@breadstone-infrastructure/nx-tasks 0.0.231 → 0.0.232

package/executors/secrets-vercel-sync/executor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.js","sourceRoot":"","sources":["../../../src/executors/secrets-vercel-sync/executor.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAalB,8BA8BC;AAxCD,+DAA4D;AAG5D,aAAa;AAEb;;;;GAIG;AACY,KAAK,UAAU,WAAW,CAAC,OAAyC,EAAE,OAAwB;IACzG,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,wDAAa,iBAAiB,GAAC,CAAC,CAAC,qBAAqB,CAAC;QAErE,MAAM,IAAI,CAAC,GAAG,CAAC;YACX,GAAG,EAAE,IAAA,+BAAc,EAAC,OAAO,CAAC;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;YAC1C,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;SACnC,CAAC,CAAC;QAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAErB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;AACL,CAAC"}

package/executors/secrets-vercel-sync/executor.options.d.ts

@@ -0,0 +1,8 @@
+import type { SecretsVercelSyncTask } from './executor.task';
+/**
+ * Executor options for the secrets-vercel-sync executor.
+ *
+ * @public
+ */
+export type SecretsVercelSyncExecutorOptions = Omit<SecretsVercelSyncTask.ISecretsVercelSyncTaskOptions, 'cwd'>;
+//# sourceMappingURL=executor.options.d.ts.map

package/executors/secrets-vercel-sync/executor.options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.options.d.ts","sourceRoot":"","sources":["../../../src/executors/secrets-vercel-sync/executor.options.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAI7D;;;;GAIG;AACH,MAAM,MAAM,gCAAgC,GAAG,IAAI,CAAC,qBAAqB,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC"}

package/executors/secrets-vercel-sync/executor.options.js

@@ -0,0 +1,4 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=executor.options.js.map

package/executors/secrets-vercel-sync/executor.options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.options.js","sourceRoot":"","sources":["../../../src/executors/secrets-vercel-sync/executor.options.ts"],"names":[],"mappings":";AAAA,kBAAkB"}

package/executors/secrets-vercel-sync/executor.task.d.ts

@@ -0,0 +1,34 @@
+import type { SecretsProviderType } from './providers/secrets-provider.factory';
+export declare namespace SecretsVercelSyncTask {
+    const VALID_VERCEL_ENVIRONMENTS: readonly ["development", "preview", "production"];
+    const VALID_VERCEL_VARIABLE_TYPES: readonly ["encrypted", "sensitive"];
+    const VALID_CONFLICT_STRATEGIES: readonly ["none", "prefer-source", "prefer-vercel"];
+    type VercelEnvironment = typeof VALID_VERCEL_ENVIRONMENTS[number];
+    type VercelVariableType = typeof VALID_VERCEL_VARIABLE_TYPES[number];
+    type ConflictStrategy = typeof VALID_CONFLICT_STRATEGIES[number];
+    export interface ISecretsVercelSyncTaskOptions {
+        cwd: string;
+        provider: SecretsProviderType;
+        secretsProject: string;
+        secretsConfig: string;
+        vaultUrl?: string;
+        apiKey?: string;
+        vercelTeam: string;
+        vercelProject: string;
+        vercelEnvironment: VercelEnvironment;
+        vercelVariableType?: VercelVariableType;
+        conflictStrategy?: ConflictStrategy;
+        dryRun?: boolean;
+        deleteMissing?: boolean;
+        includeKeys?: Array<string>;
+        excludeKeys?: Array<string>;
+        redeploy?: boolean;
+        interactive?: boolean;
+    }
+    /**
+     * Executes the Secrets Provider -> Vercel sync.
+     */
+    export function run(options: ISecretsVercelSyncTaskOptions): Promise<void>;
+    export {};
+}
+//# sourceMappingURL=executor.task.d.ts.map

package/executors/secrets-vercel-sync/executor.task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.task.d.ts","sourceRoot":"","sources":["../../../src/executors/secrets-vercel-sync/executor.task.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sCAAsC,CAAC;AAKhF,yBAAiB,qBAAqB,CAAC;IAMnC,MAAM,yBAAyB,mDAAoD,CAAC;IAEpF,MAAM,2BAA2B,qCAAsC,CAAC;IAExE,MAAM,yBAAyB,qDAAsD,CAAC;IAgBtF,KAAK,iBAAiB,GAAG,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAElE,KAAK,kBAAkB,GAAG,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAErE,KAAK,gBAAgB,GAAG,OAAO,yBAAyB,CAAC,MAAM,CAAC,CAAC;IAQjE,MAAM,WAAW,6BAA6B;QAC1C,GAAG,EAAE,MAAM,CAAC;QACZ,QAAQ,EAAE,mBAAmB,CAAC;QAC9B,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,iBAAiB,CAAC;QACrC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;QACxC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;QACpC,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,OAAO,CAAC;QACxB,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,WAAW,CAAC,EAAE,OAAO,CAAC;KACzB;IAqhBD;;OAEG;IACH,gBAAsB,GAAG,CAAC,OAAO,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CA2F/E;;CAIJ"}

package/executors/secrets-vercel-sync/executor.task.js

@@ -0,0 +1,492 @@
+"use strict";
+// #region Imports
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsVercelSyncTask = void 0;
+const utilities_1 = require("@breadstone-infrastructure/utilities");
+const enquirer_1 = require("enquirer");
+const secrets_provider_factory_1 = require("./providers/secrets-provider.factory");
+// #endregion
+var SecretsVercelSyncTask;
+(function (SecretsVercelSyncTask) {
+    // #region Constants
+    const VERCEL_API_BASE = 'https://api.vercel.com';
+    const VALID_VERCEL_ENVIRONMENTS = ['development', 'preview', 'production'];
+    const VALID_VERCEL_VARIABLE_TYPES = ['encrypted', 'sensitive'];
+    const VALID_CONFLICT_STRATEGIES = ['none', 'prefer-source', 'prefer-vercel'];
+    /**
+     * Expected semantic mapping: secrets config -> Vercel environment.
+     */
+    const STAGE_MAPPING = {
+        dev: 'development',
+        prev: 'preview',
+        stage: 'preview',
+        prod: 'production'
+    };
+    // #endregion
+    // #region Validation
+    /**
+     * Validates all options before execution.
+     */
+    function validate(options) {
+        const variableType = options.vercelVariableType ?? 'encrypted';
+        const conflictStrategy = options.conflictStrategy ?? 'prefer-source';
+        if (!VALID_VERCEL_ENVIRONMENTS.includes(options.vercelEnvironment)) {
+            throw new Error(`Invalid vercelEnvironment "${options.vercelEnvironment}". Allowed: ${VALID_VERCEL_ENVIRONMENTS.join(', ')}`);
+        }
+        if (!VALID_VERCEL_VARIABLE_TYPES.includes(variableType)) {
+            throw new Error(`Invalid vercelVariableType "${variableType}". Allowed: ${VALID_VERCEL_VARIABLE_TYPES.join(', ')}`);
+        }
+        if (!VALID_CONFLICT_STRATEGIES.includes(conflictStrategy)) {
+            throw new Error(`Invalid conflictStrategy "${conflictStrategy}". Allowed: ${VALID_CONFLICT_STRATEGIES.join(', ')}`);
+        }
+        if (variableType === 'sensitive' && options.vercelEnvironment === 'development') {
+            throw new Error('vercelVariableType "sensitive" is not allowed for vercelEnvironment "development". Vercel does not support sensitive variables in development.');
+        }
+        validateStageMapping(options.secretsConfig, options.vercelEnvironment);
+        if (options.includeKeys && options.excludeKeys) {
+            const overlap = options.includeKeys.filter(key => options.excludeKeys.includes(key));
+            if (overlap.length > 0) {
+                throw new Error(`includeKeys and excludeKeys overlap on: ${overlap.join(', ')}. Remove duplicates.`);
+            }
+        }
+        if (options.provider === 'azure-keyvault' && !options.vaultUrl) {
+            throw new Error('vaultUrl is required when provider is azure-keyvault.');
+        }
+    }
+    /**
+     * Validates that the secrets config and Vercel environment follow the expected semantic mapping.
+     */
+    function validateStageMapping(secretsConfig, vercelEnvironment) {
+        const expectedEnvironment = STAGE_MAPPING[secretsConfig];
+        if (expectedEnvironment && expectedEnvironment !== vercelEnvironment) {
+            throw new Error(`Semantic stage mismatch: secrets config "${secretsConfig}" is expected to map to Vercel environment "${expectedEnvironment}", but "${vercelEnvironment}" was configured. ` +
+                `If this is intentional, review the configuration carefully.`);
+        }
+    }
+    // #endregion
+    // #region Vercel API
+    /**
+     * Prompts the user for a token via interactive terminal input.
+     */
+    async function promptForToken(label, hint) {
+        const credentials = await (0, enquirer_1.prompt)([
+            {
+                type: 'input',
+                name: 'token',
+                message: `Enter your ${label}:\n${hint}`
+            }
+        ]);
+        if (!credentials.token) {
+            throw new Error(`No ${label} provided. Aborting.`);
+        }
+        return credentials.token;
+    }
+    /**
+     * Resolves the Vercel API token from the VERCEL_TOKEN environment variable.
+     * Falls back to interactive prompt if interactive mode is enabled.
+     */
+    async function resolveVercelToken(interactive) {
+        const token = process.env['VERCEL_TOKEN'];
+        if (token) {
+            return token;
+        }
+        if (interactive) {
+            return promptForToken('Vercel API token', 'You can create one at https://vercel.com/account/tokens.');
+        }
+        throw new Error('VERCEL_TOKEN environment variable is not set. Set it to a Vercel API token, or enable interactive mode.');
+    }
+    /**
+     * Builds the query string for Vercel team scoping.
+     */
+    function buildVercelTeamQuery(team) {
+        return team.startsWith('team_')
+            ? `teamId=${encodeURIComponent(team)}`
+            : `slug=${encodeURIComponent(team)}`;
+    }
+    /**
+     * Heuristically detects whether the values returned by Vercel are still ciphertext despite a
+     * successful `?decrypt=true` request. Vercel silently returns ciphertext when the calling token
+     * lacks decryption permission (no error). Ciphertext is invariably long (>=100 chars) and limited
+     * to base64url charset. If most encrypted-typed values match this profile, we treat the fetch as
+     * non-decrypted.
+     */
+    function detectCiphertext(envs) {
+        const candidates = envs.filter(e => e.type === 'encrypted' && typeof e.value === 'string' && e.value.length > 0);
+        if (candidates.length === 0) {
+            return false;
+        }
+        const base64UrlOnly = /^[A-Za-z0-9+/=_-]+$/;
+        let suspicious = 0;
+        for (const env of candidates) {
+            if (env.value.length >= 100 && base64UrlOnly.test(env.value)) {
+                suspicious++;
+            }
+        }
+        // If a clear majority looks like ciphertext, assume decryption did not happen.
+        return suspicious / candidates.length >= 0.5;
+    }
+    /**
+     * Fetches existing environment variables from a Vercel project.
+     *
+     * Attempts to retrieve decrypted values when `requestDecrypt` is true. If Vercel rejects the
+     * decrypt request (e.g. token lacks scope, or the variable type does not support decryption),
+     * the request is retried without `decrypt=true` and `decrypted` is reported as `false`.
+     *
+     * Note: Vercel may also silently return ciphertext when `?decrypt=true` is sent with a token
+     * that lacks decryption scope (no HTTP error). In that case `decrypted` is also reported as
+     * `false` based on a content heuristic ({@link detectCiphertext}).
+     */
+    async function fetchVercelEnvVars(token, project, team, requestDecrypt, logger) {
+        const teamQuery = buildVercelTeamQuery(team);
+        const baseUrl = `${VERCEL_API_BASE}/v9/projects/${encodeURIComponent(project)}/env?${teamQuery}`;
+        if (requestDecrypt) {
+            try {
+                const envs = await fetchAllVercelEnvPages(token, `${baseUrl}&decrypt=true`);
+                const stillCiphertext = detectCiphertext(envs);
+                if (stillCiphertext) {
+                    logger.warn('  Vercel returned ciphertext despite decrypt=true (token likely lacks decryption scope).');
+                    return { envs, decrypted: false };
+                }
+                logger.log(`  Fetched ${envs.length} env vars from Vercel [${project}] (decrypted).`);
+                return { envs, decrypted: true };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                logger.warn(`  Decrypted fetch failed (${message}). Falling back to non-decrypted fetch.`);
+            }
+        }
+        const envs = await fetchAllVercelEnvPages(token, baseUrl);
+        logger.log(`  Fetched ${envs.length} env vars from Vercel [${project}] (values not comparable).`);
+        return { envs, decrypted: false };
+    }
+    /**
+     * Pages through all Vercel env vars for the given list URL.
+     */
+    async function fetchAllVercelEnvPages(token, listUrl) {
+        const allEnvVars = [];
+        let nextUrl = listUrl;
+        while (nextUrl) {
+            const response = await fetch(nextUrl, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+            if (!response.ok) {
+                throw new Error(`Failed to fetch Vercel env vars (HTTP ${response.status}): ${response.statusText}`);
+            }
+            const data = await response.json();
+            allEnvVars.push(...data.envs);
+            if (data.pagination?.next) {
+                nextUrl = `${listUrl}&until=${data.pagination.next}`;
+            }
+            else {
+                nextUrl = undefined;
+            }
+        }
+        return allEnvVars;
+    }
+    /**
+     * Creates a new environment variable in Vercel.
+     */
+    async function createVercelEnvVar(token, project, team, key, value, target, type) {
+        const teamQuery = buildVercelTeamQuery(team);
+        const url = `${VERCEL_API_BASE}/v10/projects/${encodeURIComponent(project)}/env?${teamQuery}`;
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                key,
+                value,
+                target: [target],
+                type
+            })
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Failed to create Vercel env var "${key}" (HTTP ${response.status}): ${body}`);
+        }
+    }
+    /**
+     * Updates an existing environment variable in Vercel.
+     */
+    async function updateVercelEnvVar(token, project, team, envVarId, key, value, target, type) {
+        const teamQuery = buildVercelTeamQuery(team);
+        const url = `${VERCEL_API_BASE}/v9/projects/${encodeURIComponent(project)}/env/${encodeURIComponent(envVarId)}?${teamQuery}`;
+        const response = await fetch(url, {
+            method: 'PATCH',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                value,
+                target: [target],
+                type
+            })
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Failed to update Vercel env var "${key}" (HTTP ${response.status}): ${body}`);
+        }
+    }
+    /**
+     * Deletes an environment variable from Vercel.
+     */
+    async function deleteVercelEnvVar(token, project, team, envVarId, key) {
+        const teamQuery = buildVercelTeamQuery(team);
+        const url = `${VERCEL_API_BASE}/v9/projects/${encodeURIComponent(project)}/env/${encodeURIComponent(envVarId)}?${teamQuery}`;
+        const response = await fetch(url, {
+            method: 'DELETE',
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Failed to delete Vercel env var "${key}" (HTTP ${response.status}): ${body}`);
+        }
+    }
+    /**
+     * Triggers a redeployment of the latest deployment in the given Vercel project and environment.
+     */
+    async function triggerRedeploy(token, project, team, target, logger) {
+        const teamQuery = buildVercelTeamQuery(team);
+        const listUrl = `${VERCEL_API_BASE}/v6/deployments?projectId=${encodeURIComponent(project)}&${teamQuery}&target=${encodeURIComponent(target)}&limit=1`;
+        const listResponse = await fetch(listUrl, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        if (!listResponse.ok) {
+            logger.warn(`  Could not list deployments for redeploy (HTTP ${listResponse.status}). Skipping redeploy.`);
+            return;
+        }
+        const listData = await listResponse.json();
+        if (!listData.deployments || listData.deployments.length === 0) {
+            logger.warn(`  No deployment found for target "${target}". Skipping redeploy.`);
+            return;
+        }
+        const deploymentId = listData.deployments[0].uid;
+        const redeployUrl = `${VERCEL_API_BASE}/v13/deployments?${teamQuery}&forceNew=1`;
+        const redeployResponse = await fetch(redeployUrl, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                name: project,
+                deploymentId,
+                target
+            })
+        });
+        if (!redeployResponse.ok) {
+            const body = await redeployResponse.text();
+            logger.warn(`  Redeploy failed (HTTP ${redeployResponse.status}): ${body}`);
+            return;
+        }
+        logger.log(`  Triggered redeployment for "${target}".`);
+    }
+    // #endregion
+    // #region Filtering
+    /**
+     * Applies includeKeys and excludeKeys filters to the given secrets map.
+     */
+    function applyKeyFilters(secrets, includeKeys, excludeKeys) {
+        let keys = Object.keys(secrets);
+        if (includeKeys && includeKeys.length > 0) {
+            const includeSet = new Set(includeKeys);
+            keys = keys.filter(key => includeSet.has(key));
+        }
+        if (excludeKeys && excludeKeys.length > 0) {
+            const excludeSet = new Set(excludeKeys);
+            keys = keys.filter(key => !excludeSet.has(key));
+        }
+        return Object.fromEntries(keys.map(key => [key, secrets[key]]));
+    }
+    // #endregion
+    // #region Diff & Sync
+    /**
+     * Computes the diff between source secrets and existing Vercel env vars for a given environment.
+     *
+     * When `valuesComparable` is `false`, value equality cannot be verified (encrypted/sensitive variables
+     * whose decrypted form was not retrievable). To guarantee Vercel always reflects the latest source state,
+     * existing keys are then emitted as `forced` (and will be patched) under `prefer-source`. Under
+     * `prefer-vercel` or `none` the key is `skipped` to honor user intent.
+     */
+    function computeDiff(sourceSecrets, vercelVars, environment, conflictStrategy, deleteMissing, valuesComparable) {
+        const results = [];
+        // Index vercel vars for this environment by key
+        const vercelByKey = new Map();
+        for (const envVar of vercelVars) {
+            if (envVar.target.includes(environment)) {
+                vercelByKey.set(envVar.key, envVar);
+            }
+        }
+        // Process all source keys
+        for (const [key, value] of Object.entries(sourceSecrets)) {
+            const existing = vercelByKey.get(key);
+            if (!existing) {
+                // Key does not exist in Vercel -> add
+                results.push({ key, action: 'added', value });
+                continue;
+            }
+            if (!valuesComparable) {
+                // Cannot compare values (encrypted without decrypt or sensitive).
+                // To guarantee Vercel = source, force a patch under prefer-source.
+                switch (conflictStrategy) {
+                    case 'prefer-source':
+                        results.push({ key, action: 'forced', vercelId: existing.id, value });
+                        break;
+                    case 'prefer-vercel':
+                    case 'none':
+                        results.push({ key, action: 'skipped', vercelId: existing.id });
+                        break;
+                }
+                continue;
+            }
+            if (existing.value === value) {
+                // Value is unchanged
+                results.push({ key, action: 'unchanged', vercelId: existing.id });
+            }
+            else {
+                // Conflict: value differs
+                switch (conflictStrategy) {
+                    case 'prefer-source':
+                        results.push({ key, action: 'updated', vercelId: existing.id, value });
+                        break;
+                    case 'prefer-vercel':
+                        results.push({ key, action: 'skipped', vercelId: existing.id });
+                        break;
+                    case 'none':
+                        results.push({ key, action: 'skipped', vercelId: existing.id });
+                        break;
+                }
+            }
+        }
+        // Keys in Vercel but not in source
+        if (deleteMissing) {
+            for (const [key, envVar] of vercelByKey) {
+                if (!(key in sourceSecrets)) {
+                    results.push({ key, action: 'deleted', vercelId: envVar.id });
+                }
+            }
+        }
+        return results;
+    }
+    // #endregion
+    // #region Logging
+    /**
+     * Returns a colored tag string for the given sync action.
+     */
+    function formatActionTag(action, dryRun) {
+        const prefix = dryRun ? 'DRY RUN: ' : '';
+        switch (action) {
+            case 'added':
+                return (0, utilities_1.green)((0, utilities_1.bold)(`[${prefix}added]`));
+            case 'updated':
+                return (0, utilities_1.yellow)((0, utilities_1.bold)(`[${prefix}updated]`));
+            case 'forced':
+                return (0, utilities_1.cyan)((0, utilities_1.bold)(`[${prefix}forced]`));
+            case 'unchanged':
+                return (0, utilities_1.gray)((0, utilities_1.bold)('[unchanged]'));
+            case 'skipped':
+                return (0, utilities_1.magenta)((0, utilities_1.bold)('[skipped]'));
+            case 'deleted':
+                return (0, utilities_1.red)((0, utilities_1.bold)(`[${prefix}deleted]`));
+        }
+    }
+    /**
+     * Logs the sync results as a single alphabetically sorted tree with colored action tags.
+     */
+    function logResults(logger, results, dryRun) {
+        const sorted = [...results].sort((a, b) => a.key.localeCompare(b.key));
+        (0, utilities_1.logTree)(logger, `Keys (${sorted.length})`, sorted.map(r => ({
+            label: `${r.key} ${formatActionTag(r.action, dryRun)}`
+        })));
+    }
+    // #endregion
+    // #region Main Task
+    /**
+     * Executes the Secrets Provider -> Vercel sync.
+     */
+    async function run(options) {
+        const logger = new utilities_1.ConsoleLogger();
+        const providerType = options.provider ?? 'doppler';
+        const variableType = options.vercelVariableType ?? 'encrypted';
+        const conflictStrategy = options.conflictStrategy ?? 'prefer-source';
+        const dryRun = options.dryRun ?? false;
+        const deleteMissing = options.deleteMissing ?? false;
+        const interactive = options.interactive ?? false;
+        (0, utilities_1.logSeparator)(logger, `${providerType} → Vercel Sync`);
+        // Step 1: Validate
+        logger.log('Validating options...');
+        validate(options);
+        (0, utilities_1.logBanner)(logger, 'info', {
+            message: `${options.secretsProject}/${options.secretsConfig} → ${options.vercelProject}/${options.vercelEnvironment}`,
+            details: `Provider: ${providerType} | Type: ${variableType} | Strategy: ${conflictStrategy} | Dry Run: ${dryRun} | Delete Missing: ${deleteMissing}`
+        });
+        // Step 2: Resolve tokens
+        const secretsProvider = (0, secrets_provider_factory_1.createSecretsProvider)(providerType);
+        const secretsToken = await secretsProvider.authenticate(options.apiKey, interactive);
+        const vercelToken = await resolveVercelToken(interactive);
+        // Step 3: Fetch secrets from the provider
+        logger.log(`Fetching secrets from ${providerType}...`);
+        let sourceSecrets = await secretsProvider.fetchSecrets(secretsToken, options.secretsProject, options.secretsConfig, logger, options.vaultUrl);
+        // Step 4: Apply key filters
+        sourceSecrets = applyKeyFilters(sourceSecrets, options.includeKeys, options.excludeKeys);
+        logger.log(`  ${Object.keys(sourceSecrets).length} keys after filtering.`);
+        // Step 5: Fetch Vercel env vars (request decryption only for encrypted type;
+        // sensitive values are never returned by the Vercel API regardless of decrypt=true).
+        logger.log('Fetching Vercel environment variables...');
+        const requestDecrypt = variableType === 'encrypted';
+        const vercelFetch = await fetchVercelEnvVars(vercelToken, options.vercelProject, options.vercelTeam, requestDecrypt, logger);
+        const valuesComparable = vercelFetch.decrypted;
+        if (!valuesComparable) {
+            const reason = variableType === 'sensitive'
+                ? 'Vercel never returns values for "sensitive" variables.'
+                : 'Decrypted fetch was not available (token scope or API restriction).';
+            (0, utilities_1.logBanner)(logger, 'warning', {
+                message: 'Value comparison disabled.',
+                details: `${reason} Existing keys will be force-patched under "prefer-source" to guarantee Vercel mirrors the secrets provider. Use "prefer-vercel" or "none" to skip instead.`
+            });
+        }
+        // Step 6: Compute diff
+        logger.log('Computing diff...');
+        const diff = computeDiff(sourceSecrets, vercelFetch.envs, options.vercelEnvironment, conflictStrategy, deleteMissing, valuesComparable);
+        (0, utilities_1.logEmptyLine)(logger);
+        // Step 7: Apply changes (or dry-run report)
+        if (dryRun) {
+            (0, utilities_1.logBanner)(logger, 'warning', 'DRY RUN - no changes will be written to Vercel.');
+            logResults(logger, diff, true);
+        }
+        else {
+            for (const entry of diff) {
+                switch (entry.action) {
+                    case 'added':
+                        await createVercelEnvVar(vercelToken, options.vercelProject, options.vercelTeam, entry.key, entry.value, options.vercelEnvironment, variableType);
+                        break;
+                    case 'updated':
+                    case 'forced':
+                        await updateVercelEnvVar(vercelToken, options.vercelProject, options.vercelTeam, entry.vercelId, entry.key, entry.value, options.vercelEnvironment, variableType);
+                        break;
+                    case 'deleted':
+                        await deleteVercelEnvVar(vercelToken, options.vercelProject, options.vercelTeam, entry.vercelId, entry.key);
+                        break;
+                    case 'unchanged':
+                    case 'skipped':
+                        // No action needed
+                        break;
+                }
+            }
+            logResults(logger, diff, false);
+            // Step 8: Optional redeploy
+            if (options.redeploy) {
+                logger.log('Triggering redeployment...');
+                await triggerRedeploy(vercelToken, options.vercelProject, options.vercelTeam, options.vercelEnvironment, logger);
+            }
+        }
+        (0, utilities_1.logEmptyLine)(logger);
+        (0, utilities_1.logBanner)(logger, 'success', 'Sync complete.');
+    }
+    SecretsVercelSyncTask.run = run;
+    // #endregion
+})(SecretsVercelSyncTask || (exports.SecretsVercelSyncTask = SecretsVercelSyncTask = {}));
+//# sourceMappingURL=executor.task.js.map

package/executors/secrets-vercel-sync/executor.task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executor.task.js","sourceRoot":"","sources":["../../../src/executors/secrets-vercel-sync/executor.task.ts"],"names":[],"mappings":";AAAA,kBAAkB;;;AAElB,oEAAkL;AAClL,uCAAkC;AAElC,mFAA6E;AAE7E,aAAa;AAEb,IAAiB,qBAAqB,CA+qBrC;AA/qBD,WAAiB,qBAAqB;IAElC,oBAAoB;IAEpB,MAAM,eAAe,GAAG,wBAAwB,CAAC;IAEjD,MAAM,yBAAyB,GAAG,CAAC,aAAa,EAAE,SAAS,EAAE,YAAY,CAAU,CAAC;IAEpF,MAAM,2BAA2B,GAAG,CAAC,WAAW,EAAE,WAAW,CAAU,CAAC;IAExE,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,eAAe,EAAE,eAAe,CAAU,CAAC;IAEtF;;OAEG;IACH,MAAM,aAAa,GAA2B;QAC1C,GAAG,EAAE,aAAa;QAClB,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,IAAI,EAAE,YAAY;KACrB,CAAC;IA4DF,aAAa;IAEb,qBAAqB;IAErB;;OAEG;IACH,SAAS,QAAQ,CAAC,OAAsC;QACpD,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,IAAI,WAAW,CAAC;QAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,eAAe,CAAC;QAErE,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAsC,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,KAAK,CAAC,8BAA8B,OAAO,CAAC,iBAAiB,eAAe,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClI,CAAC;QAED,IAAI,CAAC,2BAA2B,CAAC,QAAQ,CAAC,YAAkC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,+BAA+B,YAAY,eAAe,2BAA2B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QAED,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,gBAAoC,CAAC,EAAE,CAAC;YAC5E,MAAM,IAAI,KAAK,CAAC,6BAA6B,gBAAgB,eAAe,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxH,CAAC;QAED,IAAI,YAAY,KAAK,WAAW,IAAI,OAAO,CAAC,iBAAiB,KAAK,aAAa,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,gJAAgJ,CAAC,CAAC;QACtK,CAAC;QAED,oBAAoB,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEvE,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,WAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;YAEtF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,2CAA2C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACzG,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,QAAQ,KAAK,gBAAgB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC7E,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,oBAAoB,CAAC,aAAqB,EAAE,iBAAyB;QAC1E,MAAM,mBAAmB,GAAG,aAAa,CAAC,aAAa,CAAC,CAAC;QAEzD,IAAI,mBAAmB,IAAI,mBAAmB,KAAK,iBAAiB,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACX,4CAA4C,aAAa,+CAA+C,mBAAmB,WAAW,iBAAiB,oBAAoB;gBAC3K,6DAA6D,CAChE,CAAC;QACN,CAAC;IACL,CAAC;IAED,aAAa;IAEb,qBAAqB;IAErB;;OAEG;IACH,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,IAAY;QACrD,MAAM,WAAW,GAAG,MAAM,IAAA,iBAAM,EAAoB;YAChD;gBACI,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,cAAc,KAAK,MAAM,IAAI,EAAE;aAC3C;SACJ,CAAC,CAAC;QAEH,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,sBAAsB,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,WAAW,CAAC,KAAK,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,kBAAkB,CAAC,WAAoB;QAClD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QAE1C,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,WAAW,EAAE,CAAC;YACd,OAAO,cAAc,CAAC,kBAAkB,EAAE,0DAA0D,CAAC,CAAC;QAC1G,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC/H,CAAC;IAED;;OAEG;IACH,SAAS,oBAAoB,CAAC,IAAY;QACtC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;YAC3B,CAAC,CAAC,UAAU,kBAAkB,CAAC,IAAI,CAAC,EAAE;YACtC,CAAC,CAAC,QAAQ,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;IAC7C,CAAC;IAED;;;;;;OAMG;IACH,SAAS,gBAAgB,CAAC,IAA+B;QACrD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEjH,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,aAAa,GAAG,qBAAqB,CAAC;QAC5C,IAAI,UAAU,GAAG,CAAC,CAAC;QAEnB,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC3B,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3D,UAAU,EAAE,CAAC;YACjB,CAAC;QACL,CAAC;QAED,+EAA+E;QAC/E,OAAO,UAAU,GAAG,UAAU,CAAC,MAAM,IAAI,GAAG,CAAC;IACjD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,UAAU,kBAAkB,CAC7B,KAAa,EACb,OAAe,EACf,IAAY,EACZ,cAAuB,EACvB,MAAe;QAEf,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,eAAe,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,SAAS,EAAE,CAAC;QAEjG,IAAI,cAAc,EAAE,CAAC;YACjB,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,GAAG,OAAO,eAAe,CAAC,CAAC;gBAC5E,MAAM,eAAe,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;gBAE/C,IAAI,eAAe,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAC;oBAExG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;gBACtC,CAAC;gBAED,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,0BAA0B,OAAO,gBAAgB,CAAC,CAAC;gBAEtF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;YACrC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACvE,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,yCAAyC,CAAC,CAAC;YAC/F,CAAC;QACL,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,MAAM,0BAA0B,OAAO,4BAA4B,CAAC,CAAC;QAElG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,sBAAsB,CAAC,KAAa,EAAE,OAAe;QAChE,MAAM,UAAU,GAA8B,EAAE,CAAC;QACjD,IAAI,OAAO,GAAuB,OAAO,CAAC;QAE1C,OAAO,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;gBAClC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;aAChD,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,yCAAyC,QAAQ,CAAC,MAAM,MAAM,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACzG,CAAC;YAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAiE,CAAC;YAClG,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAE9B,IAAI,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;gBACxB,OAAO,GAAG,GAAG,OAAO,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;YACzD,CAAC;iBAAM,CAAC;gBACJ,OAAO,GAAG,SAAS,CAAC;YACxB,CAAC;QACL,CAAC;QAED,OAAO,UAAU,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,kBAAkB,CAC7B,KAAa,EACb,OAAe,EACf,IAAY,EACZ,GAAW,EACX,KAAa,EACb,MAAc,EACd,IAAY;QAEZ,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,eAAe,iBAAiB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,SAAS,EAAE,CAAC;QAE9F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACrC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,GAAG;gBACH,KAAK;gBACL,MAAM,EAAE,CAAC,MAAM,CAAC;gBAChB,IAAI;aACP,CAAC;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,WAAW,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,kBAAkB,CAC7B,KAAa,EACb,OAAe,EACf,IAAY,EACZ,QAAgB,EAChB,GAAW,EACX,KAAa,EACb,MAAc,EACd,IAAY;QAEZ,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,eAAe,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QAE7H,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACL,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACrC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,KAAK;gBACL,MAAM,EAAE,CAAC,MAAM,CAAC;gBAChB,IAAI;aACP,CAAC;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,WAAW,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,kBAAkB,CAC7B,KAAa,EACb,OAAe,EACf,IAAY,EACZ,QAAgB,EAChB,GAAW;QAEX,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,GAAG,eAAe,gBAAgB,kBAAkB,CAAC,OAAO,CAAC,QAAQ,kBAAkB,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC;QAE7H,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC9B,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,WAAW,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,UAAU,eAAe,CAAC,KAAa,EAAE,OAAe,EAAE,IAAY,EAAE,MAAc,EAAE,MAAe;QACxG,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,eAAe,6BAA6B,kBAAkB,CAAC,OAAO,CAAC,IAAI,SAAS,WAAW,kBAAkB,CAAC,MAAM,CAAC,UAAU,CAAC;QAEvJ,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;YACtC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAChD,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,mDAAmD,YAAY,CAAC,MAAM,uBAAuB,CAAC,CAAC;YAE3G,OAAO;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAA6C,CAAC;QAEtF,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,CAAC,IAAI,CAAC,qCAAqC,MAAM,uBAAuB,CAAC,CAAC;YAEhF,OAAO;QACX,CAAC;QAED,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QACjD,MAAM,WAAW,GAAG,GAAG,eAAe,oBAAoB,SAAS,aAAa,CAAC;QAEjF,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACrC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACjB,IAAI,EAAE,OAAO;gBACb,YAAY;gBACZ,MAAM;aACT,CAAC;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,gBAAgB,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,2BAA2B,gBAAgB,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;YAE5E,OAAO;QACX,CAAC;QAED,MAAM,CAAC,GAAG,CAAC,iCAAiC,MAAM,IAAI,CAAC,CAAC;IAC5D,CAAC;IAED,aAAa;IAEb,oBAAoB;IAEpB;;OAEG;IACH,SAAS,eAAe,CACpB,OAA+B,EAC/B,WAA2B,EAC3B,WAA2B;QAE3B,IAAI,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEhC,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,CAAC;QAED,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACxC,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,aAAa;IAEb,sBAAsB;IAEtB;;;;;;;OAOG;IACH,SAAS,WAAW,CAChB,aAAqC,EACrC,UAAqC,EACrC,WAAmB,EACnB,gBAAkC,EAClC,aAAsB,EACtB,gBAAyB;QAEzB,MAAM,OAAO,GAA+D,EAAE,CAAC;QAE/E,gDAAgD;QAChD,MAAM,WAAW,GAAG,IAAI,GAAG,EAA8B,CAAC;QAE1D,KAAK,MAAM,MAAM,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBACtC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACxC,CAAC;QACL,CAAC;QAED,0BAA0B;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAEtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,sCAAsC;gBACtC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;gBAC9C,SAAS;YACb,CAAC;YAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACpB,kEAAkE;gBAClE,mEAAmE;gBACnE,QAAQ,gBAAgB,EAAE,CAAC;oBACvB,KAAK,eAAe;wBAChB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;wBACtE,MAAM;oBACV,KAAK,eAAe,CAAC;oBACrB,KAAK,MAAM;wBACP,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;wBAChE,MAAM;gBACd,CAAC;gBACD,SAAS;YACb,CAAC;YAED,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;gBAC3B,qBAAqB;gBACrB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC;iBAAM,CAAC;gBACJ,0BAA0B;gBAC1B,QAAQ,gBAAgB,EAAE,CAAC;oBACvB,KAAK,eAAe;wBAChB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;wBACvE,MAAM;oBACV,KAAK,eAAe;wBAChB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;wBAChE,MAAM;oBACV,KAAK,MAAM;wBACP,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;wBAChE,MAAM;gBACd,CAAC;YACL,CAAC;QACL,CAAC;QAED,mCAAmC;QACnC,IAAI,aAAa,EAAE,CAAC;YAChB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC;gBACtC,IAAI,CAAC,CAAC,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC;oBAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;gBAClE,CAAC;YACL,CAAC;QACL,CAAC;QAED,OAAO,OAAO,CAAC;IACnB,CAAC;IAED,aAAa;IAEb,kBAAkB;IAElB;;OAEG;IACH,SAAS,eAAe,CAAC,MAAkB,EAAE,MAAe;QACxD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;QAEzC,QAAQ,MAAM,EAAE,CAAC;YACb,KAAK,OAAO;gBACR,OAAO,IAAA,iBAAK,EAAC,IAAA,gBAAI,EAAC,IAAI,MAAM,QAAQ,CAAC,CAAC,CAAC;YAC3C,KAAK,SAAS;gBACV,OAAO,IAAA,kBAAM,EAAC,IAAA,gBAAI,EAAC,IAAI,MAAM,UAAU,CAAC,CAAC,CAAC;YAC9C,KAAK,QAAQ;gBACT,OAAO,IAAA,gBAAI,EAAC,IAAA,gBAAI,EAAC,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;YAC3C,KAAK,WAAW;gBACZ,OAAO,IAAA,gBAAI,EAAC,IAAA,gBAAI,EAAC,aAAa,CAAC,CAAC,CAAC;YACrC,KAAK,SAAS;gBACV,OAAO,IAAA,mBAAO,EAAC,IAAA,gBAAI,EAAC,WAAW,CAAC,CAAC,CAAC;YACtC,KAAK,SAAS;gBACV,OAAO,IAAA,eAAG,EAAC,IAAA,gBAAI,EAAC,IAAI,MAAM,UAAU,CAAC,CAAC,CAAC;QAC/C,CAAC;IACL,CAAC;IAED;;OAEG;IACH,SAAS,UAAU,CAAC,MAAe,EAAE,OAA2B,EAAE,MAAe;QAC7E,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAEvE,IAAA,mBAAO,EAAC,MAAM,EAAE,SAAS,MAAM,CAAC,MAAM,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxD,KAAK,EAAE,GAAG,CAAC,CAAC,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE;SACzD,CAAC,CAAC,CAAC,CAAC;IACT,CAAC;IAED,aAAa;IAEb,oBAAoB;IAEpB;;OAEG;IACI,KAAK,UAAU,GAAG,CAAC,OAAsC;QAC5D,MAAM,MAAM,GAAG,IAAI,yBAAa,EAAE,CAAC;QACnC,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;QACnD,MAAM,YAAY,GAAG,OAAO,CAAC,kBAAkB,IAAI,WAAW,CAAC;QAC/D,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,eAAe,CAAC;QACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC;QACvC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;QACrD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,KAAK,CAAC;QAEjD,IAAA,wBAAY,EAAC,MAAM,EAAE,GAAG,YAAY,gBAAgB,CAAC,CAAC;QAEtD,mBAAmB;QACnB,MAAM,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACpC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAElB,IAAA,qBAAS,EAAC,MAAM,EAAE,MAAM,EAAE;YACtB,OAAO,EAAE,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,aAAa,MAAM,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,iBAAiB,EAAE;YACrH,OAAO,EAAE,aAAa,YAAY,YAAY,YAAY,gBAAgB,gBAAgB,eAAe,MAAM,sBAAsB,aAAa,EAAE;SACvJ,CAAC,CAAC;QAEH,yBAAyB;QACzB,MAAM,eAAe,GAAG,IAAA,gDAAqB,EAAC,YAAY,CAAC,CAAC;QAC5D,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACrF,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAE1D,0CAA0C;QAC1C,MAAM,CAAC,GAAG,CAAC,yBAAyB,YAAY,KAAK,CAAC,CAAC;QACvD,IAAI,aAAa,GAAG,MAAM,eAAe,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QAE9I,4BAA4B;QAC5B,aAAa,GAAG,eAAe,CAAC,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,wBAAwB,CAAC,CAAC;QAE3E,6EAA6E;QAC7E,qFAAqF;QACrF,MAAM,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACvD,MAAM,cAAc,GAAG,YAAY,KAAK,WAAW,CAAC;QACpD,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,MAAM,CAAC,CAAC;QAC7H,MAAM,gBAAgB,GAAG,WAAW,CAAC,SAAS,CAAC;QAE/C,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,YAAY,KAAK,WAAW;gBACvC,CAAC,CAAC,wDAAwD;gBAC1D,CAAC,CAAC,qEAAqE,CAAC;YAE5E,IAAA,qBAAS,EAAC,MAAM,EAAE,SAAS,EAAE;gBACzB,OAAO,EAAE,4BAA4B;gBACrC,OAAO,EAAE,GAAG,MAAM,6JAA6J;aAClL,CAAC,CAAC;QACP,CAAC;QAED,uBAAuB;QACvB,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,WAAW,CAAC,aAAa,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,aAAa,EAAE,gBAAgB,CAAC,CAAC;QACxI,IAAA,wBAAY,EAAC,MAAM,CAAC,CAAC;QAErB,4CAA4C;QAC5C,IAAI,MAAM,EAAE,CAAC;YACT,IAAA,qBAAS,EAAC,MAAM,EAAE,SAAS,EAAE,iDAAiD,CAAC,CAAC;YAChF,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;gBACvB,QAAQ,KAAK,CAAC,MAAM,EAAE,CAAC;oBACnB,KAAK,OAAO;wBACR,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;wBACnJ,MAAM;oBACV,KAAK,SAAS,CAAC;oBACf,KAAK,QAAQ;wBACT,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,KAAM,EAAE,OAAO,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;wBACpK,MAAM;oBACV,KAAK,SAAS;wBACV,MAAM,kBAAkB,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;wBAC7G,MAAM;oBACV,KAAK,WAAW,CAAC;oBACjB,KAAK,SAAS;wBACV,mBAAmB;wBACnB,MAAM;gBACd,CAAC;YACL,CAAC;YAED,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAEhC,4BAA4B;YAC5B,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACnB,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;gBACzC,MAAM,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YACrH,CAAC;QACL,CAAC;QAED,IAAA,wBAAY,EAAC,MAAM,CAAC,CAAC;QACrB,IAAA,qBAAS,EAAC,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACnD,CAAC;IA3FqB,yBAAG,MA2FxB,CAAA;IAED,aAAa;AAEjB,CAAC,EA/qBgB,qBAAqB,qCAArB,qBAAqB,QA+qBrC"}

package/executors/secrets-vercel-sync/providers/azure-keyvault.provider.d.ts

@@ -0,0 +1,42 @@
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+import type { ISecretsProvider } from './secrets-provider.interface';
+/**
+ * Secrets provider implementation for Azure Key Vault.
+ *
+ * Uses the Key Vault REST API with a Bearer token (e.g. from `az account get-access-token`
+ * or a service principal client credential flow). The token must be provided via `apiKey`
+ * or entered interactively.
+ *
+ * @public
+ */
+export declare class AzureKeyVaultSecretsProvider implements ISecretsProvider {
+    /**
+     * @inheritdoc
+     */
+    authenticate(apiKey?: string, interactive?: boolean): Promise<string>;
+    /**
+     * Fetches all secrets from an Azure Key Vault.
+     *
+     * The `project` and `config` parameters are ignored. The vault is identified
+     * solely by `vaultUrl`.
+     *
+     * @inheritdoc
+     */
+    fetchSecrets(token: string, _project: string, _config: string, logger: ILogger, vaultUrl?: string): Promise<Record<string, string>>;
+    /**
+     * Lists all secrets in the vault (handles pagination).
+     */
+    private listSecrets;
+    /**
+     * Fetches the current value of a single secret.
+     */
+    private getSecretValue;
+    /**
+     * Extracts the secret name from a Key Vault secret ID URL.
+     *
+     * @example
+     * `https://my-vault.vault.azure.net/secrets/MY_SECRET` → `MY_SECRET`
+     */
+    private extractSecretName;
+}
+//# sourceMappingURL=azure-keyvault.provider.d.ts.map

package/executors/secrets-vercel-sync/providers/azure-keyvault.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-keyvault.provider.d.ts","sourceRoot":"","sources":["../../../../src/executors/secrets-vercel-sync/providers/azure-keyvault.provider.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC;AAEpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AA8BrE;;;;;;;;GAQG;AACH,qBAAa,4BAA6B,YAAW,gBAAgB;IAIjE;;OAEG;IACU,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;IA6BlF;;;;;;;OAOG;IACU,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IA4BhJ;;OAEG;YACW,WAAW;IAsBzB;;OAEG;YACW,cAAc;IAgB5B;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;CAO5B"}