… in strings

isNodeEntrypoint() stripped comments with regexes that were not aware of
string, template, or regex literals, so a `/*` inside a literal (e.g. the
`*/*` in an Accept header) was read as a block-comment start and deleted
everything up to the next real `*/`, swallowing the handler export and
dropping the function under VERCEL_NODE_FILTER_ENTRYPOINTS.

Detect handler exports with the es-module-lexer/cjs-module-lexer pair
already used elsewhere in the build pipeline instead of regex-based
comment stripping; the lexers are token-aware so the contents of literals
are never mistaken for comments. The two handler shapes that are not named
exports (`module.exports = <fn>` and a server that calls `.listen()`) are
matched against comment-stripped source whose stripper now consumes
string/template/regex literals as whole tokens. If the ESM lexer cannot
parse a file (e.g. a .tsx handler with JSX), fall back to the existing
safe default so a real function is never dropped.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ction

The stripped source is only tested for `module.exports =` and `.listen(`,
which never live inside a literal, so there's no need to preserve string
contents. Blank comments and string/template literals alike with a single
space instead of keeping strings. This drops the conditional replacer and
also removes a class of false positives where literal text such as
"module.exports =" inside a string made a non-entrypoint look like one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…with tests

Move the comment/literal stripper out of node-entrypoint.ts into a dedicated
internal module and compose its matcher from five named, individually-commented
sub-patterns instead of one dense inline regex. The composed pattern is
byte-identical to the previous one (same source and flags), so there is no
behavior change.

Add dedicated unit tests asserting the stripper's exact output on the cases
that motivate it: `//` inside a URL, `/*` inside a string that would otherwise
swallow later code, escaped quotes, template literals, single-quoted strings,
and genuine comments being removed.

The module is not re-exported from index.ts, so it stays out of the package's
public API.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

stripCommentsAndLiterals matched escapes with `\\.`, which does not match a
`\`-newline line continuation, so a string spanning lines via `\` was not
recognized as a single token — a comment-like sequence inside it could then be
read as a real comment and swallow later code. Match escapes with `\\[\s\S]`
instead so escaped newlines are consumed and the literal spans both lines.

The change differs from the previous behavior only on backslash-newline
continuations (verified by a 300k-input fuzz). Add multi-line block-comment,
multi-line template, and line-continuation tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ints

`export = handler` (TS, compiles to `module.exports = handler`) and
`export * from './handlers'` (re-exports another module's handlers) are valid
@vercel/node entrypoints, but neither the ES nor CJS lexer surfaces a
recognized handler export for them, so they were being filtered out. Add
textual patterns for both — alongside `module.exports =` and `.listen(` — and
rename the list to EXTRA_HANDLER_PATTERNS. (`export * as ns from` stays
filtered: it exports a namespace object, not a handler.)

Add a coverage suite: a catalog of valid handler shapes (default, named HTTP
methods, fetch, re-exports, CJS forms, export=, export *, servers) and genuine
non-entrypoints, plus a seeded property fuzz asserting a real handler is never
dropped when wrapped in adversarial comment/literal noise.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

unit.node-entrypoint.coverage.test.ts mostly duplicated the spec, so fold its
unique cases into unit.node-entrypoint.test.ts and delete it. The merged file
keeps only the net-new shapes (export=, export * from, object/bracket/
defineProperty CJS exports, default-of-identifier, local export lists,
generics, satisfies, decorators, shebang) and the seeded property fuzz; the
duplicated catalog is dropped. Tests now share one temp file so the fuzz
doesn't spawn thousands of throwaway directories.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>