What the screen can claim

The preview on a Vercel connection reports one state per key. What it may say depends entirely on how the value is stored, and that is the whole structure of this connector rather than an implementation detail.

For a secret, there is no “matches” and no “differs”

A secret is written as sensitive, and Vercel never returns a sensitive value — not to the dashboard, not to the API, not to kyvlt.sh. That is the property you want, and it means the comparison you would like to make cannot be made by anybody.

What Vercel does return is a timestamp. So the honest statements are:

| State | What it means | | --- | --- | | Missing | kyvlt.sh has it and Vercel does not. The next push writes it. | | Pushed | Vercel has it, and has not recorded a change since kyvlt.sh wrote. | | Changed in Vercel | Vercel recorded a change after kyvlt.sh last wrote. | | Unmanaged | Vercel has it in this target and this connection does not carry it. | | Wrong type | It is there, stored as a type kyvlt.sh would not have chosen. |

“Changed in Vercel” is not “the values differ.” It means somebody wrote that variable there after we did. They may have typed exactly the same thing. It is still worth saying, because the next push silently replaces whatever they put.

For a variable, there is

A key you have designated a variable is written as plain, and Vercel returns a plain value. So matches and differs are observations rather than guesses, and they apply to variables only.

The preview on the connection page is the exception: it deliberately does not read your values — reading an environment to draw a screen would be an audited bulk reveal performed because somebody opened a page — so there it dates a variable like a secret rather than comparing it against nothing.

“Wrong type”, and the one thing this connector deletes

Vercel fixes a variable’s type when it is created. A plain variable cannot be updated into a sensitive one.

So a key that was a variable and is now a secret has to be removed and written again, and kyvlt.sh does exactly that — for a key this connection carries, that kyvlt.sh itself wrote. Without it, re-designating a key as a secret would quietly never take effect, and the value would stay readable in Vercel for ever.

That is the only deletion this connector performs. A variable kyvlt.sh did not write is never touched.