@heychunky/core 0.1.0

package/dist/admin/services/vercel.js

@@ -0,0 +1,209 @@
+/**
+ * Vercel — projects, deployments, environment variables.
+ *
+ * Tokens are team-wide and cannot be narrowed to a project. That is Vercel's
+ * model, not an oversight, and it is why this key is one of the widest the
+ * factory holds.
+ */
+import { request } from "../../http/request.js";
+import { matchByName } from "../../config/names.js";
+import { probe, probeAccess } from "../../services/types.js";
+const BASE = "https://api.vercel.com";
+export function vercel(token) {
+    const creds = { token };
+    const o = { credentials: creds };
+    const projects = async () => (await request(`${BASE}/v9/projects?limit=100`, o)).projects;
+    /**
+     * Find a project for an app name.
+     *
+     * Deliberately tries several forms: the same account has `delters` for
+     * delters.com and `carmelcity-ai` for carmelcity.ai. A single slug rule
+     * matches one and silently misses the other — which is what broke sync-env
+     * for every app.
+     */
+    async function findProject(app) {
+        return matchByName(app, await projects(), (p) => p.name);
+    }
+    /**
+     * The team this token acts on.
+     *
+     * Vercel scopes a token to a team, but the create endpoint defaults to the
+     * personal account when no team is named — so a project would land somewhere
+     * nobody thinks to look. Read once, then remembered.
+     */
+    let team;
+    async function teamId() {
+        if (team === undefined) {
+            const { token: t } = await request(`${BASE}/v5/user/tokens/current`, o);
+            team = t.scopes.find((s) => s.type === "team")?.teamId ?? null;
+        }
+        return team ?? undefined;
+    }
+    /**
+     * Create a project, optionally linked to a GitHub repository.
+     *
+     * Only the identity is returned. Vercel's response carries far more than a
+     * project's name, and passing a provider payload through is how a credential
+     * reaches a terminal.
+     */
+    /**
+     * Create a project.
+     *
+     * The framework defaults to Next.js rather than to null. A null framework is
+     * not "detect it" — Vercel builds the repository as a bare static site,
+     * publishes nothing routable, and every URL it owns returns 404: the
+     * deployment's own, the project's, and any domain pointed at it. The build
+     * succeeds and reports READY, so nothing anywhere says what is wrong.
+     *
+     * Every app this factory provisions is Next.js. Something else is passed
+     * explicitly, and passing null is still possible for a project that really
+     * has no framework — but it is now a choice rather than the default.
+     */
+    async function createProject(name, opts = {}) {
+        const t = await teamId();
+        try {
+            const p = await request(`${BASE}/v11/projects${t ? `?teamId=${t}` : ""}`, {
+                ...o, method: "POST",
+                body: {
+                    name,
+                    framework: opts.framework === undefined ? "nextjs" : opts.framework,
+                    ...(opts.repo ? { gitRepository: { type: "github", repo: opts.repo } } : {}),
+                },
+            });
+            return { id: p.id, name: p.name };
+        }
+        catch (err) {
+            // Vercel answers "make sure there are no typos", which sends you to check
+            // the repository name — and the name is nearly always right. What it
+            // actually means is that Vercel's GitHub App was never installed on that
+            // organisation, so the repository is invisible to it rather than absent.
+            // A brand-new org is exactly that case, and the honest message saves
+            // someone an hour of looking at the wrong thing.
+            if (opts.repo && err instanceof Error && err.message.includes("repo_not_found")) {
+                const org = opts.repo.split("/")[0];
+                throw new Error(`Vercel cannot see ${opts.repo}. Its GitHub App is most likely not installed on ` +
+                    `"${org}" — grant it there at github.com/apps/vercel, then re-run.`);
+            }
+            throw err;
+        }
+    }
+    const envVars = async (projectId, teamId) => (await request(`${BASE}/v9/projects/${projectId}/env${teamId ? `?teamId=${teamId}` : ""}`, o)).envs;
+    /**
+     * Set one variable for one target, replacing what is there.
+     *
+     * Idempotent by deleting first: Vercel would otherwise accept a duplicate
+     * key on the same target and leave you guessing which one is live.
+     *
+     * Written as `sensitive` by default, so it cannot be read back out of the
+     * dashboard or the API — including by us.
+     */
+    async function setEnv(projectId, key, value, scope, opts = {}) {
+        const team = opts.teamId ? `?teamId=${opts.teamId}` : "";
+        // Deleting is scoped as narrowly as writing. Matching on the key alone
+        // would remove the same variable from every other environment.
+        const inScope = (e) => "target" in scope
+            ? (e.target ?? []).includes(scope.target) && !(e.customEnvironmentIds ?? []).length
+            : (e.customEnvironmentIds ?? []).includes(scope.customEnvironmentId);
+        for (const e of (await envVars(projectId, opts.teamId)).filter((e) => e.key === key && inScope(e))) {
+            if (e.id)
+                await request(`${BASE}/v9/projects/${projectId}/env/${e.id}${team}`, { ...o, method: "DELETE" });
+        }
+        await request(`${BASE}/v10/projects/${projectId}/env${team}`, {
+            ...o, method: "POST",
+            body: {
+                key, value,
+                type: opts.sensitive === false ? "encrypted" : "sensitive",
+                ...("target" in scope
+                    ? { target: [scope.target] }
+                    : { customEnvironmentIds: [scope.customEnvironmentId] }),
+            },
+        });
+    }
+    /** Domains on a project, and whether Vercel is happy with their DNS. */
+    const projectDomains = async (projectId, teamId) => (await request(`${BASE}/v9/projects/${projectId}/domains${teamId ? `?teamId=${teamId}` : ""}`, o)).domains;
+    /** Attach a domain. Idempotent: one already attached is reported, not re-added. */
+    async function addDomain(projectId, domain, teamId) {
+        const already = (await projectDomains(projectId, teamId)).find((d) => d.name === domain);
+        if (already)
+            return already;
+        return await request(`${BASE}/v10/projects/${projectId}/domains${teamId ? `?teamId=${teamId}` : ""}`, { ...o, method: "POST", body: { name: domain } });
+    }
+    /**
+     * Build a git ref.
+     *
+     * The framework is the project's, set when it was created — a deployment
+     * cannot supply one, which is why a project made without it produces builds
+     * that succeed and serve nothing.
+     */
+    async function deploy(name, opts) {
+        const [org, repo] = opts.repo.split("/");
+        return await request(`${BASE}/v13/deployments${opts.teamId ? `?teamId=${opts.teamId}&forceNew=1` : "?forceNew=1"}`, {
+            ...o, method: "POST",
+            body: {
+                name,
+                ...(opts.target ? { target: opts.target } : {}),
+                gitSource: { type: "github", org, repo, ref: opts.ref },
+            },
+        });
+    }
+    /** Make an existing deployment the live one, without rebuilding it. */
+    const promote = async (projectId, deploymentId, teamId) => await request(`${BASE}/v10/projects/${projectId}/promote/${deploymentId}${teamId ? `?teamId=${teamId}` : ""}`, { ...o, method: "POST" });
+    const customEnvironments = async (projectId, teamId) => (await request(`${BASE}/v9/projects/${projectId}/custom-environments${teamId ? `?teamId=${teamId}` : ""}`, o)).environments;
+    /**
+     * The custom environment for a slug, made if it is not there.
+     *
+     * Pro allows one per project, so this is the only way `staging` can exist at
+     * all — and asking first means a second sync does not fail against the limit.
+     */
+    async function ensureCustomEnvironment(projectId, slug, teamId) {
+        const found = (await customEnvironments(projectId, teamId)).find((e) => e.slug === slug);
+        if (found)
+            return found;
+        return await request(`${BASE}/v9/projects/${projectId}/custom-environments${teamId ? `?teamId=${teamId}` : ""}`, { ...o, method: "POST", body: { slug } });
+    }
+    return {
+        projects,
+        findProject,
+        teamId,
+        createProject,
+        projectDomains,
+        addDomain,
+        deploy,
+        promote,
+        envVars,
+        customEnvironments,
+        ensureCustomEnvironment,
+        setEnv,
+        deployments: async (projectId, limit = 5) => (await request(`${BASE}/v6/deployments?limit=${limit}${projectId ? `&projectId=${projectId}` : ""}`, o)).deployments,
+        async status() {
+            return probe("vercel", async () => {
+                const p = await projects();
+                return `${p.length} project${p.length === 1 ? "" : "s"}`;
+            });
+        },
+        async access() {
+            return probeAccess("vercel", async () => {
+                const { token: t } = await request(`${BASE}/v5/user/tokens/current`, o);
+                const teams = t.scopes.filter((s) => s.type === "team").length;
+                return {
+                    evidence: "scopes",
+                    scopes: t.scopes.map((s) => (s.teamId ? `${s.type}:${s.teamId}` : s.type)),
+                    can: teams
+                        ? [
+                            `read and write every project on ${teams} team${teams === 1 ? "" : "s"}`,
+                            "create projects and trigger deployments",
+                            "read and write project environment variables",
+                            "promote and roll back production deployments",
+                        ]
+                        : ["act on the personal account only"],
+                    notes: [
+                        `token "${t.name}", created ${new Date(t.createdAt).toISOString().slice(0, 10)}`,
+                        t.expiresAt ? `expires ${new Date(t.expiresAt).toISOString().slice(0, 10)}` : "does not expire",
+                        "team scope is whole-team: Vercel tokens cannot be narrowed to one project",
+                    ],
+                };
+            });
+        },
+    };
+}
+//# sourceMappingURL=vercel.js.map

package/dist/admin/services/vercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vercel.js","sourceRoot":"","sources":["../../../src/admin/services/vercel.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAoB,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,WAAW,EAA0C,MAAM,yBAAyB,CAAC;AAErG,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAsBtC,MAAM,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,KAAK,GAAgB,EAAE,KAAK,EAAE,CAAC;IACrC,MAAM,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IAEjC,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE,CAC1B,CAAC,MAAM,OAAO,CAAgC,GAAG,IAAI,wBAAwB,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IAE9F;;;;;;;OAOG;IACH,KAAK,UAAU,WAAW,CAAC,GAAW;QACpC,OAAO,WAAW,CAAC,GAAG,EAAE,MAAM,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IAED;;;;;;OAMG;IACH,IAAI,IAA+B,CAAC;IACpC,KAAK,UAAU,MAAM;QACnB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,MAAM,OAAO,CAChC,GAAG,IAAI,yBAAyB,EAAE,CAAC,CAAC,CAAC;YACvC,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,MAAM,IAAI,IAAI,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,IAAI,SAAS,CAAC;IAC3B,CAAC;IAED;;;;;;OAMG;IACH;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,aAAa,CAC1B,IAAY,EACZ,OAAqD,EAAE;QAEvD,MAAM,CAAC,GAAG,MAAM,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,MAAM,OAAO,CAAgB,GAAG,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;gBACvF,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM;gBACpB,IAAI,EAAE;oBACJ,IAAI;oBACJ,SAAS,EAAE,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS;oBACnE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC7E;aACF,CAAC,CAAC;YACH,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,0EAA0E;YAC1E,qEAAqE;YACrE,yEAAyE;YACzE,yEAAyE;YACzE,qEAAqE;YACrE,iDAAiD;YACjD,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAChF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACpC,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,IAAI,mDAAmD;oBAC/E,IAAI,GAAG,4DAA4D,CACtE,CAAC;YACJ,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAe,EAAE,EAAE,CAC3D,CAAC,MAAM,OAAO,CACZ,GAAG,IAAI,gBAAgB,SAAS,OAAO,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEzF;;;;;;;;OAQG;IACH,KAAK,UAAU,MAAM,CACnB,SAAiB,EAAE,GAAW,EAAE,KAAa,EAAE,KAAY,EAC3D,OAAiD,EAAE;QAEnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAC5B,QAAQ,IAAI,KAAK;YACf,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,MAAM;YACnF,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;QACzE,KAAK,MAAM,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnG,IAAI,CAAC,CAAC,EAAE;gBAAE,MAAM,OAAO,CAAC,GAAG,IAAI,gBAAgB,SAAS,QAAQ,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,MAAM,OAAO,CAAC,GAAG,IAAI,iBAAiB,SAAS,OAAO,IAAI,EAAE,EAAE;YAC5D,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM;YACpB,IAAI,EAAE;gBACJ,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;gBAC1D,GAAG,CAAC,QAAQ,IAAI,KAAK;oBACnB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC5B,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC;aAC3D;SACF,CAAC,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,MAAM,cAAc,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAe,EAAE,EAAE,CAClE,CAAC,MAAM,OAAO,CACZ,GAAG,IAAI,gBAAgB,SAAS,WAAW,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAClF,CAAC,CAAC,OAAO,CAAC;IAEb,mFAAmF;IACnF,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAc,EAAE,MAAe;QACzE,MAAM,OAAO,GAAG,CAAC,MAAM,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QACzF,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,OAAO,MAAM,OAAO,CAClB,GAAG,IAAI,iBAAiB,SAAS,WAAW,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC/E,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,CACjD,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,UAAU,MAAM,CACnB,IAAY,EACZ,IAAuF;QAEvF,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,MAAM,OAAO,CAClB,GAAG,IAAI,mBAAmB,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,aAAa,CAAC,CAAC,CAAC,aAAa,EAAE,EAC7F;YACE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM;YACpB,IAAI,EAAE;gBACJ,IAAI;gBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/C,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE;aACxD;SACF,CACF,CAAC;IACJ,CAAC;IAED,uEAAuE;IACvE,MAAM,OAAO,GAAG,KAAK,EAAE,SAAiB,EAAE,YAAoB,EAAE,MAAe,EAAE,EAAE,CACjF,MAAM,OAAO,CACX,GAAG,IAAI,iBAAiB,SAAS,YAAY,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC/F,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CACzB,CAAC;IAEJ,MAAM,kBAAkB,GAAG,KAAK,EAAE,SAAiB,EAAE,MAAe,EAAE,EAAE,CACtE,CAAC,MAAM,OAAO,CACZ,GAAG,IAAI,gBAAgB,SAAS,uBAAuB,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAC9F,CAAC,CAAC,YAAY,CAAC;IAElB;;;;;OAKG;IACH,KAAK,UAAU,uBAAuB,CACpC,SAAiB,EAAE,IAAY,EAAE,MAAe;QAEhD,MAAM,KAAK,GAAG,CAAC,MAAM,kBAAkB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QACzF,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QACxB,OAAO,MAAM,OAAO,CAClB,GAAG,IAAI,gBAAgB,SAAS,uBAAuB,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAC1F,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CACzC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ;QACR,WAAW;QACX,MAAM;QACN,aAAa;QACb,cAAc;QACd,SAAS;QACT,MAAM;QACN,OAAO;QACP,OAAO;QACP,kBAAkB;QAClB,uBAAuB;QACvB,MAAM;QACN,WAAW,EAAE,KAAK,EAAE,SAAkB,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,CACnD,CAAC,MAAM,OAAO,CACZ,GAAG,IAAI,yBAAyB,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,cAAc,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;QAEzG,KAAK,CAAC,MAAM;YACV,OAAO,KAAK,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBAChC,MAAM,CAAC,GAAG,MAAM,QAAQ,EAAE,CAAC;gBAC3B,OAAO,GAAG,CAAC,CAAC,MAAM,WAAW,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3D,CAAC,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM;YACV,OAAO,WAAW,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE;gBACtC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,MAAM,OAAO,CAE/B,GAAG,IAAI,yBAAyB,EAAE,CAAC,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;gBAC/D,OAAO;oBACL,QAAQ,EAAE,QAAiB;oBAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;oBAC1E,GAAG,EAAE,KAAK;wBACR,CAAC,CAAC;4BACE,mCAAmC,KAAK,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;4BACxE,yCAAyC;4BACzC,8CAA8C;4BAC9C,8CAA8C;yBAC/C;wBACH,CAAC,CAAC,CAAC,kCAAkC,CAAC;oBACxC,KAAK,EAAE;wBACL,UAAU,CAAC,CAAC,IAAI,cAAc,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;wBAChF,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB;wBAC/F,2EAA2E;qBAC5E;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/syncenv.d.ts

@@ -0,0 +1,12 @@
+import { type RunContext } from "./run.ts";
+import { type Environment } from "../config/environments.ts";
+import type { Run } from "./provision.ts";
+export interface SyncSpec {
+    /** The app, which names both the vault folder and the Vercel project. */
+    app: string;
+    environment: Environment;
+}
+/** Where an app's values for one environment live. */
+export declare const folderFor: (app: string, environment: Environment) => string;
+export declare function syncEnv(spec: SyncSpec, ctx: RunContext): Promise<Run>;
+//# sourceMappingURL=syncenv.d.ts.map

package/dist/admin/syncenv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncenv.d.ts","sourceRoot":"","sources":["../../src/admin/syncenv.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAW,KAAK,UAAU,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAW,KAAK,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,KAAK,EAAE,GAAG,EAAc,MAAM,gBAAgB,CAAC;AAEtD,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,WAAW,CAAC;CAC1B;AAED,sDAAsD;AACtD,eAAO,MAAM,SAAS,GAAI,KAAK,MAAM,EAAE,aAAa,WAAW,WACV,CAAC;AAEtD,wBAAsB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,CAmG3E"}

package/dist/admin/syncenv.js

@@ -0,0 +1,114 @@
+/**
+ * Pushing an app's environment from the vault to Vercel.
+ *
+ * The vault is the source. A deployment reads Vercel's own store, so the two
+ * have to be made to agree, and this is the direction that agreement travels:
+ * every key under `heychunky-apps/<environment>/<app>/` is written to the
+ * Vercel scope that environment deploys to.
+ *
+ * **Always push, never diff.** Vercel writes these as `sensitive`, so no one
+ * can read them back — not the dashboard, not the API, not us. "Has this value
+ * changed?" is therefore unanswerable, and a sync that tried to answer it would
+ * be guessing. Pushing every time is instead safe to repeat, and the only
+ * drift that *can* be reported honestly is a name: present, or stray.
+ *
+ * Without `confirmed` this plans, for the same reason provisioning does — the
+ * plan comes from the same walk as the run, so it cannot disagree with it.
+ */
+import { vercel } from "./services/vercel.js";
+import { KEY_FOR } from "./run.js";
+import { DEPLOYS } from "../config/environments.js";
+/** Where an app's values for one environment live. */
+export const folderFor = (app, environment) => `infisical://heychunky-apps/${environment}/${app}/`;
+export async function syncEnv(spec, ctx) {
+    const steps = [];
+    const planned = !ctx.confirmed;
+    const done = () => ({
+        app: spec.app,
+        planned,
+        steps,
+        ok: !steps.some((s) => s.state === "failed"),
+    });
+    const fail = (step, detail) => {
+        steps.push({ step, state: "failed", detail });
+        return done();
+    };
+    const where = DEPLOYS[spec.environment];
+    if (!where) {
+        return fail("environment", `${spec.environment} never deploys — it is a machine, reached by heychunky run`);
+    }
+    const vc = vercel(await ctx.secrets.get(ctx.reference(KEY_FOR["vercel"])));
+    const project = await vc.findProject(spec.app);
+    if (!project)
+        return fail("vercel project", `no Vercel project for ${spec.app}`);
+    steps.push({ step: "vercel project", state: "exists", detail: project.name });
+    const teamId = await vc.teamId();
+    // A custom environment is created even when planning would not create
+    // anything else: without it there is no scope to report against, and it
+    // holds no values of its own.
+    let scope;
+    if ("target" in where) {
+        scope = { target: where.target };
+        steps.push({ step: "target", state: "exists", detail: where.target });
+    }
+    else {
+        const existing = (await vc.customEnvironments(project.id, teamId))
+            .find((e) => e.slug === where.customEnvironment);
+        if (existing) {
+            scope = { customEnvironmentId: existing.id };
+            steps.push({ step: "custom environment", state: "exists", detail: existing.slug });
+        }
+        else if (planned) {
+            steps.push({
+                step: "custom environment", state: "would-create", detail: where.customEnvironment,
+            });
+            scope = undefined;
+        }
+        else {
+            const made = await vc.ensureCustomEnvironment(project.id, where.customEnvironment, teamId);
+            scope = { customEnvironmentId: made.id };
+            steps.push({ step: "custom environment", state: "created", detail: made.slug });
+        }
+    }
+    const values = await ctx.secrets.list(folderFor(spec.app, spec.environment));
+    const keys = Object.keys(values).sort();
+    if (!keys.length) {
+        steps.push({
+            step: "vault",
+            state: "exists",
+            detail: `nothing at heychunky-apps/${spec.environment}/${spec.app}`,
+        });
+        return done();
+    }
+    // Names already on the project, so a plan can say which are new. Values are
+    // never compared, because they cannot be read.
+    const present = new Set((await vc.envVars(project.id, teamId))
+        .filter((e) => ("target" in where
+        ? (e.target ?? []).includes(where.target)
+        : e.customEnvironmentIds?.length))
+        .map((e) => e.key));
+    for (const key of keys) {
+        if (planned || !scope) {
+            steps.push({
+                step: key,
+                state: present.has(key) ? "exists" : "would-create",
+                detail: present.has(key) ? "would be replaced" : "would be set",
+            });
+            continue;
+        }
+        try {
+            await vc.setEnv(project.id, key, values[key], scope, { teamId });
+            steps.push({ step: key, state: "created", detail: present.has(key) ? "replaced" : "set" });
+        }
+        catch (err) {
+            return fail(key, err instanceof Error ? err.message : String(err));
+        }
+    }
+    // Reported, never removed: a name Vercel has and the vault does not may be
+    // set by a platform integration, and deleting it is not this tool's call.
+    for (const key of [...present].filter((k) => !(k in values)).sort()) {
+        steps.push({ step: key, state: "exists", detail: "stray — on Vercel, not in the vault" });
+    }
+    return done();
+}
+//# sourceMappingURL=syncenv.js.map

package/dist/admin/syncenv.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"syncenv.js","sourceRoot":"","sources":["../../src/admin/syncenv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAmB,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,OAAO,EAAoB,MAAM,2BAA2B,CAAC;AAStE,sDAAsD;AACtD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,WAAwB,EAAE,EAAE,CACjE,8BAA8B,WAAW,IAAI,GAAG,GAAG,CAAC;AAEtD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,GAAe;IAC3D,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC;IAC/B,MAAM,IAAI,GAAG,GAAQ,EAAE,CAAC,CAAC;QACvB,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,OAAO;QACP,KAAK;QACL,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC;KAC7C,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,MAAc,EAAO,EAAE;QACjD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC9C,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,IAAI,CACT,aAAa,EACb,GAAG,IAAI,CAAC,WAAW,4DAA4D,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,gBAAgB,EAAE,yBAAyB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9E,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC;IAEjC,sEAAsE;IACtE,wEAAwE;IACxE,8BAA8B;IAC9B,IAAI,KAAK,CAAC;IACV,IAAI,QAAQ,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;aAC/D,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACnD,IAAI,QAAQ,EAAE,CAAC;YACb,KAAK,GAAG,EAAE,mBAAmB,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;aAAM,IAAI,OAAO,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,iBAAiB;aACnF,CAAC,CAAC;YACH,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,uBAAuB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;YAC3F,KAAK,GAAG,EAAE,mBAAmB,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YACzC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,OAAO;YACb,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,6BAA6B,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,GAAG,EAAE;SACpE,CAAC,CAAC;QACH,OAAO,IAAI,EAAE,CAAC;IAChB,CAAC;IAED,4EAA4E;IAC5E,+CAA+C;IAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,CACrB,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SACnC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,IAAI,KAAK;QAC/B,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACzC,CAAC,CAAC,CAAC,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CACrB,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACtB,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,GAAG;gBACT,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;gBACnD,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,cAAc;aAChE,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,CAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACpE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,IAAI,EAAE,CAAC;AAChB,CAAC"}

package/dist/admin/users.d.ts

@@ -0,0 +1,27 @@
+import type { RunContext } from "./run.ts";
+export type Role = "superadmin" | "developer";
+export interface User {
+    id: string;
+    email: string;
+    name: string | null;
+    role: Role;
+    created_at: string;
+}
+export declare class DuplicateUserError extends Error {
+    constructor(email: string);
+}
+/**
+ * Create an account.
+ *
+ * The address is stored as given and matched without case, which is what the
+ * unique index on `lower(email)` enforces — one person, one account, however
+ * they typed it.
+ */
+export declare function inviteUser(invite: {
+    email: string;
+    name?: string | undefined;
+    role?: Role;
+}, ctx: RunContext): Promise<User>;
+/** Everyone with an account. Never their sessions or codes. */
+export declare function listUsers(ctx: RunContext): Promise<User[]>;
+//# sourceMappingURL=users.d.ts.map

package/dist/admin/users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/admin/users.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3C,MAAM,MAAM,IAAI,GAAG,YAAY,GAAG,WAAW,CAAC;AAE9C,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,IAAI,EAAE,IAAI,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;;GAMG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,IAAI,CAAA;CAAE,EACjE,GAAG,EAAE,UAAU,GACd,OAAO,CAAC,IAAI,CAAC,CAef;AAED,+DAA+D;AAC/D,wBAAsB,SAAS,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAMhE"}

package/dist/admin/users.js

@@ -0,0 +1,48 @@
+/**
+ * Who may use the factory.
+ *
+ * Accounts are made, never self-served. Provisioning creates real
+ * repositories, databases and projects in the factory's accounts and on its
+ * bill, so an open sign-up form would let a stranger spend someone else's
+ * money. Opening it later is a decision; un-provisioning what strangers made
+ * is not.
+ *
+ * There is exactly one superadmin, and the database says so rather than this
+ * file — a partial unique index on the role. Inviting a second is refused by
+ * Postgres, which is the only place a rule like that survives a rewrite.
+ */
+import { master } from "./master.js";
+export class DuplicateUserError extends Error {
+    constructor(email) {
+        super(`${email} already has an account`);
+        this.name = "DuplicateUserError";
+    }
+}
+/**
+ * Create an account.
+ *
+ * The address is stored as given and matched without case, which is what the
+ * unique index on `lower(email)` enforces — one person, one account, however
+ * they typed it.
+ */
+export async function inviteUser(invite, ctx) {
+    const email = invite.email.trim();
+    if (!email.includes("@"))
+        throw new Error(`Not an email address: ${email}`);
+    const conn = await master(ctx);
+    const { rows } = await conn.write(`insert into users (email, name, role) values ($1, $2, $3)
+     on conflict do nothing
+     returning id, email, name, role, created_at`, [email, invite.name ?? null, invite.role ?? "developer"]);
+    // `on conflict do nothing` returns nothing when the address is taken. Saying
+    // so is better than a second account or a silent no-op.
+    if (!rows.length)
+        throw new DuplicateUserError(email);
+    return rows[0];
+}
+/** Everyone with an account. Never their sessions or codes. */
+export async function listUsers(ctx) {
+    const conn = await master(ctx);
+    const { rows } = await conn.query("select id, email, name, role, created_at from users order by created_at");
+    return rows;
+}
+//# sourceMappingURL=users.js.map

package/dist/admin/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/admin/users.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAarC,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,KAAa;QACvB,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAiE,EACjE,GAAe;IAEf,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,EAAE,CAAC,CAAC;IAE5E,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B;;iDAE6C,EAC7C,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,CACzD,CAAC;IACF,6EAA6E;IAC7E,wDAAwD;IACxD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC,CAAC,CAAoB,CAAC;AACpC,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAe;IAC7C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAC/B,yEAAyE,CAC1E,CAAC;IACF,OAAO,IAAyB,CAAC;AACnC,CAAC"}

package/dist/config/environments.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The environments every app has.
+ *
+ * One list, because three systems have to agree on it and the cost of them
+ * disagreeing is a database that exists with no credential pointing at it, or a
+ * credential pointing at a database that was never made:
+ *
+ *   Neon       one branch per environment
+ *   Infisical  one folder per environment, holding that branch's DATABASE_URL
+ *   Vercel     three of these are deployed, and three are only ever local
+ *
+ * `production` is Neon's default branch, which it calls `main`. The other five
+ * are branched from it, so every environment starts as a copy-on-write clone of
+ * production rather than an empty database that drifts.
+ *
+ * Which of them a deployment reaches:
+ *
+ *   production  Vercel production, from the `production` git branch
+ *   staging     a Vercel custom environment — stable enough to show a client,
+ *               so no pull request may write to it
+ *   dev         Vercel preview, from `main`. Every preview shares it
+ *
+ * The rest never deploy. `local1` and `local2` are other developers' machines
+ * and `agents` is Chunky's, each reached by `heychunky run` and nothing else.
+ */
+export declare const ENVIRONMENTS: readonly ["production", "staging", "dev", "local1", "local2", "agents"];
+export type Environment = (typeof ENVIRONMENTS)[number];
+/** Neon's name for the default branch, which holds production. */
+export declare const DEFAULT_BRANCH = "main";
+/** The environments that need a branch creating. Production already has one. */
+export declare const BRANCHED: readonly Environment[];
+/**
+ * How a deployed environment is addressed on Vercel.
+ *
+ * Absent means it never deploys: `local1`, `local2` and `agents` are machines,
+ * reached by `heychunky run`. Nothing may push a value to them, which is why
+ * this is a lookup rather than a mapping over every environment.
+ *
+ * `staging` names a custom environment rather than a target because Vercel has
+ * only three targets and staging is shown to clients — sharing `preview` with
+ * every pull request would let one break it.
+ */
+export declare const DEPLOYS: Partial<Record<Environment, {
+    target: "production" | "preview";
+} | {
+    customEnvironment: string;
+}>>;
+/** The environments a deployment ever reads. */
+export declare const DEPLOYED: readonly Environment[];
+//# sourceMappingURL=environments.d.ts.map

package/dist/config/environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.d.ts","sourceRoot":"","sources":["../../src/config/environments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,eAAO,MAAM,YAAY,yEAaf,CAAC;AAEX,MAAM,MAAM,WAAW,GAAG,CAAC,OAAO,YAAY,CAAC,CAAC,MAAM,CAAC,CAAC;AAExD,kEAAkE;AAClE,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC,gFAAgF;AAChF,eAAO,MAAM,QAAQ,EAAE,SAAS,WAAW,EAAmD,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,eAAO,MAAM,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE;IAAE,MAAM,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,GAAG;IAAE,iBAAiB,EAAE,MAAM,CAAA;CAAE,CAAC,CAItH,CAAC;AAEF,gDAAgD;AAChD,eAAO,MAAM,QAAQ,EAAE,SAAS,WAAW,EAA6C,CAAC"}

package/dist/config/environments.js

@@ -0,0 +1,62 @@
+/**
+ * The environments every app has.
+ *
+ * One list, because three systems have to agree on it and the cost of them
+ * disagreeing is a database that exists with no credential pointing at it, or a
+ * credential pointing at a database that was never made:
+ *
+ *   Neon       one branch per environment
+ *   Infisical  one folder per environment, holding that branch's DATABASE_URL
+ *   Vercel     three of these are deployed, and three are only ever local
+ *
+ * `production` is Neon's default branch, which it calls `main`. The other five
+ * are branched from it, so every environment starts as a copy-on-write clone of
+ * production rather than an empty database that drifts.
+ *
+ * Which of them a deployment reaches:
+ *
+ *   production  Vercel production, from the `production` git branch
+ *   staging     a Vercel custom environment — stable enough to show a client,
+ *               so no pull request may write to it
+ *   dev         Vercel preview, from `main`. Every preview shares it
+ *
+ * The rest never deploy. `local1` and `local2` are other developers' machines
+ * and `agents` is Chunky's, each reached by `heychunky run` and nothing else.
+ */
+export const ENVIRONMENTS = [
+    /** Live. Neon's default branch. */
+    "production",
+    /** Shown to clients. Stable, and no pull request writes to it. */
+    "staging",
+    /** What every preview deployment runs against, built from `main`. */
+    "dev",
+    /** A second developer, locally. */
+    "local1",
+    /** A third. */
+    "local2",
+    /** Where Chunky works on features without touching anyone's branch. */
+    "agents",
+];
+/** Neon's name for the default branch, which holds production. */
+export const DEFAULT_BRANCH = "main";
+/** The environments that need a branch creating. Production already has one. */
+export const BRANCHED = ENVIRONMENTS.filter((e) => e !== "production");
+/**
+ * How a deployed environment is addressed on Vercel.
+ *
+ * Absent means it never deploys: `local1`, `local2` and `agents` are machines,
+ * reached by `heychunky run`. Nothing may push a value to them, which is why
+ * this is a lookup rather than a mapping over every environment.
+ *
+ * `staging` names a custom environment rather than a target because Vercel has
+ * only three targets and staging is shown to clients — sharing `preview` with
+ * every pull request would let one break it.
+ */
+export const DEPLOYS = {
+    production: { target: "production" },
+    staging: { customEnvironment: "staging" },
+    dev: { target: "preview" },
+};
+/** The environments a deployment ever reads. */
+export const DEPLOYED = ENVIRONMENTS.filter((e) => e in DEPLOYS);
+//# sourceMappingURL=environments.js.map

package/dist/config/environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environments.js","sourceRoot":"","sources":["../../src/config/environments.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,mCAAmC;IACnC,YAAY;IACZ,kEAAkE;IAClE,SAAS;IACT,qEAAqE;IACrE,KAAK;IACL,mCAAmC;IACnC,QAAQ;IACR,eAAe;IACf,QAAQ;IACR,uEAAuE;IACvE,QAAQ;CACA,CAAC;AAIX,kEAAkE;AAClE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC;AAErC,gFAAgF;AAChF,MAAM,CAAC,MAAM,QAAQ,GAA2B,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC;AAE/F;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,OAAO,GAAuG;IACzH,UAAU,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE;IACpC,OAAO,EAAE,EAAE,iBAAiB,EAAE,SAAS,EAAE;IACzC,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;CAC3B,CAAC;AAEF,gDAAgD;AAChD,MAAM,CAAC,MAAM,QAAQ,GAA2B,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC"}

package/dist/config/names.d.ts

@@ -0,0 +1,45 @@
+/**
+ * How an app's name maps onto the names providers actually use.
+ *
+ * There is no single right answer, because providers were named by hand over
+ * years and disagree with each other. Today, for the same estate:
+ *
+ *   delters.com    → Vercel project "delters"        (bare name)
+ *   carmelcity.ai  → Vercel project "carmelcity-ai"  (dots to hyphens)
+ *
+ * So a lookup cannot slug one way and hope. It generates the forms a provider
+ * plausibly used and tries them in order of how likely they are to be right.
+ *
+ * The previous rule stripped every non-alphanumeric character, turning
+ * "delters.com" into "delterscom" — which matched nothing, ever. `sync-env`
+ * therefore never found a project for any app, and the apps report claimed
+ * there were no Vercel projects while eleven existed.
+ */
+/**
+ * The product name without its domain suffix.
+ * `delters.com` → `delters`, `carmel.city` → `carmel`, `heychunky` → `heychunky`.
+ */
+export declare function baseName(app: string): string;
+/**
+ * Every form a provider might have used for this app, most likely first.
+ * Deduplicated, so a name with no dot yields exactly one candidate.
+ *
+ *   carmelcity.ai → ["carmelcity-ai", "carmelcity", "carmelcityai"]
+ *   delters.com   → ["delters-com", "delters", "delterscom"]
+ *   heychunky     → ["heychunky"]
+ */
+export declare function nameCandidates(app: string): string[];
+/**
+ * Find the entry whose name matches this app, preferring earlier candidates.
+ * Returns undefined rather than throwing — a missing project is a normal
+ * state during provisioning, not an error.
+ */
+export declare function matchByName<T>(app: string, items: readonly T[], nameOf: (item: T) => string): T | undefined;
+/** The app's storage zone names on Bunny: `<base>` and `<base>-private`. */
+export declare function zoneNames(app: string): {
+    public: string;
+    private: string;
+};
+/** Subdomains the factory attaches to an app's domain. */
+export declare function subdomains(domain: string): Record<string, string>;
+//# sourceMappingURL=names.d.ts.map

package/dist/config/names.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"names.d.ts","sourceRoot":"","sources":["../../src/config/names.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAG5C;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAKpD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAC3B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,SAAS,CAAC,EAAE,EACnB,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,MAAM,GAC1B,CAAC,GAAG,SAAS,CAOf;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAG1E;AAED,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAOjE"}