eve
Version:
Filesystem-first framework for durable backend AI agents that run anywhere.
1 lines • 4.52 kB
JavaScript
import{trustedSourcesToJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectprojectsbranchmatcher.js";import{updateProjectTrustedSourcesFromJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectblock.js";import{array,object,string,unknown}from"../../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/v4/classic/schemas.js";import"../../../node_modules/.pnpm/zod@4.4.3/node_modules/zod/index.js";import{planTrustedSourceAccess}from"./vercel-trusted-sources-policy.js";import{captureVercel}from"#setup/primitives/index.js";import{normalizeVercelApiResult}from"#setup/vercel-api-failure.js";const ProjectSchema=object({id:string().min(1),name:string().min(1),customEnvironments:array(object({slug:string().min(1)})).optional(),trustedSources:unknown().nullable().optional()});function parseJson(e){try{return JSON.parse(e)}catch{return}}function parseTrustedSources(e){let n=JSON.stringify(e);if(n===void 0)return;let r=updateProjectTrustedSourcesFromJSON(n);return r.ok?r.value:void 0}function parseProject(e){let t=ProjectSchema.safeParse(parseJson(e));if(!t.success)return;let{trustedSources:n,...r}=t.data;if(n==null)return r;let i=parseTrustedSources(n);return i===void 0?void 0:{...r,trustedSources:i}}const ProjectUpdateSchema=object({id:string().min(1)}),defaultDeps={captureVercel};function environmentLabel(e){switch(e){case`development`:return`Development`;case`preview`:return`Preview`;case`production`:return`Production`;default:return e}}function projectPolicyContext(e){return{projectId:e.id,customEnvironmentSlugs:e.customEnvironments?.map(({slug:e})=>e)??[]}}async function readProject(e){let t=await e.deps.captureVercel([`api`,`/v9/projects/${encodeURIComponent(e.projectId)}`,`--scope`,e.ownerId,`--raw`],{cwd:e.workspaceRoot,nonInteractive:!0,signal:e.signal});if(!t.ok)return{kind:`failed`,message:t.failure.message};let n=parseProject(t.stdout);return n===void 0||n.id!==e.projectId?{kind:`failed`,message:`Vercel returned an invalid project response.`}:{kind:`project`,project:n}}async function prepareVercelTrustedSourceAccess(e){let t={...defaultDeps,...e.deps},n=e.target.deployment,r=await readProject({deps:t,workspaceRoot:e.workspaceRoot,ownerId:n.ownerId,projectId:n.projectId,signal:e.signal});if(r.kind===`failed`)return{kind:`failed`,message:`Could not read Deployment Protection for ${n.projectName}: ${r.message}`};let{project:i}=r;if(planTrustedSourceAccess({project:projectPolicyContext(i),targetEnvironment:n.environment,trustedSources:i.trustedSources??void 0}).kind===`unchanged`)return{kind:`unchanged`};let a=environmentLabel(`development`),o=environmentLabel(n.environment);return await e.prompter.select({message:`Allow ${a} from ${i.name} to access ${o} deployments of ${i.name}?`,hintLayout:`stacked`,notices:[{tone:`warning`,text:`This changes Deployment Protection for ${i.name} until the Trusted Sources rule is removed.`}],options:[{value:`continue`,label:`Allow access`,hint:`Add ${a} → ${o} to Trusted Sources`},{value:`cancel`,label:`Cancel`,hint:`Leave Deployment Protection unchanged`}]})===`cancel`?{kind:`cancelled`}:{kind:`approved`,grant:{ownerId:n.ownerId,projectId:i.id,projectName:i.name,targetEnvironment:n.environment}}}async function applyVercelTrustedSourceAccess(t){let n={...defaultDeps,...t.deps},r=await readProject({deps:n,workspaceRoot:t.workspaceRoot,ownerId:t.grant.ownerId,projectId:t.grant.projectId,signal:t.signal});if(r.kind===`failed`)return{kind:`failed`,message:`Could not refresh Deployment Protection for ${t.grant.projectName}: ${r.message}`};let{project:i}=r,a=planTrustedSourceAccess({project:projectPolicyContext(i),targetEnvironment:t.grant.targetEnvironment,trustedSources:i.trustedSources??void 0});if(a.kind===`unchanged`)return{kind:`unchanged`};let o=normalizeVercelApiResult(await n.captureVercel([`api`,`/v9/projects/${encodeURIComponent(i.id)}`,`--scope`,t.grant.ownerId,`--method`,`PATCH`,`--field`,`trustedSources=${trustedSourcesToJSON(a.trustedSources)}`,`--raw`],{cwd:t.workspaceRoot,nonInteractive:!0,signal:t.signal}));if(!o.ok)return{kind:`failed`,message:`Could not update Trusted Sources for ${i.name}: ${o.failure.message}`};let s=ProjectUpdateSchema.safeParse(parseJson(o.stdout));return(s.success?s.data:void 0)?.id===i.id?{kind:`updated`,targetProjectName:i.name}:{kind:`failed`,message:`Vercel returned an invalid project response.`}}export{applyVercelTrustedSourceAccess,prepareVercelTrustedSourceAccess};