@infracraft/pulumi 1.13.1 → 1.14.0

package/dist/vercel/deploy.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
 const require_chunk = require('../chunk-BVYJZCqc.cjs');
+const require_git_guard = require('../git-guard.cjs');
 const require_stable_dir = require('../stable-dir.cjs');
 let _pulumi_command = require("@pulumi/command");
 _pulumi_command = require_chunk.__toESM(_pulumi_command, 1);
@@ -7,21 +8,87 @@ let _pulumi_pulumi = require("@pulumi/pulumi");
 _pulumi_pulumi = require_chunk.__toESM(_pulumi_pulumi, 1);
 
 //#region src/vercel/deploy.ts
+/** mkdir-based lock serializing the brief window when `.vercelignore` is written. */
+const LOCK_DIR = "/tmp/.vercel-upload-lock";
+/** Where a committed `.vercelignore` is parked while the engine owns the file. */
+const IGNORE_BACKUP = ".vercelignore.infracraft-bak";
 /**
-* Deploys a Vercel project via `vercel deploy --prod --yes` CLI.
+* Patterns the engine ALWAYS writes to `.vercelignore`, independent of `excludePaths`.
+*
+* `gitGuard` hides the real `.git` by renaming it to {@link GUARD_DIR} (or a
+* {@link LEGACY_GUARD_DIRS} name) for the duration of a deploy, leaving a stub `.git`.
+* Vercel default-ignores `.git` but NOT the renamed guard dir, and — unlike the Railway
+* CLI — Vercel never reads `.gitignore` (where gitGuard also records the guard dir).
+* Without this exclusion the renamed real `.git`, with its 100MB+ pack files, is
+* uploaded and trips Vercel's 100MB-per-file limit. The transient `.vercelignore*` (the
+* generated file and its {@link IGNORE_BACKUP}) is excluded too, so the engine's own
+* scratch files never ship.
+*/
+const ALWAYS_IGNORE = [
+	require_git_guard.GUARD_DIR,
+	...require_git_guard.LEGACY_GUARD_DIRS,
+	".vercelignore*"
+];
+/**
+* Builds the newline-joined `.vercelignore` body for the deploy.
+*
+* Prepends {@link ALWAYS_IGNORE} (the guard dir and scratch files) to the consumer's
+* `excludePaths`, applying the workspace-preserving `apps/<name>` rule so other apps'
+* code is dropped while their `package.json` stays for the build's dependency graph.
+*
+* @param excludePaths Consumer-supplied paths to exclude (optional)
+* @returns The ignore body, one pattern per line
+* @example
+* ```typescript
+* buildVercelIgnore(["apps/mesh", "docs"]);
+* // ".git-infracraft-pulumi-guard\n…\napps/mesh/**\n!apps/mesh/package.json\ndocs"
+* ```
+*/
+function buildVercelIgnore(excludePaths) {
+	const excludeLines = (excludePaths ?? []).map((entry) => entry.startsWith("apps/") ? `${entry}/**\n!${entry}/package.json` : entry);
+	return [...ALWAYS_IGNORE, ...excludeLines].join("\n");
+}
+/**
+* Builds the `create` shell command that wraps `vercel deploy` in the ignore engine.
+*
+* The engine acquires a mkdir lock, parks any committed `.vercelignore` at
+* {@link IGNORE_BACKUP}, writes the generated body (`printf` expands the encoded `\n`
+* sequences), runs the deploy, and — in a background timer so a slow remote build does
+* not block sibling deploys — restores the parked file and releases the lock. The
+* deploy's exit status is captured into `EXIT` before `wait`, so the Pulumi resource
+* fails when the deploy fails.
+*
+* @param excludePaths Consumer-supplied paths to exclude (optional)
+* @returns A single-line shell command (no raw newlines)
+*/
+function buildVercelDeployCommand(excludePaths) {
+	return `while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; if [ -f .vercelignore ]; then mv .vercelignore ${IGNORE_BACKUP}; fi; printf '${buildVercelIgnore(excludePaths).replace(/\n/g, "\\n")}\\n' > .vercelignore; { sleep 8; ${`rm -f .vercelignore; [ -f ${IGNORE_BACKUP} ] && mv ${IGNORE_BACKUP} .vercelignore`}; rmdir ${LOCK_DIR} 2>/dev/null; } & vercel deploy --prod --yes; EXIT=$?; wait; exit $EXIT`;
+}
+/**
+* Deploys a Vercel project via `vercel deploy --prod --yes`, generating a
+* `.vercelignore` around the upload — the same exclude engine as `RailwayDeploy`.
 *
 * Triggers on source hash (computed from the app directory) and env content hash
 * (from `VercelVariable.contentHash`). When an env value changes — whether from
 * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes
 * and a redeploy is triggered.
 *
+* The upload is wrapped in an ignore engine mirroring Railway's: a mkdir lock
+* serializes the brief window in which `.vercelignore` must be consistent, the file is
+* written (gitGuard guard dir + {@link VercelDeployArgs.excludePaths}), then a
+* background timer restores the repository and releases the lock so concurrent deploys
+* stream. Any committed `.vercelignore` is parked at {@link IGNORE_BACKUP} and restored
+* afterward, so this never destroys a consumer's file — and because a committed
+* `.vercelignore` is git-tracked, a hard-killed run is recoverable with
+* `git checkout .vercelignore`.
+*
 * @example
 * ```typescript
 * new VercelDeploy("nexus-deploy", {
 *   projectId: vercelProject.id,
-*   rootDirectory: "apps/nexus",
 *   monorepoRoot,
-*   env: { NEXT_PUBLIC_API_URL: meshUrl },
+*   triggers: [sourceHash, envHash],
+*   excludePaths: ["apps/mesh", "docs"],
 * }, { provider });
 * ```
 */
@@ -32,7 +99,7 @@ var VercelDeploy = class extends _pulumi_pulumi.ComponentResource {
 		const projectId = project ? project.id : args.projectId;
 		if (!projectId) throw new Error("VercelDeploy: either `args.projectId` or `opts.project` must be provided");
 		const deployCmd = new _pulumi_command.local.Command(`${name}-deploy`, {
-			create: "vercel deploy --prod --yes",
+			create: buildVercelDeployCommand(args.excludePaths),
 			triggers: args.triggers,
 			dir: require_stable_dir.stableDir(args.monorepoRoot),
 			environment: {
@@ -48,4 +115,6 @@ var VercelDeploy = class extends _pulumi_pulumi.ComponentResource {
 
 //#endregion
 exports.VercelDeploy = VercelDeploy;
+exports.buildVercelDeployCommand = buildVercelDeployCommand;
+exports.buildVercelIgnore = buildVercelIgnore;
 //# sourceMappingURL=deploy.cjs.map

package/dist/vercel/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["pulumi","command","stableDir"],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { stableDir } from \"../stable-dir\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\n/** Options type for VercelDeploy — replaces Pulumi's native `provider` field. */\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\n\t/**\n\t * VercelProject resource to source the project ID from.\n\t * When provided, `args.projectId` is optional and ignored if both are given.\n\t */\n\tproject?: VercelProject;\n};\n\n/** Args for VercelDeploy. */\nexport interface VercelDeployArgs {\n\t/**\n\t * Vercel project ID.\n\t * Required when `opts.project` is not provided.\n\t */\n\tprojectId?: pulumi.Input<string>;\n\n\t/**\n\t * Absolute path to the monorepo root (working directory for `vercel deploy`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tmonorepoRoot: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n}\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes` CLI.\n *\n * Triggers on source hash (computed from the app directory) and env content hash\n * (from `VercelVariable.contentHash`). When an env value changes — whether from\n * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes\n * and a redeploy is triggered.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus-deploy\", {\n *   projectId: vercelProject.id,\n *   rootDirectory: \"apps/nexus\",\n *   monorepoRoot,\n *   env: { NEXT_PUBLIC_API_URL: meshUrl },\n * }, { provider });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\t/**\n\t * The production deployment URL printed by `vercel deploy` (its final stdout line).\n\t * Surfaces the deployed link in stack outputs after `pulumi up` without visiting the dashboard.\n\t */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst deployCmd = new command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: \"vercel deploy --prod --yes\",\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.monorepoRoot),\n\t\t\t\tenvironment: {\n\t\t\t\t\tVERCEL_TOKEN: provider.token,\n\t\t\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.deploymentUrl = deployCmd.stdout.apply(\n\t\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t\t);\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAuDA,IAAa,eAAb,cAAkCA,eAAO,kBAAkB;CAO1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,YAAY,IAAIC,gBAAQ,MAAM,QACnC,GAAG,KAAK,UACR;GACC,QAAQ;GACR,UAAU,KAAK;GACf,KAAKC,6BAAU,KAAK,YAAY;GAChC,aAAa;IACZ,cAAc,SAAS;IACvB,eAAe,SAAS;IACxB,mBAAmB;GACpB;EACD,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,UAAU,OAAO,OACpC,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAC1C;EAEA,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}
+{"version":3,"file":"deploy.cjs","names":["GUARD_DIR","LEGACY_GUARD_DIRS","pulumi","command","stableDir"],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { GUARD_DIR, LEGACY_GUARD_DIRS } from \"../git-guard\";\nimport { stableDir } from \"../stable-dir\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\n/** Options type for VercelDeploy — replaces Pulumi's native `provider` field. */\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\n\t/**\n\t * VercelProject resource to source the project ID from.\n\t * When provided, `args.projectId` is optional and ignored if both are given.\n\t */\n\tproject?: VercelProject;\n};\n\n/** Args for VercelDeploy. */\nexport interface VercelDeployArgs {\n\t/**\n\t * Vercel project ID.\n\t * Required when `opts.project` is not provided.\n\t */\n\tprojectId?: pulumi.Input<string>;\n\n\t/**\n\t * Absolute path to the monorepo root (working directory for `vercel deploy`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tmonorepoRoot: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/**\n\t * Paths to exclude from the upload via a generated `.vercelignore`, mirroring\n\t * `RailwayDeployArgs.excludePaths`. An `apps/<name>` entry excludes that app's\n\t * code but keeps its `package.json`, so the workspace graph still resolves during\n\t * the monorepo build. The gitGuard guard dir is always excluded regardless of this\n\t * list — see {@link buildVercelIgnore}.\n\t */\n\texcludePaths?: string[];\n}\n\n/** mkdir-based lock serializing the brief window when `.vercelignore` is written. */\nconst LOCK_DIR = \"/tmp/.vercel-upload-lock\";\n\n/** Where a committed `.vercelignore` is parked while the engine owns the file. */\nconst IGNORE_BACKUP = \".vercelignore.infracraft-bak\";\n\n/**\n * Patterns the engine ALWAYS writes to `.vercelignore`, independent of `excludePaths`.\n *\n * `gitGuard` hides the real `.git` by renaming it to {@link GUARD_DIR} (or a\n * {@link LEGACY_GUARD_DIRS} name) for the duration of a deploy, leaving a stub `.git`.\n * Vercel default-ignores `.git` but NOT the renamed guard dir, and — unlike the Railway\n * CLI — Vercel never reads `.gitignore` (where gitGuard also records the guard dir).\n * Without this exclusion the renamed real `.git`, with its 100MB+ pack files, is\n * uploaded and trips Vercel's 100MB-per-file limit. The transient `.vercelignore*` (the\n * generated file and its {@link IGNORE_BACKUP}) is excluded too, so the engine's own\n * scratch files never ship.\n */\nconst ALWAYS_IGNORE: readonly string[] = [\n\tGUARD_DIR,\n\t...LEGACY_GUARD_DIRS,\n\t\".vercelignore*\",\n];\n\n/**\n * Builds the newline-joined `.vercelignore` body for the deploy.\n *\n * Prepends {@link ALWAYS_IGNORE} (the guard dir and scratch files) to the consumer's\n * `excludePaths`, applying the workspace-preserving `apps/<name>` rule so other apps'\n * code is dropped while their `package.json` stays for the build's dependency graph.\n *\n * @param excludePaths Consumer-supplied paths to exclude (optional)\n * @returns The ignore body, one pattern per line\n * @example\n * ```typescript\n * buildVercelIgnore([\"apps/mesh\", \"docs\"]);\n * // \".git-infracraft-pulumi-guard\\n…\\napps/mesh/**\\n!apps/mesh/package.json\\ndocs\"\n * ```\n */\nexport function buildVercelIgnore(excludePaths?: string[]): string {\n\tconst excludeLines = (excludePaths ?? []).map((entry) =>\n\t\tentry.startsWith(\"apps/\") ? `${entry}/**\\n!${entry}/package.json` : entry,\n\t);\n\n\treturn [...ALWAYS_IGNORE, ...excludeLines].join(\"\\n\");\n}\n\n/**\n * Builds the `create` shell command that wraps `vercel deploy` in the ignore engine.\n *\n * The engine acquires a mkdir lock, parks any committed `.vercelignore` at\n * {@link IGNORE_BACKUP}, writes the generated body (`printf` expands the encoded `\\n`\n * sequences), runs the deploy, and — in a background timer so a slow remote build does\n * not block sibling deploys — restores the parked file and releases the lock. The\n * deploy's exit status is captured into `EXIT` before `wait`, so the Pulumi resource\n * fails when the deploy fails.\n *\n * @param excludePaths Consumer-supplied paths to exclude (optional)\n * @returns A single-line shell command (no raw newlines)\n */\nexport function buildVercelDeployCommand(excludePaths?: string[]): string {\n\tconst ignoreBody = buildVercelIgnore(excludePaths).replace(/\\n/g, \"\\\\n\");\n\n\tconst restore = `rm -f .vercelignore; [ -f ${IGNORE_BACKUP} ] && mv ${IGNORE_BACKUP} .vercelignore`;\n\n\treturn (\n\t\t`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ` +\n\t\t`if [ -f .vercelignore ]; then mv .vercelignore ${IGNORE_BACKUP}; fi; ` +\n\t\t`printf '${ignoreBody}\\\\n' > .vercelignore; ` +\n\t\t`{ sleep 8; ${restore}; rmdir ${LOCK_DIR} 2>/dev/null; } & ` +\n\t\t`vercel deploy --prod --yes; EXIT=$?; wait; exit $EXIT`\n\t);\n}\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes`, generating a\n * `.vercelignore` around the upload — the same exclude engine as `RailwayDeploy`.\n *\n * Triggers on source hash (computed from the app directory) and env content hash\n * (from `VercelVariable.contentHash`). When an env value changes — whether from\n * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes\n * and a redeploy is triggered.\n *\n * The upload is wrapped in an ignore engine mirroring Railway's: a mkdir lock\n * serializes the brief window in which `.vercelignore` must be consistent, the file is\n * written (gitGuard guard dir + {@link VercelDeployArgs.excludePaths}), then a\n * background timer restores the repository and releases the lock so concurrent deploys\n * stream. Any committed `.vercelignore` is parked at {@link IGNORE_BACKUP} and restored\n * afterward, so this never destroys a consumer's file — and because a committed\n * `.vercelignore` is git-tracked, a hard-killed run is recoverable with\n * `git checkout .vercelignore`.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus-deploy\", {\n *   projectId: vercelProject.id,\n *   monorepoRoot,\n *   triggers: [sourceHash, envHash],\n *   excludePaths: [\"apps/mesh\", \"docs\"],\n * }, { provider });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\t/**\n\t * The production deployment URL printed by `vercel deploy` (its final stdout line).\n\t * Surfaces the deployed link in stack outputs after `pulumi up` without visiting the dashboard.\n\t */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst deployCmd = new command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: buildVercelDeployCommand(args.excludePaths),\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.monorepoRoot),\n\t\t\t\tenvironment: {\n\t\t\t\t\tVERCEL_TOKEN: provider.token,\n\t\t\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.deploymentUrl = deployCmd.stdout.apply(\n\t\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t\t);\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;AAgDA,MAAM,WAAW;;AAGjB,MAAM,gBAAgB;;;;;;;;;;;;;AActB,MAAM,gBAAmC;CACxCA;CACA,GAAGC;CACH;AACD;;;;;;;;;;;;;;;;AAiBA,SAAgB,kBAAkB,cAAiC;CAClE,MAAM,gBAAgB,gBAAgB,CAAC,GAAG,KAAK,UAC9C,MAAM,WAAW,OAAO,IAAI,GAAG,MAAM,QAAQ,MAAM,iBAAiB,KACrE;CAEA,OAAO,CAAC,GAAG,eAAe,GAAG,YAAY,EAAE,KAAK,IAAI;AACrD;;;;;;;;;;;;;;AAeA,SAAgB,yBAAyB,cAAiC;CAKzE,OACC,iBAAiB,SAAS,iFACwB,cAAc,gBAN9C,kBAAkB,YAAY,EAAE,QAAQ,OAAO,KAO7C,EAAE,mCACR,6BAN8B,cAAc,WAAW,cAAc,gBAM7D,UAAU,SAAS;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAa,eAAb,cAAkCC,eAAO,kBAAkB;CAO1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,YAAY,IAAIC,gBAAQ,MAAM,QACnC,GAAG,KAAK,UACR;GACC,QAAQ,yBAAyB,KAAK,YAAY;GAClD,UAAU,KAAK;GACf,KAAKC,6BAAU,KAAK,YAAY;GAChC,aAAa;IACZ,cAAc,SAAS;IACvB,eAAe,SAAS;IACxB,mBAAmB;GACpB;EACD,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,UAAU,OAAO,OACpC,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAC1C;EAEA,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/vercel/deploy.d.cts

@@ -28,22 +28,70 @@ interface VercelDeployArgs {
   monorepoRoot: string;
   /** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */
   triggers: pulumi.Input<pulumi.Input<string>[]>;
+  /**
+   * Paths to exclude from the upload via a generated `.vercelignore`, mirroring
+   * `RailwayDeployArgs.excludePaths`. An `apps/<name>` entry excludes that app's
+   * code but keeps its `package.json`, so the workspace graph still resolves during
+   * the monorepo build. The gitGuard guard dir is always excluded regardless of this
+   * list — see {@link buildVercelIgnore}.
+   */
+  excludePaths?: string[];
 }
 /**
- * Deploys a Vercel project via `vercel deploy --prod --yes` CLI.
+ * Builds the newline-joined `.vercelignore` body for the deploy.
+ *
+ * Prepends {@link ALWAYS_IGNORE} (the guard dir and scratch files) to the consumer's
+ * `excludePaths`, applying the workspace-preserving `apps/<name>` rule so other apps'
+ * code is dropped while their `package.json` stays for the build's dependency graph.
+ *
+ * @param excludePaths Consumer-supplied paths to exclude (optional)
+ * @returns The ignore body, one pattern per line
+ * @example
+ * ```typescript
+ * buildVercelIgnore(["apps/mesh", "docs"]);
+ * // ".git-infracraft-pulumi-guard\n…\napps/mesh/**\n!apps/mesh/package.json\ndocs"
+ * ```
+ */
+declare function buildVercelIgnore(excludePaths?: string[]): string;
+/**
+ * Builds the `create` shell command that wraps `vercel deploy` in the ignore engine.
+ *
+ * The engine acquires a mkdir lock, parks any committed `.vercelignore` at
+ * {@link IGNORE_BACKUP}, writes the generated body (`printf` expands the encoded `\n`
+ * sequences), runs the deploy, and — in a background timer so a slow remote build does
+ * not block sibling deploys — restores the parked file and releases the lock. The
+ * deploy's exit status is captured into `EXIT` before `wait`, so the Pulumi resource
+ * fails when the deploy fails.
+ *
+ * @param excludePaths Consumer-supplied paths to exclude (optional)
+ * @returns A single-line shell command (no raw newlines)
+ */
+declare function buildVercelDeployCommand(excludePaths?: string[]): string;
+/**
+ * Deploys a Vercel project via `vercel deploy --prod --yes`, generating a
+ * `.vercelignore` around the upload — the same exclude engine as `RailwayDeploy`.
  *
  * Triggers on source hash (computed from the app directory) and env content hash
  * (from `VercelVariable.contentHash`). When an env value changes — whether from
  * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes
  * and a redeploy is triggered.
  *
+ * The upload is wrapped in an ignore engine mirroring Railway's: a mkdir lock
+ * serializes the brief window in which `.vercelignore` must be consistent, the file is
+ * written (gitGuard guard dir + {@link VercelDeployArgs.excludePaths}), then a
+ * background timer restores the repository and releases the lock so concurrent deploys
+ * stream. Any committed `.vercelignore` is parked at {@link IGNORE_BACKUP} and restored
+ * afterward, so this never destroys a consumer's file — and because a committed
+ * `.vercelignore` is git-tracked, a hard-killed run is recoverable with
+ * `git checkout .vercelignore`.
+ *
  * @example
  * ```typescript
  * new VercelDeploy("nexus-deploy", {
  *   projectId: vercelProject.id,
- *   rootDirectory: "apps/nexus",
  *   monorepoRoot,
- *   env: { NEXT_PUBLIC_API_URL: meshUrl },
+ *   triggers: [sourceHash, envHash],
+ *   excludePaths: ["apps/mesh", "docs"],
  * }, { provider });
  * ```
  */
@@ -56,5 +104,5 @@ declare class VercelDeploy extends pulumi.ComponentResource {
   constructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions);
 }
 //#endregion
-export { VercelDeploy, VercelDeployArgs };
+export { VercelDeploy, VercelDeployArgs, buildVercelDeployCommand, buildVercelIgnore };
 //# sourceMappingURL=deploy.d.cts.map

package/dist/vercel/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;;KAOK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA;EAFa;;;;EAQvB,OAAA,GAAU,aAAA;AAAA;;UAIM,gBAAA;EAZU;;;;EAiB1B,SAAA,GAAY,MAAA,CAAO,KAAA;EATnB;;;AAAuB;AAIxB;EAYC,YAAA;;EAGA,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;;;;;AAAK;AAqBpC;;;;cAAa,YAAA,SAAqB,MAAA,CAAO,iBAAA;EAOgB;;;;EAAA,SAFxC,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;;KAQK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA;EAFa;;;;EAQvB,OAAA,GAAU,aAAA;AAAA;;UAIM,gBAAA;EAZU;;;;EAiB1B,SAAA,GAAY,MAAA,CAAO,KAAA;EATnB;;;AAAuB;AAIxB;EAYC,YAAA;;EAGA,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;;;;;;;EASvB,YAAA;AAAA;;;;;;;AAAY;AA0Cb;;;;AAAyD;AAqBzD;;;iBArBgB,iBAAA,CAAkB,YAAuB;AAqBO;AA0ChE;;;;;;;;;;;;AA1CgE,iBAAhD,wBAAA,CAAyB,YAAuB;;;;;;;;;AAiDY;;;;;;;;;;;;;;;;;;;;cAP/D,YAAA,SAAqB,MAAA,CAAO,iBAAA;;;;;WAKxB,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}

package/dist/vercel/deploy.d.mts

@@ -28,22 +28,70 @@ interface VercelDeployArgs {
   monorepoRoot: string;
   /** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */
   triggers: pulumi.Input<pulumi.Input<string>[]>;
+  /**
+   * Paths to exclude from the upload via a generated `.vercelignore`, mirroring
+   * `RailwayDeployArgs.excludePaths`. An `apps/<name>` entry excludes that app's
+   * code but keeps its `package.json`, so the workspace graph still resolves during
+   * the monorepo build. The gitGuard guard dir is always excluded regardless of this
+   * list — see {@link buildVercelIgnore}.
+   */
+  excludePaths?: string[];
 }
 /**
- * Deploys a Vercel project via `vercel deploy --prod --yes` CLI.
+ * Builds the newline-joined `.vercelignore` body for the deploy.
+ *
+ * Prepends {@link ALWAYS_IGNORE} (the guard dir and scratch files) to the consumer's
+ * `excludePaths`, applying the workspace-preserving `apps/<name>` rule so other apps'
+ * code is dropped while their `package.json` stays for the build's dependency graph.
+ *
+ * @param excludePaths Consumer-supplied paths to exclude (optional)
+ * @returns The ignore body, one pattern per line
+ * @example
+ * ```typescript
+ * buildVercelIgnore(["apps/mesh", "docs"]);
+ * // ".git-infracraft-pulumi-guard\n…\napps/mesh/**\n!apps/mesh/package.json\ndocs"
+ * ```
+ */
+declare function buildVercelIgnore(excludePaths?: string[]): string;
+/**
+ * Builds the `create` shell command that wraps `vercel deploy` in the ignore engine.
+ *
+ * The engine acquires a mkdir lock, parks any committed `.vercelignore` at
+ * {@link IGNORE_BACKUP}, writes the generated body (`printf` expands the encoded `\n`
+ * sequences), runs the deploy, and — in a background timer so a slow remote build does
+ * not block sibling deploys — restores the parked file and releases the lock. The
+ * deploy's exit status is captured into `EXIT` before `wait`, so the Pulumi resource
+ * fails when the deploy fails.
+ *
+ * @param excludePaths Consumer-supplied paths to exclude (optional)
+ * @returns A single-line shell command (no raw newlines)
+ */
+declare function buildVercelDeployCommand(excludePaths?: string[]): string;
+/**
+ * Deploys a Vercel project via `vercel deploy --prod --yes`, generating a
+ * `.vercelignore` around the upload — the same exclude engine as `RailwayDeploy`.
  *
  * Triggers on source hash (computed from the app directory) and env content hash
  * (from `VercelVariable.contentHash`). When an env value changes — whether from
  * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes
  * and a redeploy is triggered.
  *
+ * The upload is wrapped in an ignore engine mirroring Railway's: a mkdir lock
+ * serializes the brief window in which `.vercelignore` must be consistent, the file is
+ * written (gitGuard guard dir + {@link VercelDeployArgs.excludePaths}), then a
+ * background timer restores the repository and releases the lock so concurrent deploys
+ * stream. Any committed `.vercelignore` is parked at {@link IGNORE_BACKUP} and restored
+ * afterward, so this never destroys a consumer's file — and because a committed
+ * `.vercelignore` is git-tracked, a hard-killed run is recoverable with
+ * `git checkout .vercelignore`.
+ *
  * @example
  * ```typescript
  * new VercelDeploy("nexus-deploy", {
  *   projectId: vercelProject.id,
- *   rootDirectory: "apps/nexus",
  *   monorepoRoot,
- *   env: { NEXT_PUBLIC_API_URL: meshUrl },
+ *   triggers: [sourceHash, envHash],
+ *   excludePaths: ["apps/mesh", "docs"],
  * }, { provider });
  * ```
  */
@@ -56,5 +104,5 @@ declare class VercelDeploy extends pulumi.ComponentResource {
   constructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions);
 }
 //#endregion
-export { VercelDeploy, VercelDeployArgs };
+export { VercelDeploy, VercelDeployArgs, buildVercelDeployCommand, buildVercelIgnore };
 //# sourceMappingURL=deploy.d.mts.map

package/dist/vercel/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;;KAOK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA;EAFa;;;;EAQvB,OAAA,GAAU,aAAA;AAAA;;UAIM,gBAAA;EAZU;;;;EAiB1B,SAAA,GAAY,MAAA,CAAO,KAAA;EATnB;;;AAAuB;AAIxB;EAYC,YAAA;;EAGA,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;;;;;AAAK;AAqBpC;;;;cAAa,YAAA,SAAqB,MAAA,CAAO,iBAAA;EAOgB;;;;EAAA,SAFxC,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;;KAQK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA;EAFa;;;;EAQvB,OAAA,GAAU,aAAA;AAAA;;UAIM,gBAAA;EAZU;;;;EAiB1B,SAAA,GAAY,MAAA,CAAO,KAAA;EATnB;;;AAAuB;AAIxB;EAYC,YAAA;;EAGA,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAAP;;;;;;;EASvB,YAAA;AAAA;;;;;;;AAAY;AA0Cb;;;;AAAyD;AAqBzD;;;iBArBgB,iBAAA,CAAkB,YAAuB;AAqBO;AA0ChE;;;;;;;;;;;;AA1CgE,iBAAhD,wBAAA,CAAyB,YAAuB;;;;;;;;;AAiDY;;;;;;;;;;;;;;;;;;;;cAP/D,YAAA,SAAqB,MAAA,CAAO,iBAAA;;;;;WAKxB,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}

package/dist/vercel/deploy.mjs

@@ -1,24 +1,91 @@
 import { t as __name } from "../chunk-OPjESj5l.mjs";
+import { GUARD_DIR, LEGACY_GUARD_DIRS } from "../git-guard.mjs";
 import { stableDir } from "../stable-dir.mjs";
 import * as command from "@pulumi/command";
 import * as pulumi from "@pulumi/pulumi";
 
 //#region src/vercel/deploy.ts
+/** mkdir-based lock serializing the brief window when `.vercelignore` is written. */
+const LOCK_DIR = "/tmp/.vercel-upload-lock";
+/** Where a committed `.vercelignore` is parked while the engine owns the file. */
+const IGNORE_BACKUP = ".vercelignore.infracraft-bak";
 /**
-* Deploys a Vercel project via `vercel deploy --prod --yes` CLI.
+* Patterns the engine ALWAYS writes to `.vercelignore`, independent of `excludePaths`.
+*
+* `gitGuard` hides the real `.git` by renaming it to {@link GUARD_DIR} (or a
+* {@link LEGACY_GUARD_DIRS} name) for the duration of a deploy, leaving a stub `.git`.
+* Vercel default-ignores `.git` but NOT the renamed guard dir, and — unlike the Railway
+* CLI — Vercel never reads `.gitignore` (where gitGuard also records the guard dir).
+* Without this exclusion the renamed real `.git`, with its 100MB+ pack files, is
+* uploaded and trips Vercel's 100MB-per-file limit. The transient `.vercelignore*` (the
+* generated file and its {@link IGNORE_BACKUP}) is excluded too, so the engine's own
+* scratch files never ship.
+*/
+const ALWAYS_IGNORE = [
+	GUARD_DIR,
+	...LEGACY_GUARD_DIRS,
+	".vercelignore*"
+];
+/**
+* Builds the newline-joined `.vercelignore` body for the deploy.
+*
+* Prepends {@link ALWAYS_IGNORE} (the guard dir and scratch files) to the consumer's
+* `excludePaths`, applying the workspace-preserving `apps/<name>` rule so other apps'
+* code is dropped while their `package.json` stays for the build's dependency graph.
+*
+* @param excludePaths Consumer-supplied paths to exclude (optional)
+* @returns The ignore body, one pattern per line
+* @example
+* ```typescript
+* buildVercelIgnore(["apps/mesh", "docs"]);
+* // ".git-infracraft-pulumi-guard\n…\napps/mesh/**\n!apps/mesh/package.json\ndocs"
+* ```
+*/
+function buildVercelIgnore(excludePaths) {
+	const excludeLines = (excludePaths ?? []).map((entry) => entry.startsWith("apps/") ? `${entry}/**\n!${entry}/package.json` : entry);
+	return [...ALWAYS_IGNORE, ...excludeLines].join("\n");
+}
+/**
+* Builds the `create` shell command that wraps `vercel deploy` in the ignore engine.
+*
+* The engine acquires a mkdir lock, parks any committed `.vercelignore` at
+* {@link IGNORE_BACKUP}, writes the generated body (`printf` expands the encoded `\n`
+* sequences), runs the deploy, and — in a background timer so a slow remote build does
+* not block sibling deploys — restores the parked file and releases the lock. The
+* deploy's exit status is captured into `EXIT` before `wait`, so the Pulumi resource
+* fails when the deploy fails.
+*
+* @param excludePaths Consumer-supplied paths to exclude (optional)
+* @returns A single-line shell command (no raw newlines)
+*/
+function buildVercelDeployCommand(excludePaths) {
+	return `while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; if [ -f .vercelignore ]; then mv .vercelignore ${IGNORE_BACKUP}; fi; printf '${buildVercelIgnore(excludePaths).replace(/\n/g, "\\n")}\\n' > .vercelignore; { sleep 8; ${`rm -f .vercelignore; [ -f ${IGNORE_BACKUP} ] && mv ${IGNORE_BACKUP} .vercelignore`}; rmdir ${LOCK_DIR} 2>/dev/null; } & vercel deploy --prod --yes; EXIT=$?; wait; exit $EXIT`;
+}
+/**
+* Deploys a Vercel project via `vercel deploy --prod --yes`, generating a
+* `.vercelignore` around the upload — the same exclude engine as `RailwayDeploy`.
 *
 * Triggers on source hash (computed from the app directory) and env content hash
 * (from `VercelVariable.contentHash`). When an env value changes — whether from
 * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes
 * and a redeploy is triggered.
 *
+* The upload is wrapped in an ignore engine mirroring Railway's: a mkdir lock
+* serializes the brief window in which `.vercelignore` must be consistent, the file is
+* written (gitGuard guard dir + {@link VercelDeployArgs.excludePaths}), then a
+* background timer restores the repository and releases the lock so concurrent deploys
+* stream. Any committed `.vercelignore` is parked at {@link IGNORE_BACKUP} and restored
+* afterward, so this never destroys a consumer's file — and because a committed
+* `.vercelignore` is git-tracked, a hard-killed run is recoverable with
+* `git checkout .vercelignore`.
+*
 * @example
 * ```typescript
 * new VercelDeploy("nexus-deploy", {
 *   projectId: vercelProject.id,
-*   rootDirectory: "apps/nexus",
 *   monorepoRoot,
-*   env: { NEXT_PUBLIC_API_URL: meshUrl },
+*   triggers: [sourceHash, envHash],
+*   excludePaths: ["apps/mesh", "docs"],
 * }, { provider });
 * ```
 */
@@ -29,7 +96,7 @@ var VercelDeploy = class extends pulumi.ComponentResource {
 		const projectId = project ? project.id : args.projectId;
 		if (!projectId) throw new Error("VercelDeploy: either `args.projectId` or `opts.project` must be provided");
 		const deployCmd = new command.local.Command(`${name}-deploy`, {
-			create: "vercel deploy --prod --yes",
+			create: buildVercelDeployCommand(args.excludePaths),
 			triggers: args.triggers,
 			dir: stableDir(args.monorepoRoot),
 			environment: {
@@ -44,5 +111,5 @@ var VercelDeploy = class extends pulumi.ComponentResource {
 };
 
 //#endregion
-export { VercelDeploy };
+export { VercelDeploy, buildVercelDeployCommand, buildVercelIgnore };
 //# sourceMappingURL=deploy.mjs.map

package/dist/vercel/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { stableDir } from \"../stable-dir\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\n/** Options type for VercelDeploy — replaces Pulumi's native `provider` field. */\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\n\t/**\n\t * VercelProject resource to source the project ID from.\n\t * When provided, `args.projectId` is optional and ignored if both are given.\n\t */\n\tproject?: VercelProject;\n};\n\n/** Args for VercelDeploy. */\nexport interface VercelDeployArgs {\n\t/**\n\t * Vercel project ID.\n\t * Required when `opts.project` is not provided.\n\t */\n\tprojectId?: pulumi.Input<string>;\n\n\t/**\n\t * Absolute path to the monorepo root (working directory for `vercel deploy`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tmonorepoRoot: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n}\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes` CLI.\n *\n * Triggers on source hash (computed from the app directory) and env content hash\n * (from `VercelVariable.contentHash`). When an env value changes — whether from\n * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes\n * and a redeploy is triggered.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus-deploy\", {\n *   projectId: vercelProject.id,\n *   rootDirectory: \"apps/nexus\",\n *   monorepoRoot,\n *   env: { NEXT_PUBLIC_API_URL: meshUrl },\n * }, { provider });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\t/**\n\t * The production deployment URL printed by `vercel deploy` (its final stdout line).\n\t * Surfaces the deployed link in stack outputs after `pulumi up` without visiting the dashboard.\n\t */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst deployCmd = new command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: \"vercel deploy --prod --yes\",\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.monorepoRoot),\n\t\t\t\tenvironment: {\n\t\t\t\t\tVERCEL_TOKEN: provider.token,\n\t\t\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.deploymentUrl = deployCmd.stdout.apply(\n\t\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t\t);\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAuDA,IAAa,eAAb,cAAkC,OAAO,kBAAkB;CAO1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,YAAY,IAAI,QAAQ,MAAM,QACnC,GAAG,KAAK,UACR;GACC,QAAQ;GACR,UAAU,KAAK;GACf,KAAK,UAAU,KAAK,YAAY;GAChC,aAAa;IACZ,cAAc,SAAS;IACvB,eAAe,SAAS;IACxB,mBAAmB;GACpB;EACD,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,UAAU,OAAO,OACpC,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAC1C;EAEA,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as command from \"@pulumi/command\";\nimport * as pulumi from \"@pulumi/pulumi\";\nimport { GUARD_DIR, LEGACY_GUARD_DIRS } from \"../git-guard\";\nimport { stableDir } from \"../stable-dir\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\n/** Options type for VercelDeploy — replaces Pulumi's native `provider` field. */\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\n\t/**\n\t * VercelProject resource to source the project ID from.\n\t * When provided, `args.projectId` is optional and ignored if both are given.\n\t */\n\tproject?: VercelProject;\n};\n\n/** Args for VercelDeploy. */\nexport interface VercelDeployArgs {\n\t/**\n\t * Vercel project ID.\n\t * Required when `opts.project` is not provided.\n\t */\n\tprojectId?: pulumi.Input<string>;\n\n\t/**\n\t * Absolute path to the monorepo root (working directory for `vercel deploy`).\n\t * Stored relative to the Pulumi program directory so the command stays stable\n\t * across machines and CI (see {@link stableDir}).\n\t */\n\tmonorepoRoot: string;\n\n\t/** Values that trigger a redeploy when changed (e.g. source hashes, env hashes). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\n\t/**\n\t * Paths to exclude from the upload via a generated `.vercelignore`, mirroring\n\t * `RailwayDeployArgs.excludePaths`. An `apps/<name>` entry excludes that app's\n\t * code but keeps its `package.json`, so the workspace graph still resolves during\n\t * the monorepo build. The gitGuard guard dir is always excluded regardless of this\n\t * list — see {@link buildVercelIgnore}.\n\t */\n\texcludePaths?: string[];\n}\n\n/** mkdir-based lock serializing the brief window when `.vercelignore` is written. */\nconst LOCK_DIR = \"/tmp/.vercel-upload-lock\";\n\n/** Where a committed `.vercelignore` is parked while the engine owns the file. */\nconst IGNORE_BACKUP = \".vercelignore.infracraft-bak\";\n\n/**\n * Patterns the engine ALWAYS writes to `.vercelignore`, independent of `excludePaths`.\n *\n * `gitGuard` hides the real `.git` by renaming it to {@link GUARD_DIR} (or a\n * {@link LEGACY_GUARD_DIRS} name) for the duration of a deploy, leaving a stub `.git`.\n * Vercel default-ignores `.git` but NOT the renamed guard dir, and — unlike the Railway\n * CLI — Vercel never reads `.gitignore` (where gitGuard also records the guard dir).\n * Without this exclusion the renamed real `.git`, with its 100MB+ pack files, is\n * uploaded and trips Vercel's 100MB-per-file limit. The transient `.vercelignore*` (the\n * generated file and its {@link IGNORE_BACKUP}) is excluded too, so the engine's own\n * scratch files never ship.\n */\nconst ALWAYS_IGNORE: readonly string[] = [\n\tGUARD_DIR,\n\t...LEGACY_GUARD_DIRS,\n\t\".vercelignore*\",\n];\n\n/**\n * Builds the newline-joined `.vercelignore` body for the deploy.\n *\n * Prepends {@link ALWAYS_IGNORE} (the guard dir and scratch files) to the consumer's\n * `excludePaths`, applying the workspace-preserving `apps/<name>` rule so other apps'\n * code is dropped while their `package.json` stays for the build's dependency graph.\n *\n * @param excludePaths Consumer-supplied paths to exclude (optional)\n * @returns The ignore body, one pattern per line\n * @example\n * ```typescript\n * buildVercelIgnore([\"apps/mesh\", \"docs\"]);\n * // \".git-infracraft-pulumi-guard\\n…\\napps/mesh/**\\n!apps/mesh/package.json\\ndocs\"\n * ```\n */\nexport function buildVercelIgnore(excludePaths?: string[]): string {\n\tconst excludeLines = (excludePaths ?? []).map((entry) =>\n\t\tentry.startsWith(\"apps/\") ? `${entry}/**\\n!${entry}/package.json` : entry,\n\t);\n\n\treturn [...ALWAYS_IGNORE, ...excludeLines].join(\"\\n\");\n}\n\n/**\n * Builds the `create` shell command that wraps `vercel deploy` in the ignore engine.\n *\n * The engine acquires a mkdir lock, parks any committed `.vercelignore` at\n * {@link IGNORE_BACKUP}, writes the generated body (`printf` expands the encoded `\\n`\n * sequences), runs the deploy, and — in a background timer so a slow remote build does\n * not block sibling deploys — restores the parked file and releases the lock. The\n * deploy's exit status is captured into `EXIT` before `wait`, so the Pulumi resource\n * fails when the deploy fails.\n *\n * @param excludePaths Consumer-supplied paths to exclude (optional)\n * @returns A single-line shell command (no raw newlines)\n */\nexport function buildVercelDeployCommand(excludePaths?: string[]): string {\n\tconst ignoreBody = buildVercelIgnore(excludePaths).replace(/\\n/g, \"\\\\n\");\n\n\tconst restore = `rm -f .vercelignore; [ -f ${IGNORE_BACKUP} ] && mv ${IGNORE_BACKUP} .vercelignore`;\n\n\treturn (\n\t\t`while ! mkdir ${LOCK_DIR} 2>/dev/null; do sleep 1; done; ` +\n\t\t`if [ -f .vercelignore ]; then mv .vercelignore ${IGNORE_BACKUP}; fi; ` +\n\t\t`printf '${ignoreBody}\\\\n' > .vercelignore; ` +\n\t\t`{ sleep 8; ${restore}; rmdir ${LOCK_DIR} 2>/dev/null; } & ` +\n\t\t`vercel deploy --prod --yes; EXIT=$?; wait; exit $EXIT`\n\t);\n}\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes`, generating a\n * `.vercelignore` around the upload — the same exclude engine as `RailwayDeploy`.\n *\n * Triggers on source hash (computed from the app directory) and env content hash\n * (from `VercelVariable.contentHash`). When an env value changes — whether from\n * code, a new mesh URL, or a drift fix after `pulumi refresh` — the hash changes\n * and a redeploy is triggered.\n *\n * The upload is wrapped in an ignore engine mirroring Railway's: a mkdir lock\n * serializes the brief window in which `.vercelignore` must be consistent, the file is\n * written (gitGuard guard dir + {@link VercelDeployArgs.excludePaths}), then a\n * background timer restores the repository and releases the lock so concurrent deploys\n * stream. Any committed `.vercelignore` is parked at {@link IGNORE_BACKUP} and restored\n * afterward, so this never destroys a consumer's file — and because a committed\n * `.vercelignore` is git-tracked, a hard-killed run is recoverable with\n * `git checkout .vercelignore`.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus-deploy\", {\n *   projectId: vercelProject.id,\n *   monorepoRoot,\n *   triggers: [sourceHash, envHash],\n *   excludePaths: [\"apps/mesh\", \"docs\"],\n * }, { provider });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\t/**\n\t * The production deployment URL printed by `vercel deploy` (its final stdout line).\n\t * Surfaces the deployed link in stack outputs after `pulumi up` without visiting the dashboard.\n\t */\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst deployCmd = new command.local.Command(\n\t\t\t`${name}-deploy`,\n\t\t\t{\n\t\t\t\tcreate: buildVercelDeployCommand(args.excludePaths),\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\tdir: stableDir(args.monorepoRoot),\n\t\t\t\tenvironment: {\n\t\t\t\t\tVERCEL_TOKEN: provider.token,\n\t\t\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this },\n\t\t);\n\n\t\tthis.deploymentUrl = deployCmd.stdout.apply(\n\t\t\t(out) => out.trim().split(\"\\n\").pop() ?? \"\",\n\t\t);\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;AAgDA,MAAM,WAAW;;AAGjB,MAAM,gBAAgB;;;;;;;;;;;;;AActB,MAAM,gBAAmC;CACxC;CACA,GAAG;CACH;AACD;;;;;;;;;;;;;;;;AAiBA,SAAgB,kBAAkB,cAAiC;CAClE,MAAM,gBAAgB,gBAAgB,CAAC,GAAG,KAAK,UAC9C,MAAM,WAAW,OAAO,IAAI,GAAG,MAAM,QAAQ,MAAM,iBAAiB,KACrE;CAEA,OAAO,CAAC,GAAG,eAAe,GAAG,YAAY,EAAE,KAAK,IAAI;AACrD;;;;;;;;;;;;;;AAeA,SAAgB,yBAAyB,cAAiC;CAKzE,OACC,iBAAiB,SAAS,iFACwB,cAAc,gBAN9C,kBAAkB,YAAY,EAAE,QAAQ,OAAO,KAO7C,EAAE,mCACR,6BAN8B,cAAc,WAAW,cAAc,gBAM7D,UAAU,SAAS;AAG3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,IAAa,eAAb,cAAkC,OAAO,kBAAkB;CAO1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,YAAY,IAAI,QAAQ,MAAM,QACnC,GAAG,KAAK,UACR;GACC,QAAQ,yBAAyB,KAAK,YAAY;GAClD,UAAU,KAAK;GACf,KAAK,UAAU,KAAK,YAAY;GAChC,aAAa;IACZ,cAAc,SAAS;IACvB,eAAe,SAAS;IACxB,mBAAmB;GACpB;EACD,GACA,EAAE,QAAQ,KAAK,CAChB;EAEA,KAAK,gBAAgB,UAAU,OAAO,OACpC,QAAQ,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,IAAI,KAAK,EAC1C;EAEA,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@infracraft/pulumi",
-	"version": "1.13.1",
+	"version": "1.14.0",
 	"type": "module",
 	"license": "MIT",
 	"repository": {