@liiift-studio/deploy-vercel-from-sanity 0.1.4 → 0.1.7

package/src/lib/api.ts

@@ -1,8 +1,11 @@
 // Vercel REST API helpers — all calls require a bearer token
-import type { VercelDeployment } from '../types'
+import type { VercelDeployment, DeploymentEvent } from '../types'
 
 const BASE = 'https://api.vercel.com'
 
+/** Only allow genuine Vercel deploy hook URLs through triggerDeploy */
+const VERCEL_HOOK_RE = /^https:\/\/api\.vercel\.com\/v1\/integrations\/deploy\//
+
 async function vercelFetch<T>(path: string, token: string, init?: RequestInit): Promise<T> {
 	const res = await fetch(`${BASE}${path}`, {
 		...init,
@@ -52,8 +55,36 @@ export async function cancelDeployment(opts: {
 	})
 }
 
-/** Trigger a deploy by POSTing to the hook URL — no auth needed */
+/**
+ * Trigger a deploy by POSTing to the hook URL.
+ * Validates the URL is a genuine Vercel hook before calling to prevent
+ * SSRF if a document is tampered with outside the Studio schema.
+ */
 export async function triggerDeploy(hookUrl: string): Promise<void> {
+	if (!VERCEL_HOOK_RE.test(hookUrl)) {
+		throw new Error('Invalid deploy hook URL — must be a Vercel hook (api.vercel.com/v1/integrations/deploy/…)')
+	}
 	const res = await fetch(hookUrl, { method: 'POST' })
 	if (!res.ok) throw new Error(`Deploy hook returned ${res.status}`)
 }
+
+/**
+ * Fetch build events for a deployment.
+ * Returns up to 100 events in reverse chronological order,
+ * filtered to lines with actual text content.
+ */
+export async function getDeploymentEvents(opts: {
+	deploymentId: string
+	token: string
+	teamId?: string
+}): Promise<DeploymentEvent[]> {
+	const params = new URLSearchParams({ limit: '100', direction: 'backward' })
+	if (opts.teamId) params.set('teamId', opts.teamId)
+	// API returns either a plain array or a wrapped object depending on version
+	const raw = await vercelFetch<DeploymentEvent[] | { events?: DeploymentEvent[] }>(
+		`/v2/deployments/${opts.deploymentId}/events?${params}`,
+		opts.token,
+	)
+	const events: DeploymentEvent[] = Array.isArray(raw) ? raw : (raw.events ?? [])
+	return events.filter(e => e.text?.trim())
+}

package/src/lib/helpers.ts

@@ -74,13 +74,30 @@ export function stateLabel(state: VercelDeployState | undefined): {
 	tone: 'positive' | 'caution' | 'critical' | 'default'
 } {
 	switch (state) {
-		case 'READY':       return { label: 'Ready',        tone: 'positive' }
-		case 'BUILDING':    return { label: 'Building',     tone: 'caution' }
-		case 'QUEUED':      return { label: 'Queued',       tone: 'caution' }
-		case 'INITIALIZING':return { label: 'Initializing', tone: 'caution' }
-		case 'ERROR':       return { label: 'Error',        tone: 'critical' }
-		case 'CANCELED':    return { label: 'Canceled',     tone: 'default' }
-		case 'LOADING':     return { label: 'Loading…',     tone: 'default' }
-		default:            return { label: 'Unknown',      tone: 'default' }
+		case 'READY':        return { label: 'Ready',        tone: 'positive' }
+		case 'BUILDING':     return { label: 'Building',     tone: 'caution' }
+		case 'QUEUED':       return { label: 'Queued',       tone: 'caution' }
+		case 'INITIALIZING': return { label: 'Initializing', tone: 'caution' }
+		case 'ERROR':        return { label: 'Error',        tone: 'critical' }
+		case 'CANCELED':     return { label: 'Canceled',     tone: 'default' }
+		case 'LOADING':      return { label: 'Loading…',     tone: 'default' }
+		default:             return { label: 'Unknown',      tone: 'default' }
+	}
+}
+
+/**
+ * Extracts the Vercel project dashboard URL from a deployment's inspectorUrl.
+ * inspectorUrl format: https://vercel.com/{team}/{project}/{deploymentId}
+ * Returns https://vercel.com/{team}/{project} or null if unparseable.
+ */
+export function projectHref(inspectorUrl: string | undefined): string | null {
+	if (!inspectorUrl) return null
+	try {
+		const { origin, pathname } = new URL(inspectorUrl)
+		const parts = pathname.split('/').filter(Boolean)
+		if (parts.length < 2) return null
+		return `${origin}/${parts[0]}/${parts[1]}`
+	} catch {
+		return null
 	}
 }

package/src/types.ts

@@ -45,9 +45,17 @@ export interface VercelDeployment {
 	}
 }
 
-/** Vercel secrets document stored at _id: 'secrets.vercelDeploy' */
-export interface VercelSecrets {
-	_id: 'secrets.vercelDeploy'
+/** A single build event returned by GET /v2/deployments/{id}/events */
+export interface DeploymentEvent {
+	type: 'command' | 'stdout' | 'stderr' | 'exit' | 'deployment-state'
+	text?: string
+	created: number
+	payload?: Record<string, unknown>
+}
+
+/** Vercel config document stored at _id: 'config.vercelDeploy' — readable by all authenticated users */
+export interface VercelConfig {
+	_id: 'config.vercelDeploy'
 	_type: 'vercelDeploy.config'
 	accessToken: string
 }