@donotdev/cli 0.0.19 → 0.0.21

package/dist/index.js

@@ -3351,9 +3351,9 @@ var require_parse2 = __commonJS({
                 const idx = prev.value.lastIndexOf("[");
                 const pre = prev.value.slice(0, idx);
                 const rest2 = prev.value.slice(idx + 2);
-                const posix = POSIX_REGEX_SOURCE[rest2];
-                if (posix) {
-                  prev.value = pre + posix;
+                const posix2 = POSIX_REGEX_SOURCE[rest2];
+                if (posix2) {
+                  prev.value = pre + posix2;
                   state.backtrack = true;
                   advance();
                   if (!bos.output && tokens.indexOf(prev) === 1) {
@@ -3875,7 +3875,7 @@ var require_picomatch = __commonJS({
         throw new TypeError("Expected pattern to be a non-empty string");
       }
       const opts = options || {};
-      const posix = utils.isWindows(options);
+      const posix2 = utils.isWindows(options);
       const regex = isState ? picomatch.compileRe(glob2, options) : picomatch.makeRe(glob2, options, false, true);
       const state = regex.state;
       delete regex.state;
@@ -3885,8 +3885,8 @@ var require_picomatch = __commonJS({
         isIgnored = picomatch(opts.ignore, ignoreOpts, returnState);
       }
       const matcher = (input, returnObject = false) => {
-        const { isMatch, match, output } = picomatch.test(input, regex, options, { glob: glob2, posix });
-        const result = { glob: glob2, state, regex, posix, input, output, match, isMatch };
+        const { isMatch, match, output } = picomatch.test(input, regex, options, { glob: glob2, posix: posix2 });
+        const result = { glob: glob2, state, regex, posix: posix2, input, output, match, isMatch };
         if (typeof opts.onResult === "function") {
           opts.onResult(result);
         }
@@ -3911,7 +3911,7 @@ var require_picomatch = __commonJS({
       }
       return matcher;
     };
-    picomatch.test = (input, regex, options, { glob: glob2, posix } = {}) => {
+    picomatch.test = (input, regex, options, { glob: glob2, posix: posix2 } = {}) => {
       if (typeof input !== "string") {
         throw new TypeError("Expected input to be a string");
       }
@@ -3919,7 +3919,7 @@ var require_picomatch = __commonJS({
         return { isMatch: false, output: "" };
       }
       const opts = options || {};
-      const format = opts.format || (posix ? utils.toPosixSlashes : null);
+      const format = opts.format || (posix2 ? utils.toPosixSlashes : null);
       let match = input === glob2;
       let output = match && format ? format(input) : input;
       if (match === false) {
@@ -3928,14 +3928,14 @@ var require_picomatch = __commonJS({
       }
       if (match === false || opts.capture === true) {
         if (opts.matchBase === true || opts.basename === true) {
-          match = picomatch.matchBase(input, regex, options, posix);
+          match = picomatch.matchBase(input, regex, options, posix2);
         } else {
           match = regex.exec(output);
         }
       }
       return { isMatch: Boolean(match), match, output };
     };
-    picomatch.matchBase = (input, glob2, options, posix = utils.isWindows(options)) => {
+    picomatch.matchBase = (input, glob2, options, posix2 = utils.isWindows(options)) => {
       const regex = glob2 instanceof RegExp ? glob2 : picomatch.makeRe(glob2, options);
       return regex.test(path.basename(input));
     };
@@ -4126,9 +4126,9 @@ var require_micromatch = __commonJS({
       return [].concat(patterns).every((p2) => picomatch(p2, options)(str));
     };
     micromatch.capture = (glob2, input, options) => {
-      let posix = utils.isWindows(options);
+      let posix2 = utils.isWindows(options);
       let regex = picomatch.makeRe(String(glob2), { ...options, capture: true });
-      let match = regex.exec(posix ? utils.toPosixSlashes(input) : input);
+      let match = regex.exec(posix2 ? utils.toPosixSlashes(input) : input);
       if (match) {
         return match.slice(1).map((v2) => v2 === void 0 ? "" : v2);
       }
@@ -4308,15 +4308,15 @@ var require_pattern = __commonJS({
     exports.removeDuplicateSlashes = removeDuplicateSlashes;
     function partitionAbsoluteAndRelative(patterns) {
       const absolute = [];
-      const relative3 = [];
+      const relative4 = [];
       for (const pattern of patterns) {
         if (isAbsolute2(pattern)) {
           absolute.push(pattern);
         } else {
-          relative3.push(pattern);
+          relative4.push(pattern);
         }
       }
-      return [absolute, relative3];
+      return [absolute, relative4];
     }
     exports.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
     function isAbsolute2(pattern) {
@@ -4626,7 +4626,7 @@ var require_async = __commonJS({
           callSuccessCallback(callback, lstat);
           return;
         }
-        settings.fs.stat(path, (statError, stat) => {
+        settings.fs.stat(path, (statError, stat2) => {
           if (statError !== null) {
             if (settings.throwErrorOnBrokenSymbolicLink) {
               callFailureCallback(callback, statError);
@@ -4636,9 +4636,9 @@ var require_async = __commonJS({
             return;
           }
           if (settings.markSymbolicLink) {
-            stat.isSymbolicLink = () => true;
+            stat2.isSymbolicLink = () => true;
           }
-          callSuccessCallback(callback, stat);
+          callSuccessCallback(callback, stat2);
         });
       });
     }
@@ -4665,11 +4665,11 @@ var require_sync = __commonJS({
         return lstat;
       }
       try {
-        const stat = settings.fs.statSync(path);
+        const stat2 = settings.fs.statSync(path);
         if (settings.markSymbolicLink) {
-          stat.isSymbolicLink = () => true;
+          stat2.isSymbolicLink = () => true;
         }
-        return stat;
+        return stat2;
       } catch (error2) {
         if (!settings.throwErrorOnBrokenSymbolicLink) {
           return lstat;
@@ -4739,14 +4739,14 @@ var require_out = __commonJS({
     var sync = require_sync();
     var settings_1 = require_settings();
     exports.Settings = settings_1.default;
-    function stat(path, optionsOrSettingsOrCallback, callback) {
+    function stat2(path, optionsOrSettingsOrCallback, callback) {
       if (typeof optionsOrSettingsOrCallback === "function") {
         async.read(path, getSettings(), optionsOrSettingsOrCallback);
         return;
       }
       async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
     }
-    exports.stat = stat;
+    exports.stat = stat2;
     function statSync3(path, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path, settings);
@@ -4916,7 +4916,7 @@ var require_async2 = __commonJS({
         readdirWithFileTypes(directory, settings, callback);
         return;
       }
-      readdir2(directory, settings, callback);
+      readdir3(directory, settings, callback);
     }
     exports.read = read2;
     function readdirWithFileTypes(directory, settings, callback) {
@@ -4965,7 +4965,7 @@ var require_async2 = __commonJS({
         });
       };
     }
-    function readdir2(directory, settings, callback) {
+    function readdir3(directory, settings, callback) {
       settings.fs.readdir(directory, (readdirError, names) => {
         if (readdirError !== null) {
           callFailureCallback(callback, readdirError);
@@ -5000,7 +5000,7 @@ var require_async2 = __commonJS({
         });
       });
     }
-    exports.readdir = readdir2;
+    exports.readdir = readdir3;
     function callFailureCallback(callback, error2) {
       callback(error2);
     }
@@ -5025,7 +5025,7 @@ var require_sync2 = __commonJS({
       if (!settings.stats && constants_1.IS_SUPPORT_READDIR_WITH_FILE_TYPES) {
         return readdirWithFileTypes(directory, settings);
       }
-      return readdir2(directory, settings);
+      return readdir3(directory, settings);
     }
     exports.read = read2;
     function readdirWithFileTypes(directory, settings) {
@@ -5050,7 +5050,7 @@ var require_sync2 = __commonJS({
       });
     }
     exports.readdirWithFileTypes = readdirWithFileTypes;
-    function readdir2(directory, settings) {
+    function readdir3(directory, settings) {
       const names = settings.fs.readdirSync(directory);
       return names.map((name) => {
         const entryPath = common.joinPathSegments(directory, name, settings.pathSegmentSeparator);
@@ -5066,7 +5066,7 @@ var require_sync2 = __commonJS({
         return entry;
       });
     }
-    exports.readdir = readdir2;
+    exports.readdir = readdir3;
   }
 });
 
@@ -6628,19 +6628,19 @@ var require_out4 = __commonJS({
         return utils.path.convertPathToPattern(source);
       }
       FastGlob2.convertPathToPattern = convertPathToPattern;
-      let posix;
-      (function(posix2) {
+      let posix2;
+      (function(posix3) {
         function escapePath2(source) {
           assertPatternsInput(source);
           return utils.path.escapePosixPath(source);
         }
-        posix2.escapePath = escapePath2;
+        posix3.escapePath = escapePath2;
         function convertPathToPattern2(source) {
           assertPatternsInput(source);
           return utils.path.convertPosixPathToPattern(source);
         }
-        posix2.convertPathToPattern = convertPathToPattern2;
-      })(posix = FastGlob2.posix || (FastGlob2.posix = {}));
+        posix3.convertPathToPattern = convertPathToPattern2;
+      })(posix2 = FastGlob2.posix || (FastGlob2.posix = {}));
       let win32;
       (function(win322) {
         function escapePath2(source) {
@@ -7219,7 +7219,7 @@ var init_PathResolver = __esm({
         }
         const detectedFormat = this._detectFormat(filePath, format);
         let writeContent;
-        if (Buffer2.isBuffer(content)) {
+        if (Buffer.isBuffer(content)) {
           writeContent = content;
         } else if (detectedFormat === "json" && typeof content === "object") {
           writeContent = JSON.stringify(content, null, 2);
@@ -7228,7 +7228,7 @@ var init_PathResolver = __esm({
         }
         try {
           return await safeExecuteAsync(async () => {
-            if (Buffer2.isBuffer(writeContent)) {
+            if (Buffer.isBuffer(writeContent)) {
               await fs.promises.writeFile(normalizedPath, writeContent);
             } else {
               await fs.promises.writeFile(normalizedPath, writeContent, "utf8");
@@ -7280,7 +7280,7 @@ var init_PathResolver = __esm({
         }
         const detectedFormat = this._detectFormat(filePath, format);
         let writeContent;
-        if (Buffer2.isBuffer(content)) {
+        if (Buffer.isBuffer(content)) {
           writeContent = content;
         } else if (detectedFormat === "json" && typeof content === "object") {
           writeContent = JSON.stringify(content, null, 2);
@@ -7288,7 +7288,7 @@ var init_PathResolver = __esm({
           writeContent = String(content);
         }
         try {
-          if (Buffer2.isBuffer(writeContent)) {
+          if (Buffer.isBuffer(writeContent)) {
             fs.writeFileSync(normalizedPath, writeContent);
           } else {
             fs.writeFileSync(normalizedPath, writeContent, "utf8");
@@ -8181,7 +8181,7 @@ async function isBinaryFile(filePath) {
   try {
     let fileHandle = null;
     try {
-      const buffer = Buffer2.alloc(4096);
+      const buffer = Buffer.alloc(4096);
       const fs2 = await import("node:fs");
       fileHandle = await fs2.promises.open(filePath, "r");
       const { bytesRead } = await fileHandle.read(buffer, 0, 4096, 0);
@@ -8359,8 +8359,8 @@ var init_pathResolver = __esm({
       if (normalizedTarget === normalizedRoot) {
         return true;
       }
-      const relative3 = getRelativePathBetween(normalizedRoot, normalizedTarget);
-      return Boolean(relative3) && !relative3.startsWith("../") && !relative3.startsWith("/") && !relative3.includes("..");
+      const relative4 = getRelativePathBetween(normalizedRoot, normalizedTarget);
+      return Boolean(relative4) && !relative4.startsWith("../") && !relative4.startsWith("/") && !relative4.includes("..");
     };
   }
 });
@@ -8491,7 +8491,7 @@ var init_typed_file_operations = __esm({
 });
 
 // packages/tooling/src/bundler/utils.ts
-import { Buffer as Buffer2 } from "node:buffer";
+import { Buffer } from "node:buffer";
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { dirname as dirname3, resolve as resolve3 } from "node:path";
@@ -8508,7 +8508,7 @@ var init_utils = __esm({
       globalThis.require = require2;
       globalThis.__filename = __filename;
       globalThis.__dirname = __dirname;
-      globalThis.Buffer = Buffer2;
+      globalThis.Buffer = Buffer;
       globalThis.process = process;
       if (typeof global === "undefined") {
         globalThis.global = globalThis;
@@ -9016,7 +9016,28 @@ var init_cli_tools = __esm({
   }
 });
 
-// packages/tooling/src/cli/setup/vercel-token.ts
+// packages/tooling/src/utils/secrets-resolver.ts
+function parseEnvFile(filePath) {
+  if (!pathExists(filePath)) return {};
+  const content = readSync(filePath, { format: "text" });
+  if (typeof content !== "string" || !content) return {};
+  const result = {};
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = trimmed.slice(0, eqIdx).trim();
+    let value = trimmed.slice(eqIdx + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (key && value) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
 function readEnvVar(filePath, varName) {
   if (!pathExists(filePath)) return null;
   const content = readSync(filePath, { format: "text" });
@@ -9025,16 +9046,93 @@ function readEnvVar(filePath, varName) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     if (trimmed.startsWith(`${varName}=`)) {
-      const val = trimmed.substring(`${varName}=`.length).trim();
+      let val = trimmed.substring(`${varName}=`.length).trim();
       if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
-        return val.slice(1, -1);
+        val = val.slice(1, -1);
       }
       return val || null;
     }
   }
   return null;
 }
-function resolveVercelVar(appDir, varName) {
+function loadDndevSecrets(projectRoot) {
+  const secretsPath = joinPath(projectRoot, ".dndev.secrets");
+  if (cachedSecretsPath === secretsPath && cachedSecrets) {
+    return cachedSecrets;
+  }
+  cachedSecrets = parseEnvFile(secretsPath);
+  cachedSecretsPath = secretsPath;
+  return cachedSecrets;
+}
+function resolveSecret(name, projectRoot, opts) {
+  const appDir = opts?.appDir ?? projectRoot;
+  const envValue = process.env[name];
+  if (envValue) {
+    return { value: envValue, source: "process.env" };
+  }
+  const secrets = loadDndevSecrets(projectRoot);
+  if (secrets[name]) {
+    return { value: secrets[name], source: ".dndev.secrets" };
+  }
+  if (name === "SUPABASE_SECRET_KEY" && secrets["SUPABASE_SERVICE_ROLE_KEY"]) {
+    return {
+      value: secrets["SUPABASE_SERVICE_ROLE_KEY"],
+      source: ".dndev.secrets"
+    };
+  }
+  const legacyPaths = LEGACY_PATHS[name];
+  if (legacyPaths) {
+    for (const relPath of legacyPaths) {
+      const fullPath = joinPath(appDir, relPath);
+      const value = readEnvVar(fullPath, name);
+      if (value) {
+        if (!opts?.silent && !warnedLegacy.has(name)) {
+          warnedLegacy.add(name);
+          log.warn(
+            `${name} found in ${relPath} (legacy). Move it to .dndev.secrets at project root.`
+          );
+        }
+        return { value, source: "legacy", legacyPath: relPath };
+      }
+      if (name === "SUPABASE_SECRET_KEY") {
+        const aliasValue = readEnvVar(fullPath, "SUPABASE_SERVICE_ROLE_KEY");
+        if (aliasValue) {
+          if (!opts?.silent && !warnedLegacy.has(name)) {
+            warnedLegacy.add(name);
+            log.warn(
+              `${name} found in ${relPath} (legacy). Move it to .dndev.secrets at project root.`
+            );
+          }
+          return { value: aliasValue, source: "legacy", legacyPath: relPath };
+        }
+      }
+    }
+  }
+  return null;
+}
+var LEGACY_PATHS, warnedLegacy, cachedSecretsPath, cachedSecrets;
+var init_secrets_resolver = __esm({
+  "packages/tooling/src/utils/secrets-resolver.ts"() {
+    "use strict";
+    init_utils();
+    init_pathResolver();
+    init_cli_output();
+    LEGACY_PATHS = {
+      VERCEL_TOKEN: [".env.local"],
+      SUPABASE_SECRET_KEY: ["supabase/functions/.env", "functions/.env"],
+      SUPABASE_DB_URL: ["supabase/functions/.env", "functions/.env"],
+      SUPABASE_ACCESS_TOKEN: ["supabase/functions/.env", "functions/.env"],
+      STRIPE_SECRET_KEY: ["supabase/functions/.env", "functions/.env"],
+      STRIPE_WEBHOOK_SECRET: ["supabase/functions/.env", "functions/.env"]
+    };
+    warnedLegacy = /* @__PURE__ */ new Set();
+    cachedSecretsPath = null;
+    cachedSecrets = null;
+  }
+});
+
+// packages/tooling/src/cli/setup/vercel-token.ts
+function resolvePerAppVar(appDir, varName) {
   if (process.env[varName]) return process.env[varName];
   const fromLocal = readEnvVar(joinPath(appDir, ".env.local"), varName);
   if (fromLocal) return fromLocal;
@@ -9042,10 +9140,11 @@ function resolveVercelVar(appDir, varName) {
   if (fromEnv) return fromEnv;
   return null;
 }
-function resolveVercelCredentials(appDir) {
-  const token = resolveVercelVar(appDir, "VERCEL_TOKEN");
-  const orgId = resolveVercelVar(appDir, "VERCEL_ORG_ID");
-  const projectId = resolveVercelVar(appDir, "VERCEL_PROJECT_ID");
+function resolveVercelCredentials(appDir, projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const token = resolveSecret("VERCEL_TOKEN", root, { appDir })?.value ?? null;
+  const orgId = resolvePerAppVar(appDir, "VERCEL_ORG_ID");
+  const projectId = resolvePerAppVar(appDir, "VERCEL_PROJECT_ID");
   const missing = [];
   if (!token) missing.push("VERCEL_TOKEN");
   if (!orgId) missing.push("VERCEL_ORG_ID");
@@ -9059,6 +9158,7 @@ var init_vercel_token = __esm({
   "packages/tooling/src/cli/setup/vercel-token.ts"() {
     "use strict";
     init_utils();
+    init_secrets_resolver();
     init_pathResolver();
   }
 });
@@ -16451,10 +16551,14 @@ var init_error_handling = __esm({
 var sync_secrets_exports = {};
 __export(sync_secrets_exports, {
   default: () => sync_secrets_default,
-  main: () => main5
+  detectGitHubRepo: () => detectGitHubRepo,
+  main: () => main5,
+  parseSecretsWithFallback: () => parseSecretsWithFallback,
+  setGitHubSecret: () => setGitHubSecret,
+  uploadServiceAccountToGitHub: () => uploadServiceAccountToGitHub
 });
-import { spawnSync as spawnSync9 } from "node:child_process";
-function parseEnvFile(filePath) {
+import { spawnSync as spawnSync8 } from "node:child_process";
+function parseEnvFile2(filePath) {
   if (!pathExists(filePath)) {
     throw new DoNotDevError(
       `Environment file not found: ${filePath}`,
@@ -16462,30 +16566,22 @@ function parseEnvFile(filePath) {
       { context: { filePath } }
     );
   }
-  const contentRaw = readSync(filePath, { format: "text" });
-  const content = typeof contentRaw === "string" ? contentRaw : null;
-  if (!content) {
-    throw new Error(`Failed to read secrets file: ${filePath}`);
+  const result = parseEnvFile(filePath);
+  if (Object.keys(result).length === 0) {
+    log.debug(`No key-value pairs found in ${filePath}`);
   }
-  const secrets = {};
-  content.split("\n").forEach((line, index) => {
-    const trimmedLine = line.trim();
-    if (!trimmedLine || trimmedLine.startsWith("#")) {
-      return;
-    }
-    const equalIndex = trimmedLine.indexOf("=");
-    if (equalIndex === -1) {
-      log.warn(`Invalid line format at line ${index + 1}: ${trimmedLine}`);
-      return;
-    }
-    const key = trimmedLine.substring(0, equalIndex).trim();
-    const value = trimmedLine.substring(equalIndex + 1).trim();
-    const cleanValue = value.replace(/^["']|["']$/g, "");
-    if (key && cleanValue) {
-      secrets[key] = cleanValue;
+  return result;
+}
+function parseSecretsWithFallback(envFilePath, projectRoot) {
+  const dndevSecretsPath = joinPath(projectRoot, ".dndev.secrets");
+  if (pathExists(dndevSecretsPath)) {
+    const secrets = parseEnvFile(dndevSecretsPath);
+    if (Object.keys(secrets).length > 0) {
+      log.info(`Reading secrets from: ${dndevSecretsPath}`);
+      return secrets;
     }
-  });
-  return secrets;
+  }
+  return parseEnvFile2(envFilePath);
 }
 function detectPlatform() {
   const currentDir = process.cwd();
@@ -16576,8 +16672,8 @@ function detectAppsWithFunctions() {
   try {
     const appsList = readdirSync2(appsDir).filter((item) => {
       const itemPath = joinPath(appsDir, item);
-      const stat = statSync2(itemPath);
-      return stat?.isDirectory() === true;
+      const stat2 = statSync2(itemPath);
+      return stat2?.isDirectory() === true;
     });
     for (const app of appsList) {
       const functionsEnvFile = joinPath(appsDir, app, "functions", ".env");
@@ -16643,7 +16739,7 @@ async function setFirebaseSecret(key, value, projectId, dryRun = false, cwd) {
         NODE_OPTIONS: ""
         // Clear to avoid conflicts
       };
-      const result = spawnSync9(firebaseCmd, args, {
+      const result = spawnSync8(firebaseCmd, args, {
         input: value,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"],
@@ -16736,7 +16832,7 @@ function setVercelSecret(key, value, projectId, dryRun = false) {
     if (projectId) {
       args.push("--project", projectId);
     }
-    const result = spawnSync9("vercel", args, {
+    const result = spawnSync8("vercel", args, {
       input: value,
       encoding: "utf8",
       stdio: ["pipe", "inherit", "inherit"]
@@ -16765,7 +16861,7 @@ function setVercelSecret(key, value, projectId, dryRun = false) {
 }
 function detectGitHubRepo() {
   try {
-    const result = spawnSync9("git", ["remote", "get-url", "origin"], {
+    const result = spawnSync8("git", ["remote", "get-url", "origin"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -16793,7 +16889,7 @@ function setGitHubSecret(key, value, repo, dryRun = false) {
     if (repo) {
       args.push("--repo", repo);
     }
-    const result = spawnSync9("gh", args, {
+    const result = spawnSync8("gh", args, {
       input: value,
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -16845,7 +16941,7 @@ function uploadServiceAccountToGitHub(appDir, repo, dryRun = false, staging = fa
   const contentRaw = readSync(filePath, { format: "text" });
   const content = typeof contentRaw === "string" ? contentRaw : null;
   if (!content) return;
-  const encoded = Buffer2.from(content).toString("base64");
+  const encoded = Buffer.from(content).toString("base64");
   setGitHubSecret(secretName, encoded, repo, dryRun);
 }
 async function main5(options = {}) {
@@ -16932,7 +17028,7 @@ Examples:
         return 1;
       }
       log.info(`Syncing secrets to GitHub repository: ${repo}`);
-      const secrets2 = parseEnvFile(envFilePath);
+      const secrets2 = parseSecretsWithFallback(envFilePath, currentDir);
       const secretKeys2 = Object.keys(secrets2);
       if (secretKeys2.length === 0) {
         log.info("No secrets found in .env file");
@@ -16968,14 +17064,13 @@ Examples:
       return 0;
     }
     const platform6 = config.platform || detectPlatform();
-    log.info(`Reading secrets from: ${envFilePath}`);
     if (config.verbose) {
       log.debug(`Working directory: ${currentDir}`);
       log.debug(`Environment file: ${envFilePath}`);
       log.debug(`Platform: ${platform6}`);
       log.debug(`Dry run mode: ${config.dryRun}`);
     }
-    const secrets = parseEnvFile(envFilePath);
+    const secrets = parseSecretsWithFallback(envFilePath, currentDir);
     const secretKeys = Object.keys(secrets);
     if (secretKeys.length === 0) {
       log.info("No secrets found in .env file");
@@ -17036,6 +17131,7 @@ var init_sync_secrets = __esm({
     init_cli_output();
     init_errors();
     init_pathResolver();
+    init_secrets_resolver();
     sync_secrets_default = main5;
   }
 });
@@ -17061,8 +17157,8 @@ async function deploySupabaseFunctions(appDir, config) {
   );
   const functionDirs = readdirSync2(functionsDir).filter((item) => {
     const itemPath = joinPath(functionsDir, item);
-    const stat = statSync2(itemPath);
-    return stat?.isDirectory() === true;
+    const stat2 = statSync2(itemPath);
+    return stat2?.isDirectory() === true;
   }).filter((dir) => {
     const indexPath = joinPath(functionsDir, dir, "index.ts");
     return pathExists(indexPath);
@@ -18394,9 +18490,11 @@ function processArrayIterations(content, replacements) {
 function isValidFileName(name) {
   return typeof name === "string" && /^[a-zA-Z0-9_-]+$/.test(name);
 }
-var RESERVED_APP_NAME = "demo";
+var RESERVED_APP_NAMES = ["demo", "dndev"];
 function isReservedAppName(name) {
-  return name.toLowerCase() === RESERVED_APP_NAME;
+  return RESERVED_APP_NAMES.includes(
+    name.toLowerCase()
+  );
 }
 async function updateRootPackageJson(rootDir, appNames) {
   const packageJsonPath = joinPath(rootDir, "package.json");
@@ -18696,7 +18794,7 @@ var PROJECT_QUESTIONNAIRE = [
   },
   {
     id: "appNames",
-    question: `App name(s) (comma-separated for multiple, e.g., web, admin) - '${RESERVED_APP_NAME}' reserved`,
+    question: `App name(s) (comma-separated for multiple, e.g., web, admin) - '${RESERVED_APP_NAMES.join("', '")}' reserved`,
     type: "input",
     defaultValue: "web"
   }
@@ -18787,48 +18885,168 @@ async function deployFrontend(appDir, serviceAccountPath, projectId, config) {
 init_utils();
 init_cli_output();
 init_vercel_token();
-import { spawnSync as spawnSync6 } from "node:child_process";
+init_pathResolver();
+import { createHash } from "node:crypto";
+import { readFile, readdir as readdir2 } from "node:fs/promises";
+import { join as join3, relative as relative3 } from "node:path";
+var VERCEL_API = "https://api.vercel.com";
+var UPLOAD_BATCH_SIZE = 10;
+var POLL_INTERVAL_MS = 3e3;
+var POLL_MAX_ATTEMPTS = 100;
+function apiHeaders(token, extra) {
+  return { Authorization: `Bearer ${token}`, ...extra };
+}
+function teamQuery(orgId) {
+  return `?teamId=${encodeURIComponent(orgId)}`;
+}
+async function collectDistFiles(distDir) {
+  const files = [];
+  async function walk(dir) {
+    const entries = await readdir2(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(fullPath);
+      } else {
+        const content = await readFile(fullPath);
+        const sha = createHash("sha1").update(content).digest("hex");
+        const rel = relative3(distDir, fullPath).split("\\").join("/");
+        files.push({
+          relativePath: rel,
+          content,
+          sha,
+          size: content.byteLength
+        });
+      }
+    }
+  }
+  await walk(distDir);
+  return files;
+}
+async function uploadFiles(files, token, orgId) {
+  const q2 = teamQuery(orgId);
+  for (let i = 0; i < files.length; i += UPLOAD_BATCH_SIZE) {
+    const batch = files.slice(i, i + UPLOAD_BATCH_SIZE);
+    await Promise.all(
+      batch.map(async (file) => {
+        const res = await fetch(`${VERCEL_API}/v2/files${q2}`, {
+          method: "POST",
+          headers: apiHeaders(token, {
+            "Content-Type": "application/octet-stream",
+            "x-vercel-digest": file.sha,
+            "Content-Length": String(file.size)
+          }),
+          body: new Uint8Array(file.content)
+        });
+        if (!res.ok) {
+          const body = await res.text();
+          throw new Error(
+            `File upload failed for ${file.relativePath} (${res.status}): ${body}`
+          );
+        }
+      })
+    );
+  }
+}
+async function createDeployment(files, token, orgId, projectId) {
+  const q2 = teamQuery(orgId);
+  const body = {
+    project: projectId,
+    target: "production",
+    files: files.map((f) => ({
+      file: f.relativePath,
+      sha: f.sha,
+      size: f.size
+    })),
+    projectSettings: {
+      buildCommand: "",
+      installCommand: "",
+      outputDirectory: "."
+    }
+  };
+  const res = await fetch(`${VERCEL_API}/v13/deployments${q2}`, {
+    method: "POST",
+    headers: apiHeaders(token, { "Content-Type": "application/json" }),
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Create deployment failed (${res.status}): ${text}`);
+  }
+  return await res.json();
+}
+async function waitForReady(deploymentId, token, orgId) {
+  const q2 = teamQuery(orgId);
+  for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
+    const res = await fetch(
+      `${VERCEL_API}/v13/deployments/${deploymentId}${q2}`,
+      { headers: apiHeaders(token) }
+    );
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(
+        `Deployment status check failed (${res.status}): ${text}`
+      );
+    }
+    const data = await res.json();
+    if (data.readyState === "READY") return data;
+    if (data.readyState === "ERROR") {
+      throw new Error(
+        `Deployment failed: ${data.errorMessage || "Unknown error"}`
+      );
+    }
+    if (data.readyState === "CANCELED") {
+      throw new Error("Deployment was canceled");
+    }
+    await new Promise((r2) => setTimeout(r2, POLL_INTERVAL_MS));
+  }
+  throw new Error("Deployment timed out (5+ minutes)");
+}
 async function deployVercelFrontend(appDir, _config) {
   const result = resolveVercelCredentials(appDir);
   if (result.missing) {
+    const secretVars = result.missing.filter((v2) => v2 === "VERCEL_TOKEN");
+    const appVars = result.missing.filter((v2) => v2 !== "VERCEL_TOKEN");
+    const hints = [];
+    if (secretVars.length > 0)
+      hints.push("Add VERCEL_TOKEN to .dndev.secrets at project root.");
+    if (appVars.length > 0)
+      hints.push(`Add ${appVars.join(", ")} to apps/<app>/.env`);
     throw new Error(
-      `Missing Vercel credentials in .env.local: ${result.missing.join(", ")}
-Add them to apps/<app>/.env.local \u2014 see guides/dndev/SETUP_VERCEL.md`
+      `Missing Vercel credentials: ${result.missing.join(", ")}
+` + hints.join("\n") + "\nSee guides/dndev/SETUP_VERCEL.md"
     );
   }
   const { token, orgId, projectId } = result.credentials;
-  log.debug("Using Vercel credentials from .env (token-based auth)");
-  log.info("Deploying to Vercel...");
-  const deployResult = spawnSync6(
-    "bunx",
-    ["vercel", "deploy", "--prod", "--yes", "--token", token],
-    {
-      cwd: appDir,
-      // stdout piped to capture deployment URL, stderr inherits for progress
-      stdio: ["inherit", "pipe", "inherit"],
-      encoding: "utf-8",
-      env: {
-        ...process.env,
-        VERCEL_ORG_ID: orgId,
-        VERCEL_PROJECT_ID: projectId
-      }
-    }
-  );
-  if (deployResult.status !== 0) {
-    throw new Error(`vercel deploy exited with code ${deployResult.status}`);
-  }
-  const deployUrl = deployResult.stdout?.trim();
-  if (deployUrl) {
-    log.success(`Production: ${deployUrl}`);
-  } else {
-    log.success("Frontend deployed to Vercel");
+  const distDir = joinPath(appDir, "dist");
+  if (!pathExists(distDir)) {
+    throw new Error(`dist/ not found at ${distDir}. Run build first.`);
+  }
+  log.debug("Using Vercel REST API (token-based, no CLI)");
+  log.info("Collecting dist/ files...");
+  const files = await collectDistFiles(distDir);
+  if (files.length === 0) {
+    throw new Error("dist/ is empty \u2014 nothing to deploy.");
+  }
+  log.info(`Found ${files.length} files`);
+  log.info("Uploading files to Vercel...");
+  await uploadFiles(files, token, orgId);
+  log.success(`${files.length} files uploaded`);
+  log.info("Creating production deployment...");
+  const deployment = await createDeployment(files, token, orgId, projectId);
+  log.info(`Deployment ${deployment.id} created, waiting...`);
+  const ready = await waitForReady(deployment.id, token, orgId);
+  const prodUrl = `https://${ready.url}`;
+  log.success(`Production: ${prodUrl}`);
+  if (ready.alias?.length) {
+    log.info(`Aliases: ${ready.alias.join(", ")}`);
   }
 }
 
 // packages/tooling/src/apps/deploy-functions.ts
 init_utils();
 var import_yaml = __toESM(require_dist(), 1);
-import { execSync as execSync8, spawnSync as spawnSync7 } from "node:child_process";
+import { execSync as execSync8, spawnSync as spawnSync6 } from "node:child_process";
 init_pathResolver();
 init_cli_tools();
 init_typed_file_operations();
@@ -18885,6 +19103,14 @@ function generateCleanPackageJson(functionsDir) {
   }
   const cleanPackageJson = { ...packageJson };
   if (cleanPackageJson.dependencies) {
+    const removedDeps = Object.entries(cleanPackageJson.dependencies).filter(
+      ([, version]) => String(version).startsWith("file:") || String(version).startsWith("workspace:")
+    );
+    if (removedDeps.length > 0) {
+      log.warn(
+        `Filtering out ${removedDeps.length} workspace/file dep(s) from dependencies: ${removedDeps.map(([name]) => name).join(", ")}`
+      );
+    }
     cleanPackageJson.dependencies = Object.fromEntries(
       Object.entries(cleanPackageJson.dependencies).filter(
         ([, version]) => !String(version).startsWith("file:") && !String(version).startsWith("workspace:")
@@ -18892,6 +19118,16 @@ function generateCleanPackageJson(functionsDir) {
     );
   }
   if (cleanPackageJson.devDependencies) {
+    const removedDevDeps = Object.entries(
+      cleanPackageJson.devDependencies
+    ).filter(
+      ([, version]) => String(version).startsWith("file:") || String(version).startsWith("workspace:")
+    );
+    if (removedDevDeps.length > 0) {
+      log.warn(
+        `Filtering out ${removedDevDeps.length} workspace/file dep(s) from devDependencies: ${removedDevDeps.map(([name]) => name).join(", ")}`
+      );
+    }
     cleanPackageJson.devDependencies = Object.fromEntries(
       Object.entries(cleanPackageJson.devDependencies).filter(
         ([, version]) => !String(version).startsWith("file:") && !String(version).startsWith("workspace:")
@@ -18997,7 +19233,7 @@ function updateCloudRunIAM(functionNames, projectId, region, serviceAccountPath,
   let failCount = 0;
   for (const funcName of functionNames) {
     try {
-      const result = spawnSync7(
+      const result = spawnSync6(
         "gcloud",
         [
           "run",
@@ -19115,7 +19351,7 @@ async function autoSyncSecrets(functionsDir, projectId, config) {
     let failCount = 0;
     for (const { key, value } of secrets) {
       try {
-        const result = spawnSync7(
+        const result = spawnSync6(
           firebaseCmd,
           ["functions:secrets:set", key, "--project", projectId],
           {
@@ -19302,7 +19538,7 @@ async function deployRules(appDir, serviceAccountPath, projectId, config, option
 
 // packages/tooling/src/apps/deploy-utils.ts
 init_utils();
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 init_pathResolver();
 init_typed_file_operations();
 init_error_handling();
@@ -19314,8 +19550,8 @@ function detectAvailableApps() {
   }
   return readdirSync2(appsDir).filter((item) => {
     const itemPath = joinPath(appsDir, item);
-    const stat = statSync2(itemPath);
-    return stat?.isDirectory() === true;
+    const stat2 = statSync2(itemPath);
+    return stat2?.isDirectory() === true;
   }).filter((app) => {
     const appDir = joinPath(appsDir, app);
     const firebaseJsonPath = joinPath(appDir, "firebase.json");
@@ -19490,7 +19726,7 @@ How to fix:
     if (shouldOpen) {
       try {
         const openCommand = process.platform === "win32" ? "start" : process.platform === "darwin" ? "open" : "xdg-open";
-        spawnSync8(openCommand, [consoleUrl], { shell: true });
+        spawnSync7(openCommand, [consoleUrl], { shell: true });
         log.success("Opening Firebase Console...");
       } catch {
         log.warn("Could not open browser. Please open the URL manually.");
@@ -19921,12 +20157,6 @@ async function main6(options = {}) {
       ...serviceAccountPath ? [`Service Account: ${serviceAccountPath}`] : []
     ].join("\n");
     Me(configNote, "Deployment Configuration");
-    if (shouldDeployVercelFrontend) {
-      requireCLI(
-        CLI_TOOLS.VERCEL,
-        "Vercel CLI is required to deploy the frontend.\nInstall: bun install -g vercel"
-      );
-    }
     if (shouldDeployFirebaseFrontend && serviceAccountPath && config.project) {
       await deployFrontend(appDir, serviceAccountPath, config.project, config);
     }
@@ -20057,6 +20287,11 @@ function generateScripts(templateName, options) {
     scripts.build = "tsc --noEmit && vite build --mode production";
     scripts.preview = "vite preview";
     scripts["type-check"] = "tsc --noEmit";
+  } else if (templateName === "dndev") {
+    scripts.dev = "vite";
+    scripts.build = "tsc --noEmit && vite build --mode production";
+    scripts.preview = "vite preview";
+    scripts["type-check"] = "tsc --noEmit";
   } else if (templateName === "entities") {
   }
   return scripts;
@@ -20184,7 +20419,7 @@ function resolveDeployConfig(host, backend) {
   return "vercel-vercel";
 }
 function getScaffoldParts(builder, host, functions, backend) {
-  const baseTemplate = builder === "nextjs" ? "app-next" : builder === "demo" ? "app-demo" : `app-${builder}`;
+  const baseTemplate = builder === "nextjs" ? "app-next" : builder === "demo" ? "app-demo" : builder === "dndev" ? "app-dndev" : `app-${builder}`;
   return {
     builder,
     backend,
@@ -20212,7 +20447,7 @@ async function createApp(appName, appConfig, workspaceRoot, templatesRoot) {
     Ie("\u{1F680} DoNotDev App Creator");
     if (!appName) {
       appName = await askForInput(
-        `App name - '${RESERVED_APP_NAME}' reserved`,
+        `App name - '${RESERVED_APP_NAMES.join("', '")}' reserved`,
         "my-app"
       );
       if (!isValidFileName(appName)) {
@@ -20413,12 +20648,13 @@ async function createApp(appName, appConfig, workspaceRoot, templatesRoot) {
     }
   }
   const executionMode = detectExecutionMode();
-  const templateName = appTemplate === "demo" ? "demo" : executionMode === "development" ? `dev-${appTemplate}` : `consumer-${appTemplate}`;
+  const isReservedTemplate = appTemplate === "demo" || appTemplate === "dndev";
+  const templateName = isReservedTemplate ? appTemplate : executionMode === "development" ? `dev-${appTemplate}` : `consumer-${appTemplate}`;
   const packageJson = generatePackageJson(templateName, executionMode, {
     appName,
-    template: appTemplate === "demo" ? "vite" : appTemplate,
+    template: isReservedTemplate ? "vite" : appTemplate,
     includeFunctions: Boolean(row.functionsTemplate),
-    platform: appTemplate === "demo" ? void 0 : backendPlatform
+    platform: isReservedTemplate ? void 0 : backendPlatform
   });
   const packageJsonPath = joinPath(appDir, "package.json");
   await write(packageJsonPath, packageJson, {
@@ -20493,7 +20729,7 @@ async function createApp(appName, appConfig, workspaceRoot, templatesRoot) {
         const firebaseJson = readSync(firebaseJsonDest, {
           format: "json"
         });
-        if (firebaseJson.hosting?.rewrites) {
+        if (firebaseJson.hosting?.rewrites && Array.isArray(firebaseJson.hosting.rewrites)) {
           firebaseJson.hosting.rewrites = firebaseJson.hosting.rewrites.filter(
             (r2) => r2.destination !== "/index.html"
           );
@@ -20781,6 +21017,14 @@ async function main9(options) {
         process.exit(0);
       }
       if (action === "replace") {
+        const confirmDelete = await askForConfirmation(
+          `This will permanently delete "${projectDirNormalized}". Are you sure?`,
+          false
+        );
+        if (!confirmDelete) {
+          Se("Project creation cancelled.");
+          process.exit(0);
+        }
         const s2 = Y2();
         s2.start("Removing existing project...");
         await remove(projectDirNormalized);
@@ -20842,6 +21086,10 @@ async function main9(options) {
       "Would you like to install the demo app? (component showcase)",
       false
     );
+    let installCockpitApp = await askForConfirmation(
+      "Would you like to install the cockpit app? (AI development dashboard)",
+      false
+    );
     let allAppNames = [...appNames];
     let appsToCreate = [];
     let appsToSkip = [];
@@ -20965,6 +21213,13 @@ async function main9(options) {
       const primaryPlatform = Object.values(appConfigs).find(
         (c) => c.backend !== "none"
       )?.backend ?? "firebase";
+      const hasVercel = Object.values(appConfigs).some(
+        (c) => c.host === "vercel"
+      );
+      const hasSupabase = Object.values(appConfigs).some(
+        (c) => c.backend === "supabase"
+      );
+      const hasBilling = Object.values(appConfigs).some((c) => c.billing);
       const rootPackageJson = generatePackageJson(
         "consumer-root",
         executionMode,
@@ -20999,8 +21254,12 @@ async function main9(options) {
         // Determined by agent in WAI-WAY Phase 0
         needsOAuth: false,
         // Determined by agent in WAI-WAY Phase 0
-        needsBilling: false
+        needsBilling: false,
         // Determined by agent in WAI-WAY Phase 0
+        // .dndev.secrets conditional sections
+        vercel: hasVercel,
+        supabase: hasSupabase,
+        stripe: hasBilling
       };
       const firebaseRootFiles = /* @__PURE__ */ new Set([
         "firebase.json.example",
@@ -21029,6 +21288,13 @@ async function main9(options) {
           await replacePlaceholders(destPath, rootReplacements);
         }
       }
+      const dndevSecretsPath = joinPath(projectDirNormalized, ".dndev.secrets");
+      if (pathExists(dndevSecretsPath)) {
+        await copy(
+          dndevSecretsPath,
+          joinPath(projectDirNormalized, ".dndev.secrets.example")
+        );
+      }
       if (setupGithubActions) {
         const ciTemplateDir = joinPath(templatesRoot, "github");
         await copyTemplateFiles(
@@ -21129,6 +21395,61 @@ async function main9(options) {
         sDemo.stop("Demo app copied");
       }
     }
+    if (installCockpitApp) {
+      const sCockpit = Y2();
+      sCockpit.start("Copying cockpit app...");
+      const cockpitAppDir = joinPath(projectDirNormalized, "apps", "dndev");
+      const cockpitTemplateDir = joinPath(templatesRoot, "app-dndev");
+      if (pathExists(cockpitAppDir)) {
+        if (isMergeMode) {
+          const cockpitAction = await askForSelection(
+            "Cockpit app already exists. What would you like to do?",
+            [
+              { title: "Replace (delete and recreate)", value: "replace" },
+              { title: "Skip (keep existing)", value: "skip" }
+            ],
+            1
+          );
+          if (cockpitAction === "replace") {
+            await remove(cockpitAppDir);
+          } else {
+            sCockpit.stop("Cockpit app skipped (already exists)");
+            installCockpitApp = false;
+          }
+        } else {
+          await remove(cockpitAppDir);
+        }
+      }
+      if (installCockpitApp) {
+        const cockpitFirebaseProjectId = projectName.toLowerCase().replace(/\s+/g, "-");
+        await copyTemplateFiles(cockpitTemplateDir, cockpitAppDir, {
+          projectName,
+          appName: "dndev",
+          includeFunctions: false,
+          needsCRUD: false,
+          setupGithubActions: false,
+          appNames,
+          firebaseProjectId: cockpitFirebaseProjectId,
+          firebaseRegion: "europe-west1",
+          firebaseSecretName: projectName.toUpperCase().replace(/-/g, "_"),
+          YOUR_FIREBASE_PROJECT_ID: cockpitFirebaseProjectId,
+          YOUR_REGION: "europe-west1",
+          monorepoRelativePath: executionMode === "development" ? calculateRelativePath(projectDirNormalized, monorepoRoot) : "",
+          appTemplate: "dndev"
+        });
+        const packageJson = generatePackageJson("dndev", executionMode, {
+          appName: "dndev",
+          template: "vite",
+          includeFunctions: false
+        });
+        const packageJsonPath = joinPath(cockpitAppDir, "package.json");
+        await write(packageJsonPath, packageJson, {
+          format: "json",
+          overwrite: true
+        });
+        sCockpit.stop("Cockpit app copied");
+      }
+    }
     log.info("Creating apps...");
     for (const appName of appNames) {
       const appConfig = appConfigs[appName];
@@ -21139,7 +21460,10 @@ async function main9(options) {
       await createApp(appName, appConfig, projectDirNormalized, templatesRoot);
     }
     s.start("Updating root package.json with scripts...");
-    await updateRootPackageJson(projectDirNormalized, appNames);
+    await updateRootPackageJson(
+      projectDirNormalized,
+      isMergeMode ? allAppNames : appNames
+    );
     s.stop("Root package.json updated");
     Se("\u{1F389} Project created successfully!");
     const cdCommand = executionMode === "development" ? `cd ../${projectName}` : `cd ${projectName}`;
@@ -21171,7 +21495,7 @@ init_utils();
 init_cli_output();
 init_errors();
 init_pathResolver();
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 import { EOL as EOL2 } from "node:os";
 async function main10(options = {}) {
   const dryRun = options.dryRun ?? false;
@@ -21651,7 +21975,7 @@ async function runPrettier(rootDir, dryRun, verbose) {
       log.info("DRY RUN: Would run Prettier");
       return stats;
     }
-    const result = spawnSync10("bunx", prettierArgs, {
+    const result = spawnSync9("bunx", prettierArgs, {
       cwd: rootDir,
       stdio: "pipe",
       shell: true,
@@ -21822,8 +22146,8 @@ async function findCacheItems(targetDir, verbose) {
         for (const nestedPkg of nestedPackages) {
           const nestedPkgPath = joinPath(pkgPath, nestedPkg);
           try {
-            const stat = statSync2(nestedPkgPath);
-            if (stat?.isDirectory()) {
+            const stat2 = statSync2(nestedPkgPath);
+            if (stat2?.isDirectory()) {
               check(joinPath(nestedPkgPath, ".vite"));
               check(joinPath(nestedPkgPath, "dist"));
               check(joinPath(nestedPkgPath, "node_modules", ".vite"));