feat: add apps/demo sub-project for independent Vercel deployment by Copilot · Pull Request #427 · objectstack-ai/objectql

Copilot · 2026-03-21T02:48:56Z

Standalone Vercel-deployable demo app following the hotcrm deployment pattern. Runs alongside apps/site as an independent Vercel project — zero impact on the existing docs site.

`apps/demo/` — new files

vercel.json — framework null, 1 GiB / 60s serverless function, all routes rewritten to catch-all handler
api/[[...route]].ts — bootstraps ObjectStack kernel (ObjectQL + InMemoryDriver + Auth + Console/Studio SPAs) via @hono/node-server getRequestListener(). Handles Vercel's pre-buffered rawBody, x-forwarded-proto fixup, and timeout protection (50s budget)
scripts/build-vercel.sh — ordered workspace build: types → core → platform-node → drivers → plugins → protocols → project-tracker example
scripts/patch-symlinks.cjs — derefs all pnpm symlinks in node_modules/ for Vercel bundling
objectstack.config.ts — local dev config reusing project-tracker showcase metadata
README.md — local dev + Vercel deployment docs, architecture diagram

Root changes

package.json — added demo:dev script
tsconfig.json — added apps/demo project reference
.gitignore — added apps/demo/.vercel
ROADMAP.md / CHANGELOG.md — updated

Vercel multi-project setup

Project	Root Directory	Framework
`apps/site`	`apps/site`	Next.js
`apps/demo`	`apps/demo`	`null` (serverless)

Each project is configured via its own vercel.json with independent build/deploy. Set Root Directory to apps/demo in Vercel project settings.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

fastdl.mongodb.org
- Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node node /home/REDACTED/work/objectql/objectql/node_modules/.bin/../vitest/vitest.mjs run packages/drivers/ packages/protocols/ --reporter=dot (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>apps/demo 子项目部署至 Vercel（参考 hotcrm vercel.json 配置）</issue_title>
<issue_description>目标：

将 objectql 的 apps/demo 子项目部署到 Vercel。

保证仓库中有 apps/site 与 apps/demo 两个 Vercel 子项目，二者独立，互不影响。

参考：

hotcrm 仓库中的 vercel.json 以及 api/[[...route]].ts 多云插件、依赖自动注册等实现方案。

热门项目将 serverless 入口置于 /api/[[...route]].ts 并对所有路径 rewrite 到此。静态资源、控制台和 studio 通过 SPA 插件提供。

实施方案建议：

在 objectql/apps 下新建 demo 子目录（如未存在），并搭建为可独立部署的 demo 应用。

为 apps/demo 增加 Vercel 配置，可独立部署，例如：
{
  "$schema": "https://openapi.vercel.sh/vercel.json",
  "installCommand": "pnpm install --ignore-scripts",
  "buildCommand": "bash scripts/build-vercel.sh",
  "framework": null,
  "functions": {
    "api/**/*.ts": {
      "memory": 1024,
      "maxDuration": 60,
      "includeFiles": "{packages/*/dist,node_modules/@object-ui/console/dist,node_modules/@objectstack/plugin-auth/dist,node_modules/@objectstack/studio/dist}/**"
    }
  },
  "rewrites": [
    { "source": "/api/:path*", "destination": "/api/[[...route]]" },
    { "source": "/(.*)", "destination": "/api/[[...route]]" }
  ]
}
结合 demo 实际情况，完善 scripts/build-vercel.sh、api/[[...route]].ts 及 demo package 依赖和启动逻辑。

README.md 增加部署说明并示例如何本地和 Vercel 云端开发两种场景下运行。

提交后需通过 CI 测试，确保 1) 主线不受影响，2) demo 可独立 build/deploy。

协作完成后，更新 ROADMAP.md/CHANGELOG.md。

注意事项：

不得影响现有 apps/site 子项目。

禁止临时性、低质量的 hack，需采用长期可维护的工程化方案。

配置多子项目部署（Monorepo & 多 Project）时，参考 Vercel 官方 workspace/multi-project best practice。

相关参考：

hotcrm vercel.json

hotcrm/api/[[...route]].ts</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes apps/demo 子项目部署至 Vercel（参考 hotcrm vercel.json 配置） #426

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

vercel · 2026-03-21T02:49:02Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
objectql	Ready	Preview, Comment	Mar 21, 2026 2:58am

Create a standalone demo application following the hotcrm Vercel pattern: - vercel.json with serverless function config and rewrites - api/[[...route]].ts catch-all serverless entry point - scripts/build-vercel.sh for ordered workspace builds - scripts/patch-symlinks.cjs for pnpm symlink dereference - objectstack.config.ts for local development - README.md with deployment documentation - Root demo:dev script and tsconfig reference - CHANGELOG.md and ROADMAP.md updates Co-authored-by: hotlong <50353452+hotlong@users.noreply.github.com> Agent-Logs-Url: https://github.com/objectstack-ai/objectql/sessions/5c9aaf48-333c-497e-89bb-44581595a4be

Copilot

Pull request overview

Adds a new apps/demo sub-project intended to be deployed as an independent Vercel serverless app (alongside apps/site) and documents/build-scripts it to follow the “hotcrm” deployment pattern.

Changes:

Introduces apps/demo with Vercel config, serverless catch-all handler, and local dev docs/config.
Adds demo build utilities (ordered workspace build + pnpm symlink dereference) for Vercel bundling.
Wires the demo into the monorepo (tsconfig reference, root demo:dev script, ignores, roadmap/changelog updates, lockfile).

Reviewed changes

Copilot reviewed 11 out of 14 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tsconfig.json	Adds `apps/demo` as a TS project reference.
ROADMAP.md	Marks demo Vercel deployment task as done.
pnpm-lock.yaml	Adds the new workspace importer and dependency resolutions.
package.json	Adds `demo:dev` script to run the demo app.
CHANGELOG.md	Adds an Unreleased entry describing the demo app addition.
apps/demo/vercel.json	Vercel serverless configuration (framework null, rewrites, includeFiles, limits).
apps/demo/tsconfig.json	Typecheck-only TS config for the demo project.
apps/demo/scripts/patch-symlinks.cjs	Dereferences pnpm symlinks for Vercel bundling compatibility.
apps/demo/scripts/build-vercel.sh	Builds required workspace packages in dependency order, then patches symlinks.
apps/demo/README.md	Documents local dev + Vercel multi-project setup and architecture.
apps/demo/package.json	Declares the demo workspace package and scripts/deps.
apps/demo/objectstack.config.ts	Local dev ObjectStack config using MemoryDriver + project-tracker showcase.
apps/demo/api/[[...route]].ts	Vercel serverless entry: bootstraps kernel, serves SPAs, body extraction, timeouts.
.gitignore	Ignores `apps/demo/.vercel`.

Files not reviewed (1)

pnpm-lock.yaml: Language not supported

Copilot · 2026-03-21T03:12:41Z

apps/demo/vercel.json

+    "api/**/*.ts": {
+      "memory": 1024,
+      "maxDuration": 60,
+      "includeFiles": "{packages/*/dist,node_modules/@object-ui/console/dist,node_modules/@objectstack/plugin-auth/dist,node_modules/@objectstack/studio/dist}/**"


includeFiles paths are relative to the Vercel project root (apps/demo per README). The glob packages/*/dist won’t match anything under apps/demo/, so the serverless bundle may miss the built workspace outputs. Adjust the paths (e.g. to point to the monorepo root) or copy required dist/ artifacts into the demo project before bundling.

Suggested change

"includeFiles": "{packages/*/dist,node_modules/@object-ui/console/dist,node_modules/@objectstack/plugin-auth/dist,node_modules/@objectstack/studio/dist}/**"

"includeFiles": [

"../packages/*/dist/**",

"node_modules/@object-ui/console/dist/**",

"node_modules/@objectstack/plugin-auth/dist/**",

"node_modules/@objectstack/studio/dist/**"

]

Copilot · 2026-03-21T03:12:41Z

apps/demo/package.json

+    "@types/node": "^20.19.37",
+    "hono": "^4.12.8",
+    "typescript": "^5.9.3"
+  },


This project imports @objectstack/runtime and @objectstack/driver-memory in api/[[...route]].ts, but they are not declared here. Relying on transitive dependencies is brittle (and can break Vercel bundling / pnpm strictness). Add them as direct dependencies (and consider moving runtime-required packages from devDependencies to dependencies).

Suggested change

},

},

"dependencies": {

"@objectstack/runtime": "^3.2.8",

"@objectstack/driver-memory": "^3.2.8"

},

Copilot · 2026-03-21T03:12:41Z

apps/demo/api/[[...route]].ts

+                const reqPath = c.req.path.substring(basePath.length) || '/';
+                const filePath = resolve(absoluteDist, reqPath.replace(/^\//, ''));
+                // Prevent path traversal: resolved path must stay within distPath
+                if (!filePath.startsWith(absoluteDist)) {
+                    return c.text('Forbidden', 403);
+                }


The path traversal guard is bypassable: an absolute path like ${absoluteDist}-evil/... still passes startsWith(absoluteDist) even though it’s outside the dist directory. Use a safer check based on path.relative() (reject if it starts with .. or is absolute) or startsWith(absoluteDist + path.sep) after normalizing.

Copilot · 2026-03-21T03:12:42Z

apps/demo/api/[[...route]].ts

+            ...(process.env.VERCEL_BRANCH_URL ? [`https://${process.env.VERCEL_BRANCH_URL}`] : []),
+            ...(process.env.VERCEL_PROJECT_PRODUCTION_URL ? [`https://${process.env.VERCEL_PROJECT_PRODUCTION_URL}`] : []),
+            ...(process.env.AUTH_TRUSTED_ORIGINS ? process.env.AUTH_TRUSTED_ORIGINS.split(',').map(s => s.trim()) : []),
+        ],


AUTH_TRUSTED_ORIGINS parsing can introduce empty strings (e.g. trailing commas), which may be treated as a wildcard/invalid origin depending on AuthPlugin behavior. After split(',').map(trim), filter out falsy entries before adding to trustedOrigins.

Copilot · 2026-03-21T03:12:42Z

CHANGELOG.md

+
+### Added
+
+- **`apps/demo`** — standalone Vercel-deployable demo application ([#issue](https://github.com/objectstack-ai/objectql/issues)):


The changelog entry links to https://github.com/objectstack-ai/objectql/issues without an issue number. Update it to reference the actual issue/PR (e.g. #426) so the entry is actionable.

Suggested change

- **`apps/demo`** — standalone Vercel-deployable demo application ([#issue](https://github.com/objectstack-ai/objectql/issues)):

- **`apps/demo`** — standalone Vercel-deployable demo application ([#426](https://github.com/objectstack-ai/objectql/issues/426)):

Initial plan

a87ac35

Copilot AI assigned Copilot and hotlong Mar 21, 2026

Copilot started work on behalf of hotlong March 21, 2026 02:49 View session

vercel bot deployed to Preview March 21, 2026 02:50 View deployment

vercel bot deployed to Preview March 21, 2026 02:58 View deployment

Copilot AI changed the title ~~[WIP] Deploy apps/demo subproject to Vercel~~ feat: add apps/demo sub-project for independent Vercel deployment Mar 21, 2026

Copilot AI requested a review from hotlong March 21, 2026 03:00

Copilot finished work on behalf of hotlong March 21, 2026 03:00

hotlong approved these changes Mar 21, 2026

View reviewed changes

hotlong marked this pull request as ready for review March 21, 2026 03:06

Copilot AI review requested due to automatic review settings March 21, 2026 03:06

hotlong merged commit 0d19ae2 into main Mar 21, 2026
3 checks passed

hotlong deleted the copilot/deploy-demo-app-to-vercel branch March 21, 2026 03:06

Copilot started reviewing on behalf of hotlong March 21, 2026 03:07 View session

Copilot AI reviewed Mar 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add apps/demo sub-project for independent Vercel deployment#427

feat: add apps/demo sub-project for independent Vercel deployment#427
hotlong merged 2 commits intomainfrom
copilot/deploy-demo-app-to-vercel

Copilot AI commented Mar 21, 2026 •

edited

Loading

Uh oh!

vercel bot commented Mar 21, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 21, 2026

Uh oh!

Copilot AI Mar 21, 2026

Uh oh!

Copilot AI Mar 21, 2026

Uh oh!

Copilot AI Mar 21, 2026

Uh oh!

Copilot AI Mar 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

-      "includeFiles": "{packages/*/dist,node_modules/@object-ui/console/dist,node_modules/@objectstack/plugin-auth/dist,node_modules/@objectstack/studio/dist}/**"
+      "includeFiles": [
+        "../packages/*/dist/**",
+        "node_modules/@object-ui/console/dist/**",
+        "node_modules/@objectstack/plugin-auth/dist/**",
+        "node_modules/@objectstack/studio/dist/**"
+      ]

-  },
+  },
+  "dependencies": {
+    "@objectstack/runtime": "^3.2.8",
+    "@objectstack/driver-memory": "^3.2.8"
+  },


		### Added

		- `apps/demo` — standalone Vercel-deployable demo application ([#issue](https://github.com/objectstack-ai/objectql/issues)):

Conversation

Copilot AI commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

apps/demo/ — new files

Root changes

Vercel multi-project setup

I tried to connect to the following addresses, but was blocked by firewall rules:

Comments on the Issue (you are @copilot in this section)

Uh oh!

vercel bot commented Mar 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 21, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 21, 2026 •

edited

Loading

`apps/demo/` — new files

vercel bot commented Mar 21, 2026 •

edited

Loading