@marlinjai/clearify 1.17.0 → 1.19.0

package/dist/node/{chunk-SVUDQMRW.js → chunk-HVHCUAVU.js}

@@ -280,9 +280,16 @@ ${hasInternal ? `
     npx clearify dev        Start the dev server
     npx clearify build      Build for production
 `);
+  const secretMode = options.secretMode ?? "prompt";
   if (options.hub) {
-    const { registerWithHub } = await import("./hub-register-VJBXLOKV.js");
-    await registerWithHub({ projectName: detectProjectName() });
+    const { registerWithHub } = await import("./hub-register-M7C3G3FE.js");
+    await registerWithHub({
+      projectName: detectProjectName(),
+      hubToken: options.hubToken,
+      secretMode,
+      secretPat: options.secretPat,
+      rotateSecret: options.rotateSecret
+    });
   } else {
     const { createInterface } = await import("readline");
     const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -291,8 +298,14 @@ ${hasInternal ? `
     });
     rl.close();
     if (answer.toLowerCase() === "y") {
-      const { registerWithHub } = await import("./hub-register-VJBXLOKV.js");
-      await registerWithHub({ projectName: detectProjectName() });
+      const { registerWithHub } = await import("./hub-register-M7C3G3FE.js");
+      await registerWithHub({
+        projectName: detectProjectName(),
+        hubToken: options.hubToken,
+        secretMode,
+        secretPat: options.secretPat,
+        rotateSecret: options.rotateSecret
+      });
     }
   }
 }

package/dist/node/cli/index.js

@@ -34,10 +34,30 @@ cli.command("build", "Build static documentation site").action(async () => {
   const { build } = await import("../node/index.js");
   await build();
 });
-cli.command("init", "Scaffold a docs folder and optionally register with a hub").option("--no-internal", "Skip creating the internal docs section").option("--no-claude-rules", "Skip creating .claude/rules/clearify-docs.md").option("--hub", "Register this project with a documentation hub").action(async (options) => {
-  const { init } = await import("../node/index.js");
-  await init({ noInternal: options.noInternal, noClaudeRules: options.noClaudeRules, hub: options.hub });
-});
+cli.command("init", "Scaffold a docs folder and optionally register with a hub").option("--no-internal", "Skip creating the internal docs section").option("--no-claude-rules", "Skip creating .claude/rules/clearify-docs.md").option("--hub", "Register this project with a documentation hub").option(
+  "--hub-token <pat>",
+  "GitHub PAT to use instead of OAuth device flow (for environments without CLEARIFY_GITHUB_CLIENT_ID set)"
+).option(
+  "--secret-mode <mode>",
+  "How to provision HUB_DISPATCH_TOKEN: prompt (interactive, default), auto (encrypt + PUT via Secrets API), manual (print UI instructions), skip (leave it to Terraform)",
+  { default: "prompt" }
+).option(
+  "--secret-pat <pat>",
+  "PAT value to store as HUB_DISPATCH_TOKEN. Visible in `ps`; prefer --secret-mode=prompt for hidden input"
+).option("--rotate-secret", "Overwrite HUB_DISPATCH_TOKEN even if it already exists on the sub-repo").action(
+  async (options) => {
+    const { init } = await import("../node/index.js");
+    await init({
+      noInternal: options.noInternal,
+      noClaudeRules: options.noClaudeRules,
+      hub: options.hub,
+      hubToken: options.hubToken,
+      secretMode: options.secretMode,
+      secretPat: options.secretPat,
+      rotateSecret: options.rotateSecret
+    });
+  }
+);
 cli.command("check", "Check for broken internal links and frontmatter issues").option("--frontmatter", "Only run frontmatter validation (skip broken link detection)").action(async (options) => {
   const { checkLinks } = await import("../node/check.js");
   await checkLinks({ frontmatterOnly: options.frontmatter });

package/dist/node/core/config.d.ts

@@ -9,9 +9,9 @@ declare const ClearifyDataSchema: z.ZodObject<{
     theme: z.ZodOptional<z.ZodObject<{
         primaryColor: z.ZodOptional<z.ZodString>;
         mode: z.ZodOptional<z.ZodEnum<{
+            auto: "auto";
             light: "light";
             dark: "dark";
-            auto: "auto";
         }>>;
     }, z.core.$strip>>;
     logo: z.ZodOptional<z.ZodObject<{

package/dist/node/{hub-register-VJBXLOKV.js → hub-register-M7C3G3FE.js}

@@ -39,6 +39,80 @@ async function ghApiFetch(url, options = {}) {
   const data = await res.json().catch(() => null);
   return { status: res.status, data };
 }
+async function encryptSecret(plaintext, publicKey) {
+  const sodium = (await import("libsodium-wrappers")).default;
+  await sodium.ready;
+  const keyBytes = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+  const messageBytes = sodium.from_string(plaintext);
+  const sealed = sodium.crypto_box_seal(messageBytes, keyBytes);
+  return sodium.to_base64(sealed, sodium.base64_variants.ORIGINAL);
+}
+async function getRepoPublicKey(token, owner, repo) {
+  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/public-key`;
+  const res = await ghApiFetch(url, {
+    headers: { Authorization: `token ${token}` }
+  });
+  if (res.status !== 200 || !res.data?.key || !res.data?.key_id) {
+    throw new Error(
+      `Failed to fetch public key for ${owner}/${repo}: ${res.status} ${JSON.stringify(res.data)}`
+    );
+  }
+  return { key_id: res.data.key_id, key: res.data.key };
+}
+async function storeDispatchToken(token, owner, repo, secretValue) {
+  const { key_id, key } = await getRepoPublicKey(token, owner, repo);
+  const encrypted_value = await encryptSecret(secretValue, key);
+  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/HUB_DISPATCH_TOKEN`;
+  const res = await ghApiFetch(url, {
+    method: "PUT",
+    headers: { Authorization: `token ${token}` },
+    body: JSON.stringify({ encrypted_value, key_id })
+  });
+  if (res.status !== 201 && res.status !== 204) {
+    throw new Error(
+      `Failed to write HUB_DISPATCH_TOKEN on ${owner}/${repo}: ${res.status} ${JSON.stringify(res.data)}`
+    );
+  }
+}
+async function secretExists(token, owner, repo, name) {
+  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/${name}`;
+  const res = await ghApiFetch(url, { headers: { Authorization: `token ${token}` } });
+  return res.status === 200;
+}
+async function promptSecretMode() {
+  const { createInterface } = await import("readline");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  console.log("\n  How would you like to provision HUB_DISPATCH_TOKEN on this sub-repo?");
+  console.log("    1) auto    paste a PAT now, Clearify encrypts and PUTs it via the Secrets API");
+  console.log("    2) manual  print instructions for the GitHub UI (I will paste it myself)");
+  console.log("    3) skip    leave it alone (I manage it via Terraform)\n");
+  const answer = await new Promise((res) => {
+    rl.question("  Choose [1/2/3] (default: 2): ", res);
+  });
+  rl.close();
+  const trimmed = answer.trim();
+  if (trimmed === "1" || trimmed.toLowerCase() === "auto") return "auto";
+  if (trimmed === "3" || trimmed.toLowerCase() === "skip") return "skip";
+  return "manual";
+}
+async function promptHiddenInput(prompt) {
+  const password = (await import("@inquirer/password")).default;
+  const value = await password({ message: prompt, mask: "*" });
+  if (!value) {
+    throw new Error("Empty input; aborting.");
+  }
+  return value;
+}
+function printManualSecretInstructions(subRepo, hub) {
+  const url = `https://github.com/${subRepo.owner}/${subRepo.repo}/settings/secrets/actions/new`;
+  console.log("\n  Manual secret provisioning");
+  console.log(`    1. Open: ${url}`);
+  console.log("    2. Secret name: HUB_DISPATCH_TOKEN");
+  console.log(
+    `    3. Value: a fine-grained PAT with "Contents: Read and Write" scope on ${hub.owner}/${hub.repo}, 90-day expiry.`
+  );
+  console.log("    4. Save and push a doc change to verify the dispatch fires.\n");
+}
 async function githubDeviceAuth(clientId) {
   const codeRes = await fetch("https://github.com/login/device/code", {
     method: "POST",
@@ -267,14 +341,46 @@ async function registerWithHub(options) {
   console.log("  Generating local files...");
   generateConfig(projectName, options.hubProject);
   generateWorkflow(hub);
+  if (options.secretMode !== "skip") {
+    const mode = options.secretMode === "prompt" || options.secretMode === void 0 ? await promptSecretMode() : options.secretMode;
+    if (mode === "auto") {
+      if (!options.rotateSecret) {
+        const exists = await secretExists(
+          token,
+          currentRepo.owner,
+          currentRepo.repo,
+          "HUB_DISPATCH_TOKEN"
+        );
+        if (exists) {
+          console.log(
+            "  HUB_DISPATCH_TOKEN already exists on this sub-repo; pass --rotate-secret to overwrite"
+          );
+          printSuccessFooter(currentRepo);
+          return;
+        }
+      }
+      const secretValue = options.secretPat ?? options.hubToken ?? await promptHiddenInput("Paste the PAT to store as HUB_DISPATCH_TOKEN: ");
+      try {
+        await storeDispatchToken(token, currentRepo.owner, currentRepo.repo, secretValue);
+        console.log("  HUB_DISPATCH_TOKEN written to sub-repo");
+      } catch (err) {
+        console.warn(`  Could not write secret: ${err.message}`);
+        printManualSecretInstructions(currentRepo, hub);
+      }
+    } else if (mode === "manual") {
+      printManualSecretInstructions(currentRepo, hub);
+    }
+  }
+  printSuccessFooter(currentRepo);
+}
+function printSuccessFooter(currentRepo) {
   console.log(`
   Hub registration complete!
 
   Next steps:
     1. Review clearify.config.ts and update the hubProject description
-    2. Add "${currentRepo.repo}" to the repos list in infra/deployments/hub-dispatch/github.tf
-    3. Run: cd infra/deployments/hub-dispatch && ../../scripts/tfrun.sh apply
-    4. Commit the generated files and push to main
+    2. If you manage HUB_DISPATCH_TOKEN via Terraform, add "${currentRepo.repo}" to the repos list in infra/deployments/hub-dispatch/github.tf and apply
+    3. Commit the generated files and push to main
 `);
 }
 export {

package/dist/node/node/index.js

@@ -11,7 +11,7 @@ import {
 import "../chunk-B2Q23JW3.js";
 import {
   init
-} from "../chunk-SVUDQMRW.js";
+} from "../chunk-HVHCUAVU.js";
 import {
   checkFrontmatter,
   checkLinks

package/dist/node/node/init.d.ts

@@ -2,6 +2,22 @@ interface InitOptions {
     noInternal?: boolean;
     noClaudeRules?: boolean;
     hub?: boolean;
+    /** PAT to use for GitHub API calls when CLEARIFY_GITHUB_CLIENT_ID is unset. */
+    hubToken?: string;
+    /**
+     * How to provision HUB_DISPATCH_TOKEN on the sub-repo. Defaults to 'prompt'
+     * during hub onboarding (interactive menu). Non-interactive modes: 'auto'
+     * (encrypt + PUT via Secrets API), 'manual' (print UI instructions), 'skip'
+     * (leave it to Terraform).
+     */
+    secretMode?: 'prompt' | 'auto' | 'manual' | 'skip';
+    /**
+     * The PAT value to store as HUB_DISPATCH_TOKEN. Visible in `ps` when passed
+     * as a flag; prefer --secret-mode=prompt for the hidden input path.
+     */
+    secretPat?: string;
+    /** Overwrite HUB_DISPATCH_TOKEN even if it already exists on the sub-repo. */
+    rotateSecret?: boolean;
 }
 declare function init(options?: InitOptions): Promise<void>;
 

package/dist/node/node/init.js

@@ -1,6 +1,6 @@
 import {
   init
-} from "../chunk-SVUDQMRW.js";
+} from "../chunk-HVHCUAVU.js";
 export {
   init
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marlinjai/clearify",
-  "version": "1.17.0",
+  "version": "1.19.0",
   "description": "An open-source documentation site generator. Turn markdown into beautiful docs.",
   "type": "module",
   "bin": {