create-thally-docs 0.10.127 → 0.10.129

package/README.md

@@ -160,6 +160,19 @@ passes. Review them before publishing. Use `--skip-validation` for an explicit
 import-only run; its report is marked unverified. An existing `--into` project
 without a build script is also reported as unverified.
 
+The report's `provenance` block records what produced the import so a later run
+can be compared with one input changed. `argv` is the command line as typed, with
+`--api-key` values and URL credentials, queries and fragments removed and a local
+source shown as `local-directory`; other paths are kept as typed, and library
+callers that pass no command line get no `argv`. `sources` lists the primary
+repository and each `--source-ref` repository with the `ref` requested and the
+`commit` that was cloned, or the commit of a local source checkout (`dirty: true`
+when it has uncommitted changes or its status cannot be read; ignored files are
+not seen). `commit` is `null` for a live site and for a folder that is not a git
+checkout. `engine` is the version of `create-thally-docs` and, when it runs from a
+Thally checkout, that checkout's commit and `dirty` state; an installed package
+reports its version only.
+
 Migration is a local build workflow for projects you own or trust. Dependency
 installation and builds execute project code, including imported MDX and
 JSX/TSX; they are not sandboxed. No additional confirmation or execution flag

package/dist/{chunk-QHYMFPRB.js → chunk-4LV2ICTJ.js}

@@ -3,19 +3,19 @@
 // src/stable-scaffold-release.json
 var stable_scaffold_release_default = {
   schemaVersion: 1,
-  id: "2026-10-27.ce5444a9.859c8f71",
+  id: "2026-10-30.b232b7ed.96f29a21",
   source: {
     repository: "thallylabs/starter",
-    commitSha: "ce5444a9f980eb0e81df4d15fa95e8031932c5db",
-    treeSha: "1df0e0e682c89d377d59fabacf201eaab7938942",
-    archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/ce5444a9f980eb0e81df4d15fa95e8031932c5db",
+    commitSha: "b232b7ed8e99ae74335642a3bce18a329f30fee5",
+    treeSha: "cb7041aa3fd6810dae79890442bf7053713a2040",
+    archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/b232b7ed8e99ae74335642a3bce18a329f30fee5",
     manifestPath: "starter-release.json",
-    manifestSha256: "049ed1669f08ba54e11226f56456decfaff723fddb6bf4652711b29a7e3598a2"
+    manifestSha256: "6fcfcc392e6183df7d2d114ad780afc777520edabc797c3e184b3972090b4a5d"
   },
   runtime: {
     repository: "thallylabs/thally",
-    commitSha: "859c8f712939da7c68e6010ff9d3eb9195ccfa91",
-    treeSha: "66022670e12f83ca639b6c2bdf07a5041c839d21",
+    commitSha: "96f29a21f73145b02c883e9a51ee15b1610d270b",
+    treeSha: "83c3ea5b90daec74e4ccf7f30fbf1ec0fd8027d2",
     contentSource: "assets",
     identityContractVersion: 1
   },
@@ -24,6 +24,26 @@ var stable_scaffold_release_default = {
 
 // src/previous-scaffold-releases.json
 var previous_scaffold_releases_default = [
+  {
+    schemaVersion: 1,
+    id: "2026-10-27.ce5444a9.859c8f71",
+    source: {
+      repository: "thallylabs/starter",
+      commitSha: "ce5444a9f980eb0e81df4d15fa95e8031932c5db",
+      treeSha: "1df0e0e682c89d377d59fabacf201eaab7938942",
+      archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/ce5444a9f980eb0e81df4d15fa95e8031932c5db",
+      manifestPath: "starter-release.json",
+      manifestSha256: "049ed1669f08ba54e11226f56456decfaff723fddb6bf4652711b29a7e3598a2"
+    },
+    runtime: {
+      repository: "thallylabs/thally",
+      commitSha: "859c8f712939da7c68e6010ff9d3eb9195ccfa91",
+      treeSha: "66022670e12f83ca639b6c2bdf07a5041c839d21",
+      contentSource: "assets",
+      identityContractVersion: 1
+    },
+    starterVersion: 3
+  },
   {
     schemaVersion: 1,
     id: "2026-10-27.553758d7.d441a873",

package/dist/{chunk-RYFINUAB.js → chunk-AOOMRNYY.js}

@@ -9,7 +9,7 @@ import {
 } from "./chunk-J7255UQA.js";
 import {
   downloadStarter
-} from "./chunk-MLHJQSNN.js";
+} from "./chunk-E75L3VIV.js";
 import {
   terminal
 } from "./chunk-L2YCVQBR.js";

package/dist/{chunk-MLHJQSNN.js → chunk-E75L3VIV.js}

@@ -4,10 +4,10 @@ import {
 } from "./chunk-L2YCVQBR.js";
 import {
   readStarterReleaseManifest
-} from "./chunk-WWTAKMTJ.js";
+} from "./chunk-YUJUWZ7V.js";
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-QHYMFPRB.js";
+} from "./chunk-4LV2ICTJ.js";
 
 // src/download.ts
 import { Readable, Transform, pipeline } from "stream";

package/dist/{chunk-WKJN3RIC.js → chunk-M6CNQ62X.js}

@@ -77,7 +77,7 @@ function pinnedSpec(specRef, specs) {
   return specs.find((entry) => canonicalRef(entry.source) === wanted) ?? specs.find((entry) => canonicalRef(entry.source).toLowerCase() === wanted.toLowerCase()) ?? (wantedBase ? specs.find((entry) => baseName(entry.source) === wantedBase) : void 0) ?? (wantedBase ? specs.find((entry) => baseName(entry.source).toLowerCase() === wantedBase.toLowerCase()) : void 0);
 }
 function pageState(ref, specs) {
-  const judge = (spec) => spec.document === void 0 ? "unknown" : ref.webhook ? webhookState(spec.document, ref.path, spec.overrides) : operationState(spec.document, ref.method, ref.path, spec.overrides);
+  const judge = (spec) => referenceState(ref, spec);
   if (ref.specRef) {
     const spec = pinnedSpec(ref.specRef, specs);
     return spec ? judge(spec) : "unknown";
@@ -87,6 +87,9 @@ function pageState(ref, specs) {
   if (specs.some((spec) => spec.document === void 0)) return "unknown";
   return states.find((state) => state === "hidden" || state === "excluded") ?? "unknown";
 }
+function referenceState(ref, spec) {
+  return spec.document === void 0 ? "unknown" : ref.webhook ? webhookState(spec.document, ref.path, spec.overrides) : operationState(spec.document, ref.method, ref.path, spec.overrides);
+}
 var firstSet = (...values) => values.find((value) => value !== void 0 && value !== null);
 function listedOperations(ref, spec) {
   const document = spec?.document;
@@ -120,6 +123,18 @@ function operationDescription(ref, specs) {
   }
   return void 0;
 }
+function hiddenOperationDescription(ref, specs) {
+  const pinned = ref.specRef ? pinnedSpec(ref.specRef, specs) : void 0;
+  const hiding = (ref.specRef ? [pinned] : specs).find((spec) => spec !== void 0 && referenceState(ref, spec) === "hidden");
+  if (!hiding) return void 0;
+  const key = (method) => `${ref.webhook ? "WEBHOOK " : ""}${method.toUpperCase()} ${ref.path}`;
+  const overrides = isObj(hiding.overrides) ? hiding.overrides : {};
+  const revealed = Object.fromEntries((ref.webhook ? METHODS : [ref.method]).map((method) => {
+    const operationKey = key(method);
+    return [operationKey, { ...isObj(overrides[operationKey]) ? overrides[operationKey] : {}, hidden: false }];
+  }));
+  return operationDescription(ref, [{ ...hiding, overrides: { ...overrides, ...revealed } }]);
+}
 function resolveLocalRef(document, ref) {
   if (ref !== "#" && !ref.startsWith("#/")) return void 0;
   let node = document;
@@ -626,7 +641,16 @@ function headingText(node, components, footnoteNumber) {
   if (node.type === "mdxJsxTextElement" && !components) return "";
   return (node.children ?? []).map((child) => headingText(child, components, footnoteNumber)).join("");
 }
+var GENERATED_FIELD_ID = /^(?:parameter|body|response)-/;
 var STEP_HEADING_SIZES = ["h2", "h3", "h4"];
+function numberTabIds(bases, used) {
+  return [...bases].map((base) => {
+    let id = base;
+    for (let occurrence = 2; used.has(id); occurrence++) id = `${base}-${occurrence}`;
+    used.add(id);
+    return id;
+  });
+}
 function readPageIds(content, parsed) {
   const tree = parsed.tree ?? parseMdxTree(content);
   const footnotes = /* @__PURE__ */ new Map();
@@ -634,7 +658,7 @@ function readPageIds(content, parsed) {
     if (!footnotes.has(identifier)) footnotes.set(identifier, footnotes.size + 1);
     return footnotes.get(identifier);
   };
-  const page = { headings: [], fieldBases: [], reserved: /* @__PURE__ */ new Set() };
+  const page = { headings: [], fieldBases: [], tabBases: [], reserved: /* @__PURE__ */ new Set() };
   const visit = (node, stepSize, inNote) => {
     let childSize = stepSize;
     if (node.type === "footnoteReference" && !inNote) footnoteNumber(node.identifier ?? "");
@@ -665,6 +689,11 @@ function readPageIds(content, parsed) {
         const base = name === void 0 ? void 0 : fieldAnchorBase(name);
         if (base && constantAttribute(node, "id") === void 0) page.fieldBases.push(base);
       }
+      if (node.name === "Tab") {
+        const title = constantAttribute(node, "title");
+        const base = title ? slugify(plainInlineText(title)) : "";
+        if (base && constantAttribute(node, "id") === void 0) page.tabBases.push(base);
+      }
     }
     for (const child of node.children ?? []) visit(child, childSize, inNote || node.type === "footnoteDefinition");
   };
@@ -687,6 +716,7 @@ function extractHeadingAnchors(content, parsed = parseMdxPage(content)) {
   const { ids, used } = numberHeadingIds(page.headings);
   for (const id of ids) if (id) anchors.add(id);
   for (const id of numberFieldIds(page.fieldBases, used, page.reserved)) anchors.add(id);
+  for (const id of numberTabIds(page.tabBases, used)) anchors.add(id);
   for (const id of page.reserved) anchors.add(id);
   return anchors;
 }
@@ -888,14 +918,14 @@ function checkOperationPages(projectDir, tabs, pages, issues) {
   const described = pages.some((page) => !page.hasDescription) ? [...specs, ...load(true)] : specs;
   for (const { file, reference, hasDescription } of pages) {
     const state = specs.length > 0 ? pageState(reference, specs) : "unknown";
-    if (state === "hidden" || state === "excluded") {
+    if (state === "excluded") {
       const operation = `${reference.specRef ? `${reference.specRef} ` : ""}${reference.method} ${reference.path}`;
       issues.push({
         severity: "warning",
         file,
         message: `page ${file} points at ${state} operation ${operation} and is not published: it returns 404 and is left out of navigation, search, sitemap and llms.txt. Publish the operation or point the page at another one`
       });
-    } else if (!hasDescription && operationDescription(reference, described) === void 0) {
+    } else if (!hasDescription && operationDescription(reference, described) === void 0 && hiddenOperationDescription(reference, described) === void 0) {
       issues.push({ severity: "warning", message: MISSING_DESCRIPTION, file });
     }
   }
@@ -996,6 +1026,7 @@ async function runCheck(projectDir, options) {
   const operationPages = [];
   const validPaths = /* @__PURE__ */ new Set(["/"]);
   const anchorsByPath = /* @__PURE__ */ new Map();
+  const operationPaths = /* @__PURE__ */ new Set();
   const linksByFile = [];
   const linkStubs = [];
   for (const filePath of allFiles) {
@@ -1034,7 +1065,11 @@ async function runCheck(projectDir, options) {
       notices.push({ severity: "warning", message: `Very short body (${content.trim().length} chars) \u2014 page may be empty`, file: rel2 });
     }
     if (isLinkStub) linkStubs.push({ file: rel2, path, issues: notices });
-    if (reference) operationPages.push({ file: rel2, reference, hasDescription: Boolean(data.description) });
+    if (reference) {
+      operationPages.push({ file: rel2, reference, hasDescription: Boolean(data.description) });
+      operationPaths.add(path);
+      operationPaths.add(`/${pageId}`);
+    }
     for (const message of manualApiProblems(rel2, data, Boolean(reference), content, config.api)) {
       issues.push({ severity: "warning", file: rel2, message });
     }
@@ -1078,7 +1113,8 @@ async function runCheck(projectDir, options) {
     });
   }
   const externalLinks = [];
-  for (const { file, anchors, links, offset } of linksByFile) {
+  const isGeneratedFieldId = (path, fragment) => operationPaths.has(path) && GENERATED_FIELD_ID.test(fragment);
+  for (const { file, path: pagePath, anchors, links, offset } of linksByFile) {
     for (const { target, line: contentLine } of links) {
       const line = contentLine + offset;
       if (/^(https?:|mailto:|tel:)/i.test(target)) {
@@ -1087,7 +1123,7 @@ async function runCheck(projectDir, options) {
       }
       if (target.startsWith("#")) {
         const anchor2 = target.slice(1);
-        if (anchor2 && !anchors.has(decodedFragment(anchor2))) {
+        if (anchor2 && !anchors.has(decodedFragment(anchor2)) && !isGeneratedFieldId(pagePath, decodedFragment(anchor2))) {
           issues.push({ severity: "warning", message: `Broken anchor: "${target}" not found on this page`, file, line });
         }
         continue;
@@ -1098,7 +1134,7 @@ async function runCheck(projectDir, options) {
       if (!cycle && isGeneratedPath(path)) continue;
       if (cycle || !validPaths.has(path)) {
         issues.push({ severity: "error", message: `Broken link: "${target}" \u2014 no page at "${path}"`, file, line });
-      } else if (anchor && !anchorsByPath.get(path)?.has(decodedFragment(anchor))) {
+      } else if (anchor && !anchorsByPath.get(path)?.has(decodedFragment(anchor)) && !isGeneratedFieldId(path, decodedFragment(anchor))) {
         issues.push({ severity: "warning", message: `Broken anchor: "${target}" \u2014 no heading "#${anchor}" on that page`, file, line });
       }
     }

package/dist/{chunk-TXS2KCLI.js → chunk-TJRGX4ZM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   downloadStarter
-} from "./chunk-MLHJQSNN.js";
+} from "./chunk-E75L3VIV.js";
 import {
   applyStarterRuntimeSyncPlan,
   areStarterFileContentsEquivalent,
@@ -11,11 +11,11 @@ import {
   planStarterRuntimeSync,
   readStarterReleaseManifest,
   starterManifestSha256
-} from "./chunk-WWTAKMTJ.js";
+} from "./chunk-YUJUWZ7V.js";
 import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES
-} from "./chunk-QHYMFPRB.js";
+} from "./chunk-4LV2ICTJ.js";
 
 // src/starter-update.ts
 import {

package/dist/{chunk-WWTAKMTJ.js → chunk-YUJUWZ7V.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-QHYMFPRB.js";
+} from "./chunk-4LV2ICTJ.js";
 
 // src/starter-sync.ts
 import { createHash } from "crypto";

package/dist/{chunk-XERSFGRA.js → chunk-Z5L3F6V5.js}

@@ -8,28 +8,28 @@ import {
   installDeps,
   runProjectCommand,
   scaffold
-} from "./chunk-RYFINUAB.js";
+} from "./chunk-AOOMRNYY.js";
 import {
   pruneMissingSiteLinks
 } from "./chunk-UG3OXVLE.js";
 import {
   resolveStarterUpdateBase
-} from "./chunk-TXS2KCLI.js";
+} from "./chunk-TJRGX4ZM.js";
 import {
   downloadStarter
-} from "./chunk-MLHJQSNN.js";
+} from "./chunk-E75L3VIV.js";
 import {
   terminal
 } from "./chunk-L2YCVQBR.js";
 import {
   areStarterFileContentsEquivalent
-} from "./chunk-WWTAKMTJ.js";
+} from "./chunk-YUJUWZ7V.js";
 
 // src/migrate/index.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync3, readFileSync as readFileSync4, realpathSync as realpathSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync3, readFileSync as readFileSync5, realpathSync as realpathSync2, rmSync as rmSync3, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { basename, join as join5, resolve as resolve2 } from "path";
+import { basename, join as join6, resolve as resolve2 } from "path";
 import {
   cloneGitHubRepository,
   importSourceRef,
@@ -405,13 +405,77 @@ function reportUnresolvedMigrationLinks(bundle) {
   }
 }
 
+// src/migrate/provenance.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
+import { fileURLToPath } from "url";
+var ENGINE_PACKAGE = "create-thally-docs";
+var REPOSITORY_ENVIRONMENT = ["GIT_DIR", "GIT_WORK_TREE", "GIT_INDEX_FILE", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_COMMON_DIR", "GIT_PREFIX"];
+function git(directory, args) {
+  const env = Object.fromEntries(Object.entries(process.env).filter(([name]) => !REPOSITORY_ENVIRONMENT.includes(name)));
+  try {
+    return execFileSync("git", ["--no-optional-locks", "-c", "core.fsmonitor=false", "-C", directory, ...args], {
+      encoding: "utf8",
+      env,
+      stdio: ["ignore", "pipe", "ignore"],
+      timeout: 1e4
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function gitCommit(directory, { atRoot = false } = {}) {
+  if (atRoot && git(directory, ["rev-parse", "--show-prefix"]) !== "") return null;
+  const commit = git(directory, ["rev-parse", "--verify", "HEAD"]);
+  return commit && /^[0-9a-f]{40,64}$/.test(commit) ? commit : null;
+}
+function gitHead(directory) {
+  const commit = gitCommit(directory);
+  return commit ? { commit, dirty: git(directory, ["status", "--porcelain"]) !== "" } : null;
+}
+function enginePackage() {
+  let directory = dirname3(fileURLToPath(import.meta.url));
+  for (; ; ) {
+    const manifestPath = join5(directory, "package.json");
+    if (existsSync5(manifestPath)) {
+      try {
+        const manifest = JSON.parse(readFileSync4(manifestPath, "utf8"));
+        if (manifest.name === ENGINE_PACKAGE && typeof manifest.version === "string") return { directory, version: manifest.version };
+      } catch {
+      }
+    }
+    const parent = dirname3(directory);
+    if (parent === directory) return null;
+    directory = parent;
+  }
+}
+function engineProvenance() {
+  const engine = enginePackage();
+  if (!engine) return { name: ENGINE_PACKAGE, version: "unknown", commit: null };
+  const head = git(engine.directory, ["rev-parse", "--show-prefix"]) === `packages/${ENGINE_PACKAGE}/` ? gitHead(engine.directory) : null;
+  return head ? { name: ENGINE_PACKAGE, version: engine.version, commit: head.commit, dirty: head.dirty } : { name: ENGINE_PACKAGE, version: engine.version, commit: null };
+}
+function redactArgv(argv) {
+  return argv.map((arg, index) => {
+    if (argv[index - 1] === "--api-key") return "<redacted>";
+    if (arg.startsWith("--api-key=")) return "--api-key=<redacted>";
+    try {
+      const url = new URL(arg);
+      if ((url.protocol === "http:" || url.protocol === "https:") && (url.username || url.password || url.search || url.hash)) return `${url.origin}${url.pathname}`;
+    } catch {
+    }
+    return arg;
+  });
+}
+
 // src/migrate/index.ts
 function projectPath(projectDir, candidate) {
   return assertMigrationDestination(projectDir, candidate);
 }
 function quarantineIgnoreFile(projectDir) {
   const ignorePath = projectPath(projectDir, ".gitignore");
-  const existing = existsSync5(ignorePath) ? readFileSync4(ignorePath, "utf8") : "";
+  const existing = existsSync6(ignorePath) ? readFileSync5(ignorePath, "utf8") : "";
   const rules = existing.split(/\r?\n/).map((line) => line.trim()).filter((line) => /^!?\/?migration-quarantine(?:\/(?:\*\*?)?)?$/.test(line));
   if (rules.length > 0 && !rules[rules.length - 1].startsWith("!")) return;
   const separator = existing === "" || existing.endsWith("\n") ? "" : "\n";
@@ -422,8 +486,8 @@ function quarantineIgnoreFile(projectDir) {
 }
 function readExistingConfig(projectDir) {
   const configPath = projectPath(projectDir, "docs.json");
-  if (!existsSync5(configPath)) return void 0;
-  return JSON.parse(readFileSync4(configPath, "utf8"));
+  if (!existsSync6(configPath)) return void 0;
+  return JSON.parse(readFileSync5(configPath, "utf8"));
 }
 function resetFreshMigrationContent(projectDir) {
   const contentDirectory = projectPath(projectDir, "src/content");
@@ -433,17 +497,24 @@ function resetFreshMigrationContent(projectDir) {
     rmSync3(projectPath(projectDir, sampleSpec), { force: true });
   }
 }
-async function fetchSourceRefs(mappings, warnings) {
+function publicSourceUrl(options) {
+  if (options.sourceDirectory) return "local-directory";
+  const url = new URL(options.sourceUrl);
+  return `${url.origin}${url.pathname}`;
+}
+async function fetchSourceRefs(mappings, warnings, sources) {
   const imports = [];
   for (const mapping of mappings) {
-    const root = mkdtempSync3(join5(tmpdir2(), "thally-source-ref-"));
+    const root = mkdtempSync3(join6(tmpdir2(), "thally-source-ref-"));
     try {
       const source = parseGitHubRepositoryUrl(`https://github.com/${mapping.repo}`);
       const tooLarge = await sourceRefOversizeReason(mapping.repo);
       if (tooLarge) throw new Error(tooLarge);
-      const cloneDir = join5(root, "repository");
+      const cloneDir = join6(root, "repository");
       await cloneGitHubRepository(source, cloneDir, warnings, { skipSubmodules: true });
+      const commit = gitCommit(cloneDir, { atRoot: true });
       imports.push(importSourceRef(mapping, cloneDir));
+      sources.push({ role: "sourceRef", url: `https://github.com/${source.owner}/${source.repo}`, ref: source.branch, mountPath: mapping.mountPath, commit });
     } catch (error) {
       warnings.push({ code: "fetch-failed", message: `sourceRef ${mapping.repo} was not imported: ${error instanceof Error ? error.message : String(error)}` });
     } finally {
@@ -453,11 +524,14 @@ async function fetchSourceRefs(mappings, warnings) {
   return imports;
 }
 async function discoverMigration(options) {
+  const sources = [];
   if (options.sourceDirectory) {
     assertSeparateMigrationDirectories(options.sourceDirectory, options.projectDir);
-    const temporaryRoot2 = mkdtempSync3(join5(tmpdir2(), "thally-local-migrate-"));
+    const temporaryRoot2 = mkdtempSync3(join6(tmpdir2(), "thally-local-migrate-"));
     try {
-      const snapshot = join5(temporaryRoot2, "source");
+      const snapshot = join6(temporaryRoot2, "source");
+      const head = gitHead(options.sourceDirectory);
+      sources.push({ role: "primary", url: publicSourceUrl(options), commit: head?.commit ?? null, ...head ? { dirty: head.dirty } : {} });
       snapshotLocalMigration(options.sourceDirectory, snapshot, options.docsDir);
       const bundle = await terminal.step("Converting local documentation", () => convertRepository({
         repositoryDir: snapshot,
@@ -467,7 +541,7 @@ async function discoverMigration(options) {
         docsDir: options.docsDir,
         platform: options.platform
       }), "Local documentation converted");
-      return hydrateRemoteApiSpecs(bundle, options.fetcher);
+      return { bundle: await hydrateRemoteApiSpecs(bundle, options.fetcher), sources };
     } finally {
       rmSync3(temporaryRoot2, { recursive: true, force: true });
     }
@@ -475,7 +549,8 @@ async function discoverMigration(options) {
   const url = new URL(options.sourceUrl);
   if (url.hostname.toLowerCase() !== "github.com") {
     if (options.sourceRefs?.length) terminal.warn("--source-ref applies only to GitHub repository sources and was ignored.");
-    return terminal.step("Discovering public documentation", () => {
+    sources.push({ role: "primary", url: publicSourceUrl(options), commit: null });
+    const bundle = await terminal.step("Discovering public documentation", () => {
       const discovery = {
         sourceUrl: options.sourceUrl,
         platform: options.platform,
@@ -485,15 +560,17 @@ async function discoverMigration(options) {
       if (options.urlMigration) return runUrlMigration({ ...discovery, fetcher: options.fetcher, ...options.urlMigration }).then((run) => options.openapiUrl ? hydrateUrlOpenApi(run.bundle, options.openapiUrl, options.fetcher) : run.bundle);
       return options.fetcher ? migrateUrl({ ...discovery, fetcher: options.fetcher }) : discoverUrl(discovery);
     }, "Public documentation discovered");
+    return { bundle, sources };
   }
   const source = parseGitHubRepositoryUrl(options.sourceUrl);
   if (options.branch) source.branch = options.branch;
-  const temporaryRoot = mkdtempSync3(join5(tmpdir2(), "thally-migrate-"));
-  const cloneDir = join5(temporaryRoot, "repository");
+  const temporaryRoot = mkdtempSync3(join6(tmpdir2(), "thally-migrate-"));
+  const cloneDir = join6(temporaryRoot, "repository");
   try {
     const cloneWarnings = [];
     await terminal.step(`Cloning ${source.owner}/${source.repo}`, () => cloneGitHubRepository(source, cloneDir, cloneWarnings, { docsDir: options.docsDir }), "Source repository cloned");
-    const sourceRefs = options.sourceRefs?.length ? await terminal.step("Importing sourceRef repositories", () => fetchSourceRefs(options.sourceRefs ?? [], cloneWarnings), "sourceRef repositories imported") : [];
+    sources.push({ role: "primary", url: `https://github.com/${source.owner}/${source.repo}`, ref: source.branch, commit: gitCommit(cloneDir, { atRoot: true }) });
+    const sourceRefs = options.sourceRefs?.length ? await terminal.step("Importing sourceRef repositories", () => fetchSourceRefs(options.sourceRefs ?? [], cloneWarnings, sources), "sourceRef repositories imported") : [];
     const bundle = await terminal.step("Converting repository documentation", () => convertRepository({
       sourceRefs,
       repositoryDir: cloneDir,
@@ -502,7 +579,7 @@ async function discoverMigration(options) {
       platform: options.platform
     }), "Repository documentation converted");
     const hydrated = await terminal.step("Loading remote API specifications", () => hydrateRemoteApiSpecs(bundle, options.fetcher), "Remote API specifications loaded");
-    return cloneWarnings.length > 0 ? { ...hydrated, warnings: [...cloneWarnings, ...hydrated.warnings] } : hydrated;
+    return { bundle: cloneWarnings.length > 0 ? { ...hydrated, warnings: [...cloneWarnings, ...hydrated.warnings] } : hydrated, sources };
   } finally {
     rmSync3(temporaryRoot, { recursive: true, force: true });
   }
@@ -523,7 +600,7 @@ function publicSpecWarning(projectDir, bundle) {
 async function migrateDocs(options) {
   const projectDir = resolve2(options.projectDir);
   assertMigrationDestination(projectDir);
-  const bundle = await discoverMigration(options);
+  const { bundle, sources } = await discoverMigration(options);
   reportUnresolvedMigrationLinks(bundle);
   if (!options.into) {
     terminal.detail("Project", projectDir);
@@ -540,7 +617,7 @@ async function migrateDocs(options) {
     });
     resetFreshMigrationContent(projectDir);
     pruneMissingSiteLinks(projectDir, new Set(bundle.pages.map((page) => page.id)));
-  } else if (!existsSync5(projectDir)) {
+  } else if (!existsSync6(projectDir)) {
     throw new Error(`Project directory "${projectDir}" does not exist. Use without --into to scaffold a new one.`);
   }
   if (!options.into) {
@@ -557,7 +634,7 @@ async function migrateDocs(options) {
   }
   const existingPlan = options.into ? await migrationExistingConfig(projectDir, readExistingConfig(projectDir), bundle.warnings) : void 0;
   const registryPath = projectPath(projectDir, "src/mdx/custom-components.tsx");
-  const registryBytes = existsSync5(registryPath) ? readFileSync4(registryPath) : void 0;
+  const registryBytes = existsSync6(registryPath) ? readFileSync5(registryPath) : void 0;
   existingPlan?.preconditions.set("src/mdx/custom-components.tsx", registryBytes);
   const rendered = await terminal.step("Rendering documentation", async () => renderFiles(bundle, {
     existingConfig: existingPlan?.config,
@@ -567,7 +644,7 @@ async function migrateDocs(options) {
   const writePreconditions = new Map(existingPlan?.preconditions);
   const writable = rendered.filter((file) => {
     const path = projectPath(projectDir, file.path);
-    const current = existsSync5(path) ? readFileSync4(path) : void 0;
+    const current = existsSync6(path) ? readFileSync5(path) : void 0;
     if (!writePreconditions.has(file.path)) writePreconditions.set(file.path, current);
     if (!options.into || file.path === "docs.json" || file.path === "src/mdx/custom-components.tsx" || !current) return true;
     if (current.equals(Buffer.from(file.content)) || existingPlan?.seedFiles.get(file.path)?.equals(current)) return true;
@@ -584,7 +661,7 @@ async function migrateDocs(options) {
   if (quarantineIgnore) {
     writable.push(quarantineIgnore);
     const ignorePath = projectPath(projectDir, ".gitignore");
-    writePreconditions.set(".gitignore", existsSync5(ignorePath) ? readFileSync4(ignorePath) : void 0);
+    writePreconditions.set(".gitignore", existsSync6(ignorePath) ? readFileSync5(ignorePath) : void 0);
   }
   await terminal.step("Writing documentation", async () => {
     projectPath(projectDir, "migration-report.json");
@@ -628,7 +705,12 @@ async function migrateDocs(options) {
   const reportPath = projectPath(projectDir, "migration-report.json");
   writeFileSync2(reportPath, `${JSON.stringify({
     version: 1,
-    sourceUrl: options.sourceDirectory ? "local-directory" : `${new URL(options.sourceUrl).origin}${new URL(options.sourceUrl).pathname}`,
+    sourceUrl: publicSourceUrl(options),
+    provenance: {
+      ...options.argv ? { argv: redactArgv(options.argv) } : {},
+      engine: engineProvenance(),
+      sources
+    },
     platform: bundle.platform,
     pages: bundle.pages.length,
     assets: bundle.assets.length,

package/dist/index.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import {
   migrateDocs
-} from "./chunk-XERSFGRA.js";
+} from "./chunk-Z5L3F6V5.js";
 import {
   parseFrontmatter,
   runCheck
-} from "./chunk-WKJN3RIC.js";
+} from "./chunk-M6CNQ62X.js";
 import "./chunk-KDLP27DS.js";
 import {
   logo,
@@ -13,18 +13,18 @@ import {
   scaffold,
   slugify,
   success
-} from "./chunk-RYFINUAB.js";
+} from "./chunk-AOOMRNYY.js";
 import "./chunk-UG3OXVLE.js";
 import "./chunk-J7255UQA.js";
-import "./chunk-TXS2KCLI.js";
-import "./chunk-MLHJQSNN.js";
+import "./chunk-TJRGX4ZM.js";
+import "./chunk-E75L3VIV.js";
 import {
   acquireTerminalAccent,
   formatHelp,
   terminal
 } from "./chunk-L2YCVQBR.js";
-import "./chunk-WWTAKMTJ.js";
-import "./chunk-QHYMFPRB.js";
+import "./chunk-YUJUWZ7V.js";
+import "./chunk-4LV2ICTJ.js";
 
 // src/index.ts
 import { existsSync as existsSync2, readdirSync } from "fs";
@@ -782,6 +782,7 @@ Options:
 `
 };
 var positional = [];
+var positionalIndexes = [];
 for (let i = 0; i < args.length; i++) {
   if (args[i].startsWith("-")) {
     if (valueFlags.has(args[i]) && i + 1 < args.length && !args[i + 1].startsWith("-")) {
@@ -789,6 +790,7 @@ for (let i = 0; i < args.length; i++) {
     }
   } else {
     positional.push(args[i]);
+    positionalIndexes.push(i);
   }
 }
 function getFlagValue(flag) {
@@ -897,7 +899,11 @@ async function runMigrateCommand() {
     platform,
     yes,
     skipValidation: flags.includes("--skip-validation"),
-    sourceRefs
+    sourceRefs,
+    // The report never names a private checkout path (see its `sourceUrl`), so
+    // a local source is masked in the recorded command line too. Every other
+    // argument, including output paths, is recorded as typed.
+    argv: sourceDirectory ? args.map((arg, i) => i === positionalIndexes[1] ? "local-directory" : arg) : args
   });
   terminal.section("Migration summary", [
     `${result.pagesWritten} pages \xB7 ${result.assetsWritten} assets \xB7 ${result.platform}`,

package/dist/migrate/index.d.ts

@@ -51,6 +51,8 @@ interface MigrateOptions {
     skipValidation?: boolean;
     /** Mintlify `sourceRef` repositories to import, from `--source-ref owner/repo=<path>`. */
     sourceRefs?: Array<SourceRefMapping>;
+    /** Command line of this run, recorded in the report with credentials removed. Absent for library callers. */
+    argv?: ReadonlyArray<string>;
 }
 interface MigrateResult {
     pagesWritten: number;

package/dist/migrate/index.js

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
 import {
   migrateDocs
-} from "../chunk-XERSFGRA.js";
+} from "../chunk-Z5L3F6V5.js";
 import "../chunk-KDLP27DS.js";
-import "../chunk-RYFINUAB.js";
+import "../chunk-AOOMRNYY.js";
 import "../chunk-UG3OXVLE.js";
 import "../chunk-J7255UQA.js";
-import "../chunk-TXS2KCLI.js";
-import "../chunk-MLHJQSNN.js";
+import "../chunk-TJRGX4ZM.js";
+import "../chunk-E75L3VIV.js";
 import "../chunk-L2YCVQBR.js";
-import "../chunk-WWTAKMTJ.js";
-import "../chunk-QHYMFPRB.js";
+import "../chunk-YUJUWZ7V.js";
+import "../chunk-4LV2ICTJ.js";
 export {
   migrateDocs
 };

package/dist/migration-worker.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCheck
-} from "./chunk-WKJN3RIC.js";
+} from "./chunk-M6CNQ62X.js";
 import "./chunk-KDLP27DS.js";
 import "./chunk-J7255UQA.js";
 

package/dist/release.js

@@ -3,7 +3,7 @@ import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES,
   isStableScaffoldRelease
-} from "./chunk-QHYMFPRB.js";
+} from "./chunk-4LV2ICTJ.js";
 export {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES,

package/dist/scaffold.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   scaffold
-} from "./chunk-RYFINUAB.js";
+} from "./chunk-AOOMRNYY.js";
 import "./chunk-UG3OXVLE.js";
 import "./chunk-J7255UQA.js";
 import {
@@ -9,12 +9,12 @@ import {
   STARTER_COMMIT_SHA,
   STARTER_REPOSITORY,
   validateStarterArchiveEntry
-} from "./chunk-MLHJQSNN.js";
+} from "./chunk-E75L3VIV.js";
 import "./chunk-L2YCVQBR.js";
-import "./chunk-WWTAKMTJ.js";
+import "./chunk-YUJUWZ7V.js";
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-QHYMFPRB.js";
+} from "./chunk-4LV2ICTJ.js";
 export {
   STABLE_SCAFFOLD_RELEASE,
   STARTER_ARCHIVE_ROOT,

package/dist/starter-sync.js

@@ -9,8 +9,8 @@ import {
   planStarterRuntimeSync,
   readStarterReleaseManifest,
   starterManifestSha256
-} from "./chunk-WWTAKMTJ.js";
-import "./chunk-QHYMFPRB.js";
+} from "./chunk-YUJUWZ7V.js";
+import "./chunk-4LV2ICTJ.js";
 export {
   applyStarterRuntimeSyncPlan,
   captureTargetPrecondition,

package/dist/starter-update.js

@@ -6,11 +6,11 @@ import {
   resolveStarterUpdateBase,
   starterReleaseProviderError,
   updateStarterProject
-} from "./chunk-TXS2KCLI.js";
-import "./chunk-MLHJQSNN.js";
+} from "./chunk-TJRGX4ZM.js";
+import "./chunk-E75L3VIV.js";
 import "./chunk-L2YCVQBR.js";
-import "./chunk-WWTAKMTJ.js";
-import "./chunk-QHYMFPRB.js";
+import "./chunk-YUJUWZ7V.js";
+import "./chunk-4LV2ICTJ.js";
 export {
   fetchStarterReleaseHint,
   resolveManualReviewMutations,

package/dist/starter-upgrade-canary.js

@@ -1,20 +1,20 @@
 #!/usr/bin/env node
 import {
   updateStarterProject
-} from "./chunk-TXS2KCLI.js";
+} from "./chunk-TJRGX4ZM.js";
 import {
   downloadStarter
-} from "./chunk-MLHJQSNN.js";
+} from "./chunk-E75L3VIV.js";
 import "./chunk-L2YCVQBR.js";
 import {
   classifyStarterPath,
   mergeStarterOwnershipContracts,
   readStarterReleaseManifest
-} from "./chunk-WWTAKMTJ.js";
+} from "./chunk-YUJUWZ7V.js";
 import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES
-} from "./chunk-QHYMFPRB.js";
+} from "./chunk-4LV2ICTJ.js";
 
 // src/starter-upgrade-canary.ts
 import { createHash } from "crypto";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-thally-docs",
-  "version": "0.10.127",
+  "version": "0.10.129",
   "description": "Scaffold an open-source Thally docs site for people, search engines, and AI tools.",
   "type": "module",
   "engines": {
@@ -54,7 +54,7 @@
     "@clack/prompts": "^0.11.0",
     "@inquirer/prompts": "^7.0.0",
     "@thallylabs/core": "0.2.18",
-    "@thallylabs/migrate": "0.2.47",
+    "@thallylabs/migrate": "0.2.48",
     "p-limit": "^6.1.0",
     "path-to-regexp": "6.3.0",
     "remark-gfm": "^4.0.1",