create-thally-docs 0.10.32 → 0.10.33

package/README.md

@@ -68,7 +68,8 @@ into the customer-owned MDX registry. Simple interactive HTML blocks are moved
 into client components, and locale/root routing is normalized. Unsupported
 customizations remain visible as warnings rather than being silently dropped.
 
-After importing, the CLI runs static content checks and writes
+After importing, the CLI automatically installs dependencies for fresh projects,
+runs static content checks and a production build, and writes
 `migration-report.json`. A failed check or build returns a nonzero exit status;
 the imported files remain available for inspection. Warnings may include
 pre-existing source problems and compatibility limitations even when a build
@@ -76,14 +77,10 @@ passes. Review them before publishing. Use `--skip-validation` for an explicit
 import-only run; its report is marked unverified. An existing `--into` project
 without a build script is also reported as unverified.
 
-Dependency installation and production builds require explicit authorization:
-answer the interactive trust prompt or pass `--trust-source` for a source you
-have reviewed. `--yes` does not grant that authorization. Without it, files are
-imported and statically checked, but the build is skipped and the report stays
-unverified. MCP callers use `trustSource: true` only after the user authorizes
-execution. `--skip-validation` also skips installation, even with trust granted.
-Imported MDX and JSX/TSX are executable code; static migration analysis is not a
-sandbox. Review the imported files before installing or building them manually.
+Migration is a local build workflow for projects you own or trust. Dependency
+installation and builds execute project code, including imported MDX and
+JSX/TSX; they are not sandboxed. No additional confirmation or execution flag
+is needed. `--skip-validation` also skips dependency installation.
 
 A fresh migration leaves the destination repository unset. After creating the
 new repository, set `site.repoUrl` in `src/data/site.ts` to its root GitHub URL

package/dist/{chunk-74SGZLEY.js → chunk-5TBIIZHQ.js}

@@ -5,7 +5,7 @@ import {
 } from "./chunk-ORUAMPNF.js";
 import {
   downloadStarter
-} from "./chunk-FLSOVTVO.js";
+} from "./chunk-DPYULA35.js";
 
 // src/scaffold.ts
 import { existsSync, mkdirSync, readdirSync } from "fs";

package/dist/{chunk-FLSOVTVO.js → chunk-DPYULA35.js}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 import {
   readStarterReleaseManifest
-} from "./chunk-HYGEXPZG.js";
+} from "./chunk-HOQBNMQ4.js";
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-ZFCZE7M7.js";
+} from "./chunk-I2OURFVJ.js";
 
 // src/download.ts
 import { Readable, Transform, pipeline } from "stream";

package/dist/{chunk-HYGEXPZG.js → chunk-HOQBNMQ4.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-ZFCZE7M7.js";
+} from "./chunk-I2OURFVJ.js";
 
 // src/starter-sync.ts
 import { createHash } from "crypto";

package/dist/{chunk-ZFCZE7M7.js → chunk-I2OURFVJ.js}

@@ -3,19 +3,19 @@
 // src/stable-scaffold-release.json
 var stable_scaffold_release_default = {
   schemaVersion: 1,
-  id: "2026-09-07.e15b143d.9b3be068",
+  id: "2026-09-07.7a2c2638.b4a79ee4",
   source: {
     repository: "thallylabs/starter",
-    commitSha: "e15b143d39935f3d6e5fe6127bffc2c3a7591318",
-    treeSha: "fff5cb413f83c8da17d2e4ec3df933d29a5613de",
-    archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/e15b143d39935f3d6e5fe6127bffc2c3a7591318",
+    commitSha: "7a2c26389fcba84afe9cfeb91d68d96d007061bf",
+    treeSha: "fca330f03c39c6e7733411d0d7bc74223a7847a2",
+    archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/7a2c26389fcba84afe9cfeb91d68d96d007061bf",
     manifestPath: "starter-release.json",
-    manifestSha256: "07fb1d733700c547874b88eaefcbfc4decef6acd204c765deb81ae3462ee66ba"
+    manifestSha256: "e7cd79509dd39a35c9de23c6f67a0f4d98b1177c0dd6df252c1db909448490a5"
   },
   runtime: {
     repository: "thallylabs/thally",
-    commitSha: "9b3be06826c9bc3a8b6402b25e597b3b7cc80cfe",
-    treeSha: "1a87aa11c382e3d8d88785b85af37e1b823dad86",
+    commitSha: "b4a79ee4055a86b06a38c2e8f8a1f13db9fdf06a",
+    treeSha: "ee790f51e68fe6bec5eb475e12035f0350951bd5",
     contentSource: "assets",
     identityContractVersion: 1
   },
@@ -24,6 +24,26 @@ var stable_scaffold_release_default = {
 
 // src/previous-scaffold-releases.json
 var previous_scaffold_releases_default = [
+  {
+    schemaVersion: 1,
+    id: "2026-09-07.e15b143d.9b3be068",
+    source: {
+      repository: "thallylabs/starter",
+      commitSha: "e15b143d39935f3d6e5fe6127bffc2c3a7591318",
+      treeSha: "fff5cb413f83c8da17d2e4ec3df933d29a5613de",
+      archiveUrl: "https://codeload.github.com/thallylabs/starter/tar.gz/e15b143d39935f3d6e5fe6127bffc2c3a7591318",
+      manifestPath: "starter-release.json",
+      manifestSha256: "07fb1d733700c547874b88eaefcbfc4decef6acd204c765deb81ae3462ee66ba"
+    },
+    runtime: {
+      repository: "thallylabs/thally",
+      commitSha: "9b3be06826c9bc3a8b6402b25e597b3b7cc80cfe",
+      treeSha: "1a87aa11c382e3d8d88785b85af37e1b823dad86",
+      contentSource: "assets",
+      identityContractVersion: 1
+    },
+    starterVersion: 2
+  },
   {
     schemaVersion: 1,
     id: "2026-09-07.06a4aca7.ad30d29f",

package/dist/{chunk-E5URHAYU.js → chunk-V5PERCVX.js}

@@ -5,7 +5,7 @@ import {
   readDocsJson,
   scaffold,
   writeDocsJson
-} from "./chunk-74SGZLEY.js";
+} from "./chunk-5TBIIZHQ.js";
 
 // src/migrate/index.ts
 import { existsSync as existsSync3, mkdirSync, mkdtempSync, readFileSync as readFileSync3, rmSync, writeFileSync } from "fs";
@@ -430,7 +430,7 @@ thally check: ${errors.length} error(s), ${warnings.length} warning(s)`);
 }
 
 // src/migrate/validate.ts
-async function validateMigration(projectDir, skip = false, trustSource = false, installationFailed = false) {
+async function validateMigration(projectDir, skip = false, installationFailed = false) {
   const result = { content: "skipped", build: "skipped", messages: [], diagnostics: [] };
   if (skip) {
     result.messages.push("Validation was explicitly skipped; this import is not verified.");
@@ -450,10 +450,6 @@ async function validateMigration(projectDir, skip = false, trustSource = false,
     result.messages.push("Dependency installation failed; production build was not attempted. Review the installation output before retrying.");
     return result;
   }
-  if (trustSource !== true) {
-    result.messages.push("Production build skipped: source execution was not authorized. Review the imported code before running npm install and npm run build, or explicitly authorize a trusted migration with --trust-source.");
-    return result;
-  }
   const packagePath = join2(projectDir, "package.json");
   try {
     const manifest = existsSync2(packagePath) ? JSON.parse(readFileSync2(packagePath, "utf8")) : void 0;
@@ -564,7 +560,8 @@ async function migrateDocs(options) {
   }
   console.log(`  \u2713 Imported ${bundle.pages.length} pages and ${bundle.assets.length} assets from ${bundle.platform}.`);
   let installationFailed = false;
-  if (!options.into && options.trustSource === true && !options.skipValidation) {
+  if (!options.skipValidation) console.log("  Migration validation runs project code locally, including imported MDX and components.");
+  if (!options.into && !options.skipValidation) {
     try {
       installDeps(projectDir);
     } catch {
@@ -572,7 +569,7 @@ async function migrateDocs(options) {
     }
   }
   console.log("\n  Validating imported documentation...");
-  const validation = await validateMigration(projectDir, options.skipValidation, options.trustSource === true, installationFailed);
+  const validation = await validateMigration(projectDir, options.skipValidation, installationFailed);
   const reportPath = projectPath(projectDir, "migration-report.json");
   writeFileSync(reportPath, `${JSON.stringify({
     version: 1,

package/dist/index.js

@@ -3,23 +3,22 @@ import {
   migrateDocs,
   parseFrontmatter,
   runCheck
-} from "./chunk-E5URHAYU.js";
+} from "./chunk-V5PERCVX.js";
 import {
   logo,
   scaffold,
   slugify,
   success
-} from "./chunk-74SGZLEY.js";
+} from "./chunk-5TBIIZHQ.js";
 import "./chunk-ORUAMPNF.js";
-import "./chunk-FLSOVTVO.js";
-import "./chunk-HYGEXPZG.js";
-import "./chunk-ZFCZE7M7.js";
+import "./chunk-DPYULA35.js";
+import "./chunk-HOQBNMQ4.js";
+import "./chunk-I2OURFVJ.js";
 
 // src/index.ts
 import { existsSync as existsSync2, readdirSync } from "fs";
 import { createRequire } from "module";
 import { resolve as resolve2 } from "path";
-import { confirm as confirm2 } from "@inquirer/prompts";
 
 // src/prompts.ts
 import { confirm, input, select } from "@inquirer/prompts";
@@ -380,11 +379,11 @@ async function runTranslateCommand(locale, pages, force, apiKey, model, yes, pro
   }
   console.log("");
   if (!yes) {
-    const confirm3 = await input2({
+    const confirm2 = await input2({
       message: "  Proceed? (Y/n):",
       default: "Y"
     });
-    if (confirm3.toLowerCase() === "n") {
+    if (confirm2.toLowerCase() === "n") {
       console.log("\n  Aborted.");
       return;
     }
@@ -454,7 +453,6 @@ var commandFlags = {
     "--max-pages",
     "--platform",
     "--skip-validation",
-    "--trust-source",
     "--yes",
     "-y"
   ]),
@@ -502,7 +500,6 @@ Options:
   --max-pages <count>  Limit a public URL crawl to 1-1000 pages
   --platform <name>    Use mintlify, docusaurus, or auto
   --skip-validation   Import only; explicitly skip content and build verification
-  --trust-source      Allow installation and build execution of trusted source code
   --api-key <key>      Anthropic API key for non-Markdown conversion
   -y, --yes            Skip interactive prompts
   -h, --help           Show this help
@@ -619,13 +616,6 @@ async function runMigrateCommand() {
   if (docsDir) console.log(`  Docs dir: ${docsDir}`);
   console.log(`  Platform: ${platform ?? "auto-detect"}`);
   console.log("");
-  let trustSource = flags.includes("--trust-source");
-  if (!trustSource && !yes && !flags.includes("--skip-validation") && process.stdin.isTTY && process.stdout.isTTY) {
-    trustSource = await confirm2({
-      message: "Installation and build validation execute imported code on this machine. Do you trust this source and authorize execution?",
-      default: false
-    });
-  }
   const result = await migrateDocs({
     sourceUrl,
     projectDir,
@@ -636,8 +626,7 @@ async function runMigrateCommand() {
     maxPages,
     platform,
     yes,
-    skipValidation: flags.includes("--skip-validation"),
-    trustSource
+    skipValidation: flags.includes("--skip-validation")
   });
   if (result.validation.content === "failed" || result.validation.build === "failed") process.exitCode = 1;
 }

package/dist/migrate/index.d.ts

@@ -42,8 +42,6 @@ interface MigrateOptions {
     fetcher?: MigrationFetcher;
     /** Explicitly opt out of content/build gates; the report remains unverified. */
     skipValidation?: boolean;
-    /** Explicitly allow local installation/build execution of reviewed source. Never implied by yes. */
-    trustSource?: boolean;
 }
 interface MigrateResult {
     pagesWritten: number;

package/dist/migrate/index.js

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import {
   migrateDocs
-} from "../chunk-E5URHAYU.js";
-import "../chunk-74SGZLEY.js";
+} from "../chunk-V5PERCVX.js";
+import "../chunk-5TBIIZHQ.js";
 import "../chunk-ORUAMPNF.js";
-import "../chunk-FLSOVTVO.js";
-import "../chunk-HYGEXPZG.js";
-import "../chunk-ZFCZE7M7.js";
+import "../chunk-DPYULA35.js";
+import "../chunk-HOQBNMQ4.js";
+import "../chunk-I2OURFVJ.js";
 export {
   migrateDocs
 };

package/dist/release.js

@@ -3,7 +3,7 @@ import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES,
   isStableScaffoldRelease
-} from "./chunk-ZFCZE7M7.js";
+} from "./chunk-I2OURFVJ.js";
 export {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES,

package/dist/scaffold.js

@@ -1,18 +1,18 @@
 #!/usr/bin/env node
 import {
   scaffold
-} from "./chunk-74SGZLEY.js";
+} from "./chunk-5TBIIZHQ.js";
 import "./chunk-ORUAMPNF.js";
 import {
   STARTER_ARCHIVE_ROOT,
   STARTER_COMMIT_SHA,
   STARTER_REPOSITORY,
   validateStarterArchiveEntry
-} from "./chunk-FLSOVTVO.js";
-import "./chunk-HYGEXPZG.js";
+} from "./chunk-DPYULA35.js";
+import "./chunk-HOQBNMQ4.js";
 import {
   STABLE_SCAFFOLD_RELEASE
-} from "./chunk-ZFCZE7M7.js";
+} from "./chunk-I2OURFVJ.js";
 export {
   STABLE_SCAFFOLD_RELEASE,
   STARTER_ARCHIVE_ROOT,

package/dist/starter-sync.js

@@ -8,8 +8,8 @@ import {
   planStarterRuntimeSync,
   readStarterReleaseManifest,
   starterManifestSha256
-} from "./chunk-HYGEXPZG.js";
-import "./chunk-ZFCZE7M7.js";
+} from "./chunk-HOQBNMQ4.js";
+import "./chunk-I2OURFVJ.js";
 export {
   applyStarterRuntimeSyncPlan,
   classifyStarterPath,

package/dist/starter-update.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   downloadStarter
-} from "./chunk-FLSOVTVO.js";
+} from "./chunk-DPYULA35.js";
 import {
   applyStarterRuntimeSyncPlan,
   mergeStarterOwnershipContracts,
@@ -9,11 +9,11 @@ import {
   planStarterRuntimeSync,
   readStarterReleaseManifest,
   starterManifestSha256
-} from "./chunk-HYGEXPZG.js";
+} from "./chunk-HOQBNMQ4.js";
 import {
   STABLE_SCAFFOLD_RELEASE,
   SUPPORTED_SCAFFOLD_RELEASES
-} from "./chunk-ZFCZE7M7.js";
+} from "./chunk-I2OURFVJ.js";
 
 // src/starter-update.ts
 import {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-thally-docs",
-  "version": "0.10.32",
+  "version": "0.10.33",
   "description": "Scaffold an open-source Thally docs site for people, search engines, and AI tools.",
   "type": "module",
   "engines": {