@vercel/static-build 2.11.3 → 2.11.5

package/dist/index.js

@@ -7166,12 +7166,9 @@ var require_frameworks = __commonJS({
         // may also be detected. It is listed first so that framework detection
         // (which returns the first match in list order) selects it over everything
         // else — e.g. a Next.js app shipping a `Dockerfile.vercel` deploys as a
-        // container, not via `@vercel/next`. Experimental for now, so it is only
-        // detected when experimental frameworks are enabled
-        // (`VERCEL_USE_EXPERIMENTAL_FRAMEWORKS`).
+        // container, not via `@vercel/next`.
         name: "Container",
         slug: "container",
-        experimental: true,
         runtimeFramework: true,
         logo: "https://api-frameworks.vercel.sh/framework-logos/container.svg",
         tagline: "Deploy any project as a container image built from a Dockerfile.",
@@ -9039,6 +9036,52 @@ var require_frameworks = __commonJS({
         },
         getOutputDirName: async () => "dist"
       },
+      {
+        name: "TanStack Start",
+        slug: "tanstack-start-lovable",
+        logo: "https://api-frameworks.vercel.sh/framework-logos/tanstack-start.svg",
+        darkModeLogo: "https://api-frameworks.vercel.sh/framework-logos/tanstack-start-dark.svg",
+        platform: {
+          name: "lovable",
+          logo: "https://api-frameworks.vercel.sh/framework-logos/lovable.svg"
+        },
+        tagline: "Full-stack Framework powered by TanStack Router imported from Lovable",
+        description: "Full-document SSR, Streaming, Server Functions, bundling and more, imported from Lovable",
+        website: "https://lovable.dev/",
+        supersedes: ["tanstack-start", "ionic-react", "vite"],
+        detectors: {
+          every: [
+            {
+              matchPackage: "@lovable.dev/vite-tanstack-config"
+            }
+          ],
+          some: [
+            {
+              matchPackage: "@tanstack/react-start"
+            },
+            {
+              matchPackage: "@tanstack/solid-start"
+            }
+          ]
+        },
+        settings: {
+          installCommand: {
+            placeholder: "`yarn install`, `pnpm install`, `npm install`, or `bun install`"
+          },
+          buildCommand: {
+            placeholder: "`npm run build` or `vite build`",
+            value: "vite build"
+          },
+          devCommand: {
+            placeholder: "vite",
+            value: "vite --port $PORT"
+          },
+          outputDirectory: {
+            value: "dist"
+          }
+        },
+        getOutputDirName: async () => "dist"
+      },
       {
         name: "VitePress",
         slug: "vitepress",
@@ -9541,6 +9584,10 @@ var require_frameworks = __commonJS({
         website: "https://storybook.js.org",
         ignoreRuntimes: ["@vercel/next", "@vercel/node"],
         disableRootMiddleware: true,
+        // Storybook is a devDependency of many apps that deploy something else
+        // entirely, so detecting it is not evidence the user intends to deploy
+        // Storybook itself.
+        detectionConfidence: "weak",
         detectors: {
           every: [
             {
@@ -11452,7 +11499,7 @@ var require_frameworks = __commonJS({
         name: "Services",
         slug: "services",
         experimental: true,
-        logo: "https://api-frameworks.vercel.sh/framework-logos/other.svg",
+        logo: "https://api-frameworks.vercel.sh/framework-logos/services.svg",
         tagline: "Multiple services deployed as serverless functions within your project.",
         description: "Multiple services deployed as serverless functions within your project.",
         website: "https://vercel.com",
@@ -19803,7 +19850,7 @@ var require_superstatic = __commonJS({
       convertCleanUrls: () => convertCleanUrls,
       convertHeaders: () => convertHeaders,
       convertRedirects: () => convertRedirects,
-      convertRewrites: () => convertRewrites,
+      convertRewrites: () => convertRewrites2,
       convertTrailingSlash: () => convertTrailingSlash,
       getCleanUrls: () => getCleanUrls2,
       pathToRegexp: () => pathToRegexp,
@@ -19919,7 +19966,7 @@ var require_superstatic = __commonJS({
         }
       });
     }
-    function convertRewrites(rewrites, internalParamNames) {
+    function convertRewrites2(rewrites, internalParamNames) {
       return rewrites.map((r) => {
         const { src, segments } = sourceToRegex2(r.source);
         const hasSegments = collectHasSegments(r.has);
@@ -19937,7 +19984,7 @@ var require_superstatic = __commonJS({
           if (typeof r.destination === "string") {
             route = { src, dest: interpolate(r.destination), check: true };
           } else {
-            const destination = { ...r.destination };
+            const destination = { ...r.destination, type: "service" };
             if (typeof destination.path === "string") {
               destination.path = interpolate(destination.path);
             }
@@ -20600,13 +20647,13 @@ var require_schemas = __commonJS({
       pattern: "^[a-zA-Z]([a-zA-Z0-9_-]*[a-zA-Z0-9])?$"
     };
     var serviceDestinationSchema = {
-      description: "A service-targeted destination that delegates routing into a named service from `services`.",
+      description: "A service-targeted destination that delegates routing into a named service from `services`. Identified by the presence of `service`.",
       type: "object",
       additionalProperties: false,
-      required: ["type", "service"],
+      required: ["service"],
       properties: {
         type: {
-          description: "Discriminator. Must be `service`.",
+          description: "Optional explicit format marker. The destination shape is identified by the `service` property, so `type` is no longer required. When present it must be `service`.",
           type: "string",
           enum: ["service"]
         },
@@ -21376,6 +21423,7 @@ var require_dist7 = __commonJS({
     __export2(src_exports2, {
       appendRoutesToPhase: () => import_append.appendRoutesToPhase,
       compilePathToRegexpTemplate: () => import_superstatic2.compilePathToRegexpTemplate,
+      convertRewrites: () => import_superstatic2.convertRewrites,
       getCleanUrls: () => import_superstatic2.getCleanUrls,
       getOwnershipGuard: () => import_service_route_ownership.getOwnershipGuard,
       getTransformedRoutes: () => getTransformedRoutes,
@@ -21430,6 +21478,8 @@ var require_dist7 = __commonJS({
         if (typeof route.destination === "string") {
           route.dest = route.destination;
           delete route.destination;
+        } else if (typeof route.destination.service === "string") {
+          route.destination = { ...route.destination, type: "service" };
         }
       }
       if (route.statusCode !== void 0) {
@@ -22799,7 +22849,7 @@ var require_utils4 = __commonJS({
       DETECTION_FRAMEWORKS: () => DETECTION_FRAMEWORKS,
       INTERNAL_QUEUES_PREFIX: () => INTERNAL_QUEUES_PREFIX,
       INTERNAL_SERVICE_PREFIX: () => import_build_utils5.INTERNAL_SERVICE_PREFIX,
-      assignRoutePrefixes: () => assignRoutePrefixes,
+      assignMountPaths: () => assignMountPaths,
       combineBuildCommand: () => combineBuildCommand,
       filterFrameworksByRuntime: () => filterFrameworksByRuntime,
       getBuilderForRuntime: () => getBuilderForRuntime,
@@ -22811,6 +22861,7 @@ var require_utils4 = __commonJS({
       hasFile: () => hasFile,
       inferRuntimeFromFramework: () => inferRuntimeFromFramework,
       inferServiceRuntime: () => inferServiceRuntime,
+      isBFFFramework: () => isBFFFramework,
       isFrontendFramework: () => isFrontendFramework,
       isRouteOwningBuilder: () => isRouteOwningBuilder2,
       isStaticBuild: () => isStaticBuild2,
@@ -22882,6 +22933,16 @@ var require_utils4 = __commonJS({
       }
       return !inferRuntimeFromFramework(framework);
     }
+    var BFF_FRAMEWORKS = /* @__PURE__ */ new Set([
+      "nextjs",
+      "nuxtjs",
+      "sveltekit",
+      "remix",
+      "solidstart"
+    ]);
+    function isBFFFramework(framework) {
+      return !!framework && BFF_FRAMEWORKS.has(framework);
+    }
     function filterFrameworksByRuntime(frameworks2, runtime) {
       if (!runtime) {
         return [...frameworks2];
@@ -22950,11 +23011,11 @@ var require_utils4 = __commonJS({
       }
       return { config: null, error: null };
     }
-    function assignRoutePrefixes(services) {
+    function assignMountPaths(services) {
       const warnings = [];
       const names = Object.keys(services);
       if (names.length === 1) {
-        services[names[0]].routePrefix = "/";
+        services[names[0]].mountPath = "/";
         return warnings;
       }
       const frontendNames = names.filter(
@@ -22967,11 +23028,19 @@ var require_utils4 = __commonJS({
         rootName = frontendNames.find((n) => n === "frontend" || n === "web") ?? frontendNames.sort()[0];
         warnings.push({
           code: "MULTIPLE_FRONTENDS",
-          message: `Multiple frontend services detected (${frontendNames.join(", ")}). "${rootName}" was assigned routePrefix "/". Adjust manually if a different service should be the root.`
+          message: `Multiple frontend services detected (${frontendNames.join(", ")}). "${rootName}" was assigned mount path "/". Adjust manually if a different service should be the root.`
         });
       }
+      const rootFramework = rootName ? services[rootName].framework : void 0;
+      const isBFF = rootFramework ? isBFFFramework(rootFramework) : false;
+      const nonRootNames = names.filter((n) => n !== rootName);
+      const needsNamespace = isBFF || nonRootNames.length > 1;
       for (const name of names) {
-        services[name].routePrefix = name === rootName ? "/" : `/_/${name}`;
+        if (name === rootName) {
+          services[name].mountPath = "/";
+        } else {
+          services[name].mountPath = needsNamespace ? `/api/${name}` : "/api";
+        }
       }
       return warnings;
     }
@@ -24183,10 +24252,35 @@ var require_resolve_v2 = __commonJS({
     var import_resolve = require_resolve();
     var import_utils = require_utils4();
     var frameworksBySlug = new Map(import_frameworks2.frameworkList.map((f) => [f.slug, f]));
-    var SERVICE_NAME_REGEX = /^[a-zA-Z]([a-zA-Z0-9_-]*[a-zA-Z0-9])?$/;
+    var MAX_SERVICE_NAME_LENGTH = 64;
+    var SERVICE_NAME_REGEX = /^[a-z]([a-z_-]*[a-z])?$/;
+    function isValidServiceName(name) {
+      return name.length <= MAX_SERVICE_NAME_LENGTH && SERVICE_NAME_REGEX.test(name);
+    }
+    function getInvalidServiceNameMessage(name) {
+      return `Service name "${name}" is invalid. Names must be 1-${MAX_SERVICE_NAME_LENGTH} characters, start and end with a lowercase letter, and contain only lowercase letters, hyphens, and underscores.`;
+    }
+    var CONTAINER_ENTRYPOINT_CANDIDATES = [
+      "Dockerfile.vercel",
+      "Containerfile.vercel",
+      "Dockerfile",
+      "Containerfile"
+    ];
+    var CONTAINER_ENTRYPOINT_BASENAMES = new Set(
+      CONTAINER_ENTRYPOINT_CANDIDATES.map((name) => name.toLowerCase())
+    );
     function isDockerfileEntrypoint(entrypoint) {
-      const base = import_path7.posix.basename(entrypoint).toLowerCase();
-      return base === "dockerfile" || base === "containerfile" || base.endsWith(".dockerfile");
+      return CONTAINER_ENTRYPOINT_BASENAMES.has(
+        import_path7.posix.basename(entrypoint).toLowerCase()
+      );
+    }
+    async function detectContainerEntrypoint(serviceFs) {
+      for (const candidate of CONTAINER_ENTRYPOINT_CANDIDATES) {
+        if (await serviceFs.hasPath(candidate)) {
+          return candidate;
+        }
+      }
+      return void 0;
     }
     function normalizeContainerCommand(command) {
       if (command === void 0) {
@@ -24194,29 +24288,40 @@ var require_resolve_v2 = __commonJS({
       }
       return Array.isArray(command) ? command : [command];
     }
-    function resolveContainerServiceV2(name, config, normalizedRoot) {
+    async function resolveContainerServiceV2(name, config, normalizedRoot, serviceFs) {
       const isRoot = normalizedRoot === ".";
       const entrypoint = config.entrypoint;
-      const dockerfile = typeof entrypoint === "string" && isDockerfileEntrypoint(entrypoint) ? import_path7.posix.normalize(entrypoint) : void 0;
-      const image = typeof entrypoint === "string" && !dockerfile ? entrypoint : void 0;
-      if (!dockerfile && !image) {
-        return {
-          error: {
-            code: "MISSING_SERVICE_CONFIG",
-            message: `Container service "${name}" must specify an "entrypoint": a Dockerfile path to build, or a prebuilt OCI image reference.`,
-            serviceName: name
-          }
-        };
+      let dockerfile;
+      if (typeof entrypoint === "string") {
+        if (!isDockerfileEntrypoint(entrypoint)) {
+          return {
+            error: {
+              code: "INVALID_SERVICE_CONFIG",
+              message: `Container service "${name}" has invalid "entrypoint" "${entrypoint}". It must name a Dockerfile or Containerfile.`,
+              serviceName: name
+            }
+          };
+        }
+        dockerfile = import_path7.posix.normalize(entrypoint);
+      } else {
+        dockerfile = await detectContainerEntrypoint(serviceFs);
+        if (!dockerfile) {
+          return {
+            error: {
+              code: "MISSING_SERVICE_CONFIG",
+              message: `Container service "${name}" has no "entrypoint" and no ${CONTAINER_ENTRYPOINT_CANDIDATES.join(
+                ", "
+              )} was found in "${normalizedRoot}".`,
+              serviceName: name
+            }
+          };
+        }
       }
-      const localSrc = dockerfile ?? image ?? "Dockerfile";
-      const builderSrc = isRoot ? localSrc : import_path7.posix.join(normalizedRoot, localSrc);
+      const builderSrc = isRoot ? dockerfile : import_path7.posix.join(normalizedRoot, dockerfile);
       const builderConfig = { zeroConfig: true };
       if (!isRoot) {
         builderConfig.workspace = normalizedRoot;
       }
-      if (image) {
-        builderConfig.handler = image;
-      }
       const command = normalizeContainerCommand(config.command);
       if (command) {
         builderConfig.command = command;
@@ -24227,7 +24332,7 @@ var require_resolve_v2 = __commonJS({
           name,
           root: normalizedRoot,
           runtime: "container",
-          entrypoint: image ?? dockerfile,
+          entrypoint: dockerfile,
           command,
           builder: {
             src: builderSrc,
@@ -24246,10 +24351,10 @@ var require_resolve_v2 = __commonJS({
       };
     }
     function validateServiceConfigV22(name, config) {
-      if (!SERVICE_NAME_REGEX.test(name)) {
+      if (!isValidServiceName(name)) {
         return {
           code: "INVALID_SERVICE_NAME",
-          message: `Service name "${name}" is invalid. Names must start with a letter, end with an alphanumeric character, and contain only alphanumeric characters, hyphens, and underscores.`,
+          message: getInvalidServiceNameMessage(name),
           serviceName: name
         };
       }
@@ -24306,27 +24411,19 @@ var require_resolve_v2 = __commonJS({
           };
         }
       }
-      const isContainer = config.runtime === "container";
-      if (!config.framework && !config.entrypoint && !isContainer) {
-        return {
-          code: "MISSING_SERVICE_CONFIG",
-          message: `Service "${name}" must specify "framework" or "entrypoint".`,
-          serviceName: name
-        };
-      }
       return null;
     }
     async function resolveConfiguredServiceV22(name, config, fs5) {
       const normalizedRoot = (0, import_utils.stripTrailingSlash)(import_path7.posix.normalize(config.root));
-      const isContainer = config.runtime === "container" || typeof config.entrypoint === "string" && isDockerfileEntrypoint(config.entrypoint);
-      if (isContainer) {
-        return resolveContainerServiceV2(name, config, normalizedRoot);
-      }
       const serviceFsResult = normalizedRoot === "." ? { fs: fs5 } : await (0, import_resolve.getServiceFs)(fs5, name, normalizedRoot);
       if (serviceFsResult.error) {
         return { error: serviceFsResult.error };
       }
       const serviceFs = serviceFsResult.fs;
+      const isContainer = config.runtime === "container" || typeof config.entrypoint === "string" && isDockerfileEntrypoint(config.entrypoint);
+      if (isContainer) {
+        return resolveContainerServiceV2(name, config, normalizedRoot, serviceFs);
+      }
       const rawEntrypoint = config.entrypoint;
       const moduleAttr = typeof rawEntrypoint === "string" ? (0, import_resolve.parsePyModuleAttrEntrypoint)(rawEntrypoint) : null;
       let normalizedEntrypoint;
@@ -24345,14 +24442,15 @@ var require_resolve_v2 = __commonJS({
         entrypointIsDirectory = Boolean(resolved.entrypoint?.isDirectory);
       }
       const entrypointFile = entrypointIsDirectory || !normalizedEntrypoint ? void 0 : normalizedEntrypoint;
-      const inferredRuntime = (0, import_utils.inferServiceRuntime)({
+      let inferredRuntime = (0, import_utils.inferServiceRuntime)({
         runtime: config.runtime,
         framework: config.framework,
         entrypoint: entrypointFile
       });
       let framework = config.framework;
-      if (!framework && normalizedEntrypoint) {
-        const workspace = entrypointIsDirectory ? normalizedEntrypoint : import_path7.posix.dirname(normalizedEntrypoint) || ".";
+      let detectedFramework = false;
+      if (!framework) {
+        const workspace = entrypointIsDirectory && normalizedEntrypoint ? normalizedEntrypoint : ".";
         const detection = await (0, import_resolve.detectFrameworkFromWorkspace)({
           fs: serviceFs,
           workspace,
@@ -24363,6 +24461,12 @@ var require_resolve_v2 = __commonJS({
           return { error: detection.error };
         }
         framework = detection.framework;
+        detectedFramework = Boolean(framework);
+        inferredRuntime = (0, import_utils.inferServiceRuntime)({
+          runtime: config.runtime,
+          framework,
+          entrypoint: entrypointFile
+        });
       }
       if (entrypointIsDirectory && !framework) {
         return {
@@ -24373,6 +24477,16 @@ var require_resolve_v2 = __commonJS({
           }
         };
       }
+      const frameworkRuntime = (0, import_utils.inferRuntimeFromFramework)(framework);
+      if (detectedFramework && frameworkRuntime && !entrypointFile) {
+        return {
+          error: {
+            code: "MISSING_SERVICE_CONFIG",
+            message: `Service "${name}" detected framework "${framework}" in "${normalizedRoot}" and must specify an "entrypoint" for runtime "${frameworkRuntime}".`,
+            serviceName: name
+          }
+        };
+      }
       const frameworkDefinition = framework ? frameworksBySlug.get(framework) : void 0;
       let builderUse;
       let builderSrc;
@@ -24381,16 +24495,26 @@ var require_resolve_v2 = __commonJS({
         builderSrc = entrypointFile || frameworkDefinition?.useRuntime?.src || "package.json";
       } else {
         if (!inferredRuntime) {
-          return {
-            error: {
-              code: "MISSING_SERVICE_CONFIG",
-              message: `Service "${name}" must specify "framework" or a runtime-resolvable "entrypoint".`,
-              serviceName: name
-            }
-          };
+          if (config.buildCommand) {
+            builderUse = "@vercel/static-build";
+            builderSrc = "package.json";
+          } else {
+            builderUse = "@vercel/static";
+            builderSrc = config.outputDirectory ? import_path7.posix.join(config.outputDirectory, "**") : "**";
+          }
+        } else {
+          if (!entrypointFile) {
+            return {
+              error: {
+                code: "MISSING_SERVICE_CONFIG",
+                message: `Service "${name}" must specify an "entrypoint" for runtime "${inferredRuntime}".`,
+                serviceName: name
+              }
+            };
+          }
+          builderUse = inferredRuntime === "node" ? "@vercel/backends" : (0, import_utils.getBuilderForRuntime)(inferredRuntime);
+          builderSrc = entrypointFile;
         }
-        builderUse = inferredRuntime === "node" ? "@vercel/backends" : (0, import_utils.getBuilderForRuntime)(inferredRuntime);
-        builderSrc = entrypointFile;
       }
       const isRoot = normalizedRoot === ".";
       const projectRelativeSrc = isRoot ? builderSrc : import_path7.posix.join(normalizedRoot, builderSrc);
@@ -24401,6 +24525,9 @@ var require_resolve_v2 = __commonJS({
       if (framework) {
         builderConfig.framework = framework;
       }
+      if (config.outputDirectory) {
+        builderConfig.outputDirectory = config.outputDirectory;
+      }
       if (!isRoot) {
         builderConfig.workspace = normalizedRoot;
       }
@@ -24463,6 +24590,14 @@ var require_resolve_v2 = __commonJS({
       const serviceNames = new Set(Object.keys(services));
       for (const service of resolved) {
         for (const binding of service.bindings ?? []) {
+          if (!isValidServiceName(binding.service)) {
+            errors.push({
+              code: "INVALID_SERVICE_BINDING_NAME",
+              message: `Service "${service.name}" declares an invalid binding service name "${binding.service}". ${getInvalidServiceNameMessage(binding.service)}`,
+              serviceName: service.name
+            });
+            continue;
+          }
           if (!serviceNames.has(binding.service)) {
             errors.push({
               code: "UNKNOWN_SERVICE_BINDING",
@@ -24579,8 +24714,9 @@ var require_auto_detect = __commonJS({
     async function detectServicesAtRoot(fs5, rootFramework, detectEntrypoint) {
       const services = {};
       services.frontend = {
+        root: ".",
         framework: rootFramework.slug ?? void 0,
-        routePrefix: "/"
+        mountPath: "/"
       };
       const backendResult = await detectBackendServices(fs5, detectEntrypoint);
       if (backendResult.error) {
@@ -24598,9 +24734,10 @@ var require_auto_detect = __commonJS({
         };
       }
       Object.assign(services, backendResult.services);
+      const mountWarnings = (0, import_utils.assignMountPaths)(services);
       return {
         services,
-        warnings: [],
+        warnings: mountWarnings,
         errors: []
       };
     }
@@ -24610,7 +24747,7 @@ var require_auto_detect = __commonJS({
       services[serviceName] = {
         framework: frontendFramework.slug ?? void 0,
         root: frontendLocation,
-        routePrefix: "/"
+        mountPath: "/"
       };
       const backendResult = await detectBackendServices(fs5, detectEntrypoint);
       if (backendResult.error) {
@@ -24633,9 +24770,10 @@ var require_auto_detect = __commonJS({
         };
       }
       Object.assign(services, backendResult.services);
+      const mountWarnings = (0, import_utils.assignMountPaths)(services);
       return {
         services,
-        warnings: [],
+        warnings: mountWarnings,
         errors: []
       };
     }
@@ -24730,14 +24868,14 @@ var require_auto_detect = __commonJS({
       }
       const framework = frameworks2[0];
       const slug = framework.slug ?? void 0;
-      const routePrefix = `/_/${serviceName}`;
+      const mountPath = `/${serviceName}`;
       const detected = detectEntrypoint && !(0, import_utils.isFrontendFramework)(slug) ? await detectEntrypoint({ workPath: dirPath, framework: slug }) : null;
       return {
         service: {
           framework: slug,
           root: dirPath,
           ...detected ? { entrypoint: detected.entrypoint } : {},
-          routePrefix
+          mountPath
         }
       };
     }
@@ -24869,18 +25007,17 @@ var require_detect_railway = __commonJS({
         }
         const framework = frameworks2[0];
         const slug = framework.slug ?? void 0;
-        let serviceConfig = {};
-        serviceConfig.framework = slug;
-        if (cf.dirPath !== ".") {
-          serviceConfig.root = cf.dirPath;
-          if (detectEntrypoint && !(0, import_utils.isFrontendFramework)(slug)) {
-            const detected = await detectEntrypoint({
-              workPath: cf.dirPath,
-              framework: slug
-            });
-            if (detected) {
-              serviceConfig.entrypoint = detected.entrypoint;
-            }
+        const serviceConfig = {
+          root: cf.dirPath,
+          framework: slug
+        };
+        if (cf.dirPath !== "." && detectEntrypoint && !(0, import_utils.isFrontendFramework)(slug)) {
+          const detected = await detectEntrypoint({
+            workPath: cf.dirPath,
+            framework: slug
+          });
+          if (detected) {
+            serviceConfig.entrypoint = detected.entrypoint;
           }
         }
         if (cf.config.build?.buildCommand) {
@@ -24899,7 +25036,7 @@ var require_detect_railway = __commonJS({
       if (serviceNames.length === 0) {
         return { services: null, errors: [], warnings };
       }
-      warnings.push(...(0, import_utils.assignRoutePrefixes)(services));
+      warnings.push(...(0, import_utils.assignMountPaths)(services));
       return { services, errors: [], warnings };
     }
     async function findRailwayConfigs(fs5, dirPath = ".", depth = 0) {
@@ -27966,7 +28103,7 @@ var require_detect_render = __commonJS({
           const name = rs.name ?? "unnamed";
           const hint = {
             entrypoint: rs.rootDir ?? "<path-to-entrypoint>",
-            routePrefix: `/_/${name}`
+            mountPath: `/api/${name}`
           };
           warnings.push({
             code: "RENDER_PSERV_HINT",
@@ -28020,19 +28157,18 @@ var require_detect_render = __commonJS({
         }
         const framework = frameworks2[0];
         const vercelType = SERVICE_TYPE_MAP[serviceType];
-        const serviceConfig = {};
-        serviceConfig.type = vercelType;
-        serviceConfig.framework = framework.slug ?? void 0;
-        if (rootDir !== ".") {
-          serviceConfig.root = rootDir;
-          if (detectEntrypoint && !(0, import_utils.isFrontendFramework)(serviceConfig.framework)) {
-            const detected = await detectEntrypoint({
-              workPath: rootDir,
-              framework: serviceConfig.framework
-            });
-            if (detected) {
-              serviceConfig.entrypoint = detected.entrypoint;
-            }
+        const serviceConfig = {
+          root: rootDir,
+          type: vercelType,
+          framework: framework.slug ?? void 0
+        };
+        if (rootDir !== "." && detectEntrypoint && !(0, import_utils.isFrontendFramework)(serviceConfig.framework)) {
+          const detected = await detectEntrypoint({
+            workPath: rootDir,
+            framework: serviceConfig.framework
+          });
+          if (detected) {
+            serviceConfig.entrypoint = detected.entrypoint;
           }
         }
         const buildCommand = (0, import_utils.combineBuildCommand)(
@@ -28050,7 +28186,7 @@ var require_detect_render = __commonJS({
       if (Object.keys(services).length === 0) {
         return { services: null, errors: [], warnings };
       }
-      warnings.push(...(0, import_utils.assignRoutePrefixes)(services));
+      warnings.push(...(0, import_utils.assignMountPaths)(services));
       return { services, errors: [], warnings };
     }
     async function readRenderYaml(fs5) {
@@ -28207,6 +28343,7 @@ var require_detect_procfile = __commonJS({
         if (isWorkerLikeProcess) {
           if (hasSupportedWorkerCommand(tokens) && entrypoint?.endsWith(".py")) {
             services[processType] = {
+              root: ".",
               type: "worker",
               entrypoint,
               runtime: "python"
@@ -28223,12 +28360,12 @@ var require_detect_procfile = __commonJS({
           });
           continue;
         }
-        const serviceConfig = { type: "web" };
-        if (detectedFramework) {
-          serviceConfig.framework = detectedFramework.slug ?? void 0;
-        }
-        serviceConfig.entrypoint = entrypoint ?? ".";
-        services[processType] = serviceConfig;
+        services[processType] = {
+          root: ".",
+          type: "web",
+          ...detectedFramework?.slug ? { framework: detectedFramework.slug } : {},
+          entrypoint: entrypoint ?? "."
+        };
       }
       if (errors.length > 0) {
         return { services: null, errors, warnings };
@@ -28244,7 +28381,7 @@ var require_detect_procfile = __commonJS({
           firstService.buildCommand = releaseCommand;
         }
       }
-      warnings.push(...(0, import_utils.assignRoutePrefixes)(services));
+      warnings.push(...(0, import_utils.assignMountPaths)(services));
       return { services, errors: [], warnings };
     }
     function parseProcfile(content) {
@@ -28361,6 +28498,7 @@ var require_detect_services = __commonJS({
     var detect_services_exports = {};
     __export2(detect_services_exports, {
       detectServices: () => detectServices2,
+      generateServiceRewrites: () => generateServiceRewrites,
       generateServicesRoutes: () => generateServicesRoutes2
     });
     module2.exports = __toCommonJS2(detect_services_exports);
@@ -28393,6 +28531,7 @@ var require_detect_services = __commonJS({
         source: resolved.source,
         useImplicitEnvInjection: resolved.useImplicitEnvInjection,
         routes: resolved.routes,
+        rewrites: resolved.rewrites,
         errors: resolved.errors,
         warnings: resolved.warnings,
         resolved,
@@ -28402,18 +28541,17 @@ var require_detect_services = __commonJS({
     function toInferredLayoutConfig(services) {
       const inferredConfig = {};
       for (const [name, service] of Object.entries(services)) {
-        const serviceConfig = {};
+        const serviceConfig = {
+          root: service.root
+        };
         if (service.type) {
           serviceConfig.type = service.type;
         }
-        if (typeof service.root === "string") {
-          serviceConfig.root = service.root;
-        }
         if (typeof service.entrypoint === "string") {
           serviceConfig.entrypoint = service.entrypoint;
         }
-        if (typeof service.routePrefix === "string") {
-          serviceConfig.routePrefix = service.routePrefix;
+        if (typeof service.mountPath === "string") {
+          serviceConfig.mountPath = service.mountPath;
         }
         if ((0, import_utils.isFrontendFramework)(service.framework)) {
           serviceConfig.framework = service.framework;
@@ -28444,6 +28582,7 @@ var require_detect_services = __commonJS({
           source: "configured",
           useImplicitEnvInjection: true,
           routes: emptyRoutes(),
+          rewrites: [],
           errors: [configError],
           warnings: []
         });
@@ -28454,6 +28593,7 @@ var require_detect_services = __commonJS({
           source: "configured",
           useImplicitEnvInjection: false,
           routes: emptyRoutes(),
+          rewrites: [],
           errors: [
             {
               code: "SERVICES_AND_EXPERIMENTAL_SERVICES_V2",
@@ -28466,63 +28606,66 @@ var require_detect_services = __commonJS({
       const hasProvidedConfiguredServices = providedConfiguredServices && Object.keys(providedConfiguredServices).length > 0;
       const experimentalServicesV2 = hasProvidedConfiguredServices && (providedConfiguredServicesType === "services" || providedConfiguredServicesType === "experimentalServicesV2") ? providedConfiguredServices : hasProvidedConfiguredServices ? void 0 : vercelConfig?.services ?? vercelConfig?.experimentalServicesV2;
       if (experimentalServicesV2 && Object.keys(experimentalServicesV2).length > 0) {
-        const result2 = await (0, import_resolve_v2.resolveAllConfiguredServicesV2)(
+        const result = await (0, import_resolve_v2.resolveAllConfiguredServicesV2)(
           experimentalServicesV2,
           scopedFs
         );
         return withResolvedResult({
-          services: result2.services,
+          services: result.services,
           source: "configured",
           // V2 uses explicit `bindings`, so no implicit `{NAME}_URL` injection.
           useImplicitEnvInjection: false,
           // V2 routes are explicitly carried per-service to output them separately.
           routes: emptyRoutes(),
-          errors: result2.errors,
+          rewrites: [],
+          errors: result.errors,
           warnings: []
         });
       }
       const experimentalServicesV1 = hasProvidedConfiguredServices ? providedConfiguredServices : vercelConfig?.experimentalServices;
       const hasExperimentalServicesV1 = experimentalServicesV1 && Object.keys(experimentalServicesV1).length > 0;
-      if (!hasExperimentalServicesV1) {
-        const detectors = [
-          { detect: import_detect_railway.detectRailwayServices, source: "railway" },
-          { detect: import_detect_render.detectRenderServices, source: "render" },
-          { detect: import_detect_procfile.detectProcfileServices, source: "procfile" },
-          { detect: import_auto_detect.autoDetectServices, source: "layout" }
-        ];
-        for (const { detect, source } of detectors) {
-          const detectResult = await detect({ fs: scopedFs, detectEntrypoint });
-          const match = await tryResolveInferred(detectResult, source, scopedFs);
-          if (match)
-            return match;
-        }
+      if (hasExperimentalServicesV1) {
+        const result = await (0, import_resolve.resolveAllConfiguredServices)(
+          experimentalServicesV1,
+          scopedFs,
+          "configured"
+        );
+        const routes = generateServicesRoutes2(result.services);
         return withResolvedResult({
-          services: [],
-          source: "auto-detected",
+          services: result.services,
+          source: "configured",
+          // experimentalServices uses the legacy `{NAME}_URL` injection.
           useImplicitEnvInjection: true,
-          routes: emptyRoutes(),
-          errors: [
-            {
-              code: "NO_EXPERIMENTAL_SERVICES_CONFIGURED",
-              message: "No services configured. Add `experimentalServices` to vercel.json."
-            }
-          ],
+          routes,
+          rewrites: [],
+          errors: result.errors,
           warnings: []
         });
       }
-      const result = await (0, import_resolve.resolveAllConfiguredServices)(
-        experimentalServicesV1,
-        scopedFs,
-        "configured"
-      );
-      const routes = generateServicesRoutes2(result.services);
+      const detectors = [
+        { detect: import_detect_railway.detectRailwayServices, source: "railway" },
+        { detect: import_detect_render.detectRenderServices, source: "render" },
+        { detect: import_detect_procfile.detectProcfileServices, source: "procfile" },
+        { detect: import_auto_detect.autoDetectServices, source: "layout" }
+      ];
+      for (const { detect, source } of detectors) {
+        const detectResult = await detect({ fs: scopedFs, detectEntrypoint });
+        const match = await tryResolveInferred(detectResult, source, scopedFs);
+        if (match)
+          return match;
+      }
       return withResolvedResult({
-        services: result.services,
-        source: "configured",
-        // experimentalServices uses the legacy `{NAME}_URL` injection.
+        services: [],
+        source: "auto-detected",
         useImplicitEnvInjection: true,
-        routes,
-        errors: result.errors,
+        routes: emptyRoutes(),
+        rewrites: [],
+        errors: [
+          {
+            code: "NO_EXPERIMENTAL_SERVICES_CONFIGURED",
+            message: "No services configured. Add `experimentalServices` to vercel.json."
+          }
+        ],
         warnings: []
       });
     }
@@ -28531,8 +28674,9 @@ var require_detect_services = __commonJS({
         return withResolvedResult({
           services: [],
           source: "auto-detected",
-          useImplicitEnvInjection: true,
+          useImplicitEnvInjection: source !== "layout",
           routes: emptyRoutes(),
+          rewrites: [],
           errors: detectResult.errors,
           warnings: detectResult.warnings
         });
@@ -28540,52 +28684,96 @@ var require_detect_services = __commonJS({
       if (!detectResult.services) {
         return null;
       }
+      if (source === "layout") {
+        const v2Services = {};
+        for (const [name, svc] of Object.entries(detectResult.services)) {
+          v2Services[name] = {
+            root: svc.root,
+            ...svc.framework ? { framework: svc.framework } : {},
+            ...svc.entrypoint ? { entrypoint: svc.entrypoint } : {}
+          };
+        }
+        const result2 = await (0, import_resolve_v2.resolveAllConfiguredServicesV2)(v2Services, scopedFs);
+        const rootServices = Object.values(detectResult.services).filter(
+          (svc) => svc.mountPath === "/" && typeof svc.framework === "string"
+        );
+        const shouldInfer2 = result2.errors.length === 0 && rootServices.length === 1 && result2.services.length > 1;
+        const inferred2 = shouldInfer2 ? {
+          source,
+          config: toInferredLayoutConfig(detectResult.services),
+          services: result2.services,
+          warnings: detectResult.warnings
+        } : null;
+        return withResolvedResult(
+          {
+            services: shouldInfer2 ? result2.services : [],
+            source: "auto-detected",
+            useImplicitEnvInjection: false,
+            routes: emptyRoutes(),
+            rewrites: shouldInfer2 ? generateServiceRewrites(detectResult.services) : [],
+            experimentalServicesV2: shouldInfer2 ? v2Services : void 0,
+            errors: result2.errors,
+            warnings: detectResult.warnings
+          },
+          inferred2
+        );
+      }
+      const v1Services = {};
+      for (const [name, svc] of Object.entries(detectResult.services)) {
+        v1Services[name] = {
+          root: svc.root === "." ? void 0 : svc.root,
+          ...svc.framework ? { framework: svc.framework } : {},
+          ...svc.entrypoint ? { entrypoint: svc.entrypoint } : {},
+          ...svc.type ? { type: svc.type } : {},
+          ...svc.buildCommand ? { buildCommand: svc.buildCommand } : {},
+          ...svc.preDeployCommand ? { preDeployCommand: svc.preDeployCommand } : {},
+          ...svc.mountPath ? { routePrefix: svc.mountPath } : {}
+        };
+      }
       const result = await (0, import_resolve.resolveAllConfiguredServices)(
-        detectResult.services,
+        v1Services,
         scopedFs,
         "generated"
       );
-      let shouldInfer;
-      if (source === "layout") {
-        const rootWebFrameworkServices = result.services.filter(
-          (service) => service.type === "web" && service.routePrefix === "/" && typeof service.framework === "string"
-        );
-        shouldInfer = result.errors.length === 0 && rootWebFrameworkServices.length === 1 && result.services.length > 1;
-      } else {
-        shouldInfer = result.errors.length === 0 && result.services.length > 0;
-      }
+      const shouldInfer = result.errors.length === 0 && result.services.length > 0;
       const inferred = shouldInfer ? {
         source,
         config: toInferredLayoutConfig(detectResult.services),
         services: result.services,
         warnings: detectResult.warnings
       } : null;
-      if (source === "layout" && shouldInfer) {
-        const routes = generateServicesRoutes2(result.services);
-        return withResolvedResult(
-          {
-            services: result.services,
-            source: "auto-detected",
-            useImplicitEnvInjection: true,
-            routes,
-            errors: result.errors,
-            warnings: detectResult.warnings
-          },
-          inferred
-        );
-      }
       return withResolvedResult(
         {
           services: [],
           source: "auto-detected",
           useImplicitEnvInjection: true,
           routes: emptyRoutes(),
+          rewrites: [],
           errors: result.errors,
           warnings: detectResult.warnings
         },
         inferred
       );
     }
+    function generateServiceRewrites(services) {
+      const entries = Object.entries(services).filter(
+        ([, svc]) => typeof svc.mountPath === "string" && (!svc.type || svc.type === "web")
+      ).sort(([, a], [, b]) => b.mountPath.length - a.mountPath.length);
+      return entries.map(([name, svc]) => {
+        const mountPath = svc.mountPath;
+        if (mountPath === "/") {
+          return {
+            source: "/(.*)",
+            destination: { type: "service", service: name }
+          };
+        }
+        const prefix = mountPath.startsWith("/") ? mountPath.slice(1) : mountPath;
+        return {
+          source: `/${prefix}(/.*)?`,
+          destination: { type: "service", service: name }
+        };
+      });
+    }
     function generateServicesRoutes2(allServices) {
       const services = allServices.filter(import_build_utils5.isExperimentalService);
       const hostRewrites = [];
@@ -29042,6 +29230,8 @@ var require_get_services_builders = __commonJS({
           ...result.routes.crons
         ] : null,
         errorRoutes: [],
+        serviceRewrites: result.rewrites.length > 0 ? result.rewrites : void 0,
+        experimentalServicesV2: result.experimentalServicesV2,
         services: result.services,
         useImplicitEnvInjection: result.useImplicitEnvInjection
       };
@@ -29653,7 +29843,7 @@ var require_detect_builders = __commonJS({
           }
         }
       }
-      if (frontendBuilder && ((0, import_is_official_runtime.isOfficialRuntime)("express", frontendBuilder.use) || (0, import_is_official_runtime.isOfficialRuntime)("hono", frontendBuilder.use) || (0, import_is_official_runtime.isOfficialRuntime)("backends", frontendBuilder.use))) {
+      if (frontendBuilder && ((0, import_is_official_runtime.isOfficialRuntime)("express", frontendBuilder.use) || (0, import_is_official_runtime.isOfficialRuntime)("hono", frontendBuilder.use) || (0, import_is_official_runtime.isOfficialRuntime)("python", frontendBuilder.use) || (0, import_is_official_runtime.isOfficialRuntime)("backends", frontendBuilder.use))) {
         return null;
       }
       if (unusedFunctions.size) {
@@ -35656,6 +35846,15 @@ var build = async ({
 }) => {
   await (0, import_build_utils4.download)(files, workPath, meta);
   const routePrefix = config.routePrefix;
+  if (routePrefix) {
+    const mountpointCandidate = routePrefix.replace(/^\//, "") || ".";
+    if (mountpointCandidate.split(/[/\\]/).some((segment) => segment === "..")) {
+      throw new import_build_utils4.NowBuildError({
+        code: "STATIC_BUILD_UNSAFE_ROUTE_PREFIX",
+        message: `Invalid routePrefix "${routePrefix}": path traversal segments are not allowed.`
+      });
+    }
+  }
   const mountpoint = routePrefix ? routePrefix.replace(/^\//, "") || "." : import_path6.default.dirname(entrypoint);
   const entrypointDir = import_path6.default.join(workPath, import_path6.default.dirname(entrypoint));
   let distPath = import_path6.default.join(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vercel/static-build",
-  "version": "2.11.3",
+  "version": "2.11.5",
   "license": "Apache-2.0",
   "main": "./dist/index",
   "homepage": "https://vercel.com/docs/build-step",
@@ -15,7 +15,7 @@
   "dependencies": {
     "ts-morph": "12.0.0",
     "@vercel/gatsby-plugin-vercel-analytics": "1.0.11",
-    "@vercel/gatsby-plugin-vercel-builder": "2.2.23",
+    "@vercel/gatsby-plugin-vercel-builder": "2.2.25",
     "@vercel/static-config": "3.4.0"
   },
   "devDependencies": {
@@ -37,11 +37,11 @@
     "semver": "7.5.2",
     "tree-kill": "1.2.2",
     "vitest": "2.0.3",
-    "@vercel/build-utils": "13.32.1",
+    "@vercel/build-utils": "13.32.3",
+    "@vercel/frameworks": "3.30.6",
     "@vercel/error-utils": "2.2.0",
-    "@vercel/frameworks": "3.30.0",
-    "@vercel/fs-detectors": "6.10.1",
-    "@vercel/routing-utils": "6.3.1"
+    "@vercel/fs-detectors": "6.12.1",
+    "@vercel/routing-utils": "6.4.0"
   },
   "scripts": {
     "build": "node ../../utils/build-builder.mjs",