@fern-api/generator-cli 0.9.32 → 0.9.34

package/dist/cli.js

@@ -22126,7 +22126,7 @@ var init_diff3 = __esm({
   }
 });
 
-// ../../node_modules/.pnpm/@fern-api+replay@0.16.0/node_modules/@fern-api/replay/dist/index.js
+// ../../node_modules/.pnpm/@fern-api+replay@0.16.2/node_modules/@fern-api/replay/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
   CREDENTIAL_PATTERNS: () => CREDENTIAL_PATTERNS,
@@ -22437,13 +22437,13 @@ function isSensitiveFile(filePath) {
   return SENSITIVE_FILE_PATTERNS.some((re) => re.test(filePath));
 }
 function scanForCredentials(content) {
-  const matches = [];
+  const matches2 = [];
   for (const { name, re } of CREDENTIAL_PATTERNS) {
     if (re.test(content)) {
-      matches.push(name);
+      matches2.push(name);
     }
   }
-  return matches;
+  return matches2;
 }
 function isGenerationCommit(commit) {
   const isFernSupport = FERN_SUPPORT_NAMES.includes(commit.authorName);
@@ -22485,6 +22485,15 @@ function isBinaryFile(filePath) {
   const ext2 = (0, import_path9.extname)(filePath).toLowerCase();
   return BINARY_EXTENSIONS.has(ext2);
 }
+function matchesFernignorePattern(filePath, patterns) {
+  if (patterns.length === 0) return false;
+  return patterns.some((p2) => {
+    if (filePath === p2) return true;
+    if (minimatch(filePath, p2)) return true;
+    if (!p2.includes("*") && !p2.includes("?") && filePath.startsWith(p2 + "/")) return true;
+    return false;
+  });
+}
 function parsePatchFileHeaders(patchContent) {
   const results = [];
   let currentPath = null;
@@ -22525,11 +22534,13 @@ async function capturePatchSnapshot(git, files, treeish) {
   }
   return snapshot;
 }
-function filterInfrastructureAndSensitiveFiles(rawFilesOutput) {
+function filterInfrastructureAndSensitiveFiles(rawFilesOutput, fernignorePatterns) {
   const allFiles = rawFilesOutput.trim().split("\n").filter(Boolean).filter((f) => !INFRASTRUCTURE_FILES.has(f)).filter((f) => !f.startsWith(".fern/"));
   const sensitiveFiles = allFiles.filter((f) => isSensitiveFile(f));
-  const files = allFiles.filter((f) => !isSensitiveFile(f));
-  return { files, sensitiveFiles };
+  const nonSensitive = allFiles.filter((f) => !isSensitiveFile(f));
+  const fernignoredFiles = nonSensitive.filter((f) => matchesFernignorePattern(f, fernignorePatterns));
+  const files = nonSensitive.filter((f) => !matchesFernignorePattern(f, fernignorePatterns));
+  return { files, sensitiveFiles, fernignoredFiles };
 }
 function threeWayMerge(base, ours, theirs) {
   const baseLines = base.split("\n");
@@ -23123,12 +23134,23 @@ async function computePerPatchDiff(patch, getCurrentGenContent, getWorkingTreeCo
       unlocatableFiles.push(file);
       continue;
     }
-    const locInCurrentGen = locInCurrentGenRaw.map(
-      (l) => resolveSpan(l, currentGenLines, "old")
-    );
-    const locInWorkingTree = locInWorkingTreeRaw.map(
-      (l) => resolveSpan(l, workingTreeLines, "new")
-    );
+    const locInCurrentGen = [];
+    const locInWorkingTree = [];
+    let spanResolutionFailed = false;
+    for (let i2 = 0; i2 < locInCurrentGenRaw.length; i2++) {
+      const cg = resolveSpan(locInCurrentGenRaw[i2], currentGenLines, "old");
+      const wt = resolveSpan(locInWorkingTreeRaw[i2], workingTreeLines, "new");
+      if (cg === null || wt === null) {
+        spanResolutionFailed = true;
+        break;
+      }
+      locInCurrentGen.push(cg);
+      locInWorkingTree.push(wt);
+    }
+    if (spanResolutionFailed) {
+      unlocatableFiles.push(file);
+      continue;
+    }
     const overlay = overlayRegions(
       currentGenLines,
       locInCurrentGen,
@@ -23190,11 +23212,11 @@ function resolveSpan(loc, oursLines, prefer) {
   if (prefer === "old") {
     if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
     if (newFits) return { ...loc, oursSpan: hunk.newCount };
-  } else {
-    if (newFits) return { ...loc, oursSpan: hunk.newCount };
-    if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+    return loc;
   }
-  return loc;
+  if (newFits) return { ...loc, oursSpan: hunk.newCount };
+  if (oldFits) return { ...loc, oursSpan: hunk.oldCount };
+  return null;
 }
 function sequenceMatches(needle, haystack, offset) {
   if (offset + needle.length > haystack.length) return false;
@@ -23364,6 +23386,93 @@ function computeCommitBuckets(results, absorbedPatchIds, patchesPassedToCommit)
   }
   return { applied, unresolved, absorbed };
 }
+function computeLegacyFernignoreCleanse(patch, fernignorePatterns, computeContentHash2) {
+  const matchesFernignore = (filePath) => fernignorePatterns.some((p2) => {
+    if (filePath === p2) return true;
+    if (minimatch(filePath, p2)) return true;
+    if (!p2.includes("*") && !p2.includes("?") && filePath.startsWith(p2 + "/")) return true;
+    return false;
+  });
+  const strippedFromFiles = patch.files.filter(matchesFernignore);
+  const survivingFiles = patch.files.filter((f) => !matchesFernignore(f));
+  let survivingSnapshot = void 0;
+  let snapshotChanged = false;
+  if (patch.theirs_snapshot) {
+    survivingSnapshot = {};
+    for (const [key, value] of Object.entries(patch.theirs_snapshot)) {
+      if (matchesFernignore(key)) {
+        snapshotChanged = true;
+      } else {
+        survivingSnapshot[key] = value;
+      }
+    }
+  }
+  const { stripped: patchContentStripped, content: newPatchContent, strippedSectionPaths } = stripFernignoreDiffSections(patch.patch_content, matchesFernignore);
+  const unchanged = strippedFromFiles.length === 0 && !snapshotChanged && !patchContentStripped;
+  if (unchanged) {
+    return {
+      unchanged: true,
+      remove: false,
+      files: patch.files,
+      patch_content: patch.patch_content,
+      content_hash: patch.content_hash,
+      theirs_snapshot: patch.theirs_snapshot,
+      strippedPaths: []
+    };
+  }
+  const strippedPaths = Array.from(/* @__PURE__ */ new Set([...strippedFromFiles, ...strippedSectionPaths]));
+  if (survivingFiles.length === 0 || newPatchContent.trim() === "") {
+    return {
+      unchanged: false,
+      remove: true,
+      files: [],
+      patch_content: "",
+      content_hash: "",
+      strippedPaths
+    };
+  }
+  const newContentHash = patchContentStripped ? computeContentHash2(newPatchContent) : patch.content_hash;
+  return {
+    unchanged: false,
+    remove: false,
+    files: survivingFiles,
+    patch_content: newPatchContent,
+    content_hash: newContentHash,
+    ...survivingSnapshot !== void 0 ? { theirs_snapshot: survivingSnapshot } : {},
+    strippedPaths
+  };
+}
+function stripFernignoreDiffSections(patchContent, matchesFernignore) {
+  const lines = patchContent.split("\n");
+  const sectionStarts = [];
+  for (let i2 = 0; i2 < lines.length; i2++) {
+    const line = lines[i2];
+    if (line.startsWith("diff --git ")) {
+      const match2 = line.match(/^diff --git a\/(.+?) b\/(.+?)$/);
+      const path5 = match2 ? match2[2] : null;
+      sectionStarts.push({ idx: i2, path: path5 });
+    }
+  }
+  if (sectionStarts.length === 0) {
+    return { stripped: false, content: patchContent, strippedSectionPaths: [] };
+  }
+  const preamble = lines.slice(0, sectionStarts[0].idx);
+  const newLines = [...preamble];
+  const strippedSectionPaths = [];
+  let stripped = false;
+  for (let i2 = 0; i2 < sectionStarts.length; i2++) {
+    const section = sectionStarts[i2];
+    const next = sectionStarts[i2 + 1];
+    const endIdx = next ? next.idx : lines.length;
+    if (section.path !== null && matchesFernignore(section.path)) {
+      stripped = true;
+      strippedSectionPaths.push(section.path);
+      continue;
+    }
+    newLines.push(...lines.slice(section.idx, endIdx));
+  }
+  return { stripped, content: newLines.join("\n"), strippedSectionPaths };
+}
 async function bootstrap(outputDir, options) {
   const git = new GitClient(outputDir);
   const lockManager = new LockfileManager(outputDir);
@@ -23947,7 +24056,7 @@ function status(outputDir) {
 }
 var import_promises3, import_os, import_path7, import_fs6, import_path8, import_yaml, import_crypto, import_path9, import_promises4, import_os2, import_path10, import_promises5, import_path11, import_promises6, import_path12, import_fs7, import_promises7, import_path13, import_promises8, import_os3, import_path14, import_child_process3, import_crypto2, import_fs8, import_path15, import_yaml2, import_crypto3, import_fs9, import_path16, import_fs10, import_promises9, import_path17, __defProp3, __getOwnPropNames3, __esm3, __export3, GitClient_exports, GitClient, init_GitClient, HybridReconstruction_exports, init_HybridReconstruction, PatchApplyTheirs_exports, init_PatchApplyTheirs, CREDENTIAL_PATTERNS, SENSITIVE_FILE_PATTERNS, FERN_BOT_NAME, FERN_BOT_EMAIL, FERN_BOT_LOGIN, FERN_SUPPORT_NAMES, LOCKFILE_HEADER, LockfileNotFoundError, LockfileManager, BINARY_EXTENSIONS, INFRASTRUCTURE_FILES, ReplayDetector, MergeAccumulator, CONFLICT_OPENER, CONFLICT_SEPARATOR, CONFLICT_CLOSER, ReplayApplicator, ReplayCommitter, FileOwnership, FirstGenerationFlow, SkipApplicationFlow, NoPatchesFlow, NormalRegenerationFlow, ReplayService, FernignoreMigrator, REPLAY_FERNIGNORE_ENTRIES, GITATTRIBUTES_ENTRIES, EMPTY_RESULT;
 var init_dist3 = __esm({
-  "../../node_modules/.pnpm/@fern-api+replay@0.16.0/node_modules/@fern-api/replay/dist/index.js"() {
+  "../../node_modules/.pnpm/@fern-api+replay@0.16.2/node_modules/@fern-api/replay/dist/index.js"() {
     "use strict";
     init_esm4();
     import_promises3 = require("fs/promises");
@@ -23955,8 +24064,10 @@ var init_dist3 = __esm({
     import_path7 = require("path");
     import_fs6 = require("fs");
     import_path8 = require("path");
+    init_esm3();
     import_yaml = __toESM(require_dist3(), 1);
     import_crypto = require("crypto");
+    init_esm3();
     import_path9 = require("path");
     init_diff3();
     import_promises4 = require("fs/promises");
@@ -24187,10 +24298,23 @@ var init_dist3 = __esm({
     LockfileManager = class {
       outputDir;
       lock = null;
+      fernignorePatterns = [];
       warnings = [];
       constructor(outputDir) {
         this.outputDir = outputDir;
       }
+      /**
+       * Inform the lockfile of the customer's `.fernignore` patterns so that
+       * `save()` can suppress its "Patch X removed from lockfile" warning when
+       * every file in the stripped patch is already `.fernignore`-protected.
+       * The strip itself still happens (credentials never persist); only the
+       * customer-visible warning is suppressed in that case, because the
+       * protected files survive the generator wipe regardless of whether the
+       * lockfile tracks them, so there's nothing for the customer to action.
+       */
+      setFernignorePatterns(patterns) {
+        this.fernignorePatterns = patterns;
+      }
       get lockfilePath() {
         return (0, import_path8.join)(this.outputDir, ".fern", "replay.lock");
       }
@@ -24259,9 +24383,14 @@ var init_dist3 = __esm({
             if (sensitiveFiles.length > 0) {
               reasons.push(`sensitive files: ${sensitiveFiles.join(", ")}`);
             }
-            this.warnings.push(
-              `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+            const allProtected = patch.files.length > 0 && patch.files.every(
+              (f) => this.fernignorePatterns.some((p2) => f === p2 || minimatch(f, p2))
             );
+            if (!allProtected) {
+              this.warnings.push(
+                `Patch ${patch.id} removed from lockfile: ${reasons.join("; ")}. This prevents credential exposure in committed lockfiles.`
+              );
+            }
           } else {
             cleanPatches.push(patch);
           }
@@ -24421,11 +24550,13 @@ var init_dist3 = __esm({
       git;
       lockManager;
       sdkOutputDir;
+      fernignorePatterns;
       warnings = [];
-      constructor(git, lockManager, sdkOutputDir) {
+      constructor(git, lockManager, sdkOutputDir, fernignorePatterns = []) {
         this.git = git;
         this.lockManager = lockManager;
         this.sdkOutputDir = sdkOutputDir;
+        this.fernignorePatterns = fernignorePatterns;
       }
       /**
        * Derive the previous-generation SHA from git history instead of trusting
@@ -24532,22 +24663,30 @@ var init_dist3 = __esm({
             continue;
           }
           const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-          const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+          const { files, sensitiveFiles, fernignoredFiles } = filterInfrastructureAndSensitiveFiles(
+            filesOutput,
+            this.fernignorePatterns
+          );
           if (sensitiveFiles.length > 0) {
             this.warnings.push(
               `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
             );
-            if (files.length > 0) {
-              const parentSha = parents[0];
-              if (parentSha) {
-                try {
-                  patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
-                } catch {
-                  continue;
-                }
-                if (!patchContent.trim()) continue;
-                contentHash = this.computeContentHash(patchContent);
+          }
+          if (fernignoredFiles.length > 0) {
+            this.warnings.push(
+              `.fernignore-protected file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${fernignoredFiles.join(", ")}. These files are managed by .fernignore, not Replay.`
+            );
+          }
+          if ((sensitiveFiles.length > 0 || fernignoredFiles.length > 0) && files.length > 0) {
+            const parentSha = parents[0];
+            if (parentSha) {
+              try {
+                patchContent = await this.git.exec(["diff", parentSha, commit.sha, "--", ...files]);
+              } catch {
+                continue;
               }
+              if (!patchContent.trim()) continue;
+              contentHash = this.computeContentHash(patchContent);
             }
           }
           if (files.length === 0) {
@@ -24746,12 +24885,20 @@ var init_dist3 = __esm({
           resolvedBaseGeneration = fallback;
         }
         const filesOutput = await this.git.exec(["diff", "--name-only", diffBase, "HEAD"]);
-        const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+        const { files, sensitiveFiles, fernignoredFiles } = filterInfrastructureAndSensitiveFiles(
+          filesOutput,
+          this.fernignorePatterns
+        );
         if (sensitiveFiles.length > 0) {
           this.warnings.push(
             `Sensitive file(s) excluded from composite patch: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
           );
         }
+        if (fernignoredFiles.length > 0) {
+          this.warnings.push(
+            `.fernignore-protected file(s) excluded from composite patch: ${fernignoredFiles.join(", ")}. These files are managed by .fernignore, not Replay.`
+          );
+        }
         if (files.length === 0) return { patches: [], revertedPatchIds: [] };
         const diff = await this.git.exec(["diff", diffBase, "HEAD", "--", ...files]);
         if (!diff.trim()) return { patches: [], revertedPatchIds: [] };
@@ -24834,23 +24981,31 @@ var init_dist3 = __esm({
             continue;
           }
           const filesOutput = await this.git.exec(["diff-tree", "--no-commit-id", "--name-only", "-r", commit.sha]);
-          const { files, sensitiveFiles } = filterInfrastructureAndSensitiveFiles(filesOutput);
+          const { files, sensitiveFiles, fernignoredFiles } = filterInfrastructureAndSensitiveFiles(
+            filesOutput,
+            this.fernignorePatterns
+          );
           if (sensitiveFiles.length > 0) {
             this.warnings.push(
               `Sensitive file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${sensitiveFiles.join(", ")}. These files will not be tracked by replay.`
             );
-            if (files.length > 0) {
-              if (parents.length === 0) {
-                continue;
-              }
-              try {
-                patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
-              } catch {
-                continue;
-              }
-              if (!patchContent.trim()) continue;
-              contentHash = this.computeContentHash(patchContent);
+          }
+          if (fernignoredFiles.length > 0) {
+            this.warnings.push(
+              `.fernignore-protected file(s) excluded from patch for commit ${commit.sha.slice(0, 7)}: ${fernignoredFiles.join(", ")}. These files are managed by .fernignore, not Replay.`
+            );
+          }
+          if ((sensitiveFiles.length > 0 || fernignoredFiles.length > 0) && files.length > 0) {
+            if (parents.length === 0) {
+              continue;
+            }
+            try {
+              patchContent = await this.git.exec(["diff", parents[0], commit.sha, "--", ...files]);
+            } catch {
+              continue;
             }
+            if (!patchContent.trim()) continue;
+            contentHash = this.computeContentHash(patchContent);
           }
           if (files.length === 0) {
             continue;
@@ -25665,6 +25820,7 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
         };
       }
       async apply(_prep) {
+        this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
         this.service.lockManager.save();
         return firstGenerationReport();
       }
@@ -25711,6 +25867,7 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
         };
       }
       async apply(_prep, options) {
+        this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
         this.service.lockManager.save();
         const credentialWarnings = [...this.service.lockManager.warnings];
         if (!options?.stageOnly) {
@@ -25832,6 +25989,7 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
             this.service.lockManager.addPatch(patch);
           }
         }
+        this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
         this.service.lockManager.save();
         this.service.warnings.push(...this.service.lockManager.warnings);
         if (newPatches.length > 0) {
@@ -25992,6 +26150,7 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
             }
           }
         }
+        this.service.lockManager.setFernignorePatterns(this.service.readFernignorePatterns());
         this.service.lockManager.save();
         this.service.warnings.push(...this.service.lockManager.warnings);
         if (options?.stageOnly) {
@@ -26063,7 +26222,8 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
         this.git = git;
         this.outputDir = outputDir;
         this.lockManager = new LockfileManager(outputDir);
-        this.detector = new ReplayDetector(git, this.lockManager, outputDir);
+        const fernignorePatterns = this.readFernignorePatterns();
+        this.detector = new ReplayDetector(git, this.lockManager, outputDir, fernignorePatterns);
         this.applicator = new ReplayApplicator(git, this.lockManager, outputDir);
         this.committer = new ReplayCommitter(git, outputDir);
         this.fileOwnership = new FileOwnership(git);
@@ -26083,8 +26243,60 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
       async prepareReplay(options) {
         this.warnings = [];
         this.detector.warnings.length = 0;
+        this.cleanseLegacyFernignoreEntries();
         return this.selectFlow(options).prepare(options);
       }
+      /**
+       * ADR 0002 migration step. Strips `.fernignore`-matched entries from
+       * `patch.files`, `patch.theirs_snapshot` keys, and `diff --git` sections
+       * in `patch.patch_content` for every patch in the lockfile. Patches that
+       * end up with no surviving files are removed entirely.
+       *
+       * Idempotent: a second run is a no-op because the first run already
+       * matches the contract. Per-patch try/catch ensures one bad patch does
+       * not block the rest. Each affected patch emits a warning naming the
+       * stripped paths. `patch_content` is left untouched if no parseable
+       * `diff --git` headers are found (fail-safe for exotic legacy formats).
+       */
+      cleanseLegacyFernignoreEntries() {
+        const patterns = this.readFernignorePatterns();
+        if (patterns.length === 0) return;
+        if (!this.lockManager.exists()) return;
+        this.lockManager.read();
+        let lockfileMutated = false;
+        const patches = this.lockManager.getPatches();
+        for (const patch of patches) {
+          try {
+            const result = computeLegacyFernignoreCleanse(
+              patch,
+              patterns,
+              (content) => this.detector.computeContentHash(content)
+            );
+            if (result.unchanged) continue;
+            if (result.remove) {
+              this.lockManager.removePatch(patch.id);
+              this.warnings.push(
+                `Cleansed legacy patch ${patch.id}: all referenced files match .fernignore \u2014 patch removed. Customer's on-disk content for those files is preserved by .fernignore. (ADR 0002: .fernignore-protected files are not tracked by Replay.)`
+              );
+            } else {
+              this.lockManager.updatePatch(patch.id, {
+                files: result.files,
+                patch_content: result.patch_content,
+                content_hash: result.content_hash,
+                ...result.theirs_snapshot !== void 0 ? { theirs_snapshot: result.theirs_snapshot } : {}
+              });
+              this.warnings.push(
+                `Cleansed legacy patch ${patch.id}: stripped .fernignore-matched entries (${result.strippedPaths.join(", ")}). Customer's on-disk content for those files is preserved by .fernignore. (ADR 0002.)`
+              );
+            }
+            lockfileMutated = true;
+          } catch {
+          }
+        }
+        if (lockfileMutated) {
+          this.lockManager.save();
+        }
+      }
       /**
        * Phase 2 of the two-phase replay flow. Applies patches, rebases them against
        * the generation, saves the lockfile, and commits `[fern-replay]` (or stages
@@ -26676,6 +26888,11 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
                 (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
               );
               if (ppResult === null) continue;
+              if (ppResult.hadFallback) {
+                this.warnings.push(
+                  `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+                );
+              }
               const diff = ppResult.diff;
               if (!diff.trim()) {
                 if (await allPatchFilesUserOwned(patch)) continue;
@@ -26763,6 +26980,11 @@ Patches absorbed by generator (${buckets.absorbed.length}):`;
               (files) => this.git.exec(["diff", currentGen, "HEAD", "--", ...files]).catch(() => null)
             );
             if (ppResult === null) continue;
+            if (ppResult.hadFallback) {
+              this.warnings.push(
+                `Patch ${patch.id}: couldn't fully isolate ${ppResult.fallbackFiles.join(", ")} \u2014 customization preserved, attribution may have merged with another patch.`
+              );
+            }
             const diff = ppResult.diff;
             if (!diff.trim()) {
               if (await allPatchFilesUserOwned(patch)) {
@@ -26857,6 +27079,7 @@ If you want to keep these lines, restore them in a follow-up commit and re-run r
           }
         }
       }
+      /** @internal Used by Flow implementations in `src/flows/`. */
       readFernignorePatterns() {
         const fernignorePath = (0, import_path13.join)(this.outputDir, ".fernignore");
         if (!(0, import_fs7.existsSync)(fernignorePath)) return [];
@@ -31368,6 +31591,11 @@ var ClonedRepository = class _ClonedRepository {
     }
     await this.git.raw([...args, ...Array.isArray(files) ? files : [files]]);
   }
+  async listTrackedFiles() {
+    await this.git.cwd(this.clonePath);
+    const result = await this.git.raw(["ls-tree", "-r", "HEAD", "--name-only"]);
+    return result.split("\n").filter((line) => line.length > 0);
+  }
   async restoreFilesFromCommit(commitSha, files) {
     await this.git.cwd(this.clonePath);
     const fileList = Array.isArray(files) ? files : [files];
@@ -31790,6 +32018,20 @@ async function cloneRepository({ githubRepository, installationToken, targetDire
   });
 }
 
+// ../commons/github/lib/expandFernignorePatterns.js
+init_esm3();
+function expandFernignorePatterns(fernignoreContent, candidatePaths) {
+  const patterns = fernignoreContent.split("\n").map((line) => line.trim()).filter((line) => line.length > 0 && !line.startsWith("#"));
+  return candidatePaths.filter((candidate) => patterns.some((pattern) => matches(candidate, pattern)));
+}
+function matches(candidate, pattern) {
+  const normalized = pattern.endsWith("/") ? pattern.slice(0, -1) : pattern;
+  if (minimatch(candidate, normalized, { dot: true })) {
+    return true;
+  }
+  return candidate === normalized || candidate.startsWith(normalized + "/");
+}
+
 // ../../node_modules/.pnpm/universal-user-agent@7.0.3/node_modules/universal-user-agent/index.js
 function getUserAgent() {
   if (typeof navigator === "object" && "userAgent" in navigator) {
@@ -32006,11 +32248,11 @@ function removeNonChars(variableName) {
   return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
 }
 function extractUrlVariableNames(url) {
-  const matches = url.match(urlVariableRegex);
-  if (!matches) {
+  const matches2 = url.match(urlVariableRegex);
+  if (!matches2) {
     return [];
   }
-  return matches.map(removeNonChars).reduce((a, b3) => a.concat(b3), []);
+  return matches2.map(removeNonChars).reduce((a, b3) => a.concat(b3), []);
 }
 function omit(object2, keysToOmit) {
   const result = { __proto__: null };
@@ -32453,8 +32695,8 @@ async function fetchWrapper(requestOptions) {
     data: ""
   };
   if ("deprecation" in responseHeaders) {
-    const matches = responseHeaders.link && responseHeaders.link.match(/<([^<>]+)>; rel="deprecation"/);
-    const deprecationLink = matches && matches.pop();
+    const matches2 = responseHeaders.link && responseHeaders.link.match(/<([^<>]+)>; rel="deprecation"/);
+    const deprecationLink = matches2 && matches2.pop();
     log.warn(
       `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${responseHeaders.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
     );
@@ -35538,15 +35780,8 @@ var GitHub = class {
     if (fernignore === void 0) {
       return [];
     }
-    const fernignoreLines = fernignore.split("\n");
-    const fernignoreFiles = [];
-    for (const line of fernignoreLines) {
-      const trimmedLine = line.trim();
-      if (!trimmedLine.startsWith("#") && trimmedLine.length > 0 && await repository.fileExists({ relativeFilePath: trimmedLine })) {
-        fernignoreFiles.push(trimmedLine);
-      }
-    }
-    return fernignoreFiles;
+    const tracked = await repository.listTrackedFiles();
+    return expandFernignorePatterns(fernignore, tracked);
   }
   async restoreFiles(repository, files) {
     if (files.length === 0) {
@@ -41858,6 +42093,8 @@ var GithubStep = class extends BaseStep {
           );
         case "push":
           return await this.executePushMode(repository, resolvedPrFields);
+        case "commit-and-release":
+          return await this.executeCommitAndReleaseMode(repository, resolvedPrFields);
         default: {
           const exhaustive = mode;
           throw new Error(`Unexpected GitHub mode: ${String(exhaustive)}`);
@@ -42084,6 +42321,71 @@ var GithubStep = class extends BaseStep {
     }
     return result;
   }
+  async executeCommitAndReleaseMode(repository, resolved) {
+    const baseBranch = this.config.branch ?? await repository.getDefaultBranch();
+    if (this.config.branch != null) {
+      this.logger.debug(`Checking out branch ${this.config.branch}`);
+      await repository.checkout(this.config.branch);
+    }
+    await this.ensureFernignore();
+    this.logger.debug("Committing changes...");
+    await repository.commitAllChanges(resolved.commitMessage);
+    this.logger.debug(`Committed changes to local copy of GitHub repository at ${this.outputDir}`);
+    if (shouldCheckNoDiff(this.config)) {
+      const noDiff = await repository.treeHashEquals(`origin/${baseBranch}`);
+      if (noDiff) {
+        this.logger.info("No changes detected after generation \u2014 skipping commit-and-release");
+        return { executed: true, success: true, skippedNoDiff: true };
+      }
+    }
+    const result = {
+      executed: true,
+      success: true
+    };
+    if (!this.config.previewMode) {
+      const octokit = this.createOctokit();
+      const { owner, repo, remote } = parseRepository(this.config.uri);
+      await pushSignedCommit({
+        repository,
+        octokit,
+        owner,
+        repo,
+        branch: baseBranch,
+        force: false,
+        rebaseOnConflict: true,
+        author: this.config.author,
+        logger: this.logger
+      });
+      const pushedBranch = await repository.getCurrentBranch();
+      result.branchUrl = `https://${remote}/${owner}/${repo}/tree/${pushedBranch}`;
+      this.logger.info(`Pushed branch: ${result.branchUrl}`);
+      if (resolved.newVersion == null) {
+        this.logger.warn(
+          "No new version available \u2014 skipping release tag creation. Pass --version <semver> or --version AUTO to fern generate to enable release tagging."
+        );
+      } else {
+        try {
+          const tagName = resolved.newVersion;
+          const headSha = await repository.getHeadSha();
+          await octokit.repos.createRelease({
+            owner,
+            repo,
+            tag_name: tagName,
+            target_commitish: headSha,
+            name: tagName,
+            body: resolved.changelogEntry ?? resolved.commitMessage,
+            draft: false,
+            prerelease: false
+          });
+          this.logger.info(`Created GitHub release ${tagName}`);
+          result.releaseUrl = `https://${remote}/${owner}/${repo}/releases/tag/${tagName}`;
+        } catch (error) {
+          this.logger.warn(`Could not create GitHub release: ${extractErrorMessage(error)}`);
+        }
+      }
+    }
+    return result;
+  }
   createOctokit() {
     const opts = { auth: this.config.token };
     if (this.config.apiBaseUrl != null) {
@@ -42528,9 +42830,9 @@ var PostGenerationPipeline = class {
     this.logger = logger;
     let replayEnabled = config.replay?.enabled ?? false;
     let autoVersionEnabled = config.autoVersion?.enabled ?? false;
-    if (replayEnabled && config.github?.mode === "push") {
+    if (replayEnabled && (config.github?.mode === "push" || config.github?.mode === "commit-and-release")) {
       this.logger.warn(
-        "Replay is not supported with GitHub push mode. Disabling replay to prevent force push to base branch."
+        `Replay is not supported with GitHub ${config.github.mode} mode. Disabling replay to prevent push to base branch.`
       );
       replayEnabled = false;
     }