eve/dist/src/services/dev-client/vercel-auth-error.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{isObject}from"#shared/guards.js";import{ClientError}from"#client/client-error.js";const VERCEL_AUTH_CHALLENGE_MARKERS=[`vercel.com/sso-api`,`<title>Authentication Required</title>`],TRUSTED_SOURCES_ERROR_CODE=/^TRUSTED_SOURCES_[A-Z0-9_]+$/u;function vercelTrustedSourcesErrorCode(e){for(let t of e.replaceAll(`\r
`,`
`).trim().split(`
`)){let e=t.trim();if(TRUSTED_SOURCES_ERROR_CODE.test(e))return e}}function bodyLooksLikeVercelAuthChallenge(e){return e.length>0&&VERCEL_AUTH_CHALLENGE_MARKERS.every(t=>e.includes(t))}function isVercelSsoUrl(e){let t=URL.parse(e);return t?.origin===`https://vercel.com`&&t.pathname===`/sso-api`&&t.searchParams.has(`url`)}function isVercelSsoRedirect(e,t){if(e<300||e>=400||t===void 0)return!1;for(let[e,n]of Object.entries(t))if(e.toLowerCase()===`location`&&typeof n==`string`)return isVercelSsoUrl(n);return!1}function isVercelUnauthorized(e,t){if(e!==401||t===void 0)return!1;for(let[e,n]of Object.entries(t))if(e.toLowerCase()===`x-vercel-error`&&n===`UNAUTHORIZED`)return!0;return!1}function bodyLooksLikeStructuredVercelAuthChallenge(t){let n;try{n=JSON.parse(t)}catch{return!1}if(!isObject(n)||!isObject(n.error)||!isObject(n.protection))return!1;let r=n.error.code,i=n.protection.vercel_auth_callback;return(r===401||r===`401`)&&n.error.message===`Protected deployment`&&typeof i==`string`&&isVercelSsoUrl(i)}function isVercelAuthChallenge(n){let r=n instanceof ClientError||isObject(n)?n:void 0;if(r===void 0||typeof r.status!=`number`||typeof r.body!=`string`)return!1;let i=isObject(r.headers)?r.headers:void 0;return isVercelSsoRedirect(r.status,i)||isVercelUnauthorized(r.status,i)||r.status===401&&(bodyLooksLikeVercelAuthChallenge(r.body)||bodyLooksLikeStructuredVercelAuthChallenge(r.body))}function formatVercelAuthChallengeMessage(e){let t=[`Vercel Deployment Protection blocked the request to ${e.serverUrl}.`];return e.oidcTokenFailure!==void 0&&t.push(``,formatDevelopmentOidcTokenFailure(e.oidcTokenFailure)),t.push(``,"To access the deployment from `eve dev`, do one of:","  • Run `vercel link` in this project so the CLI can mint an OIDC",`    token for the deployment automatically.`,`  • Set VERCEL_AUTOMATION_BYPASS_SECRET to a Protection Bypass for`,`    Automation token (Project Settings → Deployment Protection).`,`  • Disable Deployment Protection on the target deployment.`,``,`Docs: https://vercel.com/docs/deployment-protection`),t.join(`
`)}function formatDevelopmentOidcTokenFailure(e){switch(e.kind){case`resolution-failed`:return`The local Vercel OIDC token could not be resolved: ${e.message}`;case`malformed-token`:return e.reason===`missing-payload`?`Vercel returned a local OIDC token without a JWT payload.`:`Vercel returned a local OIDC token whose payload is not valid JSON.`;case`invalid-claims`:return`The local Vercel OIDC token has invalid claims: ${e.invalidClaims.join(`, `)}.`;case`target-mismatch`:return`The local Vercel OIDC token does not match the resolved deployment: ${e.mismatchedClaims.join(`, `)}.`;default:return e}}function formatVercelTrustedSourcesFailure(e){let t=e.replaceAll(`\r
`,`
`).trim().split(`
`),n=t.findIndex(e=>TRUSTED_SOURCES_ERROR_CODE.test(e.trim()));if(n<0)return e;let i=t[n].trim(),a=t.slice(0,n).join(`
`).trim();return a.length===0?e:`${a}\n\n${i}`}export{formatDevelopmentOidcTokenFailure,formatVercelAuthChallengeMessage,formatVercelTrustedSourcesFailure,isVercelAuthChallenge,vercelTrustedSourcesErrorCode};