@ingram-cloud/pulumi 1.3.0 → 2.0.0

package/README.md

@@ -83,6 +83,7 @@ const curator = new ic.IcAgent("curator", {
   autoMemory: AGENT_SPECS.curator.auto_memory,
   // memoryConsolidation: true,  // opt into background consolidation (billed)
   // variables: [...], enabledHostedTools: [...], rolloutPercent: 100,
+  // mcpServers: ["sheets"],  // scope runs to these registered MCP servers (omit = all)
 });
 
 export const curatorAgentId = curator.agentId;
@@ -150,7 +151,7 @@ export const pageUrl = page.pageUrl; // https://cloud.ingram.tech/hosted/dep_…
 // Your own server (raw URL).
 new ic.IcMcpServer("thornhill-mcp", {
   ...conn, serverName: "thornhill", url: `${APP_URL}/api/mcp`,
-  authKind: "static", secret: mcpSecret,
+  authKind: "bearer", secret: mcpSecret,
 });
 
 // An `oauth`-kind server forwards each end-user's own stored token; its
@@ -251,3 +252,9 @@ usually unnecessary — a plain `pulumi up` will reconcile the live agent.)
   `pulumi refresh` prunes a resource deleted out-of-band — e.g. after an IC DB
   reset, `pulumi refresh && pulumi up` recreates it, no `pulumi state delete`.
   Non-404 errors still throw, so a transient API blip can't drop it from state.
+- `IcMcpServer` `read` also round-trips the live `url` / `authKind` /
+  `authProvider` (raw registrations only — catalog presets supply these
+  server-side), so `pulumi refresh && pulumi up` detects and repairs server-side
+  drift such as a lost auth block. Write-only fields (`secret`) can't round-trip
+  and stay diff-by-state. Dynamic providers run the code serialized into state,
+  so drift detection starts after the first `pulumi up` with this version.

package/dist/resources.d.ts

@@ -85,6 +85,14 @@ export interface IcAgentArgs {
     instructions?: pulumi.Input<string>;
     model?: pulumi.Input<string>;
     enabledHostedTools?: pulumi.Input<string[]>;
+    /** Scope runs to these registered MCP servers (by name). Omitted = all. */
+    mcpServers?: pulumi.Input<string[]>;
+    /**
+     * Vector store ids (`vs_…`) whose contents this agent can retrieve over. Folds
+     * into the content signature like `enabledHostedTools`, so a change publishes and
+     * rolls out a new version. Pair with {@link IcVectorStore} to IaC the stores.
+     */
+    vectorStoreIds?: pulumi.Input<string[]>;
     autoMemory?: pulumi.Input<boolean>;
     /** Opt into observational-memory consolidation (background, billed). Default off. */
     memoryConsolidation?: pulumi.Input<boolean>;
@@ -109,6 +117,35 @@ export declare class IcAgent extends pulumi.dynamic.Resource {
     readonly activeVersion: pulumi.Output<number>;
     constructor(name: string, args: IcAgentArgs, opts?: pulumi.CustomResourceOptions);
 }
+/** One source file on an {@link IcVectorStore}, provided by local path. */
+export interface VectorStoreFile {
+    /** Absolute path to the file to ingest (read at `pulumi up`, like `htmlPath`). */
+    path: string;
+    /** Per-file chunking override (the `chunking_strategy` wire shape); defaults to
+     *  the server default (`auto`). */
+    chunkingStrategy?: Record<string, unknown>;
+}
+export interface IcVectorStoreArgs {
+    baseUrl: pulumi.Input<string>;
+    token: pulumi.Input<string>;
+    /** Display name. */
+    name?: pulumi.Input<string>;
+    description?: pulumi.Input<string>;
+    /** Arbitrary key/value metadata stored on the vector store. */
+    metadata?: pulumi.Input<Record<string, unknown>>;
+    /**
+     * Source files to ingest, each declared by an absolute local `path` (read at
+     * `pulumi up`, like a UI template's `htmlPath`). A file's sha256 tracks drift:
+     * edit it and it re-uploads + re-attaches, remove it and it detaches. Attaching
+     * starts async ingest server-side; this resource does not block on indexing.
+     */
+    files?: pulumi.Input<VectorStoreFile[]>;
+}
+export declare class IcVectorStore extends pulumi.dynamic.Resource {
+    /** The `vs_…` id (same as `.id`, exposed for convenience). */
+    readonly vectorStoreId: pulumi.Output<string>;
+    constructor(name: string, args: IcVectorStoreArgs, opts?: pulumi.CustomResourceOptions);
+}
 export interface IcMcpServerArgs {
     baseUrl: pulumi.Input<string>;
     token: pulumi.Input<string>;

package/dist/resources.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.IcWebPage = exports.IcProjectToken = exports.IcProject = exports.IcModelKey = exports.IcWebhook = exports.IcEmail = exports.IcWhatsAppConfig = exports.IcOauthProvider = exports.IcTelegramBot = exports.IcMcpServer = exports.IcAgent = exports.IC_API_VERSION = void 0;
+exports.IcWebPage = exports.IcProjectToken = exports.IcProject = exports.IcModelKey = exports.IcWebhook = exports.IcEmail = exports.IcWhatsAppConfig = exports.IcOauthProvider = exports.IcTelegramBot = exports.IcMcpServer = exports.IcVectorStore = exports.IcAgent = exports.IC_API_VERSION = void 0;
 /**
  * Ingram Cloud /v1 tenant configuration as Pulumi dynamic resources.
  *
@@ -143,6 +143,11 @@ function makePutResource(cfg) {
         async diff(_id, olds, news) {
             return simpleDiff(olds, news, cfg.diff);
         },
+        async read(id, props) {
+            if (!cfg.readProps || !props?.baseUrl || !props?.token)
+                return { id, props };
+            return read404(() => icRequest(props.baseUrl, props.token, "GET", cfg.path(props)), (res) => ({ id, props: { ...props, ...cfg.readProps(props, res) } }));
+        },
     };
 }
 // Read each template's HTML bundle (from `htmlPath` or inline `html`), hash the
@@ -238,6 +243,8 @@ function agentBody(i) {
         instructions: i.instructions ?? null,
         model: i.model ?? null,
         enabled_hosted_tools: i.enabledHostedTools ?? [],
+        mcp_servers: i.mcpServers ?? null,
+        vector_store_ids: i.vectorStoreIds ?? [],
         auto_memory: i.autoMemory ?? null,
         memory_consolidation: i.memoryConsolidation ?? null,
         variables: i.variables ?? [],
@@ -276,6 +283,14 @@ function agentContentSig(s) {
     const ui = uiResourcesSig(s.ui_resources);
     if (ui.length)
         base.ui_resources = ui;
+    // Same discipline for mcp_servers: unset (= all) stays out of the signature.
+    if (s.mcp_servers != null)
+        base.mcp_servers = [...s.mcp_servers].sort();
+    // And for vector stores: omit when empty so agents without any keep a
+    // byte-identical signature to pre-vectorStoreIds releases.
+    const vs = [...(s.vector_store_ids ?? [])].sort();
+    if (vs.length)
+        base.vector_store_ids = vs;
     return JSON.stringify(base);
 }
 // Map the camelCase resource inputs onto the canonical snapshot shape.
@@ -284,6 +299,8 @@ function inputsToSnapshot(i) {
         instructions: i.instructions,
         model: i.model,
         enabled_hosted_tools: i.enabledHostedTools,
+        mcp_servers: i.mcpServers,
+        vector_store_ids: i.vectorStoreIds,
         auto_memory: i.autoMemory,
         memory_consolidation: i.memoryConsolidation,
         variables: i.variables,
@@ -299,7 +316,7 @@ function inputsToSnapshot(i) {
     };
 }
 async function findAgentBySlug(baseUrl, token, slug) {
-    const res = await icRequest(baseUrl, token, "GET", "/v1/agents");
+    const res = await icRequest(baseUrl, token, "GET", "/v1/agents?limit=200");
     return (res.data ?? []).find((b) => b.slug === slug) ?? null;
 }
 // Signature of the snapshot currently published as the active version, or null
@@ -307,7 +324,7 @@ async function findAgentBySlug(baseUrl, token, slug) {
 async function activeSnapshotSig(baseUrl, token, id, activeVersion) {
     if (!activeVersion)
         return null;
-    const res = await icRequest(baseUrl, token, "GET", `/v1/agents/${id}/versions`);
+    const res = await icRequest(baseUrl, token, "GET", `/v1/agents/${id}/versions?limit=200`);
     const v = (res.data ?? []).find((x) => x.version === activeVersion);
     if (!v)
         return null;
@@ -430,6 +447,7 @@ const agentProvider = {
                     instructions: d.instructions ?? undefined,
                     model: d.model ?? undefined,
                     enabledHostedTools: d.enabled_hosted_tools ?? [],
+                    vectorStoreIds: d.vector_store_ids ?? [],
                     autoMemory: d.auto_memory ?? undefined,
                     memoryConsolidation: d.memory_consolidation ?? undefined,
                     variables: d.variables ?? [],
@@ -444,6 +462,8 @@ class IcAgent extends pulumi.dynamic.Resource {
             instructions: undefined,
             model: undefined,
             enabledHostedTools: undefined,
+            mcpServers: undefined,
+            vectorStoreIds: undefined,
             autoMemory: undefined,
             memoryConsolidation: undefined,
             variables: undefined,
@@ -461,6 +481,181 @@ class IcAgent extends pulumi.dynamic.Resource {
     }
 }
 exports.IcAgent = IcAgent;
+// Read each declared file's bytes and hash them (same sha256-hex the API keys
+// files by) so an edit shows up in the file signature. Module-scope + node
+// built-ins required inside for Pulumi's closure serialization.
+function resolveVsFiles(files) {
+    if (!files?.length)
+        return [];
+    const { createHash } = require("node:crypto");
+    return files.map((f) => {
+        if (!f.path)
+            throw new Error("vectorStore file: `path` is required");
+        const bytes = require("node:fs").readFileSync(f.path);
+        return {
+            path: f.path,
+            bytes,
+            contentHash: createHash("sha256").update(bytes).digest("hex"),
+            chunkingStrategy: f.chunkingStrategy,
+        };
+    });
+}
+// Multipart upload of one file to POST /v1/files (purpose `assistants`, the
+// vector-store source purpose) → the new `file_…` id. Not `icRequest` (that
+// JSON-encodes the body); uses global FormData/File (Node ≥18).
+async function uploadFile(baseUrl, token, bytes, filename) {
+    const form = new FormData();
+    form.set("file", new File([new Uint8Array(bytes)], filename, {
+        type: "application/octet-stream",
+    }));
+    form.set("purpose", "assistants");
+    const res = await fetch(`${baseUrl}/v1/files`, {
+        method: "POST",
+        headers: { Authorization: `Bearer ${token}`, "IC-Api-Version": exports.IC_API_VERSION },
+        body: form,
+    });
+    if (!res.ok) {
+        const err = new Error(`IC POST /v1/files → ${res.status}: ${(await res.text()).slice(0, 400)}`);
+        err.status = res.status;
+        throw err;
+    }
+    return (await res.json()).id;
+}
+const vsBasename = (p) => p.split(/[\\/]/).pop() || p;
+// The store's mutable fields (POST /v1/vector_stores on create, POST
+// /v1/vector_stores/{id} to modify). Only send keys the caller set.
+function vsBody(i) {
+    const body = {};
+    if (i.name !== undefined)
+        body.name = i.name;
+    if (i.description !== undefined)
+        body.description = i.description;
+    if (i.metadata !== undefined)
+        body.metadata = i.metadata;
+    return body;
+}
+// Upload one file's bytes and attach the resulting id to the store.
+async function attachVsFile(i, id, f) {
+    const fileId = await uploadFile(i.baseUrl, i.token, f.bytes, vsBasename(f.path));
+    await icRequest(i.baseUrl, i.token, "POST", `/v1/vector_stores/${id}/files`, {
+        file_id: fileId,
+        ...(f.chunkingStrategy ? { chunking_strategy: f.chunkingStrategy } : {}),
+    });
+    return { path: f.path, contentHash: f.contentHash, fileId };
+}
+// Reconcile attachments against the declared set: (re)upload+attach any new-or-
+// changed file, detach any whose path was dropped or whose bytes changed. Returns
+// the new file-state list to store as an output. The store-file id IS the
+// `file_…` id, so detach targets `/files/{fileId}`.
+async function syncVsFiles(i, id, prior) {
+    const desired = resolveVsFiles(i.files);
+    const byPath = new Map(prior.map((p) => [p.path, p]));
+    const next = [];
+    for (const f of desired) {
+        const cur = byPath.get(f.path);
+        if (cur && cur.contentHash === f.contentHash) {
+            next.push(cur); // unchanged bytes — keep the existing attachment
+            continue;
+        }
+        if (cur)
+            // bytes changed → detach the stale file before re-uploading
+            await icRequest(i.baseUrl, i.token, "DELETE", `/v1/vector_stores/${id}/files/${cur.fileId}`);
+        next.push(await attachVsFile(i, id, f));
+    }
+    const keep = new Set(desired.map((f) => f.path));
+    for (const p of prior)
+        if (!keep.has(p.path))
+            await icRequest(i.baseUrl, i.token, "DELETE", `/v1/vector_stores/${id}/files/${p.fileId}`);
+    return next;
+}
+// Canonical, path-sorted signature of the declared files (path + content hash +
+// chunking), so a file edit/add/remove is exactly one diff. Empty ⇒ "[]".
+function vsFilesSig(files) {
+    return JSON.stringify(resolveVsFiles(files)
+        .map((f) => ({
+        path: f.path,
+        content_hash: f.contentHash,
+        chunking: f.chunkingStrategy ?? null,
+    }))
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)));
+}
+const vectorStoreProvider = {
+    async create(i) {
+        const res = await icRequest(i.baseUrl, i.token, "POST", "/v1/vector_stores", vsBody(i));
+        const fileState = await syncVsFiles(i, res.id, []);
+        return {
+            id: res.id,
+            outs: {
+                ...i,
+                vectorStoreId: res.id,
+                fileState,
+                filesSig: vsFilesSig(i.files),
+            },
+        };
+    },
+    async update(id, olds, news) {
+        const body = vsBody(news);
+        if (Object.keys(body).length)
+            await icRequest(news.baseUrl, news.token, "POST", `/v1/vector_stores/${id}`, body);
+        const fileState = await syncVsFiles(news, id, olds.fileState ?? []);
+        return {
+            outs: {
+                ...news,
+                vectorStoreId: id,
+                fileState,
+                filesSig: vsFilesSig(news.files),
+            },
+        };
+    },
+    async delete(id, props) {
+        await icRequest(props.baseUrl, props.token, "DELETE", `/v1/vector_stores/${id}`);
+    },
+    async diff(_id, olds, news) {
+        const scalarChanged = (olds.name ?? undefined) !== (news.name ?? undefined) ||
+            (olds.description ?? undefined) !== (news.description ?? undefined);
+        const metaChanged = JSON.stringify(olds.metadata ?? null) !==
+            JSON.stringify(news.metadata ?? null);
+        // Compare against the sig STORED at the last apply (not a re-resolve of olds):
+        // a file-backed path edits the same bytes, so re-reading olds would hash the
+        // new bytes and hide the change (same reasoning as the agent diff).
+        const oldSig = olds.filesSig ?? vsFilesSig(olds.files);
+        const filesChanged = oldSig !== vsFilesSig(news.files);
+        return { changes: scalarChanged || metaChanged || filesChanged };
+    },
+    // Adopt a store a script already created (`pulumi import <id>`). Local file
+    // attachments can't be reconstructed from the server (no local paths), so this
+    // recovers only the store's own fields; declare `files` to (re)assert them.
+    async read(id, props) {
+        return read404(() => icRequest(props.baseUrl, props.token, "GET", `/v1/vector_stores/${id}`), (vs) => {
+            if (!vs || !vs.id)
+                return { id: "" };
+            return {
+                id,
+                props: {
+                    ...props,
+                    name: vs.name ?? undefined,
+                    description: vs.description ?? undefined,
+                    metadata: vs.metadata ?? undefined,
+                },
+            };
+        });
+    },
+};
+class IcVectorStore extends pulumi.dynamic.Resource {
+    constructor(name, args, opts) {
+        super(vectorStoreProvider, name, {
+            name: undefined,
+            description: undefined,
+            metadata: undefined,
+            files: undefined,
+            vectorStoreId: undefined,
+            fileState: undefined,
+            filesSig: undefined,
+            ...args,
+        }, { ...opts, additionalSecretOutputs: ["token"] });
+    }
+}
+exports.IcVectorStore = IcVectorStore;
 function mcpBody(i) {
     const auth = { kind: i.authKind };
     if (i.authProvider)
@@ -488,6 +683,19 @@ const mcpProvider = makePutResource({
         toolsDiscovered: res.tools_discovered ?? 0,
         discoveryError: res.discovery_error ?? null,
     }),
+    // `pulumi refresh` round-trips the security-relevant fields, so a live auth
+    // downgrade (e.g. oauth silently reverting to none) shows up as a diff and the
+    // next `up` re-pushes the declared config. Catalog presets supply url/auth
+    // server-side — omitted inputs are correct there, so nothing is overlaid.
+    readProps: (i, res) => {
+        if (i.catalog)
+            return {};
+        return {
+            url: res.url ?? i.url,
+            authKind: res.auth?.kind ?? i.authKind,
+            authProvider: res.auth?.provider ?? undefined,
+        };
+    },
     diff: {
         replaceKeys: ["serverName"],
         scalarKeys: [
@@ -508,7 +716,7 @@ const mcpProvider = makePutResource({
 class IcMcpServer extends pulumi.dynamic.Resource {
     constructor(name, args, opts) {
         super(mcpProvider, name, {
-            authKind: args.catalog ? undefined : "static",
+            authKind: args.catalog ? undefined : "bearer",
             url: undefined,
             catalog: undefined,
             authProvider: undefined,
@@ -696,7 +904,7 @@ const webhookProvider = {
     // Enables `pulumi import` of a webhook a script already created (id is the
     // import id). The signing secret is intentionally not recoverable.
     async read(id, props) {
-        const list = await icRequest(props.baseUrl, props.token, "GET", "/v1/tenant/webhooks");
+        const list = await icRequest(props.baseUrl, props.token, "GET", "/v1/tenant/webhooks?limit=200");
         const hit = (list.data ?? []).find((w) => w.id === id);
         // Absent from the list → gone server-side; empty id lets refresh prune it.
         if (!hit)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@ingram-cloud/pulumi",
-	"version": "1.3.0",
+	"version": "2.0.0",
 	"description": "Pulumi dynamic resources for the Ingram Cloud /v1 API — projects, project tokens, agents, MCP servers, channels, webhooks, model keys.",
 	"license": "MIT",
 	"homepage": "https://cloud.ingram.tech",
@@ -29,10 +29,10 @@
 	},
 	"devDependencies": {
 		"@ingram-tech/oxlint-config": "^0.2.2",
-		"@pulumi/pulumi": "^3.251.0",
+		"@pulumi/pulumi": "^3.253.0",
 		"@types/node": "^26.1.1",
-		"oxfmt": "^0.58.0",
-		"oxlint": "^1.73.0",
+		"oxfmt": "^0.59.0",
+		"oxlint": "^1.74.0",
 		"typescript": "^7.0.2"
 	}
 }