@breadstone-infrastructure/nx-tasks 0.0.256 → 0.0.258

package/src/executors/secrets-vercel-sync/executor.task.ts

@@ -0,0 +1,697 @@
+// #region Imports
+
+import { ConsoleLogger, type ILogger, bold, cyan, gray, green, logBanner, logEmptyLine, logSeparator, logTree, magenta, red, yellow } from '@breadstone-infrastructure/utilities';
+import { prompt } from 'enquirer';
+import type { SecretsProviderType } from './providers/secrets-provider.factory';
+import { createSecretsProvider } from './providers/secrets-provider.factory';
+
+// #endregion
+
+export namespace SecretsVercelSyncTask {
+
+    // #region Constants
+
+    const VERCEL_API_BASE = 'https://api.vercel.com';
+
+    const VALID_VERCEL_ENVIRONMENTS = ['development', 'preview', 'production'] as const;
+
+    const VALID_VERCEL_VARIABLE_TYPES = ['encrypted', 'sensitive'] as const;
+
+    const VALID_CONFLICT_STRATEGIES = ['none', 'prefer-source', 'prefer-vercel'] as const;
+
+    /**
+     * Expected semantic mapping: secrets config -> Vercel environment.
+     */
+    const STAGE_MAPPING: Record<string, string> = {
+        dev: 'development',
+        prev: 'preview',
+        stage: 'preview',
+        prod: 'production'
+    };
+
+    // #endregion
+
+    // #region Types
+
+    type VercelEnvironment = typeof VALID_VERCEL_ENVIRONMENTS[number];
+
+    type VercelVariableType = typeof VALID_VERCEL_VARIABLE_TYPES[number];
+
+    type ConflictStrategy = typeof VALID_CONFLICT_STRATEGIES[number];
+
+    type SyncAction = 'added' | 'updated' | 'unchanged' | 'skipped' | 'deleted' | 'forced';
+
+    // #endregion
+
+    // #region Interfaces
+
+    export interface ISecretsVercelSyncTaskOptions {
+        cwd: string;
+        provider: SecretsProviderType;
+        secretsProject: string;
+        secretsConfig: string;
+        vaultUrl?: string;
+        apiKey?: string;
+        vercelTeam: string;
+        vercelProject: string;
+        vercelEnvironment: VercelEnvironment;
+        vercelVariableType?: VercelVariableType;
+        conflictStrategy?: ConflictStrategy;
+        dryRun?: boolean;
+        deleteMissing?: boolean;
+        includeKeys?: Array<string>;
+        excludeKeys?: Array<string>;
+        redeploy?: boolean;
+        interactive?: boolean;
+    }
+
+    interface IVercelEnvVariable {
+        id: string;
+        key: string;
+        value: string;
+        target: Array<string>;
+        type: string;
+    }
+
+    interface IVercelEnvListResponse {
+        envs: Array<IVercelEnvVariable>;
+    }
+
+    interface IVercelEnvFetchResult {
+        envs: Array<IVercelEnvVariable>;
+        decrypted: boolean;
+    }
+
+    interface ISyncResult {
+        key: string;
+        action: SyncAction;
+    }
+
+    // #endregion
+
+    // #region Validation
+
+    /**
+     * Validates all options before execution.
+     */
+    function validate(options: ISecretsVercelSyncTaskOptions): void {
+        const variableType = options.vercelVariableType ?? 'encrypted';
+        const conflictStrategy = options.conflictStrategy ?? 'prefer-source';
+
+        if (!VALID_VERCEL_ENVIRONMENTS.includes(options.vercelEnvironment as VercelEnvironment)) {
+            throw new Error(`Invalid vercelEnvironment "${options.vercelEnvironment}". Allowed: ${VALID_VERCEL_ENVIRONMENTS.join(', ')}`);
+        }
+
+        if (!VALID_VERCEL_VARIABLE_TYPES.includes(variableType as VercelVariableType)) {
+            throw new Error(`Invalid vercelVariableType "${variableType}". Allowed: ${VALID_VERCEL_VARIABLE_TYPES.join(', ')}`);
+        }
+
+        if (!VALID_CONFLICT_STRATEGIES.includes(conflictStrategy as ConflictStrategy)) {
+            throw new Error(`Invalid conflictStrategy "${conflictStrategy}". Allowed: ${VALID_CONFLICT_STRATEGIES.join(', ')}`);
+        }
+
+        if (variableType === 'sensitive' && options.vercelEnvironment === 'development') {
+            throw new Error('vercelVariableType "sensitive" is not allowed for vercelEnvironment "development". Vercel does not support sensitive variables in development.');
+        }
+
+        validateStageMapping(options.secretsConfig, options.vercelEnvironment);
+
+        if (options.includeKeys && options.excludeKeys) {
+            const overlap = options.includeKeys.filter(key => options.excludeKeys!.includes(key));
+
+            if (overlap.length > 0) {
+                throw new Error(`includeKeys and excludeKeys overlap on: ${overlap.join(', ')}. Remove duplicates.`);
+            }
+        }
+
+        if (options.provider === 'azure-keyvault' && !options.vaultUrl) {
+            throw new Error('vaultUrl is required when provider is azure-keyvault.');
+        }
+    }
+
+    /**
+     * Validates that the secrets config and Vercel environment follow the expected semantic mapping.
+     */
+    function validateStageMapping(secretsConfig: string, vercelEnvironment: string): void {
+        const expectedEnvironment = STAGE_MAPPING[secretsConfig];
+
+        if (expectedEnvironment && expectedEnvironment !== vercelEnvironment) {
+            throw new Error(
+                `Semantic stage mismatch: secrets config "${secretsConfig}" is expected to map to Vercel environment "${expectedEnvironment}", but "${vercelEnvironment}" was configured. ` +
+                `If this is intentional, review the configuration carefully.`
+            );
+        }
+    }
+
+    // #endregion
+
+    // #region Vercel API
+
+    /**
+     * Prompts the user for a token via interactive terminal input.
+     */
+    async function promptForToken(label: string, hint: string): Promise<string> {
+        const credentials = await prompt<{ token: string }>([
+            {
+                type: 'input',
+                name: 'token',
+                message: `Enter your ${label}:\n${hint}`
+            }
+        ]);
+
+        if (!credentials.token) {
+            throw new Error(`No ${label} provided. Aborting.`);
+        }
+
+        return credentials.token;
+    }
+
+    /**
+     * Resolves the Vercel API token from the VERCEL_TOKEN environment variable.
+     * Falls back to interactive prompt if interactive mode is enabled.
+     */
+    async function resolveVercelToken(interactive: boolean): Promise<string> {
+        const token = process.env['VERCEL_TOKEN'];
+
+        if (token) {
+            return token;
+        }
+
+        if (interactive) {
+            return promptForToken('Vercel API token', 'You can create one at https://vercel.com/account/tokens.');
+        }
+
+        throw new Error('VERCEL_TOKEN environment variable is not set. Set it to a Vercel API token, or enable interactive mode.');
+    }
+
+    /**
+     * Builds the query string for Vercel team scoping.
+     */
+    function buildVercelTeamQuery(team: string): string {
+        return team.startsWith('team_')
+            ? `teamId=${encodeURIComponent(team)}`
+            : `slug=${encodeURIComponent(team)}`;
+    }
+
+    /**
+     * Heuristically detects whether the values returned by Vercel are still ciphertext despite a
+     * successful `?decrypt=true` request. Vercel silently returns ciphertext when the calling token
+     * lacks decryption permission (no error). Ciphertext is invariably long (>=100 chars) and limited
+     * to base64url charset. If most encrypted-typed values match this profile, we treat the fetch as
+     * non-decrypted.
+     */
+    function detectCiphertext(envs: Array<IVercelEnvVariable>): boolean {
+        const candidates = envs.filter(e => e.type === 'encrypted' && typeof e.value === 'string' && e.value.length > 0);
+
+        if (candidates.length === 0) {
+            return false;
+        }
+
+        const base64UrlOnly = /^[A-Za-z0-9+/=_-]+$/;
+        let suspicious = 0;
+
+        for (const env of candidates) {
+            if (env.value.length >= 100 && base64UrlOnly.test(env.value)) {
+                suspicious++;
+            }
+        }
+
+        // If a clear majority looks like ciphertext, assume decryption did not happen.
+        return suspicious / candidates.length >= 0.5;
+    }
+
+    /**
+     * Fetches existing environment variables from a Vercel project.
+     *
+     * Attempts to retrieve decrypted values when `requestDecrypt` is true. If Vercel rejects the
+     * decrypt request (e.g. token lacks scope, or the variable type does not support decryption),
+     * the request is retried without `decrypt=true` and `decrypted` is reported as `false`.
+     *
+     * Note: Vercel may also silently return ciphertext when `?decrypt=true` is sent with a token
+     * that lacks decryption scope (no HTTP error). In that case `decrypted` is also reported as
+     * `false` based on a content heuristic ({@link detectCiphertext}).
+     */
+    async function fetchVercelEnvVars(
+        token: string,
+        project: string,
+        team: string,
+        requestDecrypt: boolean,
+        logger: ILogger
+    ): Promise<IVercelEnvFetchResult> {
+        const teamQuery = buildVercelTeamQuery(team);
+        const baseUrl = `${VERCEL_API_BASE}/v9/projects/${encodeURIComponent(project)}/env?${teamQuery}`;
+
+        if (requestDecrypt) {
+            try {
+                const envs = await fetchAllVercelEnvPages(token, `${baseUrl}&decrypt=true`);
+                const stillCiphertext = detectCiphertext(envs);
+
+                if (stillCiphertext) {
+                    logger.warn('  Vercel returned ciphertext despite decrypt=true (token likely lacks decryption scope).');
+
+                    return { envs, decrypted: false };
+                }
+
+                logger.log(`  Fetched ${envs.length} env vars from Vercel [${project}] (decrypted).`);
+
+                return { envs, decrypted: true };
+            } catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                logger.warn(`  Decrypted fetch failed (${message}). Falling back to non-decrypted fetch.`);
+            }
+        }
+
+        const envs = await fetchAllVercelEnvPages(token, baseUrl);
+        logger.log(`  Fetched ${envs.length} env vars from Vercel [${project}] (values not comparable).`);
+
+        return { envs, decrypted: false };
+    }
+
+    /**
+     * Pages through all Vercel env vars for the given list URL.
+     */
+    async function fetchAllVercelEnvPages(token: string, listUrl: string): Promise<Array<IVercelEnvVariable>> {
+        const allEnvVars: Array<IVercelEnvVariable> = [];
+        let nextUrl: string | undefined = listUrl;
+
+        while (nextUrl) {
+            const response = await fetch(nextUrl, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+
+            if (!response.ok) {
+                throw new Error(`Failed to fetch Vercel env vars (HTTP ${response.status}): ${response.statusText}`);
+            }
+
+            const data = await response.json() as IVercelEnvListResponse & { pagination?: { next?: number } };
+            allEnvVars.push(...data.envs);
+
+            if (data.pagination?.next) {
+                nextUrl = `${listUrl}&until=${data.pagination.next}`;
+            } else {
+                nextUrl = undefined;
+            }
+        }
+
+        return allEnvVars;
+    }
+
+    /**
+     * Creates a new environment variable in Vercel.
+     */
+    async function createVercelEnvVar(
+        token: string,
+        project: string,
+        team: string,
+        key: string,
+        value: string,
+        target: string,
+        type: string
+    ): Promise<void> {
+        const teamQuery = buildVercelTeamQuery(team);
+        const url = `${VERCEL_API_BASE}/v10/projects/${encodeURIComponent(project)}/env?${teamQuery}`;
+
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                key,
+                value,
+                target: [target],
+                type
+            })
+        });
+
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Failed to create Vercel env var "${key}" (HTTP ${response.status}): ${body}`);
+        }
+    }
+
+    /**
+     * Updates an existing environment variable in Vercel.
+     */
+    async function updateVercelEnvVar(
+        token: string,
+        project: string,
+        team: string,
+        envVarId: string,
+        key: string,
+        value: string,
+        target: string,
+        type: string
+    ): Promise<void> {
+        const teamQuery = buildVercelTeamQuery(team);
+        const url = `${VERCEL_API_BASE}/v9/projects/${encodeURIComponent(project)}/env/${encodeURIComponent(envVarId)}?${teamQuery}`;
+
+        const response = await fetch(url, {
+            method: 'PATCH',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                value,
+                target: [target],
+                type
+            })
+        });
+
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Failed to update Vercel env var "${key}" (HTTP ${response.status}): ${body}`);
+        }
+    }
+
+    /**
+     * Deletes an environment variable from Vercel.
+     */
+    async function deleteVercelEnvVar(
+        token: string,
+        project: string,
+        team: string,
+        envVarId: string,
+        key: string
+    ): Promise<void> {
+        const teamQuery = buildVercelTeamQuery(team);
+        const url = `${VERCEL_API_BASE}/v9/projects/${encodeURIComponent(project)}/env/${encodeURIComponent(envVarId)}?${teamQuery}`;
+
+        const response = await fetch(url, {
+            method: 'DELETE',
+            headers: { Authorization: `Bearer ${token}` }
+        });
+
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Failed to delete Vercel env var "${key}" (HTTP ${response.status}): ${body}`);
+        }
+    }
+
+    /**
+     * Triggers a redeployment of the latest deployment in the given Vercel project and environment.
+     */
+    async function triggerRedeploy(token: string, project: string, team: string, target: string, logger: ILogger): Promise<void> {
+        const teamQuery = buildVercelTeamQuery(team);
+        const listUrl = `${VERCEL_API_BASE}/v6/deployments?projectId=${encodeURIComponent(project)}&${teamQuery}&target=${encodeURIComponent(target)}&limit=1`;
+
+        const listResponse = await fetch(listUrl, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+
+        if (!listResponse.ok) {
+            logger.warn(`  Could not list deployments for redeploy (HTTP ${listResponse.status}). Skipping redeploy.`);
+
+            return;
+        }
+
+        const listData = await listResponse.json() as { deployments: Array<{ uid: string }> };
+
+        if (!listData.deployments || listData.deployments.length === 0) {
+            logger.warn(`  No deployment found for target "${target}". Skipping redeploy.`);
+
+            return;
+        }
+
+        const deploymentId = listData.deployments[0].uid;
+        const redeployUrl = `${VERCEL_API_BASE}/v13/deployments?${teamQuery}&forceNew=1`;
+
+        const redeployResponse = await fetch(redeployUrl, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${token}`,
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify({
+                name: project,
+                deploymentId,
+                target
+            })
+        });
+
+        if (!redeployResponse.ok) {
+            const body = await redeployResponse.text();
+            logger.warn(`  Redeploy failed (HTTP ${redeployResponse.status}): ${body}`);
+
+            return;
+        }
+
+        logger.log(`  Triggered redeployment for "${target}".`);
+    }
+
+    // #endregion
+
+    // #region Filtering
+
+    /**
+     * Applies includeKeys and excludeKeys filters to the given secrets map.
+     */
+    function applyKeyFilters(
+        secrets: Record<string, string>,
+        includeKeys?: Array<string>,
+        excludeKeys?: Array<string>
+    ): Record<string, string> {
+        let keys = Object.keys(secrets);
+
+        if (includeKeys && includeKeys.length > 0) {
+            const includeSet = new Set(includeKeys);
+            keys = keys.filter(key => includeSet.has(key));
+        }
+
+        if (excludeKeys && excludeKeys.length > 0) {
+            const excludeSet = new Set(excludeKeys);
+            keys = keys.filter(key => !excludeSet.has(key));
+        }
+
+        return Object.fromEntries(keys.map(key => [key, secrets[key]]));
+    }
+
+    // #endregion
+
+    // #region Diff & Sync
+
+    /**
+     * Computes the diff between source secrets and existing Vercel env vars for a given environment.
+     *
+     * When `valuesComparable` is `false`, value equality cannot be verified (encrypted/sensitive variables
+     * whose decrypted form was not retrievable). To guarantee Vercel always reflects the latest source state,
+     * existing keys are then emitted as `forced` (and will be patched) under `prefer-source`. Under
+     * `prefer-vercel` or `none` the key is `skipped` to honor user intent.
+     */
+    function computeDiff(
+        sourceSecrets: Record<string, string>,
+        vercelVars: Array<IVercelEnvVariable>,
+        environment: string,
+        conflictStrategy: ConflictStrategy,
+        deleteMissing: boolean,
+        valuesComparable: boolean
+    ): Array<ISyncResult & { vercelId?: string; value?: string }> {
+        const results: Array<ISyncResult & { vercelId?: string; value?: string }> = [];
+
+        // Index vercel vars for this environment by key
+        const vercelByKey = new Map<string, IVercelEnvVariable>();
+
+        for (const envVar of vercelVars) {
+            if (envVar.target.includes(environment)) {
+                vercelByKey.set(envVar.key, envVar);
+            }
+        }
+
+        // Process all source keys
+        for (const [key, value] of Object.entries(sourceSecrets)) {
+            const existing = vercelByKey.get(key);
+
+            if (!existing) {
+                // Key does not exist in Vercel -> add
+                results.push({ key, action: 'added', value });
+                continue;
+            }
+
+            if (!valuesComparable) {
+                // Cannot compare values (encrypted without decrypt or sensitive).
+                // To guarantee Vercel = source, force a patch under prefer-source.
+                switch (conflictStrategy) {
+                    case 'prefer-source':
+                        results.push({ key, action: 'forced', vercelId: existing.id, value });
+                        break;
+                    case 'prefer-vercel':
+                    case 'none':
+                        results.push({ key, action: 'skipped', vercelId: existing.id });
+                        break;
+                }
+                continue;
+            }
+
+            if (existing.value === value) {
+                // Value is unchanged
+                results.push({ key, action: 'unchanged', vercelId: existing.id });
+            } else {
+                // Conflict: value differs
+                switch (conflictStrategy) {
+                    case 'prefer-source':
+                        results.push({ key, action: 'updated', vercelId: existing.id, value });
+                        break;
+                    case 'prefer-vercel':
+                        results.push({ key, action: 'skipped', vercelId: existing.id });
+                        break;
+                    case 'none':
+                        results.push({ key, action: 'skipped', vercelId: existing.id });
+                        break;
+                }
+            }
+        }
+
+        // Keys in Vercel but not in source
+        if (deleteMissing) {
+            for (const [key, envVar] of vercelByKey) {
+                if (!(key in sourceSecrets)) {
+                    results.push({ key, action: 'deleted', vercelId: envVar.id });
+                }
+            }
+        }
+
+        return results;
+    }
+
+    // #endregion
+
+    // #region Logging
+
+    /**
+     * Returns a colored tag string for the given sync action.
+     */
+    function formatActionTag(action: SyncAction, dryRun: boolean): string {
+        const prefix = dryRun ? 'DRY RUN: ' : '';
+
+        switch (action) {
+            case 'added':
+                return green(bold(`[${prefix}added]`));
+            case 'updated':
+                return yellow(bold(`[${prefix}updated]`));
+            case 'forced':
+                return cyan(bold(`[${prefix}forced]`));
+            case 'unchanged':
+                return gray(bold('[unchanged]'));
+            case 'skipped':
+                return magenta(bold('[skipped]'));
+            case 'deleted':
+                return red(bold(`[${prefix}deleted]`));
+        }
+    }
+
+    /**
+     * Logs the sync results as a single alphabetically sorted tree with colored action tags.
+     */
+    function logResults(logger: ILogger, results: Array<ISyncResult>, dryRun: boolean): void {
+        const sorted = [...results].sort((a, b) => a.key.localeCompare(b.key));
+
+        logTree(logger, `Keys (${sorted.length})`, sorted.map(r => ({
+            label: `${r.key} ${formatActionTag(r.action, dryRun)}`
+        })));
+    }
+
+    // #endregion
+
+    // #region Main Task
+
+    /**
+     * Executes the Secrets Provider -> Vercel sync.
+     */
+    export async function run(options: ISecretsVercelSyncTaskOptions): Promise<void> {
+        const logger = new ConsoleLogger();
+        const providerType = options.provider ?? 'doppler';
+        const variableType = options.vercelVariableType ?? 'encrypted';
+        const conflictStrategy = options.conflictStrategy ?? 'prefer-source';
+        const dryRun = options.dryRun ?? false;
+        const deleteMissing = options.deleteMissing ?? false;
+        const interactive = options.interactive ?? false;
+
+        logSeparator(logger, `${providerType} → Vercel Sync`);
+
+        // Step 1: Validate
+        logger.log('Validating options...');
+        validate(options);
+
+        logBanner(logger, 'info', {
+            message: `${options.secretsProject}/${options.secretsConfig} → ${options.vercelProject}/${options.vercelEnvironment}`,
+            details: `Provider: ${providerType} | Type: ${variableType} | Strategy: ${conflictStrategy} | Dry Run: ${dryRun} | Delete Missing: ${deleteMissing}`
+        });
+
+        // Step 2: Resolve tokens
+        const secretsProvider = createSecretsProvider(providerType);
+        const secretsToken = await secretsProvider.authenticate(options.apiKey, interactive);
+        const vercelToken = await resolveVercelToken(interactive);
+
+        // Step 3: Fetch secrets from the provider
+        logger.log(`Fetching secrets from ${providerType}...`);
+        let sourceSecrets = await secretsProvider.fetchSecrets(secretsToken, options.secretsProject, options.secretsConfig, logger, options.vaultUrl);
+
+        // Step 4: Apply key filters
+        sourceSecrets = applyKeyFilters(sourceSecrets, options.includeKeys, options.excludeKeys);
+        logger.log(`  ${Object.keys(sourceSecrets).length} keys after filtering.`);
+
+        // Step 5: Fetch Vercel env vars (request decryption only for encrypted type;
+        // sensitive values are never returned by the Vercel API regardless of decrypt=true).
+        logger.log('Fetching Vercel environment variables...');
+        const requestDecrypt = variableType === 'encrypted';
+        const vercelFetch = await fetchVercelEnvVars(vercelToken, options.vercelProject, options.vercelTeam, requestDecrypt, logger);
+        const valuesComparable = vercelFetch.decrypted;
+
+        if (!valuesComparable) {
+            const reason = variableType === 'sensitive'
+                ? 'Vercel never returns values for "sensitive" variables.'
+                : 'Decrypted fetch was not available (token scope or API restriction).';
+
+            logBanner(logger, 'warning', {
+                message: 'Value comparison disabled.',
+                details: `${reason} Existing keys will be force-patched under "prefer-source" to guarantee Vercel mirrors the secrets provider. Use "prefer-vercel" or "none" to skip instead.`
+            });
+        }
+
+        // Step 6: Compute diff
+        logger.log('Computing diff...');
+        const diff = computeDiff(sourceSecrets, vercelFetch.envs, options.vercelEnvironment, conflictStrategy, deleteMissing, valuesComparable);
+        logEmptyLine(logger);
+
+        // Step 7: Apply changes (or dry-run report)
+        if (dryRun) {
+            logBanner(logger, 'warning', 'DRY RUN - no changes will be written to Vercel.');
+            logResults(logger, diff, true);
+        } else {
+            for (const entry of diff) {
+                switch (entry.action) {
+                    case 'added':
+                        await createVercelEnvVar(vercelToken, options.vercelProject, options.vercelTeam, entry.key, entry.value!, options.vercelEnvironment, variableType);
+                        break;
+                    case 'updated':
+                    case 'forced':
+                        await updateVercelEnvVar(vercelToken, options.vercelProject, options.vercelTeam, entry.vercelId!, entry.key, entry.value!, options.vercelEnvironment, variableType);
+                        break;
+                    case 'deleted':
+                        await deleteVercelEnvVar(vercelToken, options.vercelProject, options.vercelTeam, entry.vercelId!, entry.key);
+                        break;
+                    case 'unchanged':
+                    case 'skipped':
+                        // No action needed
+                        break;
+                }
+            }
+
+            logResults(logger, diff, false);
+
+            // Step 8: Optional redeploy
+            if (options.redeploy) {
+                logger.log('Triggering redeployment...');
+                await triggerRedeploy(vercelToken, options.vercelProject, options.vercelTeam, options.vercelEnvironment, logger);
+            }
+        }
+
+        logEmptyLine(logger);
+        logBanner(logger, 'success', 'Sync complete.');
+    }
+
+    // #endregion
+
+}