eve/dist/src/cli/dev/tui/vercel-trusted-sources.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{trustedSourcesToJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectprojectsbranchmatcher.js";import{updateProjectTrustedSourcesFromJSON}from"../../../node_modules/.pnpm/@vercel_sdk@1.28.8/node_modules/@vercel/sdk/esm/models/updateprojectblock.js";import{array,object,string,unknown}from"../../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/v4/classic/schemas.js";import"../../../node_modules/.pnpm/zod@4.5.4/node_modules/zod/index.js";import{planTrustedSourceAccess}from"./vercel-trusted-sources-policy.js";import{captureVercel}from"#setup/primitives/index.js";import{normalizeVercelApiResult}from"#setup/vercel-api-failure.js";const ProjectSchema=object({id:string().min(1),name:string().min(1),customEnvironments:array(object({slug:string().min(1)})).optional(),trustedSources:unknown().nullable().optional()});function parseJson(e){try{return JSON.parse(e)}catch{return}}function parseTrustedSources(e){let t=JSON.stringify(e);if(t===void 0)return;let n=updateProjectTrustedSourcesFromJSON(t);return n.ok?n.value:void 0}function parseProject(e){let t=ProjectSchema.safeParse(parseJson(e));if(!t.success)return;let{trustedSources:n,...r}=t.data;if(n==null)return r;let i=parseTrustedSources(n);return i===void 0?void 0:{...r,trustedSources:i}}const ProjectUpdateSchema=object({id:string().min(1)}),defaultDeps={captureVercel};function environmentLabel(e){switch(e){case`development`:return`Development`;case`preview`:return`Preview`;case`production`:return`Production`;default:return e}}function projectPolicyContext(e){return{projectId:e.id,customEnvironmentSlugs:e.customEnvironments?.map(({slug:e})=>e)??[]}}async function readProject(e){let t=await e.deps.captureVercel([`api`,`/v9/projects/${encodeURIComponent(e.projectId)}`,`--scope`,e.ownerId,`--raw`],{cwd:e.workspaceRoot,nonInteractive:!0,signal:e.signal});if(!t.ok)return{kind:`failed`,message:t.failure.message};let n=parseProject(t.stdout);return n===void 0||n.id!==e.projectId?{kind:`failed`,message:`Vercel returned an invalid project response.`}:{kind:`project`,project:n}}async function prepareVercelTrustedSourceAccess(e){let t={...defaultDeps,...e.deps},n=e.target.deployment,r=await readProject({deps:t,workspaceRoot:e.workspaceRoot,ownerId:n.ownerId,projectId:n.projectId,signal:e.signal});if(r.kind===`failed`)return{kind:`failed`,message:`Could not read Deployment Protection for ${n.projectName}: ${r.message}`};let{project:i}=r;if(planTrustedSourceAccess({project:projectPolicyContext(i),targetEnvironment:n.environment,trustedSources:i.trustedSources??void 0}).kind===`unchanged`)return{kind:`unchanged`};let a=environmentLabel(`development`),o=environmentLabel(n.environment);return await e.prompter.select({message:`Allow ${a} from ${i.name} to access ${o} deployments of ${i.name}?`,hintLayout:`stacked`,notices:[{tone:`warning`,text:`This changes Deployment Protection for ${i.name} until the Trusted Sources rule is removed.`}],options:[{value:`continue`,label:`Allow access`,hint:`Add ${a} → ${o} to Trusted Sources`},{value:`cancel`,label:`Cancel`,hint:`Leave Deployment Protection unchanged`}]})===`cancel`?{kind:`cancelled`}:{kind:`approved`,grant:{ownerId:n.ownerId,projectId:i.id,projectName:i.name,targetEnvironment:n.environment}}}async function applyVercelTrustedSourceAccess(e){let t={...defaultDeps,...e.deps},n=await readProject({deps:t,workspaceRoot:e.workspaceRoot,ownerId:e.grant.ownerId,projectId:e.grant.projectId,signal:e.signal});if(n.kind===`failed`)return{kind:`failed`,message:`Could not refresh Deployment Protection for ${e.grant.projectName}: ${n.message}`};let{project:r}=n,i=planTrustedSourceAccess({project:projectPolicyContext(r),targetEnvironment:e.grant.targetEnvironment,trustedSources:r.trustedSources??void 0});if(i.kind===`unchanged`)return{kind:`unchanged`};let a=normalizeVercelApiResult(await t.captureVercel([`api`,`/v9/projects/${encodeURIComponent(r.id)}`,`--scope`,e.grant.ownerId,`--method`,`PATCH`,`--field`,`trustedSources=${trustedSourcesToJSON(i.trustedSources)}`,`--raw`],{cwd:e.workspaceRoot,nonInteractive:!0,signal:e.signal}));if(!a.ok)return{kind:`failed`,message:`Could not update Trusted Sources for ${r.name}: ${a.failure.message}`};let o=ProjectUpdateSchema.safeParse(parseJson(a.stdout));return(o.success?o.data:void 0)?.id===r.id?{kind:`updated`,targetProjectName:r.name}:{kind:`failed`,message:`Vercel returned an invalid project response.`}}export{applyVercelTrustedSourceAccess,prepareVercelTrustedSourceAccess};