationSchema)(),
         regions: {
           type: "array",
           items: {

package/dist/strip-comments-and-literals.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Replace comments and string / template literals with single spaces, leaving
+ * only the code structure behind.
+ *
+ * Comments and literals are matched by one alternation. Because a literal is
+ * matched as a single token, the engine consumes it whole before it can look
+ * inside — so a comment-like sequence that appears inside a string (for
+ * example an `Accept` header value containing a wildcard media range, or a URL
+ * with `//`) is never treated as the start of a comment. Literals are blanked
+ * rather than preserved so their contents cannot be misread as code either.
+ *
+ * This is intentionally not aware of regex literals: an unescaped `/` cannot
+ * appear inside a regex body, so a comment-opening slash-star sequence cannot
+ * occur there, and callers only test the result for plain code-level tokens.
+ */
+export declare function stripCommentsAndLiterals(content: string): string;

package/dist/strip-comments-and-literals.js

@@ -0,0 +1,39 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var strip_comments_and_literals_exports = {};
+__export(strip_comments_and_literals_exports, {
+  stripCommentsAndLiterals: () => stripCommentsAndLiterals
+});
+module.exports = __toCommonJS(strip_comments_and_literals_exports);
+const BLOCK_COMMENT = /\/\*[\s\S]*?(?:\*\/|$)/;
+const LINE_COMMENT = /\/\/[^\n]*/;
+const DOUBLE_QUOTED = /"(?:\\[\s\S]|[^"\\])*"?/;
+const SINGLE_QUOTED = /'(?:\\[\s\S]|[^'\\])*'?/;
+const TEMPLATE_LITERAL = /`(?:\\[\s\S]|[^`\\])*`?/;
+const COMMENT_OR_LITERAL = new RegExp(
+  [BLOCK_COMMENT, LINE_COMMENT, DOUBLE_QUOTED, SINGLE_QUOTED, TEMPLATE_LITERAL].map((pattern) => pattern.source).join("|"),
+  "g"
+);
+function stripCommentsAndLiterals(content) {
+  return content.replace(COMMENT_OR_LITERAL, " ");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  stripCommentsAndLiterals
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/build-utils",
-  "version": "13.27.1",
+  "version": "13.27.2",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.js",