void 0.9.3 → 0.10.2

package/dist/{deploy-RQXpVBL-.mjs → deploy-CuxXxVgz.mjs}

@@ -3,12 +3,13 @@ import { a as join, c as resolve, i as isAbsolute, n as dirname, r as extname, s
 import { n as cliTitle, r as createSpinner, s as import_picocolors } from "./output-DeiS4oEX.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths } from "./project-paths-CCMrHYQm.mjs";
 import { t as findVoidAuthConfig } from "./config-hhMYPVRT.mjs";
-import { a as isExpiredTokenError, c as getToken, i as isCliOutdatedError, l as getTokenSource, n as PlatformClient, o as parsePlatformErrorBody, t as PlatformApiError, u as isStagingMode } from "./client-DIfOFf1W.mjs";
+import { t as cfAccessHeaders } from "./cf-access-DKDsgwOU.mjs";
+import { a as isExpiredTokenError, f as getToken, i as isCliOutdatedError, m as isStagingMode, n as PlatformClient, o as parsePlatformErrorBody, p as getTokenSource, t as PlatformApiError, u as getApiUrl, y as ensureCloudflaredToken } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, u as Se, v as ue, x as q, y as ye } from "./dist-abzUneor.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-8dLIngKW.mjs";
-import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes } from "./scan-B2H1Vo2C.mjs";
-import { i as inferProjectBindings, l as validateSsrEntry, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference--7geW5Z2.mjs";
+import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes } from "./scan-DGEp1-1Q.mjs";
+import { i as inferProjectBindings, l as validateSsrEntry, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-C3fLzFvP.mjs";
 import { i as voidWarn, r as voidLog } from "./log-BdD_Fpms.mjs";
 import { t as discoverSchema } from "./discover-C8N1I4tK.mjs";
 import { t as findEnvFile } from "./env-types-CaJaIRXU.mjs";
@@ -19,18 +20,19 @@ import { n as buildMigrationPlanBundle } from "./plan-aD3wRDqF.mjs";
 import { r as validateMigrations, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
 import { t as scanPages } from "./scan-VCAM1oh3.mjs";
 import { n as STAGING_PROXY_URL, t as DEFAULT_PROXY_URL } from "./proxy-M3pxItg2.mjs";
-import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-DCUrFJxa.mjs";
+import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-CruTH_TQ.mjs";
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-D4O1_fZz.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-VkAnACKX.mjs";
-import { t as promptForLoginToken } from "./login-tt1OmNVg.mjs";
-import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-2aBxMfY1.mjs";
+import { t as collectGitDeployMetadata } from "./git-metadata-Ce0AtSZL.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BNWymgnH.mjs";
+import { t as promptForLoginToken } from "./login-v4wle1vn.mjs";
+import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-B7ZQZn0u.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { build, loadEnv } from "vite";
 import { createHash } from "node:crypto";
 import { homedir } from "node:os";
-import { execFile, execFileSync, execSync, spawnSync } from "node:child_process";
+import { execFile, execSync, spawnSync } from "node:child_process";
 import { parse } from "jsonc-parser";
 import { hash } from "blake3-jit";
 import ignore from "ignore";
@@ -1167,84 +1169,127 @@ function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 //#endregion
-//#region src/cli/git-metadata.ts
-function git(root, args) {
-	try {
-		return execFileSync("git", args, {
-			cwd: root,
-			encoding: "utf-8",
-			stdio: [
-				"ignore",
-				"pipe",
-				"ignore"
-			]
-		}).trim();
-	} catch {
-		return null;
-	}
+//#region src/cli/github-oidc.ts
+/**
+* GitHub Actions OIDC → Void deploy-token exchange.
+*
+* When `void deploy` runs inside GitHub Actions with no explicit `VOID_TOKEN`,
+* the CLI mints a short-lived GitHub OIDC token (audience `void`) and exchanges
+* it at `POST $VOID_API_URL/auth/github-oidc` for a short-lived, project-scoped
+* Void deploy token. Doing the exchange in-process lets the scaffolded workflow
+* collapse to a single `void deploy` step — no curl/jq token-exchange step.
+*
+* Server contract (platform `POST /auth/github-oidc` handler):
+*   request  { oidcToken: string, project: string }   (project = slug)
+*   response { token: string, projectId, buildId }
+*/
+const OIDC_AUDIENCE = "void";
+/**
+* True when the process is running inside GitHub Actions with the OIDC token
+* request endpoint available — i.e. the workflow granted
+* `permissions: id-token: write`, so GitHub injected the request URL + token.
+*/
+function isGithubActionsOidcAvailable(env = process.env) {
+	return env.GITHUB_ACTIONS === "true" && typeof env.ACTIONS_ID_TOKEN_REQUEST_URL === "string" && env.ACTIONS_ID_TOKEN_REQUEST_URL.length > 0 && typeof env.ACTIONS_ID_TOKEN_REQUEST_TOKEN === "string" && env.ACTIONS_ID_TOKEN_REQUEST_TOKEN.length > 0;
 }
-function stripGitSuffix(pathname) {
-	return pathname.endsWith(".git") ? pathname.slice(0, -4) : pathname;
+/**
+* Mint a GitHub Actions OIDC token (audience `void`) and exchange it for a
+* short-lived, project-scoped Void deploy token.
+*
+* Two hops:
+*   1. GET  $ACTIONS_ID_TOKEN_REQUEST_URL&audience=void  (Bearer request token)
+*        → `.value` is the OIDC JWT.
+*   2. POST $apiUrl/auth/github-oidc  { oidcToken, project }
+*        → `.token` is the Void deploy token.
+*
+* Throws a clear, actionable error (including the HTTP status and server error
+* body when available) on any non-OK response or missing field.
+*/
+async function exchangeGithubOidcForDeployToken(apiUrl, project, env = process.env) {
+	const requestUrl = env.ACTIONS_ID_TOKEN_REQUEST_URL;
+	const requestToken = env.ACTIONS_ID_TOKEN_REQUEST_TOKEN;
+	if (!requestUrl || !requestToken) throw new Error("github-oidc: GitHub Actions OIDC is unavailable (missing ACTIONS_ID_TOKEN_REQUEST_URL/TOKEN). Ensure the workflow grants `permissions: id-token: write`.");
+	return exchangeOidcTokenAtApi(apiUrl, project, await requestGithubOidcToken(requestUrl, requestToken));
 }
-function normalizeGitRemoteUrl(remote) {
-	if (!remote) return null;
-	const trimmed = remote.trim();
-	if (!trimmed) return null;
-	const scpLike = /^(?:[^@]+@)?([^:]+):(.+)$/.exec(trimmed);
-	if (scpLike && !trimmed.includes("://")) {
-		const host = scpLike[1]?.toLowerCase();
-		const path = stripGitSuffix(scpLike[2] ?? "").replace(/^\/+/, "");
-		return host && path ? `https://${host}/${path}` : null;
+/**
+* GET the GitHub Actions OIDC token for audience `void`. GitHub's request URL
+* already carries a query string, so `audience` is appended alongside it.
+*/
+async function requestGithubOidcToken(requestUrl, requestToken) {
+	const url = new URL(requestUrl);
+	url.searchParams.set("audience", OIDC_AUDIENCE);
+	let res;
+	try {
+		res = await fetch(url, { headers: { Authorization: `Bearer ${requestToken}` } });
+	} catch (err) {
+		throw new Error(`github-oidc: Failed to reach the GitHub OIDC token endpoint: ${errText(err)}`);
 	}
+	if (!res.ok) {
+		const body = await safeText(res);
+		throw new Error(`github-oidc: Failed to mint a GitHub OIDC token (${res.status})${body ? `: ${body}` : ""}.`);
+	}
+	let body;
 	try {
-		const url = new URL(trimmed);
-		if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "ssh:") return null;
-		const host = url.hostname.toLowerCase();
-		const path = stripGitSuffix(url.pathname).replace(/^\/+/, "");
-		return host && path ? `https://${host}/${path}` : null;
+		body = await res.json();
 	} catch {
-		return null;
+		throw new Error("github-oidc: GitHub OIDC token endpoint returned an invalid response.");
 	}
+	const value = body?.value;
+	if (typeof value !== "string" || value.length === 0) throw new Error("github-oidc: GitHub OIDC token endpoint did not return a token value.");
+	return value;
 }
-function buildCommitUrl(repositoryUrl, commit) {
-	if (!repositoryUrl || !commit) return null;
+/** POST the OIDC JWT to the Void API and return the minted deploy token. */
+async function exchangeOidcTokenAtApi(apiUrl, project, oidcToken) {
+	const url = `${apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl}/auth/github-oidc`;
+	ensureCloudflaredToken(apiUrl);
+	let res;
+	try {
+		res = await fetch(url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				...cfAccessHeaders(process.env)
+			},
+			body: JSON.stringify({
+				oidcToken,
+				project
+			})
+		});
+	} catch (err) {
+		throw new Error(`github-oidc: Failed to reach ${url}: ${errText(err)}`);
+	}
+	if (!res.ok) {
+		const body = await safeText(res);
+		throw new Error(`github-oidc: OIDC token exchange failed (${res.status})${body ? `: ${body}` : ""}. Confirm the repository is connected to project "${project}" with the github_actions executor.`);
+	}
+	let body;
 	try {
-		const url = new URL(repositoryUrl);
-		if (url.hostname === "github.com") return `${repositoryUrl}/commit/${commit}`;
-		if (url.hostname === "gitlab.com") return `${repositoryUrl}/-/commit/${commit}`;
-		if (url.hostname === "bitbucket.org") return `${repositoryUrl}/commits/${commit}`;
+		body = await res.json();
 	} catch {
-		return null;
+		throw new Error("github-oidc: OIDC token exchange returned an invalid response.");
 	}
-	return null;
+	const token = body?.token;
+	if (typeof token !== "string" || token.length === 0) throw new Error("github-oidc: OIDC token exchange did not return a deploy token.");
+	return token;
 }
-function getGitRefFromEnv(env) {
-	if (env.GITHUB_HEAD_REF) return env.GITHUB_HEAD_REF;
-	if (env.GITHUB_REF_NAME) return env.GITHUB_REF_NAME;
-	if (env.GITHUB_REF) return env.GITHUB_REF.replace(/^refs\/(?:heads|tags|pull)\//, "");
-	return null;
+/**
+* Emit a GitHub Actions `::add-mask::` workflow command so `value` is redacted
+* from workflow logs. No-op when not running inside GitHub Actions. GitHub reads
+* workflow commands from stdout.
+*/
+function maskGithubActionsSecret(value, env = process.env) {
+	if (env.GITHUB_ACTIONS !== "true" || !value) return;
+	process.stdout.write(`::add-mask::${value}\n`);
 }
-function getGitHubRepositoryUrl(env) {
-	if (!env.GITHUB_REPOSITORY) return null;
-	return normalizeGitRemoteUrl(`${env.GITHUB_SERVER_URL ?? "https://github.com"}/${env.GITHUB_REPOSITORY}`);
-}
-function collectGitDeployMetadata(root, commit, env = process.env) {
-	const repositoryUrl = getGitHubRepositoryUrl(env) ?? normalizeGitRemoteUrl(git(root, [
-		"remote",
-		"get-url",
-		"origin"
-	]));
-	const gitRef = getGitRefFromEnv(env) ?? git(root, [
-		"rev-parse",
-		"--abbrev-ref",
-		"HEAD"
-	]);
-	return {
-		commit,
-		commitUrl: buildCommitUrl(repositoryUrl, commit),
-		gitRef: gitRef && gitRef !== "HEAD" ? gitRef : null,
-		repositoryUrl
-	};
+function errText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+async function safeText(res) {
+	try {
+		return (await res.text()).trim();
+	} catch {
+		return "";
+	}
 }
 //#endregion
 //#region src/cli/log-file.ts
@@ -2292,6 +2337,7 @@ function generateHandlersSource(root, features) {
 //#region src/cli/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({
 	applyDeployEvent: () => applyDeployEvent,
+	buildEnv: () => buildEnv,
 	ensurePreviouslyDeployedLiveBindingConfig: () => ensurePreviouslyDeployedLiveBindingConfig,
 	generateDeployWrapperIfNeeded: () => generateDeployWrapperIfNeeded,
 	hasDeploySchemaDrift: () => hasDeploySchemaDrift,
@@ -2305,7 +2351,9 @@ var deploy_exports = /* @__PURE__ */ __exportAll({
 	resolveWorkerDirName: () => resolveWorkerDirName,
 	runDeploy: () => runDeploy,
 	runStaticDeploy: () => runStaticDeploy,
-	warnRedundantForceOn3xx: () => warnRedundantForceOn3xx
+	streamDeployEvents: () => streamDeployEvents,
+	warnRedundantForceOn3xx: () => warnRedundantForceOn3xx,
+	warnUnpublishedRouting: () => warnUnpublishedRouting
 });
 const drizzleKitBin = join(fileURLToPath(import.meta.resolve("drizzle-kit")), "..", "bin.cjs");
 const deployDriftCheckDir = join(".void", "deploy-drift-check");
@@ -2423,10 +2471,47 @@ async function runDeploy(root, options) {
 		await cliLog.close().catch(() => {});
 	}
 }
+/**
+* Build a child-process environment with the CF Access service-token PAIR
+* removed.
+*
+* The deploy flow spawns UNTRUSTED user build code (`vite build`, framework
+* preset builds, drizzle-kit loading the user schema) which inherits the
+* spawn env. A shared, long-lived CF Access service token is needed only by
+* this CLI's own API client (which captures the Access headers once at
+* construction and reuses them for every request) — never by the build — so it
+* must not survive into those children, or it would leak to arbitrary repo
+* build scripts/plugins.
+*
+* We scrub it on the CHILD env rather than mutating `process.env`: deleting it
+* from the parent also breaks interactive expired-token re-auth, which reads
+* `cfAccessHeaders(process.env)` / the cloudflared pair-guard AFTER the build
+* step. Only the service-token pair is scrubbed; the cloudflared
+* `CF_ACCESS_TOKEN` JWT (dev path) is left untouched.
+*/
+function buildEnv(extra) {
+	const env = {
+		...process.env,
+		...extra
+	};
+	delete env.CF_ACCESS_CLIENT_ID;
+	delete env.CF_ACCESS_CLIENT_SECRET;
+	return env;
+}
 async function runDeployInner(root, options, cliLog) {
 	let reauthenticated = false;
 	while (true) try {
-		const token = getToken(root);
+		let token = process.env.VOID_TOKEN ?? null;
+		if (!token && isGithubActionsOidcAvailable()) {
+			const slug = getRequestedProjectSlug(options) ?? readProjectConfig(root)?.slug;
+			if (!slug) throw new Error("deploy: running in GitHub Actions but the project is unknown — pass --project <slug> or link the project.");
+			cliLog.info("github_oidc_exchange_start", { slug });
+			token = await exchangeGithubOidcForDeployToken(getApiUrl(root), slug);
+			maskGithubActionsSecret(token);
+			process.env.VOID_TOKEN = token;
+			cliLog.info("github_oidc_exchange_success", { slug });
+		}
+		token ??= getToken(root);
 		if (!token) {
 			R.error("No auth token found. Run `void auth login` first.");
 			process.exit(1);
@@ -2598,7 +2683,8 @@ function applyDeployEvent(event, s) {
 			s.message(`Prerendering ${event.pages} pages...`);
 			return { kind: "continue" };
 		case "done":
-			s.stop("Deployed!");
+			if (event.published === false) s.stop("Deployed, but routing was not published — the project may be unreachable or still serving the previous deploy. Re-run `void deploy` to publish routing.");
+			else s.stop("Deployed!");
 			return {
 				kind: "done",
 				event
@@ -2639,12 +2725,14 @@ async function streamDeployEvents(projectId, events, s, cliLog) {
 				deploymentId = result.deploymentId;
 				cliLog?.info("stream_deployment_id", { deploymentId });
 			} else if (result.kind === "done") {
-				cliLog?.info("deploy_success", {
+				const degraded = result.event.published === false;
+				cliLog?.info(degraded ? "deploy_degraded" : "deploy_success", {
 					deploymentId,
 					url: result.event.url,
 					assets: result.event.assets,
 					workers: result.event.workers,
-					durationMs: Date.now() - startedAt
+					durationMs: Date.now() - startedAt,
+					degraded
 				});
 				return result.event;
 			} else if (result.kind === "error") {
@@ -2784,7 +2872,8 @@ async function runStaticDeploy(root, config, client, preset, skipBuild, gitMetad
 		const buildStartedAt = Date.now();
 		execSync(preset.buildCommand, {
 			cwd: root,
-			stdio: "inherit"
+			stdio: "inherit",
+			env: buildEnv()
 		});
 		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 	} else if (skipBuild) cliLog?.info("build_skipped", { reason: "skipBuild" });
@@ -2836,9 +2925,21 @@ async function runStaticDeploy(root, config, client, preset, skipBuild, gitMetad
 	});
 	const result = await streamDirectR2Deploy(client, config.projectId, manifest, assetManifest, assetFiles, needed, gitMetadata, neededSet !== null, void 0, s, cliLog);
 	Se([`${typeLabel} — ${formatKnownAssetSummary(result, skipped)}`].join("\n"), result.url);
+	warnUnpublishedRouting(result);
 	ye("Done!");
 }
 /**
+* Surface a persistent warning when a deploy committed live but its routing
+* KV was not published. Uses `log.warn` (not the spinner) so the warning
+* survives the following `note`/`outro` calls and the user sees it after the
+* deploy summary. The deploy is still committed — this is a warning, not a
+* failure, so the process exit code is unaffected.
+*/
+function warnUnpublishedRouting(result) {
+	if (result.published !== false) return;
+	R.warn("Routing was not published for this deploy. The project may be unreachable (first deploy) or still serving the previous deploy. Re-run `void deploy` to publish routing.");
+}
+/**
 * Emit a single aggregated lint warning when a `_redirects` file contains
 * one or more `!` force suffixes on 3xx entries (e.g. `301!`, `302!`).
 * The `!` is a no-op on redirects — we parse them as if the `!` weren't
@@ -2866,7 +2967,8 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		const buildStartedAt = Date.now();
 		execSync(voidConfig.inference?.build ?? resolveProjectCommand(root, fwPreset.buildCommand), {
 			cwd: root,
-			stdio: "inherit"
+			stdio: "inherit",
+			env: buildEnv()
 		});
 		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 	} else cliLog?.info("build_skipped", { reason: "skipBuild" });
@@ -3043,6 +3145,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	summary.push(`Framework: ${detected.name}`);
 	Se(summary.join("\n"), result.url);
 	cleanupWrapper(root);
+	warnUnpublishedRouting(result);
 	ye("Done!");
 }
 async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetadata, detected, cliLog) {
@@ -3059,10 +3162,7 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 			execSync(resolveProjectCommand(root, "vite build"), {
 				cwd: root,
 				stdio: "inherit",
-				env: {
-					...process.env,
-					VOID_DEPLOY_PROJECT_ID: config.projectId
-				}
+				env: buildEnv({ VOID_DEPLOY_PROJECT_ID: config.projectId })
 			});
 			cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 		} catch (err) {
@@ -3343,6 +3443,7 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 	else summary.push(`ISR revalidate: ${Object.keys(revalidate).length} path rule(s)`);
 	if (isFrameworkMode) summary.push("Framework mode");
 	Se(summary.join("\n"), result.url);
+	warnUnpublishedRouting(result);
 	ye("Done!");
 }
 async function createProjectFromSlug(root, client, slug, cliLog) {
@@ -3365,17 +3466,21 @@ function getGitCommit(root) {
 	try {
 		const githubSha = process.env.GITHUB_SHA?.trim();
 		if (githubSha && /^[0-9a-f]{7,64}$/i.test(githubSha)) return githubSha;
+		const gitEnv = buildEnv();
 		execSync("git rev-parse --is-inside-work-tree", {
 			cwd: root,
-			stdio: "ignore"
+			stdio: "ignore",
+			env: gitEnv
 		});
 		if (execSync("git status --porcelain", {
 			cwd: root,
-			encoding: "utf-8"
+			encoding: "utf-8",
+			env: gitEnv
 		}).trim() !== "") return null;
 		return execSync("git rev-parse HEAD", {
 			cwd: root,
-			encoding: "utf-8"
+			encoding: "utf-8",
+			env: gitEnv
 		}).trim();
 	} catch {
 		return null;
@@ -3421,7 +3526,8 @@ function runDrizzleKitGenerate(root, configPath) {
 		configPath
 	], {
 		cwd: root,
-		encoding: "utf-8"
+		encoding: "utf-8",
+		env: buildEnv()
 	});
 	const stderr = bufferToString(result.stderr);
 	const output = [stderr, bufferToString(result.stdout)].filter(Boolean).join("\n").trim();

package/dist/{domain-B7RntQ1r.mjs → domain-Bq6kzr_T.mjs}

@@ -1,5 +1,5 @@
 import { s as import_picocolors } from "./output-DeiS4oEX.mjs";
-import { c as getToken, n as PlatformClient } from "./client-DIfOFf1W.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, u as Se } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 //#region src/cli/domain.ts

package/dist/{env-C_ZcxxED.mjs → env-BD3U_0Av.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./pathe.M-eThtNZ-BrPhGF_K.mjs";
 import { n as cliTitle } from "./output-DeiS4oEX.mjs";
-import { c as getToken, n as PlatformClient } from "./client-DIfOFf1W.mjs";
+import { f as getToken, n as PlatformClient } from "./client-CTHvucDv.mjs";
 import { c as R, g as ge, u as Se, y as ye } from "./dist-abzUneor.mjs";
 import { r as readProjectConfig } from "./project-CH9pdo16.mjs";
 import { r as generateEnvTypes, t as findEnvFile } from "./env-types-CaJaIRXU.mjs";

package/dist/{env-helpers-Bd2wVdxz.d.mts → env-helpers-ZatKyjen.d.mts}

@@ -1,4 +1,4 @@
-import { t as StandardSchemaV1 } from "./standard-schema-Dnsh2vnl.mjs";
+import { t as StandardSchemaV1 } from "./standard-schema-BCBv-QaP.mjs";
 
 //#region src/shared/env-mask.d.ts
 /** Per-key override set by `.secret()` / `.public()` on built-in helpers. */

package/dist/{gen-O5mXZ76K.mjs → gen-Dgi4D7GC.mjs}

@@ -7,7 +7,7 @@ import { c as getDatabaseDialect, f as readConfig } from "./config-8dLIngKW.mjs"
 import { n as writeDrizzleConfig } from "./config--wXmVOoe.mjs";
 import { r as readJournal, t as collectMigrations } from "./collect-9rO3JFNM.mjs";
 import { n as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-CNWm-PsL.mjs";
-import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-0SwYgQxx.mjs";
+import { t as buildDrizzleKitSpawnEnv } from "./yarn-pnp-DhCHHLAz.mjs";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { spawnSync } from "node:child_process";

package/dist/git-metadata-Ce0AtSZL.mjs

@@ -0,0 +1,82 @@
+import { execFileSync } from "node:child_process";
+//#region src/cli/git-metadata.ts
+function git(root, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: root,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+function stripGitSuffix(pathname) {
+	return pathname.endsWith(".git") ? pathname.slice(0, -4) : pathname;
+}
+function normalizeGitRemoteUrl(remote) {
+	if (!remote) return null;
+	const trimmed = remote.trim();
+	if (!trimmed) return null;
+	const scpLike = /^(?:[^@]+@)?([^:]+):(.+)$/.exec(trimmed);
+	if (scpLike && !trimmed.includes("://")) {
+		const host = scpLike[1]?.toLowerCase();
+		const path = stripGitSuffix(scpLike[2] ?? "").replace(/^\/+/, "");
+		return host && path ? `https://${host}/${path}` : null;
+	}
+	try {
+		const url = new URL(trimmed);
+		if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "ssh:") return null;
+		const host = url.hostname.toLowerCase();
+		const path = stripGitSuffix(url.pathname).replace(/^\/+/, "");
+		return host && path ? `https://${host}/${path}` : null;
+	} catch {
+		return null;
+	}
+}
+function buildCommitUrl(repositoryUrl, commit) {
+	if (!repositoryUrl || !commit) return null;
+	try {
+		const url = new URL(repositoryUrl);
+		if (url.hostname === "github.com") return `${repositoryUrl}/commit/${commit}`;
+		if (url.hostname === "gitlab.com") return `${repositoryUrl}/-/commit/${commit}`;
+		if (url.hostname === "bitbucket.org") return `${repositoryUrl}/commits/${commit}`;
+	} catch {
+		return null;
+	}
+	return null;
+}
+function getGitRefFromEnv(env) {
+	if (env.GITHUB_HEAD_REF) return env.GITHUB_HEAD_REF;
+	if (env.GITHUB_REF_NAME) return env.GITHUB_REF_NAME;
+	if (env.GITHUB_REF) return env.GITHUB_REF.replace(/^refs\/(?:heads|tags|pull)\//, "");
+	return null;
+}
+function getGitHubRepositoryUrl(env) {
+	if (!env.GITHUB_REPOSITORY) return null;
+	return normalizeGitRemoteUrl(`${env.GITHUB_SERVER_URL ?? "https://github.com"}/${env.GITHUB_REPOSITORY}`);
+}
+function collectGitDeployMetadata(root, commit, env = process.env) {
+	const repositoryUrl = getGitHubRepositoryUrl(env) ?? normalizeGitRemoteUrl(git(root, [
+		"remote",
+		"get-url",
+		"origin"
+	]));
+	const gitRef = getGitRefFromEnv(env) ?? git(root, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return {
+		commit,
+		commitUrl: buildCommitUrl(repositoryUrl, commit),
+		gitRef: gitRef && gitRef !== "HEAD" ? gitRef : null,
+		repositoryUrl
+	};
+}
+//#endregion
+export { collectGitDeployMetadata as t };