@liiift-studio/deploy-vercel-from-sanity 1.2.0 → 1.3.0

package/src/index.ts

@@ -1,47 +0,0 @@
-// deploy-vercel-from-sanity — Sanity Studio plugin for Vercel deployments (Studio v3.30 through v6)
-import { definePlugin } from 'sanity'
-import { RocketIcon } from './icons'
-import { DeployTool } from './components/DeployTool'
-import { vercelDeploySchema } from './schema/vercelDeploy'
-import { vercelConfigSchema } from './schema/vercelConfig'
-import type { VercelDeployPluginConfig } from './types'
-
-export { vercelDeploySchema } from './schema/vercelDeploy'
-export { vercelConfigSchema } from './schema/vercelConfig'
-export type { VercelDeployPluginConfig, DeployTarget, VercelDeployment, VercelDeployState } from './types'
-
-/**
- * Sanity Studio plugin — trigger and monitor Vercel deployments.
- *
- * Supports Studio v3.30 through v6 from a single build; see the compatibility
- * table in the README for how @sanity/ui and @sanity/icons are resolved.
- *
- * @example
- * // sanity.config.ts
- * import { vercelDeploy } from '@liiift-studio/deploy-vercel-from-sanity'
- *
- * export default defineConfig({
- *   plugins: [
- *     vercelDeploy(),
- *     // or with options:
- *     vercelDeploy({ title: 'Deploy', name: 'vercel-deploy' }),
- *   ],
- * })
- */
-export const vercelDeploy = definePlugin<VercelDeployPluginConfig | void>(options => {
-	const config = options ?? {}
-	return {
-		name: 'deploy-vercel-from-sanity',
-		schema: {
-			types: [vercelDeploySchema, vercelConfigSchema],
-		},
-		tools: [
-			{
-				name: config.name ?? 'vercel-deploy',
-				title: config.title ?? 'Deploy',
-				icon: config.icon ?? RocketIcon,
-				component: DeployTool,
-			},
-		],
-	}
-})

package/src/lib/api.ts

@@ -1,102 +0,0 @@
-// Vercel REST API helpers — all calls require a bearer token
-import type { VercelDeployment, DeploymentEvent } from '../types'
-
-const BASE = 'https://api.vercel.com'
-
-/** Only allow genuine Vercel deploy hook URLs through triggerDeploy */
-const VERCEL_HOOK_RE = /^https:\/\/api\.vercel\.com\/v1\/integrations\/deploy\//
-
-async function vercelFetch<T>(path: string, token: string, init?: RequestInit): Promise<T> {
-	const res = await fetch(`${BASE}${path}`, {
-		...init,
-		headers: {
-			Authorization: `Bearer ${token}`,
-			'Content-Type': 'application/json',
-			...init?.headers,
-		},
-	})
-	if (!res.ok) {
-		const hint =
-			res.status === 401 ? ' — token is invalid or expired. Reconnect your API token.' :
-			res.status === 403 ? ' — token lacks the required permissions. Ensure it has Full Account scope.' :
-			res.status === 404 ? ' — resource not found. Check the deploy hook URL and team ID.' :
-			res.status === 429 ? ' — rate limit reached. Wait a moment and try again.' :
-			res.status >= 500  ? ' — Vercel is experiencing issues. Try again shortly.' :
-			''
-		throw new Error(`Vercel API ${res.status}${hint}`)
-	}
-	return res.json() as Promise<T>
-}
-
-/** Fetch the last N deployments triggered by a specific deploy hook */
-export async function listDeployments(opts: {
-	projectId: string
-	hookId: string
-	token: string
-	teamId?: string
-	limit?: number
-}): Promise<VercelDeployment[]> {
-	const params = new URLSearchParams({
-		projectId: opts.projectId,
-		'meta-deployHookId': opts.hookId,
-		limit: String(opts.limit ?? 10),
-	})
-	if (opts.teamId) params.set('teamId', opts.teamId)
-	const data = await vercelFetch<{ deployments: VercelDeployment[] }>(
-		`/v6/deployments?${params}`,
-		opts.token,
-	)
-	return data.deployments ?? []
-}
-
-/** Cancel an in-progress deployment */
-export async function cancelDeployment(opts: {
-	deploymentId: string
-	token: string
-	teamId?: string
-}): Promise<void> {
-	// teamId is free text from the target document — encode it rather than splicing it in raw,
-	// or an '&' injects extra parameters into an authenticated request.
-	const params = new URLSearchParams()
-	if (opts.teamId) params.set('teamId', opts.teamId)
-	const query = params.toString() ? `?${params}` : ''
-	await vercelFetch(
-		`/v12/deployments/${encodeURIComponent(opts.deploymentId)}/cancel${query}`,
-		opts.token,
-		{ method: 'PATCH' },
-	)
-}
-
-/**
- * Trigger a deploy by POSTing to the hook URL.
- * Validates the URL is a genuine Vercel hook before calling to prevent
- * SSRF if a document is tampered with outside the Studio schema.
- */
-export async function triggerDeploy(hookUrl: string): Promise<void> {
-	if (!VERCEL_HOOK_RE.test(hookUrl)) {
-		throw new Error('Invalid deploy hook URL — must be a Vercel hook (api.vercel.com/v1/integrations/deploy/…)')
-	}
-	const res = await fetch(hookUrl, { method: 'POST' })
-	if (!res.ok) throw new Error(`Deploy hook returned ${res.status}`)
-}
-
-/**
- * Fetch build events for a deployment.
- * Returns up to 100 events in reverse chronological order,
- * filtered to lines with actual text content.
- */
-export async function getDeploymentEvents(opts: {
-	deploymentId: string
-	token: string
-	teamId?: string
-}): Promise<DeploymentEvent[]> {
-	const params = new URLSearchParams({ limit: '100', direction: 'backward' })
-	if (opts.teamId) params.set('teamId', opts.teamId)
-	// API returns either a plain array or a wrapped object depending on version
-	const raw = await vercelFetch<DeploymentEvent[] | { events?: DeploymentEvent[] }>(
-		`/v2/deployments/${opts.deploymentId}/events?${params}`,
-		opts.token,
-	)
-	const events: DeploymentEvent[] = Array.isArray(raw) ? raw : (raw.events ?? [])
-	return events.filter(e => e.text?.trim())
-}

package/src/lib/helpers.ts

@@ -1,131 +0,0 @@
-// URL parsing and time formatting utilities
-import type { VercelDeployment, VercelDeployState } from '../types'
-
-/**
- * Extracts projectId and hookId from a Vercel deploy hook URL.
- * Format: https://api.vercel.com/v1/integrations/deploy/{projectId}/{hookId}
- */
-export function parseHookUrl(url: string): { projectId: string; hookId: string } {
-	try {
-		const path = new URL(url).pathname
-		const parts = path.split('/').filter(Boolean)
-		// parts: ['v1', 'integrations', 'deploy', '{projectId}', '{hookId}']
-		return {
-			projectId: parts[3] ?? '',
-			hookId: parts[4] ?? '',
-		}
-	} catch {
-		return { projectId: '', hookId: '' }
-	}
-}
-
-/** Active states — deployment is in progress and should be polled */
-const ACTIVE_STATES: ReadonlySet<VercelDeployState> = new Set([
-	'QUEUED',
-	'INITIALIZING',
-	'BUILDING',
-])
-
-export function isActiveState(state: VercelDeployState | undefined): boolean {
-	return !!state && ACTIVE_STATES.has(state)
-}
-
-/** Human-readable elapsed duration from a number of seconds */
-export function formatDuration(seconds: number): string {
-	if (seconds < 60) return `${seconds}s`
-	const m = Math.floor(seconds / 60)
-	const s = seconds % 60
-	return `${m}m ${s}s`
-}
-
-/** Human-readable relative time from a Unix ms timestamp */
-export function timeAgo(ms: number): string {
-	const diff = Math.floor((Date.now() - ms) / 1000)
-	if (diff < 60) return `${diff}s ago`
-	if (diff < 3600) return `${Math.floor(diff / 60)}m ago`
-	if (diff < 86400) return `${Math.floor(diff / 3600)}h ago`
-	return `${Math.floor(diff / 86400)}d ago`
-}
-
-/**
- * Validates a URL is safe to use as an href.
- * Rejects anything that isn't http/https to block javascript: injection
- * from a compromised API response.
- */
-export function safeHref(url: string | undefined): string | undefined {
-	if (!url) return undefined
-	try {
-		const parsed = new URL(url)
-		if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') return undefined
-		return url
-	} catch {
-		return undefined
-	}
-}
-
-/**
- * Builds a validated https URL from a Vercel deployment hostname.
- *
- * The API returns a bare host, so concatenating it fixes only the scheme —
- * a value like `@evil.com` yields `https://@evil.com`, which navigates to an
- * attacker-chosen host. Round-tripping through URL and checking the host was
- * not rewritten closes that.
- *
- * @param host Deployment hostname from the Vercel API, e.g. `my-app-abc123.vercel.app`.
- */
-export function deploymentHref(host: string | undefined): string | undefined {
-	if (!host) return undefined
-	// Reject anything carrying credentials, a scheme, a port or a path — a plain host only.
-	if (!/^[a-z0-9.-]+$/i.test(host)) return undefined
-	return safeHref(`https://${host}`)
-}
-
-/** Truncates a commit SHA to 7 chars */
-export function shortSha(sha: string | undefined): string {
-	return sha ? sha.slice(0, 7) : ''
-}
-
-/** Returns a label and tone for a Vercel deployment state */
-export function stateLabel(state: VercelDeployState | undefined): {
-	label: string
-	tone: 'positive' | 'caution' | 'critical' | 'default'
-} {
-	switch (state) {
-		case 'READY':        return { label: 'Ready',        tone: 'positive' }
-		case 'BUILDING':     return { label: 'Building',     tone: 'caution' }
-		case 'QUEUED':       return { label: 'Queued',       tone: 'caution' }
-		case 'INITIALIZING': return { label: 'Initializing', tone: 'caution' }
-		case 'ERROR':        return { label: 'Error',        tone: 'critical' }
-		case 'CANCELED':     return { label: 'Canceled',     tone: 'default' }
-		case 'LOADING':      return { label: 'Loading…',     tone: 'default' }
-		default:             return { label: 'Unknown',      tone: 'default' }
-	}
-}
-
-/**
- * Constructs a GitHub commit URL from deployment meta fields.
- * Returns null if the required repo or SHA info is not present.
- */
-export function githubCommitHref(meta: VercelDeployment['meta']): string | null {
-	if (!meta?.githubCommitSha) return null
-	const repo = meta.githubRepo ?? null
-	if (!repo) return null
-	return `https://github.com/${repo}/commit/${meta.githubCommitSha}`
-}
-
-/**
- * Extracts the Vercel project dashboard URL from a deployment's inspectorUrl.
- * inspectorUrl format: https://vercel.com/{team}/{project}/{deploymentId}
- * Returns https://vercel.com/{team}/{project} or null if unparseable.
- */
-export function projectHref(inspectorUrl: string | undefined): string | null {
-	if (!inspectorUrl) return null
-	try {
-		const { origin, pathname } = new URL(inspectorUrl)
-		const parts = pathname.split('/').filter(Boolean)
-		if (parts.length < 2) return null
-		return `${origin}/${parts[0]}/${parts[1]}`
-	} catch {
-		return null
-	}
-}

package/src/schema/schemaIcon.tsx

@@ -1,38 +0,0 @@
-// Eager rocket glyph for schema icons — Studio serialises these with renderToString, which cannot resolve a lazy component
-import { forwardRef } from 'react'
-import type { SVGProps } from 'react'
-
-/**
- * Static copy of Sanity's rocket glyph.
- *
- * Schema type icons are rendered through `renderToString` when the Studio
- * publishes its schema to Canvas/Create. On @sanity/icons v5 the resolved icon is
- * a `React.lazy` component behind Suspense, and a synchronous server render
- * cannot resolve a dynamic import — so the published icon comes out blank. This
- * eager component sidesteps that for the one place it matters. Artwork is MIT,
- * from @sanity/icons.
- */
-export const SchemaRocketIcon = forwardRef<SVGSVGElement, SVGProps<SVGSVGElement>>(
-	function SchemaRocketIcon(props, ref) {
-		return (
-			<svg
-				width="1em"
-				height="1em"
-				viewBox="0 0 25 25"
-				fill="none"
-				xmlns="http://www.w3.org/2000/svg"
-				aria-hidden="true"
-				focusable="false"
-				{...props}
-				ref={ref}
-			>
-				<path
-					d="M12.5 20.5L15.5 14M11 9.49999L4.5 12.5M9 14C9 14 7.54688 14.9531 6.5 16C5.5 17 4.5 20.5 4.5 20.5C4.5 20.5 8 19.5 9 18.5C10 17.5 11 16 11 16M9 14C9 14 10.1 9.9 12.5 7.5C15.5 4.5 20.5 4.5 20.5 4.5C20.5 4.5 20.5 9.5 17.5 12.5C15.7492 14.2508 11 16 11 16L9 14ZM16.5 9.99999C16.5 10.8284 15.8284 11.5 15 11.5C14.1716 11.5 13.5 10.8284 13.5 9.99999C13.5 9.17157 14.1716 8.49999 15 8.49999C15.8284 8.49999 16.5 9.17157 16.5 9.99999Z"
-					stroke="currentColor"
-					strokeWidth={1.2}
-					strokeLinejoin="round"
-				/>
-			</svg>
-		)
-	},
-)

package/src/schema/vercelConfig.ts

@@ -1,34 +0,0 @@
-// Sanity schema for the vercelDeploy.config singleton that holds the Vercel API token
-import { defineField, defineType } from 'sanity'
-
-/**
- * Registers the document the plugin stores its Vercel token in.
- *
- * The document was previously written without a registered type, which made it
- * invisible to Structure, absent from schema extraction, and impossible to
- * inspect or revoke from inside the Studio. Registering it does not change where
- * the token lives — see the security note in the README about dataset read
- * access — but it does make the credential visible and removable.
- */
-export const vercelConfigSchema = defineType({
-	name: 'vercelDeploy.config',
-	title: 'Vercel Deploy Configuration',
-	type: 'document',
-	fields: [
-		defineField({
-			name: 'accessToken',
-			title: 'Vercel API Token',
-			type: 'string',
-			description:
-				'Readable by anyone who can read this dataset. Delete this document to revoke the stored token.',
-		}),
-	],
-	preview: {
-		select: { token: 'accessToken' },
-		prepare: ({ token }: { token?: string }) => ({
-			title: 'Vercel API Token',
-			// Never render the secret itself in a preview.
-			subtitle: token ? 'Connected' : 'Not set',
-		}),
-	},
-})

package/src/schema/vercelDeploy.ts

@@ -1,49 +0,0 @@
-// Sanity schema for vercel_deploy documents — stores deploy hook targets
-import { defineField, defineType } from 'sanity'
-import { SchemaRocketIcon } from './schemaIcon'
-
-export const vercelDeploySchema = defineType({
-	name: 'vercel_deploy',
-	title: 'Deploy Target',
-	type: 'document',
-	icon: SchemaRocketIcon,
-	fields: [
-		defineField({
-			name: 'name',
-			title: 'Name',
-			type: 'string',
-			description: 'Display label shown in the Deploy tool (e.g. "Production", "Staging")',
-			validation: Rule => Rule.required(),
-		}),
-		defineField({
-			name: 'url',
-			title: 'Deploy Hook URL',
-			type: 'url',
-			description: 'From Vercel → Project Settings → Git → Deploy Hooks',
-			validation: Rule =>
-				Rule.required().uri({ scheme: ['https'] }).custom(url => {
-					if (typeof url !== 'string') return true
-					if (!url.includes('api.vercel.com/v1/integrations/deploy/')) {
-						return 'Must be a Vercel deploy hook URL (api.vercel.com/v1/integrations/deploy/…)'
-					}
-					return true
-				}),
-		}),
-		defineField({
-			name: 'teamId',
-			title: 'Vercel Team ID',
-			type: 'string',
-			description: 'Required for team-owned projects — find it in Vercel Team Settings',
-		}),
-		defineField({
-			name: 'disableDeleteAction',
-			title: 'Prevent deletion',
-			type: 'boolean',
-			description: 'Lock this target so it cannot be deleted from the Studio',
-			initialValue: false,
-		}),
-	],
-	preview: {
-		select: { title: 'name', subtitle: 'url' },
-	},
-})

package/src/types.ts

@@ -1,77 +0,0 @@
-// TypeScript types for deploy-vercel-from-sanity
-
-export type VercelDeployState =
-	| 'QUEUED'
-	| 'INITIALIZING'
-	| 'BUILDING'
-	| 'READY'
-	| 'ERROR'
-	| 'CANCELED'
-	| 'LOADING' // internal — before first API response
-
-/** A vercel_deploy document stored in the Sanity dataset */
-export interface DeployTarget {
-	_id: string
-	_type: 'vercel_deploy'
-	name: string
-	/** Full Vercel deploy hook URL */
-	url: string
-	/** Vercel team ID — optional, only needed for team projects */
-	teamId?: string
-	/** Prevent editors from deleting this target */
-	disableDeleteAction?: boolean
-}
-
-/** A single deployment returned by GET /v6/deployments */
-export interface VercelDeployment {
-	uid: string
-	/** Preview hostname, e.g. my-project-abc123.vercel.app */
-	url: string
-	state: VercelDeployState
-	/** Unix ms timestamp — when the deployment was created */
-	created: number
-	/** Unix ms timestamp — when the deployment became ready */
-	ready?: number
-	/** Link to the Vercel dashboard page for this deployment */
-	inspectorUrl?: string
-	creator?: {
-		uid: string
-		username: string
-		avatar?: string
-	}
-	meta?: {
-		githubCommitMessage?: string
-		githubCommitRef?: string
-		githubCommitSha?: string
-		githubCommitAuthorName?: string
-		/** GitHub repo in "org/repo" format — used to construct commit links */
-		githubRepo?: string
-		/** GitHub org slug — fallback when githubRepo is absent */
-		githubCommitOrg?: string
-	}
-}
-
-/** A single build event returned by GET /v2/deployments/{id}/events */
-export interface DeploymentEvent {
-	type: 'command' | 'stdout' | 'stderr' | 'exit' | 'deployment-state'
-	text?: string
-	created: number
-	payload?: Record<string, unknown>
-}
-
-/** Vercel config document stored at _id: 'config.vercelDeploy' — readable by all authenticated users */
-export interface VercelConfig {
-	_id: 'config.vercelDeploy'
-	_type: 'vercelDeploy.config'
-	accessToken: string
-}
-
-/** Plugin configuration options */
-export interface VercelDeployPluginConfig {
-	/** Tool name slug shown in Studio sidebar (default: 'vercel-deploy') */
-	name?: string
-	/** Tool label shown in Studio sidebar (default: 'Deploy') */
-	title?: string
-	/** Custom icon component */
-	icon?: React.ComponentType
-}

package/src/version.ts

@@ -1,2 +0,0 @@
-// Package version — keep in sync with package.json
-export const VERSION = '1.2.0'