@donotdev/cli 0.0.14 → 0.0.16

package/dist/bin/commands/deploy.js

@@ -16,6 +16,10 @@ var __esm = (fn, res) => function __init() {
 var __commonJS = (cb, mod) => function __require2() {
   return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
 };
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 var __copyProps = (to, from, except, desc) => {
   if (from && typeof from === "object" || typeof from === "function") {
     for (let key of __getOwnPropNames(from))
@@ -7687,11 +7691,39 @@ var init_PathResolver = __esm({
 });
 
 // packages/tooling/src/utils/errors.ts
-var DoNotDevError;
+var DO_NOT_DEV_ERROR_CODES, DoNotDevError;
 var init_errors = __esm({
   "packages/tooling/src/utils/errors.ts"() {
     "use strict";
     init_utils();
+    DO_NOT_DEV_ERROR_CODES = {
+      CONFIGURATION_ERROR: "configuration-error",
+      CONFIG_NOT_FOUND: "config-not-found",
+      CONFIG_INVALID: "config-invalid",
+      PATH_RESOLUTION_ERROR: "path-resolution-error",
+      FILE_OPERATION_ERROR: "file-operation-error",
+      FILE_NOT_FOUND: "file-not-found",
+      PERMISSION_DENIED: "permission-denied",
+      GENERATION_ERROR: "generation-error",
+      TEMPLATE_ERROR: "template-error",
+      TEMPLATE_NOT_FOUND: "template-not-found",
+      CLI_EXECUTION_ERROR: "cli-execution-error",
+      COMMAND_NOT_FOUND: "command-not-found",
+      COMMAND_FAILED: "command-failed",
+      VALIDATION_ERROR: "validation-error",
+      SCHEMA_ERROR: "schema-error",
+      DEPENDENCY_ERROR: "dependency-error",
+      DEPENDENCY_NOT_FOUND: "dependency-not-found",
+      DEPENDENCY_VERSION_ERROR: "dependency-version-error",
+      INVALID_ARGUMENT: "invalid-argument",
+      MISSING_ARGUMENT: "missing-argument",
+      MISSING_PROJECT_ID: "missing-project-id",
+      FIREBASE_CLI_ERROR: "firebase-cli-error",
+      DEPLOYMENT_FAILED: "deployment-failed",
+      OPERATION_CANCELLED: "operation-cancelled",
+      TIMEOUT_ERROR: "timeout-error",
+      UNKNOWN_ERROR: "unknown-error"
+    };
     DoNotDevError = class _DoNotDevError extends Error {
       /** The error code categorizing this error */
       code;
@@ -7711,7 +7743,7 @@ var init_errors = __esm({
        * @param {Record<string, any>} [options.context] - Additional context data
        * @param {boolean} [options.displayable=true] - Whether this error should be displayed to the user
        */
-      constructor(message, code = "unknown-error", options) {
+      constructor(message, code = DO_NOT_DEV_ERROR_CODES.UNKNOWN_ERROR, options) {
         super(message);
         this.name = "DoNotDevError";
         this.code = code;
@@ -7742,7 +7774,7 @@ var init_errors = __esm({
        * @param {boolean} [options.displayable=true] - Whether this error should be displayed to the user
        * @returns {DoNotDevError} New DoNotDev error wrapping the original
        */
-      static from(error2, context, code = "unknown-error", options) {
+      static from(error2, context, code = DO_NOT_DEV_ERROR_CODES.UNKNOWN_ERROR, options) {
         if (!(error2 instanceof Error)) {
           return new _DoNotDevError(
             `Unknown error: ${String(error2)}`,
@@ -7779,21 +7811,21 @@ var init_errors = __esm({
         }
         const message = error2.message.toLowerCase();
         if (error2.name === "ValidationError" || message.includes("validation")) {
-          return "validation-error";
+          return DO_NOT_DEV_ERROR_CODES.VALIDATION_ERROR;
         }
         if (message.includes("not found") || message.includes("no such file")) {
-          return "file-not-found";
+          return DO_NOT_DEV_ERROR_CODES.FILE_NOT_FOUND;
         }
         if (message.includes("permission") || message.includes("access denied")) {
-          return "permission-denied";
+          return DO_NOT_DEV_ERROR_CODES.PERMISSION_DENIED;
         }
         if (message.includes("timeout") || message.includes("timed out")) {
-          return "timeout-error";
+          return DO_NOT_DEV_ERROR_CODES.TIMEOUT_ERROR;
         }
         if (message.includes("dependency") || message.includes("module not found")) {
-          return "dependency-error";
+          return DO_NOT_DEV_ERROR_CODES.DEPENDENCY_ERROR;
         }
-        return "unknown-error";
+        return DO_NOT_DEV_ERROR_CODES.UNKNOWN_ERROR;
       }
     };
   }
@@ -7815,7 +7847,7 @@ import { fileURLToPath as fileURLToPath2 } from "node:url";
 function readdirSync2(dirPath, options) {
   return pathResolverInstance.readdirSync(dirPath, options);
 }
-var pathResolverInstance, resolvePackage, normalizePath, pathExists, readSync, writeSync, removeSync, statSync2, ensureDirSync, joinPath;
+var pathResolverInstance, resolvePackage, normalizePath, pathExists, readSync, write, writeSync, remove, removeSync, statSync2, ensureDir, ensureDirSync, getRelativePathBetween, getDirname, joinPath;
 var init_pathResolver = __esm({
   "packages/tooling/src/utils/pathResolver.ts"() {
     "use strict";
@@ -7828,16 +7860,111 @@ var init_pathResolver = __esm({
     };
     pathExists = (filePath, silent = false) => pathResolverInstance.pathExists(filePath, silent);
     readSync = (filePath, options) => pathResolverInstance.readSync(filePath, options);
+    write = async (filePath, content, options) => pathResolverInstance.write(filePath, content, options);
     writeSync = (filePath, content, options) => pathResolverInstance.writeSync(filePath, content, options);
+    remove = async (path) => pathResolverInstance.remove(path);
     removeSync = (path) => pathResolverInstance.removeSync(path);
     statSync2 = (filePath) => pathResolverInstance.statSync(filePath);
+    ensureDir = async (dirPath) => pathResolverInstance.ensureDir(dirPath);
     ensureDirSync = (dirPath) => pathResolverInstance.ensureDirSync(dirPath);
+    getRelativePathBetween = (from, to) => {
+      return normalizePath(relative2(from, to));
+    };
+    getDirname = (filePath) => {
+      return normalizePath(dirname2(filePath));
+    };
     joinPath = (...pathSegments) => {
       return normalizePath(...pathSegments);
     };
   }
 });
 
+// packages/tooling/src/utils/typed-file-operations.ts
+function readFirebaseJson(filePath) {
+  if (!pathExists(filePath)) {
+    throw new DoNotDevError(
+      `firebase.json not found: ${filePath}`,
+      DO_NOT_DEV_ERROR_CODES.FILE_NOT_FOUND,
+      { context: { filePath } }
+    );
+  }
+  const content = readSync(filePath, { format: "json" });
+  if (!content || typeof content !== "object") {
+    throw new DoNotDevError(
+      `Invalid firebase.json: ${filePath}`,
+      DO_NOT_DEV_ERROR_CODES.CONFIG_INVALID,
+      { context: { filePath } }
+    );
+  }
+  return content;
+}
+function readFirebaserc(filePath) {
+  if (!pathExists(filePath)) {
+    return { projects: {} };
+  }
+  const content = readSync(filePath, { format: "json" });
+  if (!content || typeof content !== "object") {
+    throw new DoNotDevError(
+      `Invalid .firebaserc: ${filePath}`,
+      DO_NOT_DEV_ERROR_CODES.CONFIG_INVALID,
+      { context: { filePath } }
+    );
+  }
+  return content;
+}
+function readPackageJson(filePath) {
+  if (!pathExists(filePath)) {
+    throw new DoNotDevError(
+      `package.json not found: ${filePath}`,
+      DO_NOT_DEV_ERROR_CODES.FILE_NOT_FOUND,
+      { context: { filePath } }
+    );
+  }
+  const content = readSync(filePath, { format: "json" });
+  if (!content || typeof content !== "object" || !("name" in content)) {
+    throw new DoNotDevError(
+      `Invalid package.json: ${filePath}`,
+      DO_NOT_DEV_ERROR_CODES.CONFIG_INVALID,
+      { context: { filePath } }
+    );
+  }
+  return content;
+}
+function readServiceAccountKey(filePath) {
+  if (!pathExists(filePath)) {
+    throw new DoNotDevError(
+      `Service account key not found: ${filePath}`,
+      DO_NOT_DEV_ERROR_CODES.FILE_NOT_FOUND,
+      { context: { filePath } }
+    );
+  }
+  const content = readSync(filePath, { format: "json" });
+  if (!content || typeof content !== "object") {
+    throw new DoNotDevError(
+      `Invalid service account key: ${filePath}`,
+      DO_NOT_DEV_ERROR_CODES.CONFIG_INVALID,
+      { context: { filePath } }
+    );
+  }
+  const key = content;
+  if (!key.project_id || !key.private_key || !key.client_email) {
+    throw new DoNotDevError(
+      `Invalid service account key: missing required fields`,
+      DO_NOT_DEV_ERROR_CODES.CONFIG_INVALID,
+      { context: { filePath, missingFields: ["project_id", "private_key", "client_email"].filter((f) => !key[f]) } }
+    );
+  }
+  return content;
+}
+var init_typed_file_operations = __esm({
+  "packages/tooling/src/utils/typed-file-operations.ts"() {
+    "use strict";
+    init_utils();
+    init_pathResolver();
+    init_errors();
+  }
+});
+
 // packages/tooling/src/bundler/utils.ts
 import { Buffer as Buffer2 } from "node:buffer";
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
@@ -7865,129 +7992,500 @@ var init_utils = __esm({
   }
 });
 
-// node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js
-var require_identity = __commonJS({
-  "node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js"(exports) {
+// packages/tooling/src/utils/cli-input.ts
+async function askForInput(message, defaultValue = "") {
+  const result = await he({
+    message,
+    placeholder: defaultValue || void 0,
+    defaultValue: defaultValue || void 0
+  });
+  if (pD(result)) {
+    xe("Operation cancelled.");
+    process.exit(0);
+  }
+  return result;
+}
+async function askForConfirmation(message, defaultValue = false) {
+  const result = await ye({
+    message,
+    initialValue: defaultValue
+  });
+  if (pD(result)) {
+    xe("Operation cancelled.");
+    process.exit(0);
+  }
+  return result;
+}
+async function askForSelection(message, choices, defaultValue = 0) {
+  const options = choices.map((choice) => ({
+    value: choice.value,
+    label: choice.title,
+    hint: choice.hint
+  }));
+  const result = await ve({
+    message,
+    options,
+    initialValue: choices[defaultValue]?.value
+  });
+  if (pD(result)) {
+    xe("Operation cancelled.");
+    process.exit(0);
+  }
+  return result;
+}
+var init_cli_input = __esm({
+  "packages/tooling/src/utils/cli-input.ts"() {
     "use strict";
     init_utils();
-    var ALIAS = /* @__PURE__ */ Symbol.for("yaml.alias");
-    var DOC = /* @__PURE__ */ Symbol.for("yaml.document");
-    var MAP = /* @__PURE__ */ Symbol.for("yaml.map");
-    var PAIR = /* @__PURE__ */ Symbol.for("yaml.pair");
-    var SCALAR = /* @__PURE__ */ Symbol.for("yaml.scalar");
-    var SEQ = /* @__PURE__ */ Symbol.for("yaml.seq");
-    var NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type");
-    var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
-    var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
-    var isMap = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
-    var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
-    var isScalar = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
-    var isSeq = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
-    function isCollection(node) {
-      if (node && typeof node === "object")
-        switch (node[NODE_TYPE]) {
-          case MAP:
-          case SEQ:
-            return true;
-        }
-      return false;
-    }
-    function isNode(node) {
-      if (node && typeof node === "object")
-        switch (node[NODE_TYPE]) {
-          case ALIAS:
-          case MAP:
-          case SCALAR:
-          case SEQ:
-            return true;
-        }
-      return false;
-    }
-    var hasAnchor = (node) => (isScalar(node) || isCollection(node)) && !!node.anchor;
-    exports.ALIAS = ALIAS;
-    exports.DOC = DOC;
-    exports.MAP = MAP;
-    exports.NODE_TYPE = NODE_TYPE;
-    exports.PAIR = PAIR;
-    exports.SCALAR = SCALAR;
-    exports.SEQ = SEQ;
-    exports.hasAnchor = hasAnchor;
-    exports.isAlias = isAlias;
-    exports.isCollection = isCollection;
-    exports.isDocument = isDocument;
-    exports.isMap = isMap;
-    exports.isNode = isNode;
-    exports.isPair = isPair;
-    exports.isScalar = isScalar;
-    exports.isSeq = isSeq;
+    init_dist2();
   }
 });
 
-// node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/visit.js
-var require_visit = __commonJS({
-  "node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/visit.js"(exports) {
-    "use strict";
-    init_utils();
-    var identity = require_identity();
-    var BREAK = /* @__PURE__ */ Symbol("break visit");
-    var SKIP = /* @__PURE__ */ Symbol("skip children");
-    var REMOVE = /* @__PURE__ */ Symbol("remove node");
-    function visit(node, visitor) {
-      const visitor_ = initVisitor(visitor);
-      if (identity.isDocument(node)) {
-        const cd = visit_(null, node.contents, visitor_, Object.freeze([node]));
-        if (cd === REMOVE)
-          node.contents = null;
-      } else
-        visit_(null, node, visitor_, Object.freeze([]));
-    }
-    visit.BREAK = BREAK;
-    visit.SKIP = SKIP;
-    visit.REMOVE = REMOVE;
-    function visit_(key, node, visitor, path) {
-      const ctrl = callVisitor(key, node, visitor, path);
-      if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
-        replaceNode(key, path, ctrl);
-        return visit_(key, ctrl, visitor, path);
-      }
-      if (typeof ctrl !== "symbol") {
-        if (identity.isCollection(node)) {
-          path = Object.freeze(path.concat(node));
-          for (let i = 0; i < node.items.length; ++i) {
-            const ci = visit_(i, node.items[i], visitor, path);
-            if (typeof ci === "number")
-              i = ci - 1;
-            else if (ci === BREAK)
-              return BREAK;
-            else if (ci === REMOVE) {
-              node.items.splice(i, 1);
-              i -= 1;
+// packages/tooling/src/utils/cli-tools.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+function checkCLI(command, args = ["--version"], useCache = true) {
+  const cacheKey = `${command}:${args.join(",")}`;
+  if (useCache && cliCache.has(cacheKey)) {
+    return cliCache.get(cacheKey);
+  }
+  try {
+    let result;
+    if (process.platform === "win32") {
+      const username = process.env.USERNAME || process.env.USER || "";
+      const programFiles = process.env.ProgramFiles || "C:\\Program Files";
+      const commonPaths = [
+        `${programFiles}\\nodejs\\${command}.ps1`,
+        `${programFiles}\\nodejs\\${command}.cmd`,
+        `${programFiles}\\nodejs\\${command}`,
+        `C:\\Users\\${username}\\AppData\\Roaming\\npm\\${command}.ps1`,
+        `C:\\Users\\${username}\\AppData\\Roaming\\npm\\${command}.cmd`,
+        `C:\\Users\\${username}\\AppData\\Roaming\\npm\\${command}`,
+        process.env.APPDATA ? `${process.env.APPDATA}\\npm\\${command}.ps1` : null,
+        process.env.APPDATA ? `${process.env.APPDATA}\\npm\\${command}.cmd` : null,
+        process.env.APPDATA ? `${process.env.APPDATA}\\npm\\${command}` : null
+      ].filter(Boolean);
+      for (const fullPath of commonPaths) {
+        try {
+          const testResult = spawnSync2(
+            "powershell.exe",
+            [
+              "-NoProfile",
+              "-ExecutionPolicy",
+              "Bypass",
+              "-Command",
+              `& '${fullPath}' ${args.join(" ")}`
+            ],
+            {
+              stdio: "pipe",
+              shell: false
             }
+          );
+          if (testResult.status === 0) {
+            cliCache.set(cacheKey, true);
+            return true;
           }
-        } else if (identity.isPair(node)) {
-          path = Object.freeze(path.concat(node));
-          const ck = visit_("key", node.key, visitor, path);
-          if (ck === BREAK)
-            return BREAK;
-          else if (ck === REMOVE)
-            node.key = null;
-          const cv = visit_("value", node.value, visitor, path);
-          if (cv === BREAK)
-            return BREAK;
-          else if (cv === REMOVE)
-            node.value = null;
+        } catch {
+          continue;
         }
       }
-      return ctrl;
-    }
-    async function visitAsync(node, visitor) {
-      const visitor_ = initVisitor(visitor);
-      if (identity.isDocument(node)) {
-        const cd = await visitAsync_(null, node.contents, visitor_, Object.freeze([node]));
-        if (cd === REMOVE)
-          node.contents = null;
-      } else
-        await visitAsync_(null, node, visitor_, Object.freeze([]));
+      result = spawnSync2(
+        "powershell.exe",
+        [
+          "-NoProfile",
+          "-ExecutionPolicy",
+          "Bypass",
+          "-Command",
+          `${command} ${args.join(" ")}`
+        ],
+        {
+          stdio: "pipe",
+          shell: false
+        }
+      );
+    } else {
+      result = spawnSync2(command, args, {
+        stdio: "pipe",
+        shell: true
+      });
+    }
+    const isAvailable = result.status === 0;
+    cliCache.set(cacheKey, isAvailable);
+    return isAvailable;
+  } catch (err) {
+    cliCache.set(cacheKey, false);
+    return false;
+  }
+}
+function checkBun() {
+  return checkCLI("bun");
+}
+function checkNpm() {
+  return checkCLI("npm");
+}
+function checkYarn() {
+  return checkCLI("yarn");
+}
+function checkFirebase() {
+  return checkCLI("firebase");
+}
+function checkSentry() {
+  return checkCLI("sentry-cli");
+}
+function checkGitHub() {
+  return checkCLI("gh");
+}
+function checkGit() {
+  return checkCLI("git");
+}
+function checkTsx() {
+  return checkCLI("tsx");
+}
+function getCLIInstallInstructions(tool) {
+  const platform = process.platform;
+  const instructions = {
+    [CLI_TOOLS.BUN]: {
+      win32: [
+        'powershell -c "irm bun.sh/install.ps1 | iex"',
+        "Or download from: https://bun.sh"
+      ],
+      darwin: [
+        "curl -fsSL https://bun.sh/install | bash",
+        "Or: brew install bun"
+      ],
+      linux: [
+        "curl -fsSL https://bun.sh/install | bash",
+        "Or check your package manager (apt, dnf, pacman, etc.)"
+      ]
+    },
+    [CLI_TOOLS.NPM]: {
+      win32: [
+        "Install Node.js from: https://nodejs.org",
+        "npm comes bundled with Node.js"
+      ],
+      darwin: [
+        "Install Node.js from: https://nodejs.org",
+        "Or: brew install node",
+        "npm comes bundled with Node.js"
+      ],
+      linux: [
+        "Install Node.js from: https://nodejs.org",
+        "Or use your package manager: dnf install nodejs, apt install nodejs, etc.",
+        "npm comes bundled with Node.js"
+      ]
+    },
+    [CLI_TOOLS.YARN]: {
+      win32: ["npm install -g yarn", "Or: choco install yarn"],
+      darwin: ["npm install -g yarn", "Or: brew install yarn"],
+      linux: ["npm install -g yarn", "Or check your package manager"]
+    },
+    [CLI_TOOLS.FIREBASE]: {
+      win32: [
+        "npm install -g firebase-tools",
+        "Or download standalone binary: https://firebase.google.com/docs/cli#windows-standalone-binary"
+      ],
+      darwin: [
+        "npm install -g firebase-tools",
+        "Or: brew install firebase-cli"
+      ],
+      linux: [
+        "npm install -g firebase-tools",
+        "Or check your package manager (dnf, apt, pacman, etc.)"
+      ]
+    },
+    [CLI_TOOLS.SUPABASE]: {
+      win32: [
+        "scoop install supabase",
+        "Or: winget install Supabase.CLI",
+        "Or download from: https://github.com/supabase/cli/releases"
+      ],
+      darwin: [
+        "brew install supabase/tap/supabase"
+      ],
+      linux: [
+        "brew install supabase/tap/supabase",
+        "Or see: https://supabase.com/docs/guides/cli"
+      ]
+    },
+    [CLI_TOOLS.VERCEL]: {
+      win32: ["npm install -g vercel", "Or: npx vercel (no install)"],
+      darwin: ["npm install -g vercel", "Or: brew install vercel", "Or: npx vercel"],
+      linux: ["npm install -g vercel", "Or: npx vercel"]
+    },
+    [CLI_TOOLS.SENTRY_CLI]: {
+      win32: [
+        "npm install -g @sentry/cli",
+        "Or download from: https://github.com/getsentry/sentry-cli/releases"
+      ],
+      darwin: [
+        "npm install -g @sentry/cli",
+        "Or: brew install getsentry/tools/sentry-cli"
+      ],
+      linux: [
+        "npm install -g @sentry/cli",
+        "Or: curl -sL https://sentry.io/get-cli/ | bash"
+      ]
+    },
+    [CLI_TOOLS.GH]: {
+      win32: [
+        "Download from: https://cli.github.com",
+        "Or: winget install --id GitHub.cli",
+        "Or: choco install gh"
+      ],
+      darwin: ["brew install gh", "Or download from: https://cli.github.com"],
+      linux: [
+        "See: https://github.com/cli/cli/blob/trunk/docs/install_linux.md",
+        "dnf install gh",
+        "apt install gh",
+        "Or download from: https://cli.github.com"
+      ]
+    },
+    [CLI_TOOLS.GIT]: {
+      win32: [
+        "Download from: https://git-scm.com/download/win",
+        "Or: winget install --id Git.Git"
+      ],
+      darwin: ["brew install git", "Or: xcode-select --install"],
+      linux: [
+        "Use your package manager: dnf install git, apt install git, etc."
+      ]
+    },
+    [CLI_TOOLS.TSX]: {
+      win32: ["npm install -g tsx"],
+      darwin: ["npm install -g tsx"],
+      linux: ["npm install -g tsx"]
+    }
+  };
+  const platformInstructions = instructions[tool]?.[platform] || instructions[tool]?.linux || [];
+  return platformInstructions.join("\n  \u2022 ");
+}
+function formatCLIMissingError(tool, additionalContext) {
+  const toolName = tool === CLI_TOOLS.SENTRY_CLI ? "Sentry CLI" : tool.toUpperCase();
+  M2.error(`${toolName} is not installed or not in PATH.`);
+  const instructions = getCLIInstallInstructions(tool);
+  if (instructions) {
+    M2.warn("Install it with:");
+    M2.message(`  \u2022 ${instructions}`);
+  }
+  if (additionalContext) {
+    M2.info(`
+${additionalContext}`);
+  }
+  const platform = process.platform;
+  M2.info("\nIf already installed, ensure it's in your PATH:");
+  if (platform === "win32") {
+    M2.message("  \u2022 Check with: where " + tool);
+    M2.message(
+      "  \u2022 Common location: C:\\Users\\<username>\\AppData\\Roaming\\npm\\"
+    );
+  } else {
+    M2.message("  \u2022 Check with: which " + tool);
+    M2.message("  \u2022 Common locations:");
+    M2.message("    - ~/.nvm/versions/node/*/bin/" + tool);
+    M2.message("    - ~/.bun/bin/" + tool);
+    M2.message("    - /usr/local/bin/" + tool);
+    M2.message("    - /usr/bin/" + tool);
+  }
+}
+function requireCLI(tool, additionalContext) {
+  const checkers = {
+    [CLI_TOOLS.BUN]: checkBun,
+    [CLI_TOOLS.NPM]: checkNpm,
+    [CLI_TOOLS.YARN]: checkYarn,
+    [CLI_TOOLS.FIREBASE]: checkFirebase,
+    [CLI_TOOLS.SUPABASE]: () => checkCLI(CLI_TOOLS.SUPABASE),
+    [CLI_TOOLS.VERCEL]: () => checkCLI(CLI_TOOLS.VERCEL),
+    [CLI_TOOLS.SENTRY_CLI]: checkSentry,
+    [CLI_TOOLS.GH]: checkGitHub,
+    [CLI_TOOLS.GIT]: checkGit,
+    [CLI_TOOLS.TSX]: checkTsx
+  };
+  cliCache.delete(`${tool}:--version`);
+  const isAvailable = checkers[tool]?.();
+  if (!isAvailable) {
+    formatCLIMissingError(tool, additionalContext);
+    process.exit(1);
+  }
+  return true;
+}
+var CLI_TOOLS, cliCache;
+var init_cli_tools = __esm({
+  "packages/tooling/src/utils/cli-tools.ts"() {
+    "use strict";
+    init_utils();
+    init_dist2();
+    CLI_TOOLS = {
+      BUN: "bun",
+      NPM: "npm",
+      YARN: "yarn",
+      FIREBASE: "firebase",
+      SUPABASE: "supabase",
+      VERCEL: "vercel",
+      SENTRY_CLI: "sentry-cli",
+      GH: "gh",
+      GIT: "git",
+      TSX: "tsx"
+    };
+    cliCache = /* @__PURE__ */ new Map();
+  }
+});
+
+// packages/tooling/src/cli/setup/vercel-token.ts
+function readEnvVar(filePath, varName) {
+  if (!pathExists(filePath)) return null;
+  const content = readSync(filePath, { format: "text" });
+  if (typeof content !== "string") return null;
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    if (trimmed.startsWith(`${varName}=`)) {
+      const val = trimmed.substring(`${varName}=`.length).trim();
+      if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
+        return val.slice(1, -1);
+      }
+      return val || null;
+    }
+  }
+  return null;
+}
+function resolveVercelToken(appDir) {
+  if (process.env.VERCEL_TOKEN) return process.env.VERCEL_TOKEN;
+  const fromEnv = readEnvVar(joinPath(appDir, ".env"), "VERCEL_TOKEN");
+  if (fromEnv) return fromEnv;
+  const fromLocal = readEnvVar(joinPath(appDir, ".env.local"), "VERCEL_TOKEN");
+  if (fromLocal) return fromLocal;
+  return null;
+}
+var init_vercel_token = __esm({
+  "packages/tooling/src/cli/setup/vercel-token.ts"() {
+    "use strict";
+    init_utils();
+    init_pathResolver();
+  }
+});
+
+// node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js
+var require_identity = __commonJS({
+  "node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/nodes/identity.js"(exports) {
+    "use strict";
+    init_utils();
+    var ALIAS = /* @__PURE__ */ Symbol.for("yaml.alias");
+    var DOC = /* @__PURE__ */ Symbol.for("yaml.document");
+    var MAP = /* @__PURE__ */ Symbol.for("yaml.map");
+    var PAIR = /* @__PURE__ */ Symbol.for("yaml.pair");
+    var SCALAR = /* @__PURE__ */ Symbol.for("yaml.scalar");
+    var SEQ = /* @__PURE__ */ Symbol.for("yaml.seq");
+    var NODE_TYPE = /* @__PURE__ */ Symbol.for("yaml.node.type");
+    var isAlias = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === ALIAS;
+    var isDocument = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === DOC;
+    var isMap = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === MAP;
+    var isPair = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === PAIR;
+    var isScalar = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SCALAR;
+    var isSeq = (node) => !!node && typeof node === "object" && node[NODE_TYPE] === SEQ;
+    function isCollection(node) {
+      if (node && typeof node === "object")
+        switch (node[NODE_TYPE]) {
+          case MAP:
+          case SEQ:
+            return true;
+        }
+      return false;
+    }
+    function isNode(node) {
+      if (node && typeof node === "object")
+        switch (node[NODE_TYPE]) {
+          case ALIAS:
+          case MAP:
+          case SCALAR:
+          case SEQ:
+            return true;
+        }
+      return false;
+    }
+    var hasAnchor = (node) => (isScalar(node) || isCollection(node)) && !!node.anchor;
+    exports.ALIAS = ALIAS;
+    exports.DOC = DOC;
+    exports.MAP = MAP;
+    exports.NODE_TYPE = NODE_TYPE;
+    exports.PAIR = PAIR;
+    exports.SCALAR = SCALAR;
+    exports.SEQ = SEQ;
+    exports.hasAnchor = hasAnchor;
+    exports.isAlias = isAlias;
+    exports.isCollection = isCollection;
+    exports.isDocument = isDocument;
+    exports.isMap = isMap;
+    exports.isNode = isNode;
+    exports.isPair = isPair;
+    exports.isScalar = isScalar;
+    exports.isSeq = isSeq;
+  }
+});
+
+// node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/visit.js
+var require_visit = __commonJS({
+  "node_modules/.bun/yaml@2.8.2/node_modules/yaml/dist/visit.js"(exports) {
+    "use strict";
+    init_utils();
+    var identity = require_identity();
+    var BREAK = /* @__PURE__ */ Symbol("break visit");
+    var SKIP = /* @__PURE__ */ Symbol("skip children");
+    var REMOVE = /* @__PURE__ */ Symbol("remove node");
+    function visit(node, visitor) {
+      const visitor_ = initVisitor(visitor);
+      if (identity.isDocument(node)) {
+        const cd = visit_(null, node.contents, visitor_, Object.freeze([node]));
+        if (cd === REMOVE)
+          node.contents = null;
+      } else
+        visit_(null, node, visitor_, Object.freeze([]));
+    }
+    visit.BREAK = BREAK;
+    visit.SKIP = SKIP;
+    visit.REMOVE = REMOVE;
+    function visit_(key, node, visitor, path) {
+      const ctrl = callVisitor(key, node, visitor, path);
+      if (identity.isNode(ctrl) || identity.isPair(ctrl)) {
+        replaceNode(key, path, ctrl);
+        return visit_(key, ctrl, visitor, path);
+      }
+      if (typeof ctrl !== "symbol") {
+        if (identity.isCollection(node)) {
+          path = Object.freeze(path.concat(node));
+          for (let i = 0; i < node.items.length; ++i) {
+            const ci = visit_(i, node.items[i], visitor, path);
+            if (typeof ci === "number")
+              i = ci - 1;
+            else if (ci === BREAK)
+              return BREAK;
+            else if (ci === REMOVE) {
+              node.items.splice(i, 1);
+              i -= 1;
+            }
+          }
+        } else if (identity.isPair(node)) {
+          path = Object.freeze(path.concat(node));
+          const ck = visit_("key", node.key, visitor, path);
+          if (ck === BREAK)
+            return BREAK;
+          else if (ck === REMOVE)
+            node.key = null;
+          const cv = visit_("value", node.value, visitor, path);
+          if (cv === BREAK)
+            return BREAK;
+          else if (cv === REMOVE)
+            node.value = null;
+        }
+      }
+      return ctrl;
+    }
+    async function visitAsync(node, visitor) {
+      const visitor_ = initVisitor(visitor);
+      if (identity.isDocument(node)) {
+        const cd = await visitAsync_(null, node.contents, visitor_, Object.freeze([node]));
+        if (cd === REMOVE)
+          node.contents = null;
+      } else
+        await visitAsync_(null, node, visitor_, Object.freeze([]));
     }
     visitAsync.BREAK = BREAK;
     visitAsync.SKIP = SKIP;
@@ -15221,444 +15719,836 @@ var require_dist = __commonJS({
     exports.parseAllDocuments = publicApi.parseAllDocuments;
     exports.parseDocument = publicApi.parseDocument;
     exports.stringify = publicApi.stringify;
-    exports.visit = visit.visit;
-    exports.visitAsync = visit.visitAsync;
-  }
-});
-
-// packages/cli/src/bin/commands/deploy.ts
-init_utils();
-
-// packages/tooling/src/index.ts
-init_utils();
-
-// packages/tooling/src/cli/index.ts
-init_utils();
-
-// packages/tooling/src/utils/cli-input.ts
-init_utils();
-init_dist2();
-async function askForInput(message, defaultValue = "") {
-  const result = await he({
-    message,
-    placeholder: defaultValue || void 0,
-    defaultValue: defaultValue || void 0
-  });
-  if (pD(result)) {
-    xe("Operation cancelled.");
-    process.exit(0);
-  }
-  return result;
-}
-async function askForConfirmation(message, defaultValue = false) {
-  const result = await ye({
-    message,
-    initialValue: defaultValue
-  });
-  if (pD(result)) {
-    xe("Operation cancelled.");
-    process.exit(0);
-  }
-  return result;
-}
-async function askForSelection(message, choices, defaultValue = 0) {
-  const options = choices.map((choice) => ({
-    value: choice.value,
-    label: choice.title,
-    hint: choice.hint
-  }));
-  const result = await ve({
-    message,
-    options,
-    initialValue: choices[defaultValue]?.value
-  });
-  if (pD(result)) {
-    xe("Operation cancelled.");
-    process.exit(0);
+    exports.visit = visit.visit;
+    exports.visitAsync = visit.visitAsync;
   }
-  return result;
-}
+});
 
-// packages/tooling/src/utils/spawn-utils.ts
-init_utils();
-init_cli_output();
-init_errors();
-init_pathResolver();
-import { spawnSync, execSync } from "node:child_process";
-function clearConflictingAuth(env) {
-  const cleaned = { ...env };
-  delete cleaned.FIREBASE_TOKEN;
-  delete cleaned.FIREBASE_AUTH_TOKEN;
-  return cleaned;
+// packages/tooling/src/utils/error-handling.ts
+function isError(error2) {
+  return error2 instanceof Error;
 }
-function createDeployEnv(serviceAccountPath) {
-  return clearConflictingAuth({
-    ...process.env,
-    GOOGLE_APPLICATION_CREDENTIALS: serviceAccountPath,
-    NODE_OPTIONS: "",
-    NODE_ENV: "production"
-  });
-}
-function executeFirebaseCommand(args, options) {
-  const deployEnv = createDeployEnv(options.serviceAccountPath);
-  const spawnOptions = {
-    cwd: options.cwd,
-    stdio: "inherit",
-    env: deployEnv
-  };
-  let result;
-  result = spawnSync("firebase", args, { ...spawnOptions, shell: true });
-  if (result.error) {
-    return {
-      success: false,
-      status: 1,
-      error: result.error
-    };
+function getErrorMessage(error2) {
+  if (isError(error2)) {
+    return error2.message;
   }
-  const errorOutput = result.stderr?.toString() || result.stdout?.toString() || "";
-  return {
-    success: result.status === 0,
-    status: result.status ?? 1,
-    errorOutput
-  };
+  if (typeof error2 === "string") {
+    return error2;
+  }
+  if (error2 && typeof error2 === "object" && "message" in error2) {
+    return String(error2.message);
+  }
+  return String(error2);
 }
-function buildFirebaseDeployArgs(deployTargets, projectId, debug, force) {
-  const targets = Array.isArray(deployTargets) ? deployTargets : [deployTargets];
-  const targetString = targets.join(",");
-  const args = ["deploy", "--only", targetString, "--non-interactive"];
-  if (projectId) {
-    args.push("--project", projectId);
+var init_error_handling = __esm({
+  "packages/tooling/src/utils/error-handling.ts"() {
+    "use strict";
+    init_utils();
   }
-  if (debug) {
-    args.push("--debug");
+});
+
+// packages/tooling/src/apps/sync-secrets.ts
+var sync_secrets_exports = {};
+__export(sync_secrets_exports, {
+  default: () => sync_secrets_default,
+  main: () => main
+});
+import { spawnSync as spawnSync6 } from "node:child_process";
+function parseEnvFile(filePath) {
+  if (!pathExists(filePath)) {
+    throw new DoNotDevError(
+      `Environment file not found: ${filePath}`,
+      "file-not-found",
+      { context: { filePath } }
+    );
   }
-  if (force) {
-    args.push("--force");
+  const contentRaw = readSync(filePath, { format: "text" });
+  const content = typeof contentRaw === "string" ? contentRaw : null;
+  if (!content) {
+    throw new Error(`Failed to read secrets file: ${filePath}`);
   }
-  return args;
+  const secrets = {};
+  content.split("\n").forEach((line, index) => {
+    const trimmedLine = line.trim();
+    if (!trimmedLine || trimmedLine.startsWith("#")) {
+      return;
+    }
+    const equalIndex = trimmedLine.indexOf("=");
+    if (equalIndex === -1) {
+      log.warn(`Invalid line format at line ${index + 1}: ${trimmedLine}`);
+      return;
+    }
+    const key = trimmedLine.substring(0, equalIndex).trim();
+    const value = trimmedLine.substring(equalIndex + 1).trim();
+    const cleanValue = value.replace(/^["']|["']$/g, "");
+    if (key && cleanValue) {
+      secrets[key] = cleanValue;
+    }
+  });
+  return secrets;
 }
-function analyzeDeploymentError(errorOutput) {
-  const isRetryError = errorOutput.includes("retries exhausted") || errorOutput.includes("retry");
-  const isHashError = errorOutput.includes("hash") || errorOutput.includes("content hash");
-  const isAuthError = errorOutput.includes("401") || errorOutput.includes("authentication") || errorOutput.includes("credentials");
-  const tips = [];
-  if (isRetryError || isHashError) {
-    tips.push("Try deploying with --debug flag for more details");
-    tips.push("Disable VPN if active - VPNs can corrupt file uploads");
-    tips.push("Clear Firebase cache: Remove .firebase directory");
-    tips.push(
-      "Ensure no file watchers or antivirus are modifying files during upload"
-    );
+function detectPlatform() {
+  const currentDir = process.cwd();
+  if (pathExists(joinPath(currentDir, "firebase.json"))) {
+    return "firebase";
   }
-  if (isAuthError) {
-    tips.push("Verify service account has required IAM roles");
-    tips.push("Check service account key file is valid JSON");
-    tips.push("Ensure FIREBASE_TOKEN and FIREBASE_AUTH_TOKEN are cleared");
+  if (pathExists(joinPath(currentDir, "vercel.json")) || pathExists(joinPath(currentDir, ".vercel"))) {
+    return "vercel";
   }
-  return { isRetryError, isHashError, isAuthError, tips };
+  log.warn("No platform detected, defaulting to Firebase");
+  return "firebase";
 }
-function logTroubleshootingTips(tips) {
-  if (tips.length > 0) {
-    log.warn("\nTroubleshooting Tips:");
-    tips.forEach((tip) => log.warn(`  - ${tip}`));
-    log.warn("");
+function findFirebaseProjectDir(envFilePath) {
+  const currentDir = process.cwd();
+  const resolvedPath = joinPath(currentDir, envFilePath);
+  const envFileDir = getDirname(resolvedPath);
+  const appsMatch = envFileDir.match(/apps[\\/]([^\\/]+)[\\/]functions/);
+  if (appsMatch && appsMatch[1]) {
+    const appDir = joinPath(currentDir, "apps", appsMatch[1]);
+    if (pathExists(joinPath(appDir, "firebase.json"))) {
+      return appDir;
+    }
+  }
+  let searchDir = envFileDir;
+  const rootDir = getDirname(currentDir);
+  while (searchDir !== rootDir && searchDir !== getDirname(searchDir)) {
+    if (pathExists(joinPath(searchDir, "firebase.json"))) {
+      return searchDir;
+    }
+    const parentDir = getDirname(searchDir);
+    if (parentDir === searchDir) break;
+    searchDir = parentDir;
   }
+  return currentDir;
 }
-function handleDeploymentFailure(result, command, serviceAccountPath) {
-  const analysis = analyzeDeploymentError(result.errorOutput || "");
-  logTroubleshootingTips(analysis.tips);
-  throw new DoNotDevError(
-    `Firebase deployment failed with exit code ${result.status}`,
-    "command-failed",
-    {
-      context: {
-        command,
-        serviceAccountPath,
-        troubleshootingTips: analysis.tips.length > 0 ? analysis.tips : void 0
+function isFirebaseReservedKey(key) {
+  const reservedPrefixes = ["X_GOOGLE_", "FIREBASE_", "EXT_", "GCLOUD_"];
+  const configOnlyKeys = [
+    "FIREBASE_REGION",
+    "FIREBASE_PROJECT_ID",
+    "FIREBASE_AUTH_DOMAIN"
+  ];
+  if (configOnlyKeys.includes(key)) {
+    return true;
+  }
+  return reservedPrefixes.some((prefix) => key.startsWith(prefix));
+}
+function detectFirebaseProjectId(cwd) {
+  const searchDir = cwd || process.cwd();
+  const firebasercPath = joinPath(searchDir, ".firebaserc");
+  if (pathExists(firebasercPath)) {
+    try {
+      const firebasercRaw = readSync(firebasercPath, { format: "json" });
+      const firebaserc = firebasercRaw && typeof firebasercRaw === "object" ? firebasercRaw : null;
+      if (firebaserc && firebaserc.projects?.default) {
+        return firebaserc.projects.default;
       }
+    } catch {
     }
-  );
+  }
+  let current = searchDir;
+  const root = getDirname(current);
+  while (current !== root) {
+    const firebasercPath2 = joinPath(current, ".firebaserc");
+    if (pathExists(firebasercPath2)) {
+      try {
+        const firebasercRaw = readSync(firebasercPath2, { format: "json" });
+        const firebaserc = firebasercRaw && typeof firebasercRaw === "object" ? firebasercRaw : null;
+        if (firebaserc && firebaserc.projects?.default) {
+          return firebaserc.projects.default;
+        }
+      } catch {
+      }
+    }
+    const parent = getDirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+  return void 0;
 }
-function safeRemove(path, options = {}) {
-  if (!pathExists(path)) {
-    return false;
+function detectAppsWithFunctions() {
+  const currentDir = process.cwd();
+  const appsDir = joinPath(currentDir, "apps");
+  if (!pathExists(appsDir)) {
+    return [];
   }
+  const apps = [];
   try {
-    removeSync(path);
-    if (options.logSuccess) {
-      log.debug(options.successMessage ?? `Removed: ${path}`);
-    }
-    return true;
-  } catch (error2) {
-    const message = options.failureMessage ?? `Could not remove ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`;
-    if (options.silent !== false) {
-      log.warn(message);
+    const appsList = readdirSync2(appsDir).filter((item) => {
+      const itemPath = joinPath(appsDir, item);
+      const stat = statSync2(itemPath);
+      return stat?.isDirectory() === true;
+    });
+    for (const app of appsList) {
+      const functionsEnvFile = joinPath(appsDir, app, "functions", ".env");
+      if (pathExists(functionsEnvFile)) {
+        apps.push({
+          name: app,
+          dir: joinPath(appsDir, app),
+          envFile: functionsEnvFile
+        });
+      }
     }
-    return false;
+  } catch {
   }
+  return apps.sort((a, b3) => a.name.localeCompare(b3.name));
 }
-
-// packages/tooling/src/apps/deploy.ts
-init_utils();
-import { execSync as execSync3 } from "node:child_process";
-
-// packages/tooling/src/apps/deploy-frontend.ts
-init_utils();
-
-// packages/tooling/src/utils/cli-tools.ts
-init_utils();
-init_dist2();
-import { spawnSync as spawnSync2 } from "node:child_process";
-var cliCache = /* @__PURE__ */ new Map();
-function checkCLI(command, args = ["--version"], useCache = true) {
-  const cacheKey = `${command}:${args.join(",")}`;
-  if (useCache && cliCache.has(cacheKey)) {
-    return cliCache.get(cacheKey);
+async function setFirebaseSecret(key, value, projectId, dryRun = false, cwd) {
+  if (isFirebaseReservedKey(key)) {
+    const configOnlyKeys = [
+      "FIREBASE_REGION",
+      "FIREBASE_PROJECT_ID",
+      "FIREBASE_AUTH_DOMAIN"
+    ];
+    if (configOnlyKeys.includes(key)) {
+      log.debug(
+        `\u23ED\uFE0F  Skipping ${key}: Configuration variable (stays in .env, not synced as secret)`
+      );
+    } else {
+      log.warn(
+        `\u23ED\uFE0F  Skipping ${key}: Reserved Firebase prefix (X_GOOGLE_, FIREBASE_, EXT_, GCLOUD_)`
+      );
+    }
+    return;
+  }
+  const finalProjectId = projectId || detectFirebaseProjectId(cwd);
+  if (dryRun) {
+    log.info(
+      `[DRY RUN] Would set Firebase secret: ${key}${finalProjectId ? ` (project: ${finalProjectId})` : ""}`
+    );
+    return;
+  }
+  if (!finalProjectId) {
+    throw new DoNotDevError(
+      `Firebase project ID required for secret '${key}'. Use --project <project_id> or ensure .firebaserc exists with a default project.`,
+      "missing-project-id",
+      {
+        context: {
+          platform: "firebase",
+          key,
+          cwd: cwd || process.cwd(),
+          suggestion: "Run: dn sync-secrets --project <project_id> or create .firebaserc with default project"
+        }
+      }
+    );
   }
   try {
-    let result;
-    if (process.platform === "win32") {
-      const username = process.env.USERNAME || process.env.USER || "";
-      const programFiles = process.env.ProgramFiles || "C:\\Program Files";
-      const commonPaths = [
-        `${programFiles}\\nodejs\\${command}.ps1`,
-        `${programFiles}\\nodejs\\${command}.cmd`,
-        `${programFiles}\\nodejs\\${command}`,
-        `C:\\Users\\${username}\\AppData\\Roaming\\npm\\${command}.ps1`,
-        `C:\\Users\\${username}\\AppData\\Roaming\\npm\\${command}.cmd`,
-        `C:\\Users\\${username}\\AppData\\Roaming\\npm\\${command}`,
-        process.env.APPDATA ? `${process.env.APPDATA}\\npm\\${command}.ps1` : null,
-        process.env.APPDATA ? `${process.env.APPDATA}\\npm\\${command}.cmd` : null,
-        process.env.APPDATA ? `${process.env.APPDATA}\\npm\\${command}` : null
-      ].filter(Boolean);
-      for (const fullPath of commonPaths) {
-        try {
-          const testResult = spawnSync2(
-            "powershell.exe",
-            [
-              "-NoProfile",
-              "-ExecutionPolicy",
-              "Bypass",
-              "-Command",
-              `& '${fullPath}' ${args.join(" ")}`
-            ],
+    log.info(`Setting Firebase secret: ${key} (project: ${finalProjectId})`);
+    const tempDir = joinPath(process.cwd(), ".tmp");
+    await ensureDir(tempDir);
+    const tempFile = joinPath(tempDir, `secret-${key}-${Date.now()}.txt`);
+    await write(tempFile, value);
+    try {
+      const args = ["functions:secrets:set", key, "--project", finalProjectId];
+      const firebaseCmd = process.platform === "win32" ? "firebase.cmd" : "firebase";
+      const deployEnv = {
+        ...process.env,
+        NODE_OPTIONS: ""
+        // Clear to avoid conflicts
+      };
+      const result = spawnSync6(firebaseCmd, args, {
+        input: value,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"],
+        env: deployEnv,
+        cwd: cwd || process.cwd(),
+        shell: false
+      });
+      if (result.error) {
+        throw result.error;
+      }
+      if (result.status !== 0) {
+        const stderr = result.stderr?.toString() || "";
+        const stdout = result.stdout?.toString() || "";
+        const errorOutput = stderr || stdout;
+        const errorLower = errorOutput.toLowerCase();
+        if (errorLower.includes("not logged in") || errorLower.includes("authentication required") || errorLower.includes("please login") || errorLower.includes("run firebase login") || errorLower.includes("unauthorized") || errorOutput.includes("401")) {
+          throw new DoNotDevError(
+            `Firebase CLI authentication required. Please run 'firebase login' to authenticate.`,
+            "permission-denied",
             {
-              stdio: "pipe",
-              shell: false
+              context: {
+                platform: "firebase",
+                key,
+                error: errorOutput,
+                suggestion: "Run: firebase login"
+              }
+            }
+          );
+        }
+        if (errorOutput.includes("403") || errorOutput.includes("Permission denied") || errorOutput.includes("secretmanager.secrets.get") || errorOutput.includes("secretmanager.secrets.create")) {
+          const permissionError = new DoNotDevError(
+            `Permission denied: Missing required Google Cloud permissions for secret '${key}'. Required permissions: secretmanager.secrets.get, secretmanager.secrets.create, secretmanager.versions.add. Ensure you're logged in with 'firebase login' and your account has the 'Secret Manager Admin' role.`,
+            "permission-denied",
+            {
+              context: {
+                platform: "firebase",
+                key,
+                error: errorOutput,
+                suggestion: 'Run: firebase login && gcloud projects add-iam-policy-binding donotdevelopp --member="user:YOUR_EMAIL" --role="roles/secretmanager.admin"'
+              }
+            }
+          );
+          throw permissionError;
+        }
+        if (errorOutput.includes("No currently active project")) {
+          throw new DoNotDevError(
+            `Firebase CLI exited with code ${result.status}: No active project. Please specify the project using '--project <project_id>' or set an active project with 'firebase use --add'.`,
+            "firebase-cli-error",
+            {
+              context: {
+                platform: "firebase",
+                key,
+                error: errorOutput,
+                suggestion: `Run 'dn sync-secrets --project ${finalProjectId}' or 'firebase use --add ${finalProjectId}'`
+              }
             }
           );
-          if (testResult.status === 0) {
-            cliCache.set(cacheKey, true);
-            return true;
+        }
+        throw new Error(
+          `Firebase CLI exited with code ${result.status}
+${errorOutput}`
+        );
+      }
+      log.success(`Firebase secret ${key} set successfully`);
+    } finally {
+      if (pathExists(tempFile)) {
+        await remove(tempFile);
+      }
+    }
+  } catch (err) {
+    log.error(`Failed to set Firebase secret ${key}:`, err);
+    throw new DoNotDevError(
+      `Failed to set Firebase secret ${key}`,
+      "command-failed",
+      {
+        context: {
+          platform: "firebase",
+          key,
+          error: err instanceof Error ? err.message : String(err)
+        }
+      }
+    );
+  }
+}
+function setVercelSecret(key, value, projectId, dryRun = false) {
+  if (dryRun) {
+    log.info(`[DRY RUN] Would set Vercel environment variable: ${key}`);
+    return;
+  }
+  try {
+    log.info(`Setting Vercel environment variable: ${key}`);
+    const args = ["env", "add", key];
+    if (projectId) {
+      args.push("--project", projectId);
+    }
+    const result = spawnSync6("vercel", args, {
+      input: value,
+      encoding: "utf8",
+      stdio: ["pipe", "inherit", "inherit"]
+    });
+    if (result.error) {
+      throw result.error;
+    }
+    if (result.status !== 0) {
+      throw new Error(`Vercel CLI exited with code ${result.status}`);
+    }
+    log.success(`Vercel environment variable ${key} set successfully`);
+  } catch (err) {
+    log.error(`Failed to set Vercel environment variable ${key}:`, err);
+    throw new DoNotDevError(
+      `Failed to set Vercel environment variable ${key}`,
+      "command-failed",
+      {
+        context: {
+          platform: "vercel",
+          key,
+          error: err instanceof Error ? err.message : String(err)
+        }
+      }
+    );
+  }
+}
+function detectGitHubRepo() {
+  try {
+    const result = spawnSync6("git", ["remote", "get-url", "origin"], {
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (result.status !== 0 || !result.stdout) return void 0;
+    const url = result.stdout.trim();
+    const sshMatch = url.match(/github\.com[:/]([^/]+\/[^/.]+)/);
+    if (sshMatch) return sshMatch[1];
+    const httpsMatch = url.match(/github\.com\/([^/]+\/[^/.]+)/);
+    if (httpsMatch) return httpsMatch[1];
+    return void 0;
+  } catch {
+    return void 0;
+  }
+}
+function setGitHubSecret(key, value, repo, dryRun = false) {
+  if (dryRun) {
+    log.info(
+      `[DRY RUN] Would set GitHub secret: ${key}${repo ? ` (repo: ${repo})` : ""}`
+    );
+    return;
+  }
+  try {
+    log.info(`Setting GitHub secret: ${key}${repo ? ` (repo: ${repo})` : ""}`);
+    const args = ["secret", "set", key];
+    if (repo) {
+      args.push("--repo", repo);
+    }
+    const result = spawnSync6("gh", args, {
+      input: value,
+      encoding: "utf8",
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (result.error) {
+      throw result.error;
+    }
+    if (result.status !== 0) {
+      const stderr = result.stderr?.toString() || "";
+      const stdout = result.stdout?.toString() || "";
+      const errorOutput = stderr || stdout;
+      if (errorOutput.includes("not logged in") || errorOutput.includes("authentication")) {
+        throw new DoNotDevError(
+          `GitHub CLI authentication required. Run 'gh auth login' to authenticate.`,
+          "permission-denied",
+          { context: { key, error: errorOutput } }
+        );
+      }
+      throw new Error(
+        `gh CLI exited with code ${result.status}
+${errorOutput}`
+      );
+    }
+    log.success(`GitHub secret ${key} set successfully`);
+  } catch (err) {
+    if (err instanceof DoNotDevError) throw err;
+    log.error(`Failed to set GitHub secret ${key}:`, err);
+    throw new DoNotDevError(
+      `Failed to set GitHub secret ${key}`,
+      "command-failed",
+      {
+        context: {
+          target: "github",
+          key,
+          error: err instanceof Error ? err.message : String(err)
+        }
+      }
+    );
+  }
+}
+function uploadServiceAccountToGitHub(appDir, repo, dryRun = false, staging = false) {
+  const fileName = staging ? "service-account-key.staging.json" : "service-account-key.json";
+  const secretName = staging ? "FIREBASE_SERVICE_ACCOUNT_STAGING" : "FIREBASE_SERVICE_ACCOUNT";
+  const filePath = joinPath(appDir, fileName);
+  if (!pathExists(filePath)) {
+    log.debug(`No ${fileName} found in ${appDir}, skipping GitHub upload`);
+    return;
+  }
+  const contentRaw = readSync(filePath, { format: "text" });
+  const content = typeof contentRaw === "string" ? contentRaw : null;
+  if (!content) return;
+  const encoded = Buffer2.from(content).toString("base64");
+  setGitHubSecret(secretName, encoded, repo, dryRun);
+}
+async function main(options = {}) {
+  const config = {
+    envFile: options.envFile || ".env",
+    platform: options.platform,
+    projectId: options.projectId,
+    vercelProjectId: options.vercelProjectId,
+    target: options.target || "runtime",
+    repo: options.repo,
+    dryRun: options.dryRun ?? false,
+    verbose: options.verbose ?? false
+  };
+  if (process.argv.includes("--help")) {
+    log.info(`
+Secrets Sync Tool
+
+Usage: bun run sync-secrets [options]
+
+Options:
+  --env-file <path>       Path to .env file (default: .env)
+  --target <target>       Sync target: 'runtime' (default) or 'github'
+  --platform <platform>   Platform to sync to: 'firebase' or 'vercel' (runtime target only, auto-detected)
+  --project <id>          Firebase project ID (for Firebase platform)
+  --vercel-project <id>   Vercel project ID (for Vercel platform)
+  --repo <owner/repo>     GitHub repository (github target only, auto-detected from git remote)
+  --dry-run, --dry        Show what would be done without actually setting secrets
+  --verbose               Show detailed output
+  --help                  Show this help message
+
+Examples:
+  dndev sync-secrets                                      # sync to Firebase/Vercel runtime
+  dndev sync-secrets --target github                      # sync to GitHub Secrets
+  dndev sync-secrets --target github --repo owner/repo    # sync to specific repo
+  dndev sync-secrets --platform=firebase
+  dndev sync-secrets --dry-run
+  dndev sync-secrets --env-file .env.production --project my-project
+        `);
+    return 0;
+  }
+  try {
+    const currentDir = process.cwd();
+    let firebaseProjectDir;
+    if (!options.envFile || config.envFile === ".env") {
+      const appsWithFunctions = detectAppsWithFunctions();
+      if (appsWithFunctions.length > 0) {
+        let selectedApp;
+        if (appsWithFunctions.length === 1) {
+          selectedApp = appsWithFunctions[0];
+          Me(`Using app: ${selectedApp.name}`, "Auto-detected");
+        } else {
+          const appName = await askForSelection(
+            "Which app would you like to sync secrets for?",
+            appsWithFunctions.map((app) => ({
+              title: app.name,
+              value: app.name,
+              hint: `functions/.env in ${app.name}`
+            }))
+          );
+          selectedApp = appsWithFunctions.find((a) => a.name === appName);
+        }
+        if (selectedApp) {
+          const envFileAbsolute = normalizePath(selectedApp.envFile);
+          const envFileRelative = getRelativePathBetween(
+            currentDir,
+            envFileAbsolute
+          );
+          config.envFile = envFileRelative;
+          firebaseProjectDir = selectedApp.dir;
+          if (!config.projectId) {
+            config.projectId = detectFirebaseProjectId(selectedApp.dir);
           }
-        } catch {
-          continue;
         }
       }
-      result = spawnSync2(
-        "powershell.exe",
-        [
-          "-NoProfile",
-          "-ExecutionPolicy",
-          "Bypass",
-          "-Command",
-          `${command} ${args.join(" ")}`
-        ],
-        {
-          stdio: "pipe",
-          shell: false
-        }
+    }
+    const envFilePath = joinPath(currentDir, config.envFile);
+    const syncTarget = config.target || "runtime";
+    if (syncTarget === "github") {
+      const repo = config.repo || detectGitHubRepo();
+      if (!repo) {
+        log.error(
+          "Could not detect GitHub repository. Use --repo owner/repo or ensure a GitHub remote is configured."
+        );
+        return 1;
+      }
+      log.info(`Syncing secrets to GitHub repository: ${repo}`);
+      const secrets2 = parseEnvFile(envFilePath);
+      const secretKeys2 = Object.keys(secrets2);
+      if (secretKeys2.length === 0) {
+        log.info("No secrets found in .env file");
+      } else {
+        log.info(`Found ${secretKeys2.length} secrets to sync to GitHub:`);
+        secretKeys2.forEach((key) => log.info(`  ${key}`));
+        for (const [key, value] of Object.entries(secrets2)) {
+          setGitHubSecret(key, value, repo, config.dryRun);
+        }
+      }
+      if (firebaseProjectDir) {
+        uploadServiceAccountToGitHub(
+          firebaseProjectDir,
+          repo,
+          config.dryRun,
+          false
+        );
+        uploadServiceAccountToGitHub(
+          firebaseProjectDir,
+          repo,
+          config.dryRun,
+          true
+        );
+      } else {
+        uploadServiceAccountToGitHub(currentDir, repo, config.dryRun, false);
+        uploadServiceAccountToGitHub(currentDir, repo, config.dryRun, true);
+      }
+      if (config.dryRun) {
+        log.success("\nDry run completed. No GitHub secrets were set.");
+      } else {
+        log.success("\nAll secrets synced to GitHub successfully!");
+      }
+      return 0;
+    }
+    const platform = config.platform || detectPlatform();
+    log.info(`Reading secrets from: ${envFilePath}`);
+    if (config.verbose) {
+      log.debug(`Working directory: ${currentDir}`);
+      log.debug(`Environment file: ${envFilePath}`);
+      log.debug(`Platform: ${platform}`);
+      log.debug(`Dry run mode: ${config.dryRun}`);
+    }
+    const secrets = parseEnvFile(envFilePath);
+    const secretKeys = Object.keys(secrets);
+    if (secretKeys.length === 0) {
+      log.info("No secrets found in .env file");
+      return 0;
+    }
+    log.info(`Found ${secretKeys.length} secrets to sync to ${platform}:`);
+    secretKeys.forEach((key) => {
+      if (config.verbose) {
+        const value = secrets[key];
+        log.debug(
+          `  ${key}: ${value ? value.substring(0, 10) + "..." : "undefined"}`
+        );
+      } else {
+        log.info(`  ${key}`);
+      }
+    });
+    const finalFirebaseProjectDir = platform === "firebase" ? firebaseProjectDir || findFirebaseProjectDir(config.envFile) : void 0;
+    if (config.verbose && finalFirebaseProjectDir) {
+      log.debug(`Firebase project directory: ${finalFirebaseProjectDir}`);
+    }
+    for (const [key, value] of Object.entries(secrets)) {
+      if (platform === "firebase") {
+        await setFirebaseSecret(
+          key,
+          value,
+          config.projectId,
+          config.dryRun,
+          finalFirebaseProjectDir
+        );
+      } else if (platform === "vercel") {
+        setVercelSecret(key, value, config.vercelProjectId, config.dryRun);
+      }
+    }
+    if (config.dryRun) {
+      log.success(
+        `
+Dry run completed. No secrets were actually set to ${platform}.`
       );
     } else {
-      result = spawnSync2(command, args, {
-        stdio: "pipe",
-        shell: true
-      });
+      log.success(`
+All secrets synced successfully to ${platform}!`);
     }
-    const isAvailable = result.status === 0;
-    cliCache.set(cacheKey, isAvailable);
-    return isAvailable;
+    return 0;
   } catch (err) {
-    cliCache.set(cacheKey, false);
-    return false;
+    log.error(
+      "Error syncing secrets:",
+      DoNotDevError.from(err, "Sync-secrets failed", "cli-execution-error")
+    );
+    return 1;
   }
 }
-function checkBun() {
-  return checkCLI("bun");
-}
-function checkNpm() {
-  return checkCLI("npm");
-}
-function checkYarn() {
-  return checkCLI("yarn");
-}
-function checkFirebase() {
-  return checkCLI("firebase");
-}
-function checkSentry() {
-  return checkCLI("sentry-cli");
-}
-function checkGitHub() {
-  return checkCLI("gh");
+var sync_secrets_default;
+var init_sync_secrets = __esm({
+  "packages/tooling/src/apps/sync-secrets.ts"() {
+    "use strict";
+    init_utils();
+    init_cli_input();
+    init_cli_output();
+    init_errors();
+    init_pathResolver();
+    sync_secrets_default = main;
+  }
+});
+
+// packages/tooling/src/apps/deploy-supabase-functions.ts
+var deploy_supabase_functions_exports = {};
+__export(deploy_supabase_functions_exports, {
+  deploySupabaseFunctions: () => deploySupabaseFunctions
+});
+import { execSync as execSync3 } from "node:child_process";
+async function deploySupabaseFunctions(appDir, config) {
+  const supabaseDir = joinPath(appDir, "supabase");
+  const functionsDir = joinPath(supabaseDir, "functions");
+  if (!pathExists(functionsDir)) {
+    log.warn("No supabase/functions/ directory found. Skipping Supabase functions deployment.");
+    return;
+  }
+  requireCLI(
+    CLI_TOOLS.SUPABASE,
+    "Supabase CLI is required to deploy Edge Functions.\nInstall: https://supabase.com/docs/guides/cli"
+  );
+  const functionDirs = readdirSync2(functionsDir).filter((item) => {
+    const itemPath = joinPath(functionsDir, item);
+    const stat = statSync2(itemPath);
+    return stat?.isDirectory() === true;
+  }).filter((dir) => {
+    const indexPath = joinPath(functionsDir, dir, "index.ts");
+    return pathExists(indexPath);
+  });
+  if (functionDirs.length === 0) {
+    log.warn("No Edge Functions found in supabase/functions/. Skipping deployment.");
+    return;
+  }
+  log.info(`Found ${functionDirs.length} Edge Function(s): ${functionDirs.join(", ")}`);
+  const s = Y2();
+  for (const functionName of functionDirs) {
+    s.start(`Deploying Edge Function: ${functionName}...`);
+    try {
+      execSync3(`supabase functions deploy ${functionName}`, {
+        cwd: supabaseDir,
+        stdio: config.verbose ? "inherit" : "pipe",
+        env: {
+          ...process.env,
+          DNDEV_APP_ROOT: appDir
+        }
+      });
+      s.stop(`Deployed: ${functionName}`);
+    } catch (error2) {
+      s.stop(`Failed to deploy: ${functionName}`);
+      throw new DoNotDevError(
+        `Failed to deploy Supabase Edge Function: ${functionName}`,
+        "deployment-failed",
+        { context: { functionName, error: error2 instanceof Error ? error2.message : String(error2) } }
+      );
+    }
+  }
+  log.success(`Successfully deployed ${functionDirs.length} Edge Function(s)`);
 }
-function checkGit() {
-  return checkCLI("git");
+var init_deploy_supabase_functions = __esm({
+  "packages/tooling/src/apps/deploy-supabase-functions.ts"() {
+    "use strict";
+    init_utils();
+    init_pathResolver();
+    init_cli_output();
+    init_cli_tools();
+    init_errors();
+  }
+});
+
+// packages/cli/src/bin/commands/deploy.ts
+init_utils();
+
+// packages/tooling/src/index.ts
+init_utils();
+
+// packages/tooling/src/cli/index.ts
+init_utils();
+
+// packages/tooling/src/utils/spawn-utils.ts
+init_utils();
+init_cli_output();
+init_errors();
+init_pathResolver();
+import { spawnSync, execSync } from "node:child_process";
+function clearConflictingAuth(env) {
+  const cleaned = { ...env };
+  delete cleaned.FIREBASE_TOKEN;
+  delete cleaned.FIREBASE_AUTH_TOKEN;
+  return cleaned;
 }
-function checkTsx() {
-  return checkCLI("tsx");
+function createDeployEnv(serviceAccountPath) {
+  return clearConflictingAuth({
+    ...process.env,
+    GOOGLE_APPLICATION_CREDENTIALS: serviceAccountPath,
+    NODE_OPTIONS: "",
+    NODE_ENV: "production"
+  });
 }
-function getCLIInstallInstructions(tool) {
-  const platform = process.platform;
-  const instructions = {
-    bun: {
-      win32: [
-        'powershell -c "irm bun.sh/install.ps1 | iex"',
-        "Or download from: https://bun.sh"
-      ],
-      darwin: [
-        "curl -fsSL https://bun.sh/install | bash",
-        "Or: brew install bun"
-      ],
-      linux: [
-        "curl -fsSL https://bun.sh/install | bash",
-        "Or check your package manager (apt, dnf, pacman, etc.)"
-      ]
-    },
-    npm: {
-      win32: [
-        "Install Node.js from: https://nodejs.org",
-        "npm comes bundled with Node.js"
-      ],
-      darwin: [
-        "Install Node.js from: https://nodejs.org",
-        "Or: brew install node",
-        "npm comes bundled with Node.js"
-      ],
-      linux: [
-        "Install Node.js from: https://nodejs.org",
-        "Or use your package manager: dnf install nodejs, apt install nodejs, etc.",
-        "npm comes bundled with Node.js"
-      ]
-    },
-    yarn: {
-      win32: ["npm install -g yarn", "Or: choco install yarn"],
-      darwin: ["npm install -g yarn", "Or: brew install yarn"],
-      linux: ["npm install -g yarn", "Or check your package manager"]
-    },
-    firebase: {
-      win32: [
-        "npm install -g firebase-tools",
-        "Or download standalone binary: https://firebase.google.com/docs/cli#windows-standalone-binary"
-      ],
-      darwin: [
-        "npm install -g firebase-tools",
-        "Or: brew install firebase-cli"
-      ],
-      linux: [
-        "npm install -g firebase-tools",
-        "Or check your package manager (dnf, apt, pacman, etc.)"
-      ]
-    },
-    "sentry-cli": {
-      win32: [
-        "npm install -g @sentry/cli",
-        "Or download from: https://github.com/getsentry/sentry-cli/releases"
-      ],
-      darwin: [
-        "npm install -g @sentry/cli",
-        "Or: brew install getsentry/tools/sentry-cli"
-      ],
-      linux: [
-        "npm install -g @sentry/cli",
-        "Or: curl -sL https://sentry.io/get-cli/ | bash"
-      ]
-    },
-    gh: {
-      win32: [
-        "Download from: https://cli.github.com",
-        "Or: winget install --id GitHub.cli",
-        "Or: choco install gh"
-      ],
-      darwin: ["brew install gh", "Or download from: https://cli.github.com"],
-      linux: [
-        "See: https://github.com/cli/cli/blob/trunk/docs/install_linux.md",
-        "dnf install gh",
-        "apt install gh",
-        "Or download from: https://cli.github.com"
-      ]
-    },
-    git: {
-      win32: [
-        "Download from: https://git-scm.com/download/win",
-        "Or: winget install --id Git.Git"
-      ],
-      darwin: ["brew install git", "Or: xcode-select --install"],
-      linux: [
-        "Use your package manager: dnf install git, apt install git, etc."
-      ]
-    },
-    tsx: {
-      win32: ["npm install -g tsx"],
-      darwin: ["npm install -g tsx"],
-      linux: ["npm install -g tsx"]
-    }
+function executeFirebaseCommand(args, options) {
+  const deployEnv = createDeployEnv(options.serviceAccountPath);
+  const spawnOptions = {
+    cwd: options.cwd,
+    stdio: "inherit",
+    env: deployEnv
+  };
+  let result;
+  result = spawnSync("firebase", args, { ...spawnOptions, shell: true });
+  if (result.error) {
+    return {
+      success: false,
+      status: 1,
+      error: result.error
+    };
+  }
+  const errorOutput = result.stderr?.toString() || result.stdout?.toString() || "";
+  return {
+    success: result.status === 0,
+    status: result.status ?? 1,
+    errorOutput
   };
-  const platformInstructions = instructions[tool]?.[platform] || instructions[tool]?.linux || [];
-  return platformInstructions.join("\n  \u2022 ");
 }
-function formatCLIMissingError(tool, additionalContext) {
-  const toolName = tool === "sentry-cli" ? "Sentry CLI" : tool.toUpperCase();
-  M2.error(`${toolName} is not installed or not in PATH.`);
-  const instructions = getCLIInstallInstructions(tool);
-  if (instructions) {
-    M2.warn("Install it with:");
-    M2.message(`  \u2022 ${instructions}`);
+function buildFirebaseDeployArgs(deployTargets, projectId, debug, force) {
+  const targets = Array.isArray(deployTargets) ? deployTargets : [deployTargets];
+  const targetString = targets.join(",");
+  const args = ["deploy", "--only", targetString, "--non-interactive"];
+  if (projectId) {
+    args.push("--project", projectId);
   }
-  if (additionalContext) {
-    M2.info(`
-${additionalContext}`);
+  if (debug) {
+    args.push("--debug");
   }
-  const platform = process.platform;
-  M2.info("\nIf already installed, ensure it's in your PATH:");
-  if (platform === "win32") {
-    M2.message("  \u2022 Check with: where " + tool);
-    M2.message(
-      "  \u2022 Common location: C:\\Users\\<username>\\AppData\\Roaming\\npm\\"
+  if (force) {
+    args.push("--force");
+  }
+  return args;
+}
+function analyzeDeploymentError(errorOutput) {
+  const isRetryError = errorOutput.includes("retries exhausted") || errorOutput.includes("retry");
+  const isHashError = errorOutput.includes("hash") || errorOutput.includes("content hash");
+  const isAuthError = errorOutput.includes("401") || errorOutput.includes("authentication") || errorOutput.includes("credentials");
+  const tips = [];
+  if (isRetryError || isHashError) {
+    tips.push("Try deploying with --debug flag for more details");
+    tips.push("Disable VPN if active - VPNs can corrupt file uploads");
+    tips.push("Clear Firebase cache: Remove .firebase directory");
+    tips.push(
+      "Ensure no file watchers or antivirus are modifying files during upload"
     );
-  } else {
-    M2.message("  \u2022 Check with: which " + tool);
-    M2.message("  \u2022 Common locations:");
-    M2.message("    - ~/.nvm/versions/node/*/bin/" + tool);
-    M2.message("    - ~/.bun/bin/" + tool);
-    M2.message("    - /usr/local/bin/" + tool);
-    M2.message("    - /usr/bin/" + tool);
   }
+  if (isAuthError) {
+    tips.push("Verify service account has required IAM roles");
+    tips.push("Check service account key file is valid JSON");
+    tips.push("Ensure FIREBASE_TOKEN and FIREBASE_AUTH_TOKEN are cleared");
+  }
+  return { isRetryError, isHashError, isAuthError, tips };
 }
-function requireCLI(tool, additionalContext) {
-  const checkers = {
-    bun: checkBun,
-    npm: checkNpm,
-    yarn: checkYarn,
-    firebase: checkFirebase,
-    "sentry-cli": checkSentry,
-    gh: checkGitHub,
-    git: checkGit,
-    tsx: checkTsx
-  };
-  cliCache.delete(`${tool}:--version`);
-  const isAvailable = checkers[tool]?.();
-  if (!isAvailable) {
-    formatCLIMissingError(tool, additionalContext);
-    process.exit(1);
+function logTroubleshootingTips(tips) {
+  if (tips.length > 0) {
+    log.warn("\nTroubleshooting Tips:");
+    tips.forEach((tip) => log.warn(`  - ${tip}`));
+    log.warn("");
+  }
+}
+function handleDeploymentFailure(result, command, serviceAccountPath) {
+  const analysis = analyzeDeploymentError(result.errorOutput || "");
+  logTroubleshootingTips(analysis.tips);
+  throw new DoNotDevError(
+    `Firebase deployment failed with exit code ${result.status}`,
+    "command-failed",
+    {
+      context: {
+        command,
+        serviceAccountPath,
+        troubleshootingTips: analysis.tips.length > 0 ? analysis.tips : void 0
+      }
+    }
+  );
+}
+function safeRemove(path, options = {}) {
+  if (!pathExists(path)) {
+    return false;
+  }
+  try {
+    removeSync(path);
+    if (options.logSuccess) {
+      log.debug(options.successMessage ?? `Removed: ${path}`);
+    }
+    return true;
+  } catch (error2) {
+    const message = options.failureMessage ?? `Could not remove ${path}: ${error2 instanceof Error ? error2.message : String(error2)}`;
+    if (options.silent !== false) {
+      log.warn(message);
+    }
+    return false;
   }
-  return true;
 }
 
+// packages/tooling/src/apps/deploy.ts
+init_utils();
+import { execSync as execSync4 } from "node:child_process";
+
 // packages/tooling/src/apps/deploy-frontend.ts
+init_utils();
 async function deployFrontend(appDir, serviceAccountPath, projectId, config) {
   const s = Y2();
   s.start("Deploying frontend to Firebase Hosting...");
-  const args = buildFirebaseDeployArgs("hosting", projectId, config.debug);
+  const args = buildFirebaseDeployArgs("hosting", projectId, config.debug, config.force ?? true);
   const result = executeFirebaseCommand(args, {
     cwd: appDir,
     serviceAccountPath,
@@ -15680,11 +16570,47 @@ async function deployFrontend(appDir, serviceAccountPath, projectId, config) {
   s.stop("Frontend deployed successfully");
 }
 
+// packages/tooling/src/apps/deploy-vercel-frontend.ts
+init_utils();
+init_cli_output();
+init_vercel_token();
+import { spawnSync as spawnSync3 } from "node:child_process";
+async function deployVercelFrontend(appDir, _config) {
+  const s = Y2();
+  s.start("Deploying frontend to Vercel...");
+  const token = resolveVercelToken(appDir);
+  if (token) {
+    log.debug("Using VERCEL_TOKEN from .env (token-based auth)");
+  }
+  const args = ["vercel", "--prod", "--yes"];
+  if (token) {
+    args.push("--token", token);
+  }
+  try {
+    const result = spawnSync3("bunx", args, {
+      cwd: appDir,
+      stdio: "pipe",
+      encoding: "utf-8"
+    });
+    if (result.status !== 0) {
+      s.stop("Vercel deployment failed");
+      const errOutput = result.stderr?.trim();
+      throw new Error(errOutput || `Vercel deploy exited with code ${result.status}`);
+    }
+    s.stop("Frontend deployed to Vercel");
+  } catch (err) {
+    s.stop("Vercel deployment failed");
+    throw err;
+  }
+}
+
 // packages/tooling/src/apps/deploy-functions.ts
 init_utils();
 var import_yaml = __toESM(require_dist(), 1);
-import { execSync as execSync2, spawnSync as spawnSync3 } from "node:child_process";
+import { execSync as execSync2, spawnSync as spawnSync4 } from "node:child_process";
 init_pathResolver();
+init_cli_tools();
+init_typed_file_operations();
 function backupFiles(functionsDir) {
   const backupDir = joinPath(functionsDir, ".deploy-backup");
   const packageJsonPath = joinPath(functionsDir, "package.json");
@@ -15694,14 +16620,16 @@ function backupFiles(functionsDir) {
     const backupPackageJson = joinPath(backupDir, "package.json");
     const backupPackageLockJson = joinPath(backupDir, "package-lock.json");
     if (pathExists(packageJsonPath)) {
-      const content = readSync(packageJsonPath, { format: "text" });
+      const contentRaw = readSync(packageJsonPath, { format: "text" });
+      const content = typeof contentRaw === "string" ? contentRaw : null;
       if (!content) {
         throw new Error(`Failed to read package.json: ${packageJsonPath}`);
       }
       writeSync(backupPackageJson, content, { overwrite: true });
     }
     if (pathExists(packageLockJsonPath)) {
-      const content = readSync(packageLockJsonPath, { format: "text" });
+      const contentRaw = readSync(packageLockJsonPath, { format: "text" });
+      const content = typeof contentRaw === "string" ? contentRaw : null;
       if (!content) {
         throw new Error(
           `Failed to read package-lock.json: ${packageLockJsonPath}`
@@ -15728,8 +16656,8 @@ function generateCleanPackageJson(functionsDir) {
       "file-not-found"
     );
   }
-  const packageJson = readSync(packageJsonPath, { format: "json" });
-  if (!packageJson) {
+  const packageJson = readPackageJson(packageJsonPath);
+  if (!packageJson.name) {
     throw new Error(
       `package.json is empty or invalid JSON at ${packageJsonPath}`
     );
@@ -15821,7 +16749,9 @@ function getDeployedFunctionNames(functionsDir) {
     }
     return Object.keys(parsed.endpoints);
   } catch (error2) {
-    log.warn(`Failed to parse functions.yaml: ${error2 instanceof Error ? error2.message : String(error2)}`);
+    log.warn(
+      `Failed to parse functions.yaml: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
     return [];
   }
 }
@@ -15831,18 +16761,22 @@ function updateCloudRunIAM(functionNames, projectId, region, serviceAccountPath,
   }
   if (!checkCLI("gcloud", ["--version"])) {
     log.warn("gcloud CLI not found. Skipping Cloud Run IAM updates.");
-    log.warn("Functions may require manual IAM configuration for CORS preflight.");
+    log.warn(
+      "Functions may require manual IAM configuration for CORS preflight."
+    );
     log.warn("Install gcloud: https://cloud.google.com/sdk/docs/install");
     return;
   }
   const s = Y2();
-  s.start(`Updating Cloud Run IAM for ${functionNames.length} functions (CORS preflight)...`);
+  s.start(
+    `Updating Cloud Run IAM for ${functionNames.length} functions (CORS preflight)...`
+  );
   const deployEnv = createDeployEnv(serviceAccountPath);
   let successCount = 0;
   let failCount = 0;
   for (const funcName of functionNames) {
     try {
-      const result = spawnSync3(
+      const result = spawnSync4(
         "gcloud",
         [
           "run",
@@ -15875,7 +16809,9 @@ function updateCloudRunIAM(functionNames, projectId, region, serviceAccountPath,
       }
     } catch (error2) {
       failCount++;
-      log.warn(`Error updating IAM for ${funcName}: ${error2 instanceof Error ? error2.message : String(error2)}`);
+      log.warn(
+        `Error updating IAM for ${funcName}: ${error2 instanceof Error ? error2.message : String(error2)}`
+      );
     }
   }
   if (successCount > 0) {
@@ -15884,7 +16820,9 @@ function updateCloudRunIAM(functionNames, projectId, region, serviceAccountPath,
     s.stop("Cloud Run IAM update completed with errors");
   }
   if (failCount > 0) {
-    log.warn(`${failCount} function(s) failed IAM update. They may require manual configuration.`);
+    log.warn(
+      `${failCount} function(s) failed IAM update. They may require manual configuration.`
+    );
   }
 }
 function getFirebaseRegion(functionsDir) {
@@ -15925,7 +16863,11 @@ async function autoSyncSecrets(functionsDir, projectId, config) {
     const envContent = readSync(envPath, { format: "text" });
     if (!envContent) return;
     const reservedPrefixes = ["X_GOOGLE_", "FIREBASE_", "EXT_", "GCLOUD_"];
-    const configOnlyKeys = ["FIREBASE_REGION", "FIREBASE_PROJECT_ID", "FIREBASE_AUTH_DOMAIN"];
+    const configOnlyKeys = [
+      "FIREBASE_REGION",
+      "FIREBASE_PROJECT_ID",
+      "FIREBASE_AUTH_DOMAIN"
+    ];
     const secrets = [];
     for (const line of envContent.split("\n")) {
       const trimmed = line.trim();
@@ -15944,13 +16886,15 @@ async function autoSyncSecrets(functionsDir, projectId, config) {
       return;
     }
     const s = Y2();
-    s.start(`Syncing ${secrets.length} secret(s) to Firebase Secret Manager...`);
+    s.start(
+      `Syncing ${secrets.length} secret(s) to Firebase Secret Manager...`
+    );
     const firebaseCmd = process.platform === "win32" ? "firebase.cmd" : "firebase";
     let successCount = 0;
     let failCount = 0;
     for (const { key, value } of secrets) {
       try {
-        const result = spawnSync3(
+        const result = spawnSync4(
           firebaseCmd,
           ["functions:secrets:set", key, "--project", projectId],
           {
@@ -15984,8 +16928,12 @@ async function autoSyncSecrets(functionsDir, projectId, config) {
       log.warn('Could not sync secrets. Run "dn sync-secrets" manually.');
     }
   } catch (error2) {
-    log.debug(`Could not sync secrets: ${error2 instanceof Error ? error2.message : String(error2)}`);
-    log.info('Run "dn sync-secrets" manually to sync secrets to Firebase Secret Manager.');
+    log.debug(
+      `Could not sync secrets: ${error2 instanceof Error ? error2.message : String(error2)}`
+    );
+    log.info(
+      'Run "dn sync-secrets" manually to sync secrets to Firebase Secret Manager.'
+    );
   }
 }
 async function deployFunctions(appDir, serviceAccountPath, projectId, config) {
@@ -16046,7 +16994,8 @@ To fix this, run:
       "functions",
       projectId,
       config.debug,
-      config.force
+      config.force ?? true
+      // Default --force for functions (auto-sets artifact cleanup policy)
     );
     const result = executeFirebaseCommand(args, {
       cwd: firebaseProjectDir,
@@ -16070,7 +17019,13 @@ To fix this, run:
     const functionNames = getDeployedFunctionNames(functionsDir);
     if (functionNames.length > 0) {
       const region = getFirebaseRegion(functionsDir);
-      updateCloudRunIAM(functionNames, projectId, region, serviceAccountPath, config.verbose ?? false);
+      updateCloudRunIAM(
+        functionNames,
+        projectId,
+        region,
+        serviceAccountPath,
+        config.verbose ?? false
+      );
     }
     await autoSyncSecrets(functionsDir, projectId, config);
   } finally {
@@ -16097,7 +17052,7 @@ async function deployRules(appDir, serviceAccountPath, projectId, config, option
   const targetNames = targets.join(", ");
   const s = Y2();
   s.start(`Deploying ${targetNames}...`);
-  const args = buildFirebaseDeployArgs(targets, projectId, config.debug);
+  const args = buildFirebaseDeployArgs(targets, projectId, config.debug, config.force ?? true);
   const result = executeFirebaseCommand(args, {
     cwd: appDir,
     serviceAccountPath,
@@ -16121,8 +17076,10 @@ async function deployRules(appDir, serviceAccountPath, projectId, config, option
 
 // packages/tooling/src/apps/deploy-utils.ts
 init_utils();
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync5 } from "node:child_process";
 init_pathResolver();
+init_typed_file_operations();
+init_error_handling();
 function detectAvailableApps() {
   const currentDir = process.cwd();
   const appsDir = joinPath(currentDir, "apps");
@@ -16134,8 +17091,11 @@ function detectAvailableApps() {
     const stat = statSync2(itemPath);
     return stat?.isDirectory() === true;
   }).filter((app) => {
-    const firebaseJsonPath = joinPath(appsDir, app, "firebase.json");
-    return pathExists(firebaseJsonPath);
+    const appDir = joinPath(appsDir, app);
+    const firebaseJsonPath = joinPath(appDir, "firebase.json");
+    const supabaseDir = joinPath(appDir, "supabase");
+    const vercelJsonPath = joinPath(appDir, "vercel.json");
+    return pathExists(firebaseJsonPath) || pathExists(supabaseDir) || pathExists(vercelJsonPath);
   }).sort();
 }
 function detectAppDir(appName) {
@@ -16174,40 +17134,7 @@ function validateServiceAccount(appDir, options) {
     };
   }
   try {
-    const keyData = readSync(keyPath, { format: "json" });
-    if (!keyData) {
-      return {
-        valid: false,
-        info: {
-          path: keyPath,
-          projectId: "",
-          clientEmail: "",
-          valid: false,
-          errors: ["Service account key file is empty or invalid JSON"]
-        }
-      };
-    }
-    if (!keyData.project_id) {
-      errors.push("Missing required field: project_id");
-    }
-    if (!keyData.private_key) {
-      errors.push("Missing required field: private_key");
-    }
-    if (!keyData.client_email) {
-      errors.push("Missing required field: client_email");
-    }
-    if (errors.length > 0) {
-      return {
-        valid: false,
-        info: {
-          path: keyPath,
-          projectId: keyData.project_id || "",
-          clientEmail: keyData.client_email || "",
-          valid: false,
-          errors
-        }
-      };
-    }
+    const keyData = readServiceAccountKey(keyPath);
     return {
       valid: true,
       info: {
@@ -16226,9 +17153,7 @@ function validateServiceAccount(appDir, options) {
         projectId: "",
         clientEmail: "",
         valid: false,
-        errors: [
-          `Invalid JSON format: ${error2 instanceof DoNotDevError ? error2.message : error2 instanceof Error ? error2.message : String(error2)}`
-        ]
+        errors: [`Invalid service account key: ${getErrorMessage(error2)}`]
       }
     };
   }
@@ -16247,12 +17172,7 @@ function validateFirebaseJson(appDir) {
     };
   }
   try {
-    const config = readSync(firebaseJsonPath, { format: "json" });
-    if (!config) {
-      throw new Error(
-        `firebase.json is empty or invalid JSON at ${firebaseJsonPath}`
-      );
-    }
+    const config = readFirebaseJson(firebaseJsonPath);
     const hasHosting = !!config.hosting;
     const hasFunctions = !!config.functions && Array.isArray(config.functions);
     const hasFirestoreRules = !!config.firestore?.rules && pathExists(joinPath(appDir, config.firestore.rules));
@@ -16276,9 +17196,7 @@ function validateFirebaseJson(appDir) {
       hasFirestoreRules: false,
       hasFirestoreIndexes: false,
       hasStorageRules: false,
-      errors: [
-        `Invalid JSON format: ${error2 instanceof DoNotDevError ? error2.message : error2 instanceof Error ? error2.message : String(error2)}`
-      ]
+      errors: [`Invalid firebase.json: ${getErrorMessage(error2)}`]
     };
   }
 }
@@ -16304,11 +17222,11 @@ function readStagingProject(startDir) {
     const firebasercPath = joinPath(current, ".firebaserc");
     if (pathExists(firebasercPath)) {
       try {
-        const firebaserc = readSync(firebasercPath, { format: "json" });
+        const firebaserc = readFirebaserc(firebasercPath);
         if (firebaserc?.projects?.staging) {
           return firebaserc.projects.staging;
         }
-      } catch {
+      } catch (error2) {
       }
     }
     const parent = joinPath(current, "..");
@@ -16346,7 +17264,7 @@ How to fix:
     if (shouldOpen) {
       try {
         const openCommand = process.platform === "win32" ? "start" : process.platform === "darwin" ? "open" : "xdg-open";
-        spawnSync4(openCommand, [consoleUrl], { shell: true });
+        spawnSync5(openCommand, [consoleUrl], { shell: true });
         log.success("Opening Firebase Console...");
       } catch {
         log.warn("Could not open browser. Please open the URL manually.");
@@ -16394,12 +17312,85 @@ function clearFirebaseCache(appDir) {
   }
 }
 
+// packages/tooling/src/utils/provider-detection.ts
+init_utils();
+init_pathResolver();
+function detectProvider(appDir) {
+  const firebaseJsonPath = joinPath(appDir, "firebase.json");
+  const supabaseDir = joinPath(appDir, "supabase");
+  const supabaseConfigPath = joinPath(supabaseDir, "config.toml");
+  const supabaseFunctionsDir = joinPath(supabaseDir, "functions");
+  const supabaseMigrationsDir = joinPath(supabaseDir, "migrations");
+  const hasFirebase = pathExists(firebaseJsonPath);
+  const hasSupabase = pathExists(supabaseDir) || pathExists(supabaseConfigPath);
+  let provider = "unknown";
+  if (hasFirebase && hasSupabase) {
+    provider = "both";
+  } else if (hasFirebase) {
+    provider = "firebase";
+  } else if (hasSupabase) {
+    provider = "supabase";
+  }
+  let firebaseConfig;
+  if (hasFirebase) {
+    try {
+      const config = readSync(firebaseJsonPath, { format: "json" });
+      if (config && typeof config === "object") {
+        const firebaseConfigObj = config;
+        firebaseConfig = {
+          projectId: firebaseConfigObj.projectId,
+          hasHosting: !!firebaseConfigObj.hosting,
+          hasFunctions: !!firebaseConfigObj.functions,
+          hasFirestoreRules: !!firebaseConfigObj.firestore?.rules,
+          hasStorageRules: !!firebaseConfigObj.storage?.rules
+        };
+      }
+    } catch {
+      firebaseConfig = {
+        hasHosting: false,
+        hasFunctions: false,
+        hasFirestoreRules: false,
+        hasStorageRules: false
+      };
+    }
+  }
+  let supabaseConfig;
+  if (hasSupabase) {
+    let url;
+    try {
+      const envPath = joinPath(appDir, ".env");
+      if (pathExists(envPath)) {
+        const envContent = readSync(envPath);
+        const urlMatch = envContent.match(/VITE_SUPABASE_URL=(.+)/);
+        if (urlMatch && urlMatch[1]) {
+          url = urlMatch[1].trim();
+        }
+      }
+    } catch {
+    }
+    supabaseConfig = {
+      url,
+      hasFunctions: pathExists(supabaseFunctionsDir),
+      hasMigrations: pathExists(supabaseMigrationsDir)
+    };
+  }
+  return {
+    provider,
+    hasFirebase,
+    hasSupabase,
+    firebaseConfig,
+    supabaseConfig
+  };
+}
+
 // packages/tooling/src/apps/deploy.ts
+init_cli_input();
 init_cli_output();
 init_cli_output();
+init_cli_tools();
 init_errors();
 init_pathResolver();
-async function main(options = {}) {
+async function main2(options = {}) {
   const isStaging = options.staging ?? false;
   const config = {
     app: options.app,
@@ -16407,27 +17398,43 @@ async function main(options = {}) {
     verbose: options.verbose ?? false,
     skipBuild: options.skipBuild ?? false,
     debug: options.debug ?? false,
-    force: options.force ?? false,
+    force: options.force,
     staging: isStaging
   };
   try {
-    Ie(isStaging ? "DoNotDev Staging Deployment" : "DoNotDev Firebase Deployment");
-    requireCLI(
-      "firebase",
-      "This script uses service account authentication.\nThe Firebase CLI is only needed as a deployment tool, not for authentication."
+    const projectRoot = process.cwd();
+    const providerInfo = detectProvider(projectRoot);
+    Ie(
+      isStaging ? "DoNotDev Staging Deployment" : providerInfo.provider === "supabase" ? "DoNotDev Supabase Deployment" : providerInfo.provider === "both" ? "DoNotDev Deployment (Firebase + Supabase)" : "DoNotDev Firebase Deployment"
     );
+    if (providerInfo.hasFirebase) {
+      requireCLI(
+        CLI_TOOLS.FIREBASE,
+        "This script uses service account authentication.\nThe Firebase CLI is only needed as a deployment tool, not for authentication."
+      );
+    }
+    if (providerInfo.hasSupabase && providerInfo.supabaseConfig?.hasFunctions) {
+      requireCLI(
+        CLI_TOOLS.SUPABASE,
+        "Supabase CLI is required to deploy Edge Functions.\nInstall: https://supabase.com/docs/guides/cli"
+      );
+    }
     const COMMAND_NAMES = ["deploy", "staging", "uat"];
     const cliArgs = process.argv.slice(2);
     let appName = config.app || (cliArgs[0] && !cliArgs[0].startsWith("--") && !COMMAND_NAMES.includes(cliArgs[0]) ? cliArgs[0] : void 0);
     if (!appName) {
       const availableApps = detectAvailableApps();
       if (availableApps.length === 0) {
-        log.info("No apps with firebase.json found in current directory.");
-        log.info(
-          "To deploy, ensure your app has a firebase.json configuration."
-        );
-        log.info("Run from a DoNotDev project, or create one with: dndev init");
-        return;
+        if (providerInfo.hasSupabase && !providerInfo.hasFirebase) {
+          log.info("Supabase project detected. Deploying Supabase resources...");
+        } else {
+          log.info("No apps with firebase.json or supabase/ directory found.");
+          log.info(
+            "To deploy, ensure your app has a firebase.json or supabase/ configuration."
+          );
+          log.info("Run from a DoNotDev project, or create one with: dndev init");
+          return;
+        }
       }
       if (availableApps.length === 1) {
         appName = availableApps[0];
@@ -16443,55 +17450,92 @@ async function main(options = {}) {
       log.error("App name is required but was not provided.");
       process.exit(1);
     }
-    const appDir = detectAppDir(appName);
+    const appDir = appName ? detectAppDir(appName) : projectRoot;
+    const appProviderInfo = detectProvider(appDir);
+    const hasVercelConfig = pathExists(joinPath(appDir, "vercel.json"));
     let deploymentType = config.deploymentType;
     if (!deploymentType) {
-      const firebaseConfig2 = validateFirebaseJson(appDir);
       const choices = [];
-      if (firebaseConfig2.hasHosting) {
-        choices.push({
-          title: "Frontend only",
-          value: "frontend",
-          hint: "Deploy hosting"
-        });
-      }
-      if (firebaseConfig2.hasFunctions) {
-        choices.push({
-          title: "Functions only",
-          value: "functions",
-          hint: "Deploy cloud functions"
-        });
-      }
-      const hasRules = firebaseConfig2.hasFirestoreRules || firebaseConfig2.hasFirestoreIndexes || firebaseConfig2.hasStorageRules;
-      if (hasRules) {
-        choices.push({
-          title: "Rules only",
-          value: "rules",
-          hint: "Deploy Firestore/Storage rules"
-        });
+      if (appProviderInfo.hasFirebase && appProviderInfo.firebaseConfig) {
+        const fbConfig = appProviderInfo.firebaseConfig;
+        if (fbConfig.hasHosting) {
+          choices.push({
+            title: "Frontend only (Firebase Hosting)",
+            value: "frontend",
+            hint: "Deploy Firebase hosting"
+          });
+        }
+        if (fbConfig.hasFunctions) {
+          choices.push({
+            title: "Functions only (Firebase Cloud Functions)",
+            value: "functions",
+            hint: "Deploy Firebase cloud functions"
+          });
+        }
+        const hasRules = fbConfig.hasFirestoreRules || fbConfig.hasStorageRules;
+        if (hasRules) {
+          choices.push({
+            title: "Rules only (Firestore/Storage)",
+            value: "rules",
+            hint: "Deploy Firestore/Storage rules"
+          });
+        }
+        if (fbConfig.hasHosting && fbConfig.hasFunctions) {
+          choices.push({
+            title: "Frontend + Functions (Firebase)",
+            value: "both",
+            hint: "Deploy Firebase hosting and functions"
+          });
+        }
+        const deployableKindsCount = [
+          fbConfig.hasHosting,
+          fbConfig.hasFunctions,
+          hasRules
+        ].filter(Boolean).length;
+        if (deployableKindsCount > 1) {
+          choices.push({
+            title: "All (Firebase)",
+            value: "all",
+            hint: "Deploy everything Firebase (hosting, functions, rules)"
+          });
+        }
       }
-      if (firebaseConfig2.hasHosting && firebaseConfig2.hasFunctions) {
+      if (hasVercelConfig) {
+        const fbFrontendIdx = choices.findIndex(
+          (c) => c.value === "frontend" && c.title.includes("Firebase")
+        );
+        if (fbFrontendIdx !== -1) choices.splice(fbFrontendIdx, 1);
+        const fbBothIdx = choices.findIndex(
+          (c) => c.value === "both" && c.title.includes("Firebase")
+        );
+        if (fbBothIdx !== -1) choices.splice(fbBothIdx, 1);
         choices.push({
-          title: "Frontend + Functions",
-          value: "both",
-          hint: "Deploy hosting and functions"
+          title: "Frontend only (Vercel)",
+          value: "frontend",
+          hint: "Deploy frontend to Vercel"
         });
+        const hasFunctions = appProviderInfo.hasFirebase && appProviderInfo.firebaseConfig?.hasFunctions || appProviderInfo.hasSupabase && appProviderInfo.supabaseConfig?.hasFunctions;
+        if (hasFunctions) {
+          choices.push({
+            title: "Frontend + Functions (Vercel + backend)",
+            value: "both",
+            hint: "Deploy frontend to Vercel and functions to backend provider"
+          });
+        }
       }
-      const deployableKindsCount = [
-        firebaseConfig2.hasHosting,
-        firebaseConfig2.hasFunctions,
-        hasRules
-      ].filter(Boolean).length;
-      if (deployableKindsCount > 1) {
-        choices.push({
-          title: "All",
-          value: "all",
-          hint: "Deploy everything (hosting, functions, rules)"
-        });
+      if (appProviderInfo.hasSupabase && appProviderInfo.supabaseConfig) {
+        const sbConfig = appProviderInfo.supabaseConfig;
+        if (sbConfig.hasFunctions) {
+          choices.push({
+            title: "Edge Functions only (Supabase)",
+            value: "functions",
+            hint: "Deploy Supabase Edge Functions"
+          });
+        }
       }
       if (choices.length === 0) {
         log.error(
-          "No deployment targets found. firebase.json must have hosting, functions, or rules configuration."
+          "No deployment targets found. Ensure your project has:\n  - Firebase: firebase.json with hosting/functions/rules\n  - Supabase: supabase/functions/ directory"
         );
         process.exit(1);
       }
@@ -16505,71 +17549,78 @@ async function main(options = {}) {
         );
       }
     }
-    const serviceAccountResult = validateServiceAccount(appDir, { staging: isStaging });
-    if (!serviceAccountResult.valid) {
-      const firebaseConfig2 = validateFirebaseJson(appDir);
-      await showServiceAccountError(
-        serviceAccountResult.info,
-        firebaseConfig2.projectId
-      );
-      process.exit(1);
-    }
-    const serviceAccountPath = normalizePath(serviceAccountResult.info.path);
-    let projectId = config.project;
-    if (!projectId && isStaging) {
-      projectId = readStagingProject(appDir) ?? void 0;
-      if (!projectId) {
-        log.error(
-          'Staging project not found. Add "staging" alias to .firebaserc:\n  { "projects": { "default": "my-app", "staging": "my-app-uat" } }'
+    let serviceAccountPath;
+    let projectId;
+    const needsFirebase = appProviderInfo.hasFirebase && (deploymentType === "frontend" && !hasVercelConfig || deploymentType === "functions" || deploymentType === "rules" || deploymentType === "both" || deploymentType === "all");
+    if (needsFirebase) {
+      const serviceAccountResult = validateServiceAccount(appDir, {
+        staging: isStaging
+      });
+      if (!serviceAccountResult.valid) {
+        const firebaseConfig2 = validateFirebaseJson(appDir);
+        await showServiceAccountError(
+          serviceAccountResult.info,
+          firebaseConfig2.projectId
         );
         process.exit(1);
       }
-    }
-    if (!projectId) {
-      projectId = serviceAccountResult.info.projectId || (() => {
-        const firebaseConfig2 = validateFirebaseJson(appDir);
-        return firebaseConfig2.projectId;
-      })();
-    }
-    if (!projectId) {
-      const inputProjectId = await askForInput(
-        "Firebase project ID not detected. Please enter it:"
-      );
-      if (!inputProjectId) {
-        log.error("Project ID is required for deployment.");
+      serviceAccountPath = normalizePath(serviceAccountResult.info.path);
+      projectId = config.project;
+      if (!projectId && isStaging) {
+        projectId = readStagingProject(appDir) ?? void 0;
+        if (!projectId) {
+          log.error(
+            'Staging project not found. Add "staging" alias to .firebaserc:\n  { "projects": { "default": "my-app", "staging": "my-app-uat" } }'
+          );
+          process.exit(1);
+        }
+      }
+      if (!projectId) {
+        const fallbackConfig = validateFirebaseJson(appDir);
+        projectId = serviceAccountResult.info.projectId || fallbackConfig.projectId;
+      }
+      if (!projectId) {
+        const inputProjectId = await askForInput(
+          "Firebase project ID not detected. Please enter it:"
+        );
+        if (!inputProjectId) {
+          log.error("Project ID is required for deployment.");
+          process.exit(1);
+        }
+        config.project = inputProjectId;
+      } else {
+        config.project = projectId;
+      }
+      const firebaseConfig = await validateFirebaseJson(appDir);
+      if (!firebaseConfig.valid) {
+        showFirebaseJsonError(firebaseConfig.errors, appDir, deploymentType);
         process.exit(1);
       }
-      config.project = inputProjectId;
-    } else {
-      config.project = projectId;
-    }
-    const firebaseConfig = validateFirebaseJson(appDir);
-    if (!firebaseConfig.valid) {
-      showFirebaseJsonError(firebaseConfig.errors, appDir, deploymentType);
-      process.exit(1);
     }
-    const shouldDeployFrontend = (deploymentType === "frontend" || deploymentType === "both" || deploymentType === "all") && firebaseConfig.hasHosting;
-    const shouldDeployFunctions = (deploymentType === "functions" || deploymentType === "both" || deploymentType === "all") && firebaseConfig.hasFunctions;
-    const shouldDeployRules = (deploymentType === "rules" || deploymentType === "all") && (firebaseConfig.hasFirestoreRules || firebaseConfig.hasFirestoreIndexes || firebaseConfig.hasStorageRules);
-    if (deploymentType === "frontend" && !firebaseConfig.hasHosting) {
+    const shouldDeployFirebaseFrontend = appProviderInfo.hasFirebase && appProviderInfo.firebaseConfig?.hasHosting && !hasVercelConfig && (deploymentType === "frontend" || deploymentType === "both" || deploymentType === "all");
+    const shouldDeployFirebaseFunctions = appProviderInfo.hasFirebase && appProviderInfo.firebaseConfig?.hasFunctions && (deploymentType === "functions" || deploymentType === "both" || deploymentType === "all");
+    const shouldDeployFirebaseRules = appProviderInfo.hasFirebase && (deploymentType === "rules" || deploymentType === "all") && (appProviderInfo.firebaseConfig?.hasFirestoreRules || appProviderInfo.firebaseConfig?.hasStorageRules);
+    const shouldDeploySupabaseFunctions = appProviderInfo.hasSupabase && appProviderInfo.supabaseConfig?.hasFunctions && deploymentType === "functions";
+    const shouldDeployVercelFrontend = hasVercelConfig && (deploymentType === "frontend" || deploymentType === "both" || deploymentType === "all");
+    if (deploymentType === "frontend" && !shouldDeployFirebaseFrontend && !shouldDeployVercelFrontend) {
       log.error(
-        "firebase.json does not contain hosting configuration, but frontend deployment was requested."
+        "No hosting configuration found. Ensure firebase.json has hosting config, or (for Supabase apps) vercel.json exists."
       );
       process.exit(1);
     }
-    if (deploymentType === "functions" && !firebaseConfig.hasFunctions) {
+    if (deploymentType === "functions" && !shouldDeployFirebaseFunctions && !shouldDeploySupabaseFunctions) {
       log.error(
-        "firebase.json does not contain functions configuration, but functions deployment was requested."
+        "No functions configuration found. Ensure firebase.json has functions config or supabase/functions/ directory exists."
       );
       process.exit(1);
     }
-    if (deploymentType === "rules" && !shouldDeployRules) {
+    if (deploymentType === "rules" && !shouldDeployFirebaseRules) {
       log.error(
         "firebase.json does not contain rules configuration, but rules deployment was requested."
       );
       process.exit(1);
     }
-    if (shouldDeployFrontend) {
+    if (shouldDeployFirebaseFrontend || shouldDeployVercelFrontend) {
       const buildStatus = validateBuild(appDir);
       let shouldBuild = false;
       if (!buildStatus.exists || buildStatus.isEmpty) {
@@ -16596,9 +17647,11 @@ async function main(options = {}) {
       if (shouldBuild) {
         const s = Y2();
         const buildCmd = isStaging ? "bun run build -- --mode staging" : "bun run build";
-        s.start(isStaging ? "Building (staging mode)..." : "Building application...");
+        s.start(
+          isStaging ? "Building (staging mode)..." : "Building application..."
+        );
         try {
-          execSync3(buildCmd, {
+          execSync4(buildCmd, {
             cwd: appDir,
             stdio: "inherit",
             env: {
@@ -16613,19 +17666,52 @@ async function main(options = {}) {
         }
       }
     }
-    clearFirebaseCache(appDir);
+    if (appProviderInfo.hasFirebase) {
+      clearFirebaseCache(appDir);
+    }
     const envLabel = isStaging ? " (STAGING)" : "";
-    Me(
-      `App: ${appName}
-Project: ${config.project}${envLabel}
-Deployment: ${deploymentType}
-Service Account: ${serviceAccountResult.info.clientEmail}`,
-      "Deployment Configuration"
-    );
-    if (shouldDeployFrontend) {
+    const providerLabel = appProviderInfo.provider === "both" ? " (Firebase + Supabase)" : appProviderInfo.provider === "supabase" ? " (Supabase)" : " (Firebase)";
+    const configNote = [
+      `App: ${appName || "root"}`,
+      ...config.project ? [`Project: ${config.project}${envLabel}`] : [],
+      `Provider: ${appProviderInfo.provider}${providerLabel}`,
+      `Deployment: ${deploymentType}`,
+      ...serviceAccountPath ? [`Service Account: ${serviceAccountPath}`] : []
+    ].join("\n");
+    Me(configNote, "Deployment Configuration");
+    if (shouldDeployVercelFrontend) {
+      requireCLI(
+        CLI_TOOLS.VERCEL,
+        "Vercel CLI is required to deploy the frontend.\nInstall: npm i -g vercel or use npx vercel"
+      );
+    }
+    if (shouldDeployFirebaseFrontend && serviceAccountPath && config.project) {
       await deployFrontend(appDir, serviceAccountPath, config.project, config);
     }
-    if (shouldDeployFunctions) {
+    if (shouldDeployVercelFrontend) {
+      await deployVercelFrontend(appDir, config);
+    }
+    if (shouldDeployFirebaseFunctions && serviceAccountPath && config.project) {
+      const functionsEnvPath = joinPath(appDir, "functions", ".env");
+      if (pathExists(functionsEnvPath)) {
+        const shouldSync = await askForConfirmation(
+          "Sync runtime secrets (functions/.env) before deploying?"
+        );
+        if (shouldSync) {
+          const { main: syncSecrets } = await Promise.resolve().then(() => (init_sync_secrets(), sync_secrets_exports));
+          const syncResult = await syncSecrets({
+            envFile: normalizePath(functionsEnvPath),
+            projectId: config.project,
+            dryRun: false,
+            verbose: config.verbose
+          });
+          if (syncResult !== 0) {
+            log.warn(
+              "Secrets sync returned non-zero. Functions may not have latest secrets at runtime."
+            );
+          }
+        }
+      }
       await deployFunctions(
         appDir,
         serviceAccountPath,
@@ -16633,13 +17719,18 @@ Service Account: ${serviceAccountResult.info.clientEmail}`,
         config
       );
     }
-    if (shouldDeployRules) {
+    if (shouldDeployFirebaseRules && serviceAccountPath && config.project && appProviderInfo.firebaseConfig) {
       await deployRules(appDir, serviceAccountPath, config.project, config, {
-        firestore: firebaseConfig.hasFirestoreRules,
-        firestoreIndexes: firebaseConfig.hasFirestoreIndexes,
-        storage: firebaseConfig.hasStorageRules
+        firestore: appProviderInfo.firebaseConfig.hasFirestoreRules,
+        firestoreIndexes: false,
+        // TODO: detect this
+        storage: appProviderInfo.firebaseConfig.hasStorageRules
       });
     }
+    if (shouldDeploySupabaseFunctions) {
+      const { deploySupabaseFunctions: deploySupabaseFunctions2 } = await Promise.resolve().then(() => (init_deploy_supabase_functions(), deploy_supabase_functions_exports));
+      await deploySupabaseFunctions2(appDir, config);
+    }
     Se("Deployment completed successfully!");
   } catch (error2) {
     if (error2 instanceof DoNotDevError) {
@@ -16656,7 +17747,7 @@ Service Account: ${serviceAccountResult.info.clientEmail}`,
   }
 }
 export {
-  main
+  main2 as main
 };
 /*! Bundled license information: