@marlinjai/clearify 1.18.0 → 1.20.0

package/dist/node/{chunk-7Z2GR22P.js → chunk-JZZ2BNIL.js}

@@ -282,7 +282,7 @@ ${hasInternal ? `
 `);
   const secretMode = options.secretMode ?? "prompt";
   if (options.hub) {
-    const { registerWithHub } = await import("./hub-register-VJBXLOKV.js");
+    const { registerWithHub } = await import("./hub-register-7NF5BP3E.js");
     await registerWithHub({
       projectName: detectProjectName(),
       hubToken: options.hubToken,
@@ -298,7 +298,7 @@ ${hasInternal ? `
     });
     rl.close();
     if (answer.toLowerCase() === "y") {
-      const { registerWithHub } = await import("./hub-register-VJBXLOKV.js");
+      const { registerWithHub } = await import("./hub-register-7NF5BP3E.js");
       await registerWithHub({
         projectName: detectProjectName(),
         hubToken: options.hubToken,

package/dist/node/{hub-register-VJBXLOKV.js → hub-register-7NF5BP3E.js}

@@ -39,6 +39,80 @@ async function ghApiFetch(url, options = {}) {
   const data = await res.json().catch(() => null);
   return { status: res.status, data };
 }
+async function encryptSecret(plaintext, publicKey) {
+  const sodium = (await import("libsodium-wrappers")).default;
+  await sodium.ready;
+  const keyBytes = sodium.from_base64(publicKey, sodium.base64_variants.ORIGINAL);
+  const messageBytes = sodium.from_string(plaintext);
+  const sealed = sodium.crypto_box_seal(messageBytes, keyBytes);
+  return sodium.to_base64(sealed, sodium.base64_variants.ORIGINAL);
+}
+async function getRepoPublicKey(token, owner, repo) {
+  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/public-key`;
+  const res = await ghApiFetch(url, {
+    headers: { Authorization: `token ${token}` }
+  });
+  if (res.status !== 200 || !res.data?.key || !res.data?.key_id) {
+    throw new Error(
+      `Failed to fetch public key for ${owner}/${repo}: ${res.status} ${JSON.stringify(res.data)}`
+    );
+  }
+  return { key_id: res.data.key_id, key: res.data.key };
+}
+async function storeDispatchToken(token, owner, repo, secretValue) {
+  const { key_id, key } = await getRepoPublicKey(token, owner, repo);
+  const encrypted_value = await encryptSecret(secretValue, key);
+  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/HUB_DISPATCH_TOKEN`;
+  const res = await ghApiFetch(url, {
+    method: "PUT",
+    headers: { Authorization: `token ${token}` },
+    body: JSON.stringify({ encrypted_value, key_id })
+  });
+  if (res.status !== 201 && res.status !== 204) {
+    throw new Error(
+      `Failed to write HUB_DISPATCH_TOKEN on ${owner}/${repo}: ${res.status} ${JSON.stringify(res.data)}`
+    );
+  }
+}
+async function secretExists(token, owner, repo, name) {
+  const url = `https://api.github.com/repos/${owner}/${repo}/actions/secrets/${name}`;
+  const res = await ghApiFetch(url, { headers: { Authorization: `token ${token}` } });
+  return res.status === 200;
+}
+async function promptSecretMode() {
+  const { createInterface } = await import("readline");
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  console.log("\n  How would you like to provision HUB_DISPATCH_TOKEN on this sub-repo?");
+  console.log("    1) auto    paste a PAT now, Clearify encrypts and PUTs it via the Secrets API");
+  console.log("    2) manual  print instructions for the GitHub UI (I will paste it myself)");
+  console.log("    3) skip    leave it alone (I manage it via Terraform)\n");
+  const answer = await new Promise((res) => {
+    rl.question("  Choose [1/2/3] (default: 2): ", res);
+  });
+  rl.close();
+  const trimmed = answer.trim();
+  if (trimmed === "1" || trimmed.toLowerCase() === "auto") return "auto";
+  if (trimmed === "3" || trimmed.toLowerCase() === "skip") return "skip";
+  return "manual";
+}
+async function promptHiddenInput(prompt) {
+  const password = (await import("@inquirer/password")).default;
+  const value = await password({ message: prompt, mask: "*" });
+  if (!value) {
+    throw new Error("Empty input; aborting.");
+  }
+  return value;
+}
+function printManualSecretInstructions(subRepo, hub) {
+  const url = `https://github.com/${subRepo.owner}/${subRepo.repo}/settings/secrets/actions/new`;
+  console.log("\n  Manual secret provisioning");
+  console.log(`    1. Open: ${url}`);
+  console.log("    2. Secret name: HUB_DISPATCH_TOKEN");
+  console.log(
+    `    3. Value: a fine-grained PAT with "Contents: Read and Write" scope on ${hub.owner}/${hub.repo}, 90-day expiry.`
+  );
+  console.log("    4. Save and push a doc change to verify the dispatch fires.\n");
+}
 async function githubDeviceAuth(clientId) {
   const codeRes = await fetch("https://github.com/login/device/code", {
     method: "POST",
@@ -236,9 +310,15 @@ jobs:
 }
 async function registerWithHub(options) {
   const clientId = process.env.CLEARIFY_GITHUB_CLIENT_ID;
-  if (!clientId) {
-    console.error("\n  Error: CLEARIFY_GITHUB_CLIENT_ID environment variable is not set.");
-    console.error("  Set it to your GitHub OAuth App client ID and try again.\n");
+  if (!clientId && !options.hubToken) {
+    console.error("\n  Error: no GitHub credentials available for hub onboarding.");
+    console.error("  Clearify needs one of these to write the hub registry entry:\n");
+    console.error("    1) Set CLEARIFY_GITHUB_CLIENT_ID to a GitHub OAuth App client ID");
+    console.error("       (create one at https://github.com/settings/applications/new,");
+    console.error('       scope "repo"), then re-run this command.');
+    console.error("    2) Pass --hub-token <pat> to use a Personal Access Token directly");
+    console.error('       (fine-grained PAT with "Contents: Read and Write" on the hub repo).');
+    console.error("");
     process.exit(1);
   }
   const projectName = options.projectName ?? detectProjectName();
@@ -254,8 +334,14 @@ async function registerWithHub(options) {
   const hub = await promptHubRepo();
   console.log(`  Hub: ${hub.owner}/${hub.repo}
 `);
-  console.log("  Starting GitHub authentication...");
-  const token = await githubDeviceAuth(clientId);
+  let token;
+  if (options.hubToken) {
+    console.log("  Using provided --hub-token for GitHub API calls.");
+    token = options.hubToken;
+  } else {
+    console.log("  Starting GitHub authentication...");
+    token = await githubDeviceAuth(clientId);
+  }
   console.log("  Updating hub registry...");
   await updateHubRegistry(token, hub, {
     name: projectName,
@@ -267,14 +353,46 @@ async function registerWithHub(options) {
   console.log("  Generating local files...");
   generateConfig(projectName, options.hubProject);
   generateWorkflow(hub);
+  if (options.secretMode !== "skip") {
+    const mode = options.secretMode === "prompt" || options.secretMode === void 0 ? await promptSecretMode() : options.secretMode;
+    if (mode === "auto") {
+      if (!options.rotateSecret) {
+        const exists = await secretExists(
+          token,
+          currentRepo.owner,
+          currentRepo.repo,
+          "HUB_DISPATCH_TOKEN"
+        );
+        if (exists) {
+          console.log(
+            "  HUB_DISPATCH_TOKEN already exists on this sub-repo; pass --rotate-secret to overwrite"
+          );
+          printSuccessFooter(currentRepo);
+          return;
+        }
+      }
+      const secretValue = options.secretPat ?? options.hubToken ?? await promptHiddenInput("Paste the PAT to store as HUB_DISPATCH_TOKEN: ");
+      try {
+        await storeDispatchToken(token, currentRepo.owner, currentRepo.repo, secretValue);
+        console.log("  HUB_DISPATCH_TOKEN written to sub-repo");
+      } catch (err) {
+        console.warn(`  Could not write secret: ${err.message}`);
+        printManualSecretInstructions(currentRepo, hub);
+      }
+    } else if (mode === "manual") {
+      printManualSecretInstructions(currentRepo, hub);
+    }
+  }
+  printSuccessFooter(currentRepo);
+}
+function printSuccessFooter(currentRepo) {
   console.log(`
   Hub registration complete!
 
   Next steps:
     1. Review clearify.config.ts and update the hubProject description
-    2. Add "${currentRepo.repo}" to the repos list in infra/deployments/hub-dispatch/github.tf
-    3. Run: cd infra/deployments/hub-dispatch && ../../scripts/tfrun.sh apply
-    4. Commit the generated files and push to main
+    2. If you manage HUB_DISPATCH_TOKEN via Terraform, add "${currentRepo.repo}" to the repos list in infra/deployments/hub-dispatch/github.tf and apply
+    3. Commit the generated files and push to main
 `);
 }
 export {

package/dist/node/node/index.js

@@ -11,7 +11,7 @@ import {
 import "../chunk-B2Q23JW3.js";
 import {
   init
-} from "../chunk-7Z2GR22P.js";
+} from "../chunk-JZZ2BNIL.js";
 import {
   checkFrontmatter,
   checkLinks

package/dist/node/node/init.js

@@ -1,6 +1,6 @@
 import {
   init
-} from "../chunk-7Z2GR22P.js";
+} from "../chunk-JZZ2BNIL.js";
 export {
   init
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@marlinjai/clearify",
-  "version": "1.18.0",
+  "version": "1.20.0",
   "description": "An open-source documentation site generator. Turn markdown into beautiful docs.",
   "type": "module",
   "bin": {