0.30.2 scans too many files

[florian-lefebvre]

Hi, we're using @vercel/nft in the Vercel and Netlify Astro adapters to bundle handlers before deploying.

In a private project from one of our users, way too many files were being scanned and included (eg. files in .git/), causing the builds on Vercel to fail because it was going over the 15k files limit.

Overriding the dependency with NPM to 0.30.1 solved the issue so I'm pretty sure this is somehow caused by #542.

[styfle]

You can use the ignore property to set a pattern you don't want to include.

https://github.com/vercel/nft?tab=readme-ov-file#ignore

[florian-lefebvre]

Thanks for the hint. The problem is it's including stuff incorrectly, so we don't know what we need to exclude. I would say that this can be considered a regression: 0.30.1 traces 2256 files, 0.30.2 traces 22718.

Some more context if that helps:

• Occurs in a pnpm monorepo
• 0.30.1 only matches files in node_modules/.pnpm, apps/<app>/ and a few files from other packages
• 0.30.2 matches files from all packages, other apps and even .git

Setting analysis.emitGlobs: false helps but it matches less files than in 0.30.1 so I don't know if that could cause issues

[styfle]

including stuff incorrectly

Depends on the source code. Can you share the code that nft is tracing? Does it have a readFile() call?

[florian-lefebvre]

Thanks again for the hint! I digged more by looking at the returned reasons and I managed to isolate the issue:

import chromium from "@sparticuz/chromium-min";

export const prerender = false;

export const POST = async () => {
    console.log(chromium.args);

   return new Response(null, { status: 404 });
}

Importing this dependency is what causes the issue in 0.30.2. The compiled output for this file is:

import { access, symlink, createWriteStream, rm, existsSync, createReadStream, mkdirSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join, basename, dirname } from 'node:path';
import { fileURLToPath, URL as URL$1 } from 'node:url';
import fr from 'follow-redirects';
import require$$0 from 'tar-stream';
import require$$1 from 'pump';
import require$$2 from 'fs';
import require$$3 from 'path';
import { createBrotliDecompress, createUnzip } from 'node:zlib';
export { renderers } from '../../../renderers.mjs';

var commonjsGlobal = typeof globalThis !== 'undefined' ? globalThis : typeof window !== 'undefined' ? window : typeof global !== 'undefined' ? global : typeof self !== 'undefined' ? self : {};

var tarFs = {};

var hasRequiredTarFs;

function requireTarFs () {
	if (hasRequiredTarFs) return tarFs;
	hasRequiredTarFs = 1;
	const tar = require$$0;
	const pump = require$$1;
	const fs = require$$2;
	const path = require$$3;

	const win32 = (commonjsGlobal.Bare ? commonjsGlobal.Bare.platform : process.platform) === 'win32';

	tarFs.pack = function pack (cwd, opts) {
	  if (!cwd) cwd = '.';
	  if (!opts) opts = {};

	  const xfs = opts.fs || fs;
	  const ignore = opts.ignore || opts.filter || noop;
	  const mapStream = opts.mapStream || echo;
	  const statNext = statAll(xfs, opts.dereference ? xfs.stat : xfs.lstat, cwd, ignore, opts.entries, opts.sort);
	  const strict = opts.strict !== false;
	  const umask = typeof opts.umask === 'number' ? ~opts.umask : ~processUmask();
	  const pack = opts.pack || tar.pack();
	  const finish = opts.finish || noop;

	  let map = opts.map || noop;
	  let dmode = typeof opts.dmode === 'number' ? opts.dmode : 0;
	  let fmode = typeof opts.fmode === 'number' ? opts.fmode : 0;

	  if (opts.strip) map = strip(map, opts.strip);

	  if (opts.readable) {
	    dmode |= parseInt(555, 8);
	    fmode |= parseInt(444, 8);
	  }
	  if (opts.writable) {
	    dmode |= parseInt(333, 8);
	    fmode |= parseInt(222, 8);
	  }

	  onnextentry();

	  function onsymlink (filename, header) {
	    xfs.readlink(path.join(cwd, filename), function (err, linkname) {
	      if (err) return pack.destroy(err)
	      header.linkname = normalize(linkname);
	      pack.entry(header, onnextentry);
	    });
	  }

	  function onstat (err, filename, stat) {
	    if (pack.destroyed) return
	    if (err) return pack.destroy(err)
	    if (!filename) {
	      if (opts.finalize !== false) pack.finalize();
	      return finish(pack)
	    }

	    if (stat.isSocket()) return onnextentry() // tar does not support sockets...

	    let header = {
	      name: normalize(filename),
	      mode: (stat.mode | (stat.isDirectory() ? dmode : fmode)) & umask,
	      mtime: stat.mtime,
	      size: stat.size,
	      type: 'file',
	      uid: stat.uid,
	      gid: stat.gid
	    };

	    if (stat.isDirectory()) {
	      header.size = 0;
	      header.type = 'directory';
	      header = map(header) || header;
	      return pack.entry(header, onnextentry)
	    }

	    if (stat.isSymbolicLink()) {
	      header.size = 0;
	      header.type = 'symlink';
	      header = map(header) || header;
	      return onsymlink(filename, header)
	    }

	    // TODO: add fifo etc...

	    header = map(header) || header;

	    if (!stat.isFile()) {
	      if (strict) return pack.destroy(new Error('unsupported type for ' + filename))
	      return onnextentry()
	    }

	    const entry = pack.entry(header, onnextentry);
	    const rs = mapStream(xfs.createReadStream(path.join(cwd, filename), { start: 0, end: header.size > 0 ? header.size - 1 : header.size }), header);

	    rs.on('error', function (err) { // always forward errors on destroy
	      entry.destroy(err);
	    });

	    pump(rs, entry);
	  }

	  function onnextentry (err) {
	    if (err) return pack.destroy(err)
	    statNext(onstat);
	  }

	  return pack
	};

	function head (list) {
	  return list.length ? list[list.length - 1] : null
	}

	function processGetuid () {
	  return (!commonjsGlobal.Bare && process.getuid) ? process.getuid() : -1
	}

	function processUmask () {
	  return (!commonjsGlobal.Bare && process.umask) ? process.umask() : 0
	}

	tarFs.extract = function extract (cwd, opts) {
	  if (!cwd) cwd = '.';
	  if (!opts) opts = {};

	  cwd = path.resolve(cwd);

	  const xfs = opts.fs || fs;
	  const ignore = opts.ignore || opts.filter || noop;
	  const mapStream = opts.mapStream || echo;
	  const own = opts.chown !== false && !win32 && processGetuid() === 0;
	  const extract = opts.extract || tar.extract();
	  const stack = [];
	  const now = new Date();
	  const umask = typeof opts.umask === 'number' ? ~opts.umask : ~processUmask();
	  const strict = opts.strict !== false;
	  const validateSymLinks = opts.validateSymlinks !== false;

	  let map = opts.map || noop;
	  let dmode = typeof opts.dmode === 'number' ? opts.dmode : 0;
	  let fmode = typeof opts.fmode === 'number' ? opts.fmode : 0;

	  if (opts.strip) map = strip(map, opts.strip);

	  if (opts.readable) {
	    dmode |= parseInt(555, 8);
	    fmode |= parseInt(444, 8);
	  }
	  if (opts.writable) {
	    dmode |= parseInt(333, 8);
	    fmode |= parseInt(222, 8);
	  }

	  extract.on('entry', onentry);

	  if (opts.finish) extract.on('finish', opts.finish);

	  return extract

	  function onentry (header, stream, next) {
	    header = map(header) || header;
	    header.name = normalize(header.name);

	    const name = path.join(cwd, path.join('/', header.name));

	    if (ignore(name, header)) {
	      stream.resume();
	      return next()
	    }

	    const dir = path.join(name, '.') === path.join(cwd, '.') ? cwd : path.dirname(name);

	    validate(xfs, dir, path.join(cwd, '.'), function (err, valid) {
	      if (err) return next(err)
	      if (!valid) return next(new Error(dir + ' is not a valid path'))

	      if (header.type === 'directory') {
	        stack.push([name, header.mtime]);
	        return mkdirfix(name, {
	          uid: header.uid,
	          gid: header.gid,
	          mode: header.mode
	        }, stat)
	      }

	      mkdirfix(dir, {
	        uid: header.uid,
	        gid: header.gid,
	        // normally, the folders with rights and owner should be part of the TAR file
	        // if this is not the case, create folder for same user as file and with
	        // standard permissions of 0o755 (rwxr-xr-x)
	        mode: 0o755
	      }, function (err) {
	        if (err) return next(err)

	        switch (header.type) {
	          case 'file': return onfile()
	          case 'link': return onlink()
	          case 'symlink': return onsymlink()
	        }

	        if (strict) return next(new Error('unsupported type for ' + name + ' (' + header.type + ')'))

	        stream.resume();
	        next();
	      });
	    });

	    function stat (err) {
	      if (err) return next(err)
	      utimes(name, header, function (err) {
	        if (err) return next(err)
	        if (win32) return next()
	        chperm(name, header, next);
	      });
	    }

	    function onsymlink () {
	      if (win32) return next() // skip symlinks on win for now before it can be tested
	      xfs.unlink(name, function () {
	        const dst = path.resolve(path.dirname(name), header.linkname);
	        if (!inCwd(dst) && validateSymLinks) return next(new Error(name + ' is not a valid symlink'))

	        xfs.symlink(header.linkname, name, stat);
	      });
	    }

	    function onlink () {
	      if (win32) return next() // skip links on win for now before it can be tested
	      xfs.unlink(name, function () {
	        const link = path.join(cwd, path.join('/', header.linkname));

	        fs.realpath(link, function (err, dst) {
	          if (err || !inCwd(dst)) return next(new Error(name + ' is not a valid hardlink'))

	          xfs.link(dst, name, function (err) {
	            if (err && err.code === 'EPERM' && opts.hardlinkAsFilesFallback) {
	              stream = xfs.createReadStream(dst);
	              return onfile()
	            }

	            stat(err);
	          });
	        });
	      });
	    }

	    function inCwd (dst) {
	      return dst === cwd || dst.startsWith(cwd + path.sep)
	    }

	    function onfile () {
	      const ws = xfs.createWriteStream(name);
	      const rs = mapStream(stream, header);

	      ws.on('error', function (err) { // always forward errors on destroy
	        rs.destroy(err);
	      });

	      pump(rs, ws, function (err) {
	        if (err) return next(err)
	        ws.on('close', stat);
	      });
	    }
	  }

	  function utimesParent (name, cb) { // we just set the mtime on the parent dir again everytime we write an entry
	    let top;
	    while ((top = head(stack)) && name.slice(0, top[0].length) !== top[0]) stack.pop();
	    if (!top) return cb()
	    xfs.utimes(top[0], now, top[1], cb);
	  }

	  function utimes (name, header, cb) {
	    if (opts.utimes === false) return cb()

	    if (header.type === 'directory') return xfs.utimes(name, now, header.mtime, cb)
	    if (header.type === 'symlink') return utimesParent(name, cb) // TODO: how to set mtime on link?

	    xfs.utimes(name, now, header.mtime, function (err) {
	      if (err) return cb(err)
	      utimesParent(name, cb);
	    });
	  }

	  function chperm (name, header, cb) {
	    const link = header.type === 'symlink';

	    /* eslint-disable n/no-deprecated-api */
	    const chmod = link ? xfs.lchmod : xfs.chmod;
	    const chown = link ? xfs.lchown : xfs.chown;
	    /* eslint-enable n/no-deprecated-api */

	    if (!chmod) return cb()

	    const mode = (header.mode | (header.type === 'directory' ? dmode : fmode)) & umask;

	    if (chown && own) chown.call(xfs, name, header.uid, header.gid, onchown);
	    else onchown(null);

	    function onchown (err) {
	      if (err) return cb(err)
	      if (!chmod) return cb()
	      chmod.call(xfs, name, mode, cb);
	    }
	  }

	  function mkdirfix (name, opts, cb) {
	    // when mkdir is called on an existing directory, the permissions
	    // will be overwritten (?), to avoid this we check for its existance first
	    xfs.stat(name, function (err) {
	      if (!err) return cb(null)
	      if (err.code !== 'ENOENT') return cb(err)
	      xfs.mkdir(name, { mode: opts.mode, recursive: true }, function (err, made) {
	        if (err) return cb(err)
	        chperm(name, opts, cb);
	      });
	    });
	  }
	};

	function validate (fs, name, root, cb) {
	  if (name === root) return cb(null, true)

	  fs.lstat(name, function (err, st) {
	    if (err && err.code !== 'ENOENT' && err.code !== 'EPERM') return cb(err)
	    if (err || st.isDirectory()) return validate(fs, path.join(name, '..'), root, cb)
	    cb(null, false);
	  });
	}

	function noop () {}

	function echo (name) {
	  return name
	}

	function normalize (name) {
	  return win32 ? name.replace(/\\/g, '/').replace(/[:?<>|]/g, '_') : name
	}

	function statAll (fs, stat, cwd, ignore, entries, sort) {
	  if (!entries) entries = ['.'];
	  const queue = entries.slice(0);

	  return function loop (callback) {
	    if (!queue.length) return callback(null)

	    const next = queue.shift();
	    const nextAbs = path.join(cwd, next);

	    stat.call(fs, nextAbs, function (err, stat) {
	      // ignore errors if the files were deleted while buffering
	      if (err) return callback(entries.indexOf(next) === -1 && err.code === 'ENOENT' ? null : err)

	      if (!stat.isDirectory()) return callback(null, next, stat)

	      fs.readdir(nextAbs, function (err, files) {
	        if (err) return callback(err)

	        if (sort) files.sort();

	        for (let i = 0; i < files.length; i++) {
	          if (!ignore(path.join(cwd, next, files[i]))) queue.push(path.join(next, files[i]));
	        }

	        callback(null, next, stat);
	      });
	    });
	  }
	}

	function strip (map, level) {
	  return function (header) {
	    header.name = header.name.split('/').slice(level).join('/');

	    const linkname = header.linkname;
	    if (linkname && (header.type === 'link' || path.isAbsolute(linkname))) {
	      header.linkname = linkname.split('/').slice(level).join('/');
	    }

	    return map(header)
	  }
	}
	return tarFs;
}

var tarFsExports = requireTarFs();

/**
 * Creates a symlink to a file
 */
const createSymlink = (source, target) => {
    return new Promise((resolve, reject) => {
        access(source, (error) => {
            if (error) {
                reject(error);
                return;
            }
            symlink(source, target, (error) => {
                /* c8 ignore next */
                if (error) {
                    /* c8 ignore next 3 */
                    reject(error);
                    return;
                }
                resolve();
            });
        });
    });
};
/**
 * Downloads a file from a URL
 */
const downloadFile = (url, outputPath) => {
    return new Promise((resolve, reject) => {
        const stream = createWriteStream(outputPath);
        stream.once("error", reject);
        fr.https
            .get(url, (response) => {
            if (response.statusCode !== 200) {
                stream.close();
                reject(new Error(
                /* c8 ignore next 2 */
                `Unexpected status code: ${response.statusCode?.toFixed(0) ?? "UNK"}.`));
                return;
            }
            // Pipe directly to file rather than manually writing chunks
            // This is more efficient and uses less memory
            response.pipe(stream);
            // Listen for completion
            stream.once("finish", () => {
                stream.close();
                resolve();
            });
            // Handle response errors
            response.once("error", (error) => {
                /* c8 ignore next 2 */
                stream.close();
                reject(error);
            });
        })
            /* c8 ignore next 3 */
            .on("error", (error) => {
            stream.close();
            reject(error);
        });
    });
};
/**
 * Adds the proper folders to the environment
 * @param baseLibPath the path to this packages lib folder
 */
const setupLambdaEnvironment = (baseLibPath) => {
    // If the FONTCONFIG_PATH is not set, set it to /tmp/fonts
    process.env["FONTCONFIG_PATH"] ??= join(tmpdir(), "fonts");
    // Set up Home folder if not already set
    process.env["HOME"] ??= tmpdir();
    // If LD_LIBRARY_PATH is undefined, set it to baseLibPath, otherwise, add it
    if (process.env["LD_LIBRARY_PATH"] === undefined) {
        process.env["LD_LIBRARY_PATH"] = baseLibPath;
    }
    else if (!process.env["LD_LIBRARY_PATH"].startsWith(baseLibPath)) {
        process.env["LD_LIBRARY_PATH"] = [
            baseLibPath,
            ...new Set(process.env["LD_LIBRARY_PATH"].split(":")),
        ].join(":");
    }
};
/**
 * Determines if the input is a valid URL
 * @param input the input to check
 * @returns boolean indicating if the input is a valid URL
 */
const isValidUrl = (input) => {
    try {
        return Boolean(new URL(input));
    }
    catch {
        return false;
    }
};
/**
 * Determines if the running instance is inside an Amazon Linux 2023 container,
 * AWS_EXECUTION_ENV is for native Lambda instances
 * AWS_LAMBDA_JS_RUNTIME is for netlify instances
 * CODEBUILD_BUILD_IMAGE is for CodeBuild instances
 * VERCEL is for Vercel Functions (Node 20 or later enables an AL2023-compatible environment).
 * @returns boolean indicating if the running instance is inside a Lambda container with nodejs20
 */
const isRunningInAmazonLinux2023 = (nodeMajorVersion) => {
    const awsExecEnv = process.env["AWS_EXECUTION_ENV"] ?? "";
    const awsLambdaJsRuntime = process.env["AWS_LAMBDA_JS_RUNTIME"] ?? "";
    const codebuildImage = process.env["CODEBUILD_BUILD_IMAGE"] ?? "";
    // Check for explicit version substrings, returns on first match
    if (awsExecEnv.includes("20.x") ||
        awsExecEnv.includes("22.x") ||
        awsLambdaJsRuntime.includes("20.x") ||
        awsLambdaJsRuntime.includes("22.x") ||
        codebuildImage.includes("nodejs20") ||
        codebuildImage.includes("nodejs22")) {
        return true;
    }
    // Vercel: Node 20+ is AL2023 compatible
    // eslint-disable-next-line sonarjs/prefer-single-boolean-return
    if (process.env["VERCEL"] && nodeMajorVersion >= 20) {
        return true;
    }
    return false;
};
const downloadAndExtract = async (url) => {
    const getOptions = new URL(url);
    // Increase the max body length to 60MB for larger files
    getOptions.maxBodyLength = 60 * 1024 * 1024;
    const destDir = join(tmpdir(), "chromium-pack");
    return new Promise((resolve, reject) => {
        const extractObj = tarFsExports.extract(destDir);
        // Setup error handlers for better cleanup
        /* c8 ignore next 5 */
        const cleanupOnError = (err) => {
            rm(destDir, { force: true, recursive: true }, () => {
                reject(err);
            });
        };
        // Attach error handler to extract stream
        extractObj.once("error", cleanupOnError);
        // Handle extraction completion
        extractObj.once("finish", () => {
            resolve(destDir);
        });
        const req = fr.https.get(url, (response) => {
            /* c8 ignore next */
            if (response.statusCode !== 200) {
                /* c8 ignore next 9 */
                reject(new Error(`Unexpected status code: ${response.statusCode?.toFixed(0) ?? "UNK"}.`));
                return;
            }
            // Pipe the response directly to the extraction stream
            response.pipe(extractObj);
            // Handle response errors
            response.once("error", cleanupOnError);
        });
        // Handle request errors
        req.once("error", cleanupOnError);
        // Set a timeout to avoid hanging requests
        req.setTimeout(60 * 1000, () => {
            /* c8 ignore next 2 */
            req.destroy();
            cleanupOnError(new Error("Request timeout"));
        });
    });
};

/**
 * Decompresses a (tarballed) Brotli or Gzip compressed file and returns the path to the decompressed file/folder.
 *
 * @param filePath Path of the file to decompress.
 */
const inflate = (filePath) => {
    // Determine the output path based on the file type
    const output = filePath.includes("swiftshader")
        ? tmpdir()
        : join(tmpdir(), basename(filePath).replace(/\.(?:t(?:ar(?:\.(?:br|gz))?|br|gz)|br|gz)$/i, ""));
    return new Promise((resolve, reject) => {
        // Quick return if the file is already decompressed
        if (filePath.includes("swiftshader")) {
            if (existsSync(`${output}/libGLESv2.so`)) {
                resolve(output);
                return;
            }
        }
        else if (existsSync(output)) {
            resolve(output);
            return;
        }
        // Optimize chunk size based on file type - use smaller chunks for better memory usage
        // Brotli files tend to decompress to much larger sizes
        const isBrotli = /br$/i.test(filePath);
        const isGzip = /gz$/i.test(filePath);
        const isTar = /\.t(?:ar(?:\.(?:br|gz))?|br|gz)$/i.test(filePath);
        // Use a smaller highWaterMark for better memory efficiency
        // For most serverless environments, 4MB (2**22) is more memory-efficient than 8MB
        const highWaterMark = 2 ** 22;
        const source = createReadStream(filePath, { highWaterMark });
        let target;
        // Setup error handlers first for both streams
        const handleError = (error) => {
            reject(error);
        };
        source.once("error", handleError);
        // Setup the appropriate target stream based on file type
        if (isTar) {
            target = tarFsExports.extract(output);
            target.once("finish", () => {
                resolve(output);
            });
        }
        else {
            target = createWriteStream(output, { mode: 0o700 });
            target.once("close", () => {
                resolve(output);
            });
        }
        target.once("error", handleError);
        // Pipe through the appropriate decompressor if needed
        if (isBrotli || isGzip) {
            // Use optimized chunk size for decompression
            // 2MB (2**21) is sufficient for most brotli/gzip files
            const decompressor = isBrotli
                ? createBrotliDecompress({ chunkSize: 2 ** 21 })
                : createUnzip({ chunkSize: 2 ** 21 });
            // Handle decompressor errors
            decompressor.once("error", handleError);
            // Chain the streams
            source.pipe(decompressor).pipe(target);
        }
        else {
            source.pipe(target);
        }
    });
};

/**
 * Get the bin directory path for ESM modules
 */
function getBinPath() {
    return join(dirname(fileURLToPath(import.meta.url)), "..", "..", "bin");
}

const nodeMajorVersion = Number.parseInt(process.versions.node.split(".")[0] ?? "");
// Setup the lambda environment
if (isRunningInAmazonLinux2023(nodeMajorVersion)) {
    setupLambdaEnvironment(join(tmpdir(), "al2023", "lib"));
}
// eslint-disable-next-line @typescript-eslint/no-extraneous-class
class Chromium {
    /**
     * Returns a list of additional Chromium flags recommended for serverless environments.
     * The canonical list of flags can be found on https://peter.sh/experiments/chromium-command-line-switches/.
     * Most of below can be found here: https://github.com/GoogleChrome/chrome-launcher/blob/main/docs/chrome-flags-for-tools.md
     */
    static get args() {
        const chromiumFlags = [
            "--ash-no-nudges", // Avoids blue bubble "user education" nudges (eg., "… give your browser a new look", Memory Saver)
            "--disable-domain-reliability", // Disables Domain Reliability Monitoring, which tracks whether the browser has difficulty contacting Google-owned sites and uploads reports to Google.
            "--disable-print-preview", // https://source.chromium.org/search?q=lang:cpp+symbol:kDisablePrintPreview&ss=chromium
            "--disk-cache-size=33554432", // https://source.chromium.org/search?q=lang:cpp+symbol:kDiskCacheSize&ss=chromium Forces the maximum disk space to be used by the disk cache, in bytes.
            "--no-default-browser-check", // Disable the default browser check, do not prompt to set it as such. (This is already set by Playwright, but not Puppeteer)
            "--no-pings", // Don't send hyperlink auditing pings
            "--single-process", // Runs the renderer and plugins in the same process as the browser. NOTES: Needs to be single-process to avoid `prctl(PR_SET_NO_NEW_PRIVS) failed` error
            "--font-render-hinting=none", // https://github.com/puppeteer/puppeteer/issues/2410#issuecomment-560573612
        ];
        const chromiumDisableFeatures = [
            "AudioServiceOutOfProcess",
            "IsolateOrigins",
            "site-per-process", // Disables OOPIF. https://www.chromium.org/Home/chromium-security/site-isolation
        ];
        const chromiumEnableFeatures = ["SharedArrayBuffer"];
        const graphicsFlags = [
            "--ignore-gpu-blocklist", // https://source.chromium.org/search?q=lang:cpp+symbol:kIgnoreGpuBlocklist&ss=chromium
            "--in-process-gpu", // Saves some memory by moving GPU process into a browser process thread
        ];
        // https://chromium.googlesource.com/chromium/src/+/main/docs/gpu/swiftshader.md
        if (this.graphics) {
            graphicsFlags.push(
            // As the unsafe WebGL fallback, SwANGLE (ANGLE + SwiftShader Vulkan)
            "--use-gl=angle", "--use-angle=swiftshader", "--enable-unsafe-swiftshader");
        }
        else {
            graphicsFlags.push("--disable-webgl");
        }
        const insecureFlags = [
            "--allow-running-insecure-content", // https://source.chromium.org/search?q=lang:cpp+symbol:kAllowRunningInsecureContent&ss=chromium
            "--disable-setuid-sandbox", // Lambda runs as root, so this is required to allow Chromium to run as root
            "--disable-site-isolation-trials", // https://source.chromium.org/search?q=lang:cpp+symbol:kDisableSiteIsolation&ss=chromium
            "--disable-web-security", // https://source.chromium.org/search?q=lang:cpp+symbol:kDisableWebSecurity&ss=chromium
        ];
        const headlessFlags = [
            "--headless='shell'", // We only support running chrome-headless-shell
            "--no-sandbox", // https://source.chromium.org/search?q=lang:cpp+symbol:kNoSandbox&ss=chromium
            "--no-zygote", // https://source.chromium.org/search?q=lang:cpp+symbol:kNoZygote&ss=chromium
        ];
        return [
            ...chromiumFlags,
            `--disable-features=${[...chromiumDisableFeatures].join(",")}`,
            `--enable-features=${[...chromiumEnableFeatures].join(",")}`,
            ...graphicsFlags,
            ...insecureFlags,
            ...headlessFlags,
        ];
    }
    /**
     * Returns whether the graphics stack is enabled or disabled
     * @returns boolean
     */
    static get graphics() {
        return this.graphicsMode;
    }
    /**
     * Sets whether the graphics stack is enabled or disabled.
     * @param true means the stack is enabled. WebGL will work.
     * @param false means that the stack is disabled. WebGL will not work.
     * @default true
     */
    static set setGraphicsMode(value) {
        if (typeof value !== "boolean") {
            throw new TypeError(`Graphics mode must be a boolean, you entered '${String(value)}'`);
        }
        this.graphicsMode = value;
    }
    /**
     * If true, the graphics stack and webgl is enabled,
     * If false, webgl will be disabled.
     * (If false, the swiftshader.tar.br file will also not extract)
     */
    static graphicsMode = true;
    /**
     * Inflates the included version of Chromium
     * @param input The location of the `bin` folder
     * @returns The path to the `chromium` binary
     */
    static async executablePath(input) {
        /**
         * If the `chromium` binary already exists in /tmp/chromium, return it.
         */
        if (existsSync(join(tmpdir(), "chromium"))) {
            return join(tmpdir(), "chromium");
        }
        /**
         * If input is a valid URL, download and extract the file. It will extract to /tmp/chromium-pack
         * and executablePath will be recursively called on that location, which will then extract
         * the brotli files to the correct locations
         */
        if (input && isValidUrl(input)) {
            return this.executablePath(await downloadAndExtract(input));
        }
        /**
         * If input is defined, use that as the location of the brotli files,
         * otherwise, the default location is ../../bin.
         * A custom location is needed for workflows that using custom packaging.
         */
        input ??= getBinPath();
        /**
         * If the input directory doesn't exist, throw an error.
         */
        if (!existsSync(input)) {
            throw new Error(`The input directory "${input}" does not exist. Please provide the location of the brotli files.`);
        }
        // Extract the required files
        const promises = [
            inflate(join(input, "chromium.br")),
            inflate(join(input, "fonts.tar.br")),
            inflate(join(input, "swiftshader.tar.br")),
        ];
        if (isRunningInAmazonLinux2023(nodeMajorVersion)) {
            promises.push(inflate(join(input, "al2023.tar.br")));
        }
        // Await all extractions
        const result = await Promise.all(promises);
        // Returns the first result of the promise, which is the location of the `chromium` binary
        // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
        return result.shift();
    }
    /**
     * Downloads or symlinks a custom font and returns its basename, patching the environment so that Chromium can find it.
     */
    static async font(input) {
        const fontsDir = process.env["FONTCONFIG_PATH"] ??
            join(process.env["HOME"] ?? tmpdir(), ".fonts");
        // Create fonts directory if it doesn't exist
        if (!existsSync(fontsDir)) {
            mkdirSync(fontsDir);
        }
        // Convert local path to file URL if needed
        if (!/^https?:\/\//i.test(input)) {
            input = `file://${input}`;
        }
        const url = new URL$1(input);
        const fontName = url.pathname.split("/").pop();
        if (!fontName) {
            throw new Error(`Invalid font name: ${url.pathname}`);
        }
        const outputPath = `${fontsDir}/${fontName}`;
        // Return font name if it already exists
        if (existsSync(outputPath)) {
            return fontName;
        }
        // Handle local file
        if (url.protocol === "file:") {
            try {
                await createSymlink(url.pathname, outputPath);
                return fontName;
            }
            catch (error) {
                throw new Error(`Failed to create symlink for font: ${JSON.stringify(error)}`);
            }
        }
        // Handle remote file
        else {
            try {
                await downloadFile(input, outputPath);
                return fontName;
            }
            catch (error) {
                throw new Error(`Failed to download font: ${JSON.stringify(error)}`);
            }
        }
    }
}

const prerender = false;
const POST = async () => {
  console.log(Chromium.args);
  return new Response(null, { status: 404 });
};

const _page = /*#__PURE__*/Object.freeze(/*#__PURE__*/Object.defineProperty({
	__proto__: null,
	POST,
	prerender
}, Symbol.toStringTag, { value: 'Module' }));

const page = () => _page;

export { page };

That being said, I don't know what I should do now that I know the cause. @vercel/nft is a dependency of Astro's Vercel adapter, not my project. Any recommendation or ideas?

[styfle]

Here's what I tried:

echo 'import chromium from "@sparticuz/chromium-min";' > index.mjs

npm i -g @vercel/nft@0.30.1
nft print index.mjs

npm i -g @vercel/nft@0.30.2
nft print index.mjs

These result of the filelist is the same, however I do see some additional wildcard scans so that might be related to the issue you're seeing.

cc @icyJoseph

[icyJoseph]

There are checks in place to not emit assets for wildcards, I guess the monorepo setup breaks on of these checks. I think I have a better grasp on the issue at this point. I'll debug further. Thanks for the input, it saved a ton of time!

@florian-lefebvre how does your monorepo look like? where does the tracing start? I tried with a very simple monorepo tracing from the root of the monorepo. Trying to get into a situation where .git is traced too.

[florian-lefebvre]

I've created a minimal reproduction at https://github.com/florian-lefebvre/vercel-nft-repro:

• pnpm i --frozen-lockfile from the root
• pnpm --filter test build
• apps/test/.vercel/output/functions/_render.func contains too much stuff: apps and node_modules
• Update the route at apps/test/src/pages/api.ts:

// import chromium from "@sparticuz/chromium-min";

export const POST = async () => {
    // console.log(chromium.args);

   return new Response(null, { status: 404 });
}

• pnpm --filter test build
• apps/test/.vercel/output/functions/_render.func contains the right contents: dist and src

@vercel/nft is called in apps/test/node_modules/@astrojs/vercel/dist/lib/nft.js

[teemingc]

I think we have users reporting the same issue sveltejs/kit#13764 and it affects people building their apps on Vercel in particular