@psg2/env-sync 1.0.2 → 1.1.0

package/README.md

@@ -78,10 +78,12 @@ targets:
 
 #### Vercel
 
-Pushes vars to Vercel environment(s) via the Vercel REST API. Backs up current env vars before overwriting.
+Pushes vars to Vercel environment(s) via the Vercel REST API. Before overwriting, the current variables of each environment are backed up to `.env-sync-backups/vercel-<env>.<timestamp>.env`, in `KEY="value"` format. Sensitive variables can't be read back through the API (nor by `vercel env pull`), so the backup records only their key and type as a comment.
 
 Values resolved from `op://` references are stored as **Sensitive** variables (write-only on Vercel; the value can never be read back). Literal values stay as regular readable variables. Re-running the sync converts existing variables to the right type.
 
+With `redeploy: true`, the latest READY deployment of the environment is redeployed through the API — the same effect as `vercel redeploy`. Skipped for `development`, which has no deployments.
+
 ```yaml
 targets:
   vercel-prod:
@@ -92,6 +94,8 @@ targets:
     redeploy: true                      # Optional (default: false)
 ```
 
+**Authentication:** the token is read from `VERCEL_TOKEN` first, then from the Vercel CLI auth store written by `vercel login` (e.g. `~/Library/Application Support/com.vercel.cli/auth.json` on macOS, `~/.local/share/com.vercel.cli/auth.json` on Linux, `%APPDATA%/com.vercel.cli/auth.json` on Windows). The project and team ids come from `.vercel/project.json`, created by `vercel link` (or written by hand with `projectId` and `orgId`). The `vercel` CLI itself is optional at runtime — it's only needed once, to produce the token and the linked project file.
+
 #### GitHub
 
 Pushes vars as GitHub repository secrets via the GitHub CLI.
@@ -125,10 +129,10 @@ Options:
 | Feature | Requires |
 |---------|----------|
 | 1Password secrets | [`op` CLI](https://developer.1password.com/docs/cli) + `op signin` |
-| Vercel targets | [`vercel` CLI](https://vercel.com/docs/cli) |
+| Vercel targets | `VERCEL_TOKEN` env var, or `vercel login` (CLI optional) |
 | GitHub targets | [`gh` CLI](https://cli.github.com) |
 
-The CLI checks for required tools before syncing and gives clear error messages.
+The CLI checks for `op` and `gh` before syncing and gives clear error messages; Vercel credentials are validated when the target runs.
 
 ## Examples
 

package/dist/cli.js

@@ -7284,9 +7284,13 @@ import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as rea
 import { homedir } from "os";
 import { resolve as resolve3 } from "path";
 function getVercelAuthToken() {
+  const fromEnv = process.env.VERCEL_TOKEN;
+  if (fromEnv)
+    return fromEnv;
+  const home = process.env.HOME || homedir();
   const candidates = [
-    `${homedir()}/Library/Application Support/com.vercel.cli/auth.json`,
-    `${homedir()}/.local/share/com.vercel.cli/auth.json`,
+    `${home}/Library/Application Support/com.vercel.cli/auth.json`,
+    `${home}/.local/share/com.vercel.cli/auth.json`,
     process.env.XDG_CONFIG_HOME ? `${process.env.XDG_CONFIG_HOME}/com.vercel.cli/auth.json` : undefined,
     process.env.APPDATA ? `${process.env.APPDATA}/com.vercel.cli/auth.json` : undefined
   ].filter(Boolean);
@@ -7299,7 +7303,7 @@ function getVercelAuthToken() {
         return raw.token;
     } catch {}
   }
-  throw new Error("Vercel auth token not found in any of the standard CLI store paths. Run `vercel login` first.");
+  throw new Error("Vercel token not found. Set VERCEL_TOKEN, or run `vercel login` so the token is available in the CLI auth store.");
 }
 function getProjectInfo(configDir, override) {
   const path = resolve3(configDir, ".vercel/project.json");
@@ -7312,10 +7316,10 @@ function getProjectInfo(configDir, override) {
   }
   return { projectId: data.projectId, teamId: data.orgId };
 }
-async function vercelApi(method, endpoint, teamId, token, body) {
-  const url = `https://api.vercel.com${endpoint}${endpoint.includes("?") ? "&" : "?"}teamId=${encodeURIComponent(teamId)}`;
+async function vercelApi(client, method, endpoint, body) {
+  const url = `https://api.vercel.com${endpoint}${endpoint.includes("?") ? "&" : "?"}teamId=${encodeURIComponent(client.teamId)}`;
   const headers = {
-    Authorization: `Bearer ${token}`
+    Authorization: `Bearer ${client.token}`
   };
   if (body !== undefined)
     headers["Content-Type"] = "application/json";
@@ -7333,16 +7337,16 @@ async function vercelApi(method, endpoint, teamId, token, body) {
   }
   return { ok: res.ok, status: res.status, body: parsed };
 }
-async function listExistingEnvVars(projectId, teamId, token) {
-  const res = await vercelApi("GET", `/v9/projects/${projectId}/env`, teamId, token);
+async function listExistingEnvVars(client) {
+  const res = await vercelApi(client, "GET", `/v9/projects/${client.projectId}/env?decrypt=true`);
   if (!res.ok) {
     throw new Error(`Failed to list env vars: ${res.status} ${JSON.stringify(res.body)}`);
   }
   const body = res.body;
   return body.envs ?? [];
 }
-async function deleteEnvVar(projectId, teamId, token, envId) {
-  const res = await vercelApi("DELETE", `/v9/projects/${projectId}/env/${envId}`, teamId, token);
+async function deleteEnvVar(client, envId) {
+  const res = await vercelApi(client, "DELETE", `/v9/projects/${client.projectId}/env/${envId}`);
   if (!res.ok) {
     throw new Error(`Delete env var ${envId} failed: ${res.status} ${JSON.stringify(res.body)}`);
   }
@@ -7350,8 +7354,8 @@ async function deleteEnvVar(projectId, teamId, token, envId) {
 function vercelEnvType(v) {
   return v.source.startsWith("op://") ? "sensitive" : "encrypted";
 }
-async function createEnvVar(projectId, teamId, token, payload) {
-  const res = await vercelApi("POST", `/v10/projects/${projectId}/env`, teamId, token, {
+async function createEnvVar(client, payload) {
+  const res = await vercelApi(client, "POST", `/v10/projects/${client.projectId}/env`, {
     key: payload.key,
     value: payload.value,
     target: payload.target,
@@ -7360,6 +7364,11 @@ async function createEnvVar(projectId, teamId, token, payload) {
   if (!res.ok) {
     throw new Error(`Create env var ${payload.key} failed: ${res.status} ${JSON.stringify(res.body)}`);
   }
+  const { failed } = res.body;
+  if (failed && failed.length > 0) {
+    const reason = failed[0].error.message ?? failed[0].error.code ?? JSON.stringify(failed[0]);
+    throw new Error(`Create env var ${payload.key} failed: ${reason}`);
+  }
 }
 async function syncVercel(name, target, vars, configDir, opts) {
   const errors = [];
@@ -7368,37 +7377,34 @@ async function syncVercel(name, target, vars, configDir, opts) {
     console.log(`  Would back up and push ${vars.length} vars to Vercel [${envLabel}]`);
     return { target: name, type: "vercel", vars: vars.length, errors };
   }
-  let token;
-  let projectId;
-  let teamId;
+  let client;
   try {
-    token = getVercelAuthToken();
+    const token = getVercelAuthToken();
     const info = getProjectInfo(configDir, target.project);
-    projectId = info.projectId;
-    teamId = info.teamId;
+    client = { token, projectId: info.projectId, teamId: info.teamId };
   } catch (err) {
     errors.push(`  \u2717 Vercel API setup: ${err instanceof Error ? err.message : err}`);
     return { target: name, type: "vercel", vars: vars.length, errors };
   }
-  for (const env of target.environments) {
-    await backupVercelEnv(env, target.project, configDir);
-  }
   let existing;
   try {
-    existing = await listExistingEnvVars(projectId, teamId, token);
+    existing = await listExistingEnvVars(client);
   } catch (err) {
     errors.push(`  \u2717 List env failed: ${err instanceof Error ? err.message : err}`);
     return { target: name, type: "vercel", vars: vars.length, errors };
   }
+  for (const env of target.environments) {
+    backupVercelEnv(env, existing, configDir);
+  }
   for (const v of vars) {
     for (const env of target.environments) {
       try {
         const conflict = existing.find((e) => e.key === v.key && e.target.includes(env) && !e.gitBranch);
         if (conflict) {
-          await deleteEnvVar(projectId, teamId, token, conflict.id);
+          await deleteEnvVar(client, conflict.id);
           existing = existing.filter((e) => e.id !== conflict.id);
         }
-        await createEnvVar(projectId, teamId, token, {
+        await createEnvVar(client, {
           key: v.key,
           value: v.value,
           target: [env],
@@ -7418,82 +7424,77 @@ async function syncVercel(name, target, vars, configDir, opts) {
   console.log(`  Done: ${succeeded}/${vars.length * target.environments.length} vars pushed to Vercel [${envLabel}]`);
   if (target.redeploy && errors.length === 0) {
     for (const env of target.environments) {
-      await redeployVercel(env, target.project, errors);
+      await redeployVercel(client, env, errors);
     }
   }
   return { target: name, type: "vercel", vars: vars.length, errors };
 }
-async function redeployVercel(env, project, errors) {
+async function redeployVercel(client, env, errors) {
+  if (env === "development") {
+    console.log("  Skipping redeploy [development]: environment has no deployments");
+    return;
+  }
   console.log(`  Triggering redeploy [${env}]...`);
-  const listArgs = ["list", "--environment", env, "--format", "json", "--yes"];
-  if (project)
-    listArgs.push("--project", project);
   try {
-    const listProc = Bun.spawn(["vercel", ...listArgs], {
-      stdout: "pipe",
-      stderr: "pipe"
+    const query = new URLSearchParams({
+      projectId: client.projectId,
+      target: env,
+      state: "READY",
+      limit: "1"
     });
-    const listStdout = await new Response(listProc.stdout).text();
-    const listExit = await listProc.exited;
-    if (listExit !== 0) {
-      const stderr = await new Response(listProc.stderr).text();
-      errors.push(`  \u2717 Could not list deployments [${env}]: ${stderr.trim()}`);
+    const listRes = await vercelApi(client, "GET", `/v6/deployments?${query}`);
+    if (!listRes.ok) {
+      errors.push(`  \u2717 Could not list deployments [${env}]: ${listRes.status} ${JSON.stringify(listRes.body)}`);
       return;
     }
-    const jsonStart = listStdout.indexOf("{");
-    if (jsonStart === -1) {
+    const { deployments } = listRes.body;
+    const latest = deployments?.[0];
+    if (!latest) {
       errors.push(`  \u2717 No deployments found for [${env}]`);
       return;
     }
-    const data = JSON.parse(listStdout.slice(jsonStart));
-    const deployments = data.deployments;
-    if (!deployments || deployments.length === 0) {
-      errors.push(`  \u2717 No deployments found for [${env}]`);
-      return;
-    }
-    const latestUrl = deployments[0].url;
-    const redeployArgs = ["redeploy", latestUrl, "--no-wait", "--yes"];
-    if (project)
-      redeployArgs.push("--project", project);
-    const redeployProc = Bun.spawn(["vercel", ...redeployArgs], {
-      stdout: "pipe",
-      stderr: "pipe"
+    const redeployRes = await vercelApi(client, "POST", "/v13/deployments?forceNew=1", {
+      deploymentId: latest.uid,
+      name: latest.name,
+      target: env === "production" ? "production" : undefined,
+      meta: { action: "redeploy" }
     });
-    const redeployStderr = await new Response(redeployProc.stderr).text();
-    const redeployExit = await redeployProc.exited;
-    if (redeployExit !== 0) {
-      errors.push(`  \u2717 Redeploy failed [${env}]: ${redeployStderr.trim()}`);
-    } else {
-      console.log(`  \u2713 Redeploy triggered [${env}]`);
+    if (!redeployRes.ok) {
+      errors.push(`  \u2717 Redeploy failed [${env}]: ${redeployRes.status} ${JSON.stringify(redeployRes.body)}`);
+      return;
     }
+    const created = redeployRes.body;
+    console.log(`  \u2713 Redeploy triggered [${env}]${created.url ? ` \u2192 https://${created.url}` : ""}`);
   } catch (err) {
-    errors.push(`  \u2717 Redeploy failed [${env}]: ${err}`);
+    errors.push(`  \u2717 Redeploy failed [${env}]: ${err instanceof Error ? err.message : err}`);
   }
 }
-async function backupVercelEnv(env, project, configDir) {
+function escapeEnvValue(value) {
+  return value.replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+}
+function backupVercelEnv(env, existing, configDir) {
   const backupDir = resolve3(configDir, ".env-sync-backups");
   if (!existsSync3(backupDir)) {
     mkdirSync2(backupDir, { recursive: true });
   }
   const timestamp = new Date().toISOString().replace(/[:.]/g, "").replace("T", "-").slice(0, 15);
   const backupFile = resolve3(backupDir, `vercel-${env}.${timestamp}.env`);
-  const args = ["env", "pull", backupFile, "--environment", env, "--yes"];
-  if (project)
-    args.push("--project", project);
-  try {
-    const proc = Bun.spawn(["vercel", ...args], {
-      stdout: "pipe",
-      stderr: "pipe"
-    });
-    const exitCode = await proc.exited;
-    if (exitCode === 0) {
-      console.log(`  Backed up Vercel [${env}] \u2192 .env-sync-backups/vercel-${env}.${timestamp}.env`);
+  const entries = existing.filter((e) => e.target.includes(env) && !e.gitBranch).sort((a, b) => a.key.localeCompare(b.key));
+  const lines = [`# Created by env-sync \u2014 Vercel [${env}] backup`];
+  for (const e of entries) {
+    if (e.value === undefined || e.type === "sensitive") {
+      lines.push(`# ${e.key} (${e.type ?? "unknown"}: value not readable via API)`);
     } else {
-      const stderr = await new Response(proc.stderr).text();
-      console.warn(`  \u26A0 Could not back up Vercel [${env}]: ${stderr.trim()}`);
+      lines.push(`${e.key}="${escapeEnvValue(e.value)}"`);
     }
-  } catch {
-    console.warn(`  \u26A0 Could not back up Vercel [${env}]`);
+  }
+  try {
+    writeFileSync2(backupFile, `${lines.join(`
+`)}
+`, { encoding: "utf-8", mode: 384 });
+    console.log(`  Backed up Vercel [${env}] \u2192 .env-sync-backups/vercel-${env}.${timestamp}.env`);
+  } catch (err) {
+    console.warn(`  \u26A0 Could not back up Vercel [${env}]: ${err instanceof Error ? err.message : err}`);
   }
 }
 
@@ -7692,12 +7693,9 @@ async function checkPrerequisites(config, targetFilter) {
     }
     return false;
   });
-  const needsVercel = targets.some((t) => t.type === "vercel");
   const needsGh = targets.some((t) => t.type === "github");
   if (needsOp)
     await assertCommand("op", "1Password CLI (https://developer.1password.com/docs/cli)");
-  if (needsVercel)
-    await assertCommand("vercel", "Vercel CLI (npm i -g vercel)");
   if (needsGh)
     await assertCommand("gh", "GitHub CLI (https://cli.github.com)");
   if (needsOp) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@psg2/env-sync",
-	"version": "1.0.2",
+	"version": "1.1.0",
 	"description": "Declarative env var management — 1Password → local files, Vercel, GitHub secrets",
 	"type": "module",
 	"bin": {
@@ -12,6 +12,8 @@
 		"lint": "bunx --bun biome check src/",
 		"lint:fix": "bunx --bun biome check --write src/",
 		"format": "bunx --bun biome format --write src/",
+		"format:check": "bunx --bun biome format src/",
+		"typecheck": "tsc --noEmit",
 		"test": "bun test",
 		"prepublishOnly": "bun run build"
 	},
@@ -47,6 +49,7 @@
 	},
 	"devDependencies": {
 		"@biomejs/biome": "^2.4.7",
-		"@types/bun": "^1.2.4"
+		"@types/bun": "^1.2.4",
+		"typescript": "^5"
 	}
 }