@infracraft/pulumi 1.30.3 → 1.31.0

package/README.md

@@ -33,7 +33,7 @@ Native Pulumi providers with adopt-or-create semantics and deploy orchestration.
 |---|---|---|---|
 | 🚂 | **Railway** | `@infracraft/pulumi/railway` | The only Pulumi provider for Railway. Projects, environments, services, variables, volumes, domains, deploy tokens, deploys. |
 | 🐘 | **Neon** | `@infracraft/pulumi/neon` | Adopt-or-create layer for Neon Postgres. Projects, branches, endpoints, roles, databases. |
-| ▲ | **Vercel** | `@infracraft/pulumi/vercel` | Projects with adopt-or-create, deploy orchestration, custom domains, marketplace resources, and sensitive env var drift detection. |
+| ▲ | **Vercel** | `@infracraft/pulumi/vercel` | Projects with adopt-or-create, deploy orchestration with deploy-integrated env vars, custom domains, and marketplace resources. |
 | 🎯 | **Fly.io** | `@infracraft/pulumi/fly` | App, Secret, Volume, Certificate, IP, and Deploy resources via the Machines REST API and Fly GraphQL API. |
 | 🤖 | **Agents** | `@infracraft/pulumi/agents` | Emit operating hints for AI coding agents working on the stack. |
 | #️⃣ | **Hash** | `@infracraft/pulumi/hash` | Deterministic directory/env-var/app hashing for deploy triggers. |
@@ -232,7 +232,6 @@ Leave the version unset until the first rotation is needed. Identity changes (na
 import {
   VercelProvider,
   VercelProject,
-  VercelVariable,
   VercelDeploy,
   VercelDomain,
   VercelIntegration,
@@ -255,12 +254,12 @@ const project = new VercelProject("web", {
 // project.url is a full https:// URL — custom domain or <name>.vercel.app
 export const url = project.url
 
-const vars = new VercelVariable("web-vars", {
-  variables: { NEXT_PUBLIC_API_URL: apiUrl },
-}, { provider, project })
-
+// Env vars are applied by the deploy command itself, right before
+// `vercel deploy` — see "Deploy-integrated env vars" below. A change to any
+// variable redeploys automatically (a non-secret digest joins the triggers).
 new VercelDeploy("web-deploy", {
-  triggers: [hash("apps/web"), vars.contentHash],
+  variables: { NEXT_PUBLIC_API_URL: apiUrl },
+  triggers: [hash("apps/web")],
 }, { provider, project })
 
 // Custom domain: point the domain's DNS CNAME at `cnameTarget`
@@ -295,8 +294,8 @@ new VercelResourceConnection("kv-conn", {
 |---|---|---|
 | `VercelProvider` | — | `token` or `tokenEnvVar` (see [Provider credentials](#provider-credentials)) + `teamId` |
 | `VercelProject` | `.id`, `.url` | `.url` is a full `https://` URL; prefers the custom production domain over `<name>.vercel.app`. Deletes the project on destroy — `protect: true` production projects |
-| `VercelVariable` | `.contentHash` | Use as a deploy trigger to redeploy on env var changes. Takes `opts.project` or `args.projectId` |
-| `VercelDeploy` | `.deploymentUrl` | Runs `vercel deploy --prod --yes` |
+| `VercelVariable` | `.contentHash` | ⚠️ Deprecated — prefer `VercelDeploy.variables`. As a dynamic resource it hits a Pulumi engine-level marshal bug on clean-slate creates ("Unexpected struct type", alternating pass/fail across identical from-zero runs, reproduced with plain-literal inputs) — see [Deploy-integrated env vars](#deploy-integrated-env-vars). Stays exported for existing stacks |
+| `VercelDeploy` | `.deploymentUrl` | Runs `vercel deploy --prod --yes`; optional `variables` map is upserted (production + preview + development) by the deploy command itself right before the deploy, and hashed into the triggers so variable changes redeploy |
 | `VercelDomain` | `.name`, `.verified`, `.cnameTarget` | Attaches a custom domain to a project (adopt-or-create); `.cnameTarget` is Vercel's own DNS recommendation for that specific domain |
 | `VercelIntegration` | `.configurationId` (`icfg_…`) | Resolves an installed marketplace integration by slug (install it once via the dashboard first) |
 | `VercelMarketplaceResource` | `.id`, `.externalResourceId`, `.status` | Provisions a marketplace store; `type` is the integration product ID or slug |
@@ -305,6 +304,17 @@ new VercelResourceConnection("kv-conn", {
 
 **Helpers:** `VERCEL_FRAMEWORKS` (const array), `VercelFramework` (derived union type)
 
+### Deploy-integrated env vars
+
+`VercelDeploy.variables` applies env vars inside the deploy command flow instead of as a Pulumi resource, because the dynamic-resource path (`VercelVariable`) hits a Pulumi engine-internal stateful bug on clean-slate first creates: "Unexpected struct type", strictly alternating pass/fail across identical from-zero runs, reproduced with plain-literal inputs — zero Outputs or secrets — on matched CLI/SDK versions, with four structural theories falsified by bisection. No input shape avoids an engine-internal bug, so the fix is architectural: keep env vars off the dynamic-provider marshal path entirely, the same way `RailwayDeploy`'s monitor bin owns Railway's imperative deploy steps.
+
+When `variables` is set, the deploy command runs a standalone applier bin (`node dist/vercel/bin/apply-env.mjs`) before `vercel deploy --prod --yes`:
+
+- Each entry is upserted for production + preview + development — created, or updated in place when the key already exists (ENV_CONFLICT) — via the same REST logic `VercelVariable` uses.
+- The key→value payload travels as a secret JSON value in the command environment (`IC_VC_ENV_JSON`), masked in state and never present in the script text pulumi-command echoes on failure. Values must be known at preview (config-derived) — the same class as the token the command env already carries.
+- A non-secret digest of the variables joins the command triggers automatically, so any variable change redeploys.
+- The applier logs one line per applied key (names only, never values) and exits non-zero on the first failed key — the deploy never runs against a half-applied environment.
+
 ## Fly.io
 
 ```typescript

package/dist/vercel/bin/apply-env.cjs

@@ -0,0 +1,37 @@
+const require_chunk = require('../../chunk-BVYJZCqc.cjs');
+const require_vercel_env_applier = require('../env-applier.cjs');
+
+//#region src/vercel/bin/apply-env.ts
+/**
+* Runnable entry for the Vercel env applier — invoked by `VercelDeploy` as
+* `node <dist>/vercel/bin/apply-env.mjs` right before `vercel deploy` when
+* `variables` are configured.
+*
+* Reads the deploy context from the command environment (`VERCEL_TOKEN`,
+* `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID` — the same names the deploy CLI already
+* receives — plus `IC_VC_ENV_JSON`, the JSON key→value payload), applies the
+* variables via the Vercel REST API, and exits non-zero on the first failure.
+* All upsert logic lives in the unit-tested `env-applier` module; this file is
+* only IO + process glue.
+*/
+/** Reads a required env var, failing loudly — naming it — when unset. */
+function requireEnv(name) {
+	const value = process.env[name];
+	if (!value) throw new Error(`${name} is not set in the deploy command environment`);
+	return value;
+}
+async function main() {
+	await require_vercel_env_applier.applyVercelEnv({
+		token: requireEnv("VERCEL_TOKEN"),
+		teamId: requireEnv("VERCEL_ORG_ID"),
+		projectId: requireEnv("VERCEL_PROJECT_ID"),
+		variables: JSON.parse(requireEnv("IC_VC_ENV_JSON"))
+	}, { log: (line) => process.stderr.write(`[infracraft] ${line}\n`) });
+}
+main().catch((error) => {
+	process.stderr.write(`[infracraft] vercel env applier failed: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exit(1);
+});
+
+//#endregion
+//# sourceMappingURL=apply-env.cjs.map

package/dist/vercel/bin/apply-env.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-env.cjs","names":["applyVercelEnv"],"sources":["../../../src/vercel/bin/apply-env.ts"],"sourcesContent":["/**\n * Runnable entry for the Vercel env applier — invoked by `VercelDeploy` as\n * `node <dist>/vercel/bin/apply-env.mjs` right before `vercel deploy` when\n * `variables` are configured.\n *\n * Reads the deploy context from the command environment (`VERCEL_TOKEN`,\n * `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID` — the same names the deploy CLI already\n * receives — plus `IC_VC_ENV_JSON`, the JSON key→value payload), applies the\n * variables via the Vercel REST API, and exits non-zero on the first failure.\n * All upsert logic lives in the unit-tested `env-applier` module; this file is\n * only IO + process glue.\n */\nimport { applyVercelEnv } from \"../env-applier\";\n\n/** Reads a required env var, failing loudly — naming it — when unset. */\nfunction requireEnv(name: string): string {\n\tconst value = process.env[name];\n\n\tif (!value) {\n\t\tthrow new Error(`${name} is not set in the deploy command environment`);\n\t}\n\n\treturn value;\n}\n\nasync function main(): Promise<void> {\n\tawait applyVercelEnv(\n\t\t{\n\t\t\ttoken: requireEnv(\"VERCEL_TOKEN\"),\n\t\t\tteamId: requireEnv(\"VERCEL_ORG_ID\"),\n\t\t\tprojectId: requireEnv(\"VERCEL_PROJECT_ID\"),\n\t\t\tvariables: JSON.parse(requireEnv(\"IC_VC_ENV_JSON\")) as Record<\n\t\t\t\tstring,\n\t\t\t\tstring\n\t\t\t>,\n\t\t},\n\t\t{ log: (line) => process.stderr.write(`[infracraft] ${line}\\n`) },\n\t);\n}\n\nmain().catch((error) => {\n\tprocess.stderr.write(\n\t\t`[infracraft] vercel env applier failed: ${error instanceof Error ? error.message : String(error)}\\n`,\n\t);\n\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,SAAS,WAAW,MAAsB;CACzC,MAAM,QAAQ,QAAQ,IAAI;CAE1B,IAAI,CAAC,OACJ,MAAM,IAAI,MAAM,GAAG,KAAK,8CAA8C;CAGvE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,MAAMA,0CACL;EACC,OAAO,WAAW,cAAc;EAChC,QAAQ,WAAW,eAAe;EAClC,WAAW,WAAW,mBAAmB;EACzC,WAAW,KAAK,MAAM,WAAW,gBAAgB,CAAC;CAInD,GACA,EAAE,MAAM,SAAS,QAAQ,OAAO,MAAM,gBAAgB,KAAK,GAAG,EAAE,CACjE;AACD;AAEA,KAAK,EAAE,OAAO,UAAU;CACvB,QAAQ,OAAO,MACd,2CAA2C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACnG;CAEA,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/vercel/bin/apply-env.d.cts

@@ -0,0 +1 @@
+export { };

package/dist/vercel/bin/apply-env.d.mts

@@ -0,0 +1 @@
+export { };

package/dist/vercel/bin/apply-env.mjs

@@ -0,0 +1,38 @@
+import { t as __name } from "../../chunk-OPjESj5l.mjs";
+import { applyVercelEnv } from "../env-applier.mjs";
+
+//#region src/vercel/bin/apply-env.ts
+/**
+* Runnable entry for the Vercel env applier — invoked by `VercelDeploy` as
+* `node <dist>/vercel/bin/apply-env.mjs` right before `vercel deploy` when
+* `variables` are configured.
+*
+* Reads the deploy context from the command environment (`VERCEL_TOKEN`,
+* `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID` — the same names the deploy CLI already
+* receives — plus `IC_VC_ENV_JSON`, the JSON key→value payload), applies the
+* variables via the Vercel REST API, and exits non-zero on the first failure.
+* All upsert logic lives in the unit-tested `env-applier` module; this file is
+* only IO + process glue.
+*/
+/** Reads a required env var, failing loudly — naming it — when unset. */
+function requireEnv(name) {
+	const value = process.env[name];
+	if (!value) throw new Error(`${name} is not set in the deploy command environment`);
+	return value;
+}
+async function main() {
+	await applyVercelEnv({
+		token: requireEnv("VERCEL_TOKEN"),
+		teamId: requireEnv("VERCEL_ORG_ID"),
+		projectId: requireEnv("VERCEL_PROJECT_ID"),
+		variables: JSON.parse(requireEnv("IC_VC_ENV_JSON"))
+	}, { log: (line) => process.stderr.write(`[infracraft] ${line}\n`) });
+}
+main().catch((error) => {
+	process.stderr.write(`[infracraft] vercel env applier failed: ${error instanceof Error ? error.message : String(error)}\n`);
+	process.exit(1);
+});
+
+//#endregion
+export {  };
+//# sourceMappingURL=apply-env.mjs.map

package/dist/vercel/bin/apply-env.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-env.mjs","names":[],"sources":["../../../src/vercel/bin/apply-env.ts"],"sourcesContent":["/**\n * Runnable entry for the Vercel env applier — invoked by `VercelDeploy` as\n * `node <dist>/vercel/bin/apply-env.mjs` right before `vercel deploy` when\n * `variables` are configured.\n *\n * Reads the deploy context from the command environment (`VERCEL_TOKEN`,\n * `VERCEL_ORG_ID`, `VERCEL_PROJECT_ID` — the same names the deploy CLI already\n * receives — plus `IC_VC_ENV_JSON`, the JSON key→value payload), applies the\n * variables via the Vercel REST API, and exits non-zero on the first failure.\n * All upsert logic lives in the unit-tested `env-applier` module; this file is\n * only IO + process glue.\n */\nimport { applyVercelEnv } from \"../env-applier\";\n\n/** Reads a required env var, failing loudly — naming it — when unset. */\nfunction requireEnv(name: string): string {\n\tconst value = process.env[name];\n\n\tif (!value) {\n\t\tthrow new Error(`${name} is not set in the deploy command environment`);\n\t}\n\n\treturn value;\n}\n\nasync function main(): Promise<void> {\n\tawait applyVercelEnv(\n\t\t{\n\t\t\ttoken: requireEnv(\"VERCEL_TOKEN\"),\n\t\t\tteamId: requireEnv(\"VERCEL_ORG_ID\"),\n\t\t\tprojectId: requireEnv(\"VERCEL_PROJECT_ID\"),\n\t\t\tvariables: JSON.parse(requireEnv(\"IC_VC_ENV_JSON\")) as Record<\n\t\t\t\tstring,\n\t\t\t\tstring\n\t\t\t>,\n\t\t},\n\t\t{ log: (line) => process.stderr.write(`[infracraft] ${line}\\n`) },\n\t);\n}\n\nmain().catch((error) => {\n\tprocess.stderr.write(\n\t\t`[infracraft] vercel env applier failed: ${error instanceof Error ? error.message : String(error)}\\n`,\n\t);\n\n\tprocess.exit(1);\n});\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,SAAS,WAAW,MAAsB;CACzC,MAAM,QAAQ,QAAQ,IAAI;CAE1B,IAAI,CAAC,OACJ,MAAM,IAAI,MAAM,GAAG,KAAK,8CAA8C;CAGvE,OAAO;AACR;AAEA,eAAe,OAAsB;CACpC,MAAM,eACL;EACC,OAAO,WAAW,cAAc;EAChC,QAAQ,WAAW,eAAe;EAClC,WAAW,WAAW,mBAAmB;EACzC,WAAW,KAAK,MAAM,WAAW,gBAAgB,CAAC;CAInD,GACA,EAAE,MAAM,SAAS,QAAQ,OAAO,MAAM,gBAAgB,KAAK,GAAG,EAAE,CACjE;AACD;AAEA,KAAK,EAAE,OAAO,UAAU;CACvB,QAAQ,OAAO,MACd,2CAA2C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,GACnG;CAEA,QAAQ,KAAK,CAAC;AACf,CAAC"}

package/dist/vercel/deploy.cjs

@@ -4,21 +4,39 @@ const require_commands_deploy = require('../commands/deploy.cjs');
 const require_dynamic_resolve_credential = require('../dynamic/resolve-credential.cjs');
 let _pulumi_pulumi = require("@pulumi/pulumi");
 _pulumi_pulumi = require_chunk.__toESM(_pulumi_pulumi, 1);
+let node_crypto = require("node:crypto");
+node_crypto = require_chunk.__toESM(node_crypto, 1);
+let node_url = require("node:url");
 
 //#region src/vercel/deploy.ts
 /**
+* Absolute path to the runnable env applier, resolved next to this module in
+* `dist`. Runs as a plain Node step of the deploy command (mirroring Railway's
+* deploy monitor bin) so env vars never touch the dynamic-provider marshal
+* path. Its logic lives in the unit-tested `env-applier` module.
+*/
+const APPLY_ENV_BIN = (0, node_url.fileURLToPath)(new URL("./bin/apply-env.mjs", require("url").pathToFileURL(__filename).href));
+/**
 * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and
 * git-metadata handling are entirely the seam's job — list a `DeploySandbox`
 * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.
 *
+* Pass `variables` to apply the project's env vars as part of the deploy
+* command (see `VercelDeployArgs.variables` for why this replaces
+* `VercelVariable`).
+*
 * Recommended preflight: `assertHostBinaries(["vercel"])` (from
 * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast
 * with an install hint instead of mid-deploy.
 *
 * @example
 * ```typescript
-* new VercelDeploy("nexus", { projectId: project.id, triggers: [sourceHash, envHash], excludePaths: ["apps/mesh"] },
-*   { provider, dependsOn: [sandbox, gitGuard] });
+* new VercelDeploy("nexus", {
+*   projectId: project.id,
+*   variables: { NEXT_PUBLIC_API_URL: apiUrl },
+*   triggers: [sourceHash],
+*   excludePaths: ["apps/mesh"],
+* }, { provider, dependsOn: [sandbox, gitGuard] });
 * ```
 */
 var VercelDeploy = class extends _pulumi_pulumi.ComponentResource {
@@ -27,16 +45,26 @@ var VercelDeploy = class extends _pulumi_pulumi.ComponentResource {
 		super("infracraft:vercel:Deploy", name, {}, pulumiOpts);
 		const projectId = project ? project.id : args.projectId;
 		if (!projectId) throw new Error("VercelDeploy: either `args.projectId` or `opts.project` must be provided");
+		const environment = {
+			VERCEL_TOKEN: require_dynamic_resolve_credential.resolveCredentialOutput(provider.token, provider.tokenEnvVar),
+			VERCEL_ORG_ID: provider.teamId,
+			VERCEL_PROJECT_ID: projectId
+		};
+		let cli = "vercel deploy --prod --yes";
+		let triggers = args.triggers;
+		if (args.variables) {
+			const variablesJson = _pulumi_pulumi.output(args.variables).apply((variables) => JSON.stringify(Object.fromEntries(Object.entries(variables).sort(([a], [b]) => a.localeCompare(b)))));
+			environment.IC_VC_ENV_JSON = _pulumi_pulumi.secret(variablesJson);
+			const variablesDigest = _pulumi_pulumi.unsecret(variablesJson.apply((json) => node_crypto.createHash("sha256").update(json).digest("hex")));
+			triggers = _pulumi_pulumi.output(args.triggers).apply((existing) => [...existing, variablesDigest]);
+			cli = `node "${APPLY_ENV_BIN}" && ${cli}`;
+		}
 		const { deploymentUrl } = require_commands_deploy.createDeployCommand({
 			name,
-			cli: "vercel deploy --prod --yes",
-			triggers: args.triggers,
+			cli,
+			triggers,
 			excludePaths: args.excludePaths,
-			environment: {
-				VERCEL_TOKEN: require_dynamic_resolve_credential.resolveCredentialOutput(provider.token, provider.tokenEnvVar),
-				VERCEL_ORG_ID: provider.teamId,
-				VERCEL_PROJECT_ID: projectId
-			}
+			environment
 		}, {
 			parent: this,
 			...pulumiOpts

package/dist/vercel/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["pulumi","createDeployCommand","resolveCredentialOutput"],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport { resolveCredentialOutput } from \"../dynamic/resolve-credential\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\t/** VercelProject to source the project ID from (optional if `args.projectId` given). */\n\tproject?: VercelProject;\n};\n\nexport interface VercelDeployArgs {\n\t/** Vercel project ID. Required when `opts.project` is not provided. */\n\tprojectId?: pulumi.Input<string>;\n\t/** Redeploy triggers (e.g. source hash, env content hash). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n}\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and\n * git-metadata handling are entirely the seam's job — list a `DeploySandbox`\n * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.\n *\n * Recommended preflight: `assertHostBinaries([\"vercel\"])` (from\n * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast\n * with an install hint instead of mid-deploy.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus\", { projectId: project.id, triggers: [sourceHash, envHash], excludePaths: [\"apps/mesh\"] },\n *   { provider, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli: \"vercel deploy --prod --yes\",\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tenvironment: {\n\t\t\t\t\t// Resolved at program runtime (secret) so the CLI still gets the\n\t\t\t\t\t// actual value when the provider is configured via tokenEnvVar —\n\t\t\t\t\t// without the credential ever being a dynamic-resource input.\n\t\t\t\t\tVERCEL_TOKEN: resolveCredentialOutput(\n\t\t\t\t\t\tprovider.token,\n\t\t\t\t\t\tprovider.tokenEnvVar,\n\t\t\t\t\t),\n\t\t\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAa,eAAb,cAAkCA,eAAO,kBAAkB;CAG1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,EAAE,kBAAkBC,4CACzB;GACC;GACA,KAAK;GACL,UAAU,KAAK;GACf,cAAc,KAAK;GACnB,aAAa;IAIZ,cAAcC,2DACb,SAAS,OACT,SAAS,WACV;IACA,eAAe,SAAS;IACxB,mBAAmB;GACpB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}
+{"version":3,"file":"deploy.cjs","names":["pulumi","resolveCredentialOutput","crypto","createDeployCommand"],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as crypto from \"node:crypto\";\nimport { fileURLToPath } from \"node:url\";\n\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport { resolveCredentialOutput } from \"../dynamic/resolve-credential\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\t/** VercelProject to source the project ID from (optional if `args.projectId` given). */\n\tproject?: VercelProject;\n};\n\nexport interface VercelDeployArgs {\n\t/** Vercel project ID. Required when `opts.project` is not provided. */\n\tprojectId?: pulumi.Input<string>;\n\t/** Redeploy triggers (e.g. source hash, env content hash). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/**\n\t * Env vars upserted for the project (production + preview + development)\n\t * by the deploy command itself, right before `vercel deploy` runs — the\n\t * preferred replacement for `VercelVariable`. The dynamic-resource path\n\t * hits a Pulumi engine-internal stateful bug on clean-slate first creates\n\t * (\"Unexpected struct type\", strictly alternating pass/fail across\n\t * identical from-zero runs, reproduced with plain-literal inputs and zero\n\t * secrets), so env vars are applied inside the command flow, off the\n\t * dynamic-provider marshal path entirely. A change to any variable\n\t * redeploys automatically (a non-secret digest of the map joins the\n\t * command triggers). Values must be known at preview (config-derived) —\n\t * the same class as the token the command env already carries.\n\t */\n\tvariables?: pulumi.Input<Record<string, pulumi.Input<string>>>;\n}\n\n/**\n * Absolute path to the runnable env applier, resolved next to this module in\n * `dist`. Runs as a plain Node step of the deploy command (mirroring Railway's\n * deploy monitor bin) so env vars never touch the dynamic-provider marshal\n * path. Its logic lives in the unit-tested `env-applier` module.\n */\nconst APPLY_ENV_BIN = fileURLToPath(\n\tnew URL(\"./bin/apply-env.mjs\", import.meta.url),\n);\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and\n * git-metadata handling are entirely the seam's job — list a `DeploySandbox`\n * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.\n *\n * Pass `variables` to apply the project's env vars as part of the deploy\n * command (see `VercelDeployArgs.variables` for why this replaces\n * `VercelVariable`).\n *\n * Recommended preflight: `assertHostBinaries([\"vercel\"])` (from\n * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast\n * with an install hint instead of mid-deploy.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus\", {\n *   projectId: project.id,\n *   variables: { NEXT_PUBLIC_API_URL: apiUrl },\n *   triggers: [sourceHash],\n *   excludePaths: [\"apps/mesh\"],\n * }, { provider, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst environment: Record<string, pulumi.Input<string>> = {\n\t\t\t// Resolved at program runtime (secret) so the CLI still gets the\n\t\t\t// actual value when the provider is configured via tokenEnvVar —\n\t\t\t// without the credential ever being a dynamic-resource input.\n\t\t\tVERCEL_TOKEN: resolveCredentialOutput(\n\t\t\t\tprovider.token,\n\t\t\t\tprovider.tokenEnvVar,\n\t\t\t),\n\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t};\n\n\t\tlet cli = \"vercel deploy --prod --yes\";\n\t\tlet triggers = args.triggers;\n\n\t\tif (args.variables) {\n\t\t\t// Sorted-key JSON so the payload — and the trigger digest below — is\n\t\t\t// insensitive to declaration order. Marked secret so the values are\n\t\t\t// masked in state and diagnostics; they reach the applier bin through\n\t\t\t// the command environment, never the script text.\n\t\t\tconst variablesJson = pulumi\n\t\t\t\t.output(args.variables)\n\t\t\t\t.apply((variables) =>\n\t\t\t\t\tJSON.stringify(\n\t\t\t\t\t\tObject.fromEntries(\n\t\t\t\t\t\t\tObject.entries(variables).sort(([a], [b]) => a.localeCompare(b)),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\tenvironment.IC_VC_ENV_JSON = pulumi.secret(variablesJson);\n\n\t\t\t// Non-secret digest of the payload (same rationale as `hash(env)`):\n\t\t\t// any variable change redeploys, without carrying a secret trigger.\n\t\t\tconst variablesDigest = pulumi.unsecret(\n\t\t\t\tvariablesJson.apply((json) =>\n\t\t\t\t\tcrypto.createHash(\"sha256\").update(json).digest(\"hex\"),\n\t\t\t\t),\n\t\t\t);\n\n\t\t\ttriggers = pulumi\n\t\t\t\t.output(args.triggers)\n\t\t\t\t.apply((existing) => [...existing, variablesDigest]);\n\n\t\t\tcli = `node \"${APPLY_ENV_BIN}\" && ${cli}`;\n\t\t}\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tenvironment,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA8CA,MAAM,4CACL,IAAI,IAAI,oEAAsC,CAC/C;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,IAAa,eAAb,cAAkCA,eAAO,kBAAkB;CAG1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,cAAoD;GAIzD,cAAcC,2DACb,SAAS,OACT,SAAS,WACV;GACA,eAAe,SAAS;GACxB,mBAAmB;EACpB;EAEA,IAAI,MAAM;EACV,IAAI,WAAW,KAAK;EAEpB,IAAI,KAAK,WAAW;GAKnB,MAAM,gBAAgBD,eACpB,OAAO,KAAK,SAAS,EACrB,OAAO,cACP,KAAK,UACJ,OAAO,YACN,OAAO,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAChE,CACD,CACD;GAED,YAAY,iBAAiBA,eAAO,OAAO,aAAa;GAIxD,MAAM,kBAAkBA,eAAO,SAC9B,cAAc,OAAO,SACpBE,YAAO,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK,CACtD,CACD;GAEA,WAAWF,eACT,OAAO,KAAK,QAAQ,EACpB,OAAO,aAAa,CAAC,GAAG,UAAU,eAAe,CAAC;GAEpD,MAAM,SAAS,cAAc,OAAO;EACrC;EAEA,MAAM,EAAE,kBAAkBG,4CACzB;GACC;GACA;GACA;GACA,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/vercel/deploy.d.cts

@@ -15,20 +15,42 @@ interface VercelDeployArgs {
   triggers: pulumi.Input<pulumi.Input<string>[]>;
   /** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */
   excludePaths?: string[];
+  /**
+   * Env vars upserted for the project (production + preview + development)
+   * by the deploy command itself, right before `vercel deploy` runs — the
+   * preferred replacement for `VercelVariable`. The dynamic-resource path
+   * hits a Pulumi engine-internal stateful bug on clean-slate first creates
+   * ("Unexpected struct type", strictly alternating pass/fail across
+   * identical from-zero runs, reproduced with plain-literal inputs and zero
+   * secrets), so env vars are applied inside the command flow, off the
+   * dynamic-provider marshal path entirely. A change to any variable
+   * redeploys automatically (a non-secret digest of the map joins the
+   * command triggers). Values must be known at preview (config-derived) —
+   * the same class as the token the command env already carries.
+   */
+  variables?: pulumi.Input<Record<string, pulumi.Input<string>>>;
 }
 /**
  * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and
  * git-metadata handling are entirely the seam's job — list a `DeploySandbox`
  * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.
  *
+ * Pass `variables` to apply the project's env vars as part of the deploy
+ * command (see `VercelDeployArgs.variables` for why this replaces
+ * `VercelVariable`).
+ *
  * Recommended preflight: `assertHostBinaries(["vercel"])` (from
  * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast
  * with an install hint instead of mid-deploy.
  *
  * @example
  * ```typescript
- * new VercelDeploy("nexus", { projectId: project.id, triggers: [sourceHash, envHash], excludePaths: ["apps/mesh"] },
- *   { provider, dependsOn: [sandbox, gitGuard] });
+ * new VercelDeploy("nexus", {
+ *   projectId: project.id,
+ *   variables: { NEXT_PUBLIC_API_URL: apiUrl },
+ *   triggers: [sourceHash],
+ *   excludePaths: ["apps/mesh"],
+ * }, { provider, dependsOn: [sandbox, gitGuard] });
  * ```
  */
 declare class VercelDeploy extends pulumi.ComponentResource {

package/dist/vercel/deploy.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;KAOK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA,EAFN;EAIJ,OAAA,GAAU,aAAA;AAAA;AAAA,UAGM,gBAAA;EAPU;EAS1B,SAAA,GAAY,MAAA,CAAO,KAAA;EALT;EAOV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPP;EASvB,YAAA;AAAA;;;;;;;AATuB;AAGxB;;;;;;;;cAwBa,YAAA,SAAqB,MAAA,CAAO,iBAAA;EAAA,SACxB,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}
+{"version":3,"file":"deploy.d.cts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;KAUK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA,EAFN;EAIJ,OAAA,GAAU,aAAA;AAAA;AAAA,UAGM,gBAAA;EAPU;EAS1B,SAAA,GAAY,MAAA,CAAO,KAAA;EALT;EAOV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPP;EASvB,YAAA;EAb+B;;;;;;;AAIR;AAGxB;;;;;EAoBC,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;;;;;;;;;;;;AAAK;AAoCrD;;cAAa,YAAA,SAAqB,MAAA,CAAO,iBAAA;EAAA,SACxB,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}

package/dist/vercel/deploy.d.mts

@@ -15,20 +15,42 @@ interface VercelDeployArgs {
   triggers: pulumi.Input<pulumi.Input<string>[]>;
   /** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */
   excludePaths?: string[];
+  /**
+   * Env vars upserted for the project (production + preview + development)
+   * by the deploy command itself, right before `vercel deploy` runs — the
+   * preferred replacement for `VercelVariable`. The dynamic-resource path
+   * hits a Pulumi engine-internal stateful bug on clean-slate first creates
+   * ("Unexpected struct type", strictly alternating pass/fail across
+   * identical from-zero runs, reproduced with plain-literal inputs and zero
+   * secrets), so env vars are applied inside the command flow, off the
+   * dynamic-provider marshal path entirely. A change to any variable
+   * redeploys automatically (a non-secret digest of the map joins the
+   * command triggers). Values must be known at preview (config-derived) —
+   * the same class as the token the command env already carries.
+   */
+  variables?: pulumi.Input<Record<string, pulumi.Input<string>>>;
 }
 /**
  * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and
  * git-metadata handling are entirely the seam's job — list a `DeploySandbox`
  * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.
  *
+ * Pass `variables` to apply the project's env vars as part of the deploy
+ * command (see `VercelDeployArgs.variables` for why this replaces
+ * `VercelVariable`).
+ *
  * Recommended preflight: `assertHostBinaries(["vercel"])` (from
  * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast
  * with an install hint instead of mid-deploy.
  *
  * @example
  * ```typescript
- * new VercelDeploy("nexus", { projectId: project.id, triggers: [sourceHash, envHash], excludePaths: ["apps/mesh"] },
- *   { provider, dependsOn: [sandbox, gitGuard] });
+ * new VercelDeploy("nexus", {
+ *   projectId: project.id,
+ *   variables: { NEXT_PUBLIC_API_URL: apiUrl },
+ *   triggers: [sourceHash],
+ *   excludePaths: ["apps/mesh"],
+ * }, { provider, dependsOn: [sandbox, gitGuard] });
  * ```
  */
 declare class VercelDeploy extends pulumi.ComponentResource {

package/dist/vercel/deploy.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;KAOK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA,EAFN;EAIJ,OAAA,GAAU,aAAA;AAAA;AAAA,UAGM,gBAAA;EAPU;EAS1B,SAAA,GAAY,MAAA,CAAO,KAAA;EALT;EAOV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPP;EASvB,YAAA;AAAA;;;;;;;AATuB;AAGxB;;;;;;;;cAwBa,YAAA,SAAqB,MAAA,CAAO,iBAAA;EAAA,SACxB,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}
+{"version":3,"file":"deploy.d.mts","names":[],"sources":["../../src/vercel/deploy.ts"],"mappings":";;;;;;KAUK,mBAAA,GAAsB,IAAA,CAAK,MAAA,CAAO,wBAAA;uCAEtC,QAAA,EAAU,cAAA,EAFN;EAIJ,OAAA,GAAU,aAAA;AAAA;AAAA,UAGM,gBAAA;EAPU;EAS1B,SAAA,GAAY,MAAA,CAAO,KAAA;EALT;EAOV,QAAA,EAAU,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,KAAA;EAPP;EASvB,YAAA;EAb+B;;;;;;;AAIR;AAGxB;;;;;EAoBC,SAAA,GAAY,MAAA,CAAO,KAAA,CAAM,MAAA,SAAe,MAAA,CAAO,KAAA;AAAA;;;;;;;;;;;;;;;;;;;;;AAAK;AAoCrD;;cAAa,YAAA,SAAqB,MAAA,CAAO,iBAAA;EAAA,SACxB,aAAA,EAAe,MAAA,CAAO,MAAA;cAE1B,IAAA,UAAc,IAAA,EAAM,gBAAA,EAAkB,IAAA,EAAM,mBAAA;AAAA"}

package/dist/vercel/deploy.mjs

@@ -2,21 +2,38 @@ import { t as __name } from "../chunk-OPjESj5l.mjs";
 import { createDeployCommand } from "../commands/deploy.mjs";
 import { resolveCredentialOutput } from "../dynamic/resolve-credential.mjs";
 import * as pulumi from "@pulumi/pulumi";
+import * as crypto from "node:crypto";
+import { fileURLToPath } from "node:url";
 
 //#region src/vercel/deploy.ts
 /**
+* Absolute path to the runnable env applier, resolved next to this module in
+* `dist`. Runs as a plain Node step of the deploy command (mirroring Railway's
+* deploy monitor bin) so env vars never touch the dynamic-provider marshal
+* path. Its logic lives in the unit-tested `env-applier` module.
+*/
+const APPLY_ENV_BIN = fileURLToPath(new URL("./bin/apply-env.mjs", import.meta.url));
+/**
 * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and
 * git-metadata handling are entirely the seam's job — list a `DeploySandbox`
 * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.
 *
+* Pass `variables` to apply the project's env vars as part of the deploy
+* command (see `VercelDeployArgs.variables` for why this replaces
+* `VercelVariable`).
+*
 * Recommended preflight: `assertHostBinaries(["vercel"])` (from
 * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast
 * with an install hint instead of mid-deploy.
 *
 * @example
 * ```typescript
-* new VercelDeploy("nexus", { projectId: project.id, triggers: [sourceHash, envHash], excludePaths: ["apps/mesh"] },
-*   { provider, dependsOn: [sandbox, gitGuard] });
+* new VercelDeploy("nexus", {
+*   projectId: project.id,
+*   variables: { NEXT_PUBLIC_API_URL: apiUrl },
+*   triggers: [sourceHash],
+*   excludePaths: ["apps/mesh"],
+* }, { provider, dependsOn: [sandbox, gitGuard] });
 * ```
 */
 var VercelDeploy = class extends pulumi.ComponentResource {
@@ -25,16 +42,26 @@ var VercelDeploy = class extends pulumi.ComponentResource {
 		super("infracraft:vercel:Deploy", name, {}, pulumiOpts);
 		const projectId = project ? project.id : args.projectId;
 		if (!projectId) throw new Error("VercelDeploy: either `args.projectId` or `opts.project` must be provided");
+		const environment = {
+			VERCEL_TOKEN: resolveCredentialOutput(provider.token, provider.tokenEnvVar),
+			VERCEL_ORG_ID: provider.teamId,
+			VERCEL_PROJECT_ID: projectId
+		};
+		let cli = "vercel deploy --prod --yes";
+		let triggers = args.triggers;
+		if (args.variables) {
+			const variablesJson = pulumi.output(args.variables).apply((variables) => JSON.stringify(Object.fromEntries(Object.entries(variables).sort(([a], [b]) => a.localeCompare(b)))));
+			environment.IC_VC_ENV_JSON = pulumi.secret(variablesJson);
+			const variablesDigest = pulumi.unsecret(variablesJson.apply((json) => crypto.createHash("sha256").update(json).digest("hex")));
+			triggers = pulumi.output(args.triggers).apply((existing) => [...existing, variablesDigest]);
+			cli = `node "${APPLY_ENV_BIN}" && ${cli}`;
+		}
 		const { deploymentUrl } = createDeployCommand({
 			name,
-			cli: "vercel deploy --prod --yes",
-			triggers: args.triggers,
+			cli,
+			triggers,
 			excludePaths: args.excludePaths,
-			environment: {
-				VERCEL_TOKEN: resolveCredentialOutput(provider.token, provider.tokenEnvVar),
-				VERCEL_ORG_ID: provider.teamId,
-				VERCEL_PROJECT_ID: projectId
-			}
+			environment
 		}, {
 			parent: this,
 			...pulumiOpts

package/dist/vercel/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport { resolveCredentialOutput } from \"../dynamic/resolve-credential\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\t/** VercelProject to source the project ID from (optional if `args.projectId` given). */\n\tproject?: VercelProject;\n};\n\nexport interface VercelDeployArgs {\n\t/** Vercel project ID. Required when `opts.project` is not provided. */\n\tprojectId?: pulumi.Input<string>;\n\t/** Redeploy triggers (e.g. source hash, env content hash). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n}\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and\n * git-metadata handling are entirely the seam's job — list a `DeploySandbox`\n * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.\n *\n * Recommended preflight: `assertHostBinaries([\"vercel\"])` (from\n * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast\n * with an install hint instead of mid-deploy.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus\", { projectId: project.id, triggers: [sourceHash, envHash], excludePaths: [\"apps/mesh\"] },\n *   { provider, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli: \"vercel deploy --prod --yes\",\n\t\t\t\ttriggers: args.triggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tenvironment: {\n\t\t\t\t\t// Resolved at program runtime (secret) so the CLI still gets the\n\t\t\t\t\t// actual value when the provider is configured via tokenEnvVar —\n\t\t\t\t\t// without the credential ever being a dynamic-resource input.\n\t\t\t\t\tVERCEL_TOKEN: resolveCredentialOutput(\n\t\t\t\t\t\tprovider.token,\n\t\t\t\t\t\tprovider.tokenEnvVar,\n\t\t\t\t\t),\n\t\t\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t\t\t},\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAsCA,IAAa,eAAb,cAAkC,OAAO,kBAAkB;CAG1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,EAAE,kBAAkB,oBACzB;GACC;GACA,KAAK;GACL,UAAU,KAAK;GACf,cAAc,KAAK;GACnB,aAAa;IAIZ,cAAc,wBACb,SAAS,OACT,SAAS,WACV;IACA,eAAe,SAAS;IACxB,mBAAmB;GACpB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/vercel/deploy.ts"],"sourcesContent":["import * as crypto from \"node:crypto\";\nimport { fileURLToPath } from \"node:url\";\n\nimport * as pulumi from \"@pulumi/pulumi\";\n\nimport { createDeployCommand } from \"../commands/deploy\";\nimport { resolveCredentialOutput } from \"../dynamic/resolve-credential\";\nimport type { VercelProject } from \"./project\";\nimport type { VercelProvider } from \"./provider\";\n\ntype VercelDeployOptions = Omit<pulumi.ComponentResourceOptions, \"provider\"> & {\n\t/** Vercel authentication context. */\n\tprovider: VercelProvider;\n\t/** VercelProject to source the project ID from (optional if `args.projectId` given). */\n\tproject?: VercelProject;\n};\n\nexport interface VercelDeployArgs {\n\t/** Vercel project ID. Required when `opts.project` is not provided. */\n\tprojectId?: pulumi.Input<string>;\n\t/** Redeploy triggers (e.g. source hash, env content hash). */\n\ttriggers: pulumi.Input<pulumi.Input<string>[]>;\n\t/** Paths excluded from the upload when running with `DeploySandbox` + `GitGuard`. */\n\texcludePaths?: string[];\n\t/**\n\t * Env vars upserted for the project (production + preview + development)\n\t * by the deploy command itself, right before `vercel deploy` runs — the\n\t * preferred replacement for `VercelVariable`. The dynamic-resource path\n\t * hits a Pulumi engine-internal stateful bug on clean-slate first creates\n\t * (\"Unexpected struct type\", strictly alternating pass/fail across\n\t * identical from-zero runs, reproduced with plain-literal inputs and zero\n\t * secrets), so env vars are applied inside the command flow, off the\n\t * dynamic-provider marshal path entirely. A change to any variable\n\t * redeploys automatically (a non-secret digest of the map joins the\n\t * command triggers). Values must be known at preview (config-derived) —\n\t * the same class as the token the command env already carries.\n\t */\n\tvariables?: pulumi.Input<Record<string, pulumi.Input<string>>>;\n}\n\n/**\n * Absolute path to the runnable env applier, resolved next to this module in\n * `dist`. Runs as a plain Node step of the deploy command (mirroring Railway's\n * deploy monitor bin) so env vars never touch the dynamic-provider marshal\n * path. Its logic lives in the unit-tested `env-applier` module.\n */\nconst APPLY_ENV_BIN = fileURLToPath(\n\tnew URL(\"./bin/apply-env.mjs\", import.meta.url),\n);\n\n/**\n * Deploys a Vercel project via `vercel deploy --prod --yes`. Isolation and\n * git-metadata handling are entirely the seam's job — list a `DeploySandbox`\n * (and optionally a `GitGuard`) in `opts.dependsOn` to control them.\n *\n * Pass `variables` to apply the project's env vars as part of the deploy\n * command (see `VercelDeployArgs.variables` for why this replaces\n * `VercelVariable`).\n *\n * Recommended preflight: `assertHostBinaries([\"vercel\"])` (from\n * `@infracraft/pulumi/sandbox`) at program start, so a missing CLI fails fast\n * with an install hint instead of mid-deploy.\n *\n * @example\n * ```typescript\n * new VercelDeploy(\"nexus\", {\n *   projectId: project.id,\n *   variables: { NEXT_PUBLIC_API_URL: apiUrl },\n *   triggers: [sourceHash],\n *   excludePaths: [\"apps/mesh\"],\n * }, { provider, dependsOn: [sandbox, gitGuard] });\n * ```\n */\nexport class VercelDeploy extends pulumi.ComponentResource {\n\tpublic readonly deploymentUrl: pulumi.Output<string>;\n\n\tconstructor(name: string, args: VercelDeployArgs, opts: VercelDeployOptions) {\n\t\tconst { provider, project, ...pulumiOpts } = opts;\n\n\t\tsuper(\"infracraft:vercel:Deploy\", name, {}, pulumiOpts);\n\n\t\tconst projectId = project\n\t\t\t? project.id\n\t\t\t: (args.projectId as pulumi.Input<string>);\n\n\t\tif (!projectId) {\n\t\t\tthrow new Error(\n\t\t\t\t\"VercelDeploy: either `args.projectId` or `opts.project` must be provided\",\n\t\t\t);\n\t\t}\n\n\t\tconst environment: Record<string, pulumi.Input<string>> = {\n\t\t\t// Resolved at program runtime (secret) so the CLI still gets the\n\t\t\t// actual value when the provider is configured via tokenEnvVar —\n\t\t\t// without the credential ever being a dynamic-resource input.\n\t\t\tVERCEL_TOKEN: resolveCredentialOutput(\n\t\t\t\tprovider.token,\n\t\t\t\tprovider.tokenEnvVar,\n\t\t\t),\n\t\t\tVERCEL_ORG_ID: provider.teamId,\n\t\t\tVERCEL_PROJECT_ID: projectId,\n\t\t};\n\n\t\tlet cli = \"vercel deploy --prod --yes\";\n\t\tlet triggers = args.triggers;\n\n\t\tif (args.variables) {\n\t\t\t// Sorted-key JSON so the payload — and the trigger digest below — is\n\t\t\t// insensitive to declaration order. Marked secret so the values are\n\t\t\t// masked in state and diagnostics; they reach the applier bin through\n\t\t\t// the command environment, never the script text.\n\t\t\tconst variablesJson = pulumi\n\t\t\t\t.output(args.variables)\n\t\t\t\t.apply((variables) =>\n\t\t\t\t\tJSON.stringify(\n\t\t\t\t\t\tObject.fromEntries(\n\t\t\t\t\t\t\tObject.entries(variables).sort(([a], [b]) => a.localeCompare(b)),\n\t\t\t\t\t\t),\n\t\t\t\t\t),\n\t\t\t\t);\n\n\t\t\tenvironment.IC_VC_ENV_JSON = pulumi.secret(variablesJson);\n\n\t\t\t// Non-secret digest of the payload (same rationale as `hash(env)`):\n\t\t\t// any variable change redeploys, without carrying a secret trigger.\n\t\t\tconst variablesDigest = pulumi.unsecret(\n\t\t\t\tvariablesJson.apply((json) =>\n\t\t\t\t\tcrypto.createHash(\"sha256\").update(json).digest(\"hex\"),\n\t\t\t\t),\n\t\t\t);\n\n\t\t\ttriggers = pulumi\n\t\t\t\t.output(args.triggers)\n\t\t\t\t.apply((existing) => [...existing, variablesDigest]);\n\n\t\t\tcli = `node \"${APPLY_ENV_BIN}\" && ${cli}`;\n\t\t}\n\n\t\tconst { deploymentUrl } = createDeployCommand(\n\t\t\t{\n\t\t\t\tname,\n\t\t\t\tcli,\n\t\t\t\ttriggers,\n\t\t\t\texcludePaths: args.excludePaths,\n\t\t\t\tenvironment,\n\t\t\t},\n\t\t\t{ parent: this, ...pulumiOpts },\n\t\t);\n\n\t\tthis.deploymentUrl = deploymentUrl;\n\n\t\tthis.registerOutputs({ deploymentUrl: this.deploymentUrl });\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;AA8CA,MAAM,gBAAgB,cACrB,IAAI,IAAI,uBAAuB,OAAO,KAAK,GAAG,CAC/C;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,IAAa,eAAb,cAAkC,OAAO,kBAAkB;CAG1D,YAAY,MAAc,MAAwB,MAA2B;EAC5E,MAAM,EAAE,UAAU,SAAS,GAAG,eAAe;EAE7C,MAAM,4BAA4B,MAAM,CAAC,GAAG,UAAU;EAEtD,MAAM,YAAY,UACf,QAAQ,KACP,KAAK;EAET,IAAI,CAAC,WACJ,MAAM,IAAI,MACT,0EACD;EAGD,MAAM,cAAoD;GAIzD,cAAc,wBACb,SAAS,OACT,SAAS,WACV;GACA,eAAe,SAAS;GACxB,mBAAmB;EACpB;EAEA,IAAI,MAAM;EACV,IAAI,WAAW,KAAK;EAEpB,IAAI,KAAK,WAAW;GAKnB,MAAM,gBAAgB,OACpB,OAAO,KAAK,SAAS,EACrB,OAAO,cACP,KAAK,UACJ,OAAO,YACN,OAAO,QAAQ,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAChE,CACD,CACD;GAED,YAAY,iBAAiB,OAAO,OAAO,aAAa;GAIxD,MAAM,kBAAkB,OAAO,SAC9B,cAAc,OAAO,SACpB,OAAO,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK,CACtD,CACD;GAEA,WAAW,OACT,OAAO,KAAK,QAAQ,EACpB,OAAO,aAAa,CAAC,GAAG,UAAU,eAAe,CAAC;GAEpD,MAAM,SAAS,cAAc,OAAO;EACrC;EAEA,MAAM,EAAE,kBAAkB,oBACzB;GACC;GACA;GACA;GACA,cAAc,KAAK;GACnB;EACD,GACA;GAAE,QAAQ;GAAM,GAAG;EAAW,CAC/B;EAEA,KAAK,gBAAgB;EAErB,KAAK,gBAAgB,EAAE,eAAe,KAAK,cAAc,CAAC;CAC3D;AACD"}

package/dist/vercel/env-applier.cjs

@@ -0,0 +1,48 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_chunk = require('../chunk-BVYJZCqc.cjs');
+const require_vercel_client = require('./client.cjs');
+const require_vercel_env_var_api = require('./env-var-api.cjs');
+
+//#region src/vercel/env-applier.ts
+/**
+* Deploy-integrated Vercel env var applier.
+*
+* Applies a key→value map to a Vercel project (production + preview +
+* development) through the plain REST API, inside the deploy COMMAND flow —
+* never as a Pulumi dynamic resource. The dynamic-resource path
+* (`VercelVariable`) hits a Pulumi engine-internal stateful bug on clean-slate
+* first creates ("Unexpected struct type", strictly alternating pass/fail
+* across identical from-zero runs, reproduced with plain-literal inputs — zero
+* Outputs/secrets — on matched CLI/SDK versions; four structural theories
+* falsified by bisection). The fix is architectural: run the env upserts as an
+* imperative step of the deploy command — the same pattern as the Railway
+* deploy monitor owning imperative deploy steps — off the dynamic-provider
+* marshal path entirely.
+*
+* Dependency-injected (`log`) so the behavior is unit-tested. The runnable
+* wrapper that wires real IO lives in `./bin/apply-env.ts`.
+*/
+/**
+* Upserts every entry of `variables` for the project, targeting production +
+* preview + development (create, or update in place on ENV_CONFLICT — the
+* exact semantics `VercelVariable` uses, via the shared `env-var-api`).
+*
+* Logs one line per applied key — names only, never values. Throws on the
+* first failure with the offending key named, so the bin exits non-zero and
+* the deploy never runs against a half-applied environment.
+*/
+async function applyVercelEnv(input, deps) {
+	const client = new require_vercel_client.VercelClient(input.token, input.teamId);
+	for (const [key, value] of Object.entries(input.variables)) {
+		try {
+			await require_vercel_env_var_api.upsertEnvVar(client, input.projectId, key, value, deps.log);
+		} catch (error) {
+			throw new Error(`failed to apply Vercel env var "${key}": ${error instanceof Error ? error.message : String(error)}`);
+		}
+		deps.log(`applied Vercel env var "${key}"`);
+	}
+}
+
+//#endregion
+exports.applyVercelEnv = applyVercelEnv;
+//# sourceMappingURL=env-applier.cjs.map

package/dist/vercel/env-applier.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-applier.cjs","names":["VercelClient","upsertEnvVar"],"sources":["../../src/vercel/env-applier.ts"],"sourcesContent":["/**\n * Deploy-integrated Vercel env var applier.\n *\n * Applies a key→value map to a Vercel project (production + preview +\n * development) through the plain REST API, inside the deploy COMMAND flow —\n * never as a Pulumi dynamic resource. The dynamic-resource path\n * (`VercelVariable`) hits a Pulumi engine-internal stateful bug on clean-slate\n * first creates (\"Unexpected struct type\", strictly alternating pass/fail\n * across identical from-zero runs, reproduced with plain-literal inputs — zero\n * Outputs/secrets — on matched CLI/SDK versions; four structural theories\n * falsified by bisection). The fix is architectural: run the env upserts as an\n * imperative step of the deploy command — the same pattern as the Railway\n * deploy monitor owning imperative deploy steps — off the dynamic-provider\n * marshal path entirely.\n *\n * Dependency-injected (`log`) so the behavior is unit-tested. The runnable\n * wrapper that wires real IO lives in `./bin/apply-env.ts`.\n */\nimport { VercelClient } from \"./client\";\nimport { upsertEnvVar } from \"./env-var-api\";\n\n/** Everything the applier needs to upsert one project's env vars. */\nexport interface ApplyVercelEnvInput {\n\t/** Vercel API bearer token. */\n\ttoken: string;\n\n\t/** Vercel team/org ID. */\n\tteamId: string;\n\n\t/** Vercel project ID. */\n\tprojectId: string;\n\n\t/** Key-value map of environment variable names to their values. */\n\tvariables: Record<string, string>;\n}\n\n/** Injected side-effecting collaborators (real impl in the bin, fakes in tests). */\nexport interface ApplyVercelEnvDeps {\n\tlog: (line: string) => void;\n}\n\n/**\n * Upserts every entry of `variables` for the project, targeting production +\n * preview + development (create, or update in place on ENV_CONFLICT — the\n * exact semantics `VercelVariable` uses, via the shared `env-var-api`).\n *\n * Logs one line per applied key — names only, never values. Throws on the\n * first failure with the offending key named, so the bin exits non-zero and\n * the deploy never runs against a half-applied environment.\n */\nexport async function applyVercelEnv(\n\tinput: ApplyVercelEnvInput,\n\tdeps: ApplyVercelEnvDeps,\n): Promise<void> {\n\tconst client = new VercelClient(input.token, input.teamId);\n\n\tfor (const [key, value] of Object.entries(input.variables)) {\n\t\ttry {\n\t\t\tawait upsertEnvVar(client, input.projectId, key, value, deps.log);\n\t\t} catch (error) {\n\t\t\tthrow new Error(\n\t\t\t\t`failed to apply Vercel env var \"${key}\": ${error instanceof Error ? error.message : String(error)}`,\n\t\t\t);\n\t\t}\n\n\t\tdeps.log(`applied Vercel env var \"${key}\"`);\n\t}\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkDA,eAAsB,eACrB,OACA,MACgB;CAChB,MAAM,SAAS,IAAIA,mCAAa,MAAM,OAAO,MAAM,MAAM;CAEzD,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,SAAS,GAAG;EAC3D,IAAI;GACH,MAAMC,wCAAa,QAAQ,MAAM,WAAW,KAAK,OAAO,KAAK,GAAG;EACjE,SAAS,OAAO;GACf,MAAM,IAAI,MACT,mCAAmC,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAClG;EACD;EAEA,KAAK,IAAI,2BAA2B,IAAI,EAAE;CAC3C;AACD"}

package/dist/vercel/env-applier.d.cts

@@ -0,0 +1,31 @@
+import { t as __name } from "../chunk-OPjESj5l.cjs";
+
+//#region src/vercel/env-applier.d.ts
+/** Everything the applier needs to upsert one project's env vars. */
+interface ApplyVercelEnvInput {
+  /** Vercel API bearer token. */
+  token: string;
+  /** Vercel team/org ID. */
+  teamId: string;
+  /** Vercel project ID. */
+  projectId: string;
+  /** Key-value map of environment variable names to their values. */
+  variables: Record<string, string>;
+}
+/** Injected side-effecting collaborators (real impl in the bin, fakes in tests). */
+interface ApplyVercelEnvDeps {
+  log: (line: string) => void;
+}
+/**
+ * Upserts every entry of `variables` for the project, targeting production +
+ * preview + development (create, or update in place on ENV_CONFLICT — the
+ * exact semantics `VercelVariable` uses, via the shared `env-var-api`).
+ *
+ * Logs one line per applied key — names only, never values. Throws on the
+ * first failure with the offending key named, so the bin exits non-zero and
+ * the deploy never runs against a half-applied environment.
+ */
+declare function applyVercelEnv(input: ApplyVercelEnvInput, deps: ApplyVercelEnvDeps): Promise<void>;
+//#endregion
+export { ApplyVercelEnvDeps, ApplyVercelEnvInput, applyVercelEnv };
+//# sourceMappingURL=env-applier.d.cts.map

package/dist/vercel/env-applier.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-applier.d.cts","names":[],"sources":["../../src/vercel/env-applier.ts"],"mappings":";;;;UAsBiB,mBAAA;;EAEhB,KAAA;EAFmC;EAKnC,MAAA;EAMiB;EAHjB,SAAA;EAHA;EAMA,SAAA,EAAW,MAAM;AAAA;;UAID,kBAAA;EAChB,GAAA,GAAM,IAAY;AAAA;;;;AAAA;AAYnB;;;;;iBAAsB,cAAA,CACrB,KAAA,EAAO,mBAAA,EACP,IAAA,EAAM,kBAAA,GACJ,OAAA"}

package/dist/vercel/env-applier.d.mts

@@ -0,0 +1,31 @@
+import { t as __name } from "../chunk-OPjESj5l.mjs";
+
+//#region src/vercel/env-applier.d.ts
+/** Everything the applier needs to upsert one project's env vars. */
+interface ApplyVercelEnvInput {
+  /** Vercel API bearer token. */
+  token: string;
+  /** Vercel team/org ID. */
+  teamId: string;
+  /** Vercel project ID. */
+  projectId: string;
+  /** Key-value map of environment variable names to their values. */
+  variables: Record<string, string>;
+}
+/** Injected side-effecting collaborators (real impl in the bin, fakes in tests). */
+interface ApplyVercelEnvDeps {
+  log: (line: string) => void;
+}
+/**
+ * Upserts every entry of `variables` for the project, targeting production +
+ * preview + development (create, or update in place on ENV_CONFLICT — the
+ * exact semantics `VercelVariable` uses, via the shared `env-var-api`).
+ *
+ * Logs one line per applied key — names only, never values. Throws on the
+ * first failure with the offending key named, so the bin exits non-zero and
+ * the deploy never runs against a half-applied environment.
+ */
+declare function applyVercelEnv(input: ApplyVercelEnvInput, deps: ApplyVercelEnvDeps): Promise<void>;
+//#endregion
+export { ApplyVercelEnvDeps, ApplyVercelEnvInput, applyVercelEnv };
+//# sourceMappingURL=env-applier.d.mts.map

package/dist/vercel/env-applier.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-applier.d.mts","names":[],"sources":["../../src/vercel/env-applier.ts"],"mappings":";;;;UAsBiB,mBAAA;;EAEhB,KAAA;EAFmC;EAKnC,MAAA;EAMiB;EAHjB,SAAA;EAHA;EAMA,SAAA,EAAW,MAAM;AAAA;;UAID,kBAAA;EAChB,GAAA,GAAM,IAAY;AAAA;;;;AAAA;AAYnB;;;;;iBAAsB,cAAA,CACrB,KAAA,EAAO,mBAAA,EACP,IAAA,EAAM,kBAAA,GACJ,OAAA"}