## Vercel Schema

```mermaid
graph LR
T(Team) -- RESOURCE --> P(Project)
T -- RESOURCE --> D(Domain)
T -- RESOURCE --> SEV(SharedEnvironmentVariable)
T -- RESOURCE --> I(Integration)
T -- RESOURCE --> AG(AccessGroup)
T -- RESOURCE --> W(Webhook)
T -- RESOURCE --> LD(LogDrain)
T -- RESOURCE --> N(SecureComputeNetwork)
T -- RESOURCE --> AL(Alias)
T -- RESOURCE --> EC(EdgeConfig)
T -- RESOURCE --> DR(DNSRecord)
T -- RESOURCE --> ECT(EdgeConfigToken)
T -- RESOURCE --> U(User)
P -- RESOURCE --> DP(Deployment)
P -- RESOURCE --> EV(EnvironmentVariable)
P -- HAS_DOMAIN --> D
P -- RESOURCE --> FC(FirewallConfig)
P -- RESOURCE --> FBR(FirewallBypassRule)
D -- HAS_DNS_RECORD --> DR
EC -- HAS_TOKEN --> ECT
U -- MEMBER_OF --> T
DP -- CREATED_BY --> U
FBR -- CREATED_BY --> U
EV -- REFERENCES --> EC
I -- CONFIGURED_FOR --> P
AG -- HAS_MEMBER --> U
AG -- HAS_ACCESS_TO --> P
W -- WATCHES --> P
LD -- MONITORS --> P
N -- CONNECTS --> P
AL -- DEPLOYED_TO --> DP
AL -- BELONGS_TO_PROJECT --> P
```

### VercelTeam

Represents a Vercel team (organization).

> **Ontology Mapping**: This node has the extra label `Tenant` to enable cross-platform queries for organizational tenants across different systems (e.g., OktaOrganization, AzureTenant, GCPOrganization).

| Field | Description |
|-------|-------------|
| **id** | Team ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Team display name. |
| slug | URL slug of the team. |
| created_at | Team creation timestamp (ms). |
| avatar | URL of the team avatar. |

#### Relationships
- Team members belong to the team. Each user also carries a `MEMBER_OF` relationship with membership properties (`role`, `confirmed`, `joined_from`).
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelUser)
    (:VercelUser)-[:MEMBER_OF]->(:VercelTeam)
    ```
- All Vercel resources belong to the team.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelProject | :VercelDomain | :VercelDNSRecord | :VercelSharedEnvironmentVariable | :VercelIntegration | :VercelAccessGroup | :VercelWebhook | :VercelLogDrain | :VercelSecureComputeNetwork | :VercelAlias | :VercelEdgeConfig | :VercelEdgeConfigToken)
    ```

### VercelUser

Represents a Vercel team member.

> **Ontology Mapping**: This node has the extra label `UserAccount` to enable cross-platform queries for user accounts across different systems (e.g., OktaUser, EntraUser, GSuiteUser).

| Field | Description |
|-------|-------------|
| **id** | User UID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| email | User email. |
| username | Vercel username. |
| name | Display name. |
| role | Team role (owner, member, developer, viewer, billing). |
| created_at | Account creation timestamp (ms). |
| joined_from | How the user joined the team. |
| confirmed | Whether the membership is confirmed. |

#### Relationships
- A user is both owned by the team (`RESOURCE`) and linked to it via `MEMBER_OF`. The `MEMBER_OF` relationship carries membership properties (`role`, `confirmed`, `joined_from`) that describe the user's role within that specific team.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelUser)
    (:VercelUser)-[:MEMBER_OF]->(:VercelTeam)
    ```

### VercelProject

Represents a Vercel project.

| Field | Description |
|-------|-------------|
| **id** | Project ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Project name. |
| framework | Framework preset (nextjs, gatsby, etc.). |
| node_version | Node.js version. |
| build_command | Build command override. |
| dev_command | Dev command override. |
| install_command | Install command override. |
| output_directory | Build output directory. |
| public_source | Whether the source code is publicly viewable. |
| serverless_function_region | Region where serverless functions are deployed. |
| created_at | Creation timestamp (ms). |
| updated_at | Last update timestamp (ms). |
| auto_expose_system_envs | Whether system env vars are auto-exposed. |
| root_directory | Root directory for the project. |
| git_fork_protection | Whether fork PRs can trigger deployments. |
| skew_protection_max_age | Max age of deployments kept for skew protection. |

#### Relationships
- A project belongs to a team.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelProject)
    ```
- Projects own deployments, env vars, project domains, firewall config, and firewall bypass rules.
    ```
    (:VercelProject)-[:RESOURCE]->(:VercelDeployment | :VercelEnvironmentVariable | :VercelFirewallConfig | :VercelFirewallBypassRule)
    ```

### VercelDeployment

Represents an individual deployment.

| Field | Description |
|-------|-------------|
| **id** | Deployment UID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Deployment name. |
| url | Public deployment URL. |
| created_at | Creation timestamp (ms). |
| ready_at | Ready timestamp (ms). |
| state | State (READY, BUILDING, ERROR, CANCELED, QUEUED). |
| target | Target environment (production, preview). |
| source | Source (git, cli, api). |
| creator_uid | UID of the user who created the deployment. |
| meta_git_commit_sha | Commit SHA of the deployment source. |
| meta_git_branch | Branch alias of the deployment source. |

#### Relationships
- A deployment belongs to a project.
    ```
    (:VercelProject)-[:RESOURCE]->(:VercelDeployment)
    ```
- A deployment was created by a user.
    ```
    (:VercelDeployment)-[:CREATED_BY]->(:VercelUser)
    ```

### VercelDomain

Represents a domain owned by the team.

| Field | Description |
|-------|-------------|
| **id** | Domain name (used as ID). |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Domain name. |
| service_type | `external` or `zeit.world`. |
| verified | Whether the domain is verified. |
| created_at | Creation timestamp (ms). |
| expires_at | Registration expiration timestamp (ms). |
| cdn_enabled | Whether the CDN is enabled. |
| bought_at | Timestamp the domain was purchased (ms). |

#### Relationships
- A domain belongs to a team.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelDomain)
    ```
- A domain contains DNS records via `HAS_DNS_RECORD`.
    ```
    (:VercelDomain)-[:HAS_DNS_RECORD]->(:VercelDNSRecord)
    ```
- Projects attach to domains via `HAS_DOMAIN`, which carries per-project configuration (`redirect`, `redirect_status_code`, `git_branch`, `verified`, `created_at`, `updated_at`, `project_domain_id`). Auto-generated `*.vercel.app` and external CNAMEd domains are also upserted as `VercelDomain` nodes via this relationship, without clobbering team-level domain fields.
    ```
    (:VercelProject)-[:HAS_DOMAIN]->(:VercelDomain)
    ```

### VercelDNSRecord

Represents a DNS record on a Vercel-managed domain.

> **Ontology Mapping**: This node has the extra label `DNSRecord` to enable cross-platform queries for DNS records across different systems.

| Field | Description |
|-------|-------------|
| **id** | Record ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Record name. |
| type | Record type (A, AAAA, CNAME, MX, TXT, etc.). |
| value | Record value. |
| ttl | Record TTL. |
| priority | MX priority (when applicable). |
| created_at | Creation timestamp (ms). |

#### Relationships
- A DNS record belongs to the team and is contained in a domain via `HAS_DNS_RECORD`.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelDNSRecord)
    (:VercelDomain)-[:HAS_DNS_RECORD]->(:VercelDNSRecord)
    ```

### VercelEnvironmentVariable

Represents a per-project environment variable. The value is intentionally not stored.

| Field | Description |
|-------|-------------|
| **id** | Env var ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| key | Variable name. |
| type | Variable type (encrypted, plain, sensitive, secret). |
| target | List of target environments (production, preview, development). |
| git_branch | Git branch scope. |
| created_at | Creation timestamp (ms). |
| updated_at | Last update timestamp (ms). |
| edge_config_id | Linked Edge Config ID, if any. |
| comment | Optional description. |

#### Relationships
- A project contains env vars.
    ```
    (:VercelProject)-[:RESOURCE]->(:VercelEnvironmentVariable)
    ```
- An env var can reference an edge config.
    ```
    (:VercelEnvironmentVariable)-[:REFERENCES]->(:VercelEdgeConfig)
    ```

### VercelSharedEnvironmentVariable

Represents a team-level shared env var. The value is intentionally not stored.

| Field | Description |
|-------|-------------|
| **id** | Env var ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| key | Variable name. |
| type | Variable type. |
| target | List of target environments. |
| created_at | Creation timestamp (ms). |
| updated_at | Last update timestamp (ms). |

#### Relationships
- Shared env vars belong to a team.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelSharedEnvironmentVariable)
    ```

### VercelFirewallConfig

Represents the WAF / firewall configuration for a project.

| Field | Description |
|-------|-------------|
| **id** | Synthesized ID (`{project_id}_firewall`). |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| enabled | Whether the firewall is enabled. |
| updated_at | Last update timestamp (ms). |

#### Relationships
- A firewall config belongs to a project.
    ```
    (:VercelProject)-[:RESOURCE]->(:VercelFirewallConfig)
    ```

### VercelFirewallBypassRule

Represents a firewall bypass rule that weakens WAF protections.

| Field | Description |
|-------|-------------|
| **id** | Rule ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| domain | Domain the rule applies to. |
| ip | IP address allowlisted. |
| note | Operator-provided note. |
| created_at | Creation timestamp (ms). |
| actor_id | UID of the user who created the bypass. |

#### Relationships
- A bypass rule belongs to a project and was created by a user.
    ```
    (:VercelProject)-[:RESOURCE]->(:VercelFirewallBypassRule)-[:CREATED_BY]->(:VercelUser)
    ```

### VercelIntegration

Represents a third-party integration installed on the team.

| Field | Description |
|-------|-------------|
| **id** | Integration ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| slug | Integration slug. |
| integration_id | Integration marketplace ID. |
| status | Status (installed, removed). |
| scopes | Granted scopes. |
| project_selection | `all` or `selected`. |
| project_ids | List of selected project IDs. |
| source | How the integration was installed. |
| created_at | Creation timestamp (ms). |
| updated_at | Last update timestamp (ms). |

#### Relationships
- An integration belongs to a team and is configured for specific projects.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelIntegration)-[:CONFIGURED_FOR]->(:VercelProject)
    ```

### VercelAccessGroup

Represents a team access group used for RBAC.

> **Ontology Mapping**: This node has the extra label `Group` to enable cross-platform queries for user groups across different systems (e.g., OktaGroup, GoogleWorkspaceGroup, AWSGroup).

| Field | Description |
|-------|-------------|
| **id** | Access group ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Access group name. |
| created_at | Creation timestamp (ms). |
| updated_at | Last update timestamp (ms). |
| members_count | Number of members. |
| projects_count | Number of projects. |
| is_dsync_managed | Whether the group is managed via directory sync. |
| member_ids | List of user IDs. |

#### Relationships
- An access group groups users.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelAccessGroup)-[:HAS_MEMBER]->(:VercelUser)
    ```
- An access group grants access to projects. The `HAS_ACCESS_TO` relationship carries a `role` property (`ADMIN`, `PROJECT_DEVELOPER`, `PROJECT_VIEWER`, or `PROJECT_GUEST`) describing the per-project privilege level.
    ```
    (:VercelAccessGroup)-[:HAS_ACCESS_TO]->(:VercelProject)
    ```

### VercelWebhook

Represents a team webhook endpoint.

| Field | Description |
|-------|-------------|
| **id** | Webhook ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| url | Destination URL. |
| events | List of subscribed event types. |
| project_ids | List of project IDs this webhook watches. |
| created_at | Creation timestamp (ms). |
| updated_at | Last update timestamp (ms). |

#### Relationships
- Webhooks belong to a team and watch specific projects.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelWebhook)-[:WATCHES]->(:VercelProject)
    ```

### VercelLogDrain

Represents a log delivery drain.

| Field | Description |
|-------|-------------|
| **id** | Drain ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Drain name. |
| url | Destination URL. |
| delivery_format | Format (json, ndjson, syslog). |
| status | Drain status (enabled, disabled, errored). |
| sources | List of log sources. |
| environments | List of environments monitored. |
| project_ids | List of monitored project IDs. |
| created_at | Creation timestamp (ms). |

#### Relationships
- Log drains belong to a team and monitor specific projects.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelLogDrain)-[:MONITORS]->(:VercelProject)
    ```

### VercelSecureComputeNetwork

Represents a Vercel Connect private network.

| Field | Description |
|-------|-------------|
| **id** | Network ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| name | Network name. |
| region | AWS region. |
| status | Network status. |
| created_at | Creation timestamp (ms). |

#### Relationships
- Networks belong to a team.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelSecureComputeNetwork)
    ```
- Networks attach to projects per environment. The `CONNECTS` relationship carries an `environments` list (e.g. `["production", "preview"]`) and a `passive_environments` list with the subset of those environments where the network is configured as a passive (failover) attachment.
    ```
    (:VercelSecureComputeNetwork)-[:CONNECTS]->(:VercelProject)
    ```

### VercelAlias

Represents a URL alias pointing at a deployment.

| Field | Description |
|-------|-------------|
| **id** | Alias UID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| alias | Alias hostname. |
| deployment_id | Deployment UID this alias points to. |
| project_id | Project ID this alias belongs to. |
| created_at | Creation timestamp (ms). |

#### Relationships
- An alias belongs to a team, points to a deployment, and belongs to a project.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelAlias)-[:DEPLOYED_TO]->(:VercelDeployment)
    (:VercelAlias)-[:BELONGS_TO_PROJECT]->(:VercelProject)
    ```

### VercelEdgeConfig

Represents an edge configuration used to serve runtime data from the edge.

| Field | Description |
|-------|-------------|
| **id** | Edge config ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| slug | Edge config slug. |
| created_at | Creation timestamp (ms). |
| updated_at | Last update timestamp (ms). |
| item_count | Number of items. |
| size_in_bytes | Size in bytes. |
| digest | Content digest. |

#### Relationships
- Edge configs belong to a team and expose access tokens via `HAS_TOKEN`.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelEdgeConfig)
    (:VercelEdgeConfig)-[:HAS_TOKEN]->(:VercelEdgeConfigToken)
    ```

### VercelEdgeConfigToken

Represents a read token granting access to an edge config. The token value is intentionally not stored.

| Field | Description |
|-------|-------------|
| **id** | Token ID. |
| firstseen | Timestamp of when a sync job first created this node. |
| lastupdated | Timestamp of the last time the node was updated. |
| label | Token label. |
| created_at | Creation timestamp (ms). |

#### Relationships
- Tokens belong to the team and are exposed by an edge config via `HAS_TOKEN`.
    ```
    (:VercelTeam)-[:RESOURCE]->(:VercelEdgeConfigToken)
    (:VercelEdgeConfig)-[:HAS_TOKEN]->(:VercelEdgeConfigToken)
    ```