@sentry/junior-vercel 0.264.0 → 0.266.0

package/README.md

@@ -51,6 +51,16 @@ Supported scopes (`deployment` resource type):
 - `<project-id>:production` for every production deployment
 - `<project-id>:production:<sha>` for one commit-scoped deployment
 
+Each event has the name of the Vercel webhook that it comes from:
+
+- `deployment.succeeded`: the deployment is ready.
+- `deployment.error`: the deployment failed. This is the same as GitHub `deployment.failed`, not GitHub `deployment.error`.
+- `deployment.canceled`: the deployment was canceled.
+
+All three events end a commit-scoped watch. Project and target watches stay active.
+
+Each deployment event has trusted data: `deploymentId`, `target`, and `commitSha` when the deployment came from a Git commit. Watches and event automations can filter on `target` (`preview`, `production`, or `staging`) and `commitSha`.
+
 Create the conversation watch or event automation before the terminal deployment event. A valid webhook delivery does not create a watch by itself, and unmatched deliveries are not replayed later.
 
 ## Auth model

package/dist/{chunk-VXKYUJID.js → chunk-CUJQR3FA.js}

@@ -1,4 +1,7 @@
 // src/events/deployment.ts
+import {
+  eventMatchFieldsSchema
+} from "@sentry/junior-plugin-api";
 var VERCEL_DEPLOYMENT_EVENTS = [
   "deployment.succeeded",
   "deployment.error",
@@ -9,15 +12,43 @@ var VERCEL_DEPLOYMENT_SUGGESTED_EVENTS = [
   "deployment.error",
   "deployment.canceled"
 ];
+var VERCEL_DEPLOYMENT_TARGETS = [
+  "preview",
+  "production",
+  "staging"
+];
+var VERCEL_DEPLOYMENT_MATCH_FIELDS = eventMatchFieldsSchema.parse({
+  projectId: {
+    kind: "string",
+    description: "Vercel project id, such as prj_abc123",
+    events: [...VERCEL_DEPLOYMENT_EVENTS]
+  },
+  deploymentId: {
+    kind: "string",
+    description: "Vercel deployment id, such as dpl_abc123",
+    events: [...VERCEL_DEPLOYMENT_EVENTS]
+  },
+  target: {
+    kind: "string",
+    description: "where Vercel deployed: preview, production, or staging",
+    enum: [...VERCEL_DEPLOYMENT_TARGETS],
+    events: [...VERCEL_DEPLOYMENT_EVENTS]
+  },
+  commitSha: {
+    kind: "string",
+    description: "full lowercase Git commit SHA of the deployment, when it came from a Git commit",
+    events: [...VERCEL_DEPLOYMENT_EVENTS]
+  }
+});
 function vercelDeploymentResource(input) {
-  const commitSha2 = input.commitSha?.toLowerCase();
+  const commitSha = input.commitSha?.toLowerCase();
   const target = input.target;
   const parts = [input.projectId];
   if (target) parts.push(target);
-  if (commitSha2) parts.push(commitSha2);
+  if (commitSha) parts.push(commitSha);
   let label;
-  if (target && commitSha2) {
-    label = `Vercel ${target} deployment for ${input.projectId} at ${commitSha2.slice(0, 12)}`;
+  if (target && commitSha) {
+    label = `Vercel ${target} deployment for ${input.projectId} at ${commitSha.slice(0, 12)}`;
   } else if (target) {
     label = `Vercel ${target} deployments for ${input.projectId}`;
   } else {
@@ -30,7 +61,7 @@ function vercelDeploymentResource(input) {
   };
 }
 function vercelDeploymentSubscribable(input) {
-  if (!input.webhookSecret) return void 0;
+  if (!input.canSubscribe) return void 0;
   if (input.commitSha && !input.target) return void 0;
   return {
     ...vercelDeploymentResource(input),
@@ -40,11 +71,6 @@ function vercelDeploymentSubscribable(input) {
   };
 }
 
-// src/webhooks/secret.ts
-function vercelWebhookSecret() {
-  return process.env.VERCEL_WEBHOOK_SECRET?.trim() || void 0;
-}
-
 // src/tools/deployment.ts
 import {
   definePluginTool,
@@ -127,17 +153,17 @@ function createVercelDeploymentTool(ctx) {
         throw new Error(message);
       }
       const projectId = z2.object({ id: vercelProjectIdSchema }).parse(parsed).id;
-      const commitSha2 = input.commitSha?.toLowerCase();
-      const deploymentTarget2 = input.target ?? (commitSha2 ? "production" : void 0);
-      const subscribable = ctx.events.canSubscribe ? vercelDeploymentSubscribable({
-        commitSha: commitSha2,
+      const commitSha = input.commitSha?.toLowerCase();
+      const deploymentTarget = input.target ?? (commitSha ? "production" : void 0);
+      const subscribable = vercelDeploymentSubscribable({
+        canSubscribe: ctx.events.canSubscribe,
+        commitSha,
         projectId,
-        target: deploymentTarget2,
-        webhookSecret: vercelWebhookSecret()
-      }) : void 0;
+        target: deploymentTarget
+      });
       const data = {
-        commitSha: commitSha2 ?? null,
-        deploymentTarget: deploymentTarget2 ?? null,
+        commitSha: commitSha ?? null,
+        deploymentTarget: deploymentTarget ?? null,
         projectId,
         ...subscribable ? { subscribable } : void 0
       };
@@ -152,50 +178,49 @@ function createVercelDeploymentTool(ctx) {
 // src/webhooks/events.ts
 import { z as z3 } from "zod";
 var deploymentIdSchema = z3.string().regex(/^dpl_[A-Za-z0-9]+$/);
-var commitShaSchema2 = z3.string().regex(/^[0-9a-f]{40}$/i);
+var commitShaSchema2 = z3.string().regex(/^[0-9a-f]{40}$/i).transform((sha) => sha.toLowerCase());
+var deploymentTargetSchema = z3.string().nullable().transform((target) => target ?? "preview").pipe(z3.enum(VERCEL_DEPLOYMENT_TARGETS));
+var metaCommitShaSchema = commitShaSchema2.optional().catch(void 0);
+var deploymentMetaSchema = z3.object({
+  githubCommitSha: metaCommitShaSchema,
+  gitlabCommitSha: metaCommitShaSchema,
+  bitbucketCommitSha: metaCommitShaSchema,
+  gitCommitSha: metaCommitShaSchema
+}).transform((meta) => ({
+  commitSha: meta.githubCommitSha ?? meta.gitlabCommitSha ?? meta.bitbucketCommitSha ?? meta.gitCommitSha
+}));
 var webhookEnvelopeSchema = z3.object({
   createdAt: z3.number().finite(),
   id: z3.string().min(1),
   payload: z3.unknown(),
-  type: z3.string().min(1)
+  type: z3.enum(VERCEL_DEPLOYMENT_EVENTS)
 });
 var deploymentPayloadSchema = z3.object({
   deployment: z3.object({
     id: deploymentIdSchema,
-    meta: z3.record(z3.string(), z3.unknown())
+    meta: deploymentMetaSchema
   }),
   project: z3.object({
     id: vercelProjectIdSchema
   }),
-  target: z3.string().nullable()
+  target: deploymentTargetSchema
 }).transform((payload) => ({
-  commitSha: commitSha(payload.deployment.meta),
+  commitSha: payload.deployment.meta.commitSha,
   deploymentId: payload.deployment.id,
   projectId: payload.project.id,
-  target: deploymentTarget(payload.target)
+  target: payload.target
 }));
-function deploymentTarget(value) {
-  if (value === null) return "preview";
-  if (value === "production" || value === "staging") return value;
-  return void 0;
-}
-function commitSha(meta) {
-  for (const key of [
-    "githubCommitSha",
-    "gitlabCommitSha",
-    "bitbucketCommitSha",
-    "gitCommitSha"
-  ]) {
-    const parsed = commitShaSchema2.safeParse(meta[key]);
-    if (parsed.success) return parsed.data.toLowerCase();
-  }
-  return void 0;
-}
-function isDeploymentEvent(value) {
-  return VERCEL_DEPLOYMENT_EVENTS.includes(
-    value
-  );
-}
+var deploymentEventDataSchema = z3.object({
+  projectId: vercelProjectIdSchema,
+  deploymentId: deploymentIdSchema,
+  target: z3.enum(VERCEL_DEPLOYMENT_TARGETS),
+  commitSha: commitShaSchema2.optional()
+}).strict();
+var DEPLOYMENT_OUTCOMES = {
+  "deployment.succeeded": "succeeded",
+  "deployment.error": "failed",
+  "deployment.canceled": "was canceled"
+};
 function deploymentTargets(input) {
   const targets = [
     {
@@ -226,33 +251,29 @@ function deploymentTargets(input) {
 }
 function normalizeVercelEvents(args) {
   const envelope = webhookEnvelopeSchema.safeParse(args.body);
-  if (!envelope.success || !isDeploymentEvent(envelope.data.type)) return [];
+  if (!envelope.success) return [];
   const payload = deploymentPayloadSchema.safeParse(envelope.data.payload);
   if (!payload.success) return [];
-  const target = payload.data.target;
-  if (!target) return [];
   const eventType = envelope.data.type;
-  const deploymentId = payload.data.deploymentId;
-  const outcome = eventType === "deployment.succeeded" ? "succeeded" : eventType === "deployment.error" ? "failed" : "was canceled";
-  const untrustedParts = [
-    `Target: ${target}`,
-    payload.data.commitSha ? `Commit: ${payload.data.commitSha}` : void 0,
-    `Deployment: ${deploymentId}`
-  ].filter((part) => part !== void 0);
-  const untrustedText = untrustedParts.join("\n");
-  return deploymentTargets({
-    commitSha: payload.data.commitSha,
-    projectId: payload.data.projectId,
-    target
-  }).map(({ completeOnTerminalEvent, resource }) => ({
-    eventKey: `vercel:${envelope.data.id}:${eventType}`,
-    eventType,
-    occurredAtMs: envelope.data.createdAt,
-    identifier: resource.identifier,
-    ...completeOnTerminalEvent ? { terminal: true } : void 0,
-    trustedSummary: `${resource.label} (${deploymentId}) ${outcome}.`,
-    untrustedText
-  }));
+  const { commitSha, deploymentId, projectId, target } = payload.data;
+  const data = deploymentEventDataSchema.parse({
+    projectId,
+    deploymentId,
+    target,
+    ...commitSha ? { commitSha } : void 0
+  });
+  return deploymentTargets({ commitSha, projectId, target }).map(
+    ({ completeOnTerminalEvent, resource }) => ({
+      data,
+      eventKey: `vercel:${envelope.data.id}:${eventType}`,
+      eventType,
+      identifier: resource.identifier,
+      objectType: "deployment",
+      occurredAtMs: envelope.data.createdAt,
+      ...completeOnTerminalEvent ? { terminal: true } : void 0,
+      trustedSummary: `${resource.label} (${deploymentId}) ${DEPLOYMENT_OUTCOMES[eventType]}.`
+    })
+  );
 }
 
 // src/webhooks/handler.ts
@@ -288,7 +309,7 @@ function createVercelWebhookRoute(args) {
       }
       const events = normalizeVercelEvents({ body });
       for (const event of events) {
-        await args.events.publish({ ...event, objectType: "deployment" });
+        await args.events.publish(event);
       }
       return new Response(events.length ? "Accepted" : "Ignored", {
         status: 202
@@ -300,7 +321,7 @@ function createVercelWebhookRoute(args) {
 export {
   VERCEL_DEPLOYMENT_EVENTS,
   VERCEL_DEPLOYMENT_SUGGESTED_EVENTS,
-  vercelWebhookSecret,
+  VERCEL_DEPLOYMENT_MATCH_FIELDS,
   createVercelDeploymentTool,
   normalizeVercelEvents,
   createVercelWebhookRoute

package/dist/events/deployment.d.ts

@@ -1,17 +1,36 @@
-import type { SubscribableResource } from "@sentry/junior-plugin-api";
+import { type SubscribableResource } from "@sentry/junior-plugin-api";
 export declare const VERCEL_DEPLOYMENT_EVENTS: readonly ["deployment.succeeded", "deployment.error", "deployment.canceled"];
 export declare const VERCEL_DEPLOYMENT_SUGGESTED_EVENTS: string[];
-export type VercelDeploymentTarget = "preview" | "production" | "staging";
+/** The deployment targets that Vercel webhooks report. */
+export declare const VERCEL_DEPLOYMENT_TARGETS: readonly ["preview", "production", "staging"];
+export type VercelDeploymentTarget = (typeof VERCEL_DEPLOYMENT_TARGETS)[number];
+/**
+ * Trusted values that every Vercel deployment event sets. `commitSha` is left
+ * out when the deployment has no Git commit, so a filter on it does not match.
+ * Vercel ids keep the case that Vercel sends, the same as identifiers,
+ * because they are case-sensitive.
+ */
+export declare const VERCEL_DEPLOYMENT_MATCH_FIELDS: Record<string, {
+    kind: "boolean" | "number" | "string";
+    description: string;
+    enum?: string[] | undefined;
+    list?: true | undefined;
+    events?: string[] | undefined;
+}>;
 /** Build the stable deployment identity shared by tools and webhooks. */
 export declare function vercelDeploymentResource(input: {
     commitSha?: string;
     projectId: string;
     target?: VercelDeploymentTarget;
 }): Pick<SubscribableResource, "label" | "namespace" | "identifier">;
-/** Describe a deployment resource when signed Vercel webhooks are enabled. */
+/**
+ * Describe a deployment resource that a conversation can watch.
+ * Return undefined when the host cannot create Watches.
+ */
 export declare function vercelDeploymentSubscribable(input: {
+    /** `ctx.events.canSubscribe` from the tool context. */
+    canSubscribe: boolean;
     commitSha?: string;
     projectId: string;
     target?: VercelDeploymentTarget;
-    webhookSecret?: string;
 }): SubscribableResource | undefined;

package/dist/index.js

@@ -1,10 +1,10 @@
 import {
   VERCEL_DEPLOYMENT_EVENTS,
+  VERCEL_DEPLOYMENT_MATCH_FIELDS,
   VERCEL_DEPLOYMENT_SUGGESTED_EVENTS,
   createVercelDeploymentTool,
-  createVercelWebhookRoute,
-  vercelWebhookSecret
-} from "./chunk-VXKYUJID.js";
+  createVercelWebhookRoute
+} from "./chunk-CUJQR3FA.js";
 
 // src/index.ts
 import {
@@ -289,6 +289,11 @@ function createVercelActionTools(ctx) {
   };
 }
 
+// src/webhooks/secret.ts
+function vercelWebhookSecret() {
+  return process.env.VERCEL_WEBHOOK_SECRET?.trim() || void 0;
+}
+
 // src/index.ts
 function vercelPlugin() {
   return defineJuniorPlugin({
@@ -298,7 +303,8 @@ function vercelPlugin() {
         {
           type: "deployment",
           supportedEvents: [...VERCEL_DEPLOYMENT_EVENTS],
-          suggestedEvents: [...VERCEL_DEPLOYMENT_SUGGESTED_EVENTS]
+          suggestedEvents: [...VERCEL_DEPLOYMENT_SUGGESTED_EVENTS],
+          matchFields: VERCEL_DEPLOYMENT_MATCH_FIELDS
         }
       ],
       isEnabled: () => Boolean(vercelWebhookSecret())

package/dist/testing.js

@@ -2,7 +2,7 @@ import {
   createVercelDeploymentTool,
   createVercelWebhookRoute,
   normalizeVercelEvents
-} from "./chunk-VXKYUJID.js";
+} from "./chunk-CUJQR3FA.js";
 export {
   createVercelDeploymentTool,
   createVercelWebhookRoute,

package/dist/webhooks/events.d.ts

@@ -5,7 +5,10 @@
  * and emits canonical events for project, target, and commit watches.
  */
 import type { EventInput } from "@sentry/junior-plugin-api";
-/** Normalize one verified Vercel delivery into deployment events. */
+/**
+ * Normalize one verified Vercel delivery into deployment events. Target,
+ * commit, and deployment id come from Vercel, so they go in trusted data.
+ */
 export declare function normalizeVercelEvents(args: {
     body: unknown;
 }): EventInput[];

package/dist/webhooks/secret.d.ts

@@ -1,2 +1,2 @@
-/** Read the normalized secret shared by watch creation and webhook ingress. */
+/** Read the normalized secret shared by plugin enablement and webhook ingress. */
 export declare function vercelWebhookSecret(): string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-vercel",
-  "version": "0.264.0",
+  "version": "0.266.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "zod": "^4.5.4",
-    "@sentry/junior-plugin-api": "0.264.0"
+    "@sentry/junior-plugin-api": "0.266.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.79.0",
@@ -35,7 +35,8 @@
     "oxlint": "^1.79.0",
     "tsup": "^8.5.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.12"
+    "vitest": "^4.1.12",
+    "@sentry/junior-testing": "0.0.0"
   },
   "scripts": {
     "build": "tsup && tsc -p tsconfig.build.json --emitDeclarationOnly",