hatchkit 0.1.42 → 0.1.43

package/dist/adopt.js

@@ -33,7 +33,7 @@
  * a second run on the same dir notices the existing manifest and
  * exits early with a "use `hatchkit update` instead" hint.
  */
-import { existsSync, readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { join, relative } from "node:path";
 import { Separator, confirm, input, select } from "@inquirer/prompts";
 import chalk from "chalk";
@@ -43,6 +43,7 @@ import { pushInitialBranch } from "./deploy/github.js";
 import { pushProjectKeyToCoolify, pushProjectKeyToGh } from "./deploy/keys.js";
 import { handleAdoptFailure } from "./deploy/rollback.js";
 import { runProvision } from "./provision/index.js";
+import { readEnvKeys } from "./provision/write-env.js";
 import { detectBuildPipeline, scaffoldBuildPipeline } from "./scaffold/build-pipeline.js";
 import { MANIFEST_FILENAME, readManifest, writeManifest, } from "./scaffold/manifest.js";
 import { installCancelHandler, isCancelInProgress, uninstallCancelHandler, } from "./utils/cancel-handler.js";
@@ -143,7 +144,13 @@ export async function runAdopt(cwd, opts = {}) {
         //      private one and produces "permission denied" on deploy.
         isPrivate: state.gitRemoteIsPrivate ?? true,
         appPort: "3000",
-        scaffoldBuildPipeline: true,
+        // Pipeline scaffold defaults OFF when the layout is unrecognised.
+        // The Dockerfile templates assume a single-package project rooted
+        // at /; for a workspace with no standard server/client dirs the
+        // generated files build the wrong thing (or nothing). User can
+        // still flip this on in the review loop — buildAdoptGroups parks
+        // the cursor on the row in this case so the choice is explicit.
+        scaffoldBuildPipeline: !state.unknownWorkspaceLayout,
         // Provisioning is opt-in. Each service mints real resources on a
         // third-party (GlitchTip project, OpenPanel project, Resend API
         // key) and cleaning those up after the fact is a chore — better
@@ -209,7 +216,7 @@ export async function runAdopt(cwd, opts = {}) {
 // ---------------------------------------------------------------------------
 // Detection
 // ---------------------------------------------------------------------------
-async function detectProject(projectDir) {
+export async function detectProject(projectDir) {
     const hasManifest = existsSync(join(projectDir, MANIFEST_FILENAME));
     const existingManifest = hasManifest ? (readManifest(projectDir) ?? undefined) : undefined;
     let packageName;
@@ -228,6 +235,31 @@ async function detectProject(projectDir) {
     catch {
         // No package.json at root — that's fine for a non-Node project.
     }
+    // Workspace markers — pnpm, yarn/npm, turbo, lerna, rush. When a
+    // marker is present but the standard server/client dir scan below
+    // turns up nothing, we're looking at a layout the scaffolder's
+    // surface-based Dockerfile templates can't handle. Flagged below as
+    // `unknownWorkspaceLayout`.
+    const workspaceMarkers = [
+        "pnpm-workspace.yaml",
+        "pnpm-workspace.yml",
+        "turbo.json",
+        "lerna.json",
+        "rush.json",
+    ];
+    let hasWorkspaceMarker = workspaceMarkers.some((f) => existsSync(join(projectDir, f)));
+    if (!hasWorkspaceMarker) {
+        // npm/yarn workspaces live as a `workspaces` field inside the root
+        // package.json (string array or { packages: [...] } object).
+        try {
+            const rootPkg = JSON.parse(readFileSync(join(projectDir, "package.json"), "utf-8"));
+            if (rootPkg.workspaces)
+                hasWorkspaceMarker = true;
+        }
+        catch {
+            // No / unreadable root package.json — leave hasWorkspaceMarker false.
+        }
+    }
     // Walk a generous set of common monorepo layouts.
     const serverDir = firstExisting(projectDir, [
         "packages/server",
@@ -349,6 +381,10 @@ async function detectProject(projectDir) {
             // undefined and let the stepper fall back to a sensible default.
         }
     }
+    const unknownWorkspaceLayout = hasWorkspaceMarker && !serverDir && !clientDir;
+    const standaloneBuildCandidates = unknownWorkspaceLayout
+        ? findStandaloneBuildCandidates(projectDir)
+        : [];
     return {
         projectDir,
         packageName,
@@ -356,6 +392,8 @@ async function detectProject(projectDir) {
         hasManifest,
         serverDir,
         clientDir,
+        unknownWorkspaceLayout,
+        standaloneBuildCandidates,
         features,
         prodEnvIsEncrypted,
         hasEnvKeys,
@@ -368,6 +406,57 @@ async function detectProject(projectDir) {
         existingManifest,
     };
 }
+/** Scan first-level subdirs for a standalone-buildable project — own
+ *  `package.json` AND its own lockfile (the marker that pnpm/npm/yarn
+ *  would install it independently of the parent workspace). `.npmrc`
+ *  with `ignore-workspace=true` is a stronger signal: that's the
+ *  explicit "treat me as standalone" toggle Docusaurus / marketing
+ *  sites use when they live next to a CLI workspace.
+ *
+ *  Returns first-level matches only; we don't recurse because the
+ *  intent is "show the user a starting point", not enumerate every
+ *  buildable subtree. */
+function findStandaloneBuildCandidates(projectDir) {
+    const out = [];
+    let entries;
+    try {
+        entries = readdirSync(projectDir);
+    }
+    catch {
+        return out;
+    }
+    for (const name of entries) {
+        if (name.startsWith(".") || name === "node_modules")
+            continue;
+        const dir = join(projectDir, name);
+        let isDir = false;
+        try {
+            isDir = statSync(dir).isDirectory();
+        }
+        catch {
+            continue;
+        }
+        if (!isDir)
+            continue;
+        if (!existsSync(join(dir, "package.json")))
+            continue;
+        const hasOwnLockfile = existsSync(join(dir, "pnpm-lock.yaml")) ||
+            existsSync(join(dir, "package-lock.json")) ||
+            existsSync(join(dir, "yarn.lock"));
+        if (!hasOwnLockfile)
+            continue;
+        let hasIgnoreWorkspace = false;
+        try {
+            const npmrc = readFileSync(join(dir, ".npmrc"), "utf-8");
+            hasIgnoreWorkspace = /^\s*ignore-workspace\s*=\s*true\s*$/m.test(npmrc);
+        }
+        catch {
+            // No .npmrc — still a candidate (own lockfile is the main signal).
+        }
+        out.push({ dir, hasIgnoreWorkspace });
+    }
+    return out;
+}
 function firstExisting(root, candidates) {
     for (const c of candidates) {
         const full = join(root, c);
@@ -500,6 +589,22 @@ function printDetected(state) {
             ? chalk.yellow("repo present, no `origin` set")
             : chalk.dim("not a git repo yet")));
     lines.push(row("features (guess)", state.features.length > 0 ? state.features.join(", ") : chalk.dim("none detected")));
+    if (state.unknownWorkspaceLayout) {
+        lines.push("");
+        lines.push(chalk.yellow("  ! Workspace marker detected (pnpm-workspace.yaml / workspaces / turbo / lerna)"));
+        lines.push(chalk.yellow("    but no standard server/client dir matched. Adopt will skip the Docker"));
+        lines.push(chalk.yellow("    + GH Actions pipeline scaffold — the templates assume a single-package"));
+        lines.push(chalk.yellow("    project and would build the wrong thing here."));
+        if (state.standaloneBuildCandidates.length > 0) {
+            lines.push("");
+            lines.push(chalk.dim("    Standalone-buildable subdirs (own lockfile):"));
+            for (const c of state.standaloneBuildCandidates) {
+                const tag = c.hasIgnoreWorkspace ? chalk.green("  ignore-workspace=true") : "";
+                lines.push(chalk.dim(`      · ${relativeTo(c.dir)}${tag}`));
+            }
+            lines.push(chalk.dim("    Point a hand-authored Dockerfile at one of those and re-run adopt."));
+        }
+    }
     for (const l of lines)
         console.log(l);
     console.log();
@@ -677,7 +782,10 @@ function buildAdoptGroups(state, plan) {
                         {
                             key: "scaffoldBuildPipeline",
                             label: "Docker + GH Actions",
-                            set: true,
+                            // Park cursor here when the layout is unrecognised — the
+                            // user should make an explicit yes/no rather than walk
+                            // past a defaulted-off row without seeing it.
+                            set: !state.unknownWorkspaceLayout,
                             summary: renderBuildPipelineSummary(state, plan),
                         },
                     ],
@@ -1048,6 +1156,47 @@ async function editAdoptStep(state, plan, step) {
     }
     return plan;
 }
+/** Canonical env key per service — used by `filterServicesForResume`
+ *  to decide whether a service's credentials are already wired into
+ *  the project's env files. If the key is present, re-minting on a
+ *  resume would orphan whatever's there (Resend mints a fresh API
+ *  key each call; OpenPanel mints a fresh project; Stripe re-creates
+ *  the webhook endpoint). `email` is intentionally absent — Email
+ *  Routing is zone-state with no env footprint, and its provisioner
+ *  is already 409-idempotent. */
+const RESUME_SERVICE_ENV_KEY = {
+    glitchtip: { server: "GLITCHTIP_DSN", client: "PUBLIC_GLITCHTIP_DSN" },
+    openpanel: { server: "OPENPANEL_CLIENT_ID", client: "PUBLIC_OPENPANEL_CLIENT_ID" },
+    resend: { server: "RESEND_API_KEY" },
+    s3: { server: "R2_ENDPOINT" },
+    email: {},
+};
+/** Filter the services list for `runProvision` on `--resume`: drop
+ *  every service whose canonical env keys are already in the target
+ *  env files. A non-resume run returns the list unchanged. */
+function filterServicesForResume(args) {
+    if (!args.resume)
+        return args.services;
+    const serverKeys = args.serverEnvPath ? readEnvKeys(args.serverEnvPath) : new Set();
+    const clientKeys = args.clientEnvPath ? readEnvKeys(args.clientEnvPath) : new Set();
+    const kept = [];
+    for (const svc of args.services) {
+        const want = RESUME_SERVICE_ENV_KEY[svc];
+        if (!want || (!want.server && !want.client)) {
+            kept.push(svc);
+            continue;
+        }
+        const serverOk = !want.server || serverKeys.has(want.server);
+        const clientOk = !want.client || clientKeys.has(want.client);
+        if (serverOk && clientOk) {
+            const which = [want.server, want.client].filter(Boolean).join(" + ");
+            console.log(chalk.dim(`  · Skipping ${svc} on --resume — ${which} already in .env.production.`));
+            continue;
+        }
+        kept.push(svc);
+    }
+    return kept;
+}
 async function executePlan(state, plan, opts = { resume: false }) {
     console.log(chalk.bold("\n  ── Adopting ──────────────────────────────────────────────\n"));
     const caveats = [];
@@ -1272,11 +1421,35 @@ async function executePlan(state, plan, opts = { resume: false }) {
         if (plan.scaffoldBuildPipeline && plan.deploymentMode === "coolify" && appUuidForSecrets) {
             const slug = repoSlugFromRemote(remoteUrl);
             if (slug) {
-                await setCoolifyDeploySecrets({
-                    projectDir: state.projectDir,
-                    repoSlug: slug,
-                    apps: [{ uuid: appUuidForSecrets }],
-                });
+                // --resume gate: if every secret this step would push is
+                // already present on the repo, skip the push. The values
+                // themselves aren't readable through `gh secret list` (write-
+                // only), so we trust name-presence as the signal — same
+                // contract `ghSecretExists` uses for the ledger-record gate
+                // below. The user's recourse for a rotated Coolify token is
+                // re-running adopt *without* --resume.
+                const coolifySecretNames = [
+                    "COOLIFY_BASE_URL",
+                    "COOLIFY_API_TOKEN",
+                    "COOLIFY_TOKEN",
+                    "COOLIFY_WEBHOOK_URL",
+                    "COOLIFY_RESOURCE_UUID",
+                ];
+                let skipCoolifySecrets = false;
+                if (opts.resume) {
+                    const checks = await Promise.all(coolifySecretNames.map((n) => ghSecretExists(state.projectDir, slug, n)));
+                    if (checks.every(Boolean)) {
+                        skipCoolifySecrets = true;
+                        console.log(chalk.dim(`  · Skipping Coolify GH Actions secrets on --resume — all ${coolifySecretNames.length} already on ${slug}.`));
+                    }
+                }
+                if (!skipCoolifySecrets) {
+                    await setCoolifyDeploySecrets({
+                        projectDir: state.projectDir,
+                        repoSlug: slug,
+                        apps: [{ uuid: appUuidForSecrets }],
+                    });
+                }
             }
             else {
                 console.log(chalk.dim("  · Couldn't resolve owner/repo from git remote — set the deploy secrets manually."));
@@ -1305,21 +1478,26 @@ async function executePlan(state, plan, opts = { resume: false }) {
                 // we're the creator preserves the "destroy never deletes
                 // pre-existing user data" invariant — see LedgerStep doc.
                 const preExisted = await ghSecretExists(state.projectDir, slug, secretName);
-                try {
-                    await pushProjectKeyToGh(plan.name, slug);
-                    if (!preExisted) {
-                        ledger.record({ kind: "ghActionsSecret", repo: slug, name: secretName });
-                    }
+                if (opts.resume && preExisted) {
+                    console.log(chalk.dim(`  · Skipping ${secretName} push on --resume — secret already on ${slug}.`));
                 }
-                catch (err) {
-                    caveats.push({
-                        title: `${secretName} not set on GitHub Actions`,
-                        reason: err.message,
-                        recovery: [
-                            `hatchkit keys push ${plan.name} --target gh --repo ${slug}`,
-                            `(or copy from \`hatchkit keys show ${plan.name}\` and run \`gh secret set ${secretName} --repo ${slug} --body <key>\`)`,
-                        ],
-                    });
+                else {
+                    try {
+                        await pushProjectKeyToGh(plan.name, slug);
+                        if (!preExisted) {
+                            ledger.record({ kind: "ghActionsSecret", repo: slug, name: secretName });
+                        }
+                    }
+                    catch (err) {
+                        caveats.push({
+                            title: `${secretName} not set on GitHub Actions`,
+                            reason: err.message,
+                            recovery: [
+                                `hatchkit keys push ${plan.name} --target gh --repo ${slug}`,
+                                `(or copy from \`hatchkit keys show ${plan.name}\` and run \`gh secret set ${secretName} --repo ${slug} --body <key>\`)`,
+                            ],
+                        });
+                    }
                 }
             }
             else if (remoteUrl) {
@@ -1513,7 +1691,23 @@ async function executePlan(state, plan, opts = { resume: false }) {
         // to a normal `hatchkit add`. Forward the surface choice — runProvision
         // uses the same vocabulary, so a client-only adopt produces a
         // client-only `add`.
-        if (plan.services.length > 0) {
+        //
+        // --resume contract: filter out services whose canonical env keys
+        // are already present in the target env files. Re-minting Resend
+        // keys / OpenPanel projects / Stripe webhooks on every resume
+        // orphans live credentials and rotates secrets the user didn't
+        // ask to rotate. The keychain caches some of these per-service,
+        // but those caches don't survive a fresh machine — the env file
+        // is the durable signal, so we trust it. A service is re-included
+        // if it's newly in `plan.services` (added since the last attempt)
+        // or its canonical env key is missing.
+        const resumeServices = filterServicesForResume({
+            services: plan.services,
+            resume: opts.resume === true,
+            serverEnvPath: plan.serverDir ? join(plan.serverDir, ".env.production") : null,
+            clientEnvPath: plan.clientDir ? join(plan.clientDir, ".env.production") : null,
+        });
+        if (resumeServices.length > 0) {
             console.log();
             const provisionMode = plan.surfaces === "both"
                 ? "shared"
@@ -1522,7 +1716,7 @@ async function executePlan(state, plan, opts = { resume: false }) {
                     : "client-only";
             await runProvision({
                 baseName: plan.name,
-                services: plan.services,
+                services: resumeServices,
                 surfaces: {
                     mode: provisionMode,
                     serverEnvDir: plan.serverDir,
@@ -1592,96 +1786,117 @@ async function executePlan(state, plan, opts = { resume: false }) {
         // (globally via `hatchkit config add s3 r2`, which re-pastes +
         // verifies it) and re-run `hatchkit provision s3` to finish.
         if (plan.features.includes("s3")) {
-            try {
-                const { provisionS3ForProject, defaultBucketHostname, existingCustomHostname } = await import("./provision/s3-buckets.js");
-                // Resolve the public assets-bucket custom domain. If a previous
-                // run already attached one, the manifest records it — reuse
-                // that without re-prompting. Only ask on first adopt (or when
-                // the manifest has no hostname yet, e.g. a previous run picked
-                // the managed r2.dev URL or never got that far). Blank answer →
-                // managed r2.dev.
-                let publicHostname;
-                const existingManifest = readManifest(state.projectDir);
-                const recordedHostname = existingManifest ? existingCustomHostname(existingManifest) : null;
-                if (recordedHostname) {
-                    publicHostname = recordedHostname;
-                }
-                else if (process.stdin.isTTY) {
-                    const answer = (await input({
-                        message: "Custom domain for the public assets bucket (leave empty to use the managed r2.dev URL):",
-                        default: defaultBucketHostname(plan.domain),
-                    })).trim();
-                    publicHostname = answer === "" ? null : answer;
-                }
-                // Only create the public assets bucket here. The private "state"
-                // bucket is an explicit opt-in even when the project has a
-                // server — most don't need it, and adding one silently means
-                // an extra R2 bucket + env var the user has to clean up later.
-                // Users who want one re-run `hatchkit provision s3 --with-state-bucket`.
-                const r = await provisionS3ForProject({
-                    projectDir: state.projectDir,
-                    publicHostname,
-                });
-                // Ledger: record any *fresh* bucket creations + a fresh token
-                // mint so destroy can revoke them. Reused buckets/tokens (from
-                // a prior adopt run) stay out — those are already in the
-                // earlier run's ledger or pre-existed before hatchkit ran.
-                if (r.assets.created) {
-                    ledger.record({
-                        kind: "r2Bucket",
-                        bucketName: r.assets.name,
-                        accountId: r.accountId,
-                    });
-                }
-                if (r.state?.created) {
-                    ledger.record({
-                        kind: "r2Bucket",
-                        bucketName: r.state.name,
-                        accountId: r.accountId,
+            // --resume gate: when the manifest already records the assets
+            // bucket AND .env.production has a working access/secret pair,
+            // there's nothing to provision. Skip the whole step rather than
+            // re-attaching custom domains / re-reconciling CORS / re-probing
+            // tokens, all of which are network round-trips with no payoff
+            // when nothing has changed since the last attempt.
+            const s3ManifestSnapshot = readManifest(state.projectDir);
+            const s3EnvPath = join(state.projectDir, ".env.production");
+            const s3EnvKeys = readEnvKeys(s3EnvPath);
+            const s3HasEnvCreds = (s3EnvKeys.has("R2_ACCESS_KEY_ID") && s3EnvKeys.has("R2_SECRET_ACCESS_KEY")) ||
+                (s3EnvKeys.has("S3_ACCESS_KEY_ID") && s3EnvKeys.has("S3_SECRET_ACCESS_KEY")) ||
+                (s3EnvKeys.has("AWS_ACCESS_KEY_ID") && s3EnvKeys.has("AWS_SECRET_ACCESS_KEY"));
+            const s3ManifestComplete = !!s3ManifestSnapshot?.s3Buckets?.assets?.name;
+            const s3AlreadyWired = opts.resume && s3HasEnvCreds && s3ManifestComplete;
+            if (s3AlreadyWired) {
+                console.log(chalk.dim(`  · Skipping S3 on --resume — manifest records ${s3ManifestSnapshot?.s3Buckets?.assets?.name} and .env.production has access/secret keys.`));
+            }
+            else {
+                try {
+                    const { provisionS3ForProject, defaultBucketHostname, existingCustomHostname } = await import("./provision/s3-buckets.js");
+                    // Resolve the public assets-bucket custom domain. If a previous
+                    // run already attached one, the manifest records it — reuse
+                    // that without re-prompting. Only ask on first adopt (or when
+                    // the manifest has no hostname yet, e.g. a previous run picked
+                    // the managed r2.dev URL or never got that far). Blank answer →
+                    // managed r2.dev.
+                    let publicHostname;
+                    const existingManifest = readManifest(state.projectDir);
+                    const recordedHostname = existingManifest
+                        ? existingCustomHostname(existingManifest)
+                        : null;
+                    if (recordedHostname) {
+                        publicHostname = recordedHostname;
+                    }
+                    else if (process.stdin.isTTY) {
+                        const answer = (await input({
+                            message: "Custom domain for the public assets bucket (leave empty to use the managed r2.dev URL):",
+                            default: defaultBucketHostname(plan.domain),
+                        })).trim();
+                        publicHostname = answer === "" ? null : answer;
+                    }
+                    // Only create the public assets bucket here. The private "state"
+                    // bucket is an explicit opt-in even when the project has a
+                    // server — most don't need it, and adding one silently means
+                    // an extra R2 bucket + env var the user has to clean up later.
+                    // Users who want one re-run `hatchkit provision s3 --with-state-bucket`.
+                    const r = await provisionS3ForProject({
+                        projectDir: state.projectDir,
+                        publicHostname,
                     });
+                    // Ledger: record any *fresh* bucket creations + a fresh token
+                    // mint so destroy can revoke them. Reused buckets/tokens (from
+                    // a prior adopt run) stay out — those are already in the
+                    // earlier run's ledger or pre-existed before hatchkit ran.
+                    if (r.assets.created) {
+                        ledger.record({
+                            kind: "r2Bucket",
+                            bucketName: r.assets.name,
+                            accountId: r.accountId,
+                        });
+                    }
+                    if (r.state?.created) {
+                        ledger.record({
+                            kind: "r2Bucket",
+                            bucketName: r.state.name,
+                            accountId: r.accountId,
+                        });
+                    }
+                    if (r.tokenCreated) {
+                        ledger.record({
+                            kind: "r2Token",
+                            tokenId: r.tokenCreated.tokenId,
+                            accountId: r.accountId,
+                            audience: r.tokenCreated.audience,
+                        });
+                    }
+                    console.log(chalk.green(`  ✓ S3 assets bucket ready — ${r.assets.publicUrl}`));
+                    console.log(chalk.dim(`    Wrote ${r.envWritten.length} encrypted entries. ` +
+                        "(Need a private server-side bucket too? Run `hatchkit provision s3 --with-state-bucket`.)"));
+                    // The fresh bucket is empty. Existing projects almost always
+                    // have assets sitting in some other store — surface the one
+                    // command that copies them in. Cheap line to print, easy to
+                    // miss without it.
+                    console.log(chalk.dim(`    Have existing assets to bring over? hatchkit assets migrate \\\n` +
+                        `      --from-endpoint=<old-s3-endpoint> --from-bucket=<name> \\\n` +
+                        `      --from-key=<access-key> --from-secret=<secret>`));
                 }
-                if (r.tokenCreated) {
-                    ledger.record({
-                        kind: "r2Token",
-                        tokenId: r.tokenCreated.tokenId,
-                        accountId: r.accountId,
-                        audience: r.tokenCreated.audience,
+                catch (err) {
+                    console.log(chalk.yellow(`\n  ✗ S3 bucket provisioning failed: ${err.message.split("\n")[0]}`));
+                    // Two kinds of recovery — pick based on whether the underlying
+                    // error looks like an admin-token problem (global) vs. a
+                    // bucket-side problem (per-project). Admin-token failures point
+                    // the user at the global config command (which validates the
+                    // token); everything else points at the per-project re-runner.
+                    const msg = err.message;
+                    const isAdminTokenIssue = /admin token|invalid api token|9109|10000|10001|HTTP 401|HTTP 403/i.test(msg);
+                    caveats.push({
+                        title: "S3 buckets not provisioned",
+                        reason: msg,
+                        recovery: isAdminTokenIssue
+                            ? [
+                                "Looks like an R2 admin-token problem.",
+                                "Fix globally with: hatchkit config add s3 r2  (re-paste + verify perms)",
+                                `Then re-run from the project dir: cd ${plan.name} && hatchkit provision s3`,
+                            ]
+                            : [
+                                "Once fixed, finish with: hatchkit provision s3",
+                                "(safe to re-run — bucket creation and env writes are idempotent)",
+                            ],
                     });
                 }
-                console.log(chalk.green(`  ✓ S3 assets bucket ready — ${r.assets.publicUrl}`));
-                console.log(chalk.dim(`    Wrote ${r.envWritten.length} encrypted entries. ` +
-                    "(Need a private server-side bucket too? Run `hatchkit provision s3 --with-state-bucket`.)"));
-                // The fresh bucket is empty. Existing projects almost always
-                // have assets sitting in some other store — surface the one
-                // command that copies them in. Cheap line to print, easy to
-                // miss without it.
-                console.log(chalk.dim(`    Have existing assets to bring over? hatchkit assets migrate \\\n` +
-                    `      --from-endpoint=<old-s3-endpoint> --from-bucket=<name> \\\n` +
-                    `      --from-key=<access-key> --from-secret=<secret>`));
-            }
-            catch (err) {
-                console.log(chalk.yellow(`\n  ✗ S3 bucket provisioning failed: ${err.message.split("\n")[0]}`));
-                // Two kinds of recovery — pick based on whether the underlying
-                // error looks like an admin-token problem (global) vs. a
-                // bucket-side problem (per-project). Admin-token failures point
-                // the user at the global config command (which validates the
-                // token); everything else points at the per-project re-runner.
-                const msg = err.message;
-                const isAdminTokenIssue = /admin token|invalid api token|9109|10000|10001|HTTP 401|HTTP 403/i.test(msg);
-                caveats.push({
-                    title: "S3 buckets not provisioned",
-                    reason: msg,
-                    recovery: isAdminTokenIssue
-                        ? [
-                            "Looks like an R2 admin-token problem.",
-                            "Fix globally with: hatchkit config add s3 r2  (re-paste + verify perms)",
-                            `Then re-run from the project dir: cd ${plan.name} && hatchkit provision s3`,
-                        ]
-                        : [
-                            "Once fixed, finish with: hatchkit provision s3",
-                            "(safe to re-run — bucket creation and env writes are idempotent)",
-                        ],
-                });
             }
         }
         // Step 4c: Stripe — strictly separate from `create`'s Stripe block
@@ -1708,55 +1923,69 @@ async function executePlan(state, plan, opts = { resume: false }) {
                     });
                 }
                 else {
-                    const result = await provisionStripeProject({
-                        projectName: plan.name,
-                        domain: plan.domain,
-                    });
+                    // --resume gate: if Stripe keys are already encrypted in
+                    // .env.production AND set in .env.development, the env is
+                    // wired — skip the provisioner entirely. Re-running it on
+                    // a cache miss (e.g. fresh machine) would reprompt for the
+                    // sk/pk and re-create the webhook endpoint, leaving the
+                    // old endpoint orphaned in the user's Stripe dashboard.
                     const devEnvPath = join(plan.serverDir, ".env.development");
                     const prodEnvPath = join(plan.serverDir, ".env.production");
-                    const devLabel = relative(state.projectDir, devEnvPath);
-                    const prodLabel = relative(state.projectDir, prodEnvPath);
-                    if (result.test) {
-                        if (result.test.kind === "skipped") {
-                            appendCommentBlock(devEnvPath, renderStripeSkipComment("test", devLabel));
-                        }
-                        const pairs = parseEnvLines(renderStripeEnv(result.test));
-                        writeDevEnv(devEnvPath, pairs);
-                        if (result.test.kind === "configured") {
-                            ledger.record({
-                                kind: "keychain",
-                                account: SECRET_KEYS.stripeProjectWebhookId(plan.name, "test"),
-                            });
-                        }
-                        console.log(chalk.green(result.test.kind === "skipped"
-                            ? `  ✓ Stripe sandbox placeholders → ${devLabel} (fill in later)`
-                            : `  ✓ Stripe sandbox creds → ${devLabel} (${pairs.length} keys)`));
+                    const stripeAlreadyWired = opts.resume &&
+                        readEnvKeys(prodEnvPath).has("STRIPE_SECRET_KEY") &&
+                        readEnvKeys(devEnvPath).has("STRIPE_SECRET_KEY");
+                    if (stripeAlreadyWired) {
+                        console.log(chalk.dim(`  · Skipping Stripe on --resume — STRIPE_SECRET_KEY present in both .env.production and .env.development.`));
                     }
-                    if (result.live) {
-                        if (result.live.kind === "skipped") {
-                            appendCommentBlock(prodEnvPath, renderStripeSkipComment("live", prodLabel));
+                    else {
+                        const result = await provisionStripeProject({
+                            projectName: plan.name,
+                            domain: plan.domain,
+                        });
+                        const devLabel = relative(state.projectDir, devEnvPath);
+                        const prodLabel = relative(state.projectDir, prodEnvPath);
+                        if (result.test) {
+                            if (result.test.kind === "skipped") {
+                                appendCommentBlock(devEnvPath, renderStripeSkipComment("test", devLabel));
+                            }
+                            const pairs = parseEnvLines(renderStripeEnv(result.test));
+                            writeDevEnv(devEnvPath, pairs);
+                            if (result.test.kind === "configured") {
+                                ledger.record({
+                                    kind: "keychain",
+                                    account: SECRET_KEYS.stripeProjectWebhookId(plan.name, "test"),
+                                });
+                            }
+                            console.log(chalk.green(result.test.kind === "skipped"
+                                ? `  ✓ Stripe sandbox placeholders → ${devLabel} (fill in later)`
+                                : `  ✓ Stripe sandbox creds → ${devLabel} (${pairs.length} keys)`));
                         }
-                        const pairs = parseEnvLines(renderStripeEnv(result.live));
-                        writeProdEnv(prodEnvPath, pairs);
-                        if (result.live.kind === "configured") {
-                            ledger.record({
-                                kind: "keychain",
-                                account: SECRET_KEYS.stripeProjectWebhookId(plan.name, "live"),
+                        if (result.live) {
+                            if (result.live.kind === "skipped") {
+                                appendCommentBlock(prodEnvPath, renderStripeSkipComment("live", prodLabel));
+                            }
+                            const pairs = parseEnvLines(renderStripeEnv(result.live));
+                            writeProdEnv(prodEnvPath, pairs);
+                            if (result.live.kind === "configured") {
+                                ledger.record({
+                                    kind: "keychain",
+                                    account: SECRET_KEYS.stripeProjectWebhookId(plan.name, "live"),
+                                });
+                            }
+                            console.log(chalk.green(result.live.kind === "skipped"
+                                ? `  ✓ Stripe live placeholders → ${prodLabel} (encrypted CHANGE_ME values, fill in later)`
+                                : `  ✓ Stripe live creds → ${prodLabel} (encrypted, ${pairs.length} keys)`));
+                        }
+                        if (!result.test && !result.live) {
+                            caveats.push({
+                                title: "Stripe wiring skipped",
+                                reason: "No Stripe master key configured — neither test nor live mode could be wired.",
+                                recovery: [
+                                    "Run `hatchkit config add stripe` to add at least one master key,",
+                                    `then re-run \`hatchkit adopt --resume\` from ${state.projectDir}.`,
+                                ],
                             });
                         }
-                        console.log(chalk.green(result.live.kind === "skipped"
-                            ? `  ✓ Stripe live placeholders → ${prodLabel} (encrypted CHANGE_ME values, fill in later)`
-                            : `  ✓ Stripe live creds → ${prodLabel} (encrypted, ${pairs.length} keys)`));
-                    }
-                    if (!result.test && !result.live) {
-                        caveats.push({
-                            title: "Stripe wiring skipped",
-                            reason: "No Stripe master key configured — neither test nor live mode could be wired.",
-                            recovery: [
-                                "Run `hatchkit config add stripe` to add at least one master key,",
-                                `then re-run \`hatchkit adopt --resume\` from ${state.projectDir}.`,
-                            ],
-                        });
                     }
                 }
             }
@@ -2441,8 +2670,11 @@ async function listStagedFiles(cwd) {
  *  noting which files already exist (will be left alone) vs which
  *  will be scaffolded. */
 function renderBuildPipelineSummary(state, plan) {
-    if (!plan.scaffoldBuildPipeline)
-        return chalk.dim("no — leave files as-is");
+    if (!plan.scaffoldBuildPipeline) {
+        return state.unknownWorkspaceLayout
+            ? chalk.dim("no — unrecognised workspace layout, hand-author your own")
+            : chalk.dim("no — leave files as-is");
+    }
     const pipe = detectBuildPipeline(state.projectDir);
     const willWrite = [];
     const kept = [];
@@ -2462,7 +2694,13 @@ function renderBuildPipelineSummary(state, plan) {
         return chalk.dim("all files already present — nothing to write");
     const writePart = `write ${willWrite.join(", ")}`;
     const keepPart = kept.length > 0 ? chalk.dim(` · keep ${kept.join(", ")}`) : "";
-    return `${writePart}${keepPart}`;
+    // Strong warning when the user has overridden the unknown-layout
+    // default. We still write the files (their call), but flag that the
+    // templates' single-package assumption probably doesn't fit this repo.
+    const layoutWarn = state.unknownWorkspaceLayout
+        ? `  ${chalk.yellow("(unrecognised workspace — templates may build the wrong thing)")}`
+        : "";
+    return `${writePart}${keepPart}${layoutWarn}`;
 }
 function detectDockerComposeDomainServiceName(projectDir, surfaces) {
     const pipe = detectBuildPipeline(projectDir);