eve/dist/src/services/dev-client/vercel-auth-error.js

Filesystem-first framework for durable backend AI agents that run anywhere.

import{isObject}from"#shared/guards.js";import{ClientError}from"#client/client-error.js";const VERCEL_AUTH_CHALLENGE_MARKERS=[`vercel.com/sso-api`,`<title>Authentication Required</title>`],TRUSTED_SOURCES_ERROR_CODE=/^TRUSTED_SOURCES_[A-Z0-9_]+$/u;function vercelTrustedSourcesErrorCode(e){for(let t of e.replaceAll(`\r
`,`
`).trim().split(`
`)){let e=t.trim();if(TRUSTED_SOURCES_ERROR_CODE.test(e))return e}}function bodyLooksLikeVercelAuthChallenge(e){return e.length>0&&VERCEL_AUTH_CHALLENGE_MARKERS.every(t=>e.includes(t))}function isVercelSsoUrl(e){let t=URL.parse(e);return t?.origin===`https://vercel.com`&&t.pathname===`/sso-api`&&t.searchParams.has(`url`)}function isVercelSsoRedirect(e,t){if(e<300||e>=400||t===void 0)return!1;for(let[e,n]of Object.entries(t))if(e.toLowerCase()===`location`&&typeof n==`string`)return isVercelSsoUrl(n);return!1}function isVercelUnauthorized(e,t){if(e!==401||t===void 0)return!1;for(let[e,n]of Object.entries(t))if(e.toLowerCase()===`x-vercel-error`&&n===`UNAUTHORIZED`)return!0;return!1}function bodyLooksLikeStructuredVercelAuthChallenge(e){let t;try{t=JSON.parse(e)}catch{return!1}if(!isObject(t)||!isObject(t.error)||!isObject(t.protection))return!1;let n=t.error.code,r=t.protection.vercel_auth_callback;return(n===401||n===`401`)&&t.error.message===`Protected deployment`&&typeof r==`string`&&isVercelSsoUrl(r)}function isVercelAuthChallenge(e){let t=e instanceof ClientError||isObject(e)?e:void 0;if(t===void 0||typeof t.status!=`number`||typeof t.body!=`string`)return!1;let n=isObject(t.headers)?t.headers:void 0;return isVercelSsoRedirect(t.status,n)||isVercelUnauthorized(t.status,n)||t.status===401&&(bodyLooksLikeVercelAuthChallenge(t.body)||bodyLooksLikeStructuredVercelAuthChallenge(t.body))}function formatVercelAuthChallengeMessage(e){let t=[`Vercel Deployment Protection blocked the request to ${e.serverUrl}.`];return e.oidcTokenFailure!==void 0&&t.push(``,formatDevelopmentOidcTokenFailure(e.oidcTokenFailure)),t.push(``,"To access the deployment from `eve dev`, do one of:","  • Run `vercel link` in this project so the CLI can mint an OIDC",`    token for the deployment automatically.`,`  • Set VERCEL_AUTOMATION_BYPASS_SECRET to a Protection Bypass for`,`    Automation token (Project Settings → Deployment Protection).`,`  • Disable Deployment Protection on the target deployment.`,``,`Docs: https://vercel.com/docs/deployment-protection`),t.join(`
`)}function formatDevelopmentOidcTokenFailure(e){switch(e.kind){case`resolution-failed`:return`The local Vercel OIDC token could not be resolved: ${e.message}`;case`malformed-token`:return e.reason===`missing-payload`?`Vercel returned a local OIDC token without a JWT payload.`:`Vercel returned a local OIDC token whose payload is not valid JSON.`;case`invalid-claims`:return`The local Vercel OIDC token has invalid claims: ${e.invalidClaims.join(`, `)}.`;case`target-mismatch`:return`The local Vercel OIDC token does not match the resolved deployment: ${e.mismatchedClaims.join(`, `)}.`;default:return e}}function formatVercelTrustedSourcesFailure(e){let t=e.replaceAll(`\r
`,`
`).trim().split(`
`),n=t.findIndex(e=>TRUSTED_SOURCES_ERROR_CODE.test(e.trim()));if(n<0)return e;let r=t[n].trim(),i=t.slice(0,n).join(`
`).trim();return i.length===0?e:`${i}\n\n${r}`}export{formatDevelopmentOidcTokenFailure,formatVercelAuthChallengeMessage,formatVercelTrustedSourcesFailure,isVercelAuthChallenge,vercelTrustedSourcesErrorCode};