@donotdev/cli 0.0.19 → 0.0.21

package/dist/bin/commands/deploy.js

@@ -3209,9 +3209,9 @@ var require_parse2 = __commonJS({
                 const idx = prev.value.lastIndexOf("[");
                 const pre = prev.value.slice(0, idx);
                 const rest2 = prev.value.slice(idx + 2);
-                const posix = POSIX_REGEX_SOURCE[rest2];
-                if (posix) {
-                  prev.value = pre + posix;
+                const posix2 = POSIX_REGEX_SOURCE[rest2];
+                if (posix2) {
+                  prev.value = pre + posix2;
                   state.backtrack = true;
                   advance();
                   if (!bos.output && tokens.indexOf(prev) === 1) {
@@ -3733,7 +3733,7 @@ var require_picomatch = __commonJS({
         throw new TypeError("Expected pattern to be a non-empty string");
       }
       const opts = options || {};
-      const posix = utils.isWindows(options);
+      const posix2 = utils.isWindows(options);
       const regex = isState ? picomatch.compileRe(glob, options) : picomatch.makeRe(glob, options, false, true);
       const state = regex.state;
       delete regex.state;
@@ -3743,8 +3743,8 @@ var require_picomatch = __commonJS({
         isIgnored = picomatch(opts.ignore, ignoreOpts, returnState);
       }
       const matcher = (input, returnObject = false) => {
-        const { isMatch, match, output } = picomatch.test(input, regex, options, { glob, posix });
-        const result = { glob, state, regex, posix, input, output, match, isMatch };
+        const { isMatch, match, output } = picomatch.test(input, regex, options, { glob, posix: posix2 });
+        const result = { glob, state, regex, posix: posix2, input, output, match, isMatch };
         if (typeof opts.onResult === "function") {
           opts.onResult(result);
         }
@@ -3769,7 +3769,7 @@ var require_picomatch = __commonJS({
       }
       return matcher;
     };
-    picomatch.test = (input, regex, options, { glob, posix } = {}) => {
+    picomatch.test = (input, regex, options, { glob, posix: posix2 } = {}) => {
       if (typeof input !== "string") {
         throw new TypeError("Expected input to be a string");
       }
@@ -3777,7 +3777,7 @@ var require_picomatch = __commonJS({
         return { isMatch: false, output: "" };
       }
       const opts = options || {};
-      const format = opts.format || (posix ? utils.toPosixSlashes : null);
+      const format = opts.format || (posix2 ? utils.toPosixSlashes : null);
       let match = input === glob;
       let output = match && format ? format(input) : input;
       if (match === false) {
@@ -3786,14 +3786,14 @@ var require_picomatch = __commonJS({
       }
       if (match === false || opts.capture === true) {
         if (opts.matchBase === true || opts.basename === true) {
-          match = picomatch.matchBase(input, regex, options, posix);
+          match = picomatch.matchBase(input, regex, options, posix2);
         } else {
           match = regex.exec(output);
         }
       }
       return { isMatch: Boolean(match), match, output };
     };
-    picomatch.matchBase = (input, glob, options, posix = utils.isWindows(options)) => {
+    picomatch.matchBase = (input, glob, options, posix2 = utils.isWindows(options)) => {
       const regex = glob instanceof RegExp ? glob : picomatch.makeRe(glob, options);
       return regex.test(path.basename(input));
     };
@@ -3984,9 +3984,9 @@ var require_micromatch = __commonJS({
       return [].concat(patterns).every((p2) => picomatch(p2, options)(str));
     };
     micromatch.capture = (glob, input, options) => {
-      let posix = utils.isWindows(options);
+      let posix2 = utils.isWindows(options);
       let regex = picomatch.makeRe(String(glob), { ...options, capture: true });
-      let match = regex.exec(posix ? utils.toPosixSlashes(input) : input);
+      let match = regex.exec(posix2 ? utils.toPosixSlashes(input) : input);
       if (match) {
         return match.slice(1).map((v2) => v2 === void 0 ? "" : v2);
       }
@@ -4166,15 +4166,15 @@ var require_pattern = __commonJS({
     exports.removeDuplicateSlashes = removeDuplicateSlashes;
     function partitionAbsoluteAndRelative(patterns) {
       const absolute = [];
-      const relative3 = [];
+      const relative4 = [];
       for (const pattern of patterns) {
         if (isAbsolute(pattern)) {
           absolute.push(pattern);
         } else {
-          relative3.push(pattern);
+          relative4.push(pattern);
         }
       }
-      return [absolute, relative3];
+      return [absolute, relative4];
     }
     exports.partitionAbsoluteAndRelative = partitionAbsoluteAndRelative;
     function isAbsolute(pattern) {
@@ -4484,7 +4484,7 @@ var require_async = __commonJS({
           callSuccessCallback(callback, lstat);
           return;
         }
-        settings.fs.stat(path, (statError, stat) => {
+        settings.fs.stat(path, (statError, stat2) => {
           if (statError !== null) {
             if (settings.throwErrorOnBrokenSymbolicLink) {
               callFailureCallback(callback, statError);
@@ -4494,9 +4494,9 @@ var require_async = __commonJS({
             return;
           }
           if (settings.markSymbolicLink) {
-            stat.isSymbolicLink = () => true;
+            stat2.isSymbolicLink = () => true;
           }
-          callSuccessCallback(callback, stat);
+          callSuccessCallback(callback, stat2);
         });
       });
     }
@@ -4523,11 +4523,11 @@ var require_sync = __commonJS({
         return lstat;
       }
       try {
-        const stat = settings.fs.statSync(path);
+        const stat2 = settings.fs.statSync(path);
         if (settings.markSymbolicLink) {
-          stat.isSymbolicLink = () => true;
+          stat2.isSymbolicLink = () => true;
         }
-        return stat;
+        return stat2;
       } catch (error2) {
         if (!settings.throwErrorOnBrokenSymbolicLink) {
           return lstat;
@@ -4597,14 +4597,14 @@ var require_out = __commonJS({
     var sync = require_sync();
     var settings_1 = require_settings();
     exports.Settings = settings_1.default;
-    function stat(path, optionsOrSettingsOrCallback, callback) {
+    function stat2(path, optionsOrSettingsOrCallback, callback) {
       if (typeof optionsOrSettingsOrCallback === "function") {
         async.read(path, getSettings(), optionsOrSettingsOrCallback);
         return;
       }
       async.read(path, getSettings(optionsOrSettingsOrCallback), callback);
     }
-    exports.stat = stat;
+    exports.stat = stat2;
     function statSync3(path, optionsOrSettings) {
       const settings = getSettings(optionsOrSettings);
       return sync.read(path, settings);
@@ -4774,7 +4774,7 @@ var require_async2 = __commonJS({
         readdirWithFileTypes(directory, settings, callback);
         return;
       }
-      readdir(directory, settings, callback);
+      readdir2(directory, settings, callback);
     }
     exports.read = read;
     function readdirWithFileTypes(directory, settings, callback) {
@@ -4823,7 +4823,7 @@ var require_async2 = __commonJS({
         });
       };
     }
-    function readdir(directory, settings, callback) {
+    function readdir2(directory, settings, callback) {
       settings.fs.readdir(directory, (readdirError, names) => {
         if (readdirError !== null) {
           callFailureCallback(callback, readdirError);
@@ -4858,7 +4858,7 @@ var require_async2 = __commonJS({
         });
       });
     }
-    exports.readdir = readdir;
+    exports.readdir = readdir2;
     function callFailureCallback(callback, error2) {
       callback(error2);
     }
@@ -4883,7 +4883,7 @@ var require_sync2 = __commonJS({
       if (!settings.stats && constants_1.IS_SUPPORT_READDIR_WITH_FILE_TYPES) {
         return readdirWithFileTypes(directory, settings);
       }
-      return readdir(directory, settings);
+      return readdir2(directory, settings);
     }
     exports.read = read;
     function readdirWithFileTypes(directory, settings) {
@@ -4908,7 +4908,7 @@ var require_sync2 = __commonJS({
       });
     }
     exports.readdirWithFileTypes = readdirWithFileTypes;
-    function readdir(directory, settings) {
+    function readdir2(directory, settings) {
       const names = settings.fs.readdirSync(directory);
       return names.map((name) => {
         const entryPath = common.joinPathSegments(directory, name, settings.pathSegmentSeparator);
@@ -4924,7 +4924,7 @@ var require_sync2 = __commonJS({
         return entry;
       });
     }
-    exports.readdir = readdir;
+    exports.readdir = readdir2;
   }
 });
 
@@ -6486,19 +6486,19 @@ var require_out4 = __commonJS({
         return utils.path.convertPathToPattern(source);
       }
       FastGlob2.convertPathToPattern = convertPathToPattern;
-      let posix;
-      (function(posix2) {
+      let posix2;
+      (function(posix3) {
         function escapePath2(source) {
           assertPatternsInput(source);
           return utils.path.escapePosixPath(source);
         }
-        posix2.escapePath = escapePath2;
+        posix3.escapePath = escapePath2;
         function convertPathToPattern2(source) {
           assertPatternsInput(source);
           return utils.path.convertPosixPathToPattern(source);
         }
-        posix2.convertPathToPattern = convertPathToPattern2;
-      })(posix = FastGlob2.posix || (FastGlob2.posix = {}));
+        posix3.convertPathToPattern = convertPathToPattern2;
+      })(posix2 = FastGlob2.posix || (FastGlob2.posix = {}));
       let win32;
       (function(win322) {
         function escapePath2(source) {
@@ -7077,7 +7077,7 @@ var init_PathResolver = __esm({
         }
         const detectedFormat = this._detectFormat(filePath, format);
         let writeContent;
-        if (Buffer2.isBuffer(content)) {
+        if (Buffer.isBuffer(content)) {
           writeContent = content;
         } else if (detectedFormat === "json" && typeof content === "object") {
           writeContent = JSON.stringify(content, null, 2);
@@ -7086,7 +7086,7 @@ var init_PathResolver = __esm({
         }
         try {
           return await safeExecuteAsync(async () => {
-            if (Buffer2.isBuffer(writeContent)) {
+            if (Buffer.isBuffer(writeContent)) {
               await fs.promises.writeFile(normalizedPath, writeContent);
             } else {
               await fs.promises.writeFile(normalizedPath, writeContent, "utf8");
@@ -7138,7 +7138,7 @@ var init_PathResolver = __esm({
         }
         const detectedFormat = this._detectFormat(filePath, format);
         let writeContent;
-        if (Buffer2.isBuffer(content)) {
+        if (Buffer.isBuffer(content)) {
           writeContent = content;
         } else if (detectedFormat === "json" && typeof content === "object") {
           writeContent = JSON.stringify(content, null, 2);
@@ -7146,7 +7146,7 @@ var init_PathResolver = __esm({
           writeContent = String(content);
         }
         try {
-          if (Buffer2.isBuffer(writeContent)) {
+          if (Buffer.isBuffer(writeContent)) {
             fs.writeFileSync(normalizedPath, writeContent);
           } else {
             fs.writeFileSync(normalizedPath, writeContent, "utf8");
@@ -7970,7 +7970,7 @@ var init_typed_file_operations = __esm({
 });
 
 // packages/tooling/src/bundler/utils.ts
-import { Buffer as Buffer2 } from "node:buffer";
+import { Buffer } from "node:buffer";
 import { readFileSync as readFileSync2, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "node:fs";
 import { createRequire as createRequire3 } from "node:module";
 import { dirname as dirname3, resolve as resolve3 } from "node:path";
@@ -7987,7 +7987,7 @@ var init_utils = __esm({
       globalThis.require = require2;
       globalThis.__filename = __filename;
       globalThis.__dirname = __dirname;
-      globalThis.Buffer = Buffer2;
+      globalThis.Buffer = Buffer;
       globalThis.process = process;
       if (typeof global === "undefined") {
         globalThis.global = globalThis;
@@ -8335,7 +8335,28 @@ var init_cli_tools = __esm({
   }
 });
 
-// packages/tooling/src/cli/setup/vercel-token.ts
+// packages/tooling/src/utils/secrets-resolver.ts
+function parseEnvFile(filePath) {
+  if (!pathExists(filePath)) return {};
+  const content = readSync(filePath, { format: "text" });
+  if (typeof content !== "string" || !content) return {};
+  const result = {};
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eqIdx = trimmed.indexOf("=");
+    if (eqIdx === -1) continue;
+    const key = trimmed.slice(0, eqIdx).trim();
+    let value = trimmed.slice(eqIdx + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    if (key && value) {
+      result[key] = value;
+    }
+  }
+  return result;
+}
 function readEnvVar(filePath, varName) {
   if (!pathExists(filePath)) return null;
   const content = readSync(filePath, { format: "text" });
@@ -8344,16 +8365,93 @@ function readEnvVar(filePath, varName) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     if (trimmed.startsWith(`${varName}=`)) {
-      const val = trimmed.substring(`${varName}=`.length).trim();
+      let val = trimmed.substring(`${varName}=`.length).trim();
       if (val.startsWith('"') && val.endsWith('"') || val.startsWith("'") && val.endsWith("'")) {
-        return val.slice(1, -1);
+        val = val.slice(1, -1);
       }
       return val || null;
     }
   }
   return null;
 }
-function resolveVercelVar(appDir, varName) {
+function loadDndevSecrets(projectRoot) {
+  const secretsPath = joinPath(projectRoot, ".dndev.secrets");
+  if (cachedSecretsPath === secretsPath && cachedSecrets) {
+    return cachedSecrets;
+  }
+  cachedSecrets = parseEnvFile(secretsPath);
+  cachedSecretsPath = secretsPath;
+  return cachedSecrets;
+}
+function resolveSecret(name, projectRoot, opts) {
+  const appDir = opts?.appDir ?? projectRoot;
+  const envValue = process.env[name];
+  if (envValue) {
+    return { value: envValue, source: "process.env" };
+  }
+  const secrets = loadDndevSecrets(projectRoot);
+  if (secrets[name]) {
+    return { value: secrets[name], source: ".dndev.secrets" };
+  }
+  if (name === "SUPABASE_SECRET_KEY" && secrets["SUPABASE_SERVICE_ROLE_KEY"]) {
+    return {
+      value: secrets["SUPABASE_SERVICE_ROLE_KEY"],
+      source: ".dndev.secrets"
+    };
+  }
+  const legacyPaths = LEGACY_PATHS[name];
+  if (legacyPaths) {
+    for (const relPath of legacyPaths) {
+      const fullPath = joinPath(appDir, relPath);
+      const value = readEnvVar(fullPath, name);
+      if (value) {
+        if (!opts?.silent && !warnedLegacy.has(name)) {
+          warnedLegacy.add(name);
+          log.warn(
+            `${name} found in ${relPath} (legacy). Move it to .dndev.secrets at project root.`
+          );
+        }
+        return { value, source: "legacy", legacyPath: relPath };
+      }
+      if (name === "SUPABASE_SECRET_KEY") {
+        const aliasValue = readEnvVar(fullPath, "SUPABASE_SERVICE_ROLE_KEY");
+        if (aliasValue) {
+          if (!opts?.silent && !warnedLegacy.has(name)) {
+            warnedLegacy.add(name);
+            log.warn(
+              `${name} found in ${relPath} (legacy). Move it to .dndev.secrets at project root.`
+            );
+          }
+          return { value: aliasValue, source: "legacy", legacyPath: relPath };
+        }
+      }
+    }
+  }
+  return null;
+}
+var LEGACY_PATHS, warnedLegacy, cachedSecretsPath, cachedSecrets;
+var init_secrets_resolver = __esm({
+  "packages/tooling/src/utils/secrets-resolver.ts"() {
+    "use strict";
+    init_utils();
+    init_pathResolver();
+    init_cli_output();
+    LEGACY_PATHS = {
+      VERCEL_TOKEN: [".env.local"],
+      SUPABASE_SECRET_KEY: ["supabase/functions/.env", "functions/.env"],
+      SUPABASE_DB_URL: ["supabase/functions/.env", "functions/.env"],
+      SUPABASE_ACCESS_TOKEN: ["supabase/functions/.env", "functions/.env"],
+      STRIPE_SECRET_KEY: ["supabase/functions/.env", "functions/.env"],
+      STRIPE_WEBHOOK_SECRET: ["supabase/functions/.env", "functions/.env"]
+    };
+    warnedLegacy = /* @__PURE__ */ new Set();
+    cachedSecretsPath = null;
+    cachedSecrets = null;
+  }
+});
+
+// packages/tooling/src/cli/setup/vercel-token.ts
+function resolvePerAppVar(appDir, varName) {
   if (process.env[varName]) return process.env[varName];
   const fromLocal = readEnvVar(joinPath(appDir, ".env.local"), varName);
   if (fromLocal) return fromLocal;
@@ -8361,10 +8459,11 @@ function resolveVercelVar(appDir, varName) {
   if (fromEnv) return fromEnv;
   return null;
 }
-function resolveVercelCredentials(appDir) {
-  const token = resolveVercelVar(appDir, "VERCEL_TOKEN");
-  const orgId = resolveVercelVar(appDir, "VERCEL_ORG_ID");
-  const projectId = resolveVercelVar(appDir, "VERCEL_PROJECT_ID");
+function resolveVercelCredentials(appDir, projectRoot) {
+  const root = projectRoot ?? process.cwd();
+  const token = resolveSecret("VERCEL_TOKEN", root, { appDir })?.value ?? null;
+  const orgId = resolvePerAppVar(appDir, "VERCEL_ORG_ID");
+  const projectId = resolvePerAppVar(appDir, "VERCEL_PROJECT_ID");
   const missing = [];
   if (!token) missing.push("VERCEL_TOKEN");
   if (!orgId) missing.push("VERCEL_ORG_ID");
@@ -8378,6 +8477,7 @@ var init_vercel_token = __esm({
   "packages/tooling/src/cli/setup/vercel-token.ts"() {
     "use strict";
     init_utils();
+    init_secrets_resolver();
     init_pathResolver();
   }
 });
@@ -15770,10 +15870,14 @@ var init_error_handling = __esm({
 var sync_secrets_exports = {};
 __export(sync_secrets_exports, {
   default: () => sync_secrets_default,
-  main: () => main
+  detectGitHubRepo: () => detectGitHubRepo,
+  main: () => main,
+  parseSecretsWithFallback: () => parseSecretsWithFallback,
+  setGitHubSecret: () => setGitHubSecret,
+  uploadServiceAccountToGitHub: () => uploadServiceAccountToGitHub
 });
-import { spawnSync as spawnSync6 } from "node:child_process";
-function parseEnvFile(filePath) {
+import { spawnSync as spawnSync5 } from "node:child_process";
+function parseEnvFile2(filePath) {
   if (!pathExists(filePath)) {
     throw new DoNotDevError(
       `Environment file not found: ${filePath}`,
@@ -15781,30 +15885,22 @@ function parseEnvFile(filePath) {
       { context: { filePath } }
     );
   }
-  const contentRaw = readSync(filePath, { format: "text" });
-  const content = typeof contentRaw === "string" ? contentRaw : null;
-  if (!content) {
-    throw new Error(`Failed to read secrets file: ${filePath}`);
+  const result = parseEnvFile(filePath);
+  if (Object.keys(result).length === 0) {
+    log.debug(`No key-value pairs found in ${filePath}`);
   }
-  const secrets = {};
-  content.split("\n").forEach((line, index) => {
-    const trimmedLine = line.trim();
-    if (!trimmedLine || trimmedLine.startsWith("#")) {
-      return;
-    }
-    const equalIndex = trimmedLine.indexOf("=");
-    if (equalIndex === -1) {
-      log.warn(`Invalid line format at line ${index + 1}: ${trimmedLine}`);
-      return;
-    }
-    const key = trimmedLine.substring(0, equalIndex).trim();
-    const value = trimmedLine.substring(equalIndex + 1).trim();
-    const cleanValue = value.replace(/^["']|["']$/g, "");
-    if (key && cleanValue) {
-      secrets[key] = cleanValue;
+  return result;
+}
+function parseSecretsWithFallback(envFilePath, projectRoot) {
+  const dndevSecretsPath = joinPath(projectRoot, ".dndev.secrets");
+  if (pathExists(dndevSecretsPath)) {
+    const secrets = parseEnvFile(dndevSecretsPath);
+    if (Object.keys(secrets).length > 0) {
+      log.info(`Reading secrets from: ${dndevSecretsPath}`);
+      return secrets;
     }
-  });
-  return secrets;
+  }
+  return parseEnvFile2(envFilePath);
 }
 function detectPlatform() {
   const currentDir = process.cwd();
@@ -15895,8 +15991,8 @@ function detectAppsWithFunctions() {
   try {
     const appsList = readdirSync2(appsDir).filter((item) => {
       const itemPath = joinPath(appsDir, item);
-      const stat = statSync2(itemPath);
-      return stat?.isDirectory() === true;
+      const stat2 = statSync2(itemPath);
+      return stat2?.isDirectory() === true;
     });
     for (const app of appsList) {
       const functionsEnvFile = joinPath(appsDir, app, "functions", ".env");
@@ -15962,7 +16058,7 @@ async function setFirebaseSecret(key, value, projectId, dryRun = false, cwd) {
         NODE_OPTIONS: ""
         // Clear to avoid conflicts
       };
-      const result = spawnSync6(firebaseCmd, args, {
+      const result = spawnSync5(firebaseCmd, args, {
         input: value,
         encoding: "utf8",
         stdio: ["pipe", "pipe", "pipe"],
@@ -16055,7 +16151,7 @@ function setVercelSecret(key, value, projectId, dryRun = false) {
     if (projectId) {
       args.push("--project", projectId);
     }
-    const result = spawnSync6("vercel", args, {
+    const result = spawnSync5("vercel", args, {
       input: value,
       encoding: "utf8",
       stdio: ["pipe", "inherit", "inherit"]
@@ -16084,7 +16180,7 @@ function setVercelSecret(key, value, projectId, dryRun = false) {
 }
 function detectGitHubRepo() {
   try {
-    const result = spawnSync6("git", ["remote", "get-url", "origin"], {
+    const result = spawnSync5("git", ["remote", "get-url", "origin"], {
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
     });
@@ -16112,7 +16208,7 @@ function setGitHubSecret(key, value, repo, dryRun = false) {
     if (repo) {
       args.push("--repo", repo);
     }
-    const result = spawnSync6("gh", args, {
+    const result = spawnSync5("gh", args, {
       input: value,
       encoding: "utf8",
       stdio: ["pipe", "pipe", "pipe"]
@@ -16164,7 +16260,7 @@ function uploadServiceAccountToGitHub(appDir, repo, dryRun = false, staging = fa
   const contentRaw = readSync(filePath, { format: "text" });
   const content = typeof contentRaw === "string" ? contentRaw : null;
   if (!content) return;
-  const encoded = Buffer2.from(content).toString("base64");
+  const encoded = Buffer.from(content).toString("base64");
   setGitHubSecret(secretName, encoded, repo, dryRun);
 }
 async function main(options = {}) {
@@ -16251,7 +16347,7 @@ Examples:
         return 1;
       }
       log.info(`Syncing secrets to GitHub repository: ${repo}`);
-      const secrets2 = parseEnvFile(envFilePath);
+      const secrets2 = parseSecretsWithFallback(envFilePath, currentDir);
       const secretKeys2 = Object.keys(secrets2);
       if (secretKeys2.length === 0) {
         log.info("No secrets found in .env file");
@@ -16287,14 +16383,13 @@ Examples:
       return 0;
     }
     const platform = config.platform || detectPlatform();
-    log.info(`Reading secrets from: ${envFilePath}`);
     if (config.verbose) {
       log.debug(`Working directory: ${currentDir}`);
       log.debug(`Environment file: ${envFilePath}`);
       log.debug(`Platform: ${platform}`);
       log.debug(`Dry run mode: ${config.dryRun}`);
     }
-    const secrets = parseEnvFile(envFilePath);
+    const secrets = parseSecretsWithFallback(envFilePath, currentDir);
     const secretKeys = Object.keys(secrets);
     if (secretKeys.length === 0) {
       log.info("No secrets found in .env file");
@@ -16355,6 +16450,7 @@ var init_sync_secrets = __esm({
     init_cli_output();
     init_errors();
     init_pathResolver();
+    init_secrets_resolver();
     sync_secrets_default = main;
   }
 });
@@ -16380,8 +16476,8 @@ async function deploySupabaseFunctions(appDir, config) {
   );
   const functionDirs = readdirSync2(functionsDir).filter((item) => {
     const itemPath = joinPath(functionsDir, item);
-    const stat = statSync2(itemPath);
-    return stat?.isDirectory() === true;
+    const stat2 = statSync2(itemPath);
+    return stat2?.isDirectory() === true;
   }).filter((dir) => {
     const indexPath = joinPath(functionsDir, dir, "index.ts");
     return pathExists(indexPath);
@@ -16603,48 +16699,168 @@ async function deployFrontend(appDir, serviceAccountPath, projectId, config) {
 init_utils();
 init_cli_output();
 init_vercel_token();
-import { spawnSync as spawnSync3 } from "node:child_process";
+init_pathResolver();
+import { createHash } from "node:crypto";
+import { readFile, readdir } from "node:fs/promises";
+import { join as join3, relative as relative3 } from "node:path";
+var VERCEL_API = "https://api.vercel.com";
+var UPLOAD_BATCH_SIZE = 10;
+var POLL_INTERVAL_MS = 3e3;
+var POLL_MAX_ATTEMPTS = 100;
+function apiHeaders(token, extra) {
+  return { Authorization: `Bearer ${token}`, ...extra };
+}
+function teamQuery(orgId) {
+  return `?teamId=${encodeURIComponent(orgId)}`;
+}
+async function collectDistFiles(distDir) {
+  const files = [];
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join3(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(fullPath);
+      } else {
+        const content = await readFile(fullPath);
+        const sha = createHash("sha1").update(content).digest("hex");
+        const rel = relative3(distDir, fullPath).split("\\").join("/");
+        files.push({
+          relativePath: rel,
+          content,
+          sha,
+          size: content.byteLength
+        });
+      }
+    }
+  }
+  await walk(distDir);
+  return files;
+}
+async function uploadFiles(files, token, orgId) {
+  const q2 = teamQuery(orgId);
+  for (let i = 0; i < files.length; i += UPLOAD_BATCH_SIZE) {
+    const batch = files.slice(i, i + UPLOAD_BATCH_SIZE);
+    await Promise.all(
+      batch.map(async (file) => {
+        const res = await fetch(`${VERCEL_API}/v2/files${q2}`, {
+          method: "POST",
+          headers: apiHeaders(token, {
+            "Content-Type": "application/octet-stream",
+            "x-vercel-digest": file.sha,
+            "Content-Length": String(file.size)
+          }),
+          body: new Uint8Array(file.content)
+        });
+        if (!res.ok) {
+          const body = await res.text();
+          throw new Error(
+            `File upload failed for ${file.relativePath} (${res.status}): ${body}`
+          );
+        }
+      })
+    );
+  }
+}
+async function createDeployment(files, token, orgId, projectId) {
+  const q2 = teamQuery(orgId);
+  const body = {
+    project: projectId,
+    target: "production",
+    files: files.map((f) => ({
+      file: f.relativePath,
+      sha: f.sha,
+      size: f.size
+    })),
+    projectSettings: {
+      buildCommand: "",
+      installCommand: "",
+      outputDirectory: "."
+    }
+  };
+  const res = await fetch(`${VERCEL_API}/v13/deployments${q2}`, {
+    method: "POST",
+    headers: apiHeaders(token, { "Content-Type": "application/json" }),
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`Create deployment failed (${res.status}): ${text}`);
+  }
+  return await res.json();
+}
+async function waitForReady(deploymentId, token, orgId) {
+  const q2 = teamQuery(orgId);
+  for (let attempt = 0; attempt < POLL_MAX_ATTEMPTS; attempt++) {
+    const res = await fetch(
+      `${VERCEL_API}/v13/deployments/${deploymentId}${q2}`,
+      { headers: apiHeaders(token) }
+    );
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(
+        `Deployment status check failed (${res.status}): ${text}`
+      );
+    }
+    const data = await res.json();
+    if (data.readyState === "READY") return data;
+    if (data.readyState === "ERROR") {
+      throw new Error(
+        `Deployment failed: ${data.errorMessage || "Unknown error"}`
+      );
+    }
+    if (data.readyState === "CANCELED") {
+      throw new Error("Deployment was canceled");
+    }
+    await new Promise((r2) => setTimeout(r2, POLL_INTERVAL_MS));
+  }
+  throw new Error("Deployment timed out (5+ minutes)");
+}
 async function deployVercelFrontend(appDir, _config) {
   const result = resolveVercelCredentials(appDir);
   if (result.missing) {
+    const secretVars = result.missing.filter((v2) => v2 === "VERCEL_TOKEN");
+    const appVars = result.missing.filter((v2) => v2 !== "VERCEL_TOKEN");
+    const hints = [];
+    if (secretVars.length > 0)
+      hints.push("Add VERCEL_TOKEN to .dndev.secrets at project root.");
+    if (appVars.length > 0)
+      hints.push(`Add ${appVars.join(", ")} to apps/<app>/.env`);
     throw new Error(
-      `Missing Vercel credentials in .env.local: ${result.missing.join(", ")}
-Add them to apps/<app>/.env.local \u2014 see guides/dndev/SETUP_VERCEL.md`
+      `Missing Vercel credentials: ${result.missing.join(", ")}
+` + hints.join("\n") + "\nSee guides/dndev/SETUP_VERCEL.md"
     );
   }
   const { token, orgId, projectId } = result.credentials;
-  log.debug("Using Vercel credentials from .env (token-based auth)");
-  log.info("Deploying to Vercel...");
-  const deployResult = spawnSync3(
-    "bunx",
-    ["vercel", "deploy", "--prod", "--yes", "--token", token],
-    {
-      cwd: appDir,
-      // stdout piped to capture deployment URL, stderr inherits for progress
-      stdio: ["inherit", "pipe", "inherit"],
-      encoding: "utf-8",
-      env: {
-        ...process.env,
-        VERCEL_ORG_ID: orgId,
-        VERCEL_PROJECT_ID: projectId
-      }
-    }
-  );
-  if (deployResult.status !== 0) {
-    throw new Error(`vercel deploy exited with code ${deployResult.status}`);
-  }
-  const deployUrl = deployResult.stdout?.trim();
-  if (deployUrl) {
-    log.success(`Production: ${deployUrl}`);
-  } else {
-    log.success("Frontend deployed to Vercel");
+  const distDir = joinPath(appDir, "dist");
+  if (!pathExists(distDir)) {
+    throw new Error(`dist/ not found at ${distDir}. Run build first.`);
+  }
+  log.debug("Using Vercel REST API (token-based, no CLI)");
+  log.info("Collecting dist/ files...");
+  const files = await collectDistFiles(distDir);
+  if (files.length === 0) {
+    throw new Error("dist/ is empty \u2014 nothing to deploy.");
+  }
+  log.info(`Found ${files.length} files`);
+  log.info("Uploading files to Vercel...");
+  await uploadFiles(files, token, orgId);
+  log.success(`${files.length} files uploaded`);
+  log.info("Creating production deployment...");
+  const deployment = await createDeployment(files, token, orgId, projectId);
+  log.info(`Deployment ${deployment.id} created, waiting...`);
+  const ready = await waitForReady(deployment.id, token, orgId);
+  const prodUrl = `https://${ready.url}`;
+  log.success(`Production: ${prodUrl}`);
+  if (ready.alias?.length) {
+    log.info(`Aliases: ${ready.alias.join(", ")}`);
   }
 }
 
 // packages/tooling/src/apps/deploy-functions.ts
 init_utils();
 var import_yaml = __toESM(require_dist(), 1);
-import { execSync as execSync2, spawnSync as spawnSync4 } from "node:child_process";
+import { execSync as execSync2, spawnSync as spawnSync3 } from "node:child_process";
 init_pathResolver();
 init_cli_tools();
 init_typed_file_operations();
@@ -16701,6 +16917,14 @@ function generateCleanPackageJson(functionsDir) {
   }
   const cleanPackageJson = { ...packageJson };
   if (cleanPackageJson.dependencies) {
+    const removedDeps = Object.entries(cleanPackageJson.dependencies).filter(
+      ([, version]) => String(version).startsWith("file:") || String(version).startsWith("workspace:")
+    );
+    if (removedDeps.length > 0) {
+      log.warn(
+        `Filtering out ${removedDeps.length} workspace/file dep(s) from dependencies: ${removedDeps.map(([name]) => name).join(", ")}`
+      );
+    }
     cleanPackageJson.dependencies = Object.fromEntries(
       Object.entries(cleanPackageJson.dependencies).filter(
         ([, version]) => !String(version).startsWith("file:") && !String(version).startsWith("workspace:")
@@ -16708,6 +16932,16 @@ function generateCleanPackageJson(functionsDir) {
     );
   }
   if (cleanPackageJson.devDependencies) {
+    const removedDevDeps = Object.entries(
+      cleanPackageJson.devDependencies
+    ).filter(
+      ([, version]) => String(version).startsWith("file:") || String(version).startsWith("workspace:")
+    );
+    if (removedDevDeps.length > 0) {
+      log.warn(
+        `Filtering out ${removedDevDeps.length} workspace/file dep(s) from devDependencies: ${removedDevDeps.map(([name]) => name).join(", ")}`
+      );
+    }
     cleanPackageJson.devDependencies = Object.fromEntries(
       Object.entries(cleanPackageJson.devDependencies).filter(
         ([, version]) => !String(version).startsWith("file:") && !String(version).startsWith("workspace:")
@@ -16813,7 +17047,7 @@ function updateCloudRunIAM(functionNames, projectId, region, serviceAccountPath,
   let failCount = 0;
   for (const funcName of functionNames) {
     try {
-      const result = spawnSync4(
+      const result = spawnSync3(
         "gcloud",
         [
           "run",
@@ -16931,7 +17165,7 @@ async function autoSyncSecrets(functionsDir, projectId, config) {
     let failCount = 0;
     for (const { key, value } of secrets) {
       try {
-        const result = spawnSync4(
+        const result = spawnSync3(
           firebaseCmd,
           ["functions:secrets:set", key, "--project", projectId],
           {
@@ -17118,7 +17352,7 @@ async function deployRules(appDir, serviceAccountPath, projectId, config, option
 
 // packages/tooling/src/apps/deploy-utils.ts
 init_utils();
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync4 } from "node:child_process";
 init_pathResolver();
 init_typed_file_operations();
 init_error_handling();
@@ -17130,8 +17364,8 @@ function detectAvailableApps() {
   }
   return readdirSync2(appsDir).filter((item) => {
     const itemPath = joinPath(appsDir, item);
-    const stat = statSync2(itemPath);
-    return stat?.isDirectory() === true;
+    const stat2 = statSync2(itemPath);
+    return stat2?.isDirectory() === true;
   }).filter((app) => {
     const appDir = joinPath(appsDir, app);
     const firebaseJsonPath = joinPath(appDir, "firebase.json");
@@ -17306,7 +17540,7 @@ How to fix:
     if (shouldOpen) {
       try {
         const openCommand = process.platform === "win32" ? "start" : process.platform === "darwin" ? "open" : "xdg-open";
-        spawnSync5(openCommand, [consoleUrl], { shell: true });
+        spawnSync4(openCommand, [consoleUrl], { shell: true });
         log.success("Opening Firebase Console...");
       } catch {
         log.warn("Could not open browser. Please open the URL manually.");
@@ -17737,12 +17971,6 @@ async function main2(options = {}) {
       ...serviceAccountPath ? [`Service Account: ${serviceAccountPath}`] : []
     ].join("\n");
     Me(configNote, "Deployment Configuration");
-    if (shouldDeployVercelFrontend) {
-      requireCLI(
-        CLI_TOOLS.VERCEL,
-        "Vercel CLI is required to deploy the frontend.\nInstall: bun install -g vercel"
-      );
-    }
     if (shouldDeployFirebaseFrontend && serviceAccountPath && config.project) {
       await deployFrontend(appDir, serviceAccountPath, config.project, config);
     }