vibecarbon 0.5.0 → 0.6.0

package/src/configure.js

@@ -15,13 +15,17 @@ import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import * as p from '@clack/prompts';
 
+import { formatAmount, listStripePrices } from './lib/billing/stripe-catalog.js';
+import { writeBillingCatalog } from './lib/billing/write-catalog.js';
 import { renderHelp } from './lib/cli/help.js';
 import { parseFlags } from './lib/cli/parse-flags.js';
 import { c, printBanner } from './lib/colors.js';
 import { loadCredentials, loadProjectConfig } from './lib/config.js';
+import { featureKeys, featureSecretKeys } from './lib/config-registry.js';
 import { requireLicense } from './lib/licensing/index.js';
 import { buildGitAddArgv, loadEnvVariables, setEnvVar } from './lib/project.js';
 import { assertInProjectDir } from './lib/project-guard.js';
+import { validateAdminEmail } from './lib/validators.js';
 import { VERSION } from './lib/version.js';
 
 /** @type {import('./lib/cli/parse-flags.js').CommandSpec & { summary?: string, description?: string, examples?: Array<{ command: string, description?: string }> }} */
@@ -41,12 +45,11 @@ const SPEC = {
     '               k8s/k8s-ha cluster. Diamond/Fullerene only.',
     '',
     'CONFIGURABLE FEATURES',
-    '  CI/CD                GitHub Actions build + deploy workflows',
-    '  Billing              Stripe, Paddle, or Polar payment processing',
-    '  Google OAuth         Sign in with Google',
-    '  Microsoft OAuth      Sign in with Microsoft',
-    '  SMTP / Email         Transactional emails (Resend, Mailgun, SES, etc.)',
-    '  Plausible Analytics  Privacy-friendly web analytics',
+    '  CI/CD         Auto build & deploy with GitHub Actions',
+    '  Payments      Stripe payments (subscriptions + one-time)',
+    '  OAuth         Sign in with Google or Microsoft',
+    '  SMTP / Email  Transactional emails (Resend or any SMTP)',
+    '  Analytics     Privacy-friendly web analytics (Plausible)',
   ].join('\n'),
   flags: [
     { name: 'h', boolean: true, description: 'Show this help' },
@@ -73,16 +76,22 @@ const SPEC = {
  * Returns the entered value, or the current value if user pressed Enter on a non-empty placeholder.
  */
 async function promptText(message, currentValue, options = {}) {
-  const placeholder = currentValue || options.placeholder || '';
-  const defaultValue = currentValue || options.defaultValue || undefined;
+  const fallback = currentValue || options.defaultValue || undefined;
+  const placeholder = fallback || options.placeholder || '';
   const result = await p.text({
     message,
     placeholder: placeholder ? `${placeholder}` : undefined,
-    defaultValue,
-    validate: options.validate,
+    defaultValue: fallback,
+    // @clack's text prompt runs validate on the raw (possibly empty) value before
+    // substituting defaultValue, so a bare validate would reject Enter-on-default.
+    // When we have a default, accept empty submit (Tab/Enter) and fall back to it.
+    validate: (value) => {
+      if (!value?.trim() && fallback !== undefined) return undefined;
+      return options.validate?.(value);
+    },
   });
   if (p.isCancel(result)) return null;
-  return result;
+  return result || fallback || '';
 }
 
 function requireNonEmpty(label) {
@@ -107,6 +116,21 @@ async function promptSecret(message, currentValue) {
   return result || currentValue || '';
 }
 
+/**
+ * Best-effort deploy domain for project-aware prompt suggestions.
+ * Prefers the prod environment, then any environment that has a domain.
+ * Returns null when the project hasn't been deployed / has no domain yet.
+ */
+function projectDomain(projectConfig) {
+  const envs = projectConfig?.environments;
+  if (!envs) return null;
+  if (envs.prod?.domain) return envs.prod.domain;
+  for (const e of Object.values(envs)) {
+    if (e?.domain) return e.domain;
+  }
+  return null;
+}
+
 // ---- Billing ----
 
 // Webhook endpoint that all billing providers point at. The unified handler
@@ -114,32 +138,61 @@ async function promptSecret(message, currentValue) {
 // active provider; Stripe also keeps /api/webhooks/stripe for back-compat.
 const BILLING_WEBHOOK_PATH = '/api/webhooks/billing';
 
+// `parked: true` disables a billing provider for this release without removing
+// its setup flow below or the server-side adapter — Stripe is the only fully
+// tested path for now. Paddle/Polar are hidden from the provider prompt and the
+// app won't be configured to use them; flip `parked` off to re-enable once
+// they're validated. Mirrors the parked-feature pattern in src/add.js.
+const BILLING_PROVIDERS = [
+  { value: 'stripe', label: 'Stripe', hint: 'most popular' },
+  { value: 'paddle', label: 'Paddle', hint: 'merchant of record', parked: true },
+  { value: 'polar', label: 'Polar', hint: 'open-source focused', parked: true },
+];
+
 async function promptBilling(env) {
   p.log.info(c.bold('Billing Configuration'));
   p.log.info(c.dim('Choose your payment provider and enter API credentials.'));
 
-  const currentProvider = env.BILLING_PROVIDER || 'stripe';
-  const provider = await p.select({
-    message: 'Billing provider',
-    options: [
-      { value: 'stripe', label: 'Stripe', hint: 'most popular' },
-      { value: 'paddle', label: 'Paddle', hint: 'merchant of record' },
-      { value: 'polar', label: 'Polar', hint: 'open-source focused' },
-    ],
-    initialValue: currentProvider,
-  });
-  if (p.isCancel(provider)) return null;
+  const availableProviders = BILLING_PROVIDERS.filter((bp) => !bp.parked);
+
+  let provider;
+  if (availableProviders.length === 1) {
+    // Only one provider enabled this release — no point prompting; use it.
+    provider = availableProviders[0].value;
+    p.log.info(`Billing provider: ${c.bold(availableProviders[0].label)}`);
+  } else {
+    const current = availableProviders.some((bp) => bp.value === env.BILLING_PROVIDER)
+      ? env.BILLING_PROVIDER
+      : availableProviders[0].value;
+    const selected = await p.select({
+      message: 'Billing provider',
+      options: availableProviders.map((bp) => ({
+        value: bp.value,
+        label: bp.label,
+        hint: bp.hint,
+      })),
+      initialValue: current,
+    });
+    if (p.isCancel(selected)) return null;
+    provider = selected;
+  }
 
   const vars = { BILLING_PROVIDER: provider };
 
   if (provider === 'stripe') {
     p.note(
       [
-        `${c.bold('1. Secret key')}`,
+        `${c.bold('1. Create your products in Stripe FIRST')}`,
+        `   ${c.info('https://dashboard.stripe.com/products')}`,
+        '   Add a product for each plan you want to sell and give it a price —',
+        `   ${c.dim('recurring')} for subscriptions or ${c.dim('one-time')} for single purchases.`,
+        `   Name them anything you like; we'll sync them in and let you pick which to activate.`,
+        '',
+        `${c.bold('2. Secret key')}`,
         `   ${c.info('https://dashboard.stripe.com/apikeys')}`,
         `   Use ${c.dim('sk_test_...')} for testing or ${c.dim('sk_live_...')} in production.`,
         '',
-        `${c.bold('2. Webhook')} (Workbench → Webhooks → Create an event destination)`,
+        `${c.bold('3. Webhook')} (Workbench → Webhooks → Create an event destination)`,
         `   ${c.info('https://dashboard.stripe.com/webhooks')}`,
         `   • Endpoint URL: ${c.dim(`https://<your-domain>${BILLING_WEBHOOK_PATH}`)}`,
         '   • Events to send:',
@@ -149,11 +202,6 @@ async function promptBilling(env) {
         '       customer.subscription.deleted',
         '       invoice.payment_failed',
         `   • After creating, click ${c.dim('Reveal')} to copy the ${c.dim('whsec_...')} signing secret.`,
-        '',
-        `${c.bold('3. Price IDs')}`,
-        `   ${c.info('https://dashboard.stripe.com/products')}`,
-        '   Create a Startup and Pro product, then copy each recurring',
-        `   price's ${c.dim('price_...')} ID.`,
       ].join('\n'),
       'Stripe setup',
     );
@@ -169,19 +217,62 @@ async function promptBilling(env) {
     if (webhookSecret === null) return null;
     vars.STRIPE_WEBHOOK_SECRET = webhookSecret;
 
-    const priceStarter = await promptText(
-      'Stripe price ID for Startup plan (price_...)',
-      env.STRIPE_PRICE_STARTER,
-    );
-    if (priceStarter === null) return null;
-    vars.STRIPE_PRICE_STARTER = priceStarter;
+    // Pull live prices so the user activates real products by name instead of
+    // pasting opaque price IDs. On fetch failure (or zero prices) we warn and
+    // skip catalog writing — there is no free-text fallback now that the app
+    // renders whatever tiers we snapshot.
+    let prices = null;
+    const s = p.spinner();
+    try {
+      s.start('Fetching your Stripe products and prices');
+      prices = await listStripePrices(secretKey);
+      s.stop(`Found ${prices.length} active price${prices.length === 1 ? '' : 's'} in Stripe.`);
+    } catch (err) {
+      s.stop('Could not fetch Stripe prices.');
+      p.log.warn(`${err.message}. No products activated — fix the key and re-run to set pricing.`);
+      prices = null;
+    }
 
-    const pricePro = await promptText(
-      'Stripe price ID for Pro plan (price_...)',
-      env.STRIPE_PRICE_PRO,
-    );
-    if (pricePro === null) return null;
-    vars.STRIPE_PRICE_PRO = pricePro;
+    if (prices && prices.length > 0) {
+      // Single multiselect: pick which products to activate. `prices` is already
+      // amount-sorted, so options (and the resulting snapshot) read cheapest-first.
+      const selected = await p.multiselect({
+        message: 'Select the products to activate',
+        options: prices.map((pr) => ({
+          value: pr.priceId,
+          label: `${pr.name} — ${formatAmount(pr.amount, pr.currency)}${pr.type === 'one_time' ? ' (one-time)' : `/${pr.interval}`}`,
+        })),
+        initialValues: prices.map((pr) => pr.priceId), // pre-check all; user deselects
+        required: false,
+      });
+      if (p.isCancel(selected)) return null;
+
+      // Filter preserves the amount-sorted order; these objects already match
+      // the CatalogTier shape the snapshot expects.
+      const activeTiers = prices.filter((pr) => selected.includes(pr.priceId));
+
+      // Side effect (like promptCicd writing vibecarbon.json): snapshot the
+      // activated products into src/shared/billing-catalog.ts so the app renders
+      // accurate pricing without hitting Stripe at runtime. Only write when at
+      // least one product is activated; otherwise leave the shipped default.
+      if (activeTiers.length > 0) {
+        const written = writeBillingCatalog(process.cwd(), {
+          provider: 'stripe',
+          generatedAt: new Date().toISOString(),
+          tiers: activeTiers,
+        });
+        if (written) {
+          p.log.success(
+            `Activated ${activeTiers.length} product${activeTiers.length === 1 ? '' : 's'} — wrote pricing snapshot to src/shared/billing-catalog.ts`,
+          );
+        }
+      } else {
+        p.log.warn('No products selected — left the existing pricing snapshot unchanged.');
+      }
+    } else if (prices) {
+      // Fetch succeeded but the account has no active prices.
+      p.log.warn('No active prices found in Stripe — create products first, then re-run.');
+    }
   } else if (provider === 'paddle') {
     p.note(
       [
@@ -381,64 +472,127 @@ async function promptMicrosoftOAuth(env) {
   };
 }
 
+// ---- OAuth (provider picker) ----
+
+// Single "OAuth" feature that asks which provider to set up, then delegates to
+// the provider-specific flow. Each provider writes its own env vars, so they
+// coexist — configuring one never clears the other.
+async function promptOAuth(env, ctx) {
+  const googleDone = Boolean(env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET);
+  const microsoftDone = Boolean(env.MICROSOFT_CLIENT_ID && env.MICROSOFT_CLIENT_SECRET);
+
+  const provider = await p.select({
+    message: 'Which OAuth provider?',
+    options: [
+      { value: 'google', label: googleDone ? `Google ${c.success('✓ configured')}` : 'Google' },
+      {
+        value: 'microsoft',
+        label: microsoftDone ? `Microsoft ${c.success('✓ configured')}` : 'Microsoft',
+      },
+    ],
+  });
+  if (p.isCancel(provider)) return null;
+
+  return provider === 'google' ? promptGoogleOAuth(env, ctx) : promptMicrosoftOAuth(env, ctx);
+}
+
 // ---- SMTP / Email ----
 
-async function promptSmtp(env) {
+async function promptSmtp(env, ctx = {}) {
   p.log.info(c.bold('SMTP / Email'));
   p.log.info(c.dim('Used for password resets, verification, and transactional emails.'));
 
-  p.note(
-    [
-      'Pick a provider, create an SMTP credential, then paste the values below.',
-      '',
-      `${c.bold('Resend')}`,
-      `   ${c.info('https://resend.com/api-keys')}`,
-      `   host ${c.dim('smtp.resend.com')}  •  port ${c.dim('587')}  •  user ${c.dim('resend')}  •  pass = API key`,
-      '',
-      `${c.bold('Mailgun')}`,
-      `   ${c.info('https://app.mailgun.com/app/sending/domains')}`,
-      `   host ${c.dim('smtp.mailgun.org')}  •  port ${c.dim('587')}`,
-      '',
-      `${c.bold('AWS SES')}`,
-      `   ${c.info('https://console.aws.amazon.com/ses/home#/smtp-settings')}`,
-      `   region-specific host  •  port ${c.dim('587')}`,
-      '',
-      `${c.bold('Postmark')}`,
-      `   ${c.info('https://account.postmarkapp.com/servers')}`,
-      `   host ${c.dim('smtp.postmarkapp.com')}  •  port ${c.dim('587')}`,
-      '',
-      `${c.bold('Verify your sender domain')} in the provider before going live,`,
-      'or production emails will land in spam (or get rejected outright).',
-    ].join('\n'),
-    'SMTP setup',
-  );
-
-  const host = await promptText('SMTP host', env.SMTP_HOST, {
-    placeholder: 'smtp.resend.com',
-    validate: requireNonEmpty('SMTP host'),
+  const currentIsResend = !env.SMTP_HOST || env.SMTP_HOST === 'smtp.resend.com';
+  const provider = await p.select({
+    message: 'Email provider',
+    options: [
+      { value: 'resend', label: 'Resend', hint: 'recommended — simplest setup' },
+      { value: 'smtp', label: 'Other SMTP server', hint: 'Mailgun, SES, Postmark, any SMTP' },
+    ],
+    initialValue: currentIsResend ? 'resend' : 'smtp',
   });
-  if (host === null) return null;
+  if (p.isCancel(provider)) return null;
 
-  const port = await promptText('SMTP port', env.SMTP_PORT || '587', {
-    placeholder: '587',
-  });
-  if (port === null) return null;
+  let host;
+  let port;
+  let user;
+  let pass;
 
-  const user = await promptText('SMTP username', env.SMTP_USER, {
-    validate: requireNonEmpty('SMTP username'),
-  });
-  if (user === null) return null;
+  if (provider === 'resend') {
+    p.note(
+      [
+        `${c.bold('1. Add your sending domain')}  ${c.info('https://resend.com/domains')}`,
+        `   Use your ${c.bold('root domain')} ${c.dim('(e.g. yourdomain.com)')} — not a subdomain`,
+        `   ${c.dim('like mail.yourdomain.com')}. Add the DNS records it shows you,`,
+        `   then wait for the status to read ${c.dim('"Verified"')}.`,
+        '',
+        `${c.bold('2. Create an API key')}  ${c.info('https://resend.com/api-keys')}`,
+        `   ${c.dim('"Sending access"')} permission is all you need ${c.dim('(not "Full access")')}.`,
+        '',
+        '3. Paste the API key below.',
+      ].join('\n'),
+      'Resend setup',
+    );
+
+    host = 'smtp.resend.com';
+    port = '587';
+    user = 'resend';
 
-  const pass = await promptSecret('SMTP password', env.SMTP_PASS);
-  if (pass === null) return null;
+    pass = await promptSecret('Resend API key', env.SMTP_PASS);
+    if (pass === null) return null;
+  } else {
+    p.note(
+      [
+        'Works with any SMTP provider (Mailgun, AWS SES, Postmark, …).',
+        "Grab the host, port, username, and password from your provider's",
+        'SMTP settings. Verify your sender domain there first, or production',
+        'email will land in spam.',
+      ].join('\n'),
+      'SMTP setup',
+    );
+
+    host = await promptText('SMTP host', env.SMTP_HOST, {
+      validate: requireNonEmpty('SMTP host'),
+    });
+    if (host === null) return null;
+
+    port = await promptText('SMTP port', env.SMTP_PORT, {
+      defaultValue: '587',
+    });
+    if (port === null) return null;
+
+    user = await promptText('SMTP username', env.SMTP_USER, {
+      validate: requireNonEmpty('SMTP username'),
+    });
+    if (user === null) return null;
+
+    pass = await promptSecret('SMTP password', env.SMTP_PASS);
+    if (pass === null) return null;
+  }
+
+  // Suggest a sender address on the project's own domain when we know it, so
+  // Enter accepts e.g. support@vibecarbon.com instead of a generic placeholder.
+  const domain = ctx.domain || 'yourdomain.com';
+  const emailSuggestion = ctx.domain ? `support@${ctx.domain}` : undefined;
+
+  p.note(
+    [
+      'Use a real inbox you monitor as the "from" address',
+      `${c.dim(`(e.g. hi@${domain} or support@${domain})`)} so replies —`,
+      'including to password-reset and verification emails — reach you.',
+      `${c.bold('Avoid noreply@')}.`,
+    ].join('\n'),
+    'Sender identity',
+  );
 
   const adminEmail = await promptText('Sender email address (from)', env.SMTP_ADMIN_EMAIL, {
-    placeholder: 'noreply@yourdomain.com',
-    validate: requireNonEmpty('Sender email'),
+    defaultValue: emailSuggestion,
+    placeholder: `support@${domain}`,
+    validate: validateAdminEmail,
   });
   if (adminEmail === null) return null;
 
-  const senderDefault = env.PROJECT_NAME || 'My App';
+  const senderDefault = env.PROJECT_NAME || ctx.projectConfig?.projectName || 'My App';
   const senderName = await promptText('Sender display name', env.SMTP_SENDER_NAME, {
     placeholder: senderDefault,
     defaultValue: senderDefault,
@@ -672,42 +826,108 @@ async function promptCicd() {
 // FEATURE DEFINITIONS
 // ============================================================================
 
+// Env vars that hold secrets — partially masked when echoing existing config.
+// Derived from the config-registry so a new feature secret is masked
+// automatically (no second list to keep in sync).
+const SECRET_ENV_KEYS = new Set(featureSecretKeys());
+
+// Show enough of a secret to recognize it, never the whole thing.
+function maskEnvValue(key, value) {
+  if (!SECRET_ENV_KEYS.has(key)) return value;
+  if (value.length <= 4) return '••••';
+  return `${value.slice(0, 4)}${'•'.repeat(8)}`;
+}
+
+// Render the currently-set env vars for a feature as `KEY = value` lines,
+// skipping anything unset. Detection is env-based so it works whether the user
+// ran `vibecarbon configure` or edited .env.local by hand.
+function envSummaryLines(env, keys) {
+  const lines = [];
+  for (const key of keys) {
+    const value = env[key];
+    if (value === undefined || value === '') continue;
+    lines.push(`${c.dim(key)} = ${maskEnvValue(key, value)}`);
+  }
+  return lines;
+}
+
+// Billing is provider-tagged; infer the active provider from BILLING_PROVIDER
+// or, for hand-edited envs, from whichever provider secret is present.
+const BILLING_KEYS = {
+  stripe: ['BILLING_PROVIDER', 'STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET'],
+  paddle: [
+    'BILLING_PROVIDER',
+    'PADDLE_API_KEY',
+    'PADDLE_WEBHOOK_SECRET',
+    'PADDLE_ENVIRONMENT',
+    'PADDLE_PRICE_STARTER',
+    'PADDLE_PRICE_PRO',
+  ],
+  polar: [
+    'BILLING_PROVIDER',
+    'POLAR_ACCESS_TOKEN',
+    'POLAR_WEBHOOK_SECRET',
+    'POLAR_ORGANIZATION_ID',
+    'POLAR_PRICE_STARTER',
+    'POLAR_PRICE_PRO',
+  ],
+};
+
+function billingProvider(env) {
+  if (env.BILLING_PROVIDER) return env.BILLING_PROVIDER;
+  if (env.STRIPE_SECRET_KEY) return 'stripe';
+  if (env.PADDLE_API_KEY) return 'paddle';
+  if (env.POLAR_ACCESS_TOKEN) return 'polar';
+  return null;
+}
+
 const FEATURES = [
   {
     value: 'cicd',
     label: 'CI/CD',
-    hint: 'GitHub Actions build + deploy workflows (optional; enables git-push deploys)',
+    hint: 'Auto build & deploy with GitHub Actions',
     promptFn: promptCicd,
+    isConfigured: (_env, ctx) => ctx?.projectConfig?.cicdEnabled === true,
+    summary: () => [
+      `${c.dim('cicdEnabled')} = true ${c.dim('(GitHub Actions workflows installed)')}`,
+    ],
   },
   {
     value: 'billing',
-    label: 'Billing',
-    hint: 'Stripe, Paddle, or Polar',
+    label: 'Payments',
+    hint: 'Stripe',
     promptFn: promptBilling,
+    isConfigured: (env) => Boolean(billingProvider(env)),
+    summary: (env) =>
+      envSummaryLines(env, BILLING_KEYS[billingProvider(env)] || ['BILLING_PROVIDER']),
   },
   {
-    value: 'google-oauth',
-    label: 'Google OAuth',
-    hint: 'Sign in with Google',
-    promptFn: promptGoogleOAuth,
-  },
-  {
-    value: 'microsoft-oauth',
-    label: 'Microsoft OAuth',
-    hint: 'Sign in with Microsoft',
-    promptFn: promptMicrosoftOAuth,
+    value: 'oauth',
+    label: 'OAuth',
+    hint: 'Google or Microsoft',
+    promptFn: promptOAuth,
+    isConfigured: (env) =>
+      Boolean(
+        (env.GOOGLE_CLIENT_ID && env.GOOGLE_CLIENT_SECRET) ||
+          (env.MICROSOFT_CLIENT_ID && env.MICROSOFT_CLIENT_SECRET),
+      ),
+    summary: (env) => envSummaryLines(env, featureKeys('oauth')),
   },
   {
     value: 'smtp',
     label: 'SMTP / Email',
-    hint: 'password resets, verification, transactional emails',
+    hint: 'Password resets, account verifications, notifications, etc',
     promptFn: promptSmtp,
+    isConfigured: (env) => Boolean(env.SMTP_HOST && env.SMTP_PASS),
+    summary: (env) => envSummaryLines(env, featureKeys('smtp')),
   },
   {
     value: 'plausible',
-    label: 'Plausible Analytics',
-    hint: 'privacy-friendly web analytics',
+    label: 'Analytics',
+    hint: 'Plausible',
     promptFn: promptPlausible,
+    isConfigured: (env) => Boolean(env.VITE_PLAUSIBLE_DOMAIN),
+    summary: (env) => envSummaryLines(env, featureKeys('analytics')),
   },
 ];
 
@@ -746,69 +966,77 @@ async function main(cliArgs) {
   // Load current env values
   const env = loadEnvVariables(cwd);
 
-  // Feature selection — opt-in: nothing selected by default. Most users only
-  // want to configure one or two features per run; default-on forced them to
-  // uncheck the rest, which was tedious and hid the intent of the prompt.
-  const selected = await p.multiselect({
-    message: 'Which features would you like to configure?',
+  // Project metadata (name, deploy domain) powers project-aware prompt
+  // suggestions — e.g. the SMTP sender address. Non-fatal if it can't load.
+  let projectConfig = null;
+  try {
+    projectConfig = loadProjectConfig(cwd);
+  } catch {
+    // Best-effort — prompts fall back to generic placeholders without it.
+  }
+  const ctx = { projectConfig, domain: projectDomain(projectConfig) };
+
+  // Configure one feature per run. Multi-select made failures ambiguous — if a
+  // later feature errored, it was unclear which earlier ones had been written.
+  // Re-running the command is simple and keeps each session's outcome clear.
+  const featureValue = await p.select({
+    message: 'Which feature would you like to configure?',
     options: FEATURES.map((f) => ({
       value: f.value,
-      label: f.label,
+      label: f.isConfigured(env, ctx) ? `${f.label} ${c.success('✓ configured')}` : f.label,
       hint: f.hint,
     })),
-    required: false,
-    initialValues: [],
   });
 
-  if (p.isCancel(selected)) {
+  if (p.isCancel(featureValue)) {
     p.cancel('Operation cancelled.');
     process.exit(0);
   }
 
-  if (selected.length === 0) {
-    p.log.warn('No features selected.');
-    p.outro('Nothing to configure.');
-    return;
-  }
-
-  // Collect credentials for each selected feature
-  const allVars = {};
-  const configuredFeatures = [];
+  const feature = FEATURES.find((f) => f.value === featureValue);
 
-  for (const featureValue of selected) {
-    const feature = FEATURES.find((f) => f.value === featureValue);
-    const result = await feature.promptFn(env);
+  // Already configured? Show what's set (secrets masked) and require an explicit
+  // overwrite confirmation before re-running the feature's prompts.
+  if (feature.isConfigured(env, ctx)) {
+    const lines = feature.summary(env, ctx);
+    p.note(
+      lines.length ? lines.join('\n') : c.dim('(configured)'),
+      `${feature.label} — current settings`,
+    );
 
-    if (result === null) {
-      p.log.warn(`Skipped ${feature.label} (cancelled)`);
-      continue;
+    const overwrite = await p.confirm({
+      message: `${feature.label} is already configured. Re-configure and overwrite these settings?`,
+      initialValue: false,
+    });
+    if (p.isCancel(overwrite)) {
+      p.cancel('Operation cancelled.');
+      process.exit(0);
+    }
+    if (!overwrite) {
+      p.outro(`Left ${c.bold(feature.label)} unchanged.`);
+      return;
     }
-
-    Object.assign(allVars, result);
-    configuredFeatures.push(feature.label);
   }
 
-  if (configuredFeatures.length === 0) {
-    p.outro('No features configured.');
+  const result = await feature.promptFn(env, ctx);
+
+  if (result === null) {
+    p.outro(`Skipped ${feature.label} (cancelled).`);
     return;
   }
 
-  // Show summary
-  const summaryLines = configuredFeatures.map((f) => `  ${c.success('+')} ${f}`).join('\n');
-  p.note(summaryLines, 'Features to configure');
-
-  // Write all values
+  // Write values
   const s = p.spinner();
   s.start('Writing configuration');
 
-  for (const [key, value] of Object.entries(allVars)) {
+  for (const [key, value] of Object.entries(result)) {
     setEnvVar(key, value, cwd);
   }
 
   s.stop('Configuration saved to .env.local and .env');
 
   p.outro(
-    `Configured ${configuredFeatures.length} feature${configuredFeatures.length === 1 ? '' : 's'}. Run ${c.info('vibecarbon deploy')} to push to production.`,
+    `Configured ${c.bold(feature.label)}. Run ${c.info('vibecarbon configure')} again for another feature, or ${c.info('vibecarbon deploy')} to push to production.`,
   );
 }