vercel 59.4.0 → 59.6.2

package/dist/chunks/{chunk-HMJVUXE6.js → chunk-VJ5NAOWB.js}

@@ -4,11 +4,13 @@ import { dirname as __dirname_ } from 'node:path';
 const require = __createRequire(import.meta.url);
 const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
+import {
+  pullSubcommand
+} from "./chunk-FXD67VN5.js";
 import {
   TelemetryClient,
-  require_dist as require_dist2,
   require_graceful_fs
-} from "./chunk-CYNB6LL4.js";
+} from "./chunk-XNFHNTS2.js";
 import {
   AGENT_REASON,
   AGENT_STATUS,
@@ -19,19 +21,21 @@ import {
   outputActionRequired,
   outputAgentError,
   shouldEmitNonInteractiveCommandError
-} from "./chunk-TH2XUVDP.js";
+} from "./chunk-NGGLYKNU.js";
 import {
   require_ms
 } from "./chunk-GGP5R3FU.js";
 import {
-  printError,
+  printError
+} from "./chunk-AYLY3ZVL.js";
+import {
+  parseArguments
+} from "./chunk-57RHXXXG.js";
+import {
   require_string_width,
   require_strip_ansi,
   table
-} from "./chunk-VAFU7DXZ.js";
-import {
-  parseArguments
-} from "./chunk-XLKFJPMT.js";
+} from "./chunk-RKDCNQ4S.js";
 import {
   APIError,
   CantParseJSONFile,
@@ -50,18 +54,14 @@ import {
   TeamDeleted,
   TooManyRequests,
   code,
-  forceOption,
-  formatOption,
+  isAPIError
+} from "./chunk-BMKU5KEL.js";
+import {
   getCommandName,
   getCommandNamePlain,
   getFlagsSpecification,
-  isAPIError,
-  jsonOption,
-  packageName,
-  projectOption,
-  require_lib,
-  yesOption
-} from "./chunk-SOFC4MLS.js";
+  packageName
+} from "./chunk-Q2DGFCO7.js";
 import {
   pkg_default
 } from "./chunk-P4QNYOFB.js";
@@ -81,7 +81,7 @@ import {
   require_cli_spinners,
   require_dist,
   require_escape_string_regexp
-} from "./chunk-OX7KI3LF.js";
+} from "./chunk-QFAS4OVW.js";
 import {
   require_ansi_styles,
   require_source,
@@ -8025,7 +8025,7 @@ var require_jsonfile = __commonJS({
       }
       return obj;
     }
-    var readFile7 = universalify.fromPromise(_readFile);
+    var readFile8 = universalify.fromPromise(_readFile);
     function readFileSync(file, options = {}) {
       if (typeof options === "string") {
         options = { encoding: options };
@@ -8057,7 +8057,7 @@ var require_jsonfile = __commonJS({
       return fs5.writeFileSync(file, str, options);
     }
     module.exports = {
-      readFile: readFile7,
+      readFile: readFile8,
       readFileSync,
       writeFile: writeFile5,
       writeFileSync
@@ -8327,7 +8327,7 @@ var require_move2 = __commonJS({
 });
 
 // ../../node_modules/.pnpm/fs-extra@10.0.0/node_modules/fs-extra/lib/index.js
-var require_lib2 = __commonJS({
+var require_lib = __commonJS({
   "../../node_modules/.pnpm/fs-extra@10.0.0/node_modules/fs-extra/lib/index.js"(exports, module) {
     "use strict";
     module.exports = {
@@ -8857,7 +8857,7 @@ var require_wrap_ansi = __commonJS({
 });
 
 // ../../node_modules/.pnpm/mute-stream@1.0.0/node_modules/mute-stream/lib/index.js
-var require_lib3 = __commonJS({
+var require_lib2 = __commonJS({
   "../../node_modules/.pnpm/mute-stream@1.0.0/node_modules/mute-stream/lib/index.js"(exports, module) {
     var Stream = __require("stream");
     var _isTTY, _destSrc, destSrc_fn, _proxy, proxy_fn;
@@ -13753,10 +13753,10 @@ var require_read_config_file = __commonJS({
     var import_smol_toml3 = __require("smol-toml");
     var import_fs6 = __require("fs");
     var import_error_utils5 = require_dist();
-    var { readFile: readFile7 } = import_fs6.promises;
+    var { readFile: readFile8 } = import_fs6.promises;
     async function readFileOrNull(file) {
       try {
-        const data = await readFile7(file);
+        const data = await readFile8(file);
         return data;
       } catch (error) {
         if (!(0, import_error_utils5.isErrnoException)(error)) {
@@ -13835,7 +13835,7 @@ var require_frameworks = __commonJS({
     var frameworks_exports = {};
     __export2(frameworks_exports, {
       default: () => frameworks_default,
-      frameworkList: () => frameworkList5,
+      frameworkList: () => frameworkList6,
       frameworks: () => frameworks
     });
     module.exports = __toCommonJS2(frameworks_exports);
@@ -13843,7 +13843,7 @@ var require_frameworks = __commonJS({
     var import_fs6 = __require("fs");
     var import_read_config_file = require_read_config_file();
     __reExport(frameworks_exports, require_types(), module.exports);
-    var { readdir, readFile: readFile7, unlink: unlink2 } = import_fs6.promises;
+    var { readdir, readFile: readFile8, unlink: unlink2 } = import_fs6.promises;
     var frameworks = [
       {
         // A `Dockerfile.vercel` / `Containerfile.vercel` is an explicit opt-in to
@@ -14015,7 +14015,7 @@ var require_frameworks = __commonJS({
               "public",
               "__now_routes_g4t5bY.json"
             );
-            const content = await readFile7(nowRoutesPath, "utf8");
+            const content = await readFile8(nowRoutesPath, "utf8");
             const nowRoutes = JSON.parse(content);
             try {
               await unlink2(nowRoutesPath);
@@ -17819,7 +17819,6 @@ var require_frameworks = __commonJS({
       {
         name: "Rust",
         slug: "rust",
-        experimental: true,
         runtimeFramework: true,
         logo: "https://api-frameworks.vercel.sh/framework-logos/rust.svg",
         tagline: "A language empowering everyone to build reliable and efficient software.",
@@ -17828,6 +17827,8 @@ var require_frameworks = __commonJS({
         useRuntime: { src: "src/main.rs", use: "@vercel/rust" },
         ignoreRuntimes: ["@vercel/rust"],
         detectors: {
+          // Do not detect on `[[bin]]` declarations: `api/**/*.rs` projects
+          // declare one per handler and must stay framework-less.
           every: [
             {
               path: "Cargo.toml"
@@ -18229,8 +18230,8 @@ var require_frameworks = __commonJS({
         getOutputDirName: async () => "public"
       }
     ];
-    var frameworkList5 = frameworks;
-    var frameworks_default = frameworkList5;
+    var frameworkList6 = frameworks;
+    var frameworks_default = frameworkList6;
   }
 });
 
@@ -20341,7 +20342,7 @@ var require_detect_builders = __commonJS({
     var import_minimatch = __toESM2(require_minimatch());
     var import_semver = require_semver();
     var import_path19 = __require("path");
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_is_official_runtime = require_is_official_runtime();
     var import_build_utils11 = __require("@vercel/build-utils");
     var import_python = require_python();
@@ -20371,11 +20372,11 @@ var require_detect_builders = __commonJS({
     }
     var REGEX_NON_VERCEL_PLATFORM_FILES2 = getStaticFilesPattern();
     var slugToFramework = new Map(
-      import_frameworks5.frameworkList.map((f) => [f.slug, f])
+      import_frameworks6.frameworkList.map((f) => [f.slug, f])
     );
     var builderToFrameworks2 = (() => {
       const map = /* @__PURE__ */ new Map();
-      for (const f of import_frameworks5.frameworkList) {
+      for (const f of import_frameworks6.frameworkList) {
         if (!f.useRuntime?.use)
           continue;
         const builder = f.useRuntime.use;
@@ -20458,7 +20459,10 @@ var require_detect_builders = __commonJS({
       const absolutePathCache = /* @__PURE__ */ new Map();
       const { buildCommand, outputDirectory } = projectSettings;
       const frameworkConfig = slugToFramework.get(framework || "");
-      const ignoreRuntimes = new Set(frameworkConfig?.ignoreRuntimes);
+      const rustStaticOutput = isRustStaticOutput(framework, projectSettings);
+      const ignoreRuntimes = new Set(
+        rustStaticOutput ? void 0 : frameworkConfig?.ignoreRuntimes
+      );
       const withTag = options.tag ? `@${options.tag}` : "";
       const apiMatches = getApiMatches().filter(
         (b) => (
@@ -20533,7 +20537,8 @@ var require_detect_builders = __commonJS({
         addToUsedFunctions(proxyBuilder);
         apiBuilders.unshift(proxyBuilder);
       }
-      if (!makeFrontendStatic && (hasBuildScript(pkg) || buildCommand || framework)) {
+      const rustStaticPrebuilt = rustStaticOutput && !pkg && !buildCommand;
+      if (!makeFrontendStatic && !rustStaticPrebuilt && (hasBuildScript(pkg) || buildCommand || framework)) {
         frontendBuilder = detectFrontBuilder(
           pkg,
           files,
@@ -20830,6 +20835,10 @@ var require_detect_builders = __commonJS({
       const { scripts = {} } = pkg || {};
       return Boolean(scripts && scripts["build"]);
     }
+    function isRustStaticOutput(framework, projectSettings) {
+      return framework === "rust" && typeof projectSettings.outputDirectory === "string" && projectSettings.outputDirectory !== "" && // The framework preset's display default; not a real directory.
+      projectSettings.outputDirectory !== "N/A";
+    }
     function detectFrontBuilder(pkg, files, usedFunctions, fallbackEntrypoint, options) {
       const { tag, projectSettings = {} } = options;
       const withTag = tag ? `@${tag}` : "";
@@ -20875,7 +20884,7 @@ var require_detect_builders = __commonJS({
         });
       }
       const f = slugToFramework.get(framework || "");
-      if (f && f.useRuntime) {
+      if (f && f.useRuntime && !isRustStaticOutput(framework, projectSettings)) {
         const { src, use } = f.useRuntime;
         const shouldUseUnifiedBackend = (0, import_build_utils11.isExperimentalBackendsEnabled)() && import_build_utils11.BACKEND_BUILDERS.includes(use);
         const finalUse = shouldUseUnifiedBackend ? import_build_utils11.UNIFIED_BACKEND_BUILDER : use;
@@ -21310,7 +21319,7 @@ var require_detect_file_system_api = __commonJS({
     });
     module.exports = __toCommonJS2(detect_file_system_api_exports);
     var import_semver = __toESM2(require_semver());
-    var import__2 = require_dist3();
+    var import__2 = require_dist2();
     async function detectFileSystemAPI2({
       files,
       projectSettings,
@@ -21506,11 +21515,11 @@ var require_detect_framework = __commonJS({
       const isEnabled = (val) => val === "1" || typeof val === "string" && val.toLowerCase() === "true";
       return isEnabled(experimentalEnv);
     }
-    function filterFrameworkList(frameworkList5, useExperimentalFrameworks) {
+    function filterFrameworkList(frameworkList6, useExperimentalFrameworks) {
       if (shouldIncludeExperimentalFrameworks(useExperimentalFrameworks)) {
-        return frameworkList5;
+        return frameworkList6;
       }
-      return frameworkList5.filter((f) => {
+      return frameworkList6.filter((f) => {
         const experimental = f.experimental;
         return !experimental;
       });
@@ -21627,11 +21636,11 @@ var require_detect_framework = __commonJS({
     }
     async function detectFramework2({
       fs: fs5,
-      frameworkList: frameworkList5,
+      frameworkList: frameworkList6,
       useExperimentalFrameworks
     }) {
       const filteredList = filterFrameworkList(
-        frameworkList5,
+        frameworkList6,
         useExperimentalFrameworks
       );
       const result = await Promise.all(
@@ -21647,11 +21656,11 @@ var require_detect_framework = __commonJS({
     }
     async function detectFrameworks3({
       fs: fs5,
-      frameworkList: frameworkList5,
+      frameworkList: frameworkList6,
       useExperimentalFrameworks
     }) {
       const filteredList = filterFrameworkList(
-        frameworkList5,
+        frameworkList6,
         useExperimentalFrameworks
       );
       const result = await Promise.all(
@@ -21667,11 +21676,11 @@ var require_detect_framework = __commonJS({
     }
     async function detectFrameworkRecord2({
       fs: fs5,
-      frameworkList: frameworkList5,
+      frameworkList: frameworkList6,
       useExperimentalFrameworks
     }) {
       const filteredList = filterFrameworkList(
-        frameworkList5,
+        frameworkList6,
         useExperimentalFrameworks
       );
       const result = await Promise.all(
@@ -21746,7 +21755,7 @@ var require_get_project_paths = __commonJS({
     });
     module.exports = __toCommonJS2(get_project_paths_exports);
     var import_detect_framework = require_detect_framework();
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var MAX_DEPTH_TRAVERSE = 3;
     var getProjectPaths2 = async ({
       fs: fs5,
@@ -21763,7 +21772,7 @@ var require_get_project_paths = __commonJS({
       }
       const framework = await (0, import_detect_framework.detectFramework)({
         fs: fs5.chdir(topPath),
-        frameworkList: import_frameworks5.frameworkList
+        frameworkList: import_frameworks6.frameworkList
       });
       if (framework !== null)
         allPaths.push(topPath);
@@ -21925,7 +21934,7 @@ var require_local_file_system_detector = __commonJS({
       LocalFileSystemDetector: () => LocalFileSystemDetector6
     });
     module.exports = __toCommonJS2(local_file_system_detector_exports);
-    var import_promises4 = __toESM2(__require("fs/promises"));
+    var import_promises5 = __toESM2(__require("fs/promises"));
     var import_path19 = __require("path");
     var import_filesystem = require_filesystem();
     var import_error_utils5 = require_dist();
@@ -21936,7 +21945,7 @@ var require_local_file_system_detector = __commonJS({
       }
       async _hasPath(name) {
         try {
-          await import_promises4.default.stat(this.getFilePath(name));
+          await import_promises5.default.stat(this.getFilePath(name));
           return true;
         } catch (err) {
           if ((0, import_error_utils5.isErrnoException)(err) && err.code === "ENOENT") {
@@ -21946,15 +21955,15 @@ var require_local_file_system_detector = __commonJS({
         }
       }
       _readFile(name) {
-        return import_promises4.default.readFile(this.getFilePath(name));
+        return import_promises5.default.readFile(this.getFilePath(name));
       }
       async _isFile(name) {
-        const stat2 = await import_promises4.default.stat(this.getFilePath(name));
+        const stat2 = await import_promises5.default.stat(this.getFilePath(name));
         return stat2.isFile();
       }
       async _readdir(dir) {
         const dirPath = this.getFilePath(dir);
-        const entries = await import_promises4.default.readdir(dirPath, { withFileTypes: true });
+        const entries = await import_promises5.default.readdir(dirPath, { withFileTypes: true });
         const result = [];
         for (const entry of entries) {
           let type;
@@ -28309,7 +28318,7 @@ var require_stringify = __commonJS({
 });
 
 // ../../node_modules/.pnpm/json5@2.2.2/node_modules/json5/lib/index.js
-var require_lib4 = __commonJS({
+var require_lib3 = __commonJS({
   "../../node_modules/.pnpm/json5@2.2.2/node_modules/json5/lib/index.js"(exports, module) {
     var parse3 = require_parse();
     var stringify = require_stringify();
@@ -28457,7 +28466,7 @@ var require_get_workspace_package_paths = __commonJS({
     var import_path19 = __toESM2(__require("path"));
     var import_js_yaml = __toESM2(require_js_yaml3());
     var import_glob = __toESM2(require_glob());
-    var import_json5 = __toESM2(require_lib4());
+    var import_json5 = __toESM2(require_lib3());
     var import_get_glob_fs = require_get_glob_fs();
     var posixPath = import_path19.default.posix;
     async function getWorkspacePackagePaths3({
@@ -28830,7 +28839,7 @@ var require_get_monorepo_default_settings = __commonJS({
     var import_monorepo_managers = require_monorepo_managers();
     var import_package_managers = require_package_managers();
     var import_detect_framework = require_detect_framework();
-    var import_json5 = __toESM2(require_lib4());
+    var import_json5 = __toESM2(require_lib3());
     var import_semver = __toESM2(require_semver());
     var MissingBuildPipeline = class extends Error {
       constructor(usesTasks) {
@@ -29049,7 +29058,7 @@ var require_detect_instrumentation = __commonJS({
 });
 
 // ../fs-detectors/dist/index.js
-var require_dist3 = __commonJS({
+var require_dist2 = __commonJS({
   "../fs-detectors/dist/index.js"(exports, module) {
     "use strict";
     var __defProp = Object.defineProperty;
@@ -29476,7 +29485,7 @@ var require_json_parse_better_errors = __commonJS({
 });
 
 // ../../node_modules/.pnpm/path-to-regexp@6.1.0/node_modules/path-to-regexp/dist/index.js
-var require_dist4 = __commonJS({
+var require_dist3 = __commonJS({
   "../../node_modules/.pnpm/path-to-regexp@6.1.0/node_modules/path-to-regexp/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -29846,7 +29855,7 @@ var require_dist4 = __commonJS({
 });
 
 // ../../node_modules/.pnpm/path-to-regexp@6.3.0/node_modules/path-to-regexp/dist/index.js
-var require_dist5 = __commonJS({
+var require_dist4 = __commonJS({
   "../../node_modules/.pnpm/path-to-regexp@6.3.0/node_modules/path-to-regexp/dist/index.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
@@ -30271,8 +30280,8 @@ var require_superstatic = __commonJS({
     });
     module.exports = __toCommonJS2(superstatic_exports);
     var import_url4 = __require("url");
-    var import_path_to_regexp = require_dist4();
-    var import_path_to_regexp_updated = require_dist5();
+    var import_path_to_regexp = require_dist3();
+    var import_path_to_regexp_updated = require_dist4();
     function cloneKeys(keys) {
       if (typeof keys === "undefined") {
         return void 0;
@@ -30774,7 +30783,7 @@ var require_append = __commonJS({
       appendRoutesToPhase: () => appendRoutesToPhase2
     });
     module.exports = __toCommonJS2(append_exports);
-    var import_index = require_dist6();
+    var import_index = require_dist5();
     function appendRoutesToPhase2({
       routes: prevRoutes,
       newRoutes,
@@ -30842,7 +30851,7 @@ var require_merge3 = __commonJS({
       mergeRoutes: () => mergeRoutes2
     });
     module.exports = __toCommonJS2(merge_exports);
-    var import_index = require_dist6();
+    var import_index = require_dist5();
     function getBuilderRoutesMapping(builds) {
       const builderRoutes = {};
       for (const { entrypoint, routes, use } of builds) {
@@ -31811,7 +31820,7 @@ var require_types2 = __commonJS({
 });
 
 // ../routing-utils/dist/index.js
-var require_dist6 = __commonJS({
+var require_dist5 = __commonJS({
   "../routing-utils/dist/index.js"(exports, module) {
     "use strict";
     var __defProp = Object.defineProperty;
@@ -32365,9 +32374,9 @@ var require_utils3 = __commonJS({
     });
     module.exports = __toCommonJS2(utils_exports);
     var import_build_utils11 = __require("@vercel/build-utils");
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_types = require_types3();
-    var DETECTION_FRAMEWORKS = import_frameworks5.frameworkList.filter(
+    var DETECTION_FRAMEWORKS = import_frameworks6.frameworkList.filter(
       (framework) => !framework.experimental || framework.runtimeFramework
     );
     function stripTrailingSlash(p) {
@@ -32581,11 +32590,11 @@ var require_resolve2 = __commonJS({
     var import_build_utils11 = __require("@vercel/build-utils");
     var import_types = require_types3();
     var import_utils4 = require_utils3();
-    var import_frameworks5 = require_frameworks();
-    var import_fs_detectors6 = require_dist3();
-    var import_routing_utils2 = require_dist6();
+    var import_frameworks6 = require_frameworks();
+    var import_fs_detectors6 = require_dist2();
+    var import_routing_utils2 = require_dist5();
     var import_build_utils22 = __require("@vercel/build-utils");
-    var frameworksBySlug2 = new Map(import_frameworks5.frameworkList.map((f) => [f.slug, f]));
+    var frameworksBySlug2 = new Map(import_frameworks6.frameworkList.map((f) => [f.slug, f]));
     var PYTHON_MODULE_ATTR_RE = /^([A-Za-z_][\w]*(?:\.[A-Za-z_][\w]*)*):([A-Za-z_][\w]*)$/;
     function parsePyModuleAttrEntrypoint(entrypoint) {
       const match = PYTHON_MODULE_ATTR_RE.exec(entrypoint);
@@ -32761,7 +32770,7 @@ var require_resolve2 = __commonJS({
       runtime
     }) {
       const serviceFs = workspace === "." ? fs5 : fs5.chdir(workspace);
-      const frameworkCandidates = (0, import_utils4.filterFrameworksByRuntime)(import_frameworks5.frameworkList, runtime);
+      const frameworkCandidates = (0, import_utils4.filterFrameworksByRuntime)(import_frameworks6.frameworkList, runtime);
       const frameworks = await (0, import_fs_detectors6.detectFrameworks)({
         fs: serviceFs,
         frameworkList: frameworkCandidates
@@ -33481,11 +33490,11 @@ var require_resolve_v2 = __commonJS({
     module.exports = __toCommonJS2(resolve_v2_exports);
     var import_path19 = __require("path");
     var import_build_utils11 = __require("@vercel/build-utils");
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_types = require_types3();
     var import_resolve = require_resolve2();
     var import_utils4 = require_utils3();
-    var frameworksBySlug2 = new Map(import_frameworks5.frameworkList.map((f) => [f.slug, f]));
+    var frameworksBySlug2 = new Map(import_frameworks6.frameworkList.map((f) => [f.slug, f]));
     var MAX_SERVICE_NAME_LENGTH = 64;
     var SERVICE_NAME_REGEX = /^[a-z]([a-z_-]*[a-z])?$/;
     function isValidServiceName(name) {
@@ -33872,8 +33881,8 @@ var require_auto_detect = __commonJS({
       autoDetectServices: () => autoDetectServices2
     });
     module.exports = __toCommonJS2(auto_detect_exports);
-    var import_fs_detectors6 = require_dist3();
-    var import_frameworks5 = require_frameworks();
+    var import_fs_detectors6 = require_dist2();
+    var import_frameworks6 = require_frameworks();
     var import_utils4 = require_utils3();
     var FRONTEND_DIR = "frontend";
     var APPS_WEB_DIR = "apps/web";
@@ -33884,7 +33893,7 @@ var require_auto_detect = __commonJS({
       const { fs: fs5, detectEntrypoint } = options;
       const rootFrameworks = await (0, import_fs_detectors6.detectFrameworks)({
         fs: fs5,
-        frameworkList: import_frameworks5.frameworkList
+        frameworkList: import_frameworks6.frameworkList
       });
       if (rootFrameworks.length > 1) {
         const frameworkNames = rootFrameworks.map((f) => f.name).join(", ");
@@ -33910,7 +33919,7 @@ var require_auto_detect = __commonJS({
         const frontendFs = fs5.chdir(frontendLocation);
         const frontendFrameworks = await (0, import_fs_detectors6.detectFrameworks)({
           fs: frontendFs,
-          frameworkList: import_frameworks5.frameworkList
+          frameworkList: import_frameworks6.frameworkList
         });
         if (frontendFrameworks.length > 1) {
           const frameworkNames = frontendFrameworks.map((f) => f.name).join(", ");
@@ -34154,7 +34163,7 @@ var require_detect_railway = __commonJS({
     module.exports = __toCommonJS2(detect_railway_exports);
     var import_path19 = __require("path");
     var import_smol_toml3 = __toESM2(__require("smol-toml"));
-    var import_fs_detectors6 = require_dist3();
+    var import_fs_detectors6 = require_dist2();
     var import_utils4 = require_utils3();
     var RAILWAY_JSON = "railway.json";
     var RAILWAY_TOML = "railway.toml";
@@ -34396,7 +34405,7 @@ var require_detect_render = __commonJS({
     });
     module.exports = __toCommonJS2(detect_render_exports);
     var import_js_yaml = __toESM2(require_js_yaml3());
-    var import_fs_detectors6 = require_dist3();
+    var import_fs_detectors6 = require_dist2();
     var import_types = require_types3();
     var import_utils4 = require_utils3();
     var RENDER_YAML = "render.yaml";
@@ -34617,7 +34626,7 @@ var require_detect_procfile = __commonJS({
       detectProcfileServices: () => detectProcfileServices
     });
     module.exports = __toCommonJS2(detect_procfile_exports);
-    var import_fs_detectors6 = require_dist3();
+    var import_fs_detectors6 = require_dist2();
     var import_utils4 = require_utils3();
     var PROCFILE = "Procfile";
     var PROCFILE_LINE_RE = /^\s*([A-Za-z_][A-Za-z0-9_-]*):\s*(.+)/;
@@ -34871,7 +34880,7 @@ var require_detect_services = __commonJS({
     });
     module.exports = __toCommonJS2(detect_services_exports);
     var import_build_utils11 = __require("@vercel/build-utils");
-    var import_routing_utils2 = require_dist6();
+    var import_routing_utils2 = require_dist5();
     var import_utils4 = require_utils3();
     var import_resolve = require_resolve2();
     var import_resolve_v2 = require_resolve_v2();
@@ -35266,7 +35275,7 @@ var require_detect_services = __commonJS({
 });
 
 // ../../internals/service-topology/dist/index.js
-var require_dist7 = __commonJS({
+var require_dist6 = __commonJS({
   "../../internals/service-topology/dist/index.js"(exports, module) {
     "use strict";
     var __defProp = Object.defineProperty;
@@ -36906,7 +36915,7 @@ var require_jsonfile3 = __commonJS({
     } catch (_) {
       _fs = __require("fs");
     }
-    function readFile7(file, options, callback) {
+    function readFile8(file, options, callback) {
       if (callback == null) {
         callback = options;
         options = {};
@@ -37005,7 +37014,7 @@ var require_jsonfile3 = __commonJS({
       return content;
     }
     var jsonfile = {
-      readFile: readFile7,
+      readFile: readFile8,
       readFileSync,
       writeFile: writeFile5,
       writeFileSync
@@ -37281,7 +37290,7 @@ var require_output2 = __commonJS({
 });
 
 // ../../node_modules/.pnpm/fs-extra@8.0.1/node_modules/fs-extra/lib/index.js
-var require_lib5 = __commonJS({
+var require_lib4 = __commonJS({
   "../../node_modules/.pnpm/fs-extra@8.0.1/node_modules/fs-extra/lib/index.js"(exports, module) {
     "use strict";
     module.exports = Object.assign(
@@ -37313,7 +37322,7 @@ var require_lib5 = __commonJS({
 });
 
 // ../../node_modules/.pnpm/async-sema@3.0.0/node_modules/async-sema/lib/index.js
-var require_lib6 = __commonJS({
+var require_lib5 = __commonJS({
   "../../node_modules/.pnpm/async-sema@3.0.0/node_modules/async-sema/lib/index.js"(exports) {
     "use strict";
     var __importDefault = exports && exports.__importDefault || function(mod) {
@@ -37513,8 +37522,8 @@ var require_hashes = __commonJS({
     });
     module.exports = __toCommonJS2(hashes_exports);
     var import_crypto = __require("crypto");
-    var import_fs_extra11 = __toESM2(require_lib5());
-    var import_async_sema = require_lib6();
+    var import_fs_extra11 = __toESM2(require_lib4());
+    var import_async_sema = require_lib5();
     var MAX_BUFFER_FILE_SIZE = 2 ** 31 - 1;
     function hash(buf) {
       return (0, import_crypto.createHash)("sha1").update(Uint8Array.from(buf)).digest("hex");
@@ -38000,7 +38009,7 @@ var require_package = __commonJS({
   "../client/package.json"(exports, module) {
     module.exports = {
       name: "@vercel/client",
-      version: "18.2.15",
+      version: "18.2.18",
       main: "dist/index.js",
       typings: "dist/index.d.ts",
       homepage: "https://vercel.com",
@@ -45686,14 +45695,14 @@ var require_utils8 = __commonJS({
     });
     module.exports = __toCommonJS2(utils_exports);
     var import_node_fs2 = __toESM2(__require("fs"), 1);
-    var import_node_path2 = __require("path");
+    var import_node_path3 = __require("path");
     var CONFIGURATION_FILENAMES = [
       "microfrontends.jsonc",
       "microfrontends.json"
     ];
     function findConfig({ dir }) {
       for (const filename of CONFIGURATION_FILENAMES) {
-        const maybeConfig = (0, import_node_path2.join)(dir, filename);
+        const maybeConfig = (0, import_node_path3.join)(dir, filename);
         if (import_node_fs2.default.existsSync(maybeConfig)) {
           return maybeConfig;
         }
@@ -45920,8 +45929,8 @@ var require_utils9 = __commonJS({
     var import_ignore = __toESM2(require_ignore());
     var import_pkg2 = require_pkg();
     var import_build_utils11 = __require("@vercel/build-utils");
-    var import_async_sema = require_lib6();
-    var import_fs_extra11 = require_lib5();
+    var import_async_sema = require_lib5();
+    var import_fs_extra11 = require_lib4();
     var import_readdir_recursive = __toESM2(require_readdir_recursive());
     var import_utils4 = require_utils8();
     var semaphore = new import_async_sema.Sema(10);
@@ -47082,7 +47091,7 @@ var require_retry2 = __commonJS({
 });
 
 // ../../node_modules/.pnpm/async-retry@1.2.3/node_modules/async-retry/lib/index.js
-var require_lib7 = __commonJS({
+var require_lib6 = __commonJS({
   "../../node_modules/.pnpm/async-retry@1.2.3/node_modules/async-retry/lib/index.js"(exports, module) {
     var retrier = require_retry2();
     function retry(fn, opts) {
@@ -47201,8 +47210,8 @@ var require_upload = __commonJS({
     var import_fs6 = __require("fs");
     var import_stream = __require("stream");
     var import_node_events = __require("events");
-    var import_async_retry = __toESM2(require_lib7());
-    var import_async_sema = require_lib6();
+    var import_async_retry = __toESM2(require_lib6());
+    var import_async_sema = require_lib5();
     var import_utils4 = require_utils9();
     var import_errors3 = require_errors();
     var import_deploy = require_deploy();
@@ -47805,7 +47814,7 @@ var require_BufferList = __commonJS({
         this.head = this.tail = null;
         this.length = 0;
       };
-      BufferList.prototype.join = function join14(s) {
+      BufferList.prototype.join = function join15(s) {
         if (this.length === 0)
           return "";
         var p = this.head;
@@ -52813,7 +52822,7 @@ var require_archive = __commonJS({
       createTgzFiles: () => createTgzFiles
     });
     module.exports = __toCommonJS2(archive_exports);
-    var import_node_path2 = __require("path");
+    var import_node_path3 = __require("path");
     var import_node_zlib = __require("zlib");
     var import_build_utils11 = __require("@vercel/build-utils");
     var import_tar_fs = __toESM2(require_tar_fs());
@@ -52822,7 +52831,7 @@ var require_archive = __commonJS({
       const filesToArchive = exclude ? fileList.filter((file) => !exclude.includes(file)) : fileList;
       debug?.("Packing tarball");
       const tarStream = import_tar_fs.default.pack(workPath, {
-        entries: filesToArchive.map((file) => (0, import_node_path2.relative)(workPath, file))
+        entries: filesToArchive.map((file) => (0, import_node_path3.relative)(workPath, file))
       }).pipe((0, import_node_zlib.createGzip)());
       const chunkedTarBuffers = await (0, import_build_utils11.streamToBufferChunks)(tarStream);
       debug?.(`Packed tarball into ${chunkedTarBuffers.length} chunks`);
@@ -52830,7 +52839,7 @@ var require_archive = __commonJS({
         chunkedTarBuffers.map((chunk, index) => [
           (0, import_hashes.hash)(chunk),
           {
-            names: [(0, import_node_path2.join)(workPath, `.vercel/source.tgz.part${index + 1}`)],
+            names: [(0, import_node_path3.join)(workPath, `.vercel/source.tgz.part${index + 1}`)],
             data: chunk,
             mode: 438
           }
@@ -52868,7 +52877,7 @@ var require_collect_deployment_files = __commonJS({
     });
     module.exports = __toCommonJS2(collect_deployment_files_exports);
     var import_error_utils5 = require_dist();
-    var import_fs_extra11 = require_lib5();
+    var import_fs_extra11 = require_lib4();
     var import_path19 = __require("path");
     var import_errors3 = require_errors();
     var import_utils4 = require_utils9();
@@ -53068,7 +53077,7 @@ var require_continue = __commonJS({
     });
     module.exports = __toCommonJS2(continue_exports);
     var import_path19 = __require("path");
-    var import_fs_extra11 = __toESM2(require_lib5());
+    var import_fs_extra11 = __toESM2(require_lib4());
     var import_check_deployment_status = require_check_deployment_status();
     var import_utils4 = require_utils9();
     var import_hashes = require_hashes();
@@ -53357,7 +53366,7 @@ var require_types4 = __commonJS({
 });
 
 // ../client/dist/index.js
-var require_dist8 = __commonJS({
+var require_dist7 = __commonJS({
   "../client/dist/index.js"(exports, module) {
     "use strict";
     var __create = Object.create;
@@ -53411,16 +53420,16 @@ var require_dist8 = __commonJS({
 
 // src/util/compile-vercel-config.ts
 var import_dotenv = __toESM(require_main(), 1);
-import { mkdir, readFile as readFile6, writeFile as writeFile4, unlink, access } from "fs/promises";
-import { join as join13, basename as basename4 } from "path";
+import { mkdir, readFile as readFile7, writeFile as writeFile4, unlink, access } from "fs/promises";
+import { join as join14, basename as basename4 } from "path";
 import { fork } from "child_process";
 import { parse as tomlParse2 } from "smol-toml";
 
 // src/util/projects/link.ts
 var import_ajv = __toESM(require_ajv(), 1);
-var import_fs_extra10 = __toESM(require_lib2(), 1);
+var import_fs_extra10 = __toESM(require_lib(), 1);
 import fs4 from "fs";
-import { join as join12, relative as relative5 } from "path";
+import { join as join13, relative as relative5 } from "path";
 import { promisify } from "util";
 
 // src/util/projects/get-project-by-id-or-name.ts
@@ -53900,7 +53909,7 @@ var CancelablePromise = class _CancelablePromise extends Promise {
 };
 
 // ../../node_modules/.pnpm/@inquirer+core@7.1.3/node_modules/@inquirer/core/dist/esm/lib/create-prompt.mjs
-var import_mute_stream = __toESM(require_lib3(), 1);
+var import_mute_stream = __toESM(require_lib2(), 1);
 
 // ../../node_modules/.pnpm/signal-exit@4.1.0/node_modules/signal-exit/dist/mjs/signals.js
 var signals = [];
@@ -54764,7 +54773,7 @@ ${error}${import_ansi_escapes2.default.cursorHide}`;
 // src/util/link/repo.ts
 var import_pluralize = __toESM(require_pluralize(), 1);
 var import_slugify = __toESM(require_slugify(), 1);
-var import_fs_extra3 = __toESM(require_lib2(), 1);
+var import_fs_extra3 = __toESM(require_lib(), 1);
 import { homedir as homedir2 } from "os";
 import { basename, join as join5 } from "path";
 import { normalizePath, traverseUpDirectories } from "@vercel/build-utils";
@@ -54779,7 +54788,7 @@ function humanizePath(path3) {
 }
 
 // src/util/create-git-meta.ts
-var import_fs_extra = __toESM(require_lib2(), 1);
+var import_fs_extra = __toESM(require_lib(), 1);
 var import_ini = __toESM(require_ini(), 1);
 var import_git_last_commit = __toESM(require_source3(), 1);
 var import_error_utils = __toESM(require_dist(), 1);
@@ -55089,14 +55098,14 @@ async function selectOrg(client, question, autoConfirm, searchable = false, meta
     output_manager_default.stopSpinner();
   }
   const formatChoiceName = (name, slug, isCurrent, limited) => {
-    let title2 = `${name} (${slug})`;
+    let title = `${name} (${slug})`;
     if (isCurrent) {
-      title2 += ` ${import_chalk6.default.bold("(current)")}`;
+      title += ` ${import_chalk6.default.bold("(current)")}`;
     }
     if (limited) {
-      title2 += ` ${emoji("locked")}`;
+      title += ` ${emoji("locked")}`;
     }
-    return title2;
+    return title;
   };
   const personalAccountChoice = user.version === "northstar" ? [] : [
     {
@@ -55207,7 +55216,7 @@ ${import_chalk6.default.dim(`  ${description}`)}` : "";
 }
 
 // src/util/link/add-to-gitignore.ts
-var import_fs_extra2 = __toESM(require_lib2(), 1);
+var import_fs_extra2 = __toESM(require_lib(), 1);
 import os from "os";
 import { join as join3 } from "path";
 async function addToGitIgnore(path3, ignore = VERCEL_DIR) {
@@ -55250,7 +55259,7 @@ async function createProject(client, settings) {
 
 // src/util/projects/detect-projects.ts
 var import_frameworks = __toESM(require_frameworks(), 1);
-var import_fs_detectors = __toESM(require_dist3(), 1);
+var import_fs_detectors = __toESM(require_dist2(), 1);
 import { join as join4 } from "path";
 async function detectProjects(cwd) {
   const fs5 = new import_fs_detectors.LocalFileSystemDetector(cwd);
@@ -56154,7 +56163,7 @@ function findProjectsFromPath(projects, path3) {
 
 // src/commands/env/pull.ts
 var import_chalk19 = __toESM(require_source(), 1);
-var import_fs_extra9 = __toESM(require_lib2(), 1);
+var import_fs_extra9 = __toESM(require_lib(), 1);
 import { closeSync, openSync, readSync } from "fs";
 import { resolve as resolve5 } from "path";
 
@@ -56752,7 +56761,7 @@ async function pullEnvRecords(client, projectIdOrDeploymentId, source, { target,
 }
 
 // src/util/env/diff-env-files.ts
-var import_fs_extra4 = __toESM(require_lib2(), 1);
+var import_fs_extra4 = __toESM(require_lib(), 1);
 
 // src/util/parse-env.ts
 var parseEnv = (env) => {
@@ -56826,6 +56835,610 @@ function addDeltaSection(prefix, arr, changed = false) {
 
 // src/util/env/constants.ts
 var VERCEL_OIDC_TOKEN = "VERCEL_OIDC_TOKEN";
+var SENSITIVE_ENV_VALUE_PLACEHOLDER = "[SENSITIVE]";
+
+// src/util/env/validate-env.ts
+var import_frameworks2 = __toESM(require_frameworks(), 1);
+import { readFile as readFile3 } from "fs/promises";
+import { join as join6 } from "path";
+
+// src/util/env/secret-detection.ts
+var SERVER_ONLY_KEY_PATTERNS = [
+  "access_token",
+  "refresh_token",
+  "client_secret",
+  "webhook_secret",
+  "api_key",
+  "private_key",
+  "service_account",
+  "service_role",
+  "database_url",
+  "database_uri",
+  "db_url",
+  "postgres_url",
+  "postgres_uri",
+  "mysql_url",
+  "mongo_url",
+  "mongo_uri",
+  "redis_url",
+  "redis_uri",
+  "amqp_url",
+  "kafka_url",
+  "elasticsearch_url",
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "private",
+  "key",
+  "apikey",
+  "auth",
+  "token",
+  "jwt",
+  "signature",
+  "cert",
+  "pem",
+  "salt",
+  "bearer",
+  "credential",
+  "credentials",
+  "creds"
+];
+var SAFE_KEY_HINT_TOKENS = ["public", "publishable", "anon"];
+var WELL_KNOWN_SECRET_NAMES = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DATABASE_URL_UNPOOLED",
+  "POSTGRES_URL",
+  "POSTGRES_URL_NON_POOLING",
+  "POSTGRES_URL_NO_SSL",
+  "POSTGRES_URL_UNPOOLED",
+  "POSTGRES_PRISMA_URL",
+  "MONGODB_URI",
+  "MONGODB_URL",
+  "MONGO_URI",
+  "MONGO_URL",
+  "MYSQL_URL",
+  "MYSQL_URI",
+  "REDIS_URL",
+  "REDIS_TLS_URL",
+  "KV_URL",
+  "KV_REST_API_URL",
+  "UPSTASH_REDIS_REST_URL",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "AWS_ACCESS_KEY_ID"
+]);
+var SECRET_SEGMENT_PATTERN = /(?:^|[_-])(SECRET|PASSWORD|PASSWD|PASSPHRASE|PWD|PGPASSWORD|TOKEN|CREDENTIAL|JWT|DSN|APIKEY|PRIVATEKEY|SALT|PEPPER|MNEMONIC|PEM|CIPHER)S?(?:[_-]|$)/i;
+var EXPLICIT_SECRET_TOKEN_PATTERN = /(?:^|[_-])(SECRET|PASSWORD|PASSWD|PASSPHRASE|PWD|PGPASSWORD|TOKEN|CREDENTIAL|MNEMONIC|PRIVATEKEY|APIKEY)S?(?:[_-]|$)/i;
+var SECRET_COMPOUND_PATTERNS = [
+  /(?:^|[_-])(?:API|PRIVATE|SIGNING|ENCRYPTION|SESSION|COOKIE|CSRF|HMAC|ACCESS|APP|WRITE)[_-]?(?:KEY|SECRET)S?(?:[_-]|$)/i,
+  /(?:^|[_-])(?:ACCESS|REFRESH|BEARER|AUTH)[_-]?TOKENS?(?:[_-]|$)/i,
+  /(?:^|[_-])(?:WEBHOOK|SIGNING)[_-]?SECRETS?(?:[_-]|$)/i,
+  /(?:^|[_-])SERVICE[_-]?(?:ROLE(?:[_-]?KEYS?)?|ACCOUNTS?)(?:[_-]|$)/i
+];
+var NON_CREDENTIAL_KEY_TOKENS = /* @__PURE__ */ new Set([
+  "PUBLIC",
+  "PUBLISHABLE",
+  "ANON",
+  "PRIMARY",
+  "PARTITION",
+  "FOREIGN",
+  "SORT",
+  "HASH",
+  "COMPOSITE",
+  "INDEX",
+  "UNIQUE",
+  "NATURAL",
+  "SURROGATE",
+  "CACHE",
+  "IDEMPOTENCY",
+  "LOOKUP",
+  "ROW",
+  "SHARD",
+  "CLUSTER",
+  "LICENSE",
+  "LICENCE",
+  "PRODUCT",
+  "TRANSLATION",
+  "TRANSLATIONS",
+  "I18N",
+  "LOCALE",
+  "RBAC",
+  "ACL",
+  "ROLE",
+  "ROLES",
+  "PERMISSION",
+  "PERMISSIONS",
+  "SCOPE",
+  "SCOPES",
+  "POLICY",
+  "POLICIES"
+]);
+var GENERIC_KEY_SUFFIX_PATTERN = /(?:^|[_-])([A-Z0-9]+)[_-]KEYS?$/i;
+var GENERIC_KEY_PREFIX_PATTERN = /^KEYS?[_-]([A-Z0-9]+)(?:[_-]|$)/i;
+var DB_URL_PATTERN = /(?:^|_)(?:DATABASE|POSTGRES|MONGO|MONGODB|MYSQL|REDIS|NEON|PLANETSCALE|TURSO|RDS)(?:_[A-Z0-9_]*)?_(?:URL|URI)(?:_[A-Z0-9_]+)?$/i;
+var SECRET_VALUE_PATTERNS = [
+  /gh[opsru]_[A-Za-z0-9_]{20,}/,
+  /github_pat_[A-Za-z0-9_]{20,}/,
+  /glpat-[A-Za-z0-9_-]{20,}/,
+  /(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}/,
+  /whsec_[A-Za-z0-9]{20,}/,
+  /xox[abprs]-[A-Za-z0-9-]{20,}/,
+  /xapp-[A-Za-z0-9-]{20,}/,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+  /\bAIza[A-Za-z0-9_-]{30,}/,
+  /sk-ant-[A-Za-z0-9_-]{20,}/,
+  /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/,
+  /\bsk-[A-Za-z0-9]{32,}\b/,
+  /shp(?:at|ss|ca)_[a-fA-F0-9]{32}/,
+  /npm_[A-Za-z0-9]{30,}/,
+  /\bhf_[A-Za-z0-9_]{30,}/,
+  /nvapi-[A-Za-z0-9_-]{40,}/,
+  /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/,
+  /key-[a-f0-9]{32}/,
+  /glsa_[A-Za-z0-9_]{32}_[a-f0-9]{8}/,
+  /pscale_pw_[A-Za-z0-9_-]{20,}/,
+  /\bre_[A-Za-z0-9_]{30,}/,
+  /dop_v1_[a-f0-9]{64}/,
+  /sntrys_[A-Za-z0-9_-]{30,}/,
+  /FlyV1 [A-Za-z0-9_-]{20,}/,
+  /AccountKey=[A-Za-z0-9+/]{40,}=*/,
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY[A-Z0-9 ]*-----/,
+  /-----BEGIN PGP MESSAGE-----/,
+  /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/,
+  /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[A-Za-z0-9_.%-]*:[^@\s/]+(?<!\.\.)@/,
+  /\bBearer\s+[A-Za-z0-9_+=/.-]{20,}/i,
+  /(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|auth)\s*[=:]\s*["']?[A-Za-z0-9_+=/.-]{12,}/i
+];
+function tokenize(key) {
+  return new Set(
+    key.split(/(?<=[a-z])(?=[A-Z])/).flatMap((part) => part.split(/[_\-.]+/)).map((token) => token.toLowerCase()).filter(Boolean)
+  );
+}
+function hasSafeKeyHint(key) {
+  const tokens = tokenize(key);
+  return SAFE_KEY_HINT_TOKENS.some((token) => tokens.has(token));
+}
+function hasGenericKeySuffix(key) {
+  const precedingToken = GENERIC_KEY_SUFFIX_PATTERN.exec(key)?.[1]?.toUpperCase();
+  return Boolean(
+    precedingToken && !NON_CREDENTIAL_KEY_TOKENS.has(precedingToken)
+  );
+}
+function hasGenericKeyPrefix(key) {
+  const followingToken = GENERIC_KEY_PREFIX_PATTERN.exec(key)?.[1]?.toUpperCase();
+  return Boolean(
+    followingToken && !NON_CREDENTIAL_KEY_TOKENS.has(followingToken)
+  );
+}
+function getMatchingServerOnlyKey(key) {
+  const normalized = key.replace(/(?<=[a-z])(?=[A-Z])/g, "_").toLowerCase().replace(/[-.]+/g, "_");
+  for (const pattern of SERVER_ONLY_KEY_PATTERNS) {
+    if (pattern.includes("_") && normalized.includes(pattern))
+      return pattern;
+  }
+  const tokens = tokenize(key);
+  return SERVER_ONLY_KEY_PATTERNS.find(
+    (pattern) => !pattern.includes("_") && tokens.has(pattern)
+  ) ?? null;
+}
+function looksLikeSecret(key) {
+  if (!key || hasSafeKeyHint(key))
+    return false;
+  if (WELL_KNOWN_SECRET_NAMES.has(key.toUpperCase()))
+    return true;
+  if (SECRET_SEGMENT_PATTERN.test(key))
+    return true;
+  if (SECRET_COMPOUND_PATTERNS.some((pattern) => pattern.test(key)))
+    return true;
+  if (DB_URL_PATTERN.test(key))
+    return true;
+  return hasGenericKeySuffix(key) || hasGenericKeyPrefix(key);
+}
+function looksLikeSecretValue(value) {
+  const trimmed = value.trim();
+  return Boolean(
+    trimmed && SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(trimmed))
+  );
+}
+function shouldConfirmRotationBeforeDelete(env) {
+  if (env.type === "system")
+    return false;
+  if (EXPLICIT_SECRET_TOKEN_PATTERN.test(env.key))
+    return true;
+  if (env.hasPublicPrefix || hasSafeKeyHint(env.key))
+    return false;
+  return looksLikeSecret(env.key);
+}
+function isFlagsSecretNeedingSplit(env) {
+  if (env.key !== "FLAGS_SECRET")
+    return false;
+  if (env.type !== "plain" && env.type !== "encrypted")
+    return false;
+  return env.targets.length + (env.customEnvironmentIds?.length ?? 0) > 1;
+}
+
+// src/util/env/validate-env.ts
+function getEnvValueWarnings(value) {
+  const warnings = [];
+  const normalized = value.replace(/\n$/, "");
+  if (/^[ \t]+/.test(normalized)) {
+    warnings.push({
+      message: "starts with whitespace",
+      requiresConfirmation: false
+    });
+  }
+  if (/[ \t]+$/.test(normalized)) {
+    warnings.push({
+      message: "ends with whitespace",
+      requiresConfirmation: false
+    });
+  }
+  if (normalized.includes("\r") || normalized.includes("\n")) {
+    warnings.push({
+      message: "contains newlines",
+      requiresConfirmation: false
+    });
+  }
+  if (value.includes("\0")) {
+    warnings.push({
+      message: "contains null characters",
+      requiresConfirmation: false
+    });
+  }
+  if (value === "") {
+    warnings.push({
+      message: "is empty",
+      requiresConfirmation: true
+    });
+  }
+  if (value.length > 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+    warnings.push({
+      message: "includes surrounding quotes (these will be stored literally)",
+      requiresConfirmation: false
+    });
+  }
+  return warnings;
+}
+function formatWarnings(warnings) {
+  if (warnings.length === 0)
+    return null;
+  const messages = warnings.map((w) => w.message);
+  const startsIdx = messages.indexOf("starts with whitespace");
+  const endsIdx = messages.indexOf("ends with whitespace");
+  if (startsIdx !== -1 && endsIdx !== -1) {
+    messages.splice(Math.max(startsIdx, endsIdx), 1);
+    messages[Math.min(startsIdx, endsIdx)] = "starts and ends with whitespace";
+  }
+  if (messages.length === 1) {
+    return `Value ${messages[0]}`;
+  }
+  if (messages.length === 2) {
+    return `Value ${messages[0]} and ${messages[1]}`;
+  }
+  const last = messages.pop();
+  return `Value ${messages.join(", ")}, and ${last}`;
+}
+var API_PUBLIC_PREFIXES = [
+  "NEXT_PUBLIC_",
+  "VUE_APP_",
+  "REACT_APP_",
+  "GATSBY_",
+  "GRIDSOME_",
+  "NUXT_PUBLIC_",
+  "STORYBOOK_",
+  "VITE_",
+  "PUBLIC_",
+  "EXPO_PUBLIC_",
+  "NG_APP_",
+  "REDWOOD_ENV_"
+];
+var PUBLIC_PREFIXES = [
+  .../* @__PURE__ */ new Set([
+    ...API_PUBLIC_PREFIXES,
+    ...import_frameworks2.frameworkList.map((f) => f.envPrefix).filter((prefix) => !!prefix)
+  ])
+];
+function hasOnlyWhitespaceWarnings(warnings) {
+  return warnings.length > 0 && warnings.every(
+    (w) => w.message === "starts with whitespace" || w.message === "ends with whitespace"
+  );
+}
+function trimValue(value) {
+  return value.replace(/\n$/, "").trim();
+}
+function normalizeStdinEnvValue(value) {
+  let valueWithoutTrailingNewline = value;
+  if (value.endsWith("\r\n")) {
+    valueWithoutTrailingNewline = value.slice(0, -2);
+  } else if (value.endsWith("\n")) {
+    valueWithoutTrailingNewline = value.slice(0, -1);
+  } else {
+    return {
+      value,
+      strippedTrailingNewline: false
+    };
+  }
+  if (valueWithoutTrailingNewline.includes("\n") || valueWithoutTrailingNewline.includes("\r")) {
+    return {
+      value,
+      strippedTrailingNewline: false
+    };
+  }
+  return {
+    value: valueWithoutTrailingNewline,
+    strippedTrailingNewline: true
+  };
+}
+function getPublicPrefix(key) {
+  const upperKey = key.toUpperCase();
+  return PUBLIC_PREFIXES.find((p) => upperKey.startsWith(p)) || null;
+}
+function getFrameworkPublicPrefix(frameworkSlug, key) {
+  const prefix = import_frameworks2.frameworkList.find(
+    (framework) => framework.slug === frameworkSlug
+  )?.envPrefix;
+  return prefix && key.toUpperCase().startsWith(prefix.toUpperCase()) ? prefix : null;
+}
+function getApiPublicPrefix(key) {
+  const upperKey = key.toUpperCase();
+  return API_PUBLIC_PREFIXES.find((prefix) => upperKey.startsWith(prefix)) ?? null;
+}
+function parseSvelteKitPublicEnvVarPrefix(config) {
+  if (!config.includes("publicPrefix")) {
+    return { status: "ready", prefix: null };
+  }
+  const match = /publicPrefix:\s*(?:'(?<single>[^']*)'|"(?<double>[^"]*)"|`(?<template>[^`$]*)`)/.exec(
+    config
+  );
+  const prefix = match?.groups?.single ?? match?.groups?.double ?? match?.groups?.template;
+  return prefix === void 0 ? { status: "unavailable" } : { status: "ready", prefix };
+}
+async function getLocalSvelteKitPublicPrefixes(cwd, rootDirectory) {
+  const projectRoot = rootDirectory ? join6(cwd, rootDirectory) : cwd;
+  let config;
+  try {
+    config = await readFile3(join6(projectRoot, "svelte.config.js"), "utf8");
+  } catch {
+    return void 0;
+  }
+  const parsed = parseSvelteKitPublicEnvVarPrefix(config);
+  if (parsed.status === "unavailable")
+    return void 0;
+  return [parsed.prefix ?? "PUBLIC_", "VITE_"];
+}
+function removePublicPrefix(key) {
+  const prefix = getPublicPrefix(key);
+  if (!prefix)
+    return key;
+  return key.slice(prefix.length);
+}
+async function validateEnvValue(opts) {
+  let finalValue = opts.initialValue;
+  let alreadyConfirmed = false;
+  if (!opts.skipConfirm) {
+    let valueAccepted = false;
+    while (!valueAccepted) {
+      const valueWarnings = getEnvValueWarnings(finalValue);
+      const warningMessage = formatWarnings(valueWarnings);
+      if (!warningMessage) {
+        valueAccepted = true;
+        break;
+      }
+      opts.showWarning(warningMessage);
+      const canTrim = hasOnlyWhitespaceWarnings(valueWarnings);
+      const choices = canTrim ? [
+        { name: "Leave as is", value: "c" },
+        { name: "Re-enter", value: "r" },
+        { name: "Trim whitespace", value: "t" }
+      ] : [
+        { name: "Leave as is", value: "c" },
+        { name: "Re-enter", value: "r" }
+      ];
+      const action = await opts.selectAction(choices);
+      if (action === "c") {
+        valueAccepted = true;
+        if (valueWarnings.some((w) => w.requiresConfirmation)) {
+          alreadyConfirmed = true;
+        }
+      } else if (action === "t") {
+        finalValue = trimValue(finalValue);
+        opts.showLog("Trimmed whitespace");
+      } else {
+        finalValue = await opts.promptForValue();
+      }
+    }
+  } else {
+    const valueWarnings = getEnvValueWarnings(finalValue);
+    const warningMessage = formatWarnings(valueWarnings);
+    if (warningMessage) {
+      opts.showWarning(warningMessage);
+    }
+  }
+  return { finalValue, alreadyConfirmed };
+}
+function getEnvKeyWarnings(key) {
+  const warnings = [];
+  const matchingPrefix = getPublicPrefix(key);
+  if (matchingPrefix) {
+    const nameWithoutPrefix = key.slice(matchingPrefix.length);
+    const sensitiveMatch = looksLikeSecret(nameWithoutPrefix) && getMatchingServerOnlyKey(nameWithoutPrefix);
+    if (sensitiveMatch) {
+      warnings.push({
+        message: `\`${matchingPrefix}\` exposes \`${key}\` to anyone visiting your site`,
+        requiresConfirmation: true
+      });
+    } else {
+      warnings.push({
+        message: `\`${matchingPrefix}\` exposes this value to anyone visiting your site`,
+        requiresConfirmation: false
+      });
+    }
+  }
+  return warnings;
+}
+
+// src/util/env/env-var-config-secret-ui.ts
+var ENV_VISIBILITY_DEPRECATION_MESSAGE = "`--visibility` is deprecated. Use `--type` instead.";
+function invalidTypeOptionError(optionName, value) {
+  if (value === "config" || value === "secret") {
+    return void 0;
+  }
+  if (value === "sensitive") {
+    return `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` flag.`;
+  }
+  if (value === "plain" || value === "encrypted") {
+    return `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.`;
+  }
+  return `The \`${optionName}\` flag must be either \`config\` or \`secret\`.`;
+}
+function resolveEnvVarTypeOption(options) {
+  const usedDeprecatedVisibility = options.visibility !== void 0;
+  if (options.type !== void 0) {
+    const error = invalidTypeOptionError("--type", options.type);
+    if (error) {
+      return {
+        usedDeprecatedVisibility,
+        error,
+        errorReason: "invalid_type"
+      };
+    }
+  }
+  if (options.visibility !== void 0) {
+    const error = invalidTypeOptionError("--visibility", options.visibility);
+    if (error) {
+      return {
+        usedDeprecatedVisibility,
+        error,
+        errorReason: "invalid_visibility"
+      };
+    }
+  }
+  if (options.type !== void 0 && options.visibility !== void 0 && options.type !== options.visibility) {
+    return {
+      usedDeprecatedVisibility,
+      error: `\`--type ${options.type}\` conflicts with \`--visibility ${options.visibility}\`. \`--visibility\` is a deprecated alias of \`--type\`; remove it.`,
+      errorReason: "conflicting_type_visibility"
+    };
+  }
+  if (options.type !== void 0) {
+    return {
+      explicitVisibility: options.type,
+      source: "type",
+      usedDeprecatedVisibility
+    };
+  }
+  if (options.visibility !== void 0) {
+    return {
+      explicitVisibility: options.visibility,
+      source: "visibility",
+      usedDeprecatedVisibility
+    };
+  }
+  return { usedDeprecatedVisibility };
+}
+function isSecretEnvVar(env) {
+  return env.type === "sensitive" || env.visibility === "secret";
+}
+function formatVisibilityLabel(visibility, type) {
+  const resolved = visibility ?? visibilityFromEnvType(type);
+  if (resolved === "config") {
+    return "Config";
+  }
+  if (resolved === "secret") {
+    return "Secret";
+  }
+  return void 0;
+}
+function visibilityFromEnvType(type) {
+  if (type === "sensitive") {
+    return "secret";
+  }
+  if (type === "plain" || type === "encrypted") {
+    return "config";
+  }
+  return void 0;
+}
+function hasNonDevelopmentTarget(envTargets) {
+  return envTargets.some((target) => target !== "development");
+}
+function getPublicPrefixSecretVisibilityError(key, options) {
+  const publicPrefix = getApiPublicPrefix(key);
+  if (!publicPrefix) {
+    return null;
+  }
+  const wouldBeSecret = options.visibility === "secret" || options.type === "sensitive";
+  if (!wouldBeSecret) {
+    return null;
+  }
+  const privateKey = key.slice(publicPrefix.length);
+  if (options.context === "update") {
+    return `\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, add \`${privateKey}\` as a Secret, then remove \`${key}\`. If the value is safe to expose, keep it as Config.`;
+  }
+  return `\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, rename the variable to \`${privateKey}\` and keep the Secret type. If the value is safe to expose, use \`--type config\`.`;
+}
+function shouldOmitInferredVisibility(key, envTargets, teamSensitivePolicyOn) {
+  if (!getApiPublicPrefix(key)) {
+    return false;
+  }
+  if (!hasNonDevelopmentTarget(envTargets)) {
+    return false;
+  }
+  return teamSensitivePolicyOn;
+}
+function resolveEnvVarVisibility(options) {
+  if (options.explicitVisibility !== void 0) {
+    if (options.explicitVisibility !== "config" && options.explicitVisibility !== "secret") {
+      const optionName = options.explicitOptionSource === "visibility" ? "--visibility" : "--type";
+      return {
+        error: options.explicitVisibility === "sensitive" ? `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` flag.` : options.explicitVisibility === "plain" || options.explicitVisibility === "encrypted" ? `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.` : `The \`${optionName}\` flag must be either \`config\` or \`secret\`.`
+      };
+    }
+    const publicPrefixError2 = getPublicPrefixSecretVisibilityError(
+      options.key,
+      {
+        visibility: options.explicitVisibility,
+        type: options.type,
+        context: options.context
+      }
+    );
+    if (publicPrefixError2) {
+      return { error: publicPrefixError2 };
+    }
+    return { visibility: options.explicitVisibility };
+  }
+  const inferred = visibilityFromEnvType(options.type);
+  if (inferred === void 0) {
+    return {};
+  }
+  if (shouldOmitInferredVisibility(
+    options.key,
+    options.envTargets,
+    options.teamSensitivePolicyOn
+  )) {
+    return {};
+  }
+  const publicPrefixError = getPublicPrefixSecretVisibilityError(options.key, {
+    visibility: inferred,
+    type: options.type,
+    context: options.context
+  });
+  if (publicPrefixError) {
+    return { error: publicPrefixError };
+  }
+  return { visibility: inferred };
+}
+
+// src/util/env/secret-read-guidance.ts
+function getUnavailableSecretValuesMessage(environment, count) {
+  const values = count === 1 ? "value" : "values";
+  if (environment === "development") {
+    return `${count} Development Secret ${values} ${count === 1 ? "was" : "were"} not returned by Vercel.`;
+  }
+  return `${count} Secret ${values} cannot be pulled from the \`${environment}\` Environment.`;
+}
+function getLocalSecretFallbackMessage(count) {
+  return ` Define ${count === 1 ? "it" : "them"} in a local .env file.`;
+}
 
 // src/util/env/update-oidc-token-contents.ts
 var CONTENTS_HEADER = "# Created by Vercel CLI";
@@ -56863,9 +57476,9 @@ function escapeValue(value) {
 var import_error_utils3 = __toESM(require_dist(), 1);
 
 // src/util/link/setup-and-link.ts
-var import_fs_extra7 = __toESM(require_lib2(), 1);
-var import_fs_detectors5 = __toESM(require_dist3(), 1);
-import { join as join10, basename as basename3 } from "path";
+var import_fs_extra7 = __toESM(require_lib(), 1);
+var import_fs_detectors5 = __toESM(require_dist2(), 1);
+import { join as join11, basename as basename3 } from "path";
 import { getPlatformEnv as getPlatformEnv2 } from "@vercel/build-utils";
 
 // src/util/input/input-project.ts
@@ -57183,7 +57796,7 @@ async function inputProject(client, org, detectedProjectName, autoConfirm = fals
 }
 
 // src/util/validate-paths.ts
-var import_fs_extra5 = __toESM(require_lib2(), 1);
+var import_fs_extra5 = __toESM(require_lib(), 1);
 var import_chalk13 = __toESM(require_source(), 1);
 import { homedir as homedir3 } from "os";
 import { resolve as resolve4, sep } from "path";
@@ -57286,7 +57899,7 @@ async function inputRootDirectory(client, cwd, autoConfirm = false) {
 
 // src/util/input/edit-project-settings.ts
 var import_chalk15 = __toESM(require_source(), 1);
-var import_frameworks2 = __toESM(require_frameworks(), 1);
+var import_frameworks3 = __toESM(require_frameworks(), 1);
 
 // src/util/is-setting-value.ts
 function isSettingValue(setting) {
@@ -57336,7 +57949,7 @@ async function editProjectSettings(client, projectSettings, framework, autoConfi
       }
     }
     if (localConfigurationOverrides.framework) {
-      const overrideFramework = import_frameworks2.frameworkList.find(
+      const overrideFramework = import_frameworks3.frameworkList.find(
         (f) => f.slug === localConfigurationOverrides.framework
       );
       if (overrideFramework) {
@@ -57412,7 +58025,7 @@ async function editProjectSettings(client, projectSettings, framework, autoConfi
 }
 
 // src/util/read-json-file.ts
-var import_fs_extra6 = __toESM(require_lib2(), 1);
+var import_fs_extra6 = __toESM(require_lib(), 1);
 var import_json_parse_better_errors = __toESM(require_json_parse_better_errors(), 1);
 var import_error_utils2 = __toESM(require_dist(), 1);
 async function readJSONFile(file) {
@@ -57495,7 +58108,7 @@ async function readConfig(dir) {
 }
 
 // src/util/link/setup-and-link.ts
-var import_frameworks4 = __toESM(require_frameworks(), 1);
+var import_frameworks5 = __toESM(require_frameworks(), 1);
 
 // src/util/input/vercel-auth.ts
 var import_chalk16 = __toESM(require_source(), 1);
@@ -57530,17 +58143,17 @@ async function vercelAuth(client, {
 }
 
 // src/util/link/services-setup.ts
-var import_fs_detectors4 = __toESM(require_dist3(), 1);
-var import_service_topology2 = __toESM(require_dist7(), 1);
+var import_fs_detectors4 = __toESM(require_dist2(), 1);
+var import_service_topology2 = __toESM(require_dist6(), 1);
 import {
   isExperimentalService as isExperimentalService2,
   isExperimentalServiceV2 as isExperimentalServiceV23,
   normalizePath as normalizePath4
 } from "@vercel/build-utils";
-import { join as join8, relative as relative2 } from "path";
+import { join as join9, relative as relative2 } from "path";
 
 // src/util/input/display-services.ts
-var import_frameworks3 = __toESM(require_frameworks(), 1);
+var import_frameworks4 = __toESM(require_frameworks(), 1);
 import {
   getServiceQueueTopics,
   isExperimentalServiceV2 as isExperimentalServiceV22,
@@ -57549,7 +58162,7 @@ import {
   isWorkflowTriggeredService
 } from "@vercel/build-utils";
 var chalk17 = require_source();
-var frameworksBySlug = new Map(import_frameworks3.frameworkList.map((f) => [f.slug, f]));
+var frameworksBySlug = new Map(import_frameworks4.frameworkList.map((f) => [f.slug, f]));
 var frameworkColors = {
   // JavaScript/TypeScript frameworks
   nextjs: chalk17.white,
@@ -57687,16 +58300,16 @@ function displayServiceErrors(errors) {
 }
 
 // src/util/projects/detect-services.ts
-var import_fs_detectors3 = __toESM(require_dist3(), 1);
-var import_service_topology = __toESM(require_dist7(), 1);
-import { readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
-import { basename as basename2, join as join7 } from "path";
+var import_fs_detectors3 = __toESM(require_dist2(), 1);
+var import_service_topology = __toESM(require_dist6(), 1);
+import { readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2, join as join8 } from "path";
 import { parse as tomlParse, stringify as tomlStringify } from "smol-toml";
 
 // src/util/validate-config.ts
-var import_routing_utils = __toESM(require_dist6(), 1);
-var import_client = __toESM(require_dist8(), 1);
-var import_fs_detectors2 = __toESM(require_dist3(), 1);
+var import_routing_utils = __toESM(require_dist5(), 1);
+var import_client = __toESM(require_dist7(), 1);
+var import_fs_detectors2 = __toESM(require_dist2(), 1);
 import {
   getFunctionsSchema,
   buildsSchema,
@@ -58408,7 +59021,7 @@ function validateConfig(config) {
 }
 
 // src/util/projects/detect-entrypoint.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import {
   isPythonFramework,
   isNodeBackendFramework,
@@ -58416,7 +59029,7 @@ import {
 } from "@vercel/build-utils";
 function createDetectEntrypoint(projectRoot) {
   return async ({ workPath, framework }) => {
-    const absWorkPath = normalizePath3(join6(projectRoot, workPath));
+    const absWorkPath = normalizePath3(join7(projectRoot, workPath));
     let builderName;
     if (isPythonFramework(framework)) {
       builderName = "@vercel/python";
@@ -58446,7 +59059,7 @@ function createDetectEntrypoint(projectRoot) {
   };
 }
 async function loadBuilderDetectEntrypoint(name, projectRoot) {
-  const { importBuilders } = await import("./import-builders-3H7J2SEK.js");
+  const { importBuilders } = await import("./import-builders-W3YE2V6A.js");
   const builders = await importBuilders(/* @__PURE__ */ new Set([name]), projectRoot);
   const loaded = builders.get(name);
   if (!loaded) {
@@ -58525,9 +59138,9 @@ function toProjectServicesConfigPatch(config) {
 }
 async function prepareServicesConfigWrite(cwd, config) {
   const compileResult = await compileVercelConfig(cwd);
-  const configPath = join7(cwd, "vercel.json");
+  const configPath = join8(cwd, "vercel.json");
   if (compileResult.sourceFile === "vercel.toml") {
-    return prepareTomlServicesConfigWrite(join7(cwd, "vercel.toml"), config);
+    return prepareTomlServicesConfigWrite(join8(cwd, "vercel.toml"), config);
   }
   if (compileResult.wasCompiled) {
     throw new Error(
@@ -58568,7 +59181,7 @@ async function prepareTomlServicesConfigWrite(configPath, config) {
   const patchKeys = Object.keys(patch);
   let existingContent;
   try {
-    existingContent = await readFile3(configPath, "utf8");
+    existingContent = await readFile4(configPath, "utf8");
   } catch {
     existingContent = "";
   }
@@ -58706,7 +59319,7 @@ async function promptForInferredServicesSetup({
         const serviceRoot = isExperimentalServiceV23(service) ? service.root : service.workspace;
         choice = {
           type: "single-app",
-          selectedPath: serviceRoot === "." ? workPath : join8(workPath, serviceRoot)
+          selectedPath: serviceRoot === "." ? workPath : join9(workPath, serviceRoot)
         };
       }
     }
@@ -58725,7 +59338,7 @@ async function promptForInferredServicesSetup({
 
 // src/util/projects/search-project-across-teams.ts
 var import_slugify3 = __toESM(require_slugify(), 1);
-import { join as join9, relative as relative3 } from "path";
+import { join as join10, relative as relative3 } from "path";
 async function searchProjectsByRepoRoot({
   client,
   cwd,
@@ -58738,7 +59351,7 @@ async function searchProjectsByRepoRoot({
   if (!rootPath) {
     return empty;
   }
-  const gitConfigPath = getGitConfigPath({ cwd: rootPath }) ?? join9(rootPath, ".git/config");
+  const gitConfigPath = getGitConfigPath({ cwd: rootPath }) ?? join10(rootPath, ".git/config");
   const remoteUrls = await getRemoteUrls(gitConfigPath);
   const remoteNames = remoteUrls ? Object.keys(remoteUrls).sort() : [];
   let remote;
@@ -58996,8 +59609,8 @@ async function setupAndLink(client, path3, {
   }
   if (forceDelete) {
     const vercelDir = getVercelDirectory(path3);
-    (0, import_fs_extra7.remove)(join10(vercelDir, VERCEL_DIR_README));
-    (0, import_fs_extra7.remove)(join10(vercelDir, VERCEL_DIR_PROJECT));
+    (0, import_fs_extra7.remove)(join11(vercelDir, VERCEL_DIR_README));
+    (0, import_fs_extra7.remove)(join11(vercelDir, VERCEL_DIR_PROJECT));
   }
   output_manager_default.print("\n");
   printAlignedLabel("Directory", humanizePath(path3));
@@ -59167,7 +59780,7 @@ async function setupAndLink(client, path3, {
         });
         if (shouldPromptRoot) {
           rootDirectory = await inputRootDirectory(client, path3, autoConfirm);
-          if (rootDirectory && !await validateRootDirectory(path3, join10(path3, rootDirectory))) {
+          if (rootDirectory && !await validateRootDirectory(path3, join11(path3, rootDirectory))) {
             return {
               status: "error",
               exitCode: 1,
@@ -59176,7 +59789,7 @@ async function setupAndLink(client, path3, {
           }
         }
       }
-      pathWithRootDirectory = rootDirectory ? join10(path3, rootDirectory) : path3;
+      pathWithRootDirectory = rootDirectory ? join11(path3, rootDirectory) : path3;
       const selectedRootServicesSetup = pathWithRootDirectory === path3 ? null : await getServicesSetupState(pathWithRootDirectory);
       let selectedRootInferredServicesChoice = null;
       if (!skipSelectedRootInferredServicesPrompt) {
@@ -59203,7 +59816,7 @@ async function setupAndLink(client, path3, {
             path3,
             selectedRootInferredServicesChoice.selectedPath
           );
-          pathWithRootDirectory = rootDirectory ? join10(path3, rootDirectory) : path3;
+          pathWithRootDirectory = rootDirectory ? join11(path3, rootDirectory) : path3;
         }
         const localConfig = await readConfig(pathWithRootDirectory);
         if (localConfig instanceof CantParseJSONFile) {
@@ -59224,7 +59837,7 @@ async function setupAndLink(client, path3, {
             pathWithRootDirectory
           );
           const detectedProjects = detectedProjectsForWorkspace.get("") || [];
-          const framework = detectedProjects[0] ?? import_frameworks4.frameworkList.find((f) => f.slug === null);
+          const framework = detectedProjects[0] ?? import_frameworks5.frameworkList.find((f) => f.slug === null);
           settings = await editProjectSettings(
             client,
             {},
@@ -59274,7 +59887,12 @@ async function setupAndLink(client, path3, {
       autoConfirm,
       org
     );
-    return { status: "linked", org, project };
+    return {
+      status: "linked",
+      org,
+      project,
+      ...gitConnectIntent?.offered && { gitConnectOffered: true }
+    };
   } catch (err) {
     if (isPromptCanceledError(err)) {
       throw err;
@@ -59292,7 +59910,8 @@ async function setupAndLink(client, path3, {
 }
 async function resolveGitConnectIntent(client, path3, autoConfirm) {
   try {
-    const gitConfig = await parseGitConfig(join10(path3, ".git/config"));
+    const gitConfigPath = getGitConfigPath({ cwd: path3 }) ?? join11(path3, ".git/config");
+    const gitConfig = await parseGitConfig(gitConfigPath);
     if (!gitConfig) {
       return null;
     }
@@ -59301,15 +59920,18 @@ async function resolveGitConnectIntent(client, path3, autoConfirm) {
       return null;
     }
     const skipPrompts = autoConfirm || client.nonInteractive;
-    const shouldConnect = skipPrompts || await client.input.confirm(`Connect detected Git repository?`, false);
+    const shouldConnect = skipPrompts || await client.input.confirm(
+      `Connect this Git repository to automatically deploy changes on every push?`,
+      false
+    );
     if (!shouldConnect) {
-      return null;
+      return { offered: true };
     }
     const repoInfo = skipPrompts ? parseRepoUrl(remoteUrls.origin ?? Object.values(remoteUrls)[0]) : await selectAndParseRemoteUrl(client, remoteUrls);
     if (!repoInfo) {
       return null;
     }
-    return { repoInfo };
+    return { repoInfo, offered: !skipPrompts };
   } catch (error) {
     if (isPromptCanceledError(error)) {
       throw error;
@@ -59319,7 +59941,7 @@ async function resolveGitConnectIntent(client, path3, autoConfirm) {
   }
 }
 async function applyGitConnectIntent(client, intent, project, autoConfirm, org) {
-  if (!intent) {
+  if (!intent?.repoInfo) {
     return;
   }
   const { repoInfo } = intent;
@@ -59346,9 +59968,9 @@ async function applyGitConnectIntent(client, intent, project, autoConfirm, org)
 
 // src/util/projects/find-project-root.ts
 var import_chalk17 = __toESM(require_source(), 1);
-var import_fs_extra8 = __toESM(require_lib2(), 1);
+var import_fs_extra8 = __toESM(require_lib(), 1);
 import { stat } from "fs/promises";
-import { join as join11, dirname } from "path";
+import { join as join12, dirname } from "path";
 async function findProjectRoot(startDir) {
   let cwdDev;
   try {
@@ -59365,10 +59987,10 @@ async function findProjectRoot(startDir) {
     } catch {
       return null;
     }
-    const hasVercelDir = await (0, import_fs_extra8.pathExists)(join11(dir, ".vercel"));
-    const hasVercelJson = await (0, import_fs_extra8.pathExists)(join11(dir, "vercel.json"));
-    const hasVercelToml = await (0, import_fs_extra8.pathExists)(join11(dir, "vercel.toml"));
-    const hasGit = await (0, import_fs_extra8.pathExists)(join11(dir, ".git"));
+    const hasVercelDir = await (0, import_fs_extra8.pathExists)(join12(dir, ".vercel"));
+    const hasVercelJson = await (0, import_fs_extra8.pathExists)(join12(dir, "vercel.json"));
+    const hasVercelToml = await (0, import_fs_extra8.pathExists)(join12(dir, "vercel.toml"));
+    const hasGit = await (0, import_fs_extra8.pathExists)(join12(dir, ".git"));
     if (hasVercelDir || hasVercelJson || hasVercelToml || hasGit) {
       return dir;
     }
@@ -59811,422 +60433,6 @@ var EnvPullTelemetryClient = class extends TelemetryClient {
   }
 };
 
-// src/util/env/env-target.ts
-var import_constants2 = __toESM(require_dist2(), 1);
-var import_title = __toESM(require_lib(), 1);
-var envTargetChoices = import_constants2.PROJECT_ENV_TARGET.map((t) => ({
-  name: (0, import_title.default)(t),
-  value: t
-}));
-function isValidEnvTarget(target) {
-  return typeof target === "undefined" || envTargetChoices.map((c) => c.value).includes(target);
-}
-function getEnvTargetPlaceholder() {
-  return `<${envTargetChoices.map((c) => c.value).join(" | ")}>`;
-}
-function parseEnvTargetArg(arg) {
-  return Array.from(
-    new Set(
-      arg.split(",").map((t) => t.trim()).filter(Boolean)
-    )
-  );
-}
-
-// src/commands/env/command.ts
-var targetPlaceholder = getEnvTargetPlaceholder();
-var listSubcommand = {
-  name: "list",
-  aliases: ["ls"],
-  description: "List all Environment Variables for a Project",
-  arguments: [
-    {
-      name: "environment",
-      required: false
-    },
-    {
-      name: "git-branch",
-      required: false
-    }
-  ],
-  options: [
-    formatOption,
-    jsonOption,
-    projectOption,
-    {
-      name: "guidance",
-      description: "Receive command suggestions once command is complete",
-      shorthand: null,
-      type: Boolean,
-      deprecated: false
-    }
-  ],
-  examples: []
-};
-var addSubcommand = {
-  name: "add",
-  aliases: [],
-  description: "Add an Environment Variable",
-  arguments: [
-    {
-      name: "name",
-      required: true
-    },
-    {
-      name: "environment",
-      required: false
-    }
-  ],
-  options: [
-    projectOption,
-    {
-      name: "git-branch",
-      description: "Set the Git branch for a Preview Environment Variable",
-      shorthand: null,
-      type: String,
-      argument: "NAME",
-      deprecated: false
-    },
-    {
-      name: "sensitive",
-      description: "Store the value as sensitive for Production or Preview",
-      shorthand: null,
-      type: Boolean,
-      deprecated: false
-    },
-    {
-      name: "no-sensitive",
-      description: "Store the value as non-sensitive when policy allows",
-      shorthand: null,
-      type: Boolean,
-      deprecated: false
-    },
-    {
-      name: "visibility",
-      description: "Set config/secret visibility (`config` or `secret`). Inferred from type when omitted",
-      shorthand: null,
-      type: String,
-      argument: "VISIBILITY",
-      deprecated: false
-    },
-    {
-      ...forceOption,
-      description: "Overwrite an existing variable for the same target",
-      shorthand: null
-    },
-    {
-      ...yesOption,
-      description: "Accept default choices when adding an Environment Variable"
-    },
-    {
-      name: "guidance",
-      description: "Show command suggestions after completion",
-      shorthand: null,
-      type: Boolean,
-      deprecated: false
-    },
-    {
-      name: "value",
-      description: "Set the variable value for non-interactive use; otherwise use stdin or the prompt",
-      shorthand: null,
-      type: String,
-      argument: "VALUE",
-      deprecated: false
-    }
-  ],
-  examples: [
-    {
-      name: "Add a new variable (prompts for value and Environments)",
-      value: [
-        `${packageName} env add <name>`,
-        `${packageName} env add API_TOKEN`
-      ]
-    },
-    {
-      name: "Add a new Environment Variable to a specific Environment",
-      value: [
-        `${packageName} env add <name> ${targetPlaceholder}`,
-        `${packageName} env add DB_PASS production`
-      ]
-    },
-    {
-      name: "Add one variable to multiple Environments (comma-separated)",
-      value: [
-        `${packageName} env add <name> <environment>[,<environment>]`,
-        `${packageName} env add API_URL production,preview,development`
-      ]
-    },
-    {
-      name: "Override an existing Environment Variable of same target (production, preview, deployment)",
-      value: `${packageName} env add API_TOKEN --force`
-    },
-    {
-      name: "Add a regular (non-sensitive) Environment Variable that remains readable later",
-      value: `${packageName} env add API_TOKEN --no-sensitive`
-    },
-    {
-      name: "Add a new Environment Variable for a specific Environment and Git Branch",
-      value: [
-        `${packageName} env add <name> ${targetPlaceholder} --git-branch <name>`,
-        `${packageName} env add DB_PASS preview --git-branch feat1`
-      ]
-    },
-    {
-      name: "Add a new Environment Variable from stdin",
-      value: [
-        `cat <file> | ${packageName} env add <name> ${targetPlaceholder}`,
-        `cat ~/.npmrc | ${packageName} env add NPM_RC preview`,
-        `${packageName} env add API_URL production < url.txt`
-      ]
-    },
-    {
-      name: "Add with --value for non-interactive use",
-      value: `${packageName} env add API_TOKEN production --value "<value>" --yes`
-    }
-  ]
-};
-var removeSubcommand = {
-  name: "remove",
-  aliases: ["rm"],
-  description: "Remove an Environment Variable (see examples below)",
-  arguments: [
-    {
-      name: "name",
-      required: true
-    },
-    {
-      name: "environment",
-      required: false
-    }
-  ],
-  options: [
-    projectOption,
-    {
-      ...yesOption,
-      description: "Skip the confirmation prompt when removing an Environment Variable"
-    }
-  ],
-  examples: [
-    {
-      name: "Remove a variable from multiple Environments",
-      value: [
-        `${packageName} env rm <name>`,
-        `${packageName} env rm API_TOKEN`
-      ]
-    },
-    {
-      name: "Remove a variable from a specific Environment",
-      value: [
-        `${packageName} env rm <name> ${targetPlaceholder}`,
-        `${packageName} env rm NPM_RC preview`
-      ]
-    },
-    {
-      name: "Remove a variable from a specific Environment and Git Branch",
-      value: [
-        `${packageName} env rm <name> ${targetPlaceholder} <gitbranch>`,
-        `${packageName} env rm NPM_RC preview feat1`
-      ]
-    }
-  ]
-};
-var pullSubcommand = {
-  name: "pull",
-  aliases: [],
-  description: "Pull all Development Environment Variables from the cloud and write to a file [.env.local]",
-  arguments: [
-    {
-      name: "filename",
-      required: false
-    }
-  ],
-  options: [
-    projectOption,
-    {
-      name: "environment",
-      description: "Set the Environment when pulling Environment Variables",
-      shorthand: null,
-      type: String,
-      argument: "TARGET",
-      deprecated: false
-    },
-    {
-      name: "git-branch",
-      description: "Specify the Git branch to pull specific Environment Variables for",
-      shorthand: null,
-      type: String,
-      argument: "NAME",
-      deprecated: false
-    },
-    {
-      name: "id",
-      description: "Pull environment variables for a specific deployment (e.g. dpl_xxx)",
-      shorthand: null,
-      type: String,
-      argument: "ID",
-      deprecated: false
-    },
-    {
-      ...yesOption,
-      description: "Skip the confirmation prompt when removing an environment variable"
-    }
-  ],
-  examples: [
-    {
-      name: "Pull all Development Environment Variables down from the cloud",
-      value: [
-        `${packageName} env pull <file>`,
-        `${packageName} env pull .env.development.local`
-      ]
-    },
-    {
-      name: "Pull environment variables for a specific deployment",
-      value: `${packageName} env pull --id dpl_xxx`
-    }
-  ]
-};
-var runSubcommand = {
-  name: "run",
-  aliases: [],
-  description: "Run a command with environment variables from the linked Vercel project",
-  arguments: [
-    {
-      name: "command",
-      required: true,
-      multiple: true
-    }
-  ],
-  options: [
-    projectOption,
-    {
-      name: "environment",
-      description: "Specify the environment to pull variables from (default: development)",
-      shorthand: "e",
-      type: String,
-      argument: "TARGET",
-      deprecated: false
-    },
-    {
-      name: "git-branch",
-      description: "Specify the Git branch to pull specific Environment Variables for",
-      shorthand: null,
-      type: String,
-      argument: "NAME",
-      deprecated: false
-    }
-  ],
-  examples: [
-    {
-      name: "Run Next.js dev server with development environment variables",
-      value: `${packageName} env run -- next dev`
-    },
-    {
-      name: "Run tests with preview environment variables for a specific branch",
-      value: `${packageName} env run -e preview --git-branch feature-x -- npm test`
-    }
-  ]
-};
-var updateSubcommand = {
-  name: "update",
-  aliases: [],
-  description: "Update the value of an existing Environment Variable (see examples below)",
-  arguments: [
-    {
-      name: "name",
-      required: true
-    },
-    {
-      name: "environment",
-      required: false
-    }
-  ],
-  options: [
-    projectOption,
-    {
-      name: "sensitive",
-      description: "Update to a sensitive Environment Variable",
-      shorthand: null,
-      type: Boolean,
-      deprecated: false
-    },
-    {
-      name: "visibility",
-      description: "Set config/secret visibility (`config` or `secret`). Inferred from type when omitted",
-      shorthand: null,
-      type: String,
-      argument: "VISIBILITY",
-      deprecated: false
-    },
-    {
-      ...yesOption,
-      description: "Skip the confirmation prompt when updating an Environment Variable"
-    },
-    {
-      name: "value",
-      description: "New value for the variable (non-interactive). Otherwise use stdin or you will be prompted.",
-      shorthand: null,
-      type: String,
-      argument: "VALUE",
-      deprecated: false
-    }
-  ],
-  examples: [
-    {
-      name: "Update a variable in all Environments",
-      value: [
-        `${packageName} env update <name>`,
-        `${packageName} env update API_TOKEN`
-      ]
-    },
-    {
-      name: "Update a variable in a specific Environment",
-      value: [
-        `${packageName} env update <name> ${targetPlaceholder}`,
-        `${packageName} env update DB_PASS production`
-      ]
-    },
-    {
-      name: "Update a variable for a specific Environment and Git Branch",
-      value: [
-        `${packageName} env update <name> ${targetPlaceholder} <gitbranch>`,
-        `${packageName} env update NPM_RC preview feat1`
-      ]
-    },
-    {
-      name: "Update a variable from stdin",
-      value: [
-        `cat <file> | ${packageName} env update <name> ${targetPlaceholder}`,
-        `cat ~/.npmrc | ${packageName} env update NPM_RC preview`,
-        `${packageName} env update API_URL production < url.txt`
-      ]
-    }
-  ]
-};
-var envCommand = {
-  name: "env",
-  aliases: [],
-  description: "Interact with Environment Variables for a Project",
-  arguments: [],
-  subcommands: [
-    addSubcommand,
-    listSubcommand,
-    pullSubcommand,
-    removeSubcommand,
-    runSubcommand,
-    updateSubcommand
-  ],
-  options: [],
-  examples: [
-    {
-      name: "Run a command with Environment Variables from the linked Project",
-      value: `${packageName} env run -- <command>`
-    },
-    {
-      name: "Add one variable to multiple Environments",
-      value: `${packageName} env add API_URL production,preview,development`
-    }
-  ]
-};
-
 // src/util/parse-target.ts
 function parseTarget({
   flagName,
@@ -60354,6 +60560,10 @@ async function getDeployment(client, contextName, hostOrId) {
 
 // src/commands/env/pull.ts
 var CONTENTS_PREFIX = "# Created by Vercel CLI\n";
+function printEnvPullWarning(message) {
+  output_manager_default.print(`${import_chalk19.default.yellow("!")} ${message}
+`);
+}
 function readHeadSync(path3, length) {
   const buffer = Buffer.alloc(length);
   const fd = openSync(path3, "r");
@@ -60384,7 +60594,7 @@ var VARIABLES_TO_IGNORE = [
   "VERCEL_SPEED_INSIGHTS_ID",
   "VERCEL_WEB_ANALYTICS_ID"
 ];
-var SENSITIVE_PLACEHOLDER = "[SENSITIVE]";
+var SENSITIVE_PLACEHOLDER = SENSITIVE_ENV_VALUE_PLACEHOLDER;
 async function getRedactedSensitiveKeys(client, projectId, source, target, gitBranch, records) {
   const emptyKeys = Object.keys(records).filter((key) => !records[key]);
   if (!projectId || emptyKeys.length === 0) {
@@ -60396,7 +60606,7 @@ async function getRedactedSensitiveKeys(client, projectId, source, target, gitBr
       gitBranch
     });
     const sensitiveKeys = new Set(
-      envs.filter((env) => env.type === "sensitive").map((env) => env.key)
+      envs.filter(isSecretEnvVar).map((env) => env.key)
     );
     return new Set(emptyKeys.filter((key) => sensitiveKeys.has(key)));
   } catch {
@@ -60455,9 +60665,9 @@ async function pull(client, argv, source = "vercel-cli:env:pull", options = {})
         {
           status: "error",
           reason: "not_linked",
-          message: `Your codebase isn't linked to a project on Vercel. Run ${getCommandNamePlain(
+          message: `Your codebase isn't linked to a project on Vercel. Run \`${getCommandNamePlain(
             "link"
-          )} to begin. Use --yes for non-interactive; use --scope or --project to specify team or project.`,
+          )}\` to begin. Use \`--yes\` for non-interactive; use \`--scope\` or \`--project\` to specify team or project.`,
           next: [
             { command: buildCommandWithYes(linkArgv) },
             { command: buildCommandWithYes(client.argv) }
@@ -60576,6 +60786,9 @@ async function envPullCommandLogic(client, filename, skipConfirmation, environme
   let contents;
   let fileChanged = true;
   const keptLocalKeys = [];
+  const preservedLocalSecretKeys = [];
+  let redactedSecretCount = 0;
+  let placeholderSecretCount = 0;
   if (oidcTokenOnly) {
     const existingContents = exists ? await (0, import_fs_extra9.readFile)(fullPath, "utf8") : "";
     contents = updateOidcTokenContents(
@@ -60592,9 +60805,17 @@ async function envPullCommandLogic(client, filename, skipConfirmation, environme
       gitBranch,
       records
     );
+    redactedSecretCount = sensitiveKeys.size;
     const mergedRecords = { ...records };
     for (const key of sensitiveKeys) {
-      mergedRecords[key] = SENSITIVE_PLACEHOLDER;
+      const localValue = oldEnv?.[key];
+      if (localValue && localValue !== SENSITIVE_PLACEHOLDER) {
+        mergedRecords[key] = localValue;
+        preservedLocalSecretKeys.push(key);
+      } else {
+        mergedRecords[key] = SENSITIVE_PLACEHOLDER;
+        placeholderSecretCount++;
+      }
     }
     if (oldEnv) {
       for (const [key, value] of Object.entries(oldEnv)) {
@@ -60627,6 +60848,16 @@ async function envPullCommandLogic(client, filename, skipConfirmation, environme
       )} Environment)`
     );
   }
+  if (redactedSecretCount > 0) {
+    const preservedMessage = preservedLocalSecretKeys.length > 0 ? ` Kept ${preservedLocalSecretKeys.length} existing local ${preservedLocalSecretKeys.length === 1 ? "value" : "values"}.` : "";
+    const placeholderMessage = placeholderSecretCount > 0 ? ` Wrote "${SENSITIVE_PLACEHOLDER}" ${placeholderSecretCount === 1 ? "as a placeholder" : "as placeholders"} for the remaining ${placeholderSecretCount === 1 ? "value" : "values"}; replace ${placeholderSecretCount === 1 ? "it" : "them"} with local-only values.` : "";
+    printEnvPullWarning(
+      `${getUnavailableSecretValuesMessage(
+        environment,
+        redactedSecretCount
+      )}${preservedMessage}${placeholderMessage}`
+    );
+  }
   let isGitIgnoreUpdated = false;
   const fileExistsAfterPull = exists || contents.length > 0;
   if (filename === ".env.local" && fileExistsAfterPull) {
@@ -60653,7 +60884,7 @@ function escapeValue2(value) {
 }
 
 // src/util/projects/link.ts
-var readFile5 = promisify(fs4.readFile);
+var readFile6 = promisify(fs4.readFile);
 var writeFile3 = promisify(fs4.writeFile);
 var VERCEL_DIR = ".vercel";
 var VERCEL_DIR_FALLBACK = ".now";
@@ -60688,7 +60919,7 @@ var linkSchema = {
   }
 };
 function getVercelDirectory(cwd) {
-  const possibleDirs = [join12(cwd, VERCEL_DIR), join12(cwd, VERCEL_DIR_FALLBACK)];
+  const possibleDirs = [join13(cwd, VERCEL_DIR), join13(cwd, VERCEL_DIR_FALLBACK)];
   const existingDirs = possibleDirs.filter((d) => isDirectory(d));
   if (existingDirs.length > 1) {
     throw new NowBuildError2({
@@ -60781,7 +61012,7 @@ async function getProjectLinkFromRepoLink(client, path3, projectName, projectNam
 }
 async function getLinkFromDir(dir) {
   try {
-    const json = await readFile5(join12(dir, VERCEL_DIR_PROJECT), "utf8");
+    const json = await readFile6(join13(dir, VERCEL_DIR_PROJECT), "utf8");
     const ajv = new import_ajv.default();
     const link = JSON.parse(json);
     if (!ajv.validate(linkSchema, link)) {
@@ -61045,7 +61276,7 @@ Upon creation, it will be automatically added to your ".gitignore" file.
 `;
 async function writeReadme(path3) {
   await writeFile3(
-    join12(path3, VERCEL_DIR, VERCEL_DIR_README),
+    join13(path3, VERCEL_DIR, VERCEL_DIR_README),
     VERCEL_DIR_README_CONTENT
   );
 }
@@ -61054,7 +61285,7 @@ async function linkFolderToProject(client, path3, projectLink, projectName, orgS
     return;
   }
   try {
-    await (0, import_fs_extra10.ensureDir)(join12(path3, VERCEL_DIR));
+    await (0, import_fs_extra10.ensureDir)(join13(path3, VERCEL_DIR));
   } catch (err) {
     if ((0, import_error_utils4.isErrnoException)(err) && err.code === "ENOTDIR") {
       return;
@@ -61062,7 +61293,7 @@ async function linkFolderToProject(client, path3, projectLink, projectName, orgS
     throw err;
   }
   await writeFile3(
-    join12(path3, VERCEL_DIR, VERCEL_DIR_PROJECT),
+    join13(path3, VERCEL_DIR, VERCEL_DIR_PROJECT),
     JSON.stringify({
       ...projectLink,
       projectName
@@ -61187,7 +61418,7 @@ async function fileExists(filePath) {
 async function findAllVercelConfigFiles(workPath) {
   const foundFiles = [];
   for (const ext of VERCEL_CONFIG_EXTENSIONS) {
-    const configPath = join13(workPath, `vercel.${ext}`);
+    const configPath = join14(workPath, `vercel.${ext}`);
     if (await fileExists(configPath)) {
       foundFiles.push(configPath);
     }
@@ -61196,12 +61427,12 @@ async function findAllVercelConfigFiles(workPath) {
 }
 async function findSourceVercelConfigFile(workPath) {
   for (const ext of VERCEL_CONFIG_EXTENSIONS) {
-    const configPath = join13(workPath, `vercel.${ext}`);
+    const configPath = join14(workPath, `vercel.${ext}`);
     if (await fileExists(configPath)) {
       return basename4(configPath);
     }
   }
-  const tomlPath = join13(workPath, "vercel.toml");
+  const tomlPath = join14(workPath, "vercel.toml");
   if (await fileExists(tomlPath)) {
     return "vercel.toml";
   }
@@ -61242,15 +61473,15 @@ function parseConfigLoaderError(stderr) {
   return stderr.trim();
 }
 async function compileVercelConfig(workPath) {
-  const vercelJsonPath = join13(workPath, "vercel.json");
-  const nowJsonPath = join13(workPath, "now.json");
-  const vercelTomlPath = join13(workPath, "vercel.toml");
+  const vercelJsonPath = join14(workPath, "vercel.json");
+  const nowJsonPath = join14(workPath, "now.json");
+  const vercelTomlPath = join14(workPath, "vercel.toml");
   const hasVercelJson = await fileExists(vercelJsonPath);
   const hasNowJson = await fileExists(nowJsonPath);
   const hasVercelToml = await fileExists(vercelTomlPath);
   const vercelConfigPath = await findVercelConfigFile(workPath);
-  const vercelDir = join13(workPath, VERCEL_DIR);
-  const compiledConfigPath = join13(vercelDir, "vercel.json");
+  const vercelDir = join14(workPath, VERCEL_DIR);
+  const compiledConfigPath = join14(vercelDir, "vercel.json");
   if (hasNowJson) {
     throw new DeprecatedNowJson(nowJsonPath);
   }
@@ -61289,7 +61520,7 @@ async function compileVercelConfig(workPath) {
   }
   if (hasVercelToml) {
     try {
-      const tomlContent = await readFile6(vercelTomlPath, "utf8");
+      const tomlContent = await readFile7(vercelTomlPath, "utf8");
       const config = tomlParse2(tomlContent);
       const normalizedConfig = normalizeConfig(config);
       await mkdir(vercelDir, { recursive: true });
@@ -61313,10 +61544,10 @@ async function compileVercelConfig(workPath) {
     }
   }
   const sourceConfigPath = vercelConfigPath;
-  (0, import_dotenv.config)({ path: join13(workPath, ".env") });
-  (0, import_dotenv.config)({ path: join13(workPath, ".env.local") });
-  const tempOutPath = join13(vercelDir, "vercel-temp.mjs");
-  const loaderPath = join13(vercelDir, "vercel-loader.mjs");
+  (0, import_dotenv.config)({ path: join14(workPath, ".env") });
+  (0, import_dotenv.config)({ path: join14(workPath, ".env.local") });
+  const tempOutPath = join14(vercelDir, "vercel-temp.mjs");
+  const loaderPath = join14(vercelDir, "vercel-loader.mjs");
   try {
     const { build } = await import("esbuild");
     await mkdir(vercelDir, { recursive: true });
@@ -61420,9 +61651,9 @@ async function compileVercelConfig(workPath) {
   }
 }
 async function getVercelConfigPath(workPath) {
-  const vercelJsonPath = join13(workPath, "vercel.json");
-  const vercelTomlPath = join13(workPath, "vercel.toml");
-  const compiledConfigPath = join13(workPath, VERCEL_DIR, "vercel.json");
+  const vercelJsonPath = join14(workPath, "vercel.json");
+  const vercelTomlPath = join14(workPath, "vercel.toml");
+  const compiledConfigPath = join14(workPath, VERCEL_DIR, "vercel.json");
   if (await fileExists(vercelJsonPath)) {
     return vercelJsonPath;
   }
@@ -61436,19 +61667,8 @@ async function getVercelConfigPath(workPath) {
 }
 
 export {
-  require_lib2 as require_lib,
+  require_lib,
   humanizePath,
-  envTargetChoices,
-  isValidEnvTarget,
-  getEnvTargetPlaceholder,
-  parseEnvTargetArg,
-  listSubcommand,
-  addSubcommand,
-  removeSubcommand,
-  pullSubcommand,
-  runSubcommand,
-  updateSubcommand,
-  envCommand,
   param,
   getUser,
   ua_default,
@@ -61470,7 +61690,7 @@ export {
   useKeypress,
   require_cli_width,
   require_wrap_ansi,
-  require_lib3 as require_lib2,
+  require_lib2,
   onExit,
   createPrompt,
   esm_default,
@@ -61487,11 +61707,12 @@ export {
   require_tar_stream,
   require_pump,
   require_mkdirp,
-  require_dist8 as require_dist,
+  require_dist7 as require_dist,
   require_fast_deep_equal,
   require_ajv,
   getProjectByNameOrId,
   require_pluralize,
+  getGitConfigPath,
   createGitMeta,
   parseGitConfig,
   pluckRemoteUrls,
@@ -61503,7 +61724,7 @@ export {
   require_frameworks,
   require_brace_expansion,
   require_minimatch,
-  require_dist3 as require_dist2,
+  require_dist2,
   list,
   disconnectGitProvider,
   parseRepoUrl,
@@ -61519,6 +61740,27 @@ export {
   parseEnv,
   createEnvObject,
   VERCEL_OIDC_TOKEN,
+  SENSITIVE_ENV_VALUE_PLACEHOLDER,
+  looksLikeSecret,
+  looksLikeSecretValue,
+  shouldConfirmRotationBeforeDelete,
+  isFlagsSecretNeedingSplit,
+  normalizeStdinEnvValue,
+  getPublicPrefix,
+  getFrameworkPublicPrefix,
+  getApiPublicPrefix,
+  getLocalSvelteKitPublicPrefixes,
+  removePublicPrefix,
+  validateEnvValue,
+  getEnvKeyWarnings,
+  ENV_VISIBILITY_DEPRECATION_MESSAGE,
+  resolveEnvVarTypeOption,
+  isSecretEnvVar,
+  formatVisibilityLabel,
+  getPublicPrefixSecretVisibilityError,
+  resolveEnvVarVisibility,
+  getUnavailableSecretValuesMessage,
+  getLocalSecretFallbackMessage,
   PromptCanceledError,
   PromptBackError,
   isPromptCanceledError,
@@ -61534,8 +61776,8 @@ export {
   compileVercelConfig,
   getVercelConfigPath,
   readConfig,
-  require_dist6 as require_dist3,
-  require_dist7 as require_dist4,
+  require_dist5 as require_dist3,
+  require_dist6 as require_dist4,
   displayDetectedServices,
   validateConfig,
   tryDetectServices,