vercel 59.5.0 → 59.6.2

package/dist/chunks/{chunk-E6LFKMI2.js → chunk-VJ5NAOWB.js}

@@ -6,11 +6,11 @@ const __filename = __fileURLToPath(import.meta.url);
 const __dirname = __dirname_(__filename);
 import {
   pullSubcommand
-} from "./chunk-OHER4DGX.js";
+} from "./chunk-FXD67VN5.js";
 import {
   TelemetryClient,
   require_graceful_fs
-} from "./chunk-CYNB6LL4.js";
+} from "./chunk-XNFHNTS2.js";
 import {
   AGENT_REASON,
   AGENT_STATUS,
@@ -21,13 +21,13 @@ import {
   outputActionRequired,
   outputAgentError,
   shouldEmitNonInteractiveCommandError
-} from "./chunk-L7CEMAJG.js";
+} from "./chunk-NGGLYKNU.js";
 import {
   require_ms
 } from "./chunk-GGP5R3FU.js";
 import {
   printError
-} from "./chunk-CQJRLNTX.js";
+} from "./chunk-AYLY3ZVL.js";
 import {
   parseArguments
 } from "./chunk-57RHXXXG.js";
@@ -55,7 +55,7 @@ import {
   TooManyRequests,
   code,
   isAPIError
-} from "./chunk-AWCID36T.js";
+} from "./chunk-BMKU5KEL.js";
 import {
   getCommandName,
   getCommandNamePlain,
@@ -81,7 +81,7 @@ import {
   require_cli_spinners,
   require_dist,
   require_escape_string_regexp
-} from "./chunk-OX7KI3LF.js";
+} from "./chunk-QFAS4OVW.js";
 import {
   require_ansi_styles,
   require_source,
@@ -8025,7 +8025,7 @@ var require_jsonfile = __commonJS({
       }
       return obj;
     }
-    var readFile7 = universalify.fromPromise(_readFile);
+    var readFile8 = universalify.fromPromise(_readFile);
     function readFileSync(file, options = {}) {
       if (typeof options === "string") {
         options = { encoding: options };
@@ -8057,7 +8057,7 @@ var require_jsonfile = __commonJS({
       return fs5.writeFileSync(file, str, options);
     }
     module.exports = {
-      readFile: readFile7,
+      readFile: readFile8,
       readFileSync,
       writeFile: writeFile5,
       writeFileSync
@@ -13753,10 +13753,10 @@ var require_read_config_file = __commonJS({
     var import_smol_toml3 = __require("smol-toml");
     var import_fs6 = __require("fs");
     var import_error_utils5 = require_dist();
-    var { readFile: readFile7 } = import_fs6.promises;
+    var { readFile: readFile8 } = import_fs6.promises;
     async function readFileOrNull(file) {
       try {
-        const data = await readFile7(file);
+        const data = await readFile8(file);
         return data;
       } catch (error) {
         if (!(0, import_error_utils5.isErrnoException)(error)) {
@@ -13835,7 +13835,7 @@ var require_frameworks = __commonJS({
     var frameworks_exports = {};
     __export2(frameworks_exports, {
       default: () => frameworks_default,
-      frameworkList: () => frameworkList5,
+      frameworkList: () => frameworkList6,
       frameworks: () => frameworks
     });
     module.exports = __toCommonJS2(frameworks_exports);
@@ -13843,7 +13843,7 @@ var require_frameworks = __commonJS({
     var import_fs6 = __require("fs");
     var import_read_config_file = require_read_config_file();
     __reExport(frameworks_exports, require_types(), module.exports);
-    var { readdir, readFile: readFile7, unlink: unlink2 } = import_fs6.promises;
+    var { readdir, readFile: readFile8, unlink: unlink2 } = import_fs6.promises;
     var frameworks = [
       {
         // A `Dockerfile.vercel` / `Containerfile.vercel` is an explicit opt-in to
@@ -14015,7 +14015,7 @@ var require_frameworks = __commonJS({
               "public",
               "__now_routes_g4t5bY.json"
             );
-            const content = await readFile7(nowRoutesPath, "utf8");
+            const content = await readFile8(nowRoutesPath, "utf8");
             const nowRoutes = JSON.parse(content);
             try {
               await unlink2(nowRoutesPath);
@@ -17819,7 +17819,6 @@ var require_frameworks = __commonJS({
       {
         name: "Rust",
         slug: "rust",
-        experimental: true,
         runtimeFramework: true,
         logo: "https://api-frameworks.vercel.sh/framework-logos/rust.svg",
         tagline: "A language empowering everyone to build reliable and efficient software.",
@@ -17828,6 +17827,8 @@ var require_frameworks = __commonJS({
         useRuntime: { src: "src/main.rs", use: "@vercel/rust" },
         ignoreRuntimes: ["@vercel/rust"],
         detectors: {
+          // Do not detect on `[[bin]]` declarations: `api/**/*.rs` projects
+          // declare one per handler and must stay framework-less.
           every: [
             {
               path: "Cargo.toml"
@@ -18229,8 +18230,8 @@ var require_frameworks = __commonJS({
         getOutputDirName: async () => "public"
       }
     ];
-    var frameworkList5 = frameworks;
-    var frameworks_default = frameworkList5;
+    var frameworkList6 = frameworks;
+    var frameworks_default = frameworkList6;
   }
 });
 
@@ -20341,7 +20342,7 @@ var require_detect_builders = __commonJS({
     var import_minimatch = __toESM2(require_minimatch());
     var import_semver = require_semver();
     var import_path19 = __require("path");
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_is_official_runtime = require_is_official_runtime();
     var import_build_utils11 = __require("@vercel/build-utils");
     var import_python = require_python();
@@ -20371,11 +20372,11 @@ var require_detect_builders = __commonJS({
     }
     var REGEX_NON_VERCEL_PLATFORM_FILES2 = getStaticFilesPattern();
     var slugToFramework = new Map(
-      import_frameworks5.frameworkList.map((f) => [f.slug, f])
+      import_frameworks6.frameworkList.map((f) => [f.slug, f])
     );
     var builderToFrameworks2 = (() => {
       const map = /* @__PURE__ */ new Map();
-      for (const f of import_frameworks5.frameworkList) {
+      for (const f of import_frameworks6.frameworkList) {
         if (!f.useRuntime?.use)
           continue;
         const builder = f.useRuntime.use;
@@ -20458,7 +20459,10 @@ var require_detect_builders = __commonJS({
       const absolutePathCache = /* @__PURE__ */ new Map();
       const { buildCommand, outputDirectory } = projectSettings;
       const frameworkConfig = slugToFramework.get(framework || "");
-      const ignoreRuntimes = new Set(frameworkConfig?.ignoreRuntimes);
+      const rustStaticOutput = isRustStaticOutput(framework, projectSettings);
+      const ignoreRuntimes = new Set(
+        rustStaticOutput ? void 0 : frameworkConfig?.ignoreRuntimes
+      );
       const withTag = options.tag ? `@${options.tag}` : "";
       const apiMatches = getApiMatches().filter(
         (b) => (
@@ -20533,7 +20537,8 @@ var require_detect_builders = __commonJS({
         addToUsedFunctions(proxyBuilder);
         apiBuilders.unshift(proxyBuilder);
       }
-      if (!makeFrontendStatic && (hasBuildScript(pkg) || buildCommand || framework)) {
+      const rustStaticPrebuilt = rustStaticOutput && !pkg && !buildCommand;
+      if (!makeFrontendStatic && !rustStaticPrebuilt && (hasBuildScript(pkg) || buildCommand || framework)) {
         frontendBuilder = detectFrontBuilder(
           pkg,
           files,
@@ -20830,6 +20835,10 @@ var require_detect_builders = __commonJS({
       const { scripts = {} } = pkg || {};
       return Boolean(scripts && scripts["build"]);
     }
+    function isRustStaticOutput(framework, projectSettings) {
+      return framework === "rust" && typeof projectSettings.outputDirectory === "string" && projectSettings.outputDirectory !== "" && // The framework preset's display default; not a real directory.
+      projectSettings.outputDirectory !== "N/A";
+    }
     function detectFrontBuilder(pkg, files, usedFunctions, fallbackEntrypoint, options) {
       const { tag, projectSettings = {} } = options;
       const withTag = tag ? `@${tag}` : "";
@@ -20875,7 +20884,7 @@ var require_detect_builders = __commonJS({
         });
       }
       const f = slugToFramework.get(framework || "");
-      if (f && f.useRuntime) {
+      if (f && f.useRuntime && !isRustStaticOutput(framework, projectSettings)) {
         const { src, use } = f.useRuntime;
         const shouldUseUnifiedBackend = (0, import_build_utils11.isExperimentalBackendsEnabled)() && import_build_utils11.BACKEND_BUILDERS.includes(use);
         const finalUse = shouldUseUnifiedBackend ? import_build_utils11.UNIFIED_BACKEND_BUILDER : use;
@@ -21506,11 +21515,11 @@ var require_detect_framework = __commonJS({
       const isEnabled = (val) => val === "1" || typeof val === "string" && val.toLowerCase() === "true";
       return isEnabled(experimentalEnv);
     }
-    function filterFrameworkList(frameworkList5, useExperimentalFrameworks) {
+    function filterFrameworkList(frameworkList6, useExperimentalFrameworks) {
       if (shouldIncludeExperimentalFrameworks(useExperimentalFrameworks)) {
-        return frameworkList5;
+        return frameworkList6;
       }
-      return frameworkList5.filter((f) => {
+      return frameworkList6.filter((f) => {
         const experimental = f.experimental;
         return !experimental;
       });
@@ -21627,11 +21636,11 @@ var require_detect_framework = __commonJS({
     }
     async function detectFramework2({
       fs: fs5,
-      frameworkList: frameworkList5,
+      frameworkList: frameworkList6,
       useExperimentalFrameworks
     }) {
       const filteredList = filterFrameworkList(
-        frameworkList5,
+        frameworkList6,
         useExperimentalFrameworks
       );
       const result = await Promise.all(
@@ -21647,11 +21656,11 @@ var require_detect_framework = __commonJS({
     }
     async function detectFrameworks3({
       fs: fs5,
-      frameworkList: frameworkList5,
+      frameworkList: frameworkList6,
       useExperimentalFrameworks
     }) {
       const filteredList = filterFrameworkList(
-        frameworkList5,
+        frameworkList6,
         useExperimentalFrameworks
       );
       const result = await Promise.all(
@@ -21667,11 +21676,11 @@ var require_detect_framework = __commonJS({
     }
     async function detectFrameworkRecord2({
       fs: fs5,
-      frameworkList: frameworkList5,
+      frameworkList: frameworkList6,
       useExperimentalFrameworks
     }) {
       const filteredList = filterFrameworkList(
-        frameworkList5,
+        frameworkList6,
         useExperimentalFrameworks
       );
       const result = await Promise.all(
@@ -21746,7 +21755,7 @@ var require_get_project_paths = __commonJS({
     });
     module.exports = __toCommonJS2(get_project_paths_exports);
     var import_detect_framework = require_detect_framework();
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var MAX_DEPTH_TRAVERSE = 3;
     var getProjectPaths2 = async ({
       fs: fs5,
@@ -21763,7 +21772,7 @@ var require_get_project_paths = __commonJS({
       }
       const framework = await (0, import_detect_framework.detectFramework)({
         fs: fs5.chdir(topPath),
-        frameworkList: import_frameworks5.frameworkList
+        frameworkList: import_frameworks6.frameworkList
       });
       if (framework !== null)
         allPaths.push(topPath);
@@ -21925,7 +21934,7 @@ var require_local_file_system_detector = __commonJS({
       LocalFileSystemDetector: () => LocalFileSystemDetector6
     });
     module.exports = __toCommonJS2(local_file_system_detector_exports);
-    var import_promises4 = __toESM2(__require("fs/promises"));
+    var import_promises5 = __toESM2(__require("fs/promises"));
     var import_path19 = __require("path");
     var import_filesystem = require_filesystem();
     var import_error_utils5 = require_dist();
@@ -21936,7 +21945,7 @@ var require_local_file_system_detector = __commonJS({
       }
       async _hasPath(name) {
         try {
-          await import_promises4.default.stat(this.getFilePath(name));
+          await import_promises5.default.stat(this.getFilePath(name));
           return true;
         } catch (err) {
           if ((0, import_error_utils5.isErrnoException)(err) && err.code === "ENOENT") {
@@ -21946,15 +21955,15 @@ var require_local_file_system_detector = __commonJS({
         }
       }
       _readFile(name) {
-        return import_promises4.default.readFile(this.getFilePath(name));
+        return import_promises5.default.readFile(this.getFilePath(name));
       }
       async _isFile(name) {
-        const stat2 = await import_promises4.default.stat(this.getFilePath(name));
+        const stat2 = await import_promises5.default.stat(this.getFilePath(name));
         return stat2.isFile();
       }
       async _readdir(dir) {
         const dirPath = this.getFilePath(dir);
-        const entries = await import_promises4.default.readdir(dirPath, { withFileTypes: true });
+        const entries = await import_promises5.default.readdir(dirPath, { withFileTypes: true });
         const result = [];
         for (const entry of entries) {
           let type;
@@ -32365,9 +32374,9 @@ var require_utils3 = __commonJS({
     });
     module.exports = __toCommonJS2(utils_exports);
     var import_build_utils11 = __require("@vercel/build-utils");
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_types = require_types3();
-    var DETECTION_FRAMEWORKS = import_frameworks5.frameworkList.filter(
+    var DETECTION_FRAMEWORKS = import_frameworks6.frameworkList.filter(
       (framework) => !framework.experimental || framework.runtimeFramework
     );
     function stripTrailingSlash(p) {
@@ -32581,11 +32590,11 @@ var require_resolve2 = __commonJS({
     var import_build_utils11 = __require("@vercel/build-utils");
     var import_types = require_types3();
     var import_utils4 = require_utils3();
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_fs_detectors6 = require_dist2();
     var import_routing_utils2 = require_dist5();
     var import_build_utils22 = __require("@vercel/build-utils");
-    var frameworksBySlug2 = new Map(import_frameworks5.frameworkList.map((f) => [f.slug, f]));
+    var frameworksBySlug2 = new Map(import_frameworks6.frameworkList.map((f) => [f.slug, f]));
     var PYTHON_MODULE_ATTR_RE = /^([A-Za-z_][\w]*(?:\.[A-Za-z_][\w]*)*):([A-Za-z_][\w]*)$/;
     function parsePyModuleAttrEntrypoint(entrypoint) {
       const match = PYTHON_MODULE_ATTR_RE.exec(entrypoint);
@@ -32761,7 +32770,7 @@ var require_resolve2 = __commonJS({
       runtime
     }) {
       const serviceFs = workspace === "." ? fs5 : fs5.chdir(workspace);
-      const frameworkCandidates = (0, import_utils4.filterFrameworksByRuntime)(import_frameworks5.frameworkList, runtime);
+      const frameworkCandidates = (0, import_utils4.filterFrameworksByRuntime)(import_frameworks6.frameworkList, runtime);
       const frameworks = await (0, import_fs_detectors6.detectFrameworks)({
         fs: serviceFs,
         frameworkList: frameworkCandidates
@@ -33481,11 +33490,11 @@ var require_resolve_v2 = __commonJS({
     module.exports = __toCommonJS2(resolve_v2_exports);
     var import_path19 = __require("path");
     var import_build_utils11 = __require("@vercel/build-utils");
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_types = require_types3();
     var import_resolve = require_resolve2();
     var import_utils4 = require_utils3();
-    var frameworksBySlug2 = new Map(import_frameworks5.frameworkList.map((f) => [f.slug, f]));
+    var frameworksBySlug2 = new Map(import_frameworks6.frameworkList.map((f) => [f.slug, f]));
     var MAX_SERVICE_NAME_LENGTH = 64;
     var SERVICE_NAME_REGEX = /^[a-z]([a-z_-]*[a-z])?$/;
     function isValidServiceName(name) {
@@ -33873,7 +33882,7 @@ var require_auto_detect = __commonJS({
     });
     module.exports = __toCommonJS2(auto_detect_exports);
     var import_fs_detectors6 = require_dist2();
-    var import_frameworks5 = require_frameworks();
+    var import_frameworks6 = require_frameworks();
     var import_utils4 = require_utils3();
     var FRONTEND_DIR = "frontend";
     var APPS_WEB_DIR = "apps/web";
@@ -33884,7 +33893,7 @@ var require_auto_detect = __commonJS({
       const { fs: fs5, detectEntrypoint } = options;
       const rootFrameworks = await (0, import_fs_detectors6.detectFrameworks)({
         fs: fs5,
-        frameworkList: import_frameworks5.frameworkList
+        frameworkList: import_frameworks6.frameworkList
       });
       if (rootFrameworks.length > 1) {
         const frameworkNames = rootFrameworks.map((f) => f.name).join(", ");
@@ -33910,7 +33919,7 @@ var require_auto_detect = __commonJS({
         const frontendFs = fs5.chdir(frontendLocation);
         const frontendFrameworks = await (0, import_fs_detectors6.detectFrameworks)({
           fs: frontendFs,
-          frameworkList: import_frameworks5.frameworkList
+          frameworkList: import_frameworks6.frameworkList
         });
         if (frontendFrameworks.length > 1) {
           const frameworkNames = frontendFrameworks.map((f) => f.name).join(", ");
@@ -36906,7 +36915,7 @@ var require_jsonfile3 = __commonJS({
     } catch (_) {
       _fs = __require("fs");
     }
-    function readFile7(file, options, callback) {
+    function readFile8(file, options, callback) {
       if (callback == null) {
         callback = options;
         options = {};
@@ -37005,7 +37014,7 @@ var require_jsonfile3 = __commonJS({
       return content;
     }
     var jsonfile = {
-      readFile: readFile7,
+      readFile: readFile8,
       readFileSync,
       writeFile: writeFile5,
       writeFileSync
@@ -38000,7 +38009,7 @@ var require_package = __commonJS({
   "../client/package.json"(exports, module) {
     module.exports = {
       name: "@vercel/client",
-      version: "18.2.16",
+      version: "18.2.18",
       main: "dist/index.js",
       typings: "dist/index.d.ts",
       homepage: "https://vercel.com",
@@ -45686,14 +45695,14 @@ var require_utils8 = __commonJS({
     });
     module.exports = __toCommonJS2(utils_exports);
     var import_node_fs2 = __toESM2(__require("fs"), 1);
-    var import_node_path2 = __require("path");
+    var import_node_path3 = __require("path");
     var CONFIGURATION_FILENAMES = [
       "microfrontends.jsonc",
       "microfrontends.json"
     ];
     function findConfig({ dir }) {
       for (const filename of CONFIGURATION_FILENAMES) {
-        const maybeConfig = (0, import_node_path2.join)(dir, filename);
+        const maybeConfig = (0, import_node_path3.join)(dir, filename);
         if (import_node_fs2.default.existsSync(maybeConfig)) {
           return maybeConfig;
         }
@@ -47805,7 +47814,7 @@ var require_BufferList = __commonJS({
         this.head = this.tail = null;
         this.length = 0;
       };
-      BufferList.prototype.join = function join14(s) {
+      BufferList.prototype.join = function join15(s) {
         if (this.length === 0)
           return "";
         var p = this.head;
@@ -52813,7 +52822,7 @@ var require_archive = __commonJS({
       createTgzFiles: () => createTgzFiles
     });
     module.exports = __toCommonJS2(archive_exports);
-    var import_node_path2 = __require("path");
+    var import_node_path3 = __require("path");
     var import_node_zlib = __require("zlib");
     var import_build_utils11 = __require("@vercel/build-utils");
     var import_tar_fs = __toESM2(require_tar_fs());
@@ -52822,7 +52831,7 @@ var require_archive = __commonJS({
       const filesToArchive = exclude ? fileList.filter((file) => !exclude.includes(file)) : fileList;
       debug?.("Packing tarball");
       const tarStream = import_tar_fs.default.pack(workPath, {
-        entries: filesToArchive.map((file) => (0, import_node_path2.relative)(workPath, file))
+        entries: filesToArchive.map((file) => (0, import_node_path3.relative)(workPath, file))
       }).pipe((0, import_node_zlib.createGzip)());
       const chunkedTarBuffers = await (0, import_build_utils11.streamToBufferChunks)(tarStream);
       debug?.(`Packed tarball into ${chunkedTarBuffers.length} chunks`);
@@ -52830,7 +52839,7 @@ var require_archive = __commonJS({
         chunkedTarBuffers.map((chunk, index) => [
           (0, import_hashes.hash)(chunk),
           {
-            names: [(0, import_node_path2.join)(workPath, `.vercel/source.tgz.part${index + 1}`)],
+            names: [(0, import_node_path3.join)(workPath, `.vercel/source.tgz.part${index + 1}`)],
             data: chunk,
             mode: 438
           }
@@ -53411,8 +53420,8 @@ var require_dist7 = __commonJS({
 
 // src/util/compile-vercel-config.ts
 var import_dotenv = __toESM(require_main(), 1);
-import { mkdir, readFile as readFile6, writeFile as writeFile4, unlink, access } from "fs/promises";
-import { join as join13, basename as basename4 } from "path";
+import { mkdir, readFile as readFile7, writeFile as writeFile4, unlink, access } from "fs/promises";
+import { join as join14, basename as basename4 } from "path";
 import { fork } from "child_process";
 import { parse as tomlParse2 } from "smol-toml";
 
@@ -53420,7 +53429,7 @@ import { parse as tomlParse2 } from "smol-toml";
 var import_ajv = __toESM(require_ajv(), 1);
 var import_fs_extra10 = __toESM(require_lib(), 1);
 import fs4 from "fs";
-import { join as join12, relative as relative5 } from "path";
+import { join as join13, relative as relative5 } from "path";
 import { promisify } from "util";
 
 // src/util/projects/get-project-by-id-or-name.ts
@@ -56826,6 +56835,610 @@ function addDeltaSection(prefix, arr, changed = false) {
 
 // src/util/env/constants.ts
 var VERCEL_OIDC_TOKEN = "VERCEL_OIDC_TOKEN";
+var SENSITIVE_ENV_VALUE_PLACEHOLDER = "[SENSITIVE]";
+
+// src/util/env/validate-env.ts
+var import_frameworks2 = __toESM(require_frameworks(), 1);
+import { readFile as readFile3 } from "fs/promises";
+import { join as join6 } from "path";
+
+// src/util/env/secret-detection.ts
+var SERVER_ONLY_KEY_PATTERNS = [
+  "access_token",
+  "refresh_token",
+  "client_secret",
+  "webhook_secret",
+  "api_key",
+  "private_key",
+  "service_account",
+  "service_role",
+  "database_url",
+  "database_uri",
+  "db_url",
+  "postgres_url",
+  "postgres_uri",
+  "mysql_url",
+  "mongo_url",
+  "mongo_uri",
+  "redis_url",
+  "redis_uri",
+  "amqp_url",
+  "kafka_url",
+  "elasticsearch_url",
+  "password",
+  "passwd",
+  "pwd",
+  "secret",
+  "private",
+  "key",
+  "apikey",
+  "auth",
+  "token",
+  "jwt",
+  "signature",
+  "cert",
+  "pem",
+  "salt",
+  "bearer",
+  "credential",
+  "credentials",
+  "creds"
+];
+var SAFE_KEY_HINT_TOKENS = ["public", "publishable", "anon"];
+var WELL_KNOWN_SECRET_NAMES = /* @__PURE__ */ new Set([
+  "DATABASE_URL",
+  "DATABASE_URL_UNPOOLED",
+  "POSTGRES_URL",
+  "POSTGRES_URL_NON_POOLING",
+  "POSTGRES_URL_NO_SSL",
+  "POSTGRES_URL_UNPOOLED",
+  "POSTGRES_PRISMA_URL",
+  "MONGODB_URI",
+  "MONGODB_URL",
+  "MONGO_URI",
+  "MONGO_URL",
+  "MYSQL_URL",
+  "MYSQL_URI",
+  "REDIS_URL",
+  "REDIS_TLS_URL",
+  "KV_URL",
+  "KV_REST_API_URL",
+  "UPSTASH_REDIS_REST_URL",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "AWS_ACCESS_KEY_ID"
+]);
+var SECRET_SEGMENT_PATTERN = /(?:^|[_-])(SECRET|PASSWORD|PASSWD|PASSPHRASE|PWD|PGPASSWORD|TOKEN|CREDENTIAL|JWT|DSN|APIKEY|PRIVATEKEY|SALT|PEPPER|MNEMONIC|PEM|CIPHER)S?(?:[_-]|$)/i;
+var EXPLICIT_SECRET_TOKEN_PATTERN = /(?:^|[_-])(SECRET|PASSWORD|PASSWD|PASSPHRASE|PWD|PGPASSWORD|TOKEN|CREDENTIAL|MNEMONIC|PRIVATEKEY|APIKEY)S?(?:[_-]|$)/i;
+var SECRET_COMPOUND_PATTERNS = [
+  /(?:^|[_-])(?:API|PRIVATE|SIGNING|ENCRYPTION|SESSION|COOKIE|CSRF|HMAC|ACCESS|APP|WRITE)[_-]?(?:KEY|SECRET)S?(?:[_-]|$)/i,
+  /(?:^|[_-])(?:ACCESS|REFRESH|BEARER|AUTH)[_-]?TOKENS?(?:[_-]|$)/i,
+  /(?:^|[_-])(?:WEBHOOK|SIGNING)[_-]?SECRETS?(?:[_-]|$)/i,
+  /(?:^|[_-])SERVICE[_-]?(?:ROLE(?:[_-]?KEYS?)?|ACCOUNTS?)(?:[_-]|$)/i
+];
+var NON_CREDENTIAL_KEY_TOKENS = /* @__PURE__ */ new Set([
+  "PUBLIC",
+  "PUBLISHABLE",
+  "ANON",
+  "PRIMARY",
+  "PARTITION",
+  "FOREIGN",
+  "SORT",
+  "HASH",
+  "COMPOSITE",
+  "INDEX",
+  "UNIQUE",
+  "NATURAL",
+  "SURROGATE",
+  "CACHE",
+  "IDEMPOTENCY",
+  "LOOKUP",
+  "ROW",
+  "SHARD",
+  "CLUSTER",
+  "LICENSE",
+  "LICENCE",
+  "PRODUCT",
+  "TRANSLATION",
+  "TRANSLATIONS",
+  "I18N",
+  "LOCALE",
+  "RBAC",
+  "ACL",
+  "ROLE",
+  "ROLES",
+  "PERMISSION",
+  "PERMISSIONS",
+  "SCOPE",
+  "SCOPES",
+  "POLICY",
+  "POLICIES"
+]);
+var GENERIC_KEY_SUFFIX_PATTERN = /(?:^|[_-])([A-Z0-9]+)[_-]KEYS?$/i;
+var GENERIC_KEY_PREFIX_PATTERN = /^KEYS?[_-]([A-Z0-9]+)(?:[_-]|$)/i;
+var DB_URL_PATTERN = /(?:^|_)(?:DATABASE|POSTGRES|MONGO|MONGODB|MYSQL|REDIS|NEON|PLANETSCALE|TURSO|RDS)(?:_[A-Z0-9_]*)?_(?:URL|URI)(?:_[A-Z0-9_]+)?$/i;
+var SECRET_VALUE_PATTERNS = [
+  /gh[opsru]_[A-Za-z0-9_]{20,}/,
+  /github_pat_[A-Za-z0-9_]{20,}/,
+  /glpat-[A-Za-z0-9_-]{20,}/,
+  /(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,}/,
+  /whsec_[A-Za-z0-9]{20,}/,
+  /xox[abprs]-[A-Za-z0-9-]{20,}/,
+  /xapp-[A-Za-z0-9-]{20,}/,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+  /\bAIza[A-Za-z0-9_-]{30,}/,
+  /sk-ant-[A-Za-z0-9_-]{20,}/,
+  /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/,
+  /\bsk-[A-Za-z0-9]{32,}\b/,
+  /shp(?:at|ss|ca)_[a-fA-F0-9]{32}/,
+  /npm_[A-Za-z0-9]{30,}/,
+  /\bhf_[A-Za-z0-9_]{30,}/,
+  /nvapi-[A-Za-z0-9_-]{40,}/,
+  /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/,
+  /key-[a-f0-9]{32}/,
+  /glsa_[A-Za-z0-9_]{32}_[a-f0-9]{8}/,
+  /pscale_pw_[A-Za-z0-9_-]{20,}/,
+  /\bre_[A-Za-z0-9_]{30,}/,
+  /dop_v1_[a-f0-9]{64}/,
+  /sntrys_[A-Za-z0-9_-]{30,}/,
+  /FlyV1 [A-Za-z0-9_-]{20,}/,
+  /AccountKey=[A-Za-z0-9+/]{40,}=*/,
+  /-----BEGIN [A-Z0-9 ]*PRIVATE KEY[A-Z0-9 ]*-----/,
+  /-----BEGIN PGP MESSAGE-----/,
+  /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{8,}\b/,
+  /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[A-Za-z0-9_.%-]*:[^@\s/]+(?<!\.\.)@/,
+  /\bBearer\s+[A-Za-z0-9_+=/.-]{20,}/i,
+  /(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?token|refresh[_-]?token|private[_-]?key|auth)\s*[=:]\s*["']?[A-Za-z0-9_+=/.-]{12,}/i
+];
+function tokenize(key) {
+  return new Set(
+    key.split(/(?<=[a-z])(?=[A-Z])/).flatMap((part) => part.split(/[_\-.]+/)).map((token) => token.toLowerCase()).filter(Boolean)
+  );
+}
+function hasSafeKeyHint(key) {
+  const tokens = tokenize(key);
+  return SAFE_KEY_HINT_TOKENS.some((token) => tokens.has(token));
+}
+function hasGenericKeySuffix(key) {
+  const precedingToken = GENERIC_KEY_SUFFIX_PATTERN.exec(key)?.[1]?.toUpperCase();
+  return Boolean(
+    precedingToken && !NON_CREDENTIAL_KEY_TOKENS.has(precedingToken)
+  );
+}
+function hasGenericKeyPrefix(key) {
+  const followingToken = GENERIC_KEY_PREFIX_PATTERN.exec(key)?.[1]?.toUpperCase();
+  return Boolean(
+    followingToken && !NON_CREDENTIAL_KEY_TOKENS.has(followingToken)
+  );
+}
+function getMatchingServerOnlyKey(key) {
+  const normalized = key.replace(/(?<=[a-z])(?=[A-Z])/g, "_").toLowerCase().replace(/[-.]+/g, "_");
+  for (const pattern of SERVER_ONLY_KEY_PATTERNS) {
+    if (pattern.includes("_") && normalized.includes(pattern))
+      return pattern;
+  }
+  const tokens = tokenize(key);
+  return SERVER_ONLY_KEY_PATTERNS.find(
+    (pattern) => !pattern.includes("_") && tokens.has(pattern)
+  ) ?? null;
+}
+function looksLikeSecret(key) {
+  if (!key || hasSafeKeyHint(key))
+    return false;
+  if (WELL_KNOWN_SECRET_NAMES.has(key.toUpperCase()))
+    return true;
+  if (SECRET_SEGMENT_PATTERN.test(key))
+    return true;
+  if (SECRET_COMPOUND_PATTERNS.some((pattern) => pattern.test(key)))
+    return true;
+  if (DB_URL_PATTERN.test(key))
+    return true;
+  return hasGenericKeySuffix(key) || hasGenericKeyPrefix(key);
+}
+function looksLikeSecretValue(value) {
+  const trimmed = value.trim();
+  return Boolean(
+    trimmed && SECRET_VALUE_PATTERNS.some((pattern) => pattern.test(trimmed))
+  );
+}
+function shouldConfirmRotationBeforeDelete(env) {
+  if (env.type === "system")
+    return false;
+  if (EXPLICIT_SECRET_TOKEN_PATTERN.test(env.key))
+    return true;
+  if (env.hasPublicPrefix || hasSafeKeyHint(env.key))
+    return false;
+  return looksLikeSecret(env.key);
+}
+function isFlagsSecretNeedingSplit(env) {
+  if (env.key !== "FLAGS_SECRET")
+    return false;
+  if (env.type !== "plain" && env.type !== "encrypted")
+    return false;
+  return env.targets.length + (env.customEnvironmentIds?.length ?? 0) > 1;
+}
+
+// src/util/env/validate-env.ts
+function getEnvValueWarnings(value) {
+  const warnings = [];
+  const normalized = value.replace(/\n$/, "");
+  if (/^[ \t]+/.test(normalized)) {
+    warnings.push({
+      message: "starts with whitespace",
+      requiresConfirmation: false
+    });
+  }
+  if (/[ \t]+$/.test(normalized)) {
+    warnings.push({
+      message: "ends with whitespace",
+      requiresConfirmation: false
+    });
+  }
+  if (normalized.includes("\r") || normalized.includes("\n")) {
+    warnings.push({
+      message: "contains newlines",
+      requiresConfirmation: false
+    });
+  }
+  if (value.includes("\0")) {
+    warnings.push({
+      message: "contains null characters",
+      requiresConfirmation: false
+    });
+  }
+  if (value === "") {
+    warnings.push({
+      message: "is empty",
+      requiresConfirmation: true
+    });
+  }
+  if (value.length > 2 && (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'"))) {
+    warnings.push({
+      message: "includes surrounding quotes (these will be stored literally)",
+      requiresConfirmation: false
+    });
+  }
+  return warnings;
+}
+function formatWarnings(warnings) {
+  if (warnings.length === 0)
+    return null;
+  const messages = warnings.map((w) => w.message);
+  const startsIdx = messages.indexOf("starts with whitespace");
+  const endsIdx = messages.indexOf("ends with whitespace");
+  if (startsIdx !== -1 && endsIdx !== -1) {
+    messages.splice(Math.max(startsIdx, endsIdx), 1);
+    messages[Math.min(startsIdx, endsIdx)] = "starts and ends with whitespace";
+  }
+  if (messages.length === 1) {
+    return `Value ${messages[0]}`;
+  }
+  if (messages.length === 2) {
+    return `Value ${messages[0]} and ${messages[1]}`;
+  }
+  const last = messages.pop();
+  return `Value ${messages.join(", ")}, and ${last}`;
+}
+var API_PUBLIC_PREFIXES = [
+  "NEXT_PUBLIC_",
+  "VUE_APP_",
+  "REACT_APP_",
+  "GATSBY_",
+  "GRIDSOME_",
+  "NUXT_PUBLIC_",
+  "STORYBOOK_",
+  "VITE_",
+  "PUBLIC_",
+  "EXPO_PUBLIC_",
+  "NG_APP_",
+  "REDWOOD_ENV_"
+];
+var PUBLIC_PREFIXES = [
+  .../* @__PURE__ */ new Set([
+    ...API_PUBLIC_PREFIXES,
+    ...import_frameworks2.frameworkList.map((f) => f.envPrefix).filter((prefix) => !!prefix)
+  ])
+];
+function hasOnlyWhitespaceWarnings(warnings) {
+  return warnings.length > 0 && warnings.every(
+    (w) => w.message === "starts with whitespace" || w.message === "ends with whitespace"
+  );
+}
+function trimValue(value) {
+  return value.replace(/\n$/, "").trim();
+}
+function normalizeStdinEnvValue(value) {
+  let valueWithoutTrailingNewline = value;
+  if (value.endsWith("\r\n")) {
+    valueWithoutTrailingNewline = value.slice(0, -2);
+  } else if (value.endsWith("\n")) {
+    valueWithoutTrailingNewline = value.slice(0, -1);
+  } else {
+    return {
+      value,
+      strippedTrailingNewline: false
+    };
+  }
+  if (valueWithoutTrailingNewline.includes("\n") || valueWithoutTrailingNewline.includes("\r")) {
+    return {
+      value,
+      strippedTrailingNewline: false
+    };
+  }
+  return {
+    value: valueWithoutTrailingNewline,
+    strippedTrailingNewline: true
+  };
+}
+function getPublicPrefix(key) {
+  const upperKey = key.toUpperCase();
+  return PUBLIC_PREFIXES.find((p) => upperKey.startsWith(p)) || null;
+}
+function getFrameworkPublicPrefix(frameworkSlug, key) {
+  const prefix = import_frameworks2.frameworkList.find(
+    (framework) => framework.slug === frameworkSlug
+  )?.envPrefix;
+  return prefix && key.toUpperCase().startsWith(prefix.toUpperCase()) ? prefix : null;
+}
+function getApiPublicPrefix(key) {
+  const upperKey = key.toUpperCase();
+  return API_PUBLIC_PREFIXES.find((prefix) => upperKey.startsWith(prefix)) ?? null;
+}
+function parseSvelteKitPublicEnvVarPrefix(config) {
+  if (!config.includes("publicPrefix")) {
+    return { status: "ready", prefix: null };
+  }
+  const match = /publicPrefix:\s*(?:'(?<single>[^']*)'|"(?<double>[^"]*)"|`(?<template>[^`$]*)`)/.exec(
+    config
+  );
+  const prefix = match?.groups?.single ?? match?.groups?.double ?? match?.groups?.template;
+  return prefix === void 0 ? { status: "unavailable" } : { status: "ready", prefix };
+}
+async function getLocalSvelteKitPublicPrefixes(cwd, rootDirectory) {
+  const projectRoot = rootDirectory ? join6(cwd, rootDirectory) : cwd;
+  let config;
+  try {
+    config = await readFile3(join6(projectRoot, "svelte.config.js"), "utf8");
+  } catch {
+    return void 0;
+  }
+  const parsed = parseSvelteKitPublicEnvVarPrefix(config);
+  if (parsed.status === "unavailable")
+    return void 0;
+  return [parsed.prefix ?? "PUBLIC_", "VITE_"];
+}
+function removePublicPrefix(key) {
+  const prefix = getPublicPrefix(key);
+  if (!prefix)
+    return key;
+  return key.slice(prefix.length);
+}
+async function validateEnvValue(opts) {
+  let finalValue = opts.initialValue;
+  let alreadyConfirmed = false;
+  if (!opts.skipConfirm) {
+    let valueAccepted = false;
+    while (!valueAccepted) {
+      const valueWarnings = getEnvValueWarnings(finalValue);
+      const warningMessage = formatWarnings(valueWarnings);
+      if (!warningMessage) {
+        valueAccepted = true;
+        break;
+      }
+      opts.showWarning(warningMessage);
+      const canTrim = hasOnlyWhitespaceWarnings(valueWarnings);
+      const choices = canTrim ? [
+        { name: "Leave as is", value: "c" },
+        { name: "Re-enter", value: "r" },
+        { name: "Trim whitespace", value: "t" }
+      ] : [
+        { name: "Leave as is", value: "c" },
+        { name: "Re-enter", value: "r" }
+      ];
+      const action = await opts.selectAction(choices);
+      if (action === "c") {
+        valueAccepted = true;
+        if (valueWarnings.some((w) => w.requiresConfirmation)) {
+          alreadyConfirmed = true;
+        }
+      } else if (action === "t") {
+        finalValue = trimValue(finalValue);
+        opts.showLog("Trimmed whitespace");
+      } else {
+        finalValue = await opts.promptForValue();
+      }
+    }
+  } else {
+    const valueWarnings = getEnvValueWarnings(finalValue);
+    const warningMessage = formatWarnings(valueWarnings);
+    if (warningMessage) {
+      opts.showWarning(warningMessage);
+    }
+  }
+  return { finalValue, alreadyConfirmed };
+}
+function getEnvKeyWarnings(key) {
+  const warnings = [];
+  const matchingPrefix = getPublicPrefix(key);
+  if (matchingPrefix) {
+    const nameWithoutPrefix = key.slice(matchingPrefix.length);
+    const sensitiveMatch = looksLikeSecret(nameWithoutPrefix) && getMatchingServerOnlyKey(nameWithoutPrefix);
+    if (sensitiveMatch) {
+      warnings.push({
+        message: `\`${matchingPrefix}\` exposes \`${key}\` to anyone visiting your site`,
+        requiresConfirmation: true
+      });
+    } else {
+      warnings.push({
+        message: `\`${matchingPrefix}\` exposes this value to anyone visiting your site`,
+        requiresConfirmation: false
+      });
+    }
+  }
+  return warnings;
+}
+
+// src/util/env/env-var-config-secret-ui.ts
+var ENV_VISIBILITY_DEPRECATION_MESSAGE = "`--visibility` is deprecated. Use `--type` instead.";
+function invalidTypeOptionError(optionName, value) {
+  if (value === "config" || value === "secret") {
+    return void 0;
+  }
+  if (value === "sensitive") {
+    return `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` flag.`;
+  }
+  if (value === "plain" || value === "encrypted") {
+    return `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.`;
+  }
+  return `The \`${optionName}\` flag must be either \`config\` or \`secret\`.`;
+}
+function resolveEnvVarTypeOption(options) {
+  const usedDeprecatedVisibility = options.visibility !== void 0;
+  if (options.type !== void 0) {
+    const error = invalidTypeOptionError("--type", options.type);
+    if (error) {
+      return {
+        usedDeprecatedVisibility,
+        error,
+        errorReason: "invalid_type"
+      };
+    }
+  }
+  if (options.visibility !== void 0) {
+    const error = invalidTypeOptionError("--visibility", options.visibility);
+    if (error) {
+      return {
+        usedDeprecatedVisibility,
+        error,
+        errorReason: "invalid_visibility"
+      };
+    }
+  }
+  if (options.type !== void 0 && options.visibility !== void 0 && options.type !== options.visibility) {
+    return {
+      usedDeprecatedVisibility,
+      error: `\`--type ${options.type}\` conflicts with \`--visibility ${options.visibility}\`. \`--visibility\` is a deprecated alias of \`--type\`; remove it.`,
+      errorReason: "conflicting_type_visibility"
+    };
+  }
+  if (options.type !== void 0) {
+    return {
+      explicitVisibility: options.type,
+      source: "type",
+      usedDeprecatedVisibility
+    };
+  }
+  if (options.visibility !== void 0) {
+    return {
+      explicitVisibility: options.visibility,
+      source: "visibility",
+      usedDeprecatedVisibility
+    };
+  }
+  return { usedDeprecatedVisibility };
+}
+function isSecretEnvVar(env) {
+  return env.type === "sensitive" || env.visibility === "secret";
+}
+function formatVisibilityLabel(visibility, type) {
+  const resolved = visibility ?? visibilityFromEnvType(type);
+  if (resolved === "config") {
+    return "Config";
+  }
+  if (resolved === "secret") {
+    return "Secret";
+  }
+  return void 0;
+}
+function visibilityFromEnvType(type) {
+  if (type === "sensitive") {
+    return "secret";
+  }
+  if (type === "plain" || type === "encrypted") {
+    return "config";
+  }
+  return void 0;
+}
+function hasNonDevelopmentTarget(envTargets) {
+  return envTargets.some((target) => target !== "development");
+}
+function getPublicPrefixSecretVisibilityError(key, options) {
+  const publicPrefix = getApiPublicPrefix(key);
+  if (!publicPrefix) {
+    return null;
+  }
+  const wouldBeSecret = options.visibility === "secret" || options.type === "sensitive";
+  if (!wouldBeSecret) {
+    return null;
+  }
+  const privateKey = key.slice(publicPrefix.length);
+  if (options.context === "update") {
+    return `\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, add \`${privateKey}\` as a Secret, then remove \`${key}\`. If the value is safe to expose, keep it as Config.`;
+  }
+  return `\`${publicPrefix}\` exposes this value to anyone visiting your site, so \`${key}\` cannot be a Secret. To keep it private, rename the variable to \`${privateKey}\` and keep the Secret type. If the value is safe to expose, use \`--type config\`.`;
+}
+function shouldOmitInferredVisibility(key, envTargets, teamSensitivePolicyOn) {
+  if (!getApiPublicPrefix(key)) {
+    return false;
+  }
+  if (!hasNonDevelopmentTarget(envTargets)) {
+    return false;
+  }
+  return teamSensitivePolicyOn;
+}
+function resolveEnvVarVisibility(options) {
+  if (options.explicitVisibility !== void 0) {
+    if (options.explicitVisibility !== "config" && options.explicitVisibility !== "secret") {
+      const optionName = options.explicitOptionSource === "visibility" ? "--visibility" : "--type";
+      return {
+        error: options.explicitVisibility === "sensitive" ? `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type secret\` or the legacy \`--sensitive\` flag.` : options.explicitVisibility === "plain" || options.explicitVisibility === "encrypted" ? `The \`${optionName}\` flag accepts \`config\` or \`secret\`. Use \`--type config\` for readable values.` : `The \`${optionName}\` flag must be either \`config\` or \`secret\`.`
+      };
+    }
+    const publicPrefixError2 = getPublicPrefixSecretVisibilityError(
+      options.key,
+      {
+        visibility: options.explicitVisibility,
+        type: options.type,
+        context: options.context
+      }
+    );
+    if (publicPrefixError2) {
+      return { error: publicPrefixError2 };
+    }
+    return { visibility: options.explicitVisibility };
+  }
+  const inferred = visibilityFromEnvType(options.type);
+  if (inferred === void 0) {
+    return {};
+  }
+  if (shouldOmitInferredVisibility(
+    options.key,
+    options.envTargets,
+    options.teamSensitivePolicyOn
+  )) {
+    return {};
+  }
+  const publicPrefixError = getPublicPrefixSecretVisibilityError(options.key, {
+    visibility: inferred,
+    type: options.type,
+    context: options.context
+  });
+  if (publicPrefixError) {
+    return { error: publicPrefixError };
+  }
+  return { visibility: inferred };
+}
+
+// src/util/env/secret-read-guidance.ts
+function getUnavailableSecretValuesMessage(environment, count) {
+  const values = count === 1 ? "value" : "values";
+  if (environment === "development") {
+    return `${count} Development Secret ${values} ${count === 1 ? "was" : "were"} not returned by Vercel.`;
+  }
+  return `${count} Secret ${values} cannot be pulled from the \`${environment}\` Environment.`;
+}
+function getLocalSecretFallbackMessage(count) {
+  return ` Define ${count === 1 ? "it" : "them"} in a local .env file.`;
+}
 
 // src/util/env/update-oidc-token-contents.ts
 var CONTENTS_HEADER = "# Created by Vercel CLI";
@@ -56865,7 +57478,7 @@ var import_error_utils3 = __toESM(require_dist(), 1);
 // src/util/link/setup-and-link.ts
 var import_fs_extra7 = __toESM(require_lib(), 1);
 var import_fs_detectors5 = __toESM(require_dist2(), 1);
-import { join as join10, basename as basename3 } from "path";
+import { join as join11, basename as basename3 } from "path";
 import { getPlatformEnv as getPlatformEnv2 } from "@vercel/build-utils";
 
 // src/util/input/input-project.ts
@@ -57286,7 +57899,7 @@ async function inputRootDirectory(client, cwd, autoConfirm = false) {
 
 // src/util/input/edit-project-settings.ts
 var import_chalk15 = __toESM(require_source(), 1);
-var import_frameworks2 = __toESM(require_frameworks(), 1);
+var import_frameworks3 = __toESM(require_frameworks(), 1);
 
 // src/util/is-setting-value.ts
 function isSettingValue(setting) {
@@ -57336,7 +57949,7 @@ async function editProjectSettings(client, projectSettings, framework, autoConfi
       }
     }
     if (localConfigurationOverrides.framework) {
-      const overrideFramework = import_frameworks2.frameworkList.find(
+      const overrideFramework = import_frameworks3.frameworkList.find(
         (f) => f.slug === localConfigurationOverrides.framework
       );
       if (overrideFramework) {
@@ -57495,7 +58108,7 @@ async function readConfig(dir) {
 }
 
 // src/util/link/setup-and-link.ts
-var import_frameworks4 = __toESM(require_frameworks(), 1);
+var import_frameworks5 = __toESM(require_frameworks(), 1);
 
 // src/util/input/vercel-auth.ts
 var import_chalk16 = __toESM(require_source(), 1);
@@ -57537,10 +58150,10 @@ import {
   isExperimentalServiceV2 as isExperimentalServiceV23,
   normalizePath as normalizePath4
 } from "@vercel/build-utils";
-import { join as join8, relative as relative2 } from "path";
+import { join as join9, relative as relative2 } from "path";
 
 // src/util/input/display-services.ts
-var import_frameworks3 = __toESM(require_frameworks(), 1);
+var import_frameworks4 = __toESM(require_frameworks(), 1);
 import {
   getServiceQueueTopics,
   isExperimentalServiceV2 as isExperimentalServiceV22,
@@ -57549,7 +58162,7 @@ import {
   isWorkflowTriggeredService
 } from "@vercel/build-utils";
 var chalk17 = require_source();
-var frameworksBySlug = new Map(import_frameworks3.frameworkList.map((f) => [f.slug, f]));
+var frameworksBySlug = new Map(import_frameworks4.frameworkList.map((f) => [f.slug, f]));
 var frameworkColors = {
   // JavaScript/TypeScript frameworks
   nextjs: chalk17.white,
@@ -57689,8 +58302,8 @@ function displayServiceErrors(errors) {
 // src/util/projects/detect-services.ts
 var import_fs_detectors3 = __toESM(require_dist2(), 1);
 var import_service_topology = __toESM(require_dist6(), 1);
-import { readFile as readFile3, writeFile as writeFile2 } from "fs/promises";
-import { basename as basename2, join as join7 } from "path";
+import { readFile as readFile4, writeFile as writeFile2 } from "fs/promises";
+import { basename as basename2, join as join8 } from "path";
 import { parse as tomlParse, stringify as tomlStringify } from "smol-toml";
 
 // src/util/validate-config.ts
@@ -58408,7 +59021,7 @@ function validateConfig(config) {
 }
 
 // src/util/projects/detect-entrypoint.ts
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import {
   isPythonFramework,
   isNodeBackendFramework,
@@ -58416,7 +59029,7 @@ import {
 } from "@vercel/build-utils";
 function createDetectEntrypoint(projectRoot) {
   return async ({ workPath, framework }) => {
-    const absWorkPath = normalizePath3(join6(projectRoot, workPath));
+    const absWorkPath = normalizePath3(join7(projectRoot, workPath));
     let builderName;
     if (isPythonFramework(framework)) {
       builderName = "@vercel/python";
@@ -58446,7 +59059,7 @@ function createDetectEntrypoint(projectRoot) {
   };
 }
 async function loadBuilderDetectEntrypoint(name, projectRoot) {
-  const { importBuilders } = await import("./import-builders-DVG3HOTF.js");
+  const { importBuilders } = await import("./import-builders-W3YE2V6A.js");
   const builders = await importBuilders(/* @__PURE__ */ new Set([name]), projectRoot);
   const loaded = builders.get(name);
   if (!loaded) {
@@ -58525,9 +59138,9 @@ function toProjectServicesConfigPatch(config) {
 }
 async function prepareServicesConfigWrite(cwd, config) {
   const compileResult = await compileVercelConfig(cwd);
-  const configPath = join7(cwd, "vercel.json");
+  const configPath = join8(cwd, "vercel.json");
   if (compileResult.sourceFile === "vercel.toml") {
-    return prepareTomlServicesConfigWrite(join7(cwd, "vercel.toml"), config);
+    return prepareTomlServicesConfigWrite(join8(cwd, "vercel.toml"), config);
   }
   if (compileResult.wasCompiled) {
     throw new Error(
@@ -58568,7 +59181,7 @@ async function prepareTomlServicesConfigWrite(configPath, config) {
   const patchKeys = Object.keys(patch);
   let existingContent;
   try {
-    existingContent = await readFile3(configPath, "utf8");
+    existingContent = await readFile4(configPath, "utf8");
   } catch {
     existingContent = "";
   }
@@ -58706,7 +59319,7 @@ async function promptForInferredServicesSetup({
         const serviceRoot = isExperimentalServiceV23(service) ? service.root : service.workspace;
         choice = {
           type: "single-app",
-          selectedPath: serviceRoot === "." ? workPath : join8(workPath, serviceRoot)
+          selectedPath: serviceRoot === "." ? workPath : join9(workPath, serviceRoot)
         };
       }
     }
@@ -58725,7 +59338,7 @@ async function promptForInferredServicesSetup({
 
 // src/util/projects/search-project-across-teams.ts
 var import_slugify3 = __toESM(require_slugify(), 1);
-import { join as join9, relative as relative3 } from "path";
+import { join as join10, relative as relative3 } from "path";
 async function searchProjectsByRepoRoot({
   client,
   cwd,
@@ -58738,7 +59351,7 @@ async function searchProjectsByRepoRoot({
   if (!rootPath) {
     return empty;
   }
-  const gitConfigPath = getGitConfigPath({ cwd: rootPath }) ?? join9(rootPath, ".git/config");
+  const gitConfigPath = getGitConfigPath({ cwd: rootPath }) ?? join10(rootPath, ".git/config");
   const remoteUrls = await getRemoteUrls(gitConfigPath);
   const remoteNames = remoteUrls ? Object.keys(remoteUrls).sort() : [];
   let remote;
@@ -58996,8 +59609,8 @@ async function setupAndLink(client, path3, {
   }
   if (forceDelete) {
     const vercelDir = getVercelDirectory(path3);
-    (0, import_fs_extra7.remove)(join10(vercelDir, VERCEL_DIR_README));
-    (0, import_fs_extra7.remove)(join10(vercelDir, VERCEL_DIR_PROJECT));
+    (0, import_fs_extra7.remove)(join11(vercelDir, VERCEL_DIR_README));
+    (0, import_fs_extra7.remove)(join11(vercelDir, VERCEL_DIR_PROJECT));
   }
   output_manager_default.print("\n");
   printAlignedLabel("Directory", humanizePath(path3));
@@ -59167,7 +59780,7 @@ async function setupAndLink(client, path3, {
         });
         if (shouldPromptRoot) {
           rootDirectory = await inputRootDirectory(client, path3, autoConfirm);
-          if (rootDirectory && !await validateRootDirectory(path3, join10(path3, rootDirectory))) {
+          if (rootDirectory && !await validateRootDirectory(path3, join11(path3, rootDirectory))) {
             return {
               status: "error",
               exitCode: 1,
@@ -59176,7 +59789,7 @@ async function setupAndLink(client, path3, {
           }
         }
       }
-      pathWithRootDirectory = rootDirectory ? join10(path3, rootDirectory) : path3;
+      pathWithRootDirectory = rootDirectory ? join11(path3, rootDirectory) : path3;
       const selectedRootServicesSetup = pathWithRootDirectory === path3 ? null : await getServicesSetupState(pathWithRootDirectory);
       let selectedRootInferredServicesChoice = null;
       if (!skipSelectedRootInferredServicesPrompt) {
@@ -59203,7 +59816,7 @@ async function setupAndLink(client, path3, {
             path3,
             selectedRootInferredServicesChoice.selectedPath
           );
-          pathWithRootDirectory = rootDirectory ? join10(path3, rootDirectory) : path3;
+          pathWithRootDirectory = rootDirectory ? join11(path3, rootDirectory) : path3;
         }
         const localConfig = await readConfig(pathWithRootDirectory);
         if (localConfig instanceof CantParseJSONFile) {
@@ -59224,7 +59837,7 @@ async function setupAndLink(client, path3, {
             pathWithRootDirectory
           );
           const detectedProjects = detectedProjectsForWorkspace.get("") || [];
-          const framework = detectedProjects[0] ?? import_frameworks4.frameworkList.find((f) => f.slug === null);
+          const framework = detectedProjects[0] ?? import_frameworks5.frameworkList.find((f) => f.slug === null);
           settings = await editProjectSettings(
             client,
             {},
@@ -59274,7 +59887,12 @@ async function setupAndLink(client, path3, {
       autoConfirm,
       org
     );
-    return { status: "linked", org, project };
+    return {
+      status: "linked",
+      org,
+      project,
+      ...gitConnectIntent?.offered && { gitConnectOffered: true }
+    };
   } catch (err) {
     if (isPromptCanceledError(err)) {
       throw err;
@@ -59292,7 +59910,8 @@ async function setupAndLink(client, path3, {
 }
 async function resolveGitConnectIntent(client, path3, autoConfirm) {
   try {
-    const gitConfig = await parseGitConfig(join10(path3, ".git/config"));
+    const gitConfigPath = getGitConfigPath({ cwd: path3 }) ?? join11(path3, ".git/config");
+    const gitConfig = await parseGitConfig(gitConfigPath);
     if (!gitConfig) {
       return null;
     }
@@ -59301,15 +59920,18 @@ async function resolveGitConnectIntent(client, path3, autoConfirm) {
       return null;
     }
     const skipPrompts = autoConfirm || client.nonInteractive;
-    const shouldConnect = skipPrompts || await client.input.confirm(`Connect detected Git repository?`, false);
+    const shouldConnect = skipPrompts || await client.input.confirm(
+      `Connect this Git repository to automatically deploy changes on every push?`,
+      false
+    );
     if (!shouldConnect) {
-      return null;
+      return { offered: true };
     }
     const repoInfo = skipPrompts ? parseRepoUrl(remoteUrls.origin ?? Object.values(remoteUrls)[0]) : await selectAndParseRemoteUrl(client, remoteUrls);
     if (!repoInfo) {
       return null;
     }
-    return { repoInfo };
+    return { repoInfo, offered: !skipPrompts };
   } catch (error) {
     if (isPromptCanceledError(error)) {
       throw error;
@@ -59319,7 +59941,7 @@ async function resolveGitConnectIntent(client, path3, autoConfirm) {
   }
 }
 async function applyGitConnectIntent(client, intent, project, autoConfirm, org) {
-  if (!intent) {
+  if (!intent?.repoInfo) {
     return;
   }
   const { repoInfo } = intent;
@@ -59348,7 +59970,7 @@ async function applyGitConnectIntent(client, intent, project, autoConfirm, org)
 var import_chalk17 = __toESM(require_source(), 1);
 var import_fs_extra8 = __toESM(require_lib(), 1);
 import { stat } from "fs/promises";
-import { join as join11, dirname } from "path";
+import { join as join12, dirname } from "path";
 async function findProjectRoot(startDir) {
   let cwdDev;
   try {
@@ -59365,10 +59987,10 @@ async function findProjectRoot(startDir) {
     } catch {
       return null;
     }
-    const hasVercelDir = await (0, import_fs_extra8.pathExists)(join11(dir, ".vercel"));
-    const hasVercelJson = await (0, import_fs_extra8.pathExists)(join11(dir, "vercel.json"));
-    const hasVercelToml = await (0, import_fs_extra8.pathExists)(join11(dir, "vercel.toml"));
-    const hasGit = await (0, import_fs_extra8.pathExists)(join11(dir, ".git"));
+    const hasVercelDir = await (0, import_fs_extra8.pathExists)(join12(dir, ".vercel"));
+    const hasVercelJson = await (0, import_fs_extra8.pathExists)(join12(dir, "vercel.json"));
+    const hasVercelToml = await (0, import_fs_extra8.pathExists)(join12(dir, "vercel.toml"));
+    const hasGit = await (0, import_fs_extra8.pathExists)(join12(dir, ".git"));
     if (hasVercelDir || hasVercelJson || hasVercelToml || hasGit) {
       return dir;
     }
@@ -59938,6 +60560,10 @@ async function getDeployment(client, contextName, hostOrId) {
 
 // src/commands/env/pull.ts
 var CONTENTS_PREFIX = "# Created by Vercel CLI\n";
+function printEnvPullWarning(message) {
+  output_manager_default.print(`${import_chalk19.default.yellow("!")} ${message}
+`);
+}
 function readHeadSync(path3, length) {
   const buffer = Buffer.alloc(length);
   const fd = openSync(path3, "r");
@@ -59968,7 +60594,7 @@ var VARIABLES_TO_IGNORE = [
   "VERCEL_SPEED_INSIGHTS_ID",
   "VERCEL_WEB_ANALYTICS_ID"
 ];
-var SENSITIVE_PLACEHOLDER = "[SENSITIVE]";
+var SENSITIVE_PLACEHOLDER = SENSITIVE_ENV_VALUE_PLACEHOLDER;
 async function getRedactedSensitiveKeys(client, projectId, source, target, gitBranch, records) {
   const emptyKeys = Object.keys(records).filter((key) => !records[key]);
   if (!projectId || emptyKeys.length === 0) {
@@ -59980,7 +60606,7 @@ async function getRedactedSensitiveKeys(client, projectId, source, target, gitBr
       gitBranch
     });
     const sensitiveKeys = new Set(
-      envs.filter((env) => env.type === "sensitive").map((env) => env.key)
+      envs.filter(isSecretEnvVar).map((env) => env.key)
     );
     return new Set(emptyKeys.filter((key) => sensitiveKeys.has(key)));
   } catch {
@@ -60039,9 +60665,9 @@ async function pull(client, argv, source = "vercel-cli:env:pull", options = {})
         {
           status: "error",
           reason: "not_linked",
-          message: `Your codebase isn't linked to a project on Vercel. Run ${getCommandNamePlain(
+          message: `Your codebase isn't linked to a project on Vercel. Run \`${getCommandNamePlain(
             "link"
-          )} to begin. Use --yes for non-interactive; use --scope or --project to specify team or project.`,
+          )}\` to begin. Use \`--yes\` for non-interactive; use \`--scope\` or \`--project\` to specify team or project.`,
           next: [
             { command: buildCommandWithYes(linkArgv) },
             { command: buildCommandWithYes(client.argv) }
@@ -60160,6 +60786,9 @@ async function envPullCommandLogic(client, filename, skipConfirmation, environme
   let contents;
   let fileChanged = true;
   const keptLocalKeys = [];
+  const preservedLocalSecretKeys = [];
+  let redactedSecretCount = 0;
+  let placeholderSecretCount = 0;
   if (oidcTokenOnly) {
     const existingContents = exists ? await (0, import_fs_extra9.readFile)(fullPath, "utf8") : "";
     contents = updateOidcTokenContents(
@@ -60176,9 +60805,17 @@ async function envPullCommandLogic(client, filename, skipConfirmation, environme
       gitBranch,
       records
     );
+    redactedSecretCount = sensitiveKeys.size;
     const mergedRecords = { ...records };
     for (const key of sensitiveKeys) {
-      mergedRecords[key] = SENSITIVE_PLACEHOLDER;
+      const localValue = oldEnv?.[key];
+      if (localValue && localValue !== SENSITIVE_PLACEHOLDER) {
+        mergedRecords[key] = localValue;
+        preservedLocalSecretKeys.push(key);
+      } else {
+        mergedRecords[key] = SENSITIVE_PLACEHOLDER;
+        placeholderSecretCount++;
+      }
     }
     if (oldEnv) {
       for (const [key, value] of Object.entries(oldEnv)) {
@@ -60211,6 +60848,16 @@ async function envPullCommandLogic(client, filename, skipConfirmation, environme
       )} Environment)`
     );
   }
+  if (redactedSecretCount > 0) {
+    const preservedMessage = preservedLocalSecretKeys.length > 0 ? ` Kept ${preservedLocalSecretKeys.length} existing local ${preservedLocalSecretKeys.length === 1 ? "value" : "values"}.` : "";
+    const placeholderMessage = placeholderSecretCount > 0 ? ` Wrote "${SENSITIVE_PLACEHOLDER}" ${placeholderSecretCount === 1 ? "as a placeholder" : "as placeholders"} for the remaining ${placeholderSecretCount === 1 ? "value" : "values"}; replace ${placeholderSecretCount === 1 ? "it" : "them"} with local-only values.` : "";
+    printEnvPullWarning(
+      `${getUnavailableSecretValuesMessage(
+        environment,
+        redactedSecretCount
+      )}${preservedMessage}${placeholderMessage}`
+    );
+  }
   let isGitIgnoreUpdated = false;
   const fileExistsAfterPull = exists || contents.length > 0;
   if (filename === ".env.local" && fileExistsAfterPull) {
@@ -60237,7 +60884,7 @@ function escapeValue2(value) {
 }
 
 // src/util/projects/link.ts
-var readFile5 = promisify(fs4.readFile);
+var readFile6 = promisify(fs4.readFile);
 var writeFile3 = promisify(fs4.writeFile);
 var VERCEL_DIR = ".vercel";
 var VERCEL_DIR_FALLBACK = ".now";
@@ -60272,7 +60919,7 @@ var linkSchema = {
   }
 };
 function getVercelDirectory(cwd) {
-  const possibleDirs = [join12(cwd, VERCEL_DIR), join12(cwd, VERCEL_DIR_FALLBACK)];
+  const possibleDirs = [join13(cwd, VERCEL_DIR), join13(cwd, VERCEL_DIR_FALLBACK)];
   const existingDirs = possibleDirs.filter((d) => isDirectory(d));
   if (existingDirs.length > 1) {
     throw new NowBuildError2({
@@ -60365,7 +61012,7 @@ async function getProjectLinkFromRepoLink(client, path3, projectName, projectNam
 }
 async function getLinkFromDir(dir) {
   try {
-    const json = await readFile5(join12(dir, VERCEL_DIR_PROJECT), "utf8");
+    const json = await readFile6(join13(dir, VERCEL_DIR_PROJECT), "utf8");
     const ajv = new import_ajv.default();
     const link = JSON.parse(json);
     if (!ajv.validate(linkSchema, link)) {
@@ -60629,7 +61276,7 @@ Upon creation, it will be automatically added to your ".gitignore" file.
 `;
 async function writeReadme(path3) {
   await writeFile3(
-    join12(path3, VERCEL_DIR, VERCEL_DIR_README),
+    join13(path3, VERCEL_DIR, VERCEL_DIR_README),
     VERCEL_DIR_README_CONTENT
   );
 }
@@ -60638,7 +61285,7 @@ async function linkFolderToProject(client, path3, projectLink, projectName, orgS
     return;
   }
   try {
-    await (0, import_fs_extra10.ensureDir)(join12(path3, VERCEL_DIR));
+    await (0, import_fs_extra10.ensureDir)(join13(path3, VERCEL_DIR));
   } catch (err) {
     if ((0, import_error_utils4.isErrnoException)(err) && err.code === "ENOTDIR") {
       return;
@@ -60646,7 +61293,7 @@ async function linkFolderToProject(client, path3, projectLink, projectName, orgS
     throw err;
   }
   await writeFile3(
-    join12(path3, VERCEL_DIR, VERCEL_DIR_PROJECT),
+    join13(path3, VERCEL_DIR, VERCEL_DIR_PROJECT),
     JSON.stringify({
       ...projectLink,
       projectName
@@ -60771,7 +61418,7 @@ async function fileExists(filePath) {
 async function findAllVercelConfigFiles(workPath) {
   const foundFiles = [];
   for (const ext of VERCEL_CONFIG_EXTENSIONS) {
-    const configPath = join13(workPath, `vercel.${ext}`);
+    const configPath = join14(workPath, `vercel.${ext}`);
     if (await fileExists(configPath)) {
       foundFiles.push(configPath);
     }
@@ -60780,12 +61427,12 @@ async function findAllVercelConfigFiles(workPath) {
 }
 async function findSourceVercelConfigFile(workPath) {
   for (const ext of VERCEL_CONFIG_EXTENSIONS) {
-    const configPath = join13(workPath, `vercel.${ext}`);
+    const configPath = join14(workPath, `vercel.${ext}`);
     if (await fileExists(configPath)) {
       return basename4(configPath);
     }
   }
-  const tomlPath = join13(workPath, "vercel.toml");
+  const tomlPath = join14(workPath, "vercel.toml");
   if (await fileExists(tomlPath)) {
     return "vercel.toml";
   }
@@ -60826,15 +61473,15 @@ function parseConfigLoaderError(stderr) {
   return stderr.trim();
 }
 async function compileVercelConfig(workPath) {
-  const vercelJsonPath = join13(workPath, "vercel.json");
-  const nowJsonPath = join13(workPath, "now.json");
-  const vercelTomlPath = join13(workPath, "vercel.toml");
+  const vercelJsonPath = join14(workPath, "vercel.json");
+  const nowJsonPath = join14(workPath, "now.json");
+  const vercelTomlPath = join14(workPath, "vercel.toml");
   const hasVercelJson = await fileExists(vercelJsonPath);
   const hasNowJson = await fileExists(nowJsonPath);
   const hasVercelToml = await fileExists(vercelTomlPath);
   const vercelConfigPath = await findVercelConfigFile(workPath);
-  const vercelDir = join13(workPath, VERCEL_DIR);
-  const compiledConfigPath = join13(vercelDir, "vercel.json");
+  const vercelDir = join14(workPath, VERCEL_DIR);
+  const compiledConfigPath = join14(vercelDir, "vercel.json");
   if (hasNowJson) {
     throw new DeprecatedNowJson(nowJsonPath);
   }
@@ -60873,7 +61520,7 @@ async function compileVercelConfig(workPath) {
   }
   if (hasVercelToml) {
     try {
-      const tomlContent = await readFile6(vercelTomlPath, "utf8");
+      const tomlContent = await readFile7(vercelTomlPath, "utf8");
       const config = tomlParse2(tomlContent);
       const normalizedConfig = normalizeConfig(config);
       await mkdir(vercelDir, { recursive: true });
@@ -60897,10 +61544,10 @@ async function compileVercelConfig(workPath) {
     }
   }
   const sourceConfigPath = vercelConfigPath;
-  (0, import_dotenv.config)({ path: join13(workPath, ".env") });
-  (0, import_dotenv.config)({ path: join13(workPath, ".env.local") });
-  const tempOutPath = join13(vercelDir, "vercel-temp.mjs");
-  const loaderPath = join13(vercelDir, "vercel-loader.mjs");
+  (0, import_dotenv.config)({ path: join14(workPath, ".env") });
+  (0, import_dotenv.config)({ path: join14(workPath, ".env.local") });
+  const tempOutPath = join14(vercelDir, "vercel-temp.mjs");
+  const loaderPath = join14(vercelDir, "vercel-loader.mjs");
   try {
     const { build } = await import("esbuild");
     await mkdir(vercelDir, { recursive: true });
@@ -61004,9 +61651,9 @@ async function compileVercelConfig(workPath) {
   }
 }
 async function getVercelConfigPath(workPath) {
-  const vercelJsonPath = join13(workPath, "vercel.json");
-  const vercelTomlPath = join13(workPath, "vercel.toml");
-  const compiledConfigPath = join13(workPath, VERCEL_DIR, "vercel.json");
+  const vercelJsonPath = join14(workPath, "vercel.json");
+  const vercelTomlPath = join14(workPath, "vercel.toml");
+  const compiledConfigPath = join14(workPath, VERCEL_DIR, "vercel.json");
   if (await fileExists(vercelJsonPath)) {
     return vercelJsonPath;
   }
@@ -61065,6 +61712,7 @@ export {
   require_ajv,
   getProjectByNameOrId,
   require_pluralize,
+  getGitConfigPath,
   createGitMeta,
   parseGitConfig,
   pluckRemoteUrls,
@@ -61092,6 +61740,27 @@ export {
   parseEnv,
   createEnvObject,
   VERCEL_OIDC_TOKEN,
+  SENSITIVE_ENV_VALUE_PLACEHOLDER,
+  looksLikeSecret,
+  looksLikeSecretValue,
+  shouldConfirmRotationBeforeDelete,
+  isFlagsSecretNeedingSplit,
+  normalizeStdinEnvValue,
+  getPublicPrefix,
+  getFrameworkPublicPrefix,
+  getApiPublicPrefix,
+  getLocalSvelteKitPublicPrefixes,
+  removePublicPrefix,
+  validateEnvValue,
+  getEnvKeyWarnings,
+  ENV_VISIBILITY_DEPRECATION_MESSAGE,
+  resolveEnvVarTypeOption,
+  isSecretEnvVar,
+  formatVisibilityLabel,
+  getPublicPrefixSecretVisibilityError,
+  resolveEnvVarVisibility,
+  getUnavailableSecretValuesMessage,
+  getLocalSecretFallbackMessage,
   PromptCanceledError,
   PromptBackError,
   isPromptCanceledError,