@liiift-studio/deploy-vercel-from-sanity 1.3.2 → 1.5.0

package/README.md

@@ -149,6 +149,7 @@ A target needs **either** `url` **or** `proxyKey`; the schema enforces that.
 | `mode` | `'direct' \| 'proxy'` | `'direct'` | Transport used to reach Vercel — see [Two modes](#two-modes) |
 | `proxyUrl` | `string` | — | Base URL of the deploy proxy, no trailing slash. Required when `mode` is `'proxy'`. |
 | `statusKey` | `string` | — | Key sent with status requests. Must match the proxy's `VERCEL_DEPLOY_STATUS_KEY`. Ships in the Studio bundle — treat it as public. |
+| `unblock` | `UnblockConfig` | — | Enables recovery from author-blocked deploys — see [Recovering a blocked deploy](#recovering-a-blocked-deploy). Omit to leave the feature off. |
 
 ---
 
@@ -274,6 +275,194 @@ can cancel a running build for the configured targets — see
 
 ---
 
+## Recovering a blocked deploy
+
+Vercel will not build a commit whose **git author is not a member of the team
+that owns the project**. It creates the deployment, marks it `BLOCKED`, and
+compiles nothing. There is no build log, because there was no build.
+
+This is easy to miss. The deployment appears in the history like any other, and
+before 1.4.0 the state was not in the plugin's union at all, so it rendered as
+*Unknown* — an editor pressed **Deploy**, saw nothing go wrong, and waited for a
+site that was never going to update.
+
+**Pressing Deploy again cannot fix it.** The deploy hook rebuilds the current
+HEAD, which is the same commit with the same author, so it is blocked
+identically. The only way out is a new commit by an authorised author.
+
+A Studio running in a browser holds no git credential, so it cannot make that
+commit itself. `unblock` gives it two ways to borrow one.
+
+### Choose a mode
+
+| | `endpoint` — **preferred** | `token` — workflow dispatch |
+|---|---|---|
+| Needs a server | yes, one API route | no |
+| GitHub credential in the bundle | **none** | one, `Actions: write` |
+| Tokens to maintain | **1** | 2 |
+| Workflow file on the default branch | not needed | required, or dispatch 404s |
+
+Use `endpoint` if you have anywhere to put an API route. Its whole advantage is
+that nothing sensitive reaches the browser, so there is only one credential and
+it is a server secret like any other.
+
+---
+
+## `endpoint` mode
+
+```ts
+vercelDeploy({
+  unblock: {
+    endpoint: 'https://example.com/api/deploy-unblock',
+  },
+})
+```
+
+That is the entire Studio-side configuration — note the absence of a token.
+
+The Studio posts `{ ref, requestedBy }` to that URL with the signed-in user's
+**Sanity session token** in an `Authorization: Bearer` header. Your route verifies
+that token against Sanity, then makes the commit with its own server-held GitHub
+token.
+
+Requirements for the route:
+
+- **Verify the session token.** Do not accept a shared secret instead — the bundle
+  is public, so a shared secret only moves the bar from "know the URL" to "open
+  devtools". Verify against
+  `https://<projectId>.api.sanity.io/v2021-06-07/users/me`. Note Sanity answers
+  `200` with a null `id` for an unauthenticated request rather than `401`.
+- **Allow the Studio's origin.** A deployed Studio is on `*.sanity.studio`, not
+  your site's domain, so every call is cross-origin and the preflight fails
+  without an allow-list. Echo one allow-listed origin; do not send `*` to an
+  endpoint that takes an `Authorization` header.
+- **Restrict which branches it will bump.** The recovery flow only ever needs the
+  branches you deploy.
+- **Answer `{ error }` on failure.** The plugin shows that string to the editor
+  verbatim, in preference to its own generic message.
+- **Serve it over https.** The plugin refuses a plaintext endpoint, because the
+  session token travels with the request. `localhost` is exempt for development.
+
+The token forwarded is `client.config().token`. Sanity only exposes it under
+token-based auth, so it can be absent under cookie-based login; the plugin
+detects that and says so, rather than sending an anonymous request and letting
+your route report it as a permissions failure.
+
+A worked Next.js Pages Router implementation is in
+[`docs/deploy-unblock-route.js`](docs/deploy-unblock-route.js).
+
+---
+
+## `token` mode — workflow dispatch
+
+For setups with no server. The Studio dispatches a GitHub Actions workflow, and
+the workflow makes the commit.
+
+```
+Studio bundle  ──  unblock.token   Actions: write, one repo
+                        │          public — anyone who can open the Studio can read it
+                        ▼
+GitHub Actions ──  DEPLOY_COMMIT_TOKEN   Contents: write
+                        │                never leaves GitHub
+                        ▼
+              commit as an authorised author  ──▶  Vercel builds it
+```
+
+Handing the Studio a `Contents: write` token would be far simpler and is the
+obvious first design. Do not: the Studio bundle is served publicly, so that token
+would let anyone who can load the Studio push arbitrary commits to the production
+repository — and the next build would run them. The dispatch token is scoped so
+that the worst a leak permits is *running the bump workflow*.
+
+### What a leaked dispatch token can actually do
+
+Be clear-eyed about this rather than filing it under "public by design":
+
+- It **cannot** read your code, read other secrets, or push commits.
+- It **can** run the bump workflow repeatedly — churning version commits and
+  burning Vercel build minutes.
+- It **can**, without the branch allowlist, bump your *production* branch and so
+  force a deploy of whatever is currently on it. No attacker code is introduced —
+  it deploys already-merged commits — but an outsider should not be able to
+  trigger a production release.
+
+The shipped workflow therefore opens with a branch allowlist, and a `concurrency`
+group that serialises bumps per branch. Narrow the allowlist to the branches you
+actually deploy. Rotate the token if it leaks.
+
+### Setup
+
+1. Copy [`docs/version-bump.yml`](docs/version-bump.yml) to
+   `.github/workflows/version-bump.yml`, set the git identity in it to the account
+   whose commits Vercel accepts, and narrow the branch allowlist.
+
+   > **The workflow file must exist on the repository's default branch**, and on
+   > every branch you deploy from. GitHub resolves a dispatch against the default
+   > branch's copy, then runs the copy on the requested ref. A file present only on
+   > `staging` returns a 404 — which the plugin reports in full, since GitHub uses
+   > the same 404 for "no such workflow" and "your token cannot see this repo".
+
+2. Create a fine-grained token with **`Contents: write`** on that one repository
+   and save it as the repository Actions secret **`DEPLOY_COMMIT_TOKEN`**.
+
+   It must not be the default `GITHUB_TOKEN`: commits made with it are authored by
+   `github-actions[bot]`, which is not a team member either, so Vercel would block
+   the bump for the same reason it blocked the original commit.
+
+3. Create a second fine-grained token scoped to **`Actions: write`** on the same
+   repository — and nothing else — and expose it to the Studio build:
+
+   ```sh
+   SANITY_STUDIO_DEPLOY_UNBLOCK_GH_TOKEN=github_pat_…
+   ```
+
+4. Configure the plugin:
+
+   ```ts
+   vercelDeploy({
+     unblock: {
+       token: process.env.SANITY_STUDIO_DEPLOY_UNBLOCK_GH_TOKEN,
+       owner: 'your-org',
+       repo: 'your-site-repo',
+       workflow: 'version-bump.yml',   // optional, this is the default
+     },
+   })
+   ```
+
+---
+
+## `unblock` reference
+
+| Field | Required | Description |
+|---|---|---|
+| `endpoint` | one of | URL of your site route. Wins when both modes are configured. Must be https. |
+| `token` | one of | Fine-grained token, `Actions: write` on `repo` only. Ships in the Studio bundle — treat it as public. |
+| `owner` | dispatch only | Repository owner, e.g. `your-org` |
+| `repo` | dispatch only | Repository name |
+| `workflow` | no | Workflow filename. Defaults to `version-bump.yml`. |
+| `defaultRef` | no | Branch to bump when the blocked deployment names none. Normally unnecessary — the branch is read from the deployment being recovered. |
+
+A config with neither `endpoint` nor all of `token`/`owner`/`repo` is discarded,
+so a half-finished setup renders no button rather than one that only errors.
+
+### What the editor sees
+
+The button appears only when the latest deployment is actually `BLOCKED`. It is
+not a general "deploy harder" control, and it is deliberately not offered when
+the plugin has nothing to target.
+
+Pressing it reports that the bump was **requested**. That is the honest claim:
+the commit is made, but Vercel still has to notice the push and build it, so the
+new deployment turns up shortly after. Polling picks it up on its own.
+
+### The real fix
+
+This is a recovery lever, not a cure. If the same author is blocked repeatedly,
+add their GitHub account to the Vercel team — that removes the failure entirely.
+Keep `unblock` for the cases you cannot prevent.
+
+---
+
 ## Troubleshooting
 
 ### "Vercel API 401 — token is invalid or expired"

package/dist/index.d.mts

@@ -1,7 +1,14 @@
 import * as sanity from 'sanity';
 import * as react from 'react';
 
-type VercelDeployState = 'QUEUED' | 'INITIALIZING' | 'BUILDING' | 'READY' | 'ERROR' | 'CANCELED' | 'LOADING';
+type VercelDeployState = 'QUEUED' | 'INITIALIZING' | 'BUILDING' | 'READY' | 'ERROR' | 'CANCELED'
+/**
+ * Vercel refused to build the commit because its git author is not a member of
+ * the team that owns the project. Nothing was compiled, so there are no build
+ * logs to read — the fix is a new commit by an authorised author, not a retry.
+ * Re-firing the deploy hook cannot clear it: the hook rebuilds the same HEAD.
+ */
+ | 'BLOCKED' | 'LOADING';
 /** A vercel_deploy document stored in the Sanity dataset */
 interface DeployTarget {
     _id: string;
@@ -47,6 +54,12 @@ interface VercelDeployment {
         githubCommitRef?: string;
         githubCommitSha?: string;
         githubCommitAuthorName?: string;
+        /**
+         * GitHub login of the commit author. This — not `creator` — is what Vercel
+         * checks when deciding whether to build, so it is the value to name when a
+         * deployment comes back BLOCKED.
+         */
+        githubCommitAuthorLogin?: string;
         /** GitHub repo in "org/repo" format — used to construct commit links */
         githubRepo?: string;
         /** GitHub org slug — fallback when githubRepo is absent */
@@ -66,6 +79,70 @@ interface VercelDeployment {
  *   `proxy/README.md`.
  */
 type VercelDeployMode = 'direct' | 'proxy';
+/**
+ * Opt-in recovery path for deployments Vercel refuses to build because the HEAD
+ * commit's git author is not a member of the Vercel team.
+ *
+ * The Studio cannot fix this itself — the remedy is a commit by an authorised
+ * author, and a browser holds no git credential. There are two ways to borrow
+ * one, and they are not equivalent:
+ *
+ * - **{@link endpoint} (preferred).** The Studio posts the signed-in user's
+ *   Sanity session token to a route on your own site; the route verifies it and
+ *   commits with its own server-held GitHub token. Nothing secret reaches the
+ *   browser, there is one token to maintain, and there is no workflow file whose
+ *   presence on the default branch you have to remember.
+ *
+ * - **{@link token}.** The Studio dispatches a GitHub Actions workflow directly.
+ *   Needs no server, but puts a GitHub token in the bundle, which is public.
+ *   Scope it to **Actions: write on the one repo** so the worst a leak permits is
+ *   running that workflow, and never give it `Contents: write` — a public token
+ *   that can push code is a public token that can run code on your next build.
+ *
+ * Set `endpoint` if you have anywhere to put a route. It wins when both are set.
+ */
+interface UnblockConfig {
+    /**
+     * URL of a site API route that performs the bump server-side. **Preferred.**
+     *
+     * In this mode the Studio carries no GitHub credential at all. It posts the
+     * signed-in user's Sanity session token, the route verifies it against Sanity,
+     * and the route's own server-held GitHub token makes the commit. One token,
+     * never public, and no workflow file to keep on the default branch.
+     *
+     * Takes precedence over {@link token} when both are set.
+     */
+    endpoint?: string;
+    /**
+     * Fine-grained GitHub token, scoped to `Actions: write` on {@link repo} alone.
+     * Only used when {@link endpoint} is not set.
+     *
+     * Compiled into the Studio bundle, so anyone who can load the Studio can read
+     * it and dispatch the workflow. Never give it `Contents: write` — that would
+     * let a reader push arbitrary commits to the production repo. If you have a
+     * server to put a route on, prefer {@link endpoint} and avoid this entirely.
+     */
+    token?: string;
+    /** Repository owner, e.g. `your-org`. Required for workflow-dispatch mode only. */
+    owner?: string;
+    /** Repository name. Required for workflow-dispatch mode only. */
+    repo?: string;
+    /**
+     * Workflow filename to dispatch. Defaults to `version-bump.yml`.
+     * Workflow-dispatch mode only.
+     *
+     * GitHub resolves a dispatch against the workflow file **on the repository's
+     * default branch**, then runs the copy on the requested ref — so the file must
+     * exist on the default branch as well as on every branch you deploy from, or
+     * the dispatch returns 404. `endpoint` mode has no such constraint.
+     */
+    workflow?: string;
+    /**
+     * Branch to bump when the blocked deployment does not name one. Normally
+     * unnecessary: the branch is read from the deployment being unblocked.
+     */
+    defaultRef?: string;
+}
 /** Plugin configuration options */
 interface VercelDeployPluginConfig {
     /** Tool name slug shown in Studio sidebar (default: 'vercel-deploy') */
@@ -94,6 +171,12 @@ interface VercelDeployPluginConfig {
      * API token never leaves the proxy.
      */
     statusKey?: string;
+    /**
+     * Enables the "Bump version" recovery button on deployments Vercel blocked for
+     * git-author reasons. Omit to leave the feature off — the button never renders
+     * and no GitHub token is required.
+     */
+    unblock?: UnblockConfig;
 }
 
 declare const vercelDeploySchema: {
@@ -159,4 +242,4 @@ declare const vercelDeploySchema: {
  */
 declare const vercelDeploy: sanity.Plugin<void | VercelDeployPluginConfig>;
 
-export { type DeployTarget, type VercelDeployMode, type VercelDeployPluginConfig, type VercelDeployState, type VercelDeployment, vercelDeploy, vercelDeploySchema };
+export { type DeployTarget, type UnblockConfig, type VercelDeployMode, type VercelDeployPluginConfig, type VercelDeployState, type VercelDeployment, vercelDeploy, vercelDeploySchema };

package/dist/index.d.ts

@@ -1,7 +1,14 @@
 import * as sanity from 'sanity';
 import * as react from 'react';
 
-type VercelDeployState = 'QUEUED' | 'INITIALIZING' | 'BUILDING' | 'READY' | 'ERROR' | 'CANCELED' | 'LOADING';
+type VercelDeployState = 'QUEUED' | 'INITIALIZING' | 'BUILDING' | 'READY' | 'ERROR' | 'CANCELED'
+/**
+ * Vercel refused to build the commit because its git author is not a member of
+ * the team that owns the project. Nothing was compiled, so there are no build
+ * logs to read — the fix is a new commit by an authorised author, not a retry.
+ * Re-firing the deploy hook cannot clear it: the hook rebuilds the same HEAD.
+ */
+ | 'BLOCKED' | 'LOADING';
 /** A vercel_deploy document stored in the Sanity dataset */
 interface DeployTarget {
     _id: string;
@@ -47,6 +54,12 @@ interface VercelDeployment {
         githubCommitRef?: string;
         githubCommitSha?: string;
         githubCommitAuthorName?: string;
+        /**
+         * GitHub login of the commit author. This — not `creator` — is what Vercel
+         * checks when deciding whether to build, so it is the value to name when a
+         * deployment comes back BLOCKED.
+         */
+        githubCommitAuthorLogin?: string;
         /** GitHub repo in "org/repo" format — used to construct commit links */
         githubRepo?: string;
         /** GitHub org slug — fallback when githubRepo is absent */
@@ -66,6 +79,70 @@ interface VercelDeployment {
  *   `proxy/README.md`.
  */
 type VercelDeployMode = 'direct' | 'proxy';
+/**
+ * Opt-in recovery path for deployments Vercel refuses to build because the HEAD
+ * commit's git author is not a member of the Vercel team.
+ *
+ * The Studio cannot fix this itself — the remedy is a commit by an authorised
+ * author, and a browser holds no git credential. There are two ways to borrow
+ * one, and they are not equivalent:
+ *
+ * - **{@link endpoint} (preferred).** The Studio posts the signed-in user's
+ *   Sanity session token to a route on your own site; the route verifies it and
+ *   commits with its own server-held GitHub token. Nothing secret reaches the
+ *   browser, there is one token to maintain, and there is no workflow file whose
+ *   presence on the default branch you have to remember.
+ *
+ * - **{@link token}.** The Studio dispatches a GitHub Actions workflow directly.
+ *   Needs no server, but puts a GitHub token in the bundle, which is public.
+ *   Scope it to **Actions: write on the one repo** so the worst a leak permits is
+ *   running that workflow, and never give it `Contents: write` — a public token
+ *   that can push code is a public token that can run code on your next build.
+ *
+ * Set `endpoint` if you have anywhere to put a route. It wins when both are set.
+ */
+interface UnblockConfig {
+    /**
+     * URL of a site API route that performs the bump server-side. **Preferred.**
+     *
+     * In this mode the Studio carries no GitHub credential at all. It posts the
+     * signed-in user's Sanity session token, the route verifies it against Sanity,
+     * and the route's own server-held GitHub token makes the commit. One token,
+     * never public, and no workflow file to keep on the default branch.
+     *
+     * Takes precedence over {@link token} when both are set.
+     */
+    endpoint?: string;
+    /**
+     * Fine-grained GitHub token, scoped to `Actions: write` on {@link repo} alone.
+     * Only used when {@link endpoint} is not set.
+     *
+     * Compiled into the Studio bundle, so anyone who can load the Studio can read
+     * it and dispatch the workflow. Never give it `Contents: write` — that would
+     * let a reader push arbitrary commits to the production repo. If you have a
+     * server to put a route on, prefer {@link endpoint} and avoid this entirely.
+     */
+    token?: string;
+    /** Repository owner, e.g. `your-org`. Required for workflow-dispatch mode only. */
+    owner?: string;
+    /** Repository name. Required for workflow-dispatch mode only. */
+    repo?: string;
+    /**
+     * Workflow filename to dispatch. Defaults to `version-bump.yml`.
+     * Workflow-dispatch mode only.
+     *
+     * GitHub resolves a dispatch against the workflow file **on the repository's
+     * default branch**, then runs the copy on the requested ref — so the file must
+     * exist on the default branch as well as on every branch you deploy from, or
+     * the dispatch returns 404. `endpoint` mode has no such constraint.
+     */
+    workflow?: string;
+    /**
+     * Branch to bump when the blocked deployment does not name one. Normally
+     * unnecessary: the branch is read from the deployment being unblocked.
+     */
+    defaultRef?: string;
+}
 /** Plugin configuration options */
 interface VercelDeployPluginConfig {
     /** Tool name slug shown in Studio sidebar (default: 'vercel-deploy') */
@@ -94,6 +171,12 @@ interface VercelDeployPluginConfig {
      * API token never leaves the proxy.
      */
     statusKey?: string;
+    /**
+     * Enables the "Bump version" recovery button on deployments Vercel blocked for
+     * git-author reasons. Omit to leave the feature off — the button never renders
+     * and no GitHub token is required.
+     */
+    unblock?: UnblockConfig;
 }
 
 declare const vercelDeploySchema: {
@@ -159,4 +242,4 @@ declare const vercelDeploySchema: {
  */
 declare const vercelDeploy: sanity.Plugin<void | VercelDeployPluginConfig>;
 
-export { type DeployTarget, type VercelDeployMode, type VercelDeployPluginConfig, type VercelDeployState, type VercelDeployment, vercelDeploy, vercelDeploySchema };
+export { type DeployTarget, type UnblockConfig, type VercelDeployMode, type VercelDeployPluginConfig, type VercelDeployState, type VercelDeployment, vercelDeploy, vercelDeploySchema };

package/dist/index.js

@@ -102,13 +102,23 @@ var import_react2 = require("react");
 var import_jsx_runtime2 = require("react/jsx-runtime");
 var DEFAULTS = { mode: "direct" };
 var ConfigContext = (0, import_react2.createContext)(DEFAULTS);
+function isUsableUnblock(unblock) {
+  if (!unblock) return false;
+  if (unblock.endpoint) return true;
+  return Boolean(unblock.token && unblock.owner && unblock.repo);
+}
 function resolveConfig(options) {
   const config = options ?? {};
   return {
     mode: config.mode ?? "direct",
     // Trailing slashes would double up when request paths are appended.
     proxyUrl: config.proxyUrl?.replace(/\/+$/, ""),
-    statusKey: config.statusKey
+    statusKey: config.statusKey,
+    // Dropped unless it can actually be used, so an incomplete configuration renders
+    // no button rather than one whose only outcome is an error. Either mode will do:
+    // an `endpoint` needs nothing else, while workflow dispatch needs all three of
+    // token, owner and repo to build an authenticated request.
+    unblock: isUsableUnblock(config.unblock) ? config.unblock : void 0
   };
 }
 function ConfigProvider({ value, children }) {
@@ -701,6 +711,134 @@ async function fetchDeploymentEvents(transport, target, deploymentId) {
   return data.events ?? [];
 }
 
+// src/lib/github.ts
+var GITHUB_API = "https://api.github.com";
+var DEFAULT_WORKFLOW = "version-bump.yml";
+var SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
+var REF_RE = /^[A-Za-z0-9._\-/]+$/;
+function isValidRef(ref) {
+  if (!ref || ref.length > 255) return false;
+  if (!REF_RE.test(ref)) return false;
+  if (ref.includes("..") || ref.includes("//")) return false;
+  if (ref.startsWith("/") || ref.endsWith("/")) return false;
+  if (ref.startsWith("-") || ref.endsWith(".lock")) return false;
+  return true;
+}
+async function dispatchVersionBump(opts) {
+  const { config, ref, requestedBy } = opts;
+  const workflow = config.workflow ?? DEFAULT_WORKFLOW;
+  if (!config.token) throw new Error("No GitHub token is configured for deploy recovery.");
+  if (!SEGMENT_RE.test(config.owner)) throw new Error(`Invalid repository owner "${config.owner}".`);
+  if (!SEGMENT_RE.test(config.repo)) throw new Error(`Invalid repository name "${config.repo}".`);
+  if (!SEGMENT_RE.test(workflow)) throw new Error(`Invalid workflow filename "${workflow}".`);
+  if (!isValidRef(ref)) throw new Error(`Invalid branch name "${ref}".`);
+  const path = `/repos/${encodeURIComponent(config.owner)}/${encodeURIComponent(config.repo)}/actions/workflows/${encodeURIComponent(workflow)}/dispatches`;
+  const res = await fetch(`${GITHUB_API}${path}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${config.token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      ref,
+      // Workflow inputs are strings; anything else is rejected with a 422.
+      inputs: { requested_by: (requestedBy ?? "a Studio user").slice(0, 80) }
+    })
+  });
+  if (res.status === 204) return;
+  throw new Error(`${dispatchErrorMessage(res.status, workflow, ref)} (GitHub ${res.status})`);
+}
+function dispatchErrorMessage(status, workflow, ref) {
+  switch (status) {
+    case 401:
+      return "The GitHub token is invalid or expired. Ask a developer to reissue it.";
+    case 403:
+      return "The GitHub token is not allowed to run workflows on this repository. It needs Actions: write.";
+    case 404:
+      return `GitHub could not find "${workflow}". It must exist on the repository's default branch as well as on "${ref}" \u2014 or the token cannot see this repository.`;
+    case 422:
+      return `GitHub rejected the request: branch "${ref}" may not exist, or "${workflow}" has no workflow_dispatch trigger.`;
+    case 429:
+      return "GitHub rate limit reached. Wait a minute and try again.";
+    default:
+      return status >= 500 ? "GitHub is having problems. Try again shortly." : "The version bump could not be started.";
+  }
+}
+
+// src/lib/unblock.ts
+function assertSafeEndpoint(endpoint) {
+  let parsed;
+  try {
+    parsed = new URL(endpoint);
+  } catch {
+    throw new Error(`The configured recovery endpoint is not a valid URL: "${endpoint}".`);
+  }
+  const isLocal = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+  if (parsed.protocol !== "https:" && !isLocal) {
+    throw new Error("The recovery endpoint must be https \u2014 the Studio session token is sent with the request.");
+  }
+  return parsed;
+}
+async function postToEndpoint(opts) {
+  const { config, ref, requestedBy, studioToken } = opts;
+  const endpoint = assertSafeEndpoint(config.endpoint);
+  if (!studioToken) {
+    throw new Error(
+      "Your Studio session token is not available, so the site cannot verify who you are. This happens under cookie-based login \u2014 sign out and back in, or ask a developer to deploy manually."
+    );
+  }
+  let res;
+  try {
+    res = await fetch(endpoint.toString(), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${studioToken}`
+      },
+      body: JSON.stringify({ ref, requestedBy })
+    });
+  } catch {
+    throw new Error(
+      `Could not reach ${endpoint.host}. Check the site is up and that the route allows requests from this Studio's origin.`
+    );
+  }
+  if (res.ok) return;
+  let detail = "";
+  try {
+    const body = await res.json();
+    if (typeof body?.error === "string") detail = body.error;
+  } catch {
+  }
+  throw new Error(detail || endpointErrorMessage(res.status, endpoint.host));
+}
+function endpointErrorMessage(status, host) {
+  switch (status) {
+    case 401:
+      return "The site did not accept your Studio session. Try signing out of the Studio and back in.";
+    case 403:
+      return "Your Studio account is not permitted to trigger a deploy recovery.";
+    case 404:
+      return `No recovery route at ${host}. It may not be deployed yet \u2014 check the endpoint URL.`;
+    case 429:
+      return "A bump was requested very recently. Wait a moment before trying again.";
+    default:
+      return status >= 500 ? "The site failed while making the bump commit. Check its function logs." : `The site refused the request (${status}).`;
+  }
+}
+async function requestUnblock(opts) {
+  if (opts.config.endpoint) return postToEndpoint(opts);
+  if (!opts.config.owner || !opts.config.repo) {
+    throw new Error("Deploy recovery is misconfigured \u2014 set either `endpoint`, or `owner` and `repo`.");
+  }
+  return dispatchVersionBump({
+    config: opts.config,
+    ref: opts.ref,
+    requestedBy: opts.requestedBy
+  });
+}
+
 // src/components/DeployItem.tsx
 var import_sanity = require("sanity");
 
@@ -769,6 +907,11 @@ function stateLabel(state) {
       return { label: "Initializing", tone: "caution" };
     case "ERROR":
       return { label: "Error", tone: "critical" };
+    // Distinct from Error: nothing was built, so there is no log to read and a
+    // retry changes nothing. Labelling it 'Unknown' is what made this failure
+    // invisible to editors, who saw a deploy that simply never arrived.
+    case "BLOCKED":
+      return { label: "Blocked", tone: "critical" };
     case "CANCELED":
       return { label: "Canceled", tone: "default" };
     case "LOADING":
@@ -916,6 +1059,7 @@ function DeployItem({ target, token, onDelete, onEdit }) {
   const toast = useToast();
   const pluginConfig = usePluginConfig();
   const client = (0, import_sanity.useClient)({ apiVersion: "2025-01-01" });
+  const currentUser = (0, import_sanity.useCurrentUser)();
   const transport = (0, import_react8.useMemo)(
     () => pluginConfig.mode === "proxy" ? { mode: "proxy", proxyUrl: pluginConfig.proxyUrl ?? "", statusKey: pluginConfig.statusKey } : { mode: "direct", token },
     [pluginConfig.mode, pluginConfig.proxyUrl, pluginConfig.statusKey, token]
@@ -938,6 +1082,8 @@ function DeployItem({ target, token, onDelete, onEdit }) {
   const [loadingLogs, setLoadingLogs] = (0, import_react8.useState)(false);
   const [logError, setLogError] = (0, import_react8.useState)(null);
   const [pollError, setPollError] = (0, import_react8.useState)(null);
+  const [bumping, setBumping] = (0, import_react8.useState)(false);
+  const [bumpResult, setBumpResult] = (0, import_react8.useState)(null);
   const triggeredFromUidRef = (0, import_react8.useRef)(void 0);
   const requestSeqRef = (0, import_react8.useRef)(0);
   const mountedRef = (0, import_react8.useRef)(true);
@@ -1084,6 +1230,41 @@ function DeployItem({ target, token, onDelete, onEdit }) {
     if (!showErrorLogs && errorLines.length === 0 && !logError) fetchErrorLogs();
     setShowErrorLogs((v) => !v);
   }, [showErrorLogs, errorLines.length, logError, fetchErrorLogs]);
+  const requestBump = (0, import_react8.useCallback)(async () => {
+    const unblockConfig = pluginConfig.unblock;
+    const ref = latest?.meta?.githubCommitRef ?? unblockConfig?.defaultRef;
+    if (!unblockConfig || !ref) return;
+    setBumping(true);
+    setBumpResult(null);
+    try {
+      await requestUnblock({
+        config: unblockConfig,
+        ref,
+        requestedBy: currentUser?.name || currentUser?.email || void 0,
+        // Forwarded so a site endpoint can verify the caller is a signed-in project
+        // user. Sanity only exposes this under token-based auth, so it can be
+        // absent; `requestUnblock` reports that as its own case rather than
+        // letting the server see an anonymous request and call it a permissions
+        // failure. Unused by workflow-dispatch mode.
+        studioToken: client.config().token
+      });
+      setBumpResult({
+        ok: true,
+        message: `Version bump requested on ${ref}. The new deploy appears here in a minute or two.`
+      });
+      toast.push({
+        status: "success",
+        title: "Version bump requested",
+        description: `${target.name} will redeploy once the bump commit lands on ${ref}.`
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "The version bump could not be started.";
+      setBumpResult({ ok: false, message });
+      toast.push({ status: "error", title: "Could not request a version bump", description: message });
+    } finally {
+      setBumping(false);
+    }
+  }, [pluginConfig.unblock, latest?.meta?.githubCommitRef, currentUser, target.name, toast, client]);
   const branch = latest?.meta?.githubCommitRef;
   const commitMsg = latest?.meta?.githubCommitMessage?.split("\n")[0];
   const sha = shortSha(latest?.meta?.githubCommitSha);
@@ -1093,6 +1274,10 @@ function DeployItem({ target, token, onDelete, onEdit }) {
   const deployedAt = latest?.created ? timeAgo(latest.created) : null;
   const vercelProjectUrl = projectHref(latest?.inspectorUrl);
   const isError = latest?.state === "ERROR";
+  const isBlocked = latest?.state === "BLOCKED";
+  const blockedAuthor = latest?.meta?.githubCommitAuthorLogin ?? latest?.meta?.githubCommitAuthorName;
+  const bumpRef = branch ?? pluginConfig.unblock?.defaultRef;
+  const canUnblock = Boolean(isBlocked && pluginConfig.unblock && bumpRef);
   return /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
     /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Card, { radius: 2, shadow: 1, tone: "default", children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Flex, { align: "stretch", className: "dvfs-card-flex", children: [
       /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Flex, { direction: "column", flex: 1, style: { minWidth: 0 }, children: [
@@ -1256,7 +1441,48 @@ function DeployItem({ target, token, onDelete, onEdit }) {
                 ] })
               ] }),
               deployError && /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Card, { tone: "critical", padding: 2, radius: 2, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { size: 1, children: deployError }) })
-            ] })
+            ] }),
+            isBlocked && /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Card, { tone: "critical", padding: 3, radius: 2, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Stack, { space: 3, children: [
+              /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Flex, { align: "flex-start", gap: 2, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Box, { style: { flexShrink: 0, marginTop: 2 }, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(WarningOutlineIcon, { "aria-hidden": "true" }) }),
+                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Stack, { space: 2, children: [
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { size: 1, weight: "semibold", children: "Vercel refused to build this commit" }),
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { size: 1, children: [
+                    blockedAuthor ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(import_jsx_runtime10.Fragment, { children: [
+                      "The last commit was authored by ",
+                      /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("strong", { children: blockedAuthor }),
+                      ", who is not a member of the Vercel team, so the build never started."
+                    ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(import_jsx_runtime10.Fragment, { children: "The last commit's author is not a member of the Vercel team, so the build never started." }),
+                    " ",
+                    "Deploying again will not help \u2014 it rebuilds the same commit."
+                  ] })
+                ] })
+              ] }),
+              canUnblock ? /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Stack, { space: 2, children: [
+                /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(
+                  Button,
+                  {
+                    text: bumping ? "Requesting\u2026" : "Bump version and redeploy",
+                    tone: "critical",
+                    icon: RocketIcon,
+                    fontSize: 1,
+                    loading: bumping,
+                    disabled: bumping || bumpResult?.ok === true,
+                    onClick: requestBump,
+                    style: { alignSelf: "flex-start", cursor: "pointer" }
+                  }
+                ),
+                /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { size: 0, muted: true, children: [
+                  "Adds an authorised version-bump commit on ",
+                  /* @__PURE__ */ (0, import_jsx_runtime10.jsx)("code", { children: bumpRef }),
+                  ", which Vercel will build."
+                ] })
+              ] }) : /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Text, { size: 0, muted: true, children: pluginConfig.unblock ? "This deployment carries no branch information, so a version bump cannot be targeted. Ask a developer to deploy manually." : "Ask a developer to push a version bump \u2014 a commit by an authorised author is needed before this site can deploy." }),
+              bumpResult && /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Text, { size: 0, weight: bumpResult.ok ? "semibold" : void 0, children: [
+                bumpResult.ok ? "\u2713 " : "",
+                bumpResult.message
+              ] })
+            ] }) })
           ] }),
           pollError && /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(Card, { tone: "caution", padding: 3, radius: 2, children: /* @__PURE__ */ (0, import_jsx_runtime10.jsxs)(Flex, { align: "center", gap: 2, children: [
             /* @__PURE__ */ (0, import_jsx_runtime10.jsx)(WarningOutlineIcon, { "aria-hidden": "true" }),
@@ -1644,7 +1870,7 @@ function DeployTargetForm({ initial, onSaved, onClose }) {
 }
 
 // src/version.ts
-var VERSION = "1.3.2";
+var VERSION = "1.5.0";
 
 // src/components/DeployTool.tsx
 var import_jsx_runtime13 = require("react/jsx-runtime");

package/dist/index.mjs

@@ -67,13 +67,23 @@ import { createContext, useContext } from "react";
 import { jsx as jsx2 } from "react/jsx-runtime";
 var DEFAULTS = { mode: "direct" };
 var ConfigContext = createContext(DEFAULTS);
+function isUsableUnblock(unblock) {
+  if (!unblock) return false;
+  if (unblock.endpoint) return true;
+  return Boolean(unblock.token && unblock.owner && unblock.repo);
+}
 function resolveConfig(options) {
   const config = options ?? {};
   return {
     mode: config.mode ?? "direct",
     // Trailing slashes would double up when request paths are appended.
     proxyUrl: config.proxyUrl?.replace(/\/+$/, ""),
-    statusKey: config.statusKey
+    statusKey: config.statusKey,
+    // Dropped unless it can actually be used, so an incomplete configuration renders
+    // no button rather than one whose only outcome is an error. Either mode will do:
+    // an `endpoint` needs nothing else, while workflow dispatch needs all three of
+    // token, owner and repo to build an authenticated request.
+    unblock: isUsableUnblock(config.unblock) ? config.unblock : void 0
   };
 }
 function ConfigProvider({ value, children }) {
@@ -666,8 +676,136 @@ async function fetchDeploymentEvents(transport, target, deploymentId) {
   return data.events ?? [];
 }
 
+// src/lib/github.ts
+var GITHUB_API = "https://api.github.com";
+var DEFAULT_WORKFLOW = "version-bump.yml";
+var SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
+var REF_RE = /^[A-Za-z0-9._\-/]+$/;
+function isValidRef(ref) {
+  if (!ref || ref.length > 255) return false;
+  if (!REF_RE.test(ref)) return false;
+  if (ref.includes("..") || ref.includes("//")) return false;
+  if (ref.startsWith("/") || ref.endsWith("/")) return false;
+  if (ref.startsWith("-") || ref.endsWith(".lock")) return false;
+  return true;
+}
+async function dispatchVersionBump(opts) {
+  const { config, ref, requestedBy } = opts;
+  const workflow = config.workflow ?? DEFAULT_WORKFLOW;
+  if (!config.token) throw new Error("No GitHub token is configured for deploy recovery.");
+  if (!SEGMENT_RE.test(config.owner)) throw new Error(`Invalid repository owner "${config.owner}".`);
+  if (!SEGMENT_RE.test(config.repo)) throw new Error(`Invalid repository name "${config.repo}".`);
+  if (!SEGMENT_RE.test(workflow)) throw new Error(`Invalid workflow filename "${workflow}".`);
+  if (!isValidRef(ref)) throw new Error(`Invalid branch name "${ref}".`);
+  const path = `/repos/${encodeURIComponent(config.owner)}/${encodeURIComponent(config.repo)}/actions/workflows/${encodeURIComponent(workflow)}/dispatches`;
+  const res = await fetch(`${GITHUB_API}${path}`, {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${config.token}`,
+      Accept: "application/vnd.github+json",
+      "X-GitHub-Api-Version": "2022-11-28",
+      "Content-Type": "application/json"
+    },
+    body: JSON.stringify({
+      ref,
+      // Workflow inputs are strings; anything else is rejected with a 422.
+      inputs: { requested_by: (requestedBy ?? "a Studio user").slice(0, 80) }
+    })
+  });
+  if (res.status === 204) return;
+  throw new Error(`${dispatchErrorMessage(res.status, workflow, ref)} (GitHub ${res.status})`);
+}
+function dispatchErrorMessage(status, workflow, ref) {
+  switch (status) {
+    case 401:
+      return "The GitHub token is invalid or expired. Ask a developer to reissue it.";
+    case 403:
+      return "The GitHub token is not allowed to run workflows on this repository. It needs Actions: write.";
+    case 404:
+      return `GitHub could not find "${workflow}". It must exist on the repository's default branch as well as on "${ref}" \u2014 or the token cannot see this repository.`;
+    case 422:
+      return `GitHub rejected the request: branch "${ref}" may not exist, or "${workflow}" has no workflow_dispatch trigger.`;
+    case 429:
+      return "GitHub rate limit reached. Wait a minute and try again.";
+    default:
+      return status >= 500 ? "GitHub is having problems. Try again shortly." : "The version bump could not be started.";
+  }
+}
+
+// src/lib/unblock.ts
+function assertSafeEndpoint(endpoint) {
+  let parsed;
+  try {
+    parsed = new URL(endpoint);
+  } catch {
+    throw new Error(`The configured recovery endpoint is not a valid URL: "${endpoint}".`);
+  }
+  const isLocal = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+  if (parsed.protocol !== "https:" && !isLocal) {
+    throw new Error("The recovery endpoint must be https \u2014 the Studio session token is sent with the request.");
+  }
+  return parsed;
+}
+async function postToEndpoint(opts) {
+  const { config, ref, requestedBy, studioToken } = opts;
+  const endpoint = assertSafeEndpoint(config.endpoint);
+  if (!studioToken) {
+    throw new Error(
+      "Your Studio session token is not available, so the site cannot verify who you are. This happens under cookie-based login \u2014 sign out and back in, or ask a developer to deploy manually."
+    );
+  }
+  let res;
+  try {
+    res = await fetch(endpoint.toString(), {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${studioToken}`
+      },
+      body: JSON.stringify({ ref, requestedBy })
+    });
+  } catch {
+    throw new Error(
+      `Could not reach ${endpoint.host}. Check the site is up and that the route allows requests from this Studio's origin.`
+    );
+  }
+  if (res.ok) return;
+  let detail = "";
+  try {
+    const body = await res.json();
+    if (typeof body?.error === "string") detail = body.error;
+  } catch {
+  }
+  throw new Error(detail || endpointErrorMessage(res.status, endpoint.host));
+}
+function endpointErrorMessage(status, host) {
+  switch (status) {
+    case 401:
+      return "The site did not accept your Studio session. Try signing out of the Studio and back in.";
+    case 403:
+      return "Your Studio account is not permitted to trigger a deploy recovery.";
+    case 404:
+      return `No recovery route at ${host}. It may not be deployed yet \u2014 check the endpoint URL.`;
+    case 429:
+      return "A bump was requested very recently. Wait a moment before trying again.";
+    default:
+      return status >= 500 ? "The site failed while making the bump commit. Check its function logs." : `The site refused the request (${status}).`;
+  }
+}
+async function requestUnblock(opts) {
+  if (opts.config.endpoint) return postToEndpoint(opts);
+  if (!opts.config.owner || !opts.config.repo) {
+    throw new Error("Deploy recovery is misconfigured \u2014 set either `endpoint`, or `owner` and `repo`.");
+  }
+  return dispatchVersionBump({
+    config: opts.config,
+    ref: opts.ref,
+    requestedBy: opts.requestedBy
+  });
+}
+
 // src/components/DeployItem.tsx
-import { useClient } from "sanity";
+import { useClient, useCurrentUser } from "sanity";
 
 // src/lib/helpers.ts
 function parseHookUrl(url) {
@@ -734,6 +872,11 @@ function stateLabel(state) {
       return { label: "Initializing", tone: "caution" };
     case "ERROR":
       return { label: "Error", tone: "critical" };
+    // Distinct from Error: nothing was built, so there is no log to read and a
+    // retry changes nothing. Labelling it 'Unknown' is what made this failure
+    // invisible to editors, who saw a deploy that simply never arrived.
+    case "BLOCKED":
+      return { label: "Blocked", tone: "critical" };
     case "CANCELED":
       return { label: "Canceled", tone: "default" };
     case "LOADING":
@@ -881,6 +1024,7 @@ function DeployItem({ target, token, onDelete, onEdit }) {
   const toast = useToast();
   const pluginConfig = usePluginConfig();
   const client = useClient({ apiVersion: "2025-01-01" });
+  const currentUser = useCurrentUser();
   const transport = useMemo2(
     () => pluginConfig.mode === "proxy" ? { mode: "proxy", proxyUrl: pluginConfig.proxyUrl ?? "", statusKey: pluginConfig.statusKey } : { mode: "direct", token },
     [pluginConfig.mode, pluginConfig.proxyUrl, pluginConfig.statusKey, token]
@@ -903,6 +1047,8 @@ function DeployItem({ target, token, onDelete, onEdit }) {
   const [loadingLogs, setLoadingLogs] = useState5(false);
   const [logError, setLogError] = useState5(null);
   const [pollError, setPollError] = useState5(null);
+  const [bumping, setBumping] = useState5(false);
+  const [bumpResult, setBumpResult] = useState5(null);
   const triggeredFromUidRef = useRef2(void 0);
   const requestSeqRef = useRef2(0);
   const mountedRef = useRef2(true);
@@ -1049,6 +1195,41 @@ function DeployItem({ target, token, onDelete, onEdit }) {
     if (!showErrorLogs && errorLines.length === 0 && !logError) fetchErrorLogs();
     setShowErrorLogs((v) => !v);
   }, [showErrorLogs, errorLines.length, logError, fetchErrorLogs]);
+  const requestBump = useCallback4(async () => {
+    const unblockConfig = pluginConfig.unblock;
+    const ref = latest?.meta?.githubCommitRef ?? unblockConfig?.defaultRef;
+    if (!unblockConfig || !ref) return;
+    setBumping(true);
+    setBumpResult(null);
+    try {
+      await requestUnblock({
+        config: unblockConfig,
+        ref,
+        requestedBy: currentUser?.name || currentUser?.email || void 0,
+        // Forwarded so a site endpoint can verify the caller is a signed-in project
+        // user. Sanity only exposes this under token-based auth, so it can be
+        // absent; `requestUnblock` reports that as its own case rather than
+        // letting the server see an anonymous request and call it a permissions
+        // failure. Unused by workflow-dispatch mode.
+        studioToken: client.config().token
+      });
+      setBumpResult({
+        ok: true,
+        message: `Version bump requested on ${ref}. The new deploy appears here in a minute or two.`
+      });
+      toast.push({
+        status: "success",
+        title: "Version bump requested",
+        description: `${target.name} will redeploy once the bump commit lands on ${ref}.`
+      });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "The version bump could not be started.";
+      setBumpResult({ ok: false, message });
+      toast.push({ status: "error", title: "Could not request a version bump", description: message });
+    } finally {
+      setBumping(false);
+    }
+  }, [pluginConfig.unblock, latest?.meta?.githubCommitRef, currentUser, target.name, toast, client]);
   const branch = latest?.meta?.githubCommitRef;
   const commitMsg = latest?.meta?.githubCommitMessage?.split("\n")[0];
   const sha = shortSha(latest?.meta?.githubCommitSha);
@@ -1058,6 +1239,10 @@ function DeployItem({ target, token, onDelete, onEdit }) {
   const deployedAt = latest?.created ? timeAgo(latest.created) : null;
   const vercelProjectUrl = projectHref(latest?.inspectorUrl);
   const isError = latest?.state === "ERROR";
+  const isBlocked = latest?.state === "BLOCKED";
+  const blockedAuthor = latest?.meta?.githubCommitAuthorLogin ?? latest?.meta?.githubCommitAuthorName;
+  const bumpRef = branch ?? pluginConfig.unblock?.defaultRef;
+  const canUnblock = Boolean(isBlocked && pluginConfig.unblock && bumpRef);
   return /* @__PURE__ */ jsxs6(Fragment, { children: [
     /* @__PURE__ */ jsx10(Card, { radius: 2, shadow: 1, tone: "default", children: /* @__PURE__ */ jsxs6(Flex, { align: "stretch", className: "dvfs-card-flex", children: [
       /* @__PURE__ */ jsxs6(Flex, { direction: "column", flex: 1, style: { minWidth: 0 }, children: [
@@ -1221,7 +1406,48 @@ function DeployItem({ target, token, onDelete, onEdit }) {
                 ] })
               ] }),
               deployError && /* @__PURE__ */ jsx10(Card, { tone: "critical", padding: 2, radius: 2, children: /* @__PURE__ */ jsx10(Text, { size: 1, children: deployError }) })
-            ] })
+            ] }),
+            isBlocked && /* @__PURE__ */ jsx10(Card, { tone: "critical", padding: 3, radius: 2, children: /* @__PURE__ */ jsxs6(Stack, { space: 3, children: [
+              /* @__PURE__ */ jsxs6(Flex, { align: "flex-start", gap: 2, children: [
+                /* @__PURE__ */ jsx10(Box, { style: { flexShrink: 0, marginTop: 2 }, children: /* @__PURE__ */ jsx10(WarningOutlineIcon, { "aria-hidden": "true" }) }),
+                /* @__PURE__ */ jsxs6(Stack, { space: 2, children: [
+                  /* @__PURE__ */ jsx10(Text, { size: 1, weight: "semibold", children: "Vercel refused to build this commit" }),
+                  /* @__PURE__ */ jsxs6(Text, { size: 1, children: [
+                    blockedAuthor ? /* @__PURE__ */ jsxs6(Fragment, { children: [
+                      "The last commit was authored by ",
+                      /* @__PURE__ */ jsx10("strong", { children: blockedAuthor }),
+                      ", who is not a member of the Vercel team, so the build never started."
+                    ] }) : /* @__PURE__ */ jsx10(Fragment, { children: "The last commit's author is not a member of the Vercel team, so the build never started." }),
+                    " ",
+                    "Deploying again will not help \u2014 it rebuilds the same commit."
+                  ] })
+                ] })
+              ] }),
+              canUnblock ? /* @__PURE__ */ jsxs6(Stack, { space: 2, children: [
+                /* @__PURE__ */ jsx10(
+                  Button,
+                  {
+                    text: bumping ? "Requesting\u2026" : "Bump version and redeploy",
+                    tone: "critical",
+                    icon: RocketIcon,
+                    fontSize: 1,
+                    loading: bumping,
+                    disabled: bumping || bumpResult?.ok === true,
+                    onClick: requestBump,
+                    style: { alignSelf: "flex-start", cursor: "pointer" }
+                  }
+                ),
+                /* @__PURE__ */ jsxs6(Text, { size: 0, muted: true, children: [
+                  "Adds an authorised version-bump commit on ",
+                  /* @__PURE__ */ jsx10("code", { children: bumpRef }),
+                  ", which Vercel will build."
+                ] })
+              ] }) : /* @__PURE__ */ jsx10(Text, { size: 0, muted: true, children: pluginConfig.unblock ? "This deployment carries no branch information, so a version bump cannot be targeted. Ask a developer to deploy manually." : "Ask a developer to push a version bump \u2014 a commit by an authorised author is needed before this site can deploy." }),
+              bumpResult && /* @__PURE__ */ jsxs6(Text, { size: 0, weight: bumpResult.ok ? "semibold" : void 0, children: [
+                bumpResult.ok ? "\u2713 " : "",
+                bumpResult.message
+              ] })
+            ] }) })
           ] }),
           pollError && /* @__PURE__ */ jsx10(Card, { tone: "caution", padding: 3, radius: 2, children: /* @__PURE__ */ jsxs6(Flex, { align: "center", gap: 2, children: [
             /* @__PURE__ */ jsx10(WarningOutlineIcon, { "aria-hidden": "true" }),
@@ -1609,7 +1835,7 @@ function DeployTargetForm({ initial, onSaved, onClose }) {
 }
 
 // src/version.ts
-var VERSION = "1.3.2";
+var VERSION = "1.5.0";
 
 // src/components/DeployTool.tsx
 import { jsx as jsx13, jsxs as jsxs9 } from "react/jsx-runtime";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@liiift-studio/deploy-vercel-from-sanity",
-  "version": "1.3.2",
+  "version": "1.5.0",
   "description": "Sanity Studio plugin — trigger and monitor Vercel deployments with full status, history, and build logs. Supports Studio v3.30 through v6.",
   "license": "MIT",
   "author": "Liiift Studio",