@vercel/python 6.57.1 → 6.58.0

package/dist/index.js

@@ -10403,8 +10403,7 @@ async function runFastAPICollectStatic(venvPath, workPath, env, outputStaticDir,
     return null;
   }
   return {
-    // All mounts (not just copied) so the guard carves out every subtree.
-    mountPrefixes: mounts.map((m) => m.urlPath),
+    collectedMounts: mounts,
     cdnOutputDir: outputStaticDir,
     shadowRoutes,
     // Only copied mounts get a fallback: a check:true dest that is missing makes
@@ -10415,21 +10414,45 @@ async function runFastAPICollectStatic(venvPath, workPath, env, outputStaticDir,
   };
 }
 function fastapiShadowingRoutes(discovery, lambdaPath) {
-  const chunks = [];
-  let srcLen = 0;
-  let dropped = 0;
-  for (const body of discovery.shadowRoutes) {
-    if (SHADOW_SRC_WRAPPER_LENGTH + body.length > MAX_ROUTE_SRC_LENGTH) {
-      dropped += 1;
-      continue;
-    }
-    const current = chunks[chunks.length - 1];
-    if (current && srcLen + 1 + body.length <= MAX_ROUTE_SRC_LENGTH) {
-      current.push(body);
-      srcLen += 1 + body.length;
+  const byMethods = /* @__PURE__ */ new Map();
+  for (const sr of discovery.shadowRoutes) {
+    const key = sr.methods === null ? "" : JSON.stringify([...sr.methods].sort());
+    const group = byMethods.get(key);
+    if (group) {
+      group.push(sr.body);
     } else {
-      chunks.push([body]);
-      srcLen = SHADOW_SRC_WRAPPER_LENGTH + body.length;
+      byMethods.set(key, [sr.body]);
+    }
+  }
+  const routes = [];
+  let dropped = 0;
+  for (const [methodsKey, bodies] of byMethods) {
+    const methods = methodsKey === "" ? void 0 : JSON.parse(methodsKey);
+    const chunks = [];
+    let srcLen = 0;
+    for (const body of bodies) {
+      if (SHADOW_SRC_WRAPPER_LENGTH + body.length > MAX_ROUTE_SRC_LENGTH) {
+        dropped += 1;
+        continue;
+      }
+      const current = chunks[chunks.length - 1];
+      if (current && srcLen + 1 + body.length <= MAX_ROUTE_SRC_LENGTH) {
+        current.push(body);
+        srcLen += 1 + body.length;
+      } else {
+        chunks.push([body]);
+        srcLen = SHADOW_SRC_WRAPPER_LENGTH + body.length;
+      }
+    }
+    for (const chunk of chunks) {
+      routes.push({
+        src: shadowSrc(chunk),
+        dest: `/${lambdaPath}`,
+        ...methods ? { methods } : {},
+        transforms: [
+          { type: "request.path", op: "set", args: "/$1" }
+        ]
+      });
     }
   }
   if (dropped > 0) {
@@ -10437,20 +10460,16 @@ function fastapiShadowingRoutes(discovery, lambdaPath) {
       `FastAPI: ${dropped} shadow route(s) over the ${MAX_ROUTE_SRC_LENGTH} char cap left unshadowed`
     );
   }
-  return chunks.map((bodies) => ({
-    src: shadowSrc(bodies),
-    dest: `/${lambdaPath}`,
-    transforms: [
-      { type: "request.path", op: "set", args: "/$1" }
-    ]
-  }));
+  return routes;
 }
 function escapeRegex(text) {
   return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 var NAVIGATION_ACCEPT_RE = ".*(?:^|[,\\s])(?:text/html|application/xhtml\\+xml)(?=[,;\\s]|$)(?![^,]*;\\s*q=0(?:\\.0+)?(?:[,;\\s]|$)).*";
 function fastapiFallbackRoutes(discovery) {
-  const mountPrefixes = discovery.mountPrefixes.map(trimTrailingSlashes);
+  const mountPrefixes = discovery.collectedMounts.map(
+    (m) => trimTrailingSlashes(m.urlPath)
+  );
   return discovery.fallbacks.flatMap((fb) => {
     const prefix = trimTrailingSlashes(fb.urlPath);
     const nested = mountPrefixes.filter((urlPath) => urlPath.startsWith(`${prefix}/`)).map((urlPath) => urlPath.slice(prefix.length + 1));
@@ -10485,6 +10504,51 @@ function fastapiFallbackRoutes(discovery) {
     ];
   });
 }
+function getFastAPICdnBundle(collectedMounts, workPath, fastapiConfig) {
+  if (fastapiConfig?.static?.exclude === false)
+    return { excludePatterns: [], directoryStubs: {}, redirects: [] };
+  const excludePatterns = [];
+  const directoryStubs = {};
+  const redirects = [];
+  for (const mount of collectedMounts) {
+    const relDir = (0, import_path17.relative)(workPath, mount.directory);
+    if (!relDir || relDir.startsWith("..") || (0, import_path17.isAbsolute)(relDir))
+      continue;
+    const relDirUnix = relDir.split(import_path17.sep).join("/");
+    excludePatterns.push(`${relDirUnix}/**`);
+    directoryStubs[`${relDirUnix}/.static-placeholder`] = new import_build_utils20.FileBlob({
+      data: ""
+    });
+    for (const fallbackFile of ["index.html", "404.html"]) {
+      const fsPath = (0, import_path17.join)(mount.directory, fallbackFile);
+      if (import_fs17.default.existsSync(fsPath)) {
+        directoryStubs[`${relDirUnix}/${fallbackFile}`] = new import_build_utils20.FileFsRef({
+          fsPath
+        });
+      }
+    }
+    if (mount.frontend) {
+      const urlPrefix = mount.urlPath.replace(/^\/+|\/+$/g, "");
+      const addBareRedirects = (absDir) => {
+        for (const entry of import_fs17.default.readdirSync(absDir, { withFileTypes: true })) {
+          if (!entry.isDirectory())
+            continue;
+          const subAbs = (0, import_path17.join)(absDir, entry.name);
+          const subPath = (0, import_path17.relative)(mount.directory, subAbs).split(import_path17.sep).join("/");
+          const urlPath = urlPrefix ? `${urlPrefix}/${subPath}` : subPath;
+          redirects.push({
+            src: `^/${escapeRegex(urlPath)}$`,
+            dest: `/${urlPath}/`,
+            status: 307
+          });
+          addBareRedirects(subAbs);
+        }
+      };
+      addBareRedirects(mount.directory);
+    }
+  }
+  return { excludePatterns, directoryStubs, redirects };
+}
 
 // src/index.ts
 var import_python_analysis12 = require("@vercel/python-analysis");
@@ -12109,11 +12173,22 @@ var build = async ({
       );
     }
   }
+  const excludeFilesPatterns = typeof config?.excludeFiles === "string" ? [config.excludeFiles] : Array.isArray(config?.excludeFiles) ? config.excludeFiles : [];
+  const cdnBundle = getFastAPICdnBundle(
+    fastapiStatic?.collectedMounts ?? [],
+    workPath,
+    pythonPackage.manifest?.data?.tool?.vercel?.fastapi
+  );
   const globOptions = {
     cwd: workPath,
-    ignore: config && typeof config.excludeFiles === "string" ? [...predefinedExcludes, config.excludeFiles] : predefinedExcludes
+    ignore: [
+      ...predefinedExcludes,
+      ...excludeFilesPatterns,
+      ...cdnBundle.excludePatterns
+    ]
   };
   const files = await (0, import_build_utils24.glob)("**", globOptions);
+  Object.assign(files, cdnBundle.directoryStubs);
   const appPythonSourceFiles = Object.keys(files).filter((file) => file.endsWith(".py")).map((file) => (0, import_path21.join)(workPath, file)).sort();
   if (djangoStatic?.manifestRelPath) {
     files[djangoStatic.manifestRelPath] = new import_build_utils24.FileFsRef({
@@ -12634,6 +12709,7 @@ var build = async ({
   const shadowingRoutes = fastapiStatic ? fastapiShadowingRoutes(fastapiStatic, lambdaPath) : [];
   const fallbackRoutes = fastapiStatic ? fastapiFallbackRoutes(fastapiStatic) : [];
   const routes = isNonWebService || !output ? queueRoutes.length > 0 ? queueRoutes : void 0 : [
+    ...cdnBundle.redirects,
     ...shadowingRoutes,
     { handle: "filesystem" },
     ...queueRoutes,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/python",
-  "version": "6.57.1",
+  "version": "6.58.0",
   "main": "./dist/index.js",
   "license": "Apache-2.0",
   "homepage": "https://vercel.com/docs/runtimes#official-runtimes/python",
@@ -14,7 +14,7 @@
     "directory": "packages/python"
   },
   "dependencies": {
-    "@vercel/python-analysis": "0.13.2"
+    "@vercel/python-analysis": "0.14.0"
   },
   "devDependencies": {
     "@renovatebot/pep440": "4.2.1",
@@ -35,8 +35,8 @@
     "smol-toml": "1.5.2",
     "vitest": "4.1.10",
     "which": "3.0.0",
+    "@vercel/build-utils": "14.2.0",
     "@vercel/error-utils": "2.2.1",
-    "@vercel/build-utils": "14.1.1",
     "@vercel/python-runtime": "0.21.0"
   },
   "scripts": {
@@ -44,6 +44,7 @@
     "type-check": "tsc --noEmit",
     "test": "cross-env VERCEL_FORCE_PYTHON_STREAMING=1 NODE_OPTIONS=--experimental-vm-modules vitest run --config ../../vitest.config.mts",
     "test-unit": "cross-env VERCEL_FORCE_PYTHON_STREAMING=1 NODE_OPTIONS=--experimental-vm-modules vitest run --config ../../vitest.config.mts test/unit",
-    "test-e2e": "cross-env VERCEL_FORCE_PYTHON_STREAMING=1 NODE_OPTIONS=--experimental-vm-modules vitest run --config ../../vitest.config.mts test/integration-"
+    "test-e2e": "cross-env VERCEL_FORCE_PYTHON_STREAMING=1 NODE_OPTIONS=--experimental-vm-modules vitest run --config ../../vitest.config.mts test/integration-",
+    "test-e2e-builder": "pnpm run test-e2e"
   }
 }

package/templates/vc_fastapi_static.py

@@ -170,7 +170,7 @@ def _subtree_shadow(prefix: str, mounts: list[StaticMount]) -> str:
 
 
 def _index_subdir_shadows(url_prefix: str, directory: str) -> set[str]:
-    """Shadow bodies for subdirectories that hold an index.html.
+    """Regex bodies for subdirectories that hold an index.html.
 
     A directory with an index.html diverges on the CDN. StaticFiles(html=True)
     and frontends 307 the bare directory URL to its trailing-slash form and serve
@@ -190,8 +190,8 @@ def _index_subdir_shadows(url_prefix: str, directory: str) -> set[str]:
     return shadows
 
 
-def _divergent_url_shadows(mount: StaticMount, html: bool) -> set[str]:
-    """Shadow bodies for directory URLs the CDN and the app serve differently.
+def _divergent_url_shadows(mount: StaticMount, html: bool) -> list[ShadowRoute]:
+    """Shadow routes for directory URLs the CDN and the app serve differently.
 
     When a directory holds an index.html, the app and the CDN serve that
     directory's URL differently. This affects every such subdirectory and the
@@ -206,13 +206,16 @@ def _divergent_url_shadows(mount: StaticMount, html: bool) -> set[str]:
 
     html=False shadows both forms. The app 404s both while the CDN serves the
     index, so both must reach the Lambda.
+
+    Directory redirects are GET-only: HEAD for bare dirs is handled by the
+    builder's CDN redirect routes placed before shadow routes.
     """
-    shadows = _index_subdir_shadows(mount.urlPath, mount.directory)
+    bodies = _index_subdir_shadows(mount.urlPath, mount.directory)
     if not (html and mount.urlPath == "/"):
-        shadows.add(_escape_path(mount.urlPath))
+        bodies.add(_escape_path(mount.urlPath))
     if html:
-        return {f"{body}(?!/)" for body in shadows}
-    return shadows
+        bodies = {f"{body}(?!/)" for body in bodies}
+    return [ShadowRoute(body=body, methods=("GET",)) for body in bodies]
 
 
 def _frontend_groups(router: Router) -> list[_FrontendRouteGroup]:
@@ -247,6 +250,22 @@ def _effective_route_contexts(route: BaseRoute) -> list[_EffectiveRouteContext]:
     return []
 
 
+@dataclass(frozen=True)
+class ShadowRoute:
+    """One shadow-route entry in the builder output.
+
+    `body` is the regex body for the route src; `methods` is the list of HTTP
+    methods the shadow applies to (from the API route that declared it), or
+    None when the shadow must match all methods.
+    """
+
+    body: str
+    methods: tuple[str, ...] | None  # sorted tuple, or None for all
+
+    def to_dict(self) -> dict[str, object]:
+        return {"body": self.body, "methods": list(self.methods) if self.methods is not None else None}
+
+
 @dataclass(frozen=True)
 class PriorRoute:
     """An HTTP route that outranks static files.
@@ -255,10 +274,12 @@ class PriorRoute:
     (Lambda), not the CDN, so FastAPI's declaration-order precedence is
     preserved. `path_format` is the full route path (e.g. "/items/{id}") and
     `convertors` maps each `{name}` placeholder to its Starlette convertor.
+    `methods` is the set of HTTP methods the route handles, or None for all.
     """
 
     path_format: str
     convertors: dict[str, Convertor]
+    methods: frozenset[str] | None = None
 
     def shadows(self, mount: StaticMount) -> bool:
         """True if this route can match paths the mount serves.
@@ -336,9 +357,31 @@ class Precedence:
     def add_route(self, route: PriorRoute) -> None:
         self.routes.append(route)
 
-    def shadow_bodies(self, mount: StaticMount) -> set[str]:
-        """Shadow-route bodies for every prior route that shadows `mount`."""
-        return {r.shadow_body for r in self.routes if r.shadows(mount)}
+    def shadow_bodies(self, mount: StaticMount) -> list[ShadowRoute]:
+        """Shadow-route body+methods for every prior route that shadows `mount`.
+
+        When a route declares GET, HEAD is added to the shadow methods. HTTP
+        semantics tie HEAD to GET, so the Lambda (not the CDN) should handle
+        HEAD on API-owned paths and return 405 when HEAD is not declared.
+        """
+        result = []
+        for r in self.routes:
+            if not r.shadows(mount):
+                continue
+            methods = r.methods
+            # With plain StaticFiles, HEAD bypasses the GET route and the
+            # mount serves it (200), so CDN can do the same without Lambda.
+            # With app.frontend(), HEAD on a GET route path returns 405.
+            # Shadow HEAD only for frontend mounts.
+            if methods is not None and "GET" in methods and mount.frontend:
+                methods = methods | {"HEAD"}
+            result.append(
+                ShadowRoute(
+                    body=r.shadow_body,
+                    methods=tuple(sorted(methods)) if methods is not None else None,
+                )
+            )
+        return result
 
     def add_mount(self, url_prefix: str) -> None:
         self.mount_prefixes.append(url_prefix.rstrip("/"))
@@ -349,24 +392,29 @@ class Precedence:
         return any(p == q or p.startswith(q + "/") for q in self.mount_prefixes)
 
 
+def _subtree_shadow_route(prefix: str, mounts: list[StaticMount]) -> ShadowRoute:
+    """A ShadowRoute routing a mounted sub-app's whole subtree to the Lambda."""
+    return ShadowRoute(body=_subtree_shadow(prefix, mounts), methods=None)
+
+
 def _collect_mount(
     route: Mount, prefix: str, prior: Precedence
-) -> tuple[list[StaticMount], set[str]]:
+) -> tuple[list[StaticMount], list[ShadowRoute]]:
     """Discover one app.mount(): a StaticFiles mount serves from the CDN, a
     Router/sub-app recurses, and a raw ASGI app owns its subtree opaquely.
     """
     url_prefix = prefix + route.path
     if prior.eclipses(url_prefix):
-        return [], set()
+        return [], []
 
     mounts: list[StaticMount] = []
-    shadow_routes: set[str] = set()
+    shadow_routes: list[ShadowRoute] = []
 
     static = StaticMount.from_route(route, prefix, frontend=False)
     if static:
         mounts.append(static)
-        shadow_routes |= prior.shadow_bodies(static)
-        shadow_routes |= _divergent_url_shadows(static, html=route.app.html)
+        shadow_routes += prior.shadow_bodies(static)
+        shadow_routes += _divergent_url_shadows(static, html=route.app.html)
 
     # A Starlette/FastAPI sub-app isn't a Router but exposes one as `.router`;
     # a StaticFiles or raw ASGI app exposes neither.
@@ -381,13 +429,13 @@ def _collect_mount(
         sub_prefix = prefix + route.path.rstrip("/")
         sub_mounts, sub_shadow = collect(sub_router, sub_prefix, prior)
         mounts.extend(sub_mounts)
-        shadow_routes |= sub_shadow
-        shadow_routes.add(_subtree_shadow(sub_prefix, sub_mounts))
+        shadow_routes += sub_shadow
+        shadow_routes.append(_subtree_shadow_route(sub_prefix, sub_mounts))
     elif static is None:
         # A raw ASGI app (e.g. WSGIMiddleware) owns its subtree with nothing on
         # the CDN. Shadow it so a lower-priority source's leaked copy there
         # routes to the Lambda.
-        shadow_routes.add(_subtree_shadow(url_prefix, []))
+        shadow_routes.append(_subtree_shadow_route(url_prefix, []))
 
     prior.add_mount(url_prefix)
     return mounts, shadow_routes
@@ -397,23 +445,32 @@ def collect(
     router: Router,
     prefix: str = "",
     prior: Precedence | None = None,
-) -> tuple[list[StaticMount], set[str]]:
-    """Walk the route table for (static mounts to copy, shadow-route bodies)."""
+) -> tuple[list[StaticMount], list[ShadowRoute]]:
+    """Walk the route table for (static mounts to copy, shadow routes).
+
+    Shadow routes are merged so that the same path covered by multiple API
+    routes with different methods produces one entry with the union of methods.
+    """
     prior = prior.child() if prior else Precedence()
 
     mounts: list[StaticMount] = []
-    shadow_routes: set[str] = set()
+    shadow_routes: list[ShadowRoute] = []
     frontends: list[StaticMount] = []
 
+    def _route_methods(route: Route) -> frozenset[str] | None:
+        """HTTP methods for a Starlette Route, or None for no restriction."""
+        m = getattr(route, "methods", None)
+        return frozenset(m) if m else None
+
     def collect_mount(mount_route: Mount) -> None:
         sub_mounts, sub_shadow = _collect_mount(mount_route, prefix, prior)
         mounts.extend(sub_mounts)
-        shadow_routes.update(sub_shadow)
+        shadow_routes.extend(sub_shadow)
 
     for route in router.routes:
         if isinstance(route, Route):
             prior.add_route(
-                PriorRoute(prefix + route.path_format, route.param_convertors)
+                PriorRoute(prefix + route.path_format, route.param_convertors, _route_methods(route))
             )
         elif isinstance(route, Mount):
             collect_mount(route)
@@ -433,10 +490,12 @@ def collect(
                 if ctx.starlette_route is not None:
                     path = ctx.starlette_route.path_format
                     convertors = ctx.starlette_route.param_convertors
+                    methods = _route_methods(ctx.starlette_route)
                 else:
                     path = ctx.path
                     convertors = ctx.param_convertors
-                prior.add_route(PriorRoute(prefix + path, convertors))
+                    methods = _route_methods(ctx.original_route)
+                prior.add_route(PriorRoute(prefix + path, convertors, methods))
 
         # app.include_router() with a frontend build.
         for ctx in _effective_low_priority_routes(route):
@@ -464,24 +523,66 @@ def collect(
         if prior.eclipses(m.urlPath):
             continue
         mounts.append(m)
-        shadow_routes |= prior.shadow_bodies(m)
+        shadow_routes += prior.shadow_bodies(m)
         # A frontend is html=True StaticFiles, so its URLs diverge the same way.
-        shadow_routes |= _divergent_url_shadows(m, html=True)
+        shadow_routes += _divergent_url_shadows(m, html=True)
 
-    return mounts, shadow_routes
+    return mounts, _merge_shadow_routes(shadow_routes)
+
+
+def _merge_shadow_routes(routes: list[ShadowRoute]) -> list[ShadowRoute]:
+    """Combine shadow routes that share a body by unioning their methods.
+
+    When the same path is covered by multiple API routes with different methods
+    (e.g. @app.get and @app.post on the same path), each produces a separate
+    ShadowRoute. Merging them emits one CDN route whose `methods` covers all
+    the declared methods. A None methods entry (match-all) subsumes any
+    specific set.
+    """
+    merged: dict[str, frozenset[str] | None] = {}
+    for route in routes:
+        methods = frozenset(route.methods) if route.methods is not None else None
+        if route.body not in merged:
+            merged[route.body] = methods
+        else:
+            existing = merged[route.body]
+            if existing is None or methods is None:
+                merged[route.body] = None  # match-all subsumes everything
+            else:
+                merged[route.body] = existing | methods
+    return sorted(
+        [
+            ShadowRoute(
+                body=body,
+                methods=tuple(sorted(m)) if m is not None else None,
+            )
+            for body, m in merged.items()
+        ],
+        key=lambda sr: sr.body,
+    )
 
 
 @dataclass(frozen=True)
 class Output:
-    """The JSON document written for the builder; field names are the JSON keys."""
+    """The JSON document written for the builder; field names are the JSON keys.
+
+    Each shadowRoutes entry is {"body": str, "methods": list[str] | None}.
+    `methods=None` means the shadow applies to all HTTP methods.
+    """
 
     mounts: list[StaticMount] = field(default_factory=list)
-    shadowRoutes: list[str] = field(default_factory=list)
+    shadowRoutes: list[ShadowRoute] = field(default_factory=list)
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "mounts": [asdict(m) for m in self.mounts],
+            "shadowRoutes": [sr.to_dict() for sr in self.shadowRoutes],
+        }
 
 
 def write_output(output_path: str, discovery: Output) -> None:
     with open(output_path, "w") as f:
-        json.dump(asdict(discovery), f)
+        json.dump(discovery.to_dict(), f)
 
 
 def discover(entrypoint_abs: str, variable_name: str) -> Output:
@@ -503,7 +604,7 @@ def discover(entrypoint_abs: str, variable_name: str) -> Output:
         return Output()
 
     mounts, shadow_routes = collect(router)
-    return Output(mounts=mounts, shadowRoutes=sorted(shadow_routes))
+    return Output(mounts=mounts, shadowRoutes=shadow_routes)
 
 
 def main() -> None: