create-feedbax 0.2.1 → 0.2.2

package/dist/cli.js

@@ -3,15 +3,18 @@
 // src/cli.ts
 import * as prompt from "@clack/prompts";
 import { spawn } from "node:child_process";
-import { readFile as readFile3 } from "node:fs/promises";
+import { readFile as readFile4 } from "node:fs/promises";
 import { basename as basename2, resolve as resolve2 } from "node:path";
 
 // src/index.ts
-import { createHash, randomBytes } from "node:crypto";
-import { readFile as readFile2, readdir as readdir2, writeFile as writeFile2 } from "node:fs/promises";
+import { createHash as createHash2, randomBytes as randomBytes2 } from "node:crypto";
+import { readFile as readFile3, readdir as readdir2, writeFile as writeFile3 } from "node:fs/promises";
 
 // ../config/src/index.ts
 var rootKeys = [
+  "history",
+  "provider",
+  "github",
   "connected",
   "product",
   "theme",
@@ -55,6 +58,8 @@ var changelogPropertyKeys = [
 function defineFeedbax(config) {
   const value = object(config, "Feedbax configuration");
   rejectUnknown(value, rootKeys, "Feedbax configuration");
+  if (value.history !== void 0 && typeof value.history !== "boolean")
+    throw new Error("history must be true or false.");
   const product = object(value.product, "product");
   rejectUnknown(
     product,
@@ -131,11 +136,19 @@ function defineFeedbax(config) {
   }
   const theme = object(value.theme, "theme");
   rejectUnknown(theme, ["preset"], "theme");
-  const notion = storage(
-    value.notion,
-    feedbackPropertyKeys,
-    "notion"
-  );
+  if (value.provider !== void 0 && !["notion", "github"].includes(String(value.provider)))
+    throw new Error("provider must be notion or github.");
+  const githubMode = value.provider === "github";
+  if (githubMode && value.notion !== void 0 || !githubMode && value.github !== void 0)
+    throw new Error("Select exactly one Content Provider: notion or github.");
+  const content = githubMode ? { provider: "github", github: githubConfiguration(value.github) } : {
+    ...value.provider ? { provider: "notion" } : {},
+    notion: storage(
+      value.notion,
+      feedbackPropertyKeys,
+      "notion"
+    )
+  };
   const features = object(value.features, "features");
   rejectUnknown(features, featureKeys, "features");
   const validatedFeatures = Object.fromEntries(
@@ -145,6 +158,10 @@ function defineFeedbax(config) {
       return [key, features[key]];
     })
   );
+  if (githubMode && (validatedFeatures.changelog || value.changelog !== void 0))
+    throw new Error(
+      "GitHub Installations must disable Changelog (features.changelog: false) and remove Notion Changelog configuration."
+    );
   const changelog = value.changelog === void 0 ? void 0 : storage(
     value.changelog,
     changelogPropertyKeys,
@@ -171,9 +188,10 @@ function defineFeedbax(config) {
     throw new Error("Turnstile is enabled but turnstile.siteKey is missing.");
   return {
     product: validatedProduct,
+    ...value.history !== void 0 ? { history: value.history } : {},
     ...connected ? { connected } : {},
     theme: { preset: text(theme.preset, "theme.preset") },
-    notion,
+    ...content,
     ...changelog ? { changelog } : {},
     features: validatedFeatures,
     submissions: {
@@ -238,9 +256,44 @@ function publicUrl(value, label, allowRelative) {
     `${label} must be ${allowRelative ? "root-relative or " : ""}an HTTPS URL.`
   );
 }
+function githubConfiguration(value) {
+  const input = object(value, "github");
+  rejectUnknown(
+    input,
+    ["installationId", "serviceUrl", "repository", "botUserId"],
+    "github"
+  );
+  const installationId = text(input.installationId, "github.installationId");
+  if (!/^[a-zA-Z0-9_-]{1,128}$/.test(installationId))
+    throw new Error(
+      "github.installationId must be a stable Installation identifier."
+    );
+  const serviceUrl = publicUrl(input.serviceUrl, "github.serviceUrl", false);
+  const url = new URL(serviceUrl);
+  if (url.origin !== serviceUrl || url.username || url.password)
+    throw new Error(
+      "github.serviceUrl must be an HTTPS origin without a path or credentials."
+    );
+  const repository = object(input.repository, "github.repository");
+  rejectUnknown(repository, ["id", "owner", "name"], "github.repository");
+  const owner = text(repository.owner, "github.repository.owner");
+  const name = text(repository.name, "github.repository.name");
+  if (!/^[A-Za-z0-9-]+$/.test(owner) || !/^[A-Za-z0-9_.-]+$/.test(name))
+    throw new Error("Use a valid GitHub repository owner and name.");
+  return {
+    installationId,
+    serviceUrl,
+    repository: {
+      id: positiveInteger(repository.id, "github.repository.id"),
+      owner,
+      name
+    },
+    botUserId: positiveInteger(input.botUserId, "github.botUserId")
+  };
+}
 
 // src/index.ts
-import { basename, join as join2 } from "node:path";
+import { basename, join as join3 } from "node:path";
 
 // src/template.ts
 import { parse } from "jsonc-parser";
@@ -690,7 +743,7 @@ function isPropertyMap(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/entity.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/entity.js
 var entityKind = /* @__PURE__ */ Symbol.for("drizzle:entityKind");
 function is(value, type) {
   if (!value || typeof value !== "object") {
@@ -716,7 +769,7 @@ function is(value, type) {
   return false;
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/column.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/column.js
 var Column = class {
   constructor(table, config) {
     this.table = table;
@@ -767,7 +820,7 @@ var Column = class {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/column-builder.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/column-builder.js
 var ColumnBuilder = class {
   static [entityKind] = "ColumnBuilder";
   config;
@@ -870,10 +923,10 @@ var ColumnBuilder = class {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/table.utils.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/table.utils.js
 var TableName = /* @__PURE__ */ Symbol.for("drizzle:Name");
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/foreign-keys.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/foreign-keys.js
 var ForeignKeyBuilder = class {
   static [entityKind] = "PgForeignKeyBuilder";
   /** @internal */
@@ -930,12 +983,12 @@ var ForeignKey = class {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/tracing-utils.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/tracing-utils.js
 function iife(fn, ...args) {
   return fn(...args);
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/unique-constraint.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/unique-constraint.js
 function uniqueKeyName(table, columns) {
   return `${table[TableName]}_${columns.join("_")}_unique`;
 }
@@ -985,7 +1038,7 @@ var UniqueConstraint = class {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/utils/array.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/utils/array.js
 function parsePgArrayValue(arrayString, startFrom, inQuotes) {
   for (let i = startFrom; i < arrayString.length; i++) {
     const char = arrayString[i];
@@ -1061,7 +1114,7 @@ function makePgArray(array) {
   }).join(",")}}`;
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/columns/common.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/columns/common.js
 var PgColumnBuilder = class extends ColumnBuilder {
   foreignKeyConfigs = [];
   static [entityKind] = "PgColumnBuilder";
@@ -1245,7 +1298,7 @@ var PgArray = class _PgArray extends PgColumn {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/columns/enum.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/pg-core/columns/enum.js
 var PgEnumObjectColumnBuilder = class extends PgColumnBuilder {
   static [entityKind] = "PgEnumObjectColumnBuilder";
   constructor(name, enumInstance) {
@@ -1303,7 +1356,7 @@ var PgEnumColumn = class extends PgColumn {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/subquery.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/subquery.js
 var Subquery = class {
   static [entityKind] = "Subquery";
   constructor(sql2, fields, alias, isWith = false, usedTables = []) {
@@ -1324,10 +1377,10 @@ var WithSubquery = class extends Subquery {
   static [entityKind] = "WithSubquery";
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/version.js
-var version = "0.45.2";
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/version.js
+var version = "0.45.4";
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/tracing.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/tracing.js
 var otel;
 var rawTracer;
 var tracer = {
@@ -1362,10 +1415,10 @@ var tracer = {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/view-common.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/view-common.js
 var ViewBaseConfig = /* @__PURE__ */ Symbol.for("drizzle:ViewBaseConfig");
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/table.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/table.js
 var Schema = /* @__PURE__ */ Symbol.for("drizzle:Schema");
 var Columns = /* @__PURE__ */ Symbol.for("drizzle:Columns");
 var ExtraConfigColumns = /* @__PURE__ */ Symbol.for("drizzle:ExtraConfigColumns");
@@ -1421,7 +1474,7 @@ var Table = class {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sql/sql.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sql/sql.js
 var FakePrimitiveParam = class {
   static [entityKind] = "FakePrimitiveParam";
 };
@@ -1711,7 +1764,7 @@ function sql(strings, ...params) {
     return new SQL([new StringChunk(str)]);
   }
   sql2.raw = raw;
-  function join3(chunks, separator) {
+  function join4(chunks, separator) {
     const result = [];
     for (const [i, chunk] of chunks.entries()) {
       if (i > 0 && separator !== void 0) {
@@ -1721,7 +1774,7 @@ function sql(strings, ...params) {
     }
     return new SQL(result);
   }
-  sql2.join = join3;
+  sql2.join = join4;
   function identifier(value) {
     return new Name(value);
   }
@@ -1795,7 +1848,7 @@ Subquery.prototype.getSQL = function() {
   return new SQL([this]);
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/utils.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/utils.js
 function getColumnNameAndConfig(a, b) {
   return {
     name: typeof a === "string" && a.length > 0 ? a : "",
@@ -1804,7 +1857,7 @@ function getColumnNameAndConfig(a, b) {
 }
 var textDecoder = typeof TextDecoder === "undefined" ? null : new TextDecoder();
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/foreign-keys.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/foreign-keys.js
 var ForeignKeyBuilder2 = class {
   static [entityKind] = "SQLiteForeignKeyBuilder";
   /** @internal */
@@ -1861,7 +1914,7 @@ var ForeignKey2 = class {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/unique-constraint.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/unique-constraint.js
 function uniqueKeyName2(table, columns) {
   return `${table[TableName]}_${columns.join("_")}_unique`;
 }
@@ -1903,7 +1956,7 @@ var UniqueConstraint2 = class {
   }
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/common.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/common.js
 var SQLiteColumnBuilder = class extends ColumnBuilder {
   static [entityKind] = "SQLiteColumnBuilder";
   foreignKeyConfigs = [];
@@ -1954,7 +2007,7 @@ var SQLiteColumn = class extends Column {
   static [entityKind] = "SQLiteColumn";
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/blob.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/blob.js
 var SQLiteBigIntBuilder = class extends SQLiteColumnBuilder {
   static [entityKind] = "SQLiteBigIntBuilder";
   constructor(name) {
@@ -2043,7 +2096,7 @@ function blob(a, b) {
   return new SQLiteBlobBufferBuilder(name);
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/custom.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/custom.js
 var SQLiteCustomColumnBuilder = class extends SQLiteColumnBuilder {
   static [entityKind] = "SQLiteCustomColumnBuilder";
   constructor(name, fieldConfig, customTypeParams) {
@@ -2091,7 +2144,7 @@ function customType(customTypeParams) {
   };
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/integer.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/integer.js
 var SQLiteBaseIntegerBuilder = class extends SQLiteColumnBuilder {
   static [entityKind] = "SQLiteBaseIntegerBuilder";
   constructor(name, dataType, columnType) {
@@ -2200,7 +2253,7 @@ function integer(a, b) {
   return new SQLiteIntegerBuilder(name);
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/numeric.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/numeric.js
 var SQLiteNumericBuilder = class extends SQLiteColumnBuilder {
   static [entityKind] = "SQLiteNumericBuilder";
   constructor(name) {
@@ -2275,7 +2328,7 @@ function numeric(a, b) {
   return mode === "number" ? new SQLiteNumericNumberBuilder(name) : mode === "bigint" ? new SQLiteNumericBigIntBuilder(name) : new SQLiteNumericBuilder(name);
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/real.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/real.js
 var SQLiteRealBuilder = class extends SQLiteColumnBuilder {
   static [entityKind] = "SQLiteRealBuilder";
   constructor(name) {
@@ -2296,7 +2349,7 @@ function real(name) {
   return new SQLiteRealBuilder(name ?? "");
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/text.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/text.js
 var SQLiteTextBuilder = class extends SQLiteColumnBuilder {
   static [entityKind] = "SQLiteTextBuilder";
   constructor(name, config) {
@@ -2356,7 +2409,7 @@ function text2(a, b = {}) {
   return new SQLiteTextBuilder(name, config);
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/all.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/columns/all.js
 function getSQLiteColumnBuilders() {
   return {
     blob,
@@ -2368,7 +2421,7 @@ function getSQLiteColumnBuilders() {
   };
 }
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/table.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/table.js
 var InlineForeignKeys = /* @__PURE__ */ Symbol.for("drizzle:SQLiteInlineForeignKeys");
 var SQLiteTable = class extends Table {
   static [entityKind] = "SQLiteTable";
@@ -2407,7 +2460,7 @@ var sqliteTable = (name, columns, extraConfig) => {
   return sqliteTableBase(name, columns, extraConfig);
 };
 
-// ../../node_modules/.pnpm/drizzle-orm@0.45.2_@cloudflare+workers-types@5.20261014.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/primary-keys.js
+// ../../node_modules/.pnpm/drizzle-orm@0.45.4_@cloudflare+workers-types@5.20261015.1_kysely@0.29.6/node_modules/drizzle-orm/sqlite-core/primary-keys.js
 function primaryKey(...config) {
   if (config[0].columns) {
     return new PrimaryKeyBuilder(config[0].columns, config[0].name);
@@ -2555,7 +2608,7 @@ async function validateNotionChangelogDataSource({
   const properties = recordAt(dataSource, "properties");
   const propertiesById = new Map(
     Object.values(properties).flatMap((property) => {
-      if (!isRecord(property) || typeof property.id !== "string") return [];
+      if (!isRecord2(property) || typeof property.id !== "string") return [];
       return [[property.id, property]];
     })
   );
@@ -2610,7 +2663,7 @@ async function readObject(response, subject) {
       `Notion rejected the ${subject} request (${response.status}).`
     );
   }
-  if (!isRecord(body))
+  if (!isRecord2(body))
     throw new Error(`Notion returned an invalid ${subject} response.`);
   return body;
 }
@@ -2618,7 +2671,7 @@ function recordAt(value, key) {
   return record(value[key]);
 }
 function record(value) {
-  if (!isRecord(value))
+  if (!isRecord2(value))
     throw new Error("Notion returned an invalid Changelog response.");
   return value;
 }
@@ -2627,13 +2680,141 @@ function requiredString(value) {
     throw new Error("Notion returned an invalid Changelog response.");
   return value;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 
+// src/github.ts
+import { createHash, randomBytes } from "node:crypto";
+import { readFile as readFile2, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join2 } from "node:path";
+async function provisionGitHubInstallation(options) {
+  const { connected, github } = options;
+  if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(options.workerName) || !/^[0-9a-f-]{36}$/i.test(options.database.id) || !options.database.name.trim())
+    throw new Error(
+      "GitHub setup requires a distinct Worker and an explicitly provisioned FEEDBAX_DB D1 database."
+    );
+  if (connected && (connected.databaseId !== options.database.id || connected.handoffSecret.length < 32 || connected.processing !== "standard" && !connected.queueName))
+    throw new Error(
+      "Connected setup requires the same D1 database, a handoff secret, and an existing processing queue for small processing."
+    );
+  if (connected?.imageBucket && !/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/.test(connected.imageBucket))
+    throw new Error("Use a dedicated private R2 bucket for images.");
+  const config = defineFeedbax({
+    provider: "github",
+    github,
+    product: { ...options.product, logo: "/feedbax-mark.svg" },
+    theme: { preset: "lyra-neutral" },
+    features: options.features,
+    ...connected ? {
+      connected: {
+        processing: connected.processing ?? "small",
+        issuer: connected.issuer,
+        loginUrl: connected.loginUrl,
+        ...connected.imageBucket ? { images: true } : {},
+        ...connected.email ? {
+          email: {
+            provider: connected.email.provider,
+            from: connected.email.from,
+            ...connected.email.endpoint ? { endpoint: connected.email.endpoint } : {}
+          }
+        } : {}
+      }
+    } : {},
+    submissions: {
+      moderation: "required",
+      maxTitleLength: 160,
+      maxDescriptionLength: 5e3
+    },
+    turnstile: {
+      enabled: Boolean(options.turnstile?.siteKey),
+      ...options.turnstile?.siteKey ? { siteKey: options.turnstile.siteKey } : {}
+    }
+  });
+  if (!await options.preview(
+    "Create GitHub-backed portal source and private pairing secrets. GitHub requires D1 independently of sign-in. If the repository is public, issue titles/bodies are public immediately even while portal Posts await moderation. This does not create issues, pair the App, or deploy."
+  ))
+    throw new Error("GitHub setup was not approved.");
+  await copyPackagedTemplate(options.destination);
+  const path = join2(options.destination, "wrangler.jsonc");
+  const base = JSON.parse(await readFile2(path, "utf8"));
+  const wrangler = {
+    ...base,
+    name: options.workerName,
+    compatibility_flags: [
+      .../* @__PURE__ */ new Set([
+        ...base.compatibility_flags ?? [],
+        "global_fetch_strictly_public"
+      ])
+    ],
+    d1_databases: [
+      {
+        binding: "FEEDBAX_DB",
+        database_id: options.database.id,
+        database_name: options.database.name,
+        migrations_dir: "migrations"
+      }
+    ],
+    triggers: { crons: ["*/5 * * * *"] },
+    ...connected?.queueName ? {
+      queues: {
+        producers: [
+          { binding: "FEEDBAX_UPDATES", queue: connected.queueName }
+        ],
+        consumers: [
+          {
+            queue: connected.queueName,
+            max_batch_size: 1,
+            max_concurrency: 1,
+            max_retries: 3,
+            retry_delay: 60
+          }
+        ]
+      }
+    } : {},
+    ...connected?.imageBucket ? {
+      r2_buckets: [
+        { binding: "FEEDBAX_IMAGES", bucket_name: connected.imageBucket }
+      ]
+    } : {},
+    ...connected?.email?.provider === "cloudflare" ? {
+      send_email: [
+        {
+          name: "FEEDBAX_EMAIL",
+          allowed_sender_addresses: [connected.email.from]
+        }
+      ]
+    } : {}
+  };
+  const apiKey = randomBytes(32).toString("base64url");
+  const pairingSecret = randomBytes(32).toString("base64url");
+  const secrets = {
+    FEEDBAX_API_KEY_HASH: createHash("sha256").update(apiKey).digest("base64url"),
+    PARTICIPATION_SIGNING_SECRET: randomBytes(32).toString("base64url"),
+    GITHUB_PAIRING_SECRET: pairingSecret,
+    ...connected ? { IDENTITY_HANDOFF_SECRET: connected.handoffSecret } : {},
+    ...connected?.email?.secret ? { EMAIL_PROVIDER_SECRET: connected.email.secret } : {},
+    ...options.turnstile?.secretKey ? { TURNSTILE_SECRET_KEY: options.turnstile.secretKey } : {}
+  };
+  await writeFile2(path, JSON.stringify(wrangler, null, 2) + "\n");
+  await writeFile2(
+    join2(options.destination, "src/feedbax.ts"),
+    `import { defineFeedbax } from "@feedbax/config";
+
+export default defineFeedbax(${JSON.stringify(config, null, 2)});
+`
+  );
+  await writeFile2(
+    join2(options.destination, ".dev.vars"),
+    Object.entries(secrets).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n") + "\n",
+    { mode: 384 }
+  );
+  return { apiKey, pairingSecret, configuration: config };
+}
+
 // src/index.ts
 function defaultProcessingQueueName(workerName) {
-  return workerName.length <= 55 ? `${workerName}-updates` : `${workerName.slice(0, 46)}-${createHash("sha256").update(workerName).digest("hex").slice(0, 8)}-updates`;
+  return workerName.length <= 55 ? `${workerName}-updates` : `${workerName.slice(0, 46)}-${createHash2("sha256").update(workerName).digest("hex").slice(0, 8)}-updates`;
 }
 async function provisionGuidedInstallation({
   destination,
@@ -2741,9 +2922,9 @@ async function provisionGuidedInstallation({
     preview
   });
   await copyPackagedTemplate(destination);
-  const wranglerPath = join2(destination, "wrangler.jsonc");
-  const wrangler = JSON.parse(await readFile2(wranglerPath, "utf8"));
-  await writeFile2(
+  const wranglerPath = join3(destination, "wrangler.jsonc");
+  const wrangler = JSON.parse(await readFile3(wranglerPath, "utf8"));
+  await writeFile3(
     wranglerPath,
     JSON.stringify(
       {
@@ -2798,14 +2979,14 @@ async function provisionGuidedInstallation({
       2
     ) + "\n"
   );
-  const apiKey = randomBytes(32).toString("base64url");
-  const signingSecret = randomBytes(32).toString("base64url");
+  const apiKey = randomBytes2(32).toString("base64url");
+  const signingSecret = randomBytes2(32).toString("base64url");
   const values = {
     NOTION_TOKEN: notionToken,
     NOTION_FEEDBACK_DATABASE_ID: feedback.databaseId,
     NOTION_FEEDBACK_DATA_SOURCE_ID: feedback.dataSourceId,
     ...prefixProperties("NOTION_FEEDBACK", feedback.propertyIds),
-    FEEDBAX_API_KEY_HASH: createHash("sha256").update(apiKey).digest("base64url"),
+    FEEDBAX_API_KEY_HASH: createHash2("sha256").update(apiKey).digest("base64url"),
     PARTICIPATION_SIGNING_SECRET: signingSecret,
     ...connected ? { IDENTITY_HANDOFF_SECRET: connected.handoffSecret } : {},
     ...connected?.email?.secret ? { EMAIL_PROVIDER_SECRET: connected.email.secret } : {},
@@ -2820,8 +3001,8 @@ async function provisionGuidedInstallation({
       ...prefixProperties("NOTION_CHANGELOG", changelog.propertyIds)
     } : {}
   };
-  await writeFile2(
-    join2(destination, ".dev.vars"),
+  await writeFile3(
+    join3(destination, ".dev.vars"),
     Object.entries(values).map(([key, value]) => `${key}=${JSON.stringify(value)}`).join("\n") + "\n",
     { mode: 384 }
   );
@@ -2866,16 +3047,16 @@ async function provisionGuidedInstallation({
       ...turnstile.siteKey ? { siteKey: turnstile.siteKey } : {}
     }
   });
-  await writeFile2(
-    join2(destination, "src/feedbax.ts"),
+  await writeFile3(
+    join3(destination, "src/feedbax.ts"),
     `import { defineFeedbax } from "@feedbax/config";
 
 export default defineFeedbax(${JSON.stringify(configuration, null, 2)});
 `
   );
   const probePage = commentProbePageId ?? (feedbackSelection.kind === "create" ? feedbackSelection.parentPageId : feedback.databaseId);
-  await writeFile2(
-    join2(destination, ".dev.vars"),
+  await writeFile3(
+    join3(destination, ".dev.vars"),
     `NOTION_COMMENT_CAPABILITY_PROBE_PAGE_ID=${JSON.stringify(probePage)}
 `,
     { flag: "a", mode: 384 }
@@ -3019,12 +3200,12 @@ try {
   const args = process.argv.slice(2);
   if (args.includes("--help") || args.includes("-h")) {
     console.log(
-      "Usage: create-feedbax [directory] [--template-only]\nGuided setup prompts for a destination, product, Notion connection, features, and deployment.\n--template-only copies source without external requests or installing dependencies."
+      "Usage: create-feedbax [directory] [--template-only]\nGuided setup prompts for a destination, product, Notion or GitHub connection, features, and deployment.\n--template-only copies source without external requests or installing dependencies."
     );
   } else if (args.includes("--version")) {
     console.log(
       JSON.parse(
-        await readFile3(new URL("../package.json", import.meta.url), "utf8")
+        await readFile4(new URL("../package.json", import.meta.url), "utf8")
       ).version
     );
   } else {
@@ -3053,163 +3234,181 @@ try {
         "Cloudflare Worker name (choose a distinct name for this product)",
         basename2(destination).toLowerCase().replace(/[^a-z0-9-]/g, "-")
       );
-      const connected = await confirm2(
-        "Enable Connected Profile using your application's sign-in, dedicated D1, and a processing queue? Small processing supports Workers Free with Resend/custom email.",
-        false
-      ) ? {
-        issuer: await text4("Application identity issuer (HTTPS URL)"),
-        loginUrl: await text4(
-          "Application signed-handoff login URL (HTTPS)"
-        ),
-        databaseId: await text4("Dedicated Cloudflare D1 database ID"),
-        databaseName: await text4("Dedicated Cloudflare D1 database name"),
-        queueName: await text4(
-          "Dedicated Cloudflare Queue name (create it with wrangler queues create first)",
-          defaultProcessingQueueName(workerName)
-        ),
-        handoffSecret: await secret(
-          "Shared server-only identity handoff secret (at least 32 characters)"
-        )
-      } : void 0;
-      let email;
-      let imageBucket;
-      if (connected) {
-        const provider = await text4(
-          "Email sender: cloudflare, resend, custom, or none",
-          "none"
-        );
-        if (provider !== "none") {
-          if (provider !== "cloudflare" && provider !== "resend" && provider !== "custom")
-            throw new Error(
-              "Email sender must be cloudflare, resend, custom, or none."
+      const provider = checked(
+        await prompt.select({
+          message: "Content Provider",
+          options: [
+            { value: "notion", label: "Notion" },
+            { value: "github", label: "GitHub" }
+          ]
+        })
+      );
+      if (provider === "github") {
+        await githubSetup(destination, product, workerName);
+      } else {
+        const connected = await confirm2(
+          "Enable Connected Profile using your application's sign-in, dedicated D1, and a processing queue? Small processing supports Workers Free with Resend/custom email.",
+          false
+        ) ? {
+          issuer: await text4("Application identity issuer (HTTPS URL)"),
+          loginUrl: await text4(
+            "Application signed-handoff login URL (HTTPS)"
+          ),
+          databaseId: await text4("Dedicated Cloudflare D1 database ID"),
+          databaseName: await text4("Dedicated Cloudflare D1 database name"),
+          queueName: await text4(
+            "Dedicated Cloudflare Queue name (create it with wrangler queues create first)",
+            defaultProcessingQueueName(workerName)
+          ),
+          handoffSecret: await secret(
+            "Shared server-only identity handoff secret (at least 32 characters)"
+          )
+        } : void 0;
+        let email;
+        let imageBucket;
+        if (connected) {
+          const provider2 = await text4(
+            "Email sender: cloudflare, resend, custom, or none",
+            "none"
+          );
+          if (provider2 !== "none") {
+            if (provider2 !== "cloudflare" && provider2 !== "resend" && provider2 !== "custom")
+              throw new Error(
+                "Email sender must be cloudflare, resend, custom, or none."
+              );
+            email = {
+              provider: provider2,
+              from: await text4("Verified sender email address"),
+              ...provider2 === "custom" ? { endpoint: await text4("Custom HTTPS delivery endpoint") } : {},
+              ...provider2 !== "cloudflare" ? { secret: await secret("Server-only email provider secret") } : {}
+            };
+          }
+          if (await confirm2(
+            "Enable Participant image attachments using an existing private R2 bucket?",
+            false
+          ))
+            imageBucket = await text4(
+              "Dedicated private R2 bucket name (create it in Cloudflare first)"
             );
-          email = {
-            provider,
-            from: await text4("Verified sender email address"),
-            ...provider === "custom" ? { endpoint: await text4("Custom HTTPS delivery endpoint") } : {},
-            ...provider !== "cloudflare" ? { secret: await secret("Server-only email provider secret") } : {}
-          };
         }
-        if (await confirm2(
-          "Enable Participant image attachments using an existing private R2 bucket?",
+        const themePreset = await text4(
+          "shadcn preset code, or lyra-neutral for the included preset",
+          "lyra-neutral"
+        );
+        const notionToken = process.env.NOTION_TOKEN?.trim() || await secret("Notion internal integration token");
+        const existing = await confirm2(
+          "Use an existing compatible Feedback Data Source?",
           false
-        ))
-          imageBucket = await text4(
-            "Dedicated private R2 bucket name (create it in Cloudflare first)"
-          );
-      }
-      const themePreset = await text4(
-        "shadcn preset code, or lyra-neutral for the included preset",
-        "lyra-neutral"
-      );
-      const notionToken = process.env.NOTION_TOKEN?.trim() || await secret("Notion internal integration token");
-      const existing = await confirm2(
-        "Use an existing compatible Feedback Data Source?",
-        false
-      );
-      const feedbackSelection = existing ? { kind: "existing", configuration: await existingFeedback() } : {
-        kind: "create",
-        parentPageId: await text4(
-          "Notion parent page ID (share it with the integration)"
-        )
-      };
-      const features = await collectFeatureSelection({
-        confirm: ({ message, initialValue }) => confirm2(message, initialValue)
-      });
-      const commentProbePageId = existing && features.comments ? await text4("Shared Notion page ID for checking Comment permissions") : void 0;
-      const changelogSelection = features.changelog && await confirm2(
-        "Use an existing compatible Changelog Data Source?",
-        false
-      ) ? {
-        kind: "existing",
-        dataSourceId: await text4("Changelog Data Source ID"),
-        propertyIds: await propertyIds([
-          "title",
-          "slug",
-          "date",
-          "summary",
-          "body",
-          "labels",
-          "image",
-          "published",
-          "createdAt",
-          "updatedAt"
-        ])
-      } : void 0;
-      const turnstile = await confirm2(
-        "Enable Cloudflare Turnstile? Recommended for production.",
-        true
-      ) ? {
-        siteKey: await text4("Turnstile site key"),
-        secretKey: process.env.TURNSTILE_SECRET_KEY || await secret("Turnstile secret key")
-      } : {};
-      const result = await provisionGuidedInstallation({
-        destination,
-        product,
-        themePreset,
-        workerName,
-        commentProbePageId,
-        connected: connected ? {
-          ...connected,
-          ...email ? { email } : {},
-          ...imageBucket ? { imageBucket } : {}
-        } : void 0,
-        features,
-        feedbackSelection,
-        changelogSelection,
-        notionToken,
-        turnstile,
-        preview: (message) => confirm2(message, false)
-      });
-      console.log(
-        `Created ${destination}.
+        );
+        const feedbackSelection = existing ? {
+          kind: "existing",
+          configuration: await existingFeedback()
+        } : {
+          kind: "create",
+          parentPageId: await text4(
+            "Notion parent page ID (share it with the integration)"
+          )
+        };
+        const features = await collectFeatureSelection({
+          confirm: ({ message, initialValue }) => confirm2(message, initialValue)
+        });
+        const commentProbePageId = existing && features.comments ? await text4(
+          "Shared Notion page ID for checking Comment permissions"
+        ) : void 0;
+        const changelogSelection = features.changelog && await confirm2(
+          "Use an existing compatible Changelog Data Source?",
+          false
+        ) ? {
+          kind: "existing",
+          dataSourceId: await text4("Changelog Data Source ID"),
+          propertyIds: await propertyIds([
+            "title",
+            "slug",
+            "date",
+            "summary",
+            "body",
+            "labels",
+            "image",
+            "published",
+            "createdAt",
+            "updatedAt"
+          ])
+        } : void 0;
+        const turnstile = await confirm2(
+          "Enable Cloudflare Turnstile? Recommended for production.",
+          true
+        ) ? {
+          siteKey: await text4("Turnstile site key"),
+          secretKey: process.env.TURNSTILE_SECRET_KEY || await secret("Turnstile secret key")
+        } : {};
+        const result = await provisionGuidedInstallation({
+          destination,
+          product,
+          themePreset,
+          workerName,
+          commentProbePageId,
+          connected: connected ? {
+            ...connected,
+            ...email ? { email } : {},
+            ...imageBucket ? { imageBucket } : {}
+          } : void 0,
+          features,
+          feedbackSelection,
+          changelogSelection,
+          notionToken,
+          turnstile,
+          preview: (message) => confirm2(message, false)
+        });
+        console.log(
+          `Created ${destination}.
 Trusted API key \u2014 copy it now; plaintext is not stored:
 ${result.apiKey}`
-      );
-      await runIn(destination, "pnpm", ["install"]);
-      if (themePreset !== "lyra-neutral")
-        await runIn(destination, "pnpm", [
-          "dlx",
-          "shadcn@latest",
-          "init",
-          "--preset",
-          themePreset,
-          "--yes",
-          "--force"
-        ]);
-      await runIn(destination, "pnpm", [
-        "exec",
-        "prettier",
-        "--write",
-        "src/feedbax.ts"
-      ]);
-      if (connected) {
-        if (!await confirm2(
-          `Apply the included Connected schema migration to D1 ${connected.databaseName} (${connected.databaseId}) in your authenticated Cloudflare account?`,
-          false
-        ))
-          throw new Error(
-            "Connected source is preserved. Apply the D1 migration described in CONNECTED.md before running doctor or deploying."
-          );
+        );
+        await runIn(destination, "pnpm", ["install"]);
+        if (themePreset !== "lyra-neutral")
+          await runIn(destination, "pnpm", [
+            "dlx",
+            "shadcn@latest",
+            "init",
+            "--preset",
+            themePreset,
+            "--yes",
+            "--force"
+          ]);
         await runIn(destination, "pnpm", [
           "exec",
-          "wrangler",
-          "d1",
-          "migrations",
-          "apply",
-          "FEEDBAX_DB",
-          "--remote"
+          "prettier",
+          "--write",
+          "src/feedbax.ts"
         ]);
+        if (connected) {
+          if (!await confirm2(
+            `Apply the included Connected schema migration to D1 ${connected.databaseName} (${connected.databaseId}) in your authenticated Cloudflare account?`,
+            false
+          ))
+            throw new Error(
+              "Connected source is preserved. Apply the D1 migration described in CONNECTED.md before running doctor or deploying."
+            );
+          await runIn(destination, "pnpm", [
+            "exec",
+            "wrangler",
+            "d1",
+            "migrations",
+            "apply",
+            "FEEDBAX_DB",
+            "--remote"
+          ]);
+        }
+        await runIn(destination, "pnpm", ["exec", "feedbax", "doctor"]);
+        if (await confirm2(
+          "Authenticate with Cloudflare and deploy this portal?",
+          false
+        )) {
+          await runIn(destination, "pnpm", ["exec", "wrangler", "login"]);
+          await runIn(destination, "pnpm", ["exec", "feedbax", "deploy"]);
+        }
+        prompt.outro(`Your portal source is ready in ${destination}.`);
       }
-      await runIn(destination, "pnpm", ["exec", "feedbax", "doctor"]);
-      if (await confirm2(
-        "Authenticate with Cloudflare and deploy this portal?",
-        false
-      )) {
-        await runIn(destination, "pnpm", ["exec", "wrangler", "login"]);
-        await runIn(destination, "pnpm", ["exec", "feedbax", "deploy"]);
-      }
-      prompt.outro(`Your portal source is ready in ${destination}.`);
     }
   }
 } catch (error) {
@@ -3287,3 +3486,97 @@ function runIn(cwd, command, args) {
     );
   });
 }
+async function githubSetup(destination, product, workerName) {
+  const serviceUrl = await text4(
+    "GitHub App service HTTPS origin (official or your self-hosted service)"
+  );
+  const infoResponse = await fetch(`${serviceUrl}/v1/info`, {
+    redirect: "manual"
+  });
+  if (!infoResponse.ok)
+    throw new Error(
+      "The App service is unavailable. Configure it before portal setup."
+    );
+  const info = await infoResponse.json();
+  if (!Number.isSafeInteger(info.botUserId))
+    throw new Error("The service did not return a valid App identity.");
+  const database = {
+    id: await text4(
+      "Dedicated Cloudflare D1 database ID (required independently of sign-in)"
+    ),
+    name: await text4("Dedicated D1 database name")
+  };
+  const result = await provisionGitHubInstallation({
+    destination,
+    product,
+    workerName,
+    database,
+    github: {
+      serviceUrl,
+      installationId: await text4("Stable Feedbax Installation ID", workerName),
+      repository: {
+        id: Number(
+          await text4(
+            "Feedback Repository numeric ID (gh api repos/OWNER/NAME --jq .id)"
+          )
+        ),
+        owner: await text4("Repository owner"),
+        name: await text4("Repository name")
+      },
+      botUserId: info.botUserId
+    },
+    features: {
+      voting: await confirm2("Enable best-effort browser voting?", true),
+      comments: await confirm2("Enable portal Comments?", true),
+      changelog: false
+    },
+    turnstile: await confirm2("Enable Cloudflare Turnstile?", true) ? {
+      siteKey: await text4("Turnstile site key"),
+      secretKey: await secret("Turnstile secret key")
+    } : {},
+    preview: (message) => confirm2(message, false)
+  });
+  console.log(
+    `Created ${destination}. Trusted API key \u2014 copy it now; plaintext is not stored:
+${result.apiKey}`
+  );
+  await runIn(destination, "pnpm", ["install"]);
+  await runIn(destination, "pnpm", [
+    "exec",
+    "prettier",
+    "--write",
+    "src/feedbax.ts"
+  ]);
+  if (await confirm2(
+    `Apply included additive migrations to D1 ${database.name}?`,
+    false
+  ))
+    await runIn(destination, "pnpm", [
+      "exec",
+      "wrangler",
+      "d1",
+      "migrations",
+      "apply",
+      "FEEDBAX_DB",
+      "--remote"
+    ]);
+  if (await confirm2("Deploy the unpaired portal for GitHub authorization?", false))
+    await runIn(destination, "pnpm", [
+      "exec",
+      "feedbax",
+      "deploy",
+      "--pairing-bootstrap"
+    ]);
+  const installationId = await text4(
+    "GitHub App installation ID from the App installation page"
+  );
+  await runIn(destination, "pnpm", [
+    "exec",
+    "feedbax",
+    "pair-github",
+    installationId
+  ]);
+  prompt.outro(
+    "Finish the GitHub authorization, then run feedbax doctor. Connected identity can be configured independently using CONNECTED.md."
+  );
+}