@ingram-cloud/pulumi 1.0.0

package/README.md

@@ -0,0 +1,201 @@
+# @ingram-cloud/pulumi
+
+Pulumi dynamic resources for the [Ingram Cloud](https://cloud.ingram.tech) `/v1`
+API. Declare your tenant's IC configuration — agents, MCP servers, integrations,
+webhooks, BYOK model keys — as Pulumi resources instead of imperative
+`register-*.ts` / `ensure-agent.ts` scripts, so it lives in state and a change
+is a `pulumi up`.
+
+The library is published alongside the Ingram Cloud `/v1` API so the wrapper
+tracks the surface it wraps. The API version it targets is pinned per library
+version (`IC_API_VERSION`).
+
+## Install
+
+```bash
+bun add @ingram-cloud/pulumi @pulumi/pulumi
+```
+
+## How the repos interact
+
+```
+cloud.ingram.tech/pulumi/   THIS LIBRARY — knows nothing about any consumer
+                            (Agent, McpServer, TelegramBot, WhatsAppConfig,
+                             Webhook, ModelKey, Secret)
+
+app repos (thornhill, …)    declare their AGENTS — the `instructions` are
+                            app-owned content (prompts), so they stay in the app
+                            repo, sourced from the app's own spec module. The app's
+                            Pulumi program imports this library + those specs.
+
+infra repo (~/src/infra)    declares tenant INTEGRATION config (MCP, Telegram, WhatsApp,
+                            webhook, model keys) alongside DNS/DB/Vercel, and can
+                            read an app stack's outputs via pulumi.StackReference to
+                            push IC-derived values (agent ids, webhook secret)
+                            into Vercel env. No prompts ever live here.
+```
+
+The hard rule: **prompts never leave the app repo.** This library carries no
+content; it only carries the machinery.
+
+## Connection
+
+Every resource takes `baseUrl` + `token` (the tenant-admin bearer; `IcProject` /
+`IcProjectToken` take an **organization** key instead — see below). Resolve them
+once with `connectionFromConfig()` and spread:
+
+```ts
+import * as ic from "@ingram-cloud/pulumi";
+
+const conn = ic.connectionFromConfig(); // ingram-cloud:token (secret) / :baseUrl
+                                        // or env INGRAM_CLOUD_TOKEN|CLOUD_API_KEY
+```
+
+Set the token as a stack secret:
+
+```bash
+pulumi config set --secret ingram-cloud:token tha_live_…
+```
+
+## Resources
+
+### IcAgent (declare in the APP repo)
+
+Create-or-adopt by **`slug`** → publish a new immutable version **only when the
+content changed** → roll it out. Mirrors the old `ensure-agent.ts` idempotency, so
+the first `pulumi up` after switching from a script **adopts** the existing agent
+(matched by slug) rather than recreating it.
+
+`slug` is the immutable reconcile key; it defaults to the Pulumi resource name
+(here `"curator"`), so existing stacks keep adopting the same agent. `name` is a
+free display label you can rename without churning the agent. Changing `slug`
+replaces it.
+
+```ts
+import { AGENT_SPECS } from "../src/lib/cloud/agent-spec"; // app-owned
+
+const curator = new ic.IcAgent("curator", {
+  ...conn,
+  // slug defaults to "curator"; pass `slug` to decouple the key from the name.
+  name: AGENT_SPECS.curator.name, // display label, freely renamable
+  instructions: AGENT_SPECS.curator.instructions,
+  model: AGENT_SPECS.curator.model,
+  autoMemory: AGENT_SPECS.curator.auto_memory,
+  // memoryConsolidation: true,  // opt into background consolidation (billed)
+  // variables: [...], enabledHostedTools: [...], rolloutPercent: 100,
+});
+
+export const curatorAgentId = curator.agentId;
+```
+
+> Attaching **existing** smiths to a agent is a one-time fleet backfill —
+> keep it as the app's migration script. New smiths attach at birth in app code.
+> Pulumi does not own per-smith runtime state.
+
+### IcMcpServer, IcOauthProvider, IcTelegramBot, IcWhatsAppConfig, IcEmail, IcWebhook, IcModelKey (declare in INFRA)
+
+```ts
+// Your own server (raw URL).
+new ic.IcMcpServer("thornhill-mcp", {
+  ...conn, serverName: "thornhill", url: `${APP_URL}/api/mcp`,
+  authKind: "static", secret: mcpSecret,
+});
+
+// An `oauth`-kind server forwards each end-user's own stored token; its
+// provider record tells IC how tokens refresh. Webhook-delegation mode (a
+// refreshWebhook and NO clientSecret): IC POSTs { connection_id } to the
+// tenant near expiry and the tenant PATCHes a fresh pair back — the tenant
+// owns the token format entirely.
+new ic.IcMcpServer("thornhill-user-mcp", {
+  ...conn, serverName: "thornhill-user", url: `${APP_URL}/api/user-mcp`,
+  authKind: "oauth", authProvider: "thornhill",
+});
+new ic.IcOauthProvider("thornhill-provider", {
+  ...conn, provider: "thornhill",
+  refreshWebhook: `${APP_URL}/api/ic/refresh`,
+});
+
+// A curated third party: stamp from the catalog, gate which tools run, and
+// require human approval on the scary ones. Per-smith OAuth tokens are NOT
+// declared here — the runtime collects each end-user's identity (the hosted
+// connect flow vaults it). `clientMode: "platform"` uses Ingram's OAuth client.
+new ic.IcMcpServer("stripe", {
+  ...conn, serverName: "stripe", catalog: "stripe",
+  toolAllowlist: ["get_balance", "list_charges", "create_refund"],
+  approvalPolicy: [{ match: "create_refund" }],
+});
+
+new ic.IcTelegramBot("thornhill-telegram", { ...conn, botToken });
+
+// The agent's own email channel (BYO-Cloudflare transport). IC returns the
+// inbound HMAC once — it becomes a secret output you flow into the inbound worker.
+const email = new ic.IcEmail("thornhill-email", {
+  ...conn, cloudflareAccountId, cloudflareApiToken, fromDomain: "mail.thornhill.app",
+});
+export const inboundEmailSecret = email.inboundSecret; // create-time secret output
+
+const hook = new ic.IcWebhook("thornhill-events", {
+  ...conn, url: `${APP_URL}/api/ic/events`,
+  events: ["run.completed", "approval.required", /* … */],
+});
+export const webhookSigningSecret = hook.secret; // whsec_… (create-only secret output)
+
+new ic.IcModelKey("anthropic", { ...conn, provider: "anthropic", apiKey });
+```
+
+`IcWebhook.secret` is the `whsec_…` signing secret IC returns exactly once — it
+becomes a secret Pulumi output, so the infra stack can flow it straight into Vercel
+env with no copy-paste.
+
+### IcProject + IcProjectToken (declare in the PLATFORM stack)
+
+The tier **above** a project. These take an **organization key**
+(`organization:*`, your account master key) — not a project token. Hand it to a
+platform stack and it provisions projects and mints each one a project-scoped
+`tenant:*` token, which you drop straight into that app's env. The org key reads
+no run, memory, or smith itself; only the project tokens it mints can.
+
+```ts
+// In the PLATFORM stack, `ingram-cloud:token` is your ORGANIZATION key.
+const project = new ic.IcProject("thornhill", { ...conn }); // adopt-by-name
+const icToken = new ic.IcProjectToken("thornhill-admin", {
+  ...conn,
+  project: project.projectId, // the project id == the tenant
+});
+
+// Flow the minted tenant token straight into the app's runtime env:
+new vercel.ProjectEnvironmentVariable("th-ic-token", {
+  projectId: thornhillVercelId,
+  key: "INGRAM_CLOUD_TOKEN",
+  value: icToken.projectToken, // secret tenant:* token
+  targets: ["production"],
+});
+export const thornhillProjectId = project.projectId;
+```
+
+`IcProject` adopts an existing project by `projectName` (defaults to the resource
+name), so re-runs reconcile. `IcProjectToken.projectToken` is a secret output; it
+re-mints on any change and revokes on destroy.
+
+## Importing resources a script already created
+
+Agents and webhooks implement `read`, so you can adopt pre-existing ones:
+
+```bash
+pulumi import 'ingram-cloud:index:IcAgent' curator agt_123…
+```
+
+(Agents also self-adopt by slug on first `create`, so an explicit import is
+usually unnecessary — a plain `pulumi up` will reconcile the live agent.)
+
+## Notes
+
+- Built as CommonJS to match the Pulumi Node.js runtime and the infra stack's
+  `module: commonjs` tsconfig.
+- `token` and every credential input are marked `additionalSecretOutputs`, so they
+  are encrypted in Pulumi state.
+- CRUD runs inline in the Pulumi process over the global `fetch` (Node ≥18).
+- `read` treats a server-side **404 as "gone"** (returns an empty id) so
+  `pulumi refresh` prunes a resource deleted out-of-band — e.g. after an IC DB
+  reset, `pulumi refresh && pulumi up` recreates it, no `pulumi state delete`.
+  Non-404 errors still throw, so a transient API blip can't drop it from state.

package/dist/connection.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Connection helper — resolves the IC `{ baseUrl, token }` pair once so a Pulumi
+ * program can spread it into every resource:
+ *
+ *   const conn = connectionFromConfig();
+ *   new ic.IcAgent("assistant", { ...conn, name: "…", instructions: "…" });
+ *
+ * Resolution order (first hit wins):
+ *   baseUrl: `ingram-cloud:baseUrl` config → IC_BASE_URL → CLOUD_BASE_URL → prod
+ *   token:   `ingram-cloud:token` secret config → INGRAM_CLOUD_TOKEN → CLOUD_API_KEY
+ *
+ * The env fallbacks bridge the two naming conventions already in the fleet
+ * (thornhill's INGRAM_CLOUD_TOKEN, integrain's CLOUD_API_KEY). The returned
+ * token is always a secret Output so it stays encrypted in state.
+ */
+import * as pulumi from "@pulumi/pulumi";
+export declare const DEFAULT_BASE_URL = "https://api.cloud.ingram.tech";
+export interface IcConnection {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+}
+export declare function connectionFromConfig(cfg?: pulumi.Config): IcConnection;

package/dist/connection.js

@@ -0,0 +1,65 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_BASE_URL = void 0;
+exports.connectionFromConfig = connectionFromConfig;
+/**
+ * Connection helper — resolves the IC `{ baseUrl, token }` pair once so a Pulumi
+ * program can spread it into every resource:
+ *
+ *   const conn = connectionFromConfig();
+ *   new ic.IcAgent("assistant", { ...conn, name: "…", instructions: "…" });
+ *
+ * Resolution order (first hit wins):
+ *   baseUrl: `ingram-cloud:baseUrl` config → IC_BASE_URL → CLOUD_BASE_URL → prod
+ *   token:   `ingram-cloud:token` secret config → INGRAM_CLOUD_TOKEN → CLOUD_API_KEY
+ *
+ * The env fallbacks bridge the two naming conventions already in the fleet
+ * (thornhill's INGRAM_CLOUD_TOKEN, integrain's CLOUD_API_KEY). The returned
+ * token is always a secret Output so it stays encrypted in state.
+ */
+const pulumi = __importStar(require("@pulumi/pulumi"));
+exports.DEFAULT_BASE_URL = "https://api.cloud.ingram.tech";
+function connectionFromConfig(cfg) {
+    const c = cfg ?? new pulumi.Config("ingram-cloud");
+    const baseUrl = c.get("baseUrl") ??
+        process.env.IC_BASE_URL ??
+        process.env.CLOUD_BASE_URL ??
+        exports.DEFAULT_BASE_URL;
+    const tokenFromCfg = c.getSecret("token");
+    const token = tokenFromCfg ??
+        pulumi.secret(process.env.INGRAM_CLOUD_TOKEN ?? process.env.CLOUD_API_KEY ?? "");
+    return { baseUrl, token };
+}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * @ingram-cloud/pulumi
+ *
+ * Pulumi dynamic resources for the Ingram Cloud /v1 API. See README.md for the
+ * repo-interaction model (library here, agents declared in app repos,
+ * integration/tenant config in the infra repo).
+ */
+export * from "./resources";
+export * from "./connection";

package/dist/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * @ingram-cloud/pulumi
+ *
+ * Pulumi dynamic resources for the Ingram Cloud /v1 API. See README.md for the
+ * repo-interaction model (library here, agents declared in app repos,
+ * integration/tenant config in the infra repo).
+ */
+__exportStar(require("./resources"), exports);
+__exportStar(require("./connection"), exports);

package/dist/resources.d.ts

@@ -0,0 +1,210 @@
+/**
+ * Ingram Cloud /v1 tenant configuration as Pulumi dynamic resources.
+ *
+ * Replaces the per-app `scripts/register-*.ts` / `ensure-agent.ts` one-shots
+ * with declarative resources, so IC wiring is a `pulumi up` and lives in state
+ * instead of drifting in someone's shell history.
+ *
+ * Each resource talks to the IC REST API. `token` is the tenant-admin bearer;
+ * keep it (and any credential input) a stack secret — it's marked as an
+ * additional secret output so it's encrypted in state.
+ *
+ * Where each resource is meant to be declared:
+ *   - **Agents** (`IcAgent`) — the `instructions` are app-owned *content*,
+ *     so declare these in the APP repo's Pulumi program, sourced from the app's
+ *     own spec module. Never copy prompts into the infra repo.
+ *   - **Integrations / tenant config** (`IcMcpServer`, `IcOauthProvider`,
+ *     `IcTelegramBot`, `IcWhatsAppConfig`, `IcWebhook`, `IcModelKey`) —
+ *     tenant-level wiring; declare in the infra repo alongside DNS/DB/Vercel.
+ *
+ * Not modelled here, on purpose:
+ *   - **Per-end-user actions** — creating users, binding deployments, pushing
+ *     per-user connection tokens, minting user tokens — happen at app runtime.
+ *   - **Attaching existing smiths to an agent** — a one-time backfill that
+ *     mutates the live fleet; keep it as the app's migration script. New
+ *     smiths attach at birth in app code.
+ *   - **Slack app factory** — config-token rotation is stateful and app-driven.
+ */
+import * as pulumi from "@pulumi/pulumi";
+/**
+ * The /v1 API version this library targets. Bumping the IC API contract is a
+ * library version bump — consumers pin behaviour by pinning this package.
+ */
+export declare const IC_API_VERSION = "2026-05-01";
+export interface AgentVariable {
+    name: string;
+    default?: string | null;
+    description?: string | null;
+    required?: boolean;
+}
+export interface IcAgentArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    /**
+     * Immutable, tenant-unique reconcile key (`[a-z0-9-]`). This is what the
+     * resource adopts on across runs. Defaults to the Pulumi resource name
+     * (slugified); set it explicitly to decouple the key from the resource name.
+     * Changing it replaces the agent.
+     */
+    slug?: pulumi.Input<string>;
+    /** Free display label (mutable, not unique). Defaults to the slug. */
+    name?: pulumi.Input<string>;
+    /** The persona/instruction template (may contain `{{ variables }}`). */
+    instructions?: pulumi.Input<string>;
+    model?: pulumi.Input<string>;
+    enabledHostedTools?: pulumi.Input<string[]>;
+    autoMemory?: pulumi.Input<boolean>;
+    /** Opt into observational-memory consolidation (background, billed). Default off. */
+    memoryConsolidation?: pulumi.Input<boolean>;
+    variables?: pulumi.Input<AgentVariable[]>;
+    /** Release note recorded when a new version is published. */
+    publishNote?: pulumi.Input<string>;
+    /** Rollout percentage for the published version (default 100). */
+    rolloutPercent?: pulumi.Input<number>;
+}
+export declare class IcAgent extends pulumi.dynamic.Resource {
+    /** The `agt_…` id (same as `.id`, exposed for convenience). */
+    readonly agentId: pulumi.Output<string>;
+    /** The version number currently rolled out. */
+    readonly activeVersion: pulumi.Output<number>;
+    constructor(name: string, args: IcAgentArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcMcpServerArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    /** Registry name — the `{name}` in `/v1/tenant/mcp/{name}`. */
+    serverName: pulumi.Input<string>;
+    /** Server URL. Optional when `catalog` is set (the preset supplies it). */
+    url?: pulumi.Input<string>;
+    /** Stamp from a curated catalog preset (e.g. "stripe"); copied down at enable. */
+    catalog?: pulumi.Input<string>;
+    authKind?: pulumi.Input<string>;
+    authProvider?: pulumi.Input<string>;
+    /** oauth only: "tenant" (your own OAuth client) | "platform" (Ingram-owned). */
+    clientMode?: pulumi.Input<string>;
+    secret?: pulumi.Input<string>;
+    /** Default-deny: only these tool names reach a run. Omit to expose all discovered. */
+    toolAllowlist?: pulumi.Input<string[]>;
+    /** IC-side approval gating by tool-name glob, e.g. `[{ match: "create_refund" }]`. */
+    approvalPolicy?: pulumi.Input<{
+        match: string;
+        require?: string;
+    }[]>;
+}
+export declare class IcMcpServer extends pulumi.dynamic.Resource {
+    readonly toolsDiscovered: pulumi.Output<number>;
+    readonly discoveryError: pulumi.Output<string | undefined>;
+    constructor(name: string, args: IcMcpServerArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcTelegramBotArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    botToken: pulumi.Input<string>;
+}
+export declare class IcTelegramBot extends pulumi.dynamic.Resource {
+    readonly botUsername: pulumi.Output<string>;
+    readonly webhookUrl: pulumi.Output<string>;
+    constructor(name: string, args: IcTelegramBotArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcOauthProviderArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    /** Provider key — the `{provider}` in `/v1/tenant/providers/{provider}`;
+     *  what an oauth-kind `IcMcpServer` names via `authProvider`. */
+    provider: pulumi.Input<string>;
+    /** Webhook-delegation mode: IC POSTs `{ connection_id }` here when a stored
+     *  token nears expiry and the tenant PATCHes a fresh pair back. Set this
+     *  WITHOUT `clientSecret` (a stored secret switches IC to IC-driven mode). */
+    refreshWebhook?: pulumi.Input<string>;
+    clientId?: pulumi.Input<string>;
+    /** IC-driven refresh mode: IC exchanges the refresh token at `tokenUri`. */
+    clientSecret?: pulumi.Input<string>;
+    tokenUri?: pulumi.Input<string>;
+    scopesAllowed?: pulumi.Input<string[]>;
+}
+export declare class IcOauthProvider extends pulumi.dynamic.Resource {
+    constructor(name: string, args: IcOauthProviderArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcWhatsAppConfigArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    phoneNumberId: pulumi.Input<string>;
+    accessToken: pulumi.Input<string>;
+    /** The WhatsApp Business Account id — IC subscribes its app to it so inbound flows. */
+    wabaId: pulumi.Input<string>;
+}
+export declare class IcWhatsAppConfig extends pulumi.dynamic.Resource {
+    readonly displayPhoneNumber: pulumi.Output<string>;
+    readonly webhookUrl: pulumi.Output<string>;
+    constructor(name: string, args: IcWhatsAppConfigArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcEmailArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    /** Cloudflare account that owns the sending domain + Email-Sending token. */
+    cloudflareAccountId: pulumi.Input<string>;
+    /** Email-Sending-scoped Cloudflare API token (secret). */
+    cloudflareApiToken: pulumi.Input<string>;
+    /** The verified sending domain (e.g. `mail.thornhill.app`). */
+    fromDomain: pulumi.Input<string>;
+    /** Optional friendly From name. */
+    displayName?: pulumi.Input<string>;
+    /** Optional HMAC for inbound-worker verification; IC generates one if omitted. */
+    inboundSecret?: pulumi.Input<string>;
+}
+export declare class IcEmail extends pulumi.dynamic.Resource {
+    readonly inboundSecret: pulumi.Output<string>;
+    readonly inboundUrl: pulumi.Output<string>;
+    readonly configured: pulumi.Output<boolean>;
+    constructor(name: string, args: IcEmailArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcWebhookArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    url: pulumi.Input<string>;
+    events: pulumi.Input<string[]>;
+}
+export declare class IcWebhook extends pulumi.dynamic.Resource {
+    /** The signing secret — present only when Pulumi created the webhook. */
+    readonly secret: pulumi.Output<string | undefined>;
+    constructor(name: string, args: IcWebhookArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcModelKeyArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    /** Provider id, e.g. `openai`, `anthropic`. */
+    provider: pulumi.Input<string>;
+    apiKey: pulumi.Input<string>;
+    /** Optional override base URL (OpenAI-compatible backends). */
+    providerBaseUrl?: pulumi.Input<string>;
+}
+export declare class IcModelKey extends pulumi.dynamic.Resource {
+    constructor(name: string, args: IcModelKeyArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcProjectArgs {
+    baseUrl: pulumi.Input<string>;
+    /** An **organization** key (`organization:*`), NOT a project token. */
+    token: pulumi.Input<string>;
+    /** Adopt-by-name reconcile key (defaults to the Pulumi resource name). */
+    projectName?: pulumi.Input<string>;
+}
+export declare class IcProject extends pulumi.dynamic.Resource {
+    /** The project id — this is the TENANT a project token is bound to. */
+    readonly projectId: pulumi.Output<string>;
+    constructor(name: string, args: IcProjectArgs, opts?: pulumi.CustomResourceOptions);
+}
+export interface IcProjectTokenArgs {
+    baseUrl: pulumi.Input<string>;
+    /** An **organization** key (`organization:*`), NOT a project token. */
+    token: pulumi.Input<string>;
+    /** The project id to mint for — typically an `IcProject().projectId`. */
+    project: pulumi.Input<string>;
+    tokenName?: pulumi.Input<string>;
+    ttlSeconds?: pulumi.Input<number>;
+}
+export declare class IcProjectToken extends pulumi.dynamic.Resource {
+    /** The minted `tenant:*` token (secret) — feed this into the app's env. */
+    readonly projectToken: pulumi.Output<string>;
+    readonly tokenId: pulumi.Output<string>;
+    constructor(name: string, args: IcProjectTokenArgs, opts?: pulumi.CustomResourceOptions);
+}

package/dist/resources.js

@@ -0,0 +1,686 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.IcProjectToken = exports.IcProject = exports.IcModelKey = exports.IcWebhook = exports.IcEmail = exports.IcWhatsAppConfig = exports.IcOauthProvider = exports.IcTelegramBot = exports.IcMcpServer = exports.IcAgent = exports.IC_API_VERSION = void 0;
+/**
+ * Ingram Cloud /v1 tenant configuration as Pulumi dynamic resources.
+ *
+ * Replaces the per-app `scripts/register-*.ts` / `ensure-agent.ts` one-shots
+ * with declarative resources, so IC wiring is a `pulumi up` and lives in state
+ * instead of drifting in someone's shell history.
+ *
+ * Each resource talks to the IC REST API. `token` is the tenant-admin bearer;
+ * keep it (and any credential input) a stack secret — it's marked as an
+ * additional secret output so it's encrypted in state.
+ *
+ * Where each resource is meant to be declared:
+ *   - **Agents** (`IcAgent`) — the `instructions` are app-owned *content*,
+ *     so declare these in the APP repo's Pulumi program, sourced from the app's
+ *     own spec module. Never copy prompts into the infra repo.
+ *   - **Integrations / tenant config** (`IcMcpServer`, `IcOauthProvider`,
+ *     `IcTelegramBot`, `IcWhatsAppConfig`, `IcWebhook`, `IcModelKey`) —
+ *     tenant-level wiring; declare in the infra repo alongside DNS/DB/Vercel.
+ *
+ * Not modelled here, on purpose:
+ *   - **Per-end-user actions** — creating users, binding deployments, pushing
+ *     per-user connection tokens, minting user tokens — happen at app runtime.
+ *   - **Attaching existing smiths to an agent** — a one-time backfill that
+ *     mutates the live fleet; keep it as the app's migration script. New
+ *     smiths attach at birth in app code.
+ *   - **Slack app factory** — config-token rotation is stateful and app-driven.
+ */
+const pulumi = __importStar(require("@pulumi/pulumi"));
+/**
+ * The /v1 API version this library targets. Bumping the IC API contract is a
+ * library version bump — consumers pin behaviour by pinning this package.
+ */
+exports.IC_API_VERSION = "2026-05-01";
+// Shared IC REST call. Module-scope so Pulumi's closure serialization captures
+// it into each provider's methods; uses only the global `fetch` (Node ≥18).
+async function icRequest(baseUrl, token, method, path, body, idempotencyKey) {
+    const headers = {
+        Authorization: `Bearer ${token}`,
+        "IC-Api-Version": exports.IC_API_VERSION,
+    };
+    if (body !== undefined)
+        headers["Content-Type"] = "application/json";
+    if (idempotencyKey)
+        headers["Idempotency-Key"] = idempotencyKey;
+    const res = await fetch(`${baseUrl}${path}`, {
+        method,
+        headers,
+        body: body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    const text = await res.text();
+    if (!res.ok) {
+        // Carry the status so `read` can tell "gone" (404) from a transient blip.
+        const err = new Error(`IC ${method} ${path} → ${res.status}: ${text.slice(0, 400)}`);
+        err.status = res.status;
+        throw err;
+    }
+    return text ? JSON.parse(text) : {};
+}
+// Shared `diff` for the CRUD-scaffold providers: compare a fixed set of keys and
+// build the Pulumi DiffResult. `replaceKeys` force a replace when changed;
+// `scalarKeys` are in-place by reference equality; `listKeys` are in-place but
+// compared by value (JSON). Each provider keeps its exact key set and its
+// `deleteBeforeReplace` choice — this only removes the hand-rolled boilerplate.
+function simpleDiff(olds, news, opts) {
+    const replaces = (opts.replaceKeys ?? []).filter((k) => olds[k] !== news[k]);
+    const scalarChanged = (opts.scalarKeys ?? []).some((k) => olds[k] !== news[k]);
+    const listChanged = (opts.listKeys ?? []).some((k) => JSON.stringify(olds[k] ?? null) !== JSON.stringify(news[k] ?? null));
+    return {
+        changes: replaces.length > 0 || scalarChanged || listChanged,
+        replaces,
+        deleteBeforeReplace: opts.deleteBeforeReplace,
+    };
+}
+// Shared `read` 404 handling: run a fetch, map a server-side 404 to `{ id: "" }`
+// (so refresh prunes the resource and the next `up` recreates it) and rethrow any
+// other error so a transient blip can't nuke state.
+async function read404(fetchFn, onFound) {
+    try {
+        return onFound(await fetchFn());
+    }
+    catch (e) {
+        if (e?.status === 404)
+            return { id: "" };
+        throw e;
+    }
+}
+// Factory for the PUT-style providers (mcp, telegram, whatsapp, modelKey): they
+// all reconcile by PUTting the desired body to a resource path and DELETE the
+// same path to tear down. They differ only in (a) the path — a fixed singleton
+// vs one keyed by an input field — (b) the request body, (c) which response
+// fields become outputs, and (d) the diff key sets — all passed in here.
+function makePutResource(cfg) {
+    const put = async (i) => {
+        const res = await icRequest(i.baseUrl, i.token, "PUT", cfg.path(i), cfg.body(i));
+        return { ...i, ...(cfg.outs ? cfg.outs(i, res) : {}) };
+    };
+    return {
+        async create(i) {
+            return { id: cfg.id(i), outs: await put(i) };
+        },
+        async update(_id, _olds, news) {
+            return { outs: await put(news) };
+        },
+        async delete(_id, props) {
+            await icRequest(props.baseUrl, props.token, "DELETE", cfg.path(props));
+        },
+        async diff(_id, olds, news) {
+            return simpleDiff(olds, news, cfg.diff);
+        },
+    };
+}
+// Lower-case, hyphenate, trim — matches the API's slug derivation so a
+// logical-name-derived slug lines up with what the server would compute.
+function slugify(s) {
+    return (s
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, "-")
+        .replace(/^-+|-+$/g, "")
+        .slice(0, 63) || "agent");
+}
+// The draft body IC's create/patch expect (snake_case wire shape). `slug` is
+// honoured on create and ignored on patch (it's immutable), so the display
+// `name` defaults to the slug when none is given.
+function agentBody(i) {
+    return {
+        slug: i.slug,
+        name: i.name ?? i.slug,
+        instructions: i.instructions ?? null,
+        model: i.model ?? null,
+        enabled_hosted_tools: i.enabledHostedTools ?? [],
+        auto_memory: i.autoMemory ?? null,
+        memory_consolidation: i.memoryConsolidation ?? null,
+        variables: i.variables ?? [],
+    };
+}
+// Stable signature of the *content* that warrants a new published version
+// (name and rollout% deliberately excluded — a rename/restage is not new content).
+function agentContentSig(s) {
+    return JSON.stringify({
+        instructions: s.instructions ?? null,
+        model: s.model ?? null,
+        tools: [...(s.enabled_hosted_tools ?? [])].sort(),
+        auto_memory: s.auto_memory ?? null,
+        memory_consolidation: s.memory_consolidation ?? null,
+        variables: s.variables ?? [],
+    });
+}
+// Map the camelCase resource inputs onto the canonical snapshot shape.
+function inputsToSnapshot(i) {
+    return {
+        instructions: i.instructions,
+        model: i.model,
+        enabled_hosted_tools: i.enabledHostedTools,
+        auto_memory: i.autoMemory,
+        memory_consolidation: i.memoryConsolidation,
+        variables: i.variables,
+    };
+}
+async function findAgentBySlug(baseUrl, token, slug) {
+    const res = await icRequest(baseUrl, token, "GET", "/v1/agents");
+    return (res.data ?? []).find((b) => b.slug === slug) ?? null;
+}
+// Signature of the snapshot currently published as the active version, or null
+// if nothing is published yet.
+async function activeSnapshotSig(baseUrl, token, id, activeVersion) {
+    if (!activeVersion)
+        return null;
+    const res = await icRequest(baseUrl, token, "GET", `/v1/agents/${id}/versions`);
+    const v = (res.data ?? []).find((x) => x.version === activeVersion);
+    if (!v)
+        return null;
+    // The version's `snapshot` is already the canonical snake_case shape.
+    return agentContentSig(v.snapshot ?? {});
+}
+// Ensure the live agent matches desired: adopt-or-create, publish iff the
+// content drifted from the active version, then roll out at `percent`.
+async function reconcileAgent(i, knownId, priorSig) {
+    let id;
+    if (!knownId) {
+        const existing = await findAgentBySlug(i.baseUrl, i.token, i.slug);
+        if (existing) {
+            id = existing.id;
+            await icRequest(i.baseUrl, i.token, "PATCH", `/v1/agents/${id}`, agentBody(i));
+        }
+        else {
+            // No idempotency key: Pulumi calls create once and tracks the id in
+            // state, and the adopt-by-slug branch above covers re-runs and the
+            // script→Pulumi migration. Keying on the slug would replay a stale
+            // (possibly archived) create after a destroy+recreate within the 24h
+            // idempotency window.
+            const bp = await icRequest(i.baseUrl, i.token, "POST", "/v1/agents", agentBody(i));
+            id = bp.id;
+        }
+    }
+    else {
+        // Known id (update path): push the draft to the desired shape.
+        id = knownId;
+        await icRequest(i.baseUrl, i.token, "PATCH", `/v1/agents/${id}`, agentBody(i));
+    }
+    const bp = await icRequest(i.baseUrl, i.token, "GET", `/v1/agents/${id}`);
+    const desiredSig = agentContentSig(inputsToSnapshot(i));
+    // On the create path we don't know the prior sig — compare to what's actually
+    // published so adopting a script-made agent doesn't churn a needless version.
+    const liveSig = priorSig ??
+        (await activeSnapshotSig(i.baseUrl, i.token, id, bp.active_version));
+    let version = bp.active_version ?? 0;
+    if (!bp.active_version || liveSig !== desiredSig) {
+        // Publishing snapshots the draft as the next immutable version and returns
+        // its number. Only the *first* publish auto-activates; later ones go live
+        // only via the rollout below — so take the version from the publish reply,
+        // not from active_version (which hasn't advanced yet).
+        const pub = await icRequest(i.baseUrl, i.token, "POST", `/v1/agents/${id}/versions`, {
+            note: i.publishNote ?? null,
+        });
+        version = pub.version;
+    }
+    // Always assert the rollout: it activates a freshly published version and is
+    // an idempotent no-op when `version` is already the active one at `percent`.
+    const percent = i.rolloutPercent ?? 100;
+    await icRequest(i.baseUrl, i.token, "POST", `/v1/agents/${id}/rollout`, {
+        version,
+        percent,
+    });
+    return {
+        ...i,
+        agentId: id,
+        contentSig: desiredSig,
+        activeVersion: version,
+        rolloutPercent: percent,
+    };
+}
+const agentProvider = {
+    async create(i) {
+        const outs = await reconcileAgent(i);
+        return { id: outs.agentId, outs };
+    },
+    async update(id, olds, news) {
+        const outs = await reconcileAgent(news, id, olds.contentSig);
+        return { outs };
+    },
+    async delete(id, props) {
+        try {
+            await icRequest(props.baseUrl, props.token, "DELETE", `/v1/agents/${id}`);
+        }
+        catch (e) {
+            // A 409 is the API's `agent_in_use` precondition: an agent can't be archived
+            // while smiths still run it. Surface that as an actionable message; the API's
+            // own error (carrying the smith count) is appended. Any other error propagates
+            // unwrapped.
+            if (e?.status === 409)
+                throw new Error(`Agent ${id} can't be archived while smiths still run it. Delete or ` +
+                    `re-point those smiths first, or set { retainOnDelete: true } on the ` +
+                    `resource to leave the agent in place. ${e}`);
+            throw e;
+        }
+    },
+    async diff(_id, olds, news) {
+        // slug is the immutable reconcile key — changing it is a replace, not an
+        // update (the old and new slugs differ, so create-before-delete is safe).
+        if (olds.slug !== news.slug)
+            return { changes: true, replaces: ["slug"] };
+        const contentChanged = agentContentSig(inputsToSnapshot(olds)) !==
+            agentContentSig(inputsToSnapshot(news));
+        const nameChanged = (olds.name ?? olds.slug) !== (news.name ?? news.slug);
+        const rolloutChanged = (olds.rolloutPercent ?? 100) !== (news.rolloutPercent ?? 100);
+        return { changes: contentChanged || nameChanged || rolloutChanged };
+    },
+    // Adopt a agent a script already created (`pulumi import <id>`).
+    async read(id, props) {
+        return read404(() => icRequest(props.baseUrl, props.token, "GET", `/v1/agents/${id}`), (bp) => {
+            if (!bp || !bp.id)
+                return { id: "" };
+            const d = bp.draft ?? {};
+            return {
+                id,
+                props: {
+                    ...props,
+                    slug: bp.slug ?? props.slug,
+                    name: bp.name,
+                    instructions: d.instructions ?? undefined,
+                    model: d.model ?? undefined,
+                    enabledHostedTools: d.enabled_hosted_tools ?? [],
+                    autoMemory: d.auto_memory ?? undefined,
+                    memoryConsolidation: d.memory_consolidation ?? undefined,
+                    variables: d.variables ?? [],
+                },
+            };
+        });
+    },
+};
+class IcAgent extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(agentProvider, name, {
+            instructions: undefined,
+            model: undefined,
+            enabledHostedTools: undefined,
+            autoMemory: undefined,
+            memoryConsolidation: undefined,
+            variables: undefined,
+            publishNote: undefined,
+            rolloutPercent: undefined,
+            agentId: undefined,
+            activeVersion: undefined,
+            contentSig: undefined,
+            ...args,
+            // Default the reconcile key to the (stable) resource name when the
+            // caller doesn't pin one — kept after ...args so it always resolves.
+            slug: args.slug ?? slugify(name),
+        }, { ...opts, additionalSecretOutputs: ["token"] });
+    }
+}
+exports.IcAgent = IcAgent;
+function mcpBody(i) {
+    const auth = { kind: i.authKind };
+    if (i.authProvider)
+        auth.provider = i.authProvider;
+    if (i.clientMode)
+        auth.client_mode = i.clientMode;
+    if (i.secret)
+        auth.secret = i.secret;
+    const body = { auth };
+    if (i.url)
+        body.url = i.url;
+    if (i.catalog)
+        body.catalog = i.catalog;
+    if (i.toolAllowlist !== undefined)
+        body.tool_allowlist = i.toolAllowlist;
+    if (i.approvalPolicy !== undefined)
+        body.approval_policy = i.approvalPolicy;
+    return body;
+}
+const mcpProvider = makePutResource({
+    path: (i) => `/v1/tenant/mcp/${encodeURIComponent(i.serverName)}`,
+    id: (i) => i.serverName,
+    body: mcpBody,
+    outs: (_i, res) => ({
+        toolsDiscovered: res.tools_discovered ?? 0,
+        discoveryError: res.discovery_error ?? null,
+    }),
+    diff: {
+        replaceKeys: ["serverName"],
+        scalarKeys: [
+            "url",
+            "catalog",
+            "authKind",
+            "authProvider",
+            "clientMode",
+            "secret",
+            "token",
+            "baseUrl",
+        ],
+        // Arrays compare by value, not reference.
+        listKeys: ["toolAllowlist", "approvalPolicy"],
+        deleteBeforeReplace: true,
+    },
+});
+class IcMcpServer extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(mcpProvider, name, {
+            authKind: args.catalog ? undefined : "static",
+            url: undefined,
+            catalog: undefined,
+            authProvider: undefined,
+            clientMode: undefined,
+            secret: undefined,
+            toolAllowlist: undefined,
+            approvalPolicy: undefined,
+            toolsDiscovered: undefined,
+            discoveryError: undefined,
+            ...args,
+        }, { ...opts, additionalSecretOutputs: ["token", "secret"] });
+    }
+}
+exports.IcMcpServer = IcMcpServer;
+const telegramProvider = makePutResource({
+    path: () => "/v1/tenant/telegram",
+    id: () => "telegram",
+    body: (i) => ({ bot_token: i.botToken }),
+    outs: (_i, res) => ({
+        botUsername: res.bot_username,
+        botId: res.bot_id,
+        webhookUrl: res.webhook_url,
+    }),
+    diff: { scalarKeys: ["botToken", "token", "baseUrl"] },
+});
+class IcTelegramBot extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(telegramProvider, name, {
+            botUsername: undefined,
+            botId: undefined,
+            webhookUrl: undefined,
+            ...args,
+        }, { ...opts, additionalSecretOutputs: ["token", "botToken"] });
+    }
+}
+exports.IcTelegramBot = IcTelegramBot;
+const oauthProviderResource = makePutResource({
+    path: (i) => `/v1/tenant/providers/${encodeURIComponent(i.provider)}`,
+    id: (i) => i.provider,
+    body: (i) => ({
+        refresh_webhook: i.refreshWebhook,
+        client_id: i.clientId,
+        // Key presence is meaningful on the wire: an omitted `client_secret`
+        // keeps the stored one, a sent value (even null) replaces it. Only send
+        // the key when the input is set so a webhook-mode provider never
+        // clobbers— or phantom-clears — a secret.
+        ...(i.clientSecret !== undefined ? { client_secret: i.clientSecret } : {}),
+        token_uri: i.tokenUri,
+        scopes_allowed: i.scopesAllowed,
+    }),
+    diff: {
+        replaceKeys: ["provider"],
+        scalarKeys: [
+            "refreshWebhook",
+            "clientId",
+            "clientSecret",
+            "tokenUri",
+            "token",
+            "baseUrl",
+        ],
+        listKeys: ["scopesAllowed"],
+        deleteBeforeReplace: true,
+    },
+});
+class IcOauthProvider extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(oauthProviderResource, name, {
+            refreshWebhook: undefined,
+            clientId: undefined,
+            clientSecret: undefined,
+            tokenUri: undefined,
+            scopesAllowed: undefined,
+            ...args,
+        }, { ...opts, additionalSecretOutputs: ["token", "clientSecret"] });
+    }
+}
+exports.IcOauthProvider = IcOauthProvider;
+const whatsappProvider = makePutResource({
+    path: () => "/v1/tenant/whatsapp",
+    id: () => "whatsapp",
+    body: (i) => ({
+        phone_number_id: i.phoneNumberId,
+        access_token: i.accessToken,
+        waba_id: i.wabaId,
+    }),
+    outs: (_i, res) => ({
+        displayPhoneNumber: res.display_phone_number,
+        webhookUrl: res.webhook_url,
+    }),
+    diff: {
+        scalarKeys: ["phoneNumberId", "accessToken", "wabaId", "token", "baseUrl"],
+    },
+});
+class IcWhatsAppConfig extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(whatsappProvider, name, {
+            displayPhoneNumber: undefined,
+            webhookUrl: undefined,
+            ...args,
+        }, {
+            ...opts,
+            additionalSecretOutputs: ["token", "accessToken"],
+        });
+    }
+}
+exports.IcWhatsAppConfig = IcWhatsAppConfig;
+const emailProvider = makePutResource({
+    path: () => "/v1/tenant/email",
+    id: () => "email",
+    body: (i) => ({
+        cloudflare_account_id: i.cloudflareAccountId,
+        cloudflare_api_token: i.cloudflareApiToken,
+        from_domain: i.fromDomain,
+        display_name: i.displayName,
+        inbound_secret: i.inboundSecret,
+    }),
+    outs: (i, res) => ({
+        // IC generates inbound_secret when we don't supply one — capture it so it's
+        // stable in state (and wireable into the inbound worker).
+        inboundSecret: res.inbound_secret ?? i.inboundSecret,
+        inboundUrl: res.inbound_url,
+        configured: res.configured,
+    }),
+    // inboundSecret excluded — IC may generate it, so it's an output, not drift.
+    diff: {
+        scalarKeys: [
+            "cloudflareAccountId",
+            "cloudflareApiToken",
+            "fromDomain",
+            "displayName",
+            "token",
+            "baseUrl",
+        ],
+    },
+});
+class IcEmail extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(emailProvider, name, {
+            displayName: undefined,
+            inboundSecret: undefined,
+            inboundUrl: undefined,
+            configured: undefined,
+            ...args,
+        }, {
+            ...opts,
+            additionalSecretOutputs: [
+                "token",
+                "cloudflareApiToken",
+                "inboundSecret",
+            ],
+        });
+    }
+}
+exports.IcEmail = IcEmail;
+const webhookProvider = {
+    async create(i) {
+        const res = await icRequest(i.baseUrl, i.token, "POST", "/v1/tenant/webhooks", {
+            url: i.url,
+            events: i.events,
+            active: true,
+        });
+        return { id: res.id, outs: { ...i, secret: res.secret } };
+    },
+    async update(id, olds, news) {
+        await icRequest(news.baseUrl, news.token, "PATCH", `/v1/tenant/webhooks/${id}`, {
+            events: news.events,
+        });
+        // The signing secret survives an events PATCH on IC's side; carry the
+        // create-time output forward so an update never blanks consumers that
+        // flow `secret` into app config.
+        return { outs: { ...news, secret: olds.secret } };
+    },
+    async delete(id, props) {
+        await icRequest(props.baseUrl, props.token, "DELETE", `/v1/tenant/webhooks/${id}`);
+    },
+    async diff(_id, olds, news) {
+        const replaces = olds.url !== news.url ? ["url"] : [];
+        const eventsChanged = JSON.stringify([...(olds.events ?? [])].sort()) !==
+            JSON.stringify([...(news.events ?? [])].sort());
+        return { changes: replaces.length > 0 || eventsChanged, replaces };
+    },
+    // Enables `pulumi import` of a webhook a script already created (id is the
+    // import id). The signing secret is intentionally not recoverable.
+    async read(id, props) {
+        const list = await icRequest(props.baseUrl, props.token, "GET", "/v1/tenant/webhooks");
+        const hit = (list.data ?? []).find((w) => w.id === id);
+        // Absent from the list → gone server-side; empty id lets refresh prune it.
+        if (!hit)
+            return { id: "" };
+        return { id, props: { ...props, url: hit.url, events: hit.events } };
+    },
+};
+class IcWebhook extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(webhookProvider, name, { secret: undefined, ...args }, {
+            ...opts,
+            additionalSecretOutputs: ["token", "secret"],
+        });
+    }
+}
+exports.IcWebhook = IcWebhook;
+const modelKeyProvider = makePutResource({
+    path: (i) => `/v1/tenant/model_keys/${encodeURIComponent(i.provider)}`,
+    id: (i) => i.provider,
+    body: (i) => ({ api_key: i.apiKey, base_url: i.providerBaseUrl ?? null }),
+    diff: {
+        replaceKeys: ["provider"],
+        scalarKeys: ["apiKey", "providerBaseUrl", "token", "baseUrl"],
+        deleteBeforeReplace: true,
+    },
+});
+class IcModelKey extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(modelKeyProvider, name, { providerBaseUrl: undefined, ...args }, { ...opts, additionalSecretOutputs: ["token", "apiKey"] });
+    }
+}
+exports.IcModelKey = IcModelKey;
+async function findProjectByName(baseUrl, token, name) {
+    const res = await icRequest(baseUrl, token, "GET", `/v1/organization/projects?name=${encodeURIComponent(name)}`);
+    return (res.data ?? [])[0] ?? null;
+}
+const projectProvider = {
+    async create(i) {
+        const existing = await findProjectByName(i.baseUrl, i.token, i.projectName);
+        const proj = existing ??
+            (await icRequest(i.baseUrl, i.token, "POST", "/v1/organization/projects", {
+                name: i.projectName,
+            }));
+        return { id: proj.id, outs: { ...i, projectId: proj.id } };
+    },
+    async update(id, _olds, news) {
+        // Nothing mutable server-side (a name change is a replace); just re-assert.
+        return { outs: { ...news, projectId: id } };
+    },
+    async delete(id, props) {
+        await icRequest(props.baseUrl, props.token, "DELETE", `/v1/organization/projects/${encodeURIComponent(id)}`);
+    },
+    async diff(_id, olds, news) {
+        return simpleDiff(olds, news, {
+            replaceKeys: ["projectName"],
+            scalarKeys: ["token", "baseUrl"],
+            deleteBeforeReplace: false,
+        });
+    },
+    async read(id, props) {
+        return read404(() => icRequest(props.baseUrl, props.token, "GET", `/v1/organization/projects/${encodeURIComponent(id)}`), (p) => ({
+            id,
+            props: { ...props, projectName: p.name, projectId: p.id },
+        }));
+    },
+};
+class IcProject extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(projectProvider, name, { ...args, projectName: args.projectName ?? name, projectId: undefined }, { ...opts, additionalSecretOutputs: ["token"] });
+    }
+}
+exports.IcProject = IcProject;
+const projectTokenProvider = {
+    async create(i) {
+        const res = await icRequest(i.baseUrl, i.token, "POST", `/v1/organization/projects/${encodeURIComponent(i.project)}/tokens`, { name: i.tokenName, ttl_seconds: i.ttlSeconds });
+        return {
+            id: res.id,
+            outs: { ...i, tokenId: res.id, projectToken: res.token, sub: res.sub },
+        };
+    },
+    async delete(id, props) {
+        await icRequest(props.baseUrl, props.token, "DELETE", `/v1/organization/projects/${encodeURIComponent(props.project)}/tokens/${encodeURIComponent(id)}`);
+    },
+    async diff(_id, olds, news) {
+        // The token value can't be edited in place — any change re-mints. Mint the
+        // new one before revoking the old so dependents can switch over first
+        // (so every input is a replace key, none in-place).
+        return simpleDiff(olds, news, {
+            replaceKeys: ["project", "tokenName", "ttlSeconds", "token", "baseUrl"],
+            deleteBeforeReplace: false,
+        });
+    },
+};
+class IcProjectToken extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(projectTokenProvider, name, {
+            ...args,
+            tokenName: args.tokenName ?? name,
+            tokenId: undefined,
+            projectToken: undefined,
+            sub: undefined,
+        }, { ...opts, additionalSecretOutputs: ["token", "projectToken"] });
+    }
+}
+exports.IcProjectToken = IcProjectToken;

package/package.json

@@ -0,0 +1,38 @@
+{
+	"name": "@ingram-cloud/pulumi",
+	"version": "1.0.0",
+	"description": "Pulumi dynamic resources for the Ingram Cloud /v1 API — projects, project tokens, agents, MCP servers, channels, webhooks, model keys.",
+	"license": "MIT",
+	"homepage": "https://cloud.ingram.tech",
+	"keywords": [
+		"pulumi",
+		"ingram-cloud",
+		"ingram"
+	],
+	"main": "dist/index.js",
+	"types": "dist/index.d.ts",
+	"files": [
+		"dist"
+	],
+	"publishConfig": {
+		"access": "public"
+	},
+	"scripts": {
+		"build": "tsc -p tsconfig.json",
+		"type-check": "tsc -p tsconfig.json --noEmit",
+		"lint": "oxlint",
+		"format": "oxfmt --write .",
+		"prepublishOnly": "npm run build"
+	},
+	"peerDependencies": {
+		"@pulumi/pulumi": "^3.0.0"
+	},
+	"devDependencies": {
+		"@ingram-tech/oxlint-config": "^0.2.1",
+		"@pulumi/pulumi": "^3.0.0",
+		"@types/node": "^25.0.0",
+		"oxfmt": "^0.54.0",
+		"oxlint": "^1.70.0",
+		"typescript": "^6.0.0"
+	}
+}