@notionx/create-notionx-app 1.0.0

package/dist/provision/ntn-credentials.js

@@ -0,0 +1,198 @@
+// packages/create-notionx-app/src/provision/ntn-credentials.ts
+//
+// Resolve a Notion API token from the `ntn` CLI's local credentials,
+// so the scaffolder can skip the "paste your token" step for users
+// who have already done `ntn login`.
+//
+// Where `ntn` stores its token:
+//
+//   - macOS:      Keychain (service "notion-cli"). We read it with
+//                 `security find-generic-password -s notion-cli -w`.
+//                 The user may be prompted by macOS to allow the
+//                 first read in a session, but subsequent reads are
+//                 silent.
+//   - Linux:      GNOME Keyring / KWallet via `secret-tool`. The
+//                 attribute pair is `service notion-cli`. We try
+//                 `secret-tool` first and fall back to
+//                 `~/.config/notion/auth.json`.
+//   - Windows:    Credential Manager (`cmdkey /list`). We do not
+//                 implement Windows keychain reads here — the
+//                 file-based fallback applies when the user has set
+//                 `NOTION_KEYRING=0`.
+//   - File mode:  When the user has exported `NOTION_KEYRING=0`
+//                 before running `ntn login`, ntn writes a JSON file
+//                 to `~/.config/notion/auth.json` containing the
+//                 active workspace's token. We read that.
+//
+// All three return paths are best-effort: if the local credential
+// store does not contain a Notion token (or we cannot read it), the
+// caller falls back to the manual `secret_…` paste prompt.
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir, platform } from "node:os";
+import { run, runNtn } from "./shell.js";
+const KEYCHAIN_SERVICE = "notion-cli";
+/**
+ * Try every well-known location in turn. Returns the first token that
+ * verifies as a live Notion API token, or `null` if nothing usable
+ * was found.
+ */
+export async function readNtnToken() {
+    // 0. Honor an explicit env override first. (This is the path
+    // `ntn` itself uses internally.)
+    if (process.env.NOTION_API_TOKEN && process.env.NOTION_API_TOKEN.length > 0) {
+        return { token: process.env.NOTION_API_TOKEN, source: "ntn-env" };
+    }
+    // 1. Try the platform-native credential store.
+    const native = await readFromNativeStore();
+    if (native)
+        return native;
+    // 2. Fall back to the file-based store ntn uses when the user has
+    //    disabled the keyring via `NOTION_KEYRING=0`.
+    const fileBased = await readFromAuthJson();
+    if (fileBased)
+        return fileBased;
+    return null;
+}
+async function readFromNativeStore() {
+    const p = platform();
+    if (p === "darwin") {
+        return readFromMacosKeychain();
+    }
+    if (p === "linux") {
+        return readFromLinuxKeyring();
+    }
+    // Windows: skip native store — not implemented.
+    return null;
+}
+async function readFromMacosKeychain() {
+    const r = await run("security", [
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-w",
+    ]);
+    if (r.code !== 0)
+        return null;
+    const token = r.stdout.trim();
+    if (!token)
+        return null;
+    // `ntn` stores its token in the account field as a UUID-like value,
+    // not in the password field. Some installations put it in the
+    // password — cover both.
+    if (looksLikeNotionToken(token)) {
+        return { token, source: "ntn-macos-keychain" };
+    }
+    const accountR = await run("security", [
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-g",
+    ]);
+    const accountMatch = accountR.stdout.match(/"acct"<blob>="([^"]+)"/);
+    const account = accountMatch?.[1]?.trim();
+    if (account && looksLikeNotionToken(account)) {
+        return { token: account, source: "ntn-macos-keychain" };
+    }
+    return null;
+}
+async function readFromLinuxKeyring() {
+    // `secret-tool` is the standard D-Bus Secret Service client on
+    // GNOME. It prompts the user the first time per session.
+    const r = await run("secret-tool", [
+        "lookup",
+        "service",
+        KEYCHAIN_SERVICE,
+    ]);
+    if (r.code !== 0 || !r.stdout.trim())
+        return null;
+    const token = r.stdout.trim();
+    if (!looksLikeNotionToken(token))
+        return null;
+    return { token, source: "ntn-linux-keyring" };
+}
+async function readFromAuthJson() {
+    const file = join(homedir(), ".config", "notion", "auth.json");
+    if (!existsSync(file))
+        return null;
+    let raw;
+    try {
+        raw = await readFile(file, "utf8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    // Flat schema: `{ "token": "ntn_…" }`
+    if (parsed.token && looksLikeNotionToken(parsed.token)) {
+        return { token: parsed.token, source: "ntn-auth-json" };
+    }
+    // Nested schema: `{ workspaces: { prod: { <id>: { token, name } } } }`
+    if (parsed.workspaces) {
+        for (const [envKey, wsMap] of Object.entries(parsed.workspaces)) {
+            if (!wsMap)
+                continue;
+            // Prefer the default workspace id, fall back to the first
+            // entry that has a token.
+            const preferredId = parsed.defaultWorkspaceIds?.[envKey] ??
+                parsed.defaultWorkspaceId ??
+                Object.keys(wsMap)[0];
+            const ordered = [
+                wsMap[preferredId],
+                ...Object.entries(wsMap)
+                    .filter(([id]) => id !== preferredId)
+                    .map(([, v]) => v),
+            ];
+            for (const entry of ordered) {
+                if (entry?.token && looksLikeNotionToken(entry.token)) {
+                    return {
+                        token: entry.token,
+                        source: "ntn-auth-json",
+                        workspace: entry.name,
+                    };
+                }
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Best-effort: ask the `ntn` CLI to confirm that *some* credentials
+ * are present. We use this to give a clear "Run `ntn login` first"
+ * hint when we fail to read the token directly.
+ */
+export async function isNtnLoggedIn() {
+    // `ntn whoami` is read-only but still calls libuv's
+    // `uv_tty_init` on startup, so we keep the PTY-aware wrapper for
+    // it to actually exit 0 on hosts where the libuv TTY dance is
+    // strict.
+    const r = await runNtn(["whoami"]);
+    return r.code === 0;
+}
+function looksLikeNotionToken(s) {
+    // Notion integration tokens start with "secret_", "ntn_", or
+    // (for OAuth public integrations) a UUID-like bearer. The CLI
+    // stores its own OAuth token, so ntn_… is the common shape.
+    return /^(secret_[A-Za-z0-9]{20,}|ntn_[A-Za-z0-9]{20,}|[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,})$/.test(s);
+}
+/** Human-friendly source label for the status card. */
+export function describeNtnSource(source) {
+    switch (source) {
+        case "ntn-macos-keychain":
+            return "macOS Keychain (service=notion-cli)";
+        case "ntn-linux-keyring":
+            return "Linux Secret Service (service=notion-cli)";
+        case "ntn-auth-json":
+            return "~/.config/notion/auth.json";
+        case "ntn-env":
+            return "NOTION_API_TOKEN env var";
+    }
+}
+//# sourceMappingURL=ntn-credentials.js.map

package/dist/provision/ntn-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ntn-credentials.js","sourceRoot":"","sources":["../../src/provision/ntn-credentials.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,qCAAqC;AACrC,EAAE;AACF,gCAAgC;AAChC,EAAE;AACF,mEAAmE;AACnE,qEAAqE;AACrE,iEAAiE;AACjE,oEAAoE;AACpE,0BAA0B;AAC1B,iEAAiE;AACjE,iEAAiE;AACjE,uDAAuD;AACvD,gDAAgD;AAChD,iEAAiE;AACjE,8DAA8D;AAC9D,oEAAoE;AACpE,sCAAsC;AACtC,gEAAgE;AAChE,qEAAqE;AACrE,iEAAiE;AACjE,0DAA0D;AAC1D,EAAE;AACF,kEAAkE;AAClE,oEAAoE;AACpE,2DAA2D;AAE3D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAczC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAEtC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,6DAA6D;IAC7D,iCAAiC;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACpE,CAAC;IAED,+CAA+C;IAC/C,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,kEAAkE;IAClE,kDAAkD;IAClD,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,IAAI,SAAS;QAAE,OAAO,SAAS,CAAC;IAEhC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,mBAAmB;IAChC,MAAM,CAAC,GAAG,QAAQ,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;QACnB,OAAO,qBAAqB,EAAE,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC;QAClB,OAAO,oBAAoB,EAAE,CAAC;IAChC,CAAC;IACD,gDAAgD;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,qBAAqB;IAClC,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE;QAC9B,uBAAuB;QACvB,IAAI;QACJ,gBAAgB;QAChB,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,oEAAoE;IACpE,8DAA8D;IAC9D,yBAAyB;IACzB,IAAI,oBAAoB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACjD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE;QACrC,uBAAuB;QACvB,IAAI;QACJ,gBAAgB;QAChB,IAAI;KACL,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,OAAO,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7C,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB;IACjC,+DAA+D;IAC/D,yDAAyD;IACzD,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE;QACjC,QAAQ;QACR,SAAS;QACT,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QAAE,OAAO,IAAI,CAAC;IAClD,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;AAChD,CAAC;AAiBD,KAAK,UAAU,gBAAgB;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,sCAAsC;IACtC,IAAI,MAAM,CAAC,KAAK,IAAI,oBAAoB,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,CAAC;IAED,uEAAuE;IACvE,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACtB,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,KAAK;gBAAE,SAAS;YACrB,0DAA0D;YAC1D,0BAA0B;YAC1B,MAAM,WAAW,GACf,MAAM,CAAC,mBAAmB,EAAE,CAAC,MAAM,CAAC;gBACpC,MAAM,CAAC,kBAAkB;gBACzB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACxB,MAAM,OAAO,GAAG;gBACd,KAAK,CAAC,WAAW,CAAC;gBAClB,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;qBACrB,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;qBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;aACrB,CAAC;YACF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,IAAI,KAAK,EAAE,KAAK,IAAI,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtD,OAAO;wBACL,KAAK,EAAE,KAAK,CAAC,KAAK;wBAClB,MAAM,EAAE,eAAe;wBACvB,SAAS,EAAE,KAAK,CAAC,IAAI;qBACtB,CAAC;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,oDAAoD;IACpD,iEAAiE;IACjE,8DAA8D;IAC9D,UAAU;IACV,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS;IACrC,6DAA6D;IAC7D,8DAA8D;IAC9D,4DAA4D;IAC5D,OAAO,yFAAyF,CAAC,IAAI,CACnG,CAAC,CACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,MAAM,UAAU,iBAAiB,CAAC,MAA+B;IAC/D,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,oBAAoB;YACvB,OAAO,qCAAqC,CAAC;QAC/C,KAAK,mBAAmB;YACtB,OAAO,2CAA2C,CAAC;QACrD,KAAK,eAAe;YAClB,OAAO,4BAA4B,CAAC;QACtC,KAAK,SAAS;YACZ,OAAO,0BAA0B,CAAC;IACtC,CAAC;AACH,CAAC"}

package/dist/provision/options.js

@@ -0,0 +1,15 @@
+export function defaultProvisionMode(name) {
+    if (name === "repair") {
+        return {
+            name,
+            deploy: false,
+            allowRemoteMigrations: false,
+        };
+    }
+    return {
+        name,
+        deploy: true,
+        allowRemoteMigrations: true,
+    };
+}
+//# sourceMappingURL=options.js.map

package/dist/provision/options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"options.js","sourceRoot":"","sources":["../../src/provision/options.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,KAAK;YACb,qBAAqB,EAAE,KAAK;SAC7B,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI;QACZ,qBAAqB,EAAE,IAAI;KAC5B,CAAC;AACJ,CAAC"}

package/dist/provision/password-hash.js

@@ -0,0 +1,78 @@
+// packages/create-notionx-app/src/provision/password-hash.ts
+//
+// Hashes the admin password at scaffold time so it can be baked into
+// `migrations/0002_admin_seed.sql` and verified by `@notionx/core`'s
+// `verifyPassword` on the first admin login.
+//
+// Why a local copy instead of importing from `@notionx/core`:
+//   - The scaffolder is a Node CLI, not a Cloudflare Worker. It must
+//     run on Node 22+ for the user, in a place where the runtime
+//     package may not be installed yet (e.g. in CI for a brand-new
+//     project that doesn't exist on disk).
+//   - PBKDF2-SHA256 is a 30-line algorithm. Keeping a local copy is
+//     simpler than wiring a workspace import + build dep.
+//   - The generated project imports the *canonical* implementation
+//     from `@notionx/core`; the only thing that matters is that the
+//     wire format matches so `verifyPassword` can decode it.
+//
+// Wire format (must stay in lockstep with
+// `packages/notionx/src/auth/passwords.ts#hashPassword`):
+//
+//   pbkdf2_sha256$<iterations>$<salt-base64>$<derived-key-base64>
+//
+// The `iterations` field is technically variable, but the runtime
+// caps it at 100000 because Cloudflare Workers WebCrypto refuses
+// higher counts. We bake 100000 in here so the seed row verifies
+// in the same Workers environment the rest of the app runs in.
+const HASH_PREFIX = "pbkdf2_sha256";
+const PBKDF2_ITERATIONS = 100_000;
+const SALT_BYTES = 16;
+const DERIVED_KEY_BITS = 256;
+function bytesToBase64(bytes) {
+    // Manual base64 because `Buffer` exists in Node 22 but we want
+    // this module to also work in any other env (e.g. edge test
+    // runners) that has `btoa` but not `Buffer`. `btoa` is available
+    // in Node 16+ and all modern browsers.
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin);
+}
+async function deriveBits(password, salt, iterations) {
+    // Node 22 exposes `crypto.subtle` globally. The scaffolder's
+    // package.json already requires Node >= 22, so we don't need a
+    // `node:crypto` import here.
+    const enc = new TextEncoder();
+    const baseKey = await crypto.subtle.importKey("raw", enc.encode(password), "PBKDF2", false, ["deriveBits"]);
+    const derived = await crypto.subtle.deriveBits({
+        name: "PBKDF2",
+        hash: "SHA-256",
+        salt: salt,
+        iterations,
+    }, baseKey, DERIVED_KEY_BITS);
+    return new Uint8Array(derived);
+}
+/**
+ * Hash `password` the same way `@notionx/core`'s `hashPassword` does.
+ *
+ * The output is a single string suitable for direct interpolation
+ * into a SQL literal — e.g.
+ *
+ *   `INSERT INTO users (email, password_hash) VALUES ('admin@example.com', '${hash}')`
+ *
+ * `render.ts` calls this exactly once per scaffold run (for the
+ * admin password) and bakes the result into a migration file. The
+ * 100k PBKDF2 iteration count takes ~200ms on a developer laptop —
+ * visible in the spinner, but not annoying.
+ */
+export async function hashPasswordForScaffold(password) {
+    const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+    const derived = await deriveBits(password, salt, PBKDF2_ITERATIONS);
+    return [
+        HASH_PREFIX,
+        String(PBKDF2_ITERATIONS),
+        bytesToBase64(salt),
+        bytesToBase64(derived),
+    ].join("$");
+}
+//# sourceMappingURL=password-hash.js.map

package/dist/provision/password-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.js","sourceRoot":"","sources":["../../src/provision/password-hash.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,6CAA6C;AAC7C,EAAE;AACF,8DAA8D;AAC9D,qEAAqE;AACrE,iEAAiE;AACjE,mEAAmE;AACnE,2CAA2C;AAC3C,oEAAoE;AACpE,0DAA0D;AAC1D,mEAAmE;AACnE,oEAAoE;AACpE,6DAA6D;AAC7D,EAAE;AACF,0CAA0C;AAC1C,0DAA0D;AAC1D,EAAE;AACF,kEAAkE;AAClE,EAAE;AACF,kEAAkE;AAClE,iEAAiE;AACjE,iEAAiE;AACjE,+DAA+D;AAE/D,MAAM,WAAW,GAAG,eAAe,CAAC;AACpC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAClC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,SAAS,aAAa,CAAC,KAAiB;IACtC,+DAA+D;IAC/D,4DAA4D;IAC5D,iEAAiE;IACjE,uCAAuC;IACvC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,QAAgB,EAChB,IAAgB,EAChB,UAAkB;IAElB,6DAA6D;IAC7D,+DAA+D;IAC/D,6BAA6B;IAC7B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EACpB,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5C;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAA+B;QACrC,UAAU;KACX,EACD,OAAO,EACP,gBAAgB,CACjB,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACpE,OAAO;QACL,WAAW;QACX,MAAM,CAAC,iBAAiB,CAAC;QACzB,aAAa,CAAC,IAAI,CAAC;QACnB,aAAa,CAAC,OAAO,CAAC;KACvB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC"}

package/dist/provision/prompts.js

@@ -0,0 +1,115 @@
+// packages/create-notionx-app/src/provision/prompts.ts
+//
+// Interactive (and silent) prompts for the post-render provisioning
+// stage. Each prompt is a no-op when not running in a TTY (e.g. when
+// the scaffolder is invoked with `--yes` or piped). Callers must
+// tolerate `null` returns — they translate to "skip this step".
+import * as p from "@clack/prompts";
+const SAFE_NON_TTY = null;
+/** "Enable Resend email verification? (y/N)". Skipped silently if !interactive. */
+export async function promptResend(ctx) {
+    if (!ctx.interactive)
+        return null;
+    const enable = await p.confirm({
+        message: "Enable Resend email verification? (no = auth falls back to no-op)",
+        initialValue: false,
+    });
+    if (p.isCancel(enable) || !enable)
+        return null;
+    const apiKey = await p.password({
+        message: "Resend API key (re_…)",
+        validate: (v) => !v || v.trim().length === 0 ? "Required when enabling Resend" : undefined,
+    });
+    if (p.isCancel(apiKey))
+        return null;
+    const fromAddress = await p.text({
+        message: "Resend sender address",
+        placeholder: "no-reply@example.com",
+        initialValue: "no-reply@example.com",
+        validate: (v) => (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(v) ? undefined : "Must be an email address"),
+    });
+    if (p.isCancel(fromAddress))
+        return null;
+    return { apiKey: String(apiKey), fromAddress: String(fromAddress) };
+}
+/** "Enable Google sign-in? (y/N)". Skipped silently if !interactive. */
+export async function promptGoogle(ctx, siteUrl) {
+    if (!ctx.interactive)
+        return null;
+    const enable = await p.confirm({
+        message: "Enable Google sign-in? (you'll need a Google Cloud OAuth client)",
+        initialValue: false,
+    });
+    if (p.isCancel(enable) || !enable)
+        return null;
+    const redirectUri = `${siteUrl.replace(/\/$/, "")}/api/auth/google/callback`;
+    p.log.info(`Add this redirect URI to your Google OAuth client:\n  ${redirectUri}`);
+    const clientId = await p.text({
+        message: "Google OAuth Client ID",
+        validate: (v) => (v && v.trim().length > 0 ? undefined : "Required"),
+    });
+    if (p.isCancel(clientId))
+        return null;
+    const clientSecret = await p.password({
+        message: "Google OAuth Client Secret",
+        validate: (v) => (v && v.trim().length > 0 ? undefined : "Required"),
+    });
+    if (p.isCancel(clientSecret))
+        return null;
+    return {
+        clientId: String(clientId),
+        clientSecret: String(clientSecret),
+        redirectUri,
+    };
+}
+/**
+ * "Wire up Notion now?" — triggered when no `NOTION_API_TOKEN` env var
+ * is set and we couldn't auto-detect credentials from `ntn`. The
+ * caller can pass a `preloadedToken` (e.g. read from the ntn CLI's
+ * local keychain) to skip the token prompt entirely. Returns the
+ * token + parent page id the user types in, or null to skip.
+ */
+export async function promptNotion(ctx, fields, preloadedToken, seedCount = 6) {
+    if (!ctx.interactive)
+        return null;
+    let apiToken = preloadedToken ?? "";
+    if (!apiToken) {
+        p.log.info("Notion: create an integration at https://www.notion.so/my-integrations, share a target page with it, then paste the token below. (Tip: run `ntn login` first and the scaffolder will pick up the token automatically.)");
+        const input = await p.password({
+            message: "Notion integration token (secret_…) — Enter to skip",
+        });
+        if (p.isCancel(input) || !input)
+            return null;
+        apiToken = String(input).trim();
+    }
+    p.log.info([
+        "Notion parent page:",
+        "  1. Create or choose a Notion page.",
+        "  2. Add the Notion CLI / integration connection to that page.",
+        "  3. Paste the page URL or page id below.",
+        "The scaffolder will create the blog database and 6 realistic sample posts under it.",
+    ].join("\n"));
+    const parentPageId = await p.text({
+        message: "Parent page URL or id (the page your integration can edit)",
+        placeholder: "https://www.notion.so/workspace/Page-00000000000000000000000000000000",
+        initialValue: preloadedToken ? "" : undefined,
+        validate: (v) => {
+            const id = extractNotionPageId(v ?? "");
+            return id ? undefined : "Paste a Notion page URL or a 32-char page id";
+        },
+    });
+    if (p.isCancel(parentPageId))
+        return null;
+    return {
+        apiToken,
+        parentPageId: extractNotionPageId(String(parentPageId)),
+        seedCount,
+    };
+}
+function extractNotionPageId(value) {
+    const compact = value.trim().replace(/-/g, "");
+    const matches = compact.match(/[0-9a-fA-F]{32}/g);
+    return matches?.at(-1)?.toLowerCase() ?? null;
+}
+export const _internal = { SAFE_NON_TTY };
+//# sourceMappingURL=prompts.js.map

package/dist/provision/prompts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompts.js","sourceRoot":"","sources":["../../src/provision/prompts.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,iEAAiE;AACjE,gEAAgE;AAEhE,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AA0BpC,MAAM,YAAY,GAA4D,IAAI,CAAC;AAEnF,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAkB;IACnD,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;QAC7B,OAAO,EAAE,mEAAmE;QAC5E,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC;QAC9B,OAAO,EAAE,uBAAuB;QAChC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC/B,OAAO,EAAE,uBAAuB;QAChC,WAAW,EAAE,sBAAsB;QACnC,YAAY,EAAE,sBAAsB;QACpC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC;KACjG,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,OAAe;IAEf,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC;QAC7B,OAAO,EAAE,kEAAkE;QAC3E,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,WAAW,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC;IAC7E,CAAC,CAAC,GAAG,CAAC,IAAI,CACR,yDAAyD,WAAW,EAAE,CACvE,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC5B,OAAO,EAAE,wBAAwB;QACjC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC;QACpC,OAAO,EAAE,4BAA4B;QACrC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC1B,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;QAClC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAkB,EAClB,MAA6B,EAC7B,cAAuB,EACvB,SAAS,GAAG,CAAC;IAEb,IAAI,CAAC,GAAG,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,QAAQ,GAAG,cAAc,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,CAAC,CAAC,GAAG,CAAC,IAAI,CACR,wNAAwN,CACzN,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC;YAC7B,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7C,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,IAAI,CACR;QACE,qBAAqB;QACrB,sCAAsC;QACtC,gEAAgE;QAChE,2CAA2C;QAC3C,qFAAqF;KACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAChC,OAAO,EAAE,4DAA4D;QACrE,WAAW,EAAE,uEAAuE;QACpF,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QAC7C,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE;YACd,MAAM,EAAE,GAAG,mBAAmB,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C,CAAC;QACzE,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO;QACL,QAAQ;QACR,YAAY,EAAE,mBAAmB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAE;QACxD,SAAS;KACV,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;IAClD,OAAO,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,EAAE,YAAY,EAAE,CAAC"}

package/dist/provision/repair.js

@@ -0,0 +1,48 @@
+import { DEFAULT_ANSWERS } from "../prompt.js";
+import { provision } from "./index.js";
+import { defaultProvisionMode } from "./options.js";
+import { inspectProvisionRepair } from "./inspect.js";
+export { inspectProvisionRepair } from "./inspect.js";
+export function buildRepairAnswers(registry) {
+    const m = registry.manifest;
+    return {
+        projectName: m.projectName,
+        targetDir: process.cwd(),
+        defaultLocale: m.defaultLocale,
+        supportedLocales: [...m.supportedLocales],
+        notionxSource: m.notionxCore,
+        enableSiteSettings: m.enableSiteSettings,
+        enableBlocks: m.enableBlocks,
+        enableAuth: m.enableAuth,
+        enableAdmin: m.enableAdmin,
+        enablePages: m.enablePages,
+        enableSearch: m.enableSearch,
+        contentSource: {
+            id: m.contentSource.id,
+            title: m.contentSource.title,
+            fields: m.contentSource.fields.map((field) => ({
+                key: field.key,
+                notionName: field.notionName,
+            })),
+        },
+        adminEmail: DEFAULT_ANSWERS.adminEmail,
+        adminPassword: DEFAULT_ANSWERS.adminPassword,
+        notionParentPage: DEFAULT_ANSWERS.notionParentPage,
+        notionSeedCount: DEFAULT_ANSWERS.notionSeedCount,
+    };
+}
+export async function runProvisionRepair(registry, projectDir, answers = buildRepairAnswers(registry), options = {}) {
+    if (options.conflictChoice) {
+        const entries = await inspectProvisionRepair(projectDir);
+        const applicable = entries.filter((entry) => options.conflictChoice === "apply-all" ? true : entry.risk === "safe");
+        for (const entry of applicable) {
+            await entry.apply();
+        }
+        return { answers, appliedEntries: applicable };
+    }
+    return provision(answers, projectDir, {
+        interactive: false,
+        mode: defaultProvisionMode("repair"),
+    });
+}
+//# sourceMappingURL=repair.js.map

package/dist/provision/repair.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair.js","sourceRoot":"","sources":["../../src/provision/repair.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAgB,MAAM,cAAc,CAAC;AAE7D,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAEtD,MAAM,UAAU,kBAAkB,CAAC,QAAwB;IACzD,MAAM,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC;IAC5B,OAAO;QACL,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE;QACxB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,gBAAgB,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,CAAC;QACzC,aAAa,EAAE,CAAC,CAAC,WAAW;QAC5B,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,YAAY,EAAE,CAAC,CAAC,YAAY;QAC5B,aAAa,EAAE;YACb,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE;YACtB,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,KAAK;YAC5B,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC7C,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC,CAAC;SACJ;QACD,UAAU,EAAE,eAAe,CAAC,UAAU;QACtC,aAAa,EAAE,eAAe,CAAC,aAAa;QAC5C,gBAAgB,EAAE,eAAe,CAAC,gBAAgB;QAClD,eAAe,EAAE,eAAe,CAAC,eAAe;KACjD,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAAwB,EACxB,UAAkB,EAClB,UAAmB,kBAAkB,CAAC,QAAQ,CAAC,EAC/C,UAA0D,EAAE;IAE5D,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1C,OAAO,CAAC,cAAc,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CACtE,CAAC;QAEF,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;YAC/B,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE;QACpC,WAAW,EAAE,KAAK;QAClB,IAAI,EAAE,oBAAoB,CAAC,QAAQ,CAAC;KACrC,CAAC,CAAC;AACL,CAAC"}

package/dist/provision/repair.test.js

@@ -0,0 +1,141 @@
+import { describe, expect, it, vi } from "vitest";
+import { defaultProvisionMode } from "./options.js";
+import { inspectProvisionRepair, runProvisionRepair } from "./repair.js";
+const provisionMock = vi.hoisted(() => vi.fn());
+const inspectProvisionMock = vi.hoisted(() => vi.fn());
+vi.mock("./index.js", async () => {
+    const actual = await vi.importActual("./index.js");
+    return {
+        ...actual,
+        provision: provisionMock,
+    };
+});
+vi.mock("./inspect.js", async () => {
+    const actual = await vi.importActual("./inspect.js");
+    return {
+        ...actual,
+        inspectProvisionRepair: inspectProvisionMock,
+    };
+});
+const registry = {
+    manifest: {
+        $schema: "https://notionx.dev/schemas/registry.v2.json",
+        projectKind: "notionx",
+        projectName: "demo",
+        scaffoldVersion: "0.4.10",
+        notionxCore: "^0.1.2",
+        defaultLocale: "en",
+        supportedLocales: ["en"],
+        enableSiteSettings: true,
+        enableBlocks: true,
+        enableAuth: true,
+        enableAdmin: true,
+        enablePages: true,
+        enableSearch: true,
+        contentSource: {
+            id: "blog",
+            title: "Blog",
+            fields: [{ key: "title", notionName: "Name" }],
+        },
+        compat: { mode: "v2-native" },
+        registries: {},
+        installed: [],
+        managedFiles: { platform: [], bridge: [], user: [] },
+    },
+    managedFiles: { platform: [], bridge: [], user: [] },
+};
+const projectDir = "/tmp/demo";
+describe("provision mode defaults", () => {
+    it("disables deploy for repair mode", () => {
+        expect(defaultProvisionMode("repair").deploy).toBe(false);
+    });
+    it("enables deploy for create mode", () => {
+        expect(defaultProvisionMode("create").deploy).toBe(true);
+    });
+});
+describe("runProvisionRepair", () => {
+    it("invokes provision in repair mode", async () => {
+        const answers = {
+            projectName: "demo",
+            targetDir: "./demo",
+            defaultLocale: "en",
+            supportedLocales: ["en"],
+            notionxSource: "^0.1.2",
+            enableSiteSettings: true,
+            enableBlocks: true,
+            enableAuth: true,
+            enableAdmin: true,
+            enablePages: true,
+            enableSearch: true,
+            contentSource: {
+                id: "blog",
+                title: "Blog",
+                fields: [{ key: "title", notionName: "Name" }],
+            },
+            adminEmail: "admin@example.com",
+            adminPassword: "ChangeMe1234",
+            notionParentPage: "",
+            notionSeedCount: 3,
+        };
+        provisionMock.mockResolvedValueOnce({ deploy: { skipped: true } });
+        await runProvisionRepair(registry, projectDir, answers);
+        expect(provisionMock).toHaveBeenCalledWith(answers, "/tmp/demo", expect.objectContaining({
+            interactive: false,
+            mode: expect.objectContaining({ name: "repair", deploy: false }),
+        }));
+    });
+    it("can apply only safe inspected entries", async () => {
+        const safeApply = vi.fn();
+        const conflictApply = vi.fn();
+        inspectProvisionMock.mockResolvedValueOnce([
+            {
+                label: "cloudflare:add-var:VINEXT_KV_CACHE",
+                kind: "cloudflare",
+                group: "cloudflareBinding",
+                risk: "safe",
+                apply: safeApply,
+            },
+            {
+                label: "notion:update-site-settings:Nav",
+                kind: "notion",
+                group: "notionContent",
+                risk: "conflict",
+                apply: conflictApply,
+            },
+        ]);
+        await runProvisionRepair(registry, projectDir, undefined, {
+            conflictChoice: "safe-only",
+        });
+        expect(safeApply).toHaveBeenCalledTimes(1);
+        expect(conflictApply).not.toHaveBeenCalled();
+    });
+});
+describe("inspectProvisionRepair", () => {
+    it("marks additive Notion schema repairs as safe", async () => {
+        inspectProvisionMock.mockResolvedValueOnce([
+            {
+                label: "notion:add-property:Count",
+                kind: "notion",
+                group: "notionContent",
+                risk: "safe",
+                apply: vi.fn(),
+            },
+        ]);
+        const entries = await inspectProvisionRepair(projectDir);
+        expect(entries[0]?.risk).toBe("safe");
+    });
+    it("marks populated site settings replacements as conflicts", async () => {
+        inspectProvisionMock.mockResolvedValueOnce([
+            {
+                label: "notion:update-site-settings:Nav",
+                kind: "notion",
+                group: "notionContent",
+                risk: "conflict",
+                apply: vi.fn(),
+            },
+        ]);
+        const entries = await inspectProvisionRepair(projectDir);
+        expect(entries[0]?.risk).toBe("conflict");
+    });
+});
+//# sourceMappingURL=repair.test.js.map

package/dist/provision/repair.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repair.test.js","sourceRoot":"","sources":["../../src/provision/repair.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEzE,MAAM,aAAa,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChD,MAAM,oBAAoB,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAEvD,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;IAC/B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAA8B,YAAY,CAAC,CAAC;IAChF,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,aAAa;KACzB,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE;IACjC,MAAM,MAAM,GACV,MAAM,EAAE,CAAC,YAAY,CAAgC,cAAc,CAAC,CAAC;IACvE,OAAO;QACL,GAAG,MAAM;QACT,sBAAsB,EAAE,oBAAoB;KAC7C,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAmB;IAC/B,QAAQ,EAAE;QACR,OAAO,EAAE,8CAA8C;QACvD,WAAW,EAAE,SAAS;QACtB,WAAW,EAAE,MAAM;QACnB,eAAe,EAAE,QAAQ;QACzB,WAAW,EAAE,QAAQ;QACrB,aAAa,EAAE,IAAI;QACnB,gBAAgB,EAAE,CAAC,IAAI,CAAC;QACxB,kBAAkB,EAAE,IAAI;QACxB,YAAY,EAAE,IAAI;QAClB,UAAU,EAAE,IAAI;QAChB,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,YAAY,EAAE,IAAI;QAClB,aAAa,EAAE;YACb,EAAE,EAAE,MAAM;YACV,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;SAC/C;QACD,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC7B,UAAU,EAAE,EAAE;QACd,SAAS,EAAE,EAAE;QACb,YAAY,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;KACrD;IACD,YAAY,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;CACrD,CAAC;AAEF,MAAM,UAAU,GAAG,WAAW,CAAC;AAE/B,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAChD,MAAM,OAAO,GAAY;YACvB,WAAW,EAAE,MAAM;YACnB,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,IAAI;YACnB,gBAAgB,EAAE,CAAC,IAAI,CAAC;YACxB,aAAa,EAAE,QAAQ;YACvB,kBAAkB,EAAE,IAAI;YACxB,YAAY,EAAE,IAAI;YAClB,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI;YACjB,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,IAAI;YAClB,aAAa,EAAE;gBACb,EAAE,EAAE,MAAM;gBACV,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;aAC/C;YACD,UAAU,EAAE,mBAAmB;YAC/B,aAAa,EAAE,cAAc;YAC7B,gBAAgB,EAAE,EAAE;YACpB,eAAe,EAAE,CAAC;SACnB,CAAC;QACF,aAAa,CAAC,qBAAqB,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAEnE,MAAM,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;QAExD,MAAM,CAAC,aAAa,CAAC,CAAC,oBAAoB,CACxC,OAAO,EACP,WAAW,EACX,MAAM,CAAC,gBAAgB,CAAC;YACtB,WAAW,EAAE,KAAK;YAClB,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACjE,CAAC,CACH,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9B,oBAAoB,CAAC,qBAAqB,CAAC;YACzC;gBACE,KAAK,EAAE,oCAAoC;gBAC3C,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,mBAAmB;gBAC1B,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,SAAS;aACjB;YACD;gBACE,KAAK,EAAE,iCAAiC;gBACxC,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,aAAa;aACrB;SACF,CAAC,CAAC;QAEH,MAAM,kBAAkB,CAAC,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE;YACxD,cAAc,EAAE,WAAW;SAC5B,CAAC,CAAC;QAEH,MAAM,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC/C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,oBAAoB,CAAC,qBAAqB,CAAC;YACzC;gBACE,KAAK,EAAE,2BAA2B;gBAClC,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,MAAM;gBACZ,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;aACf;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,oBAAoB,CAAC,qBAAqB,CAAC;YACzC;gBACE,KAAK,EAAE,iCAAiC;gBACxC,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,eAAe;gBACtB,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE,EAAE,CAAC,EAAE,EAAE;aACf;SACF,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}