vercel 59.11.2 → 59.11.7

package/dist/chunks/chunk-GHKJAK5V.js

@@ -0,0 +1,1288 @@
+import { createRequire as __createRequire } from 'node:module';
+import { fileURLToPath as __fileURLToPath } from 'node:url';
+import { dirname as __dirname_ } from 'node:path';
+const require = __createRequire(import.meta.url);
+const __filename = __fileURLToPath(import.meta.url);
+const __dirname = __dirname_(__filename);
+import {
+  resolveProjectContext
+} from "./chunk-7KROIXQM.js";
+import {
+  require_frameworks
+} from "./chunk-FRVG4OW3.js";
+import {
+  require_json_parse_better_errors
+} from "./chunk-6E6KPBXY.js";
+import {
+  ensureLink,
+  parseEnv
+} from "./chunk-C762AAVU.js";
+import {
+  pullSubcommand
+} from "./chunk-XUAWTW4W.js";
+import {
+  performDeviceCodeFlow
+} from "./chunk-DBYHS3CK.js";
+import {
+  STANDARD_ENVIRONMENTS,
+  formatProject
+} from "./chunk-PNGVSHR3.js";
+import {
+  getDeployment,
+  parseTarget
+} from "./chunk-RN6V5ODW.js";
+import {
+  TelemetryClient
+} from "./chunk-HB4UKFDO.js";
+import {
+  printError
+} from "./chunk-3VM7HWF6.js";
+import {
+  parseArguments
+} from "./chunk-57RHXXXG.js";
+import {
+  addToGitIgnore,
+  param,
+  printAlignedLabel,
+  require_lib
+} from "./chunk-2TSBB22D.js";
+import {
+  buildCommandWithYes,
+  getPreservedArgsForEnvPull,
+  outputActionRequired,
+  outputAgentError
+} from "./chunk-26CU4Q3C.js";
+import {
+  isAPIError
+} from "./chunk-CV5YC2EN.js";
+import {
+  getCommandName,
+  getCommandNamePlain,
+  getFlagsSpecification
+} from "./chunk-Q2DGFCO7.js";
+import {
+  output_manager_default
+} from "./chunk-2JIX6UMI.js";
+import {
+  require_dist
+} from "./chunk-ZW6HETRE.js";
+import {
+  require_source
+} from "./chunk-S7KYDPEM.js";
+import {
+  __toESM
+} from "./chunk-TZ2YI2VH.js";
+
+// src/commands/env/pull.ts
+var import_chalk2 = __toESM(require_source(), 1);
+var import_fs_extra2 = __toESM(require_lib(), 1);
+import { closeSync, openSync, readSync } from "fs";
+import { resolve } from "path";
+
+// src/util/env/get-env-records.ts
+import { URLSearchParams } from "url";
+
+// src/util/env/challenge-recovery.ts
+var RECOVERABLE_CHALLENGE_CODES = /* @__PURE__ */ new Set([
+  "challenge_required",
+  "challenge_required_email_otp",
+  "user_auth_required"
+]);
+async function withEnvChallengeRecovery(client, fn) {
+  const hadStoredSession = Boolean(
+    client.authConfig.token || client.authConfig.refreshToken
+  );
+  try {
+    return await fn();
+  } catch (error) {
+    if (!isAPIError(error)) {
+      throw error;
+    }
+    const isRecoverableChallenge = RECOVERABLE_CHALLENGE_CODES.has(error.code);
+    const isRejectedStoredSession = hadStoredSession && error.invalidToken === true;
+    if (!isRecoverableChallenge && !isRejectedStoredSession) {
+      throw error;
+    }
+    if (client.authConfig.tokenSource || !client.stdin.isTTY || client.nonInteractive) {
+      throw error;
+    }
+    output_manager_default.stopSpinner();
+    output_manager_default.log("Sensitive Environment Variables require fresh authentication.");
+    const refreshToken = client.authConfig.refreshToken;
+    const acrValues = getAcrValuesFromWWWAuthenticate(error.wwwAuthenticate);
+    const tokens = isRecoverableChallenge && refreshToken && acrValues ? await performDeviceCodeFlow(client, {
+      refreshToken,
+      acrValues,
+      fallbackToLoginOnStepUpFailure: true
+    }) : await performDeviceCodeFlow(client);
+    if (!tokens) {
+      throw error;
+    }
+    client.updateAuthConfig({
+      token: tokens.access_token,
+      userId: void 0,
+      expiresAt: Math.floor(Date.now() / 1e3) + tokens.expires_in,
+      refreshToken: tokens.refresh_token
+    });
+    client.persistAuthConfig();
+    return await fn();
+  }
+}
+function getAcrValuesFromWWWAuthenticate(header) {
+  if (!header) {
+    return;
+  }
+  const bearerIndex = header.toLowerCase().indexOf("bearer");
+  if (bearerIndex === -1) {
+    return;
+  }
+  const bearerChallenge = header.slice(bearerIndex + "bearer".length);
+  const match = bearerChallenge.match(
+    /(?:^|[,\s])acr_values=(?:"((?:\\.|[^"\\])*)"|([^,\s]+))/i
+  );
+  return match?.[1]?.replace(/\\(.)/g, "$1") ?? match?.[2];
+}
+
+// src/util/env/get-env-records.ts
+async function getEnvRecords(client, projectId, source, {
+  target,
+  gitBranch,
+  decrypt
+} = {}) {
+  output_manager_default.debug(
+    `Fetching Environment Variables of project ${projectId} and target ${target}`
+  );
+  const query = new URLSearchParams();
+  if (target) {
+    let targetParam = "target";
+    if (target !== "production" && target !== "preview" && target !== "development") {
+      targetParam = "customEnvironmentId";
+    }
+    query.set(targetParam, target);
+  }
+  if (gitBranch) {
+    query.set("gitBranch", gitBranch);
+  }
+  if (decrypt) {
+    query.set("decrypt", decrypt.toString());
+  }
+  if (source) {
+    query.set("source", source);
+  }
+  const url = `/v10/projects/${projectId}/env?${query}`;
+  return withEnvChallengeRecovery(
+    client,
+    () => client.fetch(url)
+  );
+}
+async function pullEnvRecords(client, projectIdOrDeploymentId, source, { target, gitBranch } = {}) {
+  output_manager_default.debug(
+    `Fetching Environment Variables of ${projectIdOrDeploymentId} and target ${target}`
+  );
+  const query = new URLSearchParams();
+  let url = `/v3/env/pull/${projectIdOrDeploymentId}`;
+  if (!projectIdOrDeploymentId.startsWith("dpl_")) {
+    if (target) {
+      url += `/${encodeURIComponent(target)}`;
+      if (gitBranch) {
+        url += `/${encodeURIComponent(gitBranch)}`;
+      }
+    }
+  }
+  if (source) {
+    query.set("source", source);
+  }
+  if (Array.from(query).length > 0) {
+    url += `?${query}`;
+  }
+  return withEnvChallengeRecovery(
+    client,
+    () => client.fetch(url)
+  );
+}
+
+// src/util/env/diff-env-files.ts
+var import_fs_extra = __toESM(require_lib(), 1);
+var import_chalk = __toESM(require_source(), 1);
+async function createEnvObject(envPath) {
+  const envArr = (await (0, import_fs_extra.readFile)(envPath, "utf-8")).replace(/"/g, "").split(/\r?\n|\r/).filter((line) => /^[^#]/.test(line)).filter((line) => /=/i.test(line));
+  const parsedEnv = parseEnv(envArr);
+  if (Object.keys(parsedEnv).length === 0) {
+    output_manager_default.debug("Failed to parse env file.");
+    return;
+  }
+  return parsedEnv;
+}
+function findChanges(oldEnv, newEnv) {
+  const added = [];
+  const changed = [];
+  for (const key of Object.keys(newEnv)) {
+    if (oldEnv[key] === void 0) {
+      added.push(key);
+    } else if (oldEnv[key] !== newEnv[key]) {
+      changed.push(key);
+    }
+    delete oldEnv[key];
+  }
+  const removed = Object.keys(oldEnv);
+  return {
+    added,
+    changed,
+    removed
+  };
+}
+function buildDeltaString(oldEnv, newEnv) {
+  const { added, changed, removed } = findChanges(oldEnv, newEnv);
+  let deltaString = "";
+  deltaString += import_chalk.default.green(addDeltaSection("+", changed, true));
+  deltaString += import_chalk.default.green(addDeltaSection("+", added));
+  deltaString += import_chalk.default.red(addDeltaSection("-", removed));
+  return deltaString ? import_chalk.default.gray("  Changes:\n") + deltaString + "\n" : deltaString;
+}
+function addDeltaSection(prefix, arr, changed = false) {
+  if (arr.length === 0)
+    return "";
+  return arr.sort().map((item) => `  ${prefix} ${item}${changed ? " (Updated)" : ""}`).join("\n") + "\n";
+}
+
+// src/util/env/constants.ts
+var VERCEL_OIDC_TOKEN = "VERCEL_OIDC_TOKEN";
+var SENSITIVE_ENV_VALUE_PLACEHOLDER = "[SENSITIVE]";
+
+// src/util/env/validate-env.ts
+var import_frameworks = __toESM(require_frameworks(), 1);
+import { readFile as readFile2 } from "fs/promises";
+import { join } from "path";
+
+// src/util/env/secret-detection.ts
+var SERVER_ONLY_KEY_PATTERNS = [
+  "access_token",
+  "refresh_token",
+  "client_secret",
+  "webhook_secret",
+  "api_key",
+  "private_key",
+  "service_account",
+  "service_role",
+  "database_url",
+  "database_uri",
+  "db_url",
+  "postgres_url",
+  "postgres_uri",
+  "mysql_url",
+  "mongo_url",
+  "mongo_uri",
+  "redis_url",
+  "redis_uri",
+  "amqp_url",
+  "kafka_url",
+  "elasticsearch_url",
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "private",
+  "key",
+  "apikey",
+  "auth",
+  "token",
+  "jwt",
+  "signature",
+  "cert",
+  "pem",
+  "salt",
+  "bearer",
+  "credential",
+  "credentials",
+  "creds"
+];
+var SAFE_KEY_HINT_TOKENS = ["public", "publishable", "anon"];
+var WELL_KNOWN_SECRET_NAMES = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DATABASE_URL_UNPOOLED",
+  "POSTGRES_URL",
+  "POSTGRES_URL_NON_POOLING",
+  "POSTGRES_URL_NO_SSL",
+  "POSTGRES_URL_UNPOOLED",
+  "POSTGRES_PRISMA_URL",
+  "MONGODB_URI",
+  "MONGODB_URL",
+  "MONGO_URI",
+  "MONGO_URL",
+  "MYSQL_URL",
+  "MYSQL_URI",
+  "REDIS_URL",
+  "REDIS_TLS_URL",
+  "KV_URL",
+  "KV_REST_API_URL",
+  "UPSTASH_REDIS_REST_URL",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "AWS_ACCESS_KEY_ID"
+]);
+var SECRET_SEGMENT_PATTERN = /(?:^|[_-])(SECRET|PASSWORD|PASSWD|PASSPHRASE|PWD|PGPASSWORD|TOKEN|CREDENTIAL|JWT|DSN|APIKEY|PRIVATEKEY|SALT|PEPPER|MNEMONIC|PEM|CIPHER)S?(?:[_-]|$)/i;
+var EXPLICIT_SECRET_TOKEN_PATTERN = /(?:^|[_-])(SECRET|PASSWORD|PASSWD|PASSPHRASE|PWD|PGPASSWORD|TOKEN|CREDENTIAL|MNEMONIC|PRIVATEKEY|APIKEY)S?(?:[_-]|$)/i;
+var SECRET_COMPOUND_PATTERNS = [
+  /(?:^|[_-])(?:API|PRIVATE|SIGNING|ENCRYPTION|SESSION|COOKIE|CSRF|HMAC|ACCESS|APP|WRITE)[_-]?(?:KEY|SECRET)S?(?:[_-]|$)/i,
+  /(?:^|[_-])(?:ACCESS|REFRESH|BEARER|AUTH)[_-]?TOKENS?(?:[_-]|$)/i,
+  /(?:^|[_-])(?:WEBHOOK|SIGNING)[_-]?SECRETS?(?:[_-]|$)/i,
+  /(?:^|[_-])SERVICE[_-]?(?:ROLE(?:[_-]?KEYS?)?|ACCOUNTS?)(?:[_-]|$)/i
+];
+var NON_CREDENTIAL_KEY_TOKENS = /* @__PURE__ */ new Set([
+  "PUBLIC",
+  "PUBLISHABLE",
+  "ANON",
+  "PRIMARY",
+  "PARTITION",
+  "FOREIGN",
+  "SORT",
+  "HASH",
+  "COMPOSITE",
+  "INDEX",
+  "UNIQUE",
+  "NATURAL",
+  "SURROGATE",
+  "CACHE",
+  "IDEMPOTENCY",
+  "LOOKUP",
+  "ROW",
+  "SHARD",
+  "CLUSTER",
+  "LICENSE",
+  "LICENCE",
+  "PRODUCT",
+  "TRANSLATION",
+  "TRANSLATIONS",
+  "I18N",
+  "LOCALE",
+  "RBAC",
+  "ACL",
+  "ROLE",
+  "ROLES",
+  "PERMISSION",
+  "PERMISSIONS",
+  "SCOPE",
+  "SCOPES",
+  "POLICY",
+  "POLICIES"
+]);
+var GENERIC_KEY_SUFFIX_PATTERN = /(?:^|[_-])([A-Z0-9]+)[_-]KEYS?$/i;
+var GENERIC_KEY_PREFIX_PATTERN = /^KEYS?[_-]([A-Z0-9]+)(?:[_-]|$)/i;
+var DB_URL_PATTERN = /(?:^|_)(?:DATABASE|POSTGRES|MONGO|MONGODB|MYSQL|REDIS|NEON|PLANETSCALE|TURSO|RDS)(?:_[A-Z0-9_]*)?_(?:URL|URI)(?:_[A-Z0-9_]+)?$/i;
+var SECRET_VALUE_PATTERNS = [
+  /gh[opsru]_[A-Za-z0-9_]{20,}/,
+  /github_pat_[A-Za-z0-9_]{20,}/,
+  /glpat-[A-Za-z0-9_-]{20,}/,
+  /(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}/,
+  /whsec_[A-Za-z0-9]{20,}/,
+  /xox[abprs]-[A-Za-z0-9-]{20,}/,
+  /xapp-[A-Za-z0-9-]{20,}/,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+  /\bAIza[A-Za-z0-9_-]{30,}/,
+  /sk-ant-[A-Za-z0-9_-]{20,}/,
+  /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/,
+  /\bsk-[A-Za-z0-9]{32,}\b/,
+  /shp(?:at|ss|ca)_[a-fA-F0-9]{32}/,
+  /npm_[A-Za-z0-9]{30,}/,
+  /\bhf_[A-Za-z0-9_]{30,}/,
+  /nvapi-[A-Za-z0-9_-]{40,}/,
+  /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/,
+  /key-[a-f0-9]{32}/,
+  /glsa_[A-Za-z0-9_]{32}_[a-f0-9]{8}/,
+  /pscale_pw_[A-Za-z0-9_-]{20,}/,
+  /\bre_[A-Za-z0-9_]{30,}/,
+  /dop_v1_[a-f0-9]{64}/,
+  /sntrys_[A-Za-z0-9_-]{30,}/,
+  /FlyV1 [A-Za-z0-9_-]{20,}/,
+  /AccountKey=[A-Za-z0-9+/]{40,}=*/,
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY[A-Z0-9 ]*-----/,
+  /-----BEGIN PGP MESSAGE-----/,
+  /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/,
+  /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[A-Za-z0-9_.%-]*:[^@\s/]+(?<!\.\.)@/,
+  /\bBearer\s+[A-Za-z0-9_+=/.-]{20,}/i,
+  /(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|auth)\s*[=:]\s*["']?[A-Za-z0-9_+=/.-]{12,}/i
+];
+function tokenize(key) {
+  return new Set(
+    key.split(/(?<=[a-z])(?=[A-Z])/).flatMap((part) => part.split(/[_\-.]+/)).map((token) => token.toLowerCase()).filter(Boolean)
+  );
+}
+function hasSafeKeyHint(key) {
+  const tokens = tokenize(key);
+  return SAFE_KEY_HINT_TOKENS.some((token) => tokens.has(token));
+}
+function hasGenericKeySuffix(key) {
+  const precedingToken = GENERIC_KEY_SUFFIX_PATTERN.exec(key)?.[1]?.toUpperCase();
+  return Boolean(
+    precedingToken && !NON_CREDENTIAL_KEY_TOKENS.has(precedingToken)
+  );
+}
+function hasGenericKeyPrefix(key) {
+  const followingToken = GENERIC_KEY_PREFIX_PATTERN.exec(key)?.[1]?.toUpperCase();
+  return Boolean(
+    followingToken && !NON_CREDENTIAL_KEY_TOKENS.has(followingToken)
+  );
+}
+function getMatchingServerOnlyKey(key) {
+  const normalized = key.replace(/(?<=[a-z])(?=[A-Z])/g, "_").toLowerCase().replace(/[-.]+/g, "_");
+  for (const pattern of SERVER_ONLY_KEY_PATTERNS) {
+    if (pattern.includes("_") && normalized.includes(pattern))
+      return pattern;
+  }
+  const tokens = tokenize(key);
+  return SERVER_ONLY_KEY_PATTERNS.find(
+    (pattern) => !pattern.includes("_") && tokens.has(pattern)
+  ) ?? null;
+}
+function looksLikeSecret(key) {
+  if (!key || hasSafeKeyHint(key))
+    return false;
+  if (WELL_KNOWN_SECRET_NAMES.has(key.toUpperCase()))
+    return true;
+  if (SECRET_SEGMENT_PATTERN.test(key))
+    return true;
+  if (SECRET_COMPOUND_PATTERNS.some((pattern) => pattern.test(key)))
+    return true;
+  if (DB_URL_PATTERN.test(key))
+    return true;
+  return hasGenericKeySuffix(key) || hasGenericKeyPrefix(key);
+}
+function looksLikeSecretValue(value) {
+  const trimmed = value.trim();
+  return Boolean(
+    trimmed && SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(trimmed))
+  );
+}
+function shouldConfirmRotationBeforeDelete(env) {
+  if (env.type === "system")
+    return false;
+  if (EXPLICIT_SECRET_TOKEN_PATTERN.test(env.key))
+    return true;
+  if (env.hasPublicPrefix || hasSafeKeyHint(env.key))
+    return false;
+  return looksLikeSecret(env.key);
+}
+function isFlagsSecretNeedingSplit(env) {
+  if (env.key !== "FLAGS_SECRET")
+    return false;
+  if (env.type !== "plain" && env.type !== "encrypted")
+    return false;
+  return env.targets.length + (env.customEnvironmentIds?.length ?? 0) > 1;
+}
+
+// src/util/env/validate-env.ts
+function getEnvValueWarnings(value) {
+  const warnings = [];
+  const normalized = value.replace(/\n$/, "");
+  if (/^[ \t]+/.test(normalized)) {
+    warnings.push({
+      message: "starts with whitespace",
+      requiresConfirmation: false
+    });
+  }
+  if (/[ \t]+$/.test(normalized)) {
+    warnings.push({
+      message: "ends with whitespace",
+      requiresConfirmation: false
+    });
+  }
+  if (normalized.includes("\r") || normalized.includes("\n")) {
+    warnings.push({
+      message: "contains newlines",
+      requiresConfirmation: false
+    });
+  }
+  if (value.includes("\0")) {
+    warnings.push({
+      message: "contains null characters",
+      requiresConfirmation: false
+    });
+  }
+  if (value === "") {
+    warnings.push({
+      message: "is empty",
+      requiresConfirmation: true
+    });
+  }
+  if (value.length > 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+    warnings.push({
+      message: "includes surrounding quotes (these will be stored literally)",
+      requiresConfirmation: false
+    });
+  }
+  return warnings;
+}
+function formatWarnings(warnings) {
+  if (warnings.length === 0)
+    return null;
+  const messages = warnings.map((w) => w.message);
+  const startsIdx = messages.indexOf("starts with whitespace");
+  const endsIdx = messages.indexOf("ends with whitespace");
+  if (startsIdx !== -1 && endsIdx !== -1) {
+    messages.splice(Math.max(startsIdx, endsIdx), 1);
+    messages[Math.min(startsIdx, endsIdx)] = "starts and ends with whitespace";
+  }
+  if (messages.length === 1) {
+    return `Value ${messages[0]}`;
+  }
+  if (messages.length === 2) {
+    return `Value ${messages[0]} and ${messages[1]}`;
+  }
+  const last = messages.pop();
+  return `Value ${messages.join(", ")}, and ${last}`;
+}
+var API_PUBLIC_PREFIXES = [
+  "NEXT_PUBLIC_",
+  "VUE_APP_",
+  "REACT_APP_",
+  "GATSBY_",
+  "GRIDSOME_",
+  "NUXT_PUBLIC_",
+  "STORYBOOK_",
+  "VITE_",
+  "PUBLIC_",
+  "EXPO_PUBLIC_",
+  "NG_APP_",
+  "REDWOOD_ENV_"
+];
+var PUBLIC_PREFIXES = [
+  .../* @__PURE__ */ new Set([
+    ...API_PUBLIC_PREFIXES,
+    ...import_frameworks.frameworkList.map((f) => f.envPrefix).filter((prefix) => !!prefix)
+  ])
+];
+function hasOnlyWhitespaceWarnings(warnings) {
+  return warnings.length > 0 && warnings.every(
+    (w) => w.message === "starts with whitespace" || w.message === "ends with whitespace"
+  );
+}
+function trimValue(value) {
+  return value.replace(/\n$/, "").trim();
+}
+function normalizeStdinEnvValue(value) {
+  let valueWithoutTrailingNewline = value;
+  if (value.endsWith("\r\n")) {
+    valueWithoutTrailingNewline = value.slice(0, -2);
+  } else if (value.endsWith("\n")) {
+    valueWithoutTrailingNewline = value.slice(0, -1);
+  } else {
+    return {
+      value,
+      strippedTrailingNewline: false
+    };
+  }
+  if (valueWithoutTrailingNewline.includes("\n") || valueWithoutTrailingNewline.includes("\r")) {
+    return {
+      value,
+      strippedTrailingNewline: false
+    };
+  }
+  return {
+    value: valueWithoutTrailingNewline,
+    strippedTrailingNewline: true
+  };
+}
+function getPublicPrefix(key) {
+  const upperKey = key.toUpperCase();
+  return PUBLIC_PREFIXES.find((p) => upperKey.startsWith(p)) || null;
+}
+function getFrameworkPublicPrefix(frameworkSlug, key) {
+  const prefix = import_frameworks.frameworkList.find(
+    (framework) => framework.slug === frameworkSlug
+  )?.envPrefix;
+  return prefix && key.toUpperCase().startsWith(prefix.toUpperCase()) ? prefix : null;
+}
+function getApiPublicPrefix(key) {
+  const upperKey = key.toUpperCase();
+  return API_PUBLIC_PREFIXES.find((prefix) => upperKey.startsWith(prefix)) ?? null;
+}
+function parseSvelteKitPublicEnvVarPrefix(config) {
+  if (!config.includes("publicPrefix")) {
+    return { status: "ready", prefix: null };
+  }
+  const match = /publicPrefix:\s*(?:'(?<single>[^']*)'|"(?<double>[^"]*)"|`(?<template>[^`$]*)`)/.exec(
+    config
+  );
+  const prefix = match?.groups?.single ?? match?.groups?.double ?? match?.groups?.template;
+  return prefix === void 0 ? { status: "unavailable" } : { status: "ready", prefix };
+}
+async function getLocalSvelteKitPublicPrefixes(cwd, rootDirectory) {
+  const projectRoot = rootDirectory ? join(cwd, rootDirectory) : cwd;
+  let config;
+  try {
+    config = await readFile2(join(projectRoot, "svelte.config.js"), "utf8");
+  } catch {
+    return void 0;
+  }
+  const parsed = parseSvelteKitPublicEnvVarPrefix(config);
+  if (parsed.status === "unavailable")
+    return void 0;
+  return [parsed.prefix ?? "PUBLIC_", "VITE_"];
+}
+function removePublicPrefix(key) {
+  const prefix = getPublicPrefix(key);
+  if (!prefix)
+    return key;
+  return key.slice(prefix.length);
+}
+async function validateEnvValue(opts) {
+  let finalValue = opts.initialValue;
+  let alreadyConfirmed = false;
+  if (!opts.skipConfirm) {
+    let valueAccepted = false;
+    while (!valueAccepted) {
+      const valueWarnings = getEnvValueWarnings(finalValue);
+      const warningMessage = formatWarnings(valueWarnings);
+      if (!warningMessage) {
+        valueAccepted = true;
+        break;
+      }
+      opts.showWarning(warningMessage);
+      const canTrim = hasOnlyWhitespaceWarnings(valueWarnings);
+      const choices = canTrim ? [
+        { name: "Leave as is", value: "c" },
+        { name: "Re-enter", value: "r" },
+        { name: "Trim whitespace", value: "t" }
+      ] : [
+        { name: "Leave as is", value: "c" },
+        { name: "Re-enter", value: "r" }
+      ];
+      const action = await opts.selectAction(choices);
+      if (action === "c") {
+        valueAccepted = true;
+        if (valueWarnings.some((w) => w.requiresConfirmation)) {
+          alreadyConfirmed = true;
+        }
+      } else if (action === "t") {
+        finalValue = trimValue(finalValue);
+        opts.showLog("Trimmed whitespace");
+      } else {
+        finalValue = await opts.promptForValue();
+      }
+    }
+  } else {
+    const valueWarnings = getEnvValueWarnings(finalValue);
+    const warningMessage = formatWarnings(valueWarnings);
+    if (warningMessage) {
+      opts.showWarning(warningMessage);
+    }
+  }
+  return { finalValue, alreadyConfirmed };
+}
+function getEnvKeyWarnings(key) {
+  const warnings = [];
+  const matchingPrefix = getPublicPrefix(key);
+  if (matchingPrefix) {
+    const nameWithoutPrefix = key.slice(matchingPrefix.length);
+    const sensitiveMatch = looksLikeSecret(nameWithoutPrefix) && getMatchingServerOnlyKey(nameWithoutPrefix);
+    if (sensitiveMatch) {
+      warnings.push({
+        message: `\`${matchingPrefix}\` exposes \`${key}\` to anyone visiting your site`,
+        requiresConfirmation: true
+      });
+    } else {
+      warnings.push({
+        message: `\`${matchingPrefix}\` exposes this value to anyone visiting your site`,
+        requiresConfirmation: false
+      });
+    }
+  }
+  return warnings;
+}
+
+// src/util/env/env-var-config-secret-ui.ts
+var ENV_VISIBILITY_DEPRECATION_MESSAGE = "`--visibility` is deprecated. Use `--type` instead.";
+function invalidTypeOptionError(optionName, value) {
+  if (value === "config" || value === "secret") {
+    return void 0;
+  }
+  if (value === "sensitive") {
+    return `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` flag.`;
+  }
+  if (value === "plain" || value === "encrypted") {
+    return `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.`;
+  }
+  return `The \`${optionName}\` flag must be either \`config\` or \`secret\`.`;
+}
+function resolveEnvVarTypeOption(options) {
+  const usedDeprecatedVisibility = options.visibility !== void 0;
+  if (options.type !== void 0) {
+    const error = invalidTypeOptionError("--type", options.type);
+    if (error) {
+      return {
+        usedDeprecatedVisibility,
+        error,
+        errorReason: "invalid_type"
+      };
+    }
+  }
+  if (options.visibility !== void 0) {
+    const error = invalidTypeOptionError("--visibility", options.visibility);
+    if (error) {
+      return {
+        usedDeprecatedVisibility,
+        error,
+        errorReason: "invalid_visibility"
+      };
+    }
+  }
+  if (options.type !== void 0 && options.visibility !== void 0 && options.type !== options.visibility) {
+    return {
+      usedDeprecatedVisibility,
+      error: `\`--type ${options.type}\` conflicts with \`--visibility ${options.visibility}\`. \`--visibility\` is a deprecated alias of \`--type\`; remove it.`,
+      errorReason: "conflicting_type_visibility"
+    };
+  }
+  if (options.type !== void 0) {
+    return {
+      explicitVisibility: options.type,
+      source: "type",
+      usedDeprecatedVisibility
+    };
+  }
+  if (options.visibility !== void 0) {
+    return {
+      explicitVisibility: options.visibility,
+      source: "visibility",
+      usedDeprecatedVisibility
+    };
+  }
+  return { usedDeprecatedVisibility };
+}
+function isSecretEnvVar(env) {
+  return env.type === "sensitive" || env.visibility === "secret";
+}
+function formatVisibilityLabel(visibility, type) {
+  const resolved = visibility ?? visibilityFromEnvType(type);
+  if (resolved === "config") {
+    return "Config";
+  }
+  if (resolved === "secret") {
+    return "Secret";
+  }
+  return void 0;
+}
+function visibilityFromEnvType(type) {
+  if (type === "sensitive") {
+    return "secret";
+  }
+  if (type === "plain" || type === "encrypted") {
+    return "config";
+  }
+  return void 0;
+}
+function hasNonDevelopmentTarget(envTargets) {
+  return envTargets.some((target) => target !== "development");
+}
+function getPublicPrefixSecretVisibilityError(key, options) {
+  const publicPrefix = getApiPublicPrefix(key);
+  if (!publicPrefix) {
+    return null;
+  }
+  const wouldBeSecret = options.visibility === "secret" || options.type === "sensitive";
+  if (!wouldBeSecret) {
+    return null;
+  }
+  const privateKey = key.slice(publicPrefix.length);
+  if (options.context === "update") {
+    return `\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, add \`${privateKey}\` as a Secret, then remove \`${key}\`. If the value is safe to expose, keep it as Config.`;
+  }
+  return `\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, rename the variable to \`${privateKey}\` and keep the Secret type. If the value is safe to expose, use \`--type config\`.`;
+}
+function shouldOmitInferredVisibility(key, envTargets, teamSensitivePolicyOn) {
+  if (!getApiPublicPrefix(key)) {
+    return false;
+  }
+  if (!hasNonDevelopmentTarget(envTargets)) {
+    return false;
+  }
+  return teamSensitivePolicyOn;
+}
+function resolveEnvVarVisibility(options) {
+  if (options.explicitVisibility !== void 0) {
+    if (options.explicitVisibility !== "config" && options.explicitVisibility !== "secret") {
+      const optionName = options.explicitOptionSource === "visibility" ? "--visibility" : "--type";
+      return {
+        error: options.explicitVisibility === "sensitive" ? `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` flag.` : options.explicitVisibility === "plain" || options.explicitVisibility === "encrypted" ? `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.` : `The \`${optionName}\` flag must be either \`config\` or \`secret\`.`
+      };
+    }
+    const publicPrefixError2 = getPublicPrefixSecretVisibilityError(
+      options.key,
+      {
+        visibility: options.explicitVisibility,
+        type: options.type,
+        context: options.context
+      }
+    );
+    if (publicPrefixError2) {
+      return { error: publicPrefixError2 };
+    }
+    return { visibility: options.explicitVisibility };
+  }
+  const inferred = visibilityFromEnvType(options.type);
+  if (inferred === void 0) {
+    return {};
+  }
+  if (shouldOmitInferredVisibility(
+    options.key,
+    options.envTargets,
+    options.teamSensitivePolicyOn
+  )) {
+    return {};
+  }
+  const publicPrefixError = getPublicPrefixSecretVisibilityError(options.key, {
+    visibility: inferred,
+    type: options.type,
+    context: options.context
+  });
+  if (publicPrefixError) {
+    return { error: publicPrefixError };
+  }
+  return { visibility: inferred };
+}
+
+// src/util/env/secret-read-guidance.ts
+function getUnavailableSecretValuesMessage(environment, count) {
+  const values = count === 1 ? "value" : "values";
+  if (environment === "development") {
+    return `${count} Development Secret ${values} ${count === 1 ? "was" : "were"} not returned by Vercel.`;
+  }
+  return `${count} Secret ${values} cannot be pulled from the \`${environment}\` Environment.`;
+}
+function getLocalSecretFallbackMessage(count) {
+  return ` Define ${count === 1 ? "it" : "them"} in a local .env file.`;
+}
+
+// src/util/env/update-oidc-token-contents.ts
+var CONTENTS_HEADER = "# Created by Vercel CLI";
+function updateOidcTokenContents(existing, token) {
+  const assignment = `${VERCEL_OIDC_TOKEN}="${escapeValue(token)}"`;
+  const oidcAssignment = new RegExp(
+    `^(\\uFEFF?)[\\t ]*(?:export[\\t ]+)?${VERCEL_OIDC_TOKEN}[\\t ]*=[^\\r\\n]*(\\r\\n|\\n|\\r|$)`,
+    "gm"
+  );
+  let tokenWritten = false;
+  const withoutDuplicates = existing.replace(
+    oidcAssignment,
+    (_match, byteOrderMark, lineEnding2) => {
+      if (token !== void 0 && !tokenWritten) {
+        tokenWritten = true;
+        return `${byteOrderMark}${assignment}${lineEnding2}`;
+      }
+      return byteOrderMark;
+    }
+  );
+  if (token === void 0 || tokenWritten) {
+    return withoutDuplicates;
+  }
+  const lineEnding = withoutDuplicates.match(/\r\n|\n|\r/)?.[0] ?? "\n";
+  const hasTrailingLineEnding = /(?:\r\n|\n|\r)$/.test(withoutDuplicates);
+  const hasTrailingBlankLine = /(?:\r\n|\n|\r){2}$/.test(withoutDuplicates);
+  const separator = withoutDuplicates.length === 0 || hasTrailingBlankLine ? "" : hasTrailingLineEnding ? lineEnding : `${lineEnding}${lineEnding}`;
+  return `${withoutDuplicates}${separator}${CONTENTS_HEADER}${lineEnding}${assignment}${lineEnding}`;
+}
+function escapeValue(value) {
+  return value ? value.replace(/\n/g, "\\n").replace(/\r/g, "\\r") : "";
+}
+
+// src/commands/env/pull.ts
+var import_error_utils = __toESM(require_dist(), 1);
+var import_json_parse_better_errors = __toESM(require_json_parse_better_errors(), 1);
+
+// src/util/telemetry/commands/env/pull.ts
+var EnvPullTelemetryClient = class extends TelemetryClient {
+  trackCliArgumentFilename(filename) {
+    if (filename) {
+      this.trackCliArgument({
+        arg: "filename",
+        value: this.redactedValue
+      });
+    }
+  }
+  trackCliOptionEnvironment(environment) {
+    if (environment) {
+      this.trackCliOption({
+        option: "environment",
+        value: STANDARD_ENVIRONMENTS.includes(
+          environment
+        ) ? environment : this.redactedValue
+      });
+    }
+  }
+  trackCliOptionGitBranch(gitBranch) {
+    if (gitBranch) {
+      this.trackCliOption({
+        option: "git-branch",
+        value: this.redactedValue
+      });
+    }
+  }
+  trackCliFlagYes(yes) {
+    if (yes) {
+      this.trackCliFlag("yes");
+    }
+  }
+  trackCliOptionId(id) {
+    if (id) {
+      this.trackCliOption({
+        option: "id",
+        value: this.redactedValue
+      });
+    }
+  }
+};
+
+// src/commands/env/pull.ts
+var CONTENTS_PREFIX = "# Created by Vercel CLI\n";
+function printEnvPullWarning(message) {
+  output_manager_default.print(`${import_chalk2.default.yellow("!")} ${message}
+`);
+}
+function readHeadSync(path, length) {
+  const buffer = Buffer.alloc(length);
+  const fd = openSync(path, "r");
+  try {
+    readSync(
+      fd,
+      buffer,
+      0,
+      buffer.length,
+      null
+    );
+  } finally {
+    closeSync(fd);
+  }
+  return buffer.toString();
+}
+function tryReadHeadSync(path, length) {
+  try {
+    return readHeadSync(path, length);
+  } catch (err) {
+    if (!(0, import_error_utils.isErrnoException)(err) || err.code !== "ENOENT") {
+      throw err;
+    }
+  }
+}
+var VARIABLES_TO_IGNORE = [
+  "VERCEL_ANALYTICS_ID",
+  "VERCEL_SPEED_INSIGHTS_ID",
+  "VERCEL_WEB_ANALYTICS_ID"
+];
+var SENSITIVE_PLACEHOLDER = SENSITIVE_ENV_VALUE_PLACEHOLDER;
+async function getRedactedSensitiveKeys(client, projectId, source, target, gitBranch, records) {
+  const emptyKeys = Object.keys(records).filter((key) => !records[key]);
+  if (!projectId || emptyKeys.length === 0) {
+    return /* @__PURE__ */ new Set();
+  }
+  try {
+    const { envs } = await getEnvRecords(client, projectId, source, {
+      target,
+      gitBranch
+    });
+    const sensitiveKeys = new Set(
+      envs.filter(isSecretEnvVar).map((env) => env.key)
+    );
+    return new Set(emptyKeys.filter((key) => sensitiveKeys.has(key)));
+  } catch {
+    return /* @__PURE__ */ new Set();
+  }
+}
+async function pull(client, argv, source = "vercel-cli:env:pull", options = {}) {
+  const telemetryClient = new EnvPullTelemetryClient({
+    opts: {
+      store: client.telemetryEventStore
+    }
+  });
+  let parsedArgs;
+  const flagsSpecification = getFlagsSpecification(pullSubcommand.options);
+  try {
+    parsedArgs = parseArguments(argv, flagsSpecification);
+  } catch (err) {
+    printError(err);
+    return 1;
+  }
+  const { args, flags: opts } = parsedArgs;
+  if (args.length > 1) {
+    output_manager_default.error(
+      `Invalid number of arguments. Usage: ${getCommandName(`env pull <file>`)}`
+    );
+    return 1;
+  }
+  const [rawFilename] = args;
+  const filename = rawFilename || ".env.local";
+  const skipConfirmation = opts["--yes"];
+  const gitBranch = opts["--git-branch"];
+  telemetryClient.trackCliArgumentFilename(args[0]);
+  telemetryClient.trackCliFlagYes(skipConfirmation);
+  telemetryClient.trackCliOptionGitBranch(gitBranch);
+  telemetryClient.trackCliOptionEnvironment(opts["--environment"]);
+  telemetryClient.trackCliOptionId(opts["--id"]);
+  telemetryClient.trackCliOptionProject(opts["--project"]);
+  let link = await resolveProjectContext({
+    client,
+    projectNameOrId: opts["--project"]
+  });
+  if (link.status === "error") {
+    return link.exitCode;
+  } else if (link.status === "not_linked") {
+    if (client.nonInteractive) {
+      const preserved = getPreservedArgsForEnvPull(client.argv);
+      const linkArgv = [
+        ...client.argv.slice(0, 2),
+        "link",
+        "--scope",
+        "<scope>",
+        ...preserved
+      ];
+      outputAgentError(
+        client,
+        {
+          status: "error",
+          reason: "not_linked",
+          message: `Your codebase isn't linked to a project on Vercel. Run \`${getCommandNamePlain(
+            "link"
+          )}\` to begin. Use \`--yes\` for non-interactive; use \`--scope\` or \`--project\` to specify team or project.`,
+          next: [
+            { command: buildCommandWithYes(linkArgv) },
+            { command: buildCommandWithYes(client.argv) }
+          ]
+        },
+        1
+      );
+    }
+    if (!client.nonInteractive && client.stdin.isTTY && !skipConfirmation) {
+      const ensuredLink = await ensureLink("env pull", client, client.cwd, {
+        link,
+        // The env vars are pulled below, so don't offer to pull them twice.
+        pullEnv: false
+      });
+      if (typeof ensuredLink === "number") {
+        return ensuredLink;
+      }
+      link = ensuredLink;
+    } else {
+      output_manager_default.error(
+        `Your codebase isn\u2019t linked to a project on Vercel. Run ${getCommandName(
+          "link"
+        )} to begin.`
+      );
+      return 1;
+    }
+  }
+  client.config.currentTeam = link.org.type === "team" ? link.org.id : void 0;
+  const deploymentId = opts["--id"];
+  if (deploymentId && opts["--project"]) {
+    const deployment = await getDeployment(client, link.org.slug, deploymentId);
+    if (deployment.projectId && deployment.projectId !== link.project.id) {
+      output_manager_default.error(
+        `Deployment ${import_chalk2.default.bold(deploymentId)} does not belong to project ${import_chalk2.default.bold(link.project.name)}.`
+      );
+      return 1;
+    }
+  }
+  const environment = parseTarget({
+    flagName: "environment",
+    flags: opts
+  }) || "development";
+  await envPullCommandLogic(
+    client,
+    filename,
+    !!skipConfirmation,
+    environment,
+    link,
+    gitBranch,
+    client.cwd,
+    source,
+    deploymentId,
+    options
+  );
+  return 0;
+}
+async function envPullCommandLogic(client, filename, skipConfirmation, environment, link, gitBranch, cwd, source, deploymentId, { oidcTokenOnly = false } = {}) {
+  const fullPath = resolve(cwd, filename);
+  const head = tryReadHeadSync(fullPath, Buffer.byteLength(CONTENTS_PREFIX));
+  const exists = typeof head !== "undefined";
+  if (head === CONTENTS_PREFIX && !oidcTokenOnly) {
+    output_manager_default.log(`Overwriting existing ${import_chalk2.default.bold(filename)} file`);
+  } else if (exists && !skipConfirmation && !oidcTokenOnly) {
+    if (client.nonInteractive) {
+      const preserved = getPreservedArgsForEnvPull(client.argv).filter(
+        (arg) => arg !== "--yes" && arg !== "-y"
+      );
+      const suffix = preserved.length > 0 ? ` ${preserved.join(" ")}` : "";
+      outputActionRequired(client, {
+        status: "action_required",
+        reason: "env_file_exists",
+        message: `File ${param(filename)} already exists and was not created by Vercel CLI. Use --yes to overwrite or specify a different filename.`,
+        next: [
+          {
+            command: getCommandNamePlain(`env pull ${filename} --yes${suffix}`),
+            when: "Overwrite this file"
+          },
+          {
+            command: getCommandNamePlain(`env pull <filename>${suffix}`),
+            when: "Use a different filename"
+          }
+        ]
+      });
+    }
+    if (!await client.input.confirm(
+      `Found existing file ${param(filename)}. Do you want to overwrite?`,
+      false
+    )) {
+      output_manager_default.log("Canceled");
+      return;
+    }
+  }
+  const projectSlugLink = formatProject(link.org.slug, link.project.name);
+  const downloadMessage = oidcTokenOnly ? `Downloading a fresh \`${import_chalk2.default.cyan(
+    VERCEL_OIDC_TOKEN
+  )}\` for ${projectSlugLink}` : gitBranch ? `Downloading \`${import_chalk2.default.cyan(
+    environment
+  )}\` environment variables for ${projectSlugLink} and any overrides for branch ${import_chalk2.default.cyan(
+    gitBranch
+  )}` : `Downloading \`${import_chalk2.default.cyan(
+    environment
+  )}\` environment variables for ${projectSlugLink}`;
+  output_manager_default.log(downloadMessage);
+  output_manager_default.spinner("Downloading");
+  const pullId = deploymentId || link.project.id;
+  const pullResult = await pullEnvRecords(client, pullId, source, {
+    target: environment || "development",
+    gitBranch
+  });
+  const records = deploymentId ? pullResult.buildEnv : pullResult.env;
+  let deltaString = "";
+  let oldEnv;
+  if (exists && !oidcTokenOnly) {
+    oldEnv = await createEnvObject(fullPath);
+  }
+  let contents;
+  let fileChanged = true;
+  const keptLocalKeys = [];
+  const preservedLocalSecretKeys = [];
+  let redactedSecretCount = 0;
+  let placeholderSecretCount = 0;
+  if (oidcTokenOnly) {
+    const existingContents = exists ? await (0, import_fs_extra2.readFile)(fullPath, "utf8") : "";
+    contents = updateOidcTokenContents(
+      existingContents,
+      records[VERCEL_OIDC_TOKEN] || void 0
+    );
+    fileChanged = contents !== existingContents;
+  } else {
+    const sensitiveKeys = await getRedactedSensitiveKeys(
+      client,
+      deploymentId ? void 0 : link.project.id,
+      source,
+      environment,
+      gitBranch,
+      records
+    );
+    redactedSecretCount = sensitiveKeys.size;
+    const mergedRecords = { ...records };
+    for (const key of sensitiveKeys) {
+      const localValue = oldEnv?.[key];
+      if (localValue && localValue !== SENSITIVE_PLACEHOLDER) {
+        mergedRecords[key] = localValue;
+        preservedLocalSecretKeys.push(key);
+      } else {
+        mergedRecords[key] = SENSITIVE_PLACEHOLDER;
+        placeholderSecretCount++;
+      }
+    }
+    if (oldEnv) {
+      for (const [key, value] of Object.entries(oldEnv)) {
+        if (!(key in mergedRecords) && key !== VERCEL_OIDC_TOKEN && !VARIABLES_TO_IGNORE.includes(key)) {
+          mergedRecords[key] = value;
+          keptLocalKeys.push(key);
+        }
+      }
+    }
+    contents = CONTENTS_PREFIX + Object.keys(mergedRecords).sort().filter((key) => !VARIABLES_TO_IGNORE.includes(key)).map((key) => `${key}="${escapeValue2(mergedRecords[key])}"`).join("\n") + "\n";
+    if (oldEnv) {
+      const newEnv = (0, import_json_parse_better_errors.default)(
+        JSON.stringify(mergedRecords).replace(/\\"/g, "")
+      );
+      deltaString = buildDeltaString(oldEnv, newEnv);
+    }
+  }
+  if (fileChanged) {
+    await (0, import_fs_extra2.outputFile)(fullPath, contents, "utf8");
+  }
+  if (deltaString) {
+    output_manager_default.print("\n" + deltaString);
+  } else if (oldEnv && exists) {
+    output_manager_default.log("No changes found.");
+  }
+  if (keptLocalKeys.length > 0) {
+    output_manager_default.log(
+      `Kept ${keptLocalKeys.sort().map((key) => import_chalk2.default.bold(key)).join(", ")} (defined locally, not found in the ${import_chalk2.default.cyan(
+        environment
+      )} Environment)`
+    );
+  }
+  if (redactedSecretCount > 0) {
+    const preservedMessage = preservedLocalSecretKeys.length > 0 ? ` Kept ${preservedLocalSecretKeys.length} existing local ${preservedLocalSecretKeys.length === 1 ? "value" : "values"}.` : "";
+    const placeholderMessage = placeholderSecretCount > 0 ? ` Wrote "${SENSITIVE_PLACEHOLDER}" ${placeholderSecretCount === 1 ? "as a placeholder" : "as placeholders"} for the remaining ${placeholderSecretCount === 1 ? "value" : "values"}; replace ${placeholderSecretCount === 1 ? "it" : "them"} with local-only values.` : "";
+    printEnvPullWarning(
+      `${getUnavailableSecretValuesMessage(
+        environment,
+        redactedSecretCount
+      )}${preservedMessage}${placeholderMessage}`
+    );
+  }
+  let isGitIgnoreUpdated = false;
+  const fileExistsAfterPull = exists || contents.length > 0;
+  if (filename === ".env.local" && fileExistsAfterPull) {
+    const rootPath = link.repoRoot ?? cwd;
+    isGitIgnoreUpdated = await addToGitIgnore(rootPath, ".env*");
+  }
+  if (!fileChanged && !isGitIgnoreUpdated) {
+    output_manager_default.stopSpinner();
+    return;
+  }
+  output_manager_default.print("\n");
+  if (!fileChanged) {
+    printAlignedLabel("Updated", `.gitignore for ${filename}`, { gutter: "\u2713" });
+    return;
+  }
+  printAlignedLabel(
+    exists ? "Updated" : "Created",
+    `${filename} file${isGitIgnoreUpdated ? " and added it to .gitignore" : ""}`,
+    { gutter: "\u2713" }
+  );
+}
+function escapeValue2(value) {
+  return value ? value.replace(new RegExp("\n", "g"), "\\n").replace(new RegExp("\r", "g"), "\\r") : "";
+}
+
+export {
+  getEnvRecords,
+  pullEnvRecords,
+  createEnvObject,
+  VERCEL_OIDC_TOKEN,
+  SENSITIVE_ENV_VALUE_PLACEHOLDER,
+  looksLikeSecret,
+  looksLikeSecretValue,
+  shouldConfirmRotationBeforeDelete,
+  isFlagsSecretNeedingSplit,
+  normalizeStdinEnvValue,
+  getPublicPrefix,
+  getFrameworkPublicPrefix,
+  getApiPublicPrefix,
+  getLocalSvelteKitPublicPrefixes,
+  removePublicPrefix,
+  validateEnvValue,
+  getEnvKeyWarnings,
+  ENV_VISIBILITY_DEPRECATION_MESSAGE,
+  resolveEnvVarTypeOption,
+  isSecretEnvVar,
+  formatVisibilityLabel,
+  getPublicPrefixSecretVisibilityError,
+  resolveEnvVarVisibility,
+  getUnavailableSecretValuesMessage,
+  getLocalSecretFallbackMessage,
+  SENSITIVE_PLACEHOLDER,
+  pull,
+  envPullCommandLogic
+};