feat: reconcile resources across org pipelines

[dhruva-vapi]

Linear ticket

https://linear.app/vapi/issue/PRISM-978/gitops-support-cross-org-resource-migration-with-uuid-reference

Fixes PRISM-978

Value

Customers can now define ordered org pipelines and promote reviewed Git changes forward from dev to staging to production. The same command supports a read-only plan, a manual apply, and automatic reconciliation after changes land on main.

Promotion mirrors only the declared resource patterns, includes referenced dependencies, resolves each org's UUIDs independently, binds or omits org-local credentials and phone numbers, and carries reviewed deletions forward without touching unrelated destination resources.

Small edits since first push: scoped promotions now protect every selected file explicitly, deletion authorization carries across multi-org pipelines, and the README explains the complete customer setup and deletion lifecycle.

Evidence of value

• Focused coverage exercises creation, repeat updates, scoped and multi-hop deletion, UUID-suffixed destination mappings, dependencies, org-local bindings, empty-source protection, and the production dry-run entrypoint.
• A live disposable US → EU smoke created an assistant, tool, and structured output with distinct EU UUIDs; updated them in place without duplicates; then deleted all three and verified every EU API GET returned 404.
• Explicit file-scoped deletion cannot delete sibling state or dashboard resources outside the reviewed plan.
• The TypeScript build, workflow YAML validation, Biome checks, and focused regression suites pass.

API Changes (including webhooks + events)

• Is this changing the public API?

  • Yes
  • No

• If yes, is it backward‐compatible?

  • Yes
  • No

Non backward-compatible changes might break customers' agents. Please proceed with care and notify the team.

Testing plan

• Run npm run build.
• Run node --import tsx --test tests/promotion.test.ts tests/vapi-ignore-push.test.ts tests/apply-scoped-pull.test.ts.
• Run npm test; the current result is 277 passing with the same 20 known baseline failures.
• For a release smoke, use disposable orgs and verify creation mints destination UUIDs, modification preserves them, and deletion removes only patterned resources and state mappings.
• A regression is any mutation outside the configured patterns, any copied source UUID, any repeated create after a partial failure, or any selected file restored by the promotion safety pull.

[dhruva-vapi]

• feat: reconcile resources across org pipelines #47 👈 (View in Graphite)
• feat: sync org-local bindings for cross-org promotion #46
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[dhruva-vapi]

Merge activity

• Jul 22, 5:00 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Jul 22, 5:04 AM UTC: Graphite rebased this pull request as part of a merge.
• Jul 22, 5:04 AM UTC: @dhruva-vapi merged this pull request with Graphite.