@infracraft/pulumi 0.1.0

package/dist/vercel/variable.d.cts

@@ -0,0 +1,55 @@
+import { t as __name } from "../chunk-OPjESj5l.cjs";
+import * as pulumi from "@pulumi/pulumi";
+
+//#region src/vercel/variable.d.ts
+/** Resolved inputs for the Vercel variable dynamic provider. */
+interface VercelVariableInputs {
+  /** Vercel API bearer token. */
+  token: string;
+  /** Vercel team/org ID. */
+  teamId: string;
+  /** Vercel project ID. */
+  projectId: string;
+  /** Key-value map of environment variable names to their values. */
+  variables: Record<string, string>;
+}
+/**
+ * Manages Vercel project environment variables as a batch with drift detection.
+ *
+ * Unlike `@pulumiverse/vercel`'s `ProjectEnvironmentVariable`, this provider
+ * reads decrypted values from Vercel's API during `pulumi refresh`, enabling
+ * detection of manually changed env var values.
+ *
+ * All variables target production, preview, and development environments.
+ *
+ * @example
+ * ```typescript
+ * new VercelVariable("vercel-variable-nexus", {
+ *   token: vercelConfig.token,
+ *   teamId: vercelConfig.teamId,
+ *   projectId: project.id,
+ *   variables: {
+ *     NEXT_PUBLIC_API_URL: meshUrl,
+ *     NEXTAUTH_SECRET: config.requireSecret("nextauthSecret"),
+ *   },
+ * });
+ * ```
+ */
+declare class VercelVariable extends pulumi.dynamic.Resource {
+  /** SHA-256 hash of all key-value pairs. Use as a deploy trigger for drift-aware redeployment. */
+  readonly contentHash: pulumi.Output<string>;
+  /**
+   * @param name Pulumi resource name
+   * @param args Variable configuration inputs
+   * @param opts Standard Pulumi resource options
+   */
+  constructor(name: string, args: {
+    /** Vercel API bearer token. */token: pulumi.Input<string>; /** Vercel team/org ID. */
+    teamId: pulumi.Input<string>; /** Vercel project ID. */
+    projectId: pulumi.Input<string>; /** Key-value map of environment variable names to their values. */
+    variables: pulumi.Input<Record<string, pulumi.Input<string>>>;
+  }, opts?: pulumi.CustomResourceOptions);
+}
+//#endregion
+export { VercelVariable, VercelVariableInputs };
+//# sourceMappingURL=variable.d.cts.map

package/dist/vercel/variable.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable.d.cts","names":[],"sources":["../../src/vercel/variable.ts"],"mappings":";;;;;UAKiB,oBAAA;;EAEhB,KAAA;EAFoC;EAKpC,MAAA;EAMiB;EAHjB,SAAA;EAHA;EAMA,SAAA,EAAW,MAAM;AAAA;;;AAAA;AA8alB;;;;;;;;;;;;;;;;;;;cAAa,cAAA,SAAuB,MAAA,CAAO,OAAA,CAAQ,QAAA;;WAE1B,WAAA,EAAa,MAAA,CAAO,MAAA;EAW1C;;;;;cAHD,IAAA,UACA,IAAA;IAQC,+BANA,KAAA,EAAO,MAAA,CAAO,KAAA,UAMI;IAHlB,MAAA,EAAQ,MAAA,CAAO,KAAA,UAMJ;IAHX,SAAA,EAAW,MAAA,CAAO,KAAA,UAGM;IAAxB,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,MAAA,SAAe,MAAA,CAAO,KAAA;EAAA,GAE/C,IAAA,GAAO,MAAA,CAAO,qBAAA;AAAA"}

package/dist/vercel/variable.d.mts

@@ -0,0 +1,55 @@
+import { t as __name } from "../chunk-OPjESj5l.mjs";
+import * as pulumi from "@pulumi/pulumi";
+
+//#region src/vercel/variable.d.ts
+/** Resolved inputs for the Vercel variable dynamic provider. */
+interface VercelVariableInputs {
+  /** Vercel API bearer token. */
+  token: string;
+  /** Vercel team/org ID. */
+  teamId: string;
+  /** Vercel project ID. */
+  projectId: string;
+  /** Key-value map of environment variable names to their values. */
+  variables: Record<string, string>;
+}
+/**
+ * Manages Vercel project environment variables as a batch with drift detection.
+ *
+ * Unlike `@pulumiverse/vercel`'s `ProjectEnvironmentVariable`, this provider
+ * reads decrypted values from Vercel's API during `pulumi refresh`, enabling
+ * detection of manually changed env var values.
+ *
+ * All variables target production, preview, and development environments.
+ *
+ * @example
+ * ```typescript
+ * new VercelVariable("vercel-variable-nexus", {
+ *   token: vercelConfig.token,
+ *   teamId: vercelConfig.teamId,
+ *   projectId: project.id,
+ *   variables: {
+ *     NEXT_PUBLIC_API_URL: meshUrl,
+ *     NEXTAUTH_SECRET: config.requireSecret("nextauthSecret"),
+ *   },
+ * });
+ * ```
+ */
+declare class VercelVariable extends pulumi.dynamic.Resource {
+  /** SHA-256 hash of all key-value pairs. Use as a deploy trigger for drift-aware redeployment. */
+  readonly contentHash: pulumi.Output<string>;
+  /**
+   * @param name Pulumi resource name
+   * @param args Variable configuration inputs
+   * @param opts Standard Pulumi resource options
+   */
+  constructor(name: string, args: {
+    /** Vercel API bearer token. */token: pulumi.Input<string>; /** Vercel team/org ID. */
+    teamId: pulumi.Input<string>; /** Vercel project ID. */
+    projectId: pulumi.Input<string>; /** Key-value map of environment variable names to their values. */
+    variables: pulumi.Input<Record<string, pulumi.Input<string>>>;
+  }, opts?: pulumi.CustomResourceOptions);
+}
+//#endregion
+export { VercelVariable, VercelVariableInputs };
+//# sourceMappingURL=variable.d.mts.map

package/dist/vercel/variable.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable.d.mts","names":[],"sources":["../../src/vercel/variable.ts"],"mappings":";;;;;UAKiB,oBAAA;;EAEhB,KAAA;EAFoC;EAKpC,MAAA;EAMiB;EAHjB,SAAA;EAHA;EAMA,SAAA,EAAW,MAAM;AAAA;;;AAAA;AA8alB;;;;;;;;;;;;;;;;;;;cAAa,cAAA,SAAuB,MAAA,CAAO,OAAA,CAAQ,QAAA;;WAE1B,WAAA,EAAa,MAAA,CAAO,MAAA;EAW1C;;;;;cAHD,IAAA,UACA,IAAA;IAQC,+BANA,KAAA,EAAO,MAAA,CAAO,KAAA,UAMI;IAHlB,MAAA,EAAQ,MAAA,CAAO,KAAA,UAMJ;IAHX,SAAA,EAAW,MAAA,CAAO,KAAA,UAGM;IAAxB,SAAA,EAAW,MAAA,CAAO,KAAA,CAAM,MAAA,SAAe,MAAA,CAAO,KAAA;EAAA,GAE/C,IAAA,GAAO,MAAA,CAAO,qBAAA;AAAA"}

package/dist/vercel/variable.mjs

@@ -0,0 +1,278 @@
+import { t as __name } from "../chunk-OPjESj5l.mjs";
+import * as pulumi from "@pulumi/pulumi";
+
+//#region src/vercel/variable.ts
+const VERCEL_API_URL = "https://api.vercel.com";
+/**
+* Computes a deterministic content hash of a variables map.
+* Uses dynamic import to avoid capturing `crypto` in the provider closure.
+*
+* @param variables Key-value map of environment variables
+* @returns Hex-encoded SHA-256 hash
+*/
+async function hashVariables(variables) {
+	const hash = (await import("node:crypto")).createHash("sha256");
+	const sorted = Object.entries(variables).sort(([a], [b]) => a.localeCompare(b));
+	for (const [key, value] of sorted) {
+		hash.update(key);
+		hash.update(value);
+	}
+	return hash.digest("hex");
+}
+/**
+* Fetches all environment variables for a Vercel project with decrypted values.
+*
+* @param token Vercel API token
+* @param teamId Vercel team ID
+* @param projectId Vercel project ID
+* @returns Array of env vars with decrypted values
+*/
+async function fetchEnvVars(token, teamId, projectId) {
+	const listResponse = await fetch(`${VERCEL_API_URL}/v9/projects/${projectId}/env?teamId=${teamId}`, { headers: { Authorization: `Bearer ${token}` } });
+	if (!listResponse.ok) throw new Error(`Vercel API error (${listResponse.status}): ${await listResponse.text()}`);
+	const list = await listResponse.json();
+	const decrypted = [];
+	for (const env of list.envs) {
+		const response = await fetch(`${VERCEL_API_URL}/v9/projects/${projectId}/env/${env.id}?teamId=${teamId}&decrypt=true`, { headers: { Authorization: `Bearer ${token}` } });
+		if (response.ok) decrypted.push(await response.json());
+	}
+	return decrypted;
+}
+/**
+* Creates a single Vercel env var targeting all environments.
+*
+* @param token Vercel API token
+* @param teamId Vercel team ID
+* @param projectId Vercel project ID
+* @param key Env var name
+* @param value Env var value
+* @returns The created env var with its Vercel-assigned ID
+*/
+async function createEnvVar(token, teamId, projectId, key, value) {
+	const response = await fetch(`${VERCEL_API_URL}/v10/projects/${projectId}/env?teamId=${teamId}`, {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({
+			key,
+			value,
+			type: "encrypted",
+			target: [
+				"production",
+				"preview",
+				"development"
+			]
+		})
+	});
+	if (!response.ok) {
+		const errorText = await response.text();
+		if (errorText.includes("ENV_CONFLICT")) {
+			pulumi.log.info(`Vercel env var "${key}" already exists, will update instead`);
+			const match = (await fetchEnvVars(token, teamId, projectId)).find((e) => e.key === key);
+			if (match) {
+				await updateEnvVar(token, teamId, projectId, match.id, value);
+				return {
+					...match,
+					value
+				};
+			}
+		}
+		throw new Error(`Vercel API error creating "${key}" (${response.status}): ${errorText}`);
+	}
+	return await response.json();
+}
+/**
+* Updates a single Vercel env var value.
+*
+* @param token Vercel API token
+* @param teamId Vercel team ID
+* @param projectId Vercel project ID
+* @param envId Vercel-assigned env var ID
+* @param value New value
+*/
+async function updateEnvVar(token, teamId, projectId, envId, value) {
+	const response = await fetch(`${VERCEL_API_URL}/v9/projects/${projectId}/env/${envId}?teamId=${teamId}`, {
+		method: "PATCH",
+		headers: {
+			Authorization: `Bearer ${token}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ value })
+	});
+	if (!response.ok) throw new Error(`Vercel API error updating env var (${response.status}): ${await response.text()}`);
+}
+/**
+* Deletes a single Vercel env var.
+*
+* @param token Vercel API token
+* @param teamId Vercel team ID
+* @param projectId Vercel project ID
+* @param envId Vercel-assigned env var ID
+*/
+async function deleteEnvVar(token, teamId, projectId, envId) {
+	const response = await fetch(`${VERCEL_API_URL}/v9/projects/${projectId}/env/${envId}?teamId=${teamId}`, {
+		method: "DELETE",
+		headers: { Authorization: `Bearer ${token}` }
+	});
+	if (!response.ok && response.status !== 404) throw new Error(`Vercel API error deleting env var (${response.status}): ${await response.text()}`);
+}
+/**
+* Dynamic provider implementing CRUD for Vercel project environment variables.
+*
+* Manages all env vars for a project as a batch (like RailwayVariable).
+* The `read()` method fetches decrypted values from Vercel's API,
+* enabling drift detection during `pulumi refresh`.
+*/
+var VercelVariableProvider = class {
+	/**
+	* Creates all env vars on the target Vercel project.
+	* Handles ENV_CONFLICT by updating existing vars instead of failing.
+	*
+	* @param inputs Resolved variable configuration
+	* @returns Composite ID in the form `{projectId}:variables`
+	*/
+	async create(inputs) {
+		const envIds = {};
+		for (const [key, value] of Object.entries(inputs.variables)) envIds[key] = (await createEnvVar(inputs.token, inputs.teamId, inputs.projectId, key, value)).id;
+		return {
+			id: `${inputs.projectId}:variables`,
+			outs: {
+				...inputs,
+				envIds,
+				contentHash: await hashVariables(inputs.variables)
+			}
+		};
+	}
+	/**
+	* Updates variables by deleting removed keys, creating new keys,
+	* and patching changed values.
+	*
+	* @param _id Current resource ID
+	* @param olds Previous persisted state
+	* @param news New desired configuration
+	* @returns Updated outputs with current envIds
+	*/
+	async update(_id, olds, news) {
+		const envIds = { ...olds.envIds };
+		const removedKeys = Object.keys(olds.variables).filter((key) => !(key in news.variables));
+		for (const key of removedKeys) {
+			const envId = envIds[key];
+			if (envId) {
+				try {
+					await deleteEnvVar(news.token, news.teamId, news.projectId, envId);
+				} catch {
+					pulumi.log.warn(`Failed to delete Vercel env var "${key}" (may already be deleted)`);
+				}
+				delete envIds[key];
+			}
+		}
+		for (const [key, value] of Object.entries(news.variables)) {
+			const existingId = envIds[key];
+			if (existingId && olds.variables[key] !== value) await updateEnvVar(news.token, news.teamId, news.projectId, existingId, value);
+			else if (!existingId) envIds[key] = (await createEnvVar(news.token, news.teamId, news.projectId, key, value)).id;
+		}
+		return { outs: {
+			...news,
+			envIds,
+			contentHash: await hashVariables(news.variables)
+		} };
+	}
+	/**
+	* Reads current state from Vercel API with decrypted values.
+	* Enables drift detection during `pulumi refresh`.
+	*
+	* @param id Current resource ID
+	* @param props Last known persisted state
+	* @returns Refreshed properties with actual values from Vercel
+	*/
+	async read(id, props) {
+		const actual = await fetchEnvVars(props.token, props.teamId, props.projectId);
+		const actualVariables = {};
+		const actualEnvIds = {};
+		for (const [key] of Object.entries(props.variables)) {
+			const match = actual.find((e) => e.key === key);
+			if (match) {
+				actualVariables[key] = match.value;
+				actualEnvIds[key] = match.id;
+			}
+		}
+		return {
+			id,
+			props: {
+				...props,
+				variables: actualVariables,
+				envIds: actualEnvIds,
+				contentHash: await hashVariables(actualVariables)
+			}
+		};
+	}
+	/**
+	* Deletes all managed env vars from Vercel.
+	*
+	* @param _id Current resource ID
+	* @param props Last known persisted state
+	*/
+	async delete(_id, props) {
+		for (const [key, envId] of Object.entries(props.envIds)) try {
+			await deleteEnvVar(props.token, props.teamId, props.projectId, envId);
+		} catch {
+			pulumi.log.warn(`Failed to delete Vercel env var "${key}" (may already be deleted)`);
+		}
+	}
+	/**
+	* Compares old and new variable maps by key set and value equality.
+	*
+	* @param _id Current resource ID
+	* @param olds Previous persisted state
+	* @param news New desired configuration
+	* @returns Whether any keys or values changed
+	*/
+	async diff(_id, olds, news) {
+		const oldKeys = Object.keys(olds.variables).sort().join(",");
+		const newKeys = Object.keys(news.variables).sort().join(",");
+		const valuesChanged = Object.entries(news.variables).some(([key, value]) => olds.variables[key] !== value);
+		return { changes: oldKeys !== newKeys || valuesChanged };
+	}
+};
+/**
+* Manages Vercel project environment variables as a batch with drift detection.
+*
+* Unlike `@pulumiverse/vercel`'s `ProjectEnvironmentVariable`, this provider
+* reads decrypted values from Vercel's API during `pulumi refresh`, enabling
+* detection of manually changed env var values.
+*
+* All variables target production, preview, and development environments.
+*
+* @example
+* ```typescript
+* new VercelVariable("vercel-variable-nexus", {
+*   token: vercelConfig.token,
+*   teamId: vercelConfig.teamId,
+*   projectId: project.id,
+*   variables: {
+*     NEXT_PUBLIC_API_URL: meshUrl,
+*     NEXTAUTH_SECRET: config.requireSecret("nextauthSecret"),
+*   },
+* });
+* ```
+*/
+var VercelVariable = class extends pulumi.dynamic.Resource {
+	/**
+	* @param name Pulumi resource name
+	* @param args Variable configuration inputs
+	* @param opts Standard Pulumi resource options
+	*/
+	constructor(name, args, opts) {
+		super(new VercelVariableProvider(), name, {
+			...args,
+			envIds: void 0,
+			contentHash: void 0
+		}, opts);
+	}
+};
+
+//#endregion
+export { VercelVariable };
+//# sourceMappingURL=variable.mjs.map

package/dist/vercel/variable.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable.mjs","names":[],"sources":["../../src/vercel/variable.ts"],"sourcesContent":["import * as pulumi from \"@pulumi/pulumi\";\n\nconst VERCEL_API_URL = \"https://api.vercel.com\";\n\n/** Resolved inputs for the Vercel variable dynamic provider. */\nexport interface VercelVariableInputs {\n\t/** Vercel API bearer token. */\n\ttoken: string;\n\n\t/** Vercel team/org ID. */\n\tteamId: string;\n\n\t/** Vercel project ID. */\n\tprojectId: string;\n\n\t/** Key-value map of environment variable names to their values. */\n\tvariables: Record<string, string>;\n}\n\n/** Persisted state for Vercel variables. */\ninterface VercelVariableOutputs extends VercelVariableInputs {\n\t/** Map of env var keys to their Vercel-assigned IDs (for updates and deletes). */\n\tenvIds: Record<string, string>;\n\n\t/** SHA-256 hash of all key-value pairs. Changes when any value is modified (including drift fixes). */\n\tcontentHash: string;\n}\n\n/**\n * Computes a deterministic content hash of a variables map.\n * Uses dynamic import to avoid capturing `crypto` in the provider closure.\n *\n * @param variables Key-value map of environment variables\n * @returns Hex-encoded SHA-256 hash\n */\nasync function hashVariables(\n\tvariables: Record<string, string>,\n): Promise<string> {\n\tconst crypto = await import(\"node:crypto\");\n\tconst hash = crypto.createHash(\"sha256\");\n\n\tconst sorted = Object.entries(variables).sort(([a], [b]) =>\n\t\ta.localeCompare(b),\n\t);\n\n\tfor (const [key, value] of sorted) {\n\t\thash.update(key);\n\t\thash.update(value);\n\t}\n\n\treturn hash.digest(\"hex\");\n}\n\n/** Vercel API response for a single env var. */\ninterface VercelEnvVar {\n\tid: string;\n\tkey: string;\n\tvalue: string;\n\ttype: string;\n\ttarget: string[];\n}\n\n/**\n * Fetches all environment variables for a Vercel project with decrypted values.\n *\n * @param token Vercel API token\n * @param teamId Vercel team ID\n * @param projectId Vercel project ID\n * @returns Array of env vars with decrypted values\n */\nasync function fetchEnvVars(\n\ttoken: string,\n\tteamId: string,\n\tprojectId: string,\n): Promise<VercelEnvVar[]> {\n\tconst listResponse = await fetch(\n\t\t`${VERCEL_API_URL}/v9/projects/${projectId}/env?teamId=${teamId}`,\n\t\t{ headers: { Authorization: `Bearer ${token}` } },\n\t);\n\n\tif (!listResponse.ok) {\n\t\tthrow new Error(\n\t\t\t`Vercel API error (${listResponse.status}): ${await listResponse.text()}`,\n\t\t);\n\t}\n\n\tconst list = (await listResponse.json()) as { envs: VercelEnvVar[] };\n\n\tconst decrypted: VercelEnvVar[] = [];\n\n\tfor (const env of list.envs) {\n\t\tconst response = await fetch(\n\t\t\t`${VERCEL_API_URL}/v9/projects/${projectId}/env/${env.id}?teamId=${teamId}&decrypt=true`,\n\t\t\t{ headers: { Authorization: `Bearer ${token}` } },\n\t\t);\n\n\t\tif (response.ok) {\n\t\t\tdecrypted.push((await response.json()) as VercelEnvVar);\n\t\t}\n\t}\n\n\treturn decrypted;\n}\n\n/**\n * Creates a single Vercel env var targeting all environments.\n *\n * @param token Vercel API token\n * @param teamId Vercel team ID\n * @param projectId Vercel project ID\n * @param key Env var name\n * @param value Env var value\n * @returns The created env var with its Vercel-assigned ID\n */\nasync function createEnvVar(\n\ttoken: string,\n\tteamId: string,\n\tprojectId: string,\n\tkey: string,\n\tvalue: string,\n): Promise<VercelEnvVar> {\n\tconst response = await fetch(\n\t\t`${VERCEL_API_URL}/v10/projects/${projectId}/env?teamId=${teamId}`,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify({\n\t\t\t\tkey,\n\t\t\t\tvalue,\n\t\t\t\ttype: \"encrypted\",\n\t\t\t\ttarget: [\"production\", \"preview\", \"development\"],\n\t\t\t}),\n\t\t},\n\t);\n\n\tif (!response.ok) {\n\t\tconst errorText = await response.text();\n\n\t\tif (errorText.includes(\"ENV_CONFLICT\")) {\n\t\t\tpulumi.log.info(\n\t\t\t\t`Vercel env var \"${key}\" already exists, will update instead`,\n\t\t\t);\n\n\t\t\tconst existing = await fetchEnvVars(token, teamId, projectId);\n\t\t\tconst match = existing.find((e) => e.key === key);\n\n\t\t\tif (match) {\n\t\t\t\tawait updateEnvVar(token, teamId, projectId, match.id, value);\n\n\t\t\t\treturn { ...match, value };\n\t\t\t}\n\t\t}\n\n\t\tthrow new Error(\n\t\t\t`Vercel API error creating \"${key}\" (${response.status}): ${errorText}`,\n\t\t);\n\t}\n\n\treturn (await response.json()) as VercelEnvVar;\n}\n\n/**\n * Updates a single Vercel env var value.\n *\n * @param token Vercel API token\n * @param teamId Vercel team ID\n * @param projectId Vercel project ID\n * @param envId Vercel-assigned env var ID\n * @param value New value\n */\nasync function updateEnvVar(\n\ttoken: string,\n\tteamId: string,\n\tprojectId: string,\n\tenvId: string,\n\tvalue: string,\n): Promise<void> {\n\tconst response = await fetch(\n\t\t`${VERCEL_API_URL}/v9/projects/${projectId}/env/${envId}?teamId=${teamId}`,\n\t\t{\n\t\t\tmethod: \"PATCH\",\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify({ value }),\n\t\t},\n\t);\n\n\tif (!response.ok) {\n\t\tthrow new Error(\n\t\t\t`Vercel API error updating env var (${response.status}): ${await response.text()}`,\n\t\t);\n\t}\n}\n\n/**\n * Deletes a single Vercel env var.\n *\n * @param token Vercel API token\n * @param teamId Vercel team ID\n * @param projectId Vercel project ID\n * @param envId Vercel-assigned env var ID\n */\nasync function deleteEnvVar(\n\ttoken: string,\n\tteamId: string,\n\tprojectId: string,\n\tenvId: string,\n): Promise<void> {\n\tconst response = await fetch(\n\t\t`${VERCEL_API_URL}/v9/projects/${projectId}/env/${envId}?teamId=${teamId}`,\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t},\n\t);\n\n\tif (!response.ok && response.status !== 404) {\n\t\tthrow new Error(\n\t\t\t`Vercel API error deleting env var (${response.status}): ${await response.text()}`,\n\t\t);\n\t}\n}\n\n/**\n * Dynamic provider implementing CRUD for Vercel project environment variables.\n *\n * Manages all env vars for a project as a batch (like RailwayVariable).\n * The `read()` method fetches decrypted values from Vercel's API,\n * enabling drift detection during `pulumi refresh`.\n */\nclass VercelVariableProvider implements pulumi.dynamic.ResourceProvider {\n\t/**\n\t * Creates all env vars on the target Vercel project.\n\t * Handles ENV_CONFLICT by updating existing vars instead of failing.\n\t *\n\t * @param inputs Resolved variable configuration\n\t * @returns Composite ID in the form `{projectId}:variables`\n\t */\n\tasync create(\n\t\tinputs: VercelVariableInputs,\n\t): Promise<pulumi.dynamic.CreateResult> {\n\t\tconst envIds: Record<string, string> = {};\n\n\t\tfor (const [key, value] of Object.entries(inputs.variables)) {\n\t\t\tconst result = await createEnvVar(\n\t\t\t\tinputs.token,\n\t\t\t\tinputs.teamId,\n\t\t\t\tinputs.projectId,\n\t\t\t\tkey,\n\t\t\t\tvalue,\n\t\t\t);\n\n\t\t\tenvIds[key] = result.id;\n\t\t}\n\n\t\treturn {\n\t\t\tid: `${inputs.projectId}:variables`,\n\t\t\touts: {\n\t\t\t\t...inputs,\n\t\t\t\tenvIds,\n\t\t\t\tcontentHash: await hashVariables(inputs.variables),\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Updates variables by deleting removed keys, creating new keys,\n\t * and patching changed values.\n\t *\n\t * @param _id Current resource ID\n\t * @param olds Previous persisted state\n\t * @param news New desired configuration\n\t * @returns Updated outputs with current envIds\n\t */\n\tasync update(\n\t\t_id: string,\n\t\tolds: VercelVariableOutputs,\n\t\tnews: VercelVariableInputs,\n\t): Promise<pulumi.dynamic.UpdateResult> {\n\t\tconst envIds = { ...olds.envIds };\n\n\t\tconst removedKeys = Object.keys(olds.variables).filter(\n\t\t\t(key) => !(key in news.variables),\n\t\t);\n\n\t\tfor (const key of removedKeys) {\n\t\t\tconst envId = envIds[key];\n\n\t\t\tif (envId) {\n\t\t\t\ttry {\n\t\t\t\t\tawait deleteEnvVar(news.token, news.teamId, news.projectId, envId);\n\t\t\t\t} catch {\n\t\t\t\t\tpulumi.log.warn(\n\t\t\t\t\t\t`Failed to delete Vercel env var \"${key}\" (may already be deleted)`,\n\t\t\t\t\t);\n\t\t\t\t}\n\n\t\t\t\tdelete envIds[key];\n\t\t\t}\n\t\t}\n\n\t\tfor (const [key, value] of Object.entries(news.variables)) {\n\t\t\tconst existingId = envIds[key];\n\n\t\t\tif (existingId && olds.variables[key] !== value) {\n\t\t\t\tawait updateEnvVar(\n\t\t\t\t\tnews.token,\n\t\t\t\t\tnews.teamId,\n\t\t\t\t\tnews.projectId,\n\t\t\t\t\texistingId,\n\t\t\t\t\tvalue,\n\t\t\t\t);\n\t\t\t} else if (!existingId) {\n\t\t\t\tconst result = await createEnvVar(\n\t\t\t\t\tnews.token,\n\t\t\t\t\tnews.teamId,\n\t\t\t\t\tnews.projectId,\n\t\t\t\t\tkey,\n\t\t\t\t\tvalue,\n\t\t\t\t);\n\n\t\t\t\tenvIds[key] = result.id;\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\touts: {\n\t\t\t\t...news,\n\t\t\t\tenvIds,\n\t\t\t\tcontentHash: await hashVariables(news.variables),\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Reads current state from Vercel API with decrypted values.\n\t * Enables drift detection during `pulumi refresh`.\n\t *\n\t * @param id Current resource ID\n\t * @param props Last known persisted state\n\t * @returns Refreshed properties with actual values from Vercel\n\t */\n\tasync read(\n\t\tid: string,\n\t\tprops: VercelVariableOutputs,\n\t): Promise<pulumi.dynamic.ReadResult> {\n\t\tconst actual = await fetchEnvVars(\n\t\t\tprops.token,\n\t\t\tprops.teamId,\n\t\t\tprops.projectId,\n\t\t);\n\n\t\tconst actualVariables: Record<string, string> = {};\n\t\tconst actualEnvIds: Record<string, string> = {};\n\n\t\tfor (const [key] of Object.entries(props.variables)) {\n\t\t\tconst match = actual.find((e) => e.key === key);\n\n\t\t\tif (match) {\n\t\t\t\tactualVariables[key] = match.value;\n\t\t\t\tactualEnvIds[key] = match.id;\n\t\t\t}\n\t\t}\n\n\t\treturn {\n\t\t\tid,\n\t\t\tprops: {\n\t\t\t\t...props,\n\t\t\t\tvariables: actualVariables,\n\t\t\t\tenvIds: actualEnvIds,\n\t\t\t\tcontentHash: await hashVariables(actualVariables),\n\t\t\t},\n\t\t};\n\t}\n\n\t/**\n\t * Deletes all managed env vars from Vercel.\n\t *\n\t * @param _id Current resource ID\n\t * @param props Last known persisted state\n\t */\n\tasync delete(_id: string, props: VercelVariableOutputs): Promise<void> {\n\t\tfor (const [key, envId] of Object.entries(props.envIds)) {\n\t\t\ttry {\n\t\t\t\tawait deleteEnvVar(props.token, props.teamId, props.projectId, envId);\n\t\t\t} catch {\n\t\t\t\tpulumi.log.warn(\n\t\t\t\t\t`Failed to delete Vercel env var \"${key}\" (may already be deleted)`,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t}\n\n\t/**\n\t * Compares old and new variable maps by key set and value equality.\n\t *\n\t * @param _id Current resource ID\n\t * @param olds Previous persisted state\n\t * @param news New desired configuration\n\t * @returns Whether any keys or values changed\n\t */\n\tasync diff(\n\t\t_id: string,\n\t\tolds: VercelVariableOutputs,\n\t\tnews: VercelVariableInputs,\n\t): Promise<pulumi.dynamic.DiffResult> {\n\t\tconst oldKeys = Object.keys(olds.variables).sort().join(\",\");\n\t\tconst newKeys = Object.keys(news.variables).sort().join(\",\");\n\n\t\tconst valuesChanged = Object.entries(news.variables).some(\n\t\t\t([key, value]) => olds.variables[key] !== value,\n\t\t);\n\n\t\treturn {\n\t\t\tchanges: oldKeys !== newKeys || valuesChanged,\n\t\t};\n\t}\n}\n\n/**\n * Manages Vercel project environment variables as a batch with drift detection.\n *\n * Unlike `@pulumiverse/vercel`'s `ProjectEnvironmentVariable`, this provider\n * reads decrypted values from Vercel's API during `pulumi refresh`, enabling\n * detection of manually changed env var values.\n *\n * All variables target production, preview, and development environments.\n *\n * @example\n * ```typescript\n * new VercelVariable(\"vercel-variable-nexus\", {\n *   token: vercelConfig.token,\n *   teamId: vercelConfig.teamId,\n *   projectId: project.id,\n *   variables: {\n *     NEXT_PUBLIC_API_URL: meshUrl,\n *     NEXTAUTH_SECRET: config.requireSecret(\"nextauthSecret\"),\n *   },\n * });\n * ```\n */\nexport class VercelVariable extends pulumi.dynamic.Resource {\n\t/** SHA-256 hash of all key-value pairs. Use as a deploy trigger for drift-aware redeployment. */\n\tpublic declare readonly contentHash: pulumi.Output<string>;\n\n\t/**\n\t * @param name Pulumi resource name\n\t * @param args Variable configuration inputs\n\t * @param opts Standard Pulumi resource options\n\t */\n\tconstructor(\n\t\tname: string,\n\t\targs: {\n\t\t\t/** Vercel API bearer token. */\n\t\t\ttoken: pulumi.Input<string>;\n\n\t\t\t/** Vercel team/org ID. */\n\t\t\tteamId: pulumi.Input<string>;\n\n\t\t\t/** Vercel project ID. */\n\t\t\tprojectId: pulumi.Input<string>;\n\n\t\t\t/** Key-value map of environment variable names to their values. */\n\t\t\tvariables: pulumi.Input<Record<string, pulumi.Input<string>>>;\n\t\t},\n\t\topts?: pulumi.CustomResourceOptions,\n\t) {\n\t\tsuper(\n\t\t\tnew VercelVariableProvider(),\n\t\t\tname,\n\t\t\t{ ...args, envIds: undefined, contentHash: undefined },\n\t\t\topts,\n\t\t);\n\t}\n}\n"],"mappings":";;;;AAEA,MAAM,iBAAiB;;;;;;;;AAiCvB,eAAe,cACd,WACkB;CAElB,MAAM,QAAO,MADQ,OAAO,gBACR,WAAW,QAAQ;CAEvC,MAAM,SAAS,OAAO,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OACpD,EAAE,cAAc,CAAC,CAClB;CAEA,KAAK,MAAM,CAAC,KAAK,UAAU,QAAQ;EAClC,KAAK,OAAO,GAAG;EACf,KAAK,OAAO,KAAK;CAClB;CAEA,OAAO,KAAK,OAAO,KAAK;AACzB;;;;;;;;;AAmBA,eAAe,aACd,OACA,QACA,WAC0B;CAC1B,MAAM,eAAe,MAAM,MAC1B,GAAG,eAAe,eAAe,UAAU,cAAc,UACzD,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAAE,CACjD;CAEA,IAAI,CAAC,aAAa,IACjB,MAAM,IAAI,MACT,qBAAqB,aAAa,OAAO,KAAK,MAAM,aAAa,KAAK,GACvE;CAGD,MAAM,OAAQ,MAAM,aAAa,KAAK;CAEtC,MAAM,YAA4B,CAAC;CAEnC,KAAK,MAAM,OAAO,KAAK,MAAM;EAC5B,MAAM,WAAW,MAAM,MACtB,GAAG,eAAe,eAAe,UAAU,OAAO,IAAI,GAAG,UAAU,OAAO,gBAC1E,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,EAAE,CACjD;EAEA,IAAI,SAAS,IACZ,UAAU,KAAM,MAAM,SAAS,KAAK,CAAkB;CAExD;CAEA,OAAO;AACR;;;;;;;;;;;AAYA,eAAe,aACd,OACA,QACA,WACA,KACA,OACwB;CACxB,MAAM,WAAW,MAAM,MACtB,GAAG,eAAe,gBAAgB,UAAU,cAAc,UAC1D;EACC,QAAQ;EACR,SAAS;GACR,eAAe,UAAU;GACzB,gBAAgB;EACjB;EACA,MAAM,KAAK,UAAU;GACpB;GACA;GACA,MAAM;GACN,QAAQ;IAAC;IAAc;IAAW;GAAa;EAChD,CAAC;CACF,CACD;CAEA,IAAI,CAAC,SAAS,IAAI;EACjB,MAAM,YAAY,MAAM,SAAS,KAAK;EAEtC,IAAI,UAAU,SAAS,cAAc,GAAG;GACvC,OAAO,IAAI,KACV,mBAAmB,IAAI,sCACxB;GAGA,MAAM,SAAQ,MADS,aAAa,OAAO,QAAQ,SAAS,GACrC,MAAM,MAAM,EAAE,QAAQ,GAAG;GAEhD,IAAI,OAAO;IACV,MAAM,aAAa,OAAO,QAAQ,WAAW,MAAM,IAAI,KAAK;IAE5D,OAAO;KAAE,GAAG;KAAO;IAAM;GAC1B;EACD;EAEA,MAAM,IAAI,MACT,8BAA8B,IAAI,KAAK,SAAS,OAAO,KAAK,WAC7D;CACD;CAEA,OAAQ,MAAM,SAAS,KAAK;AAC7B;;;;;;;;;;AAWA,eAAe,aACd,OACA,QACA,WACA,OACA,OACgB;CAChB,MAAM,WAAW,MAAM,MACtB,GAAG,eAAe,eAAe,UAAU,OAAO,MAAM,UAAU,UAClE;EACC,QAAQ;EACR,SAAS;GACR,eAAe,UAAU;GACzB,gBAAgB;EACjB;EACA,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;CAC/B,CACD;CAEA,IAAI,CAAC,SAAS,IACb,MAAM,IAAI,MACT,sCAAsC,SAAS,OAAO,KAAK,MAAM,SAAS,KAAK,GAChF;AAEF;;;;;;;;;AAUA,eAAe,aACd,OACA,QACA,WACA,OACgB;CAChB,MAAM,WAAW,MAAM,MACtB,GAAG,eAAe,eAAe,UAAU,OAAO,MAAM,UAAU,UAClE;EACC,QAAQ;EACR,SAAS,EAAE,eAAe,UAAU,QAAQ;CAC7C,CACD;CAEA,IAAI,CAAC,SAAS,MAAM,SAAS,WAAW,KACvC,MAAM,IAAI,MACT,sCAAsC,SAAS,OAAO,KAAK,MAAM,SAAS,KAAK,GAChF;AAEF;;;;;;;;AASA,IAAM,yBAAN,MAAwE;;;;;;;;CAQvE,MAAM,OACL,QACuC;EACvC,MAAM,SAAiC,CAAC;EAExC,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,SAAS,GASzD,OAAO,QAAO,MARO,aACpB,OAAO,OACP,OAAO,QACP,OAAO,WACP,KACA,KACD,GAEqB;EAGtB,OAAO;GACN,IAAI,GAAG,OAAO,UAAU;GACxB,MAAM;IACL,GAAG;IACH;IACA,aAAa,MAAM,cAAc,OAAO,SAAS;GAClD;EACD;CACD;;;;;;;;;;CAWA,MAAM,OACL,KACA,MACA,MACuC;EACvC,MAAM,SAAS,EAAE,GAAG,KAAK,OAAO;EAEhC,MAAM,cAAc,OAAO,KAAK,KAAK,SAAS,EAAE,QAC9C,QAAQ,EAAE,OAAO,KAAK,UACxB;EAEA,KAAK,MAAM,OAAO,aAAa;GAC9B,MAAM,QAAQ,OAAO;GAErB,IAAI,OAAO;IACV,IAAI;KACH,MAAM,aAAa,KAAK,OAAO,KAAK,QAAQ,KAAK,WAAW,KAAK;IAClE,QAAQ;KACP,OAAO,IAAI,KACV,oCAAoC,IAAI,2BACzC;IACD;IAEA,OAAO,OAAO;GACf;EACD;EAEA,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,KAAK,SAAS,GAAG;GAC1D,MAAM,aAAa,OAAO;GAE1B,IAAI,cAAc,KAAK,UAAU,SAAS,OACzC,MAAM,aACL,KAAK,OACL,KAAK,QACL,KAAK,WACL,YACA,KACD;QACM,IAAI,CAAC,YASX,OAAO,QAAO,MARO,aACpB,KAAK,OACL,KAAK,QACL,KAAK,WACL,KACA,KACD,GAEqB;EAEvB;EAEA,OAAO,EACN,MAAM;GACL,GAAG;GACH;GACA,aAAa,MAAM,cAAc,KAAK,SAAS;EAChD,EACD;CACD;;;;;;;;;CAUA,MAAM,KACL,IACA,OACqC;EACrC,MAAM,SAAS,MAAM,aACpB,MAAM,OACN,MAAM,QACN,MAAM,SACP;EAEA,MAAM,kBAA0C,CAAC;EACjD,MAAM,eAAuC,CAAC;EAE9C,KAAK,MAAM,CAAC,QAAQ,OAAO,QAAQ,MAAM,SAAS,GAAG;GACpD,MAAM,QAAQ,OAAO,MAAM,MAAM,EAAE,QAAQ,GAAG;GAE9C,IAAI,OAAO;IACV,gBAAgB,OAAO,MAAM;IAC7B,aAAa,OAAO,MAAM;GAC3B;EACD;EAEA,OAAO;GACN;GACA,OAAO;IACN,GAAG;IACH,WAAW;IACX,QAAQ;IACR,aAAa,MAAM,cAAc,eAAe;GACjD;EACD;CACD;;;;;;;CAQA,MAAM,OAAO,KAAa,OAA6C;EACtE,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,MAAM,GACrD,IAAI;GACH,MAAM,aAAa,MAAM,OAAO,MAAM,QAAQ,MAAM,WAAW,KAAK;EACrE,QAAQ;GACP,OAAO,IAAI,KACV,oCAAoC,IAAI,2BACzC;EACD;CAEF;;;;;;;;;CAUA,MAAM,KACL,KACA,MACA,MACqC;EACrC,MAAM,UAAU,OAAO,KAAK,KAAK,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG;EAC3D,MAAM,UAAU,OAAO,KAAK,KAAK,SAAS,EAAE,KAAK,EAAE,KAAK,GAAG;EAE3D,MAAM,gBAAgB,OAAO,QAAQ,KAAK,SAAS,EAAE,MACnD,CAAC,KAAK,WAAW,KAAK,UAAU,SAAS,KAC3C;EAEA,OAAO,EACN,SAAS,YAAY,WAAW,cACjC;CACD;AACD;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAa,iBAAb,cAAoC,OAAO,QAAQ,SAAS;;;;;;CAS3D,YACC,MACA,MAaA,MACC;EACD,MACC,IAAI,uBAAuB,GAC3B,MACA;GAAE,GAAG;GAAM,QAAQ;GAAW,aAAa;EAAU,GACrD,IACD;CACD;AACD"}

package/package.json

@@ -0,0 +1,62 @@
+{
+	"name": "@infracraft/pulumi",
+	"version": "0.1.0",
+	"type": "module",
+	"license": "MIT",
+	"repository": {
+		"type": "git",
+		"url": "https://github.com/andredezzy/infracraft",
+		"directory": "packages/pulumi"
+	},
+	"exports": {
+		"./railway": {
+			"types": "./dist/railway/index.d.mts",
+			"default": "./dist/railway/index.mjs"
+		},
+		"./neon": {
+			"types": "./dist/neon/index.d.mts",
+			"default": "./dist/neon/index.mjs"
+		},
+		"./vercel": {
+			"types": "./dist/vercel/index.d.mts",
+			"default": "./dist/vercel/index.mjs"
+		},
+		"./hash": {
+			"types": "./dist/hash.d.mts",
+			"default": "./dist/hash.mjs"
+		},
+		"./git-guard": {
+			"types": "./dist/git-guard.d.mts",
+			"default": "./dist/git-guard.mjs"
+		}
+	},
+	"files": [
+		"dist/**"
+	],
+	"scripts": {
+		"build": "tsdown",
+		"dev": "tsdown --watch",
+		"typecheck": "tsc --noEmit",
+		"test": "vitest run",
+		"lint": "biome check --write"
+	},
+	"peerDependencies": {
+		"@pulumi/pulumi": "^3",
+		"@pulumi/command": "^1"
+	},
+	"peerDependenciesMeta": {
+		"@pulumi/command": {
+			"optional": true
+		}
+	},
+	"devDependencies": {
+		"@infracraft/config-tsdown": "workspace:*",
+		"@infracraft/config-test": "workspace:*",
+		"@infracraft/typescript-config": "workspace:*",
+		"@pulumi/command": "1.2.1",
+		"@pulumi/pulumi": "3.243.0",
+		"@types/node": "25.9.1",
+		"typescript": "6.0.3",
+		"vitest": "4.1.7"
+	}
+}