nrdocs 0.1.8 → 0.2.1

package/dist/bin.mjs

@@ -599,9 +599,292 @@ function authLogout(opts = {}) {
 }
 
 // src/commands/init.ts
+import * as fs4 from "node:fs";
+import * as path5 from "node:path";
+import * as readline2 from "node:readline";
+
+// src/config/docs-config.ts
+import * as fs3 from "node:fs";
+import * as path4 from "node:path";
+import YAML from "yaml";
+
+// src/renderer/navigation.ts
 import * as fs2 from "node:fs";
 import * as path3 from "node:path";
-import * as readline2 from "node:readline";
+function extractTitle(markdownContent, filePath) {
+  const match2 = markdownContent.match(/^#\s+(.+)$/m);
+  if (match2) {
+    return match2[1].trim();
+  }
+  const basename3 = path3.basename(filePath, ".md");
+  if (basename3 === "index") {
+    return "Home";
+  }
+  return basename3.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+function findMarkdownFiles(dir, relativeTo) {
+  const results = [];
+  if (!fs2.existsSync(dir)) return results;
+  const entries = fs2.readdirSync(dir, { withFileTypes: true });
+  for (const entry of entries) {
+    const fullPath = path3.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...findMarkdownFiles(fullPath, relativeTo));
+    } else if (entry.isFile() && entry.name.endsWith(".md")) {
+      results.push(path3.relative(relativeTo, fullPath).replace(/\\/g, "/"));
+    }
+  }
+  return results;
+}
+function sortNavPaths(files, indexPath = "index.md") {
+  const normalizedIndex = indexPath.replace(/\\/g, "/");
+  const sorted = [...files].sort((a, b) => a.localeCompare(b, void 0, { numeric: true }));
+  const indexIdx = sorted.indexOf(normalizedIndex);
+  if (indexIdx <= 0) return sorted;
+  const without = sorted.filter((f) => f !== normalizedIndex);
+  return [normalizedIndex, ...without];
+}
+function mdPathToHref(filePath) {
+  const normalized = filePath.replace(/\\/g, "/");
+  const withoutExt = normalized.replace(/\.md$/, "");
+  if (withoutExt === "index" || withoutExt.endsWith("/index")) {
+    const dir = withoutExt === "index" ? "" : withoutExt.slice(0, -"/index".length);
+    return dir ? `${dir}/` : "";
+  }
+  return `${withoutExt}/`;
+}
+function navEntryFromFile(contentDir, file) {
+  const fullPath = path3.join(contentDir, file);
+  const content = fs2.readFileSync(fullPath, "utf-8");
+  return {
+    title: extractTitle(content, file),
+    path: file
+  };
+}
+function folderSegmentToTitle(segment) {
+  if (segment === "index") return "Home";
+  return segment.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
+}
+function groupNavEntriesByFolders(files, contentDir, indexPath = "index.md") {
+  const sorted = sortNavPaths(files, indexPath);
+  const rootLinks = [];
+  const byFolder = /* @__PURE__ */ new Map();
+  for (const file of sorted) {
+    const dir = path3.dirname(file).replace(/\\/g, "/");
+    if (dir === ".") {
+      rootLinks.push(navEntryFromFile(contentDir, file));
+      continue;
+    }
+    const top = dir.split("/")[0];
+    const list2 = byFolder.get(top) ?? [];
+    list2.push(file);
+    byFolder.set(top, list2);
+  }
+  const sections = [];
+  for (const folder of [...byFolder.keys()].sort(
+    (a, b) => a.localeCompare(b, void 0, { numeric: true })
+  )) {
+    const paths = sortNavPaths(byFolder.get(folder), indexPath);
+    sections.push({
+      title: folderSegmentToTitle(folder),
+      children: paths.map((f) => navEntryFromFile(contentDir, f))
+    });
+  }
+  return [...rootLinks, ...sections];
+}
+function discoverNavEntries(contentDir, options) {
+  const indexPath = (options?.indexPath ?? "index.md").replace(/\\/g, "/");
+  const files = findMarkdownFiles(contentDir, contentDir);
+  return groupNavEntriesByFolders(files, contentDir, indexPath);
+}
+function navConfigToNavItems(entries, contentDir) {
+  const items = [];
+  const walk = (list2) => {
+    for (const entry of list2) {
+      if (entry.path) {
+        const normalizedPath = entry.path.replace(/\\/g, "/");
+        items.push({
+          title: entry.title,
+          path: normalizedPath,
+          href: mdPathToHref(normalizedPath)
+        });
+      }
+      if (entry.children?.length) {
+        walk(entry.children);
+      }
+    }
+  };
+  walk(entries);
+  if (items.length === 0) {
+    throw new Error("Nav has no pages (entries need path or nested children with paths)");
+  }
+  for (const item of items) {
+    const full = path3.join(contentDir, item.path);
+    if (!fs2.existsSync(full)) {
+      throw new Error(`Nav path not found: ${item.path}`);
+    }
+  }
+  return items;
+}
+function navConfigToSidebar(entries, activePath) {
+  const normalizedActive = activePath?.replace(/\\/g, "/");
+  const mapEntry = (entry) => {
+    const children = entry.children?.length ? entry.children.map(mapEntry).filter((n) => n !== null) : [];
+    if (entry.path) {
+      const normalizedPath = entry.path.replace(/\\/g, "/");
+      return {
+        kind: "link",
+        title: entry.title,
+        path: normalizedPath,
+        href: mdPathToHref(normalizedPath),
+        active: normalizedActive === normalizedPath
+      };
+    }
+    if (children.length === 0) return null;
+    const open = normalizedActive ? children.some((c) => sidebarContainsActive(c, normalizedActive)) : true;
+    return { kind: "section", title: entry.title, children, open };
+  };
+  return entries.map(mapEntry).filter((n) => n !== null);
+}
+function sidebarContainsActive(entry, activePath) {
+  if (entry.kind === "link") return entry.path === activePath;
+  return entry.children.some((c) => sidebarContainsActive(c, activePath));
+}
+function flattenNavPaths(entries) {
+  const paths = [];
+  const walk = (list2) => {
+    for (const e of list2) {
+      if (e.path) paths.push(e.path.replace(/\\/g, "/"));
+      if (e.children?.length) walk(e.children);
+    }
+  };
+  walk(entries);
+  return paths;
+}
+
+// src/config/docs-config.ts
+function loadDocsConfig(docsDir) {
+  const configPath = path4.resolve(docsDir, "nrdocs.yml");
+  if (!fs3.existsSync(configPath)) {
+    throw new Error(`Config file not found: ${configPath}`);
+  }
+  const raw = fs3.readFileSync(configPath, "utf-8");
+  const config2 = YAML.parse(raw);
+  if (!config2 || typeof config2 !== "object") {
+    throw new Error(`Invalid config: ${configPath}`);
+  }
+  const sourceDir = config2.content?.source_dir ?? ".";
+  const contentDir = path4.resolve(docsDir, sourceDir);
+  return { config: config2, configPath, contentDir };
+}
+function hasExplicitNav(config2) {
+  return Array.isArray(config2.content?.nav);
+}
+function parseNavEntries(nav) {
+  if (!Array.isArray(nav)) {
+    throw new Error('content.nav must be a list or "auto"');
+  }
+  const entries = [];
+  for (const item of nav) {
+    if (!item || typeof item !== "object") {
+      throw new Error("Each nav entry must be an object with title");
+    }
+    const rec = item;
+    if (typeof rec["title"] !== "string") {
+      throw new Error("Each nav entry must have a title string");
+    }
+    const hasPath = typeof rec["path"] === "string";
+    const hasChildren = Array.isArray(rec["children"]) && rec["children"].length > 0;
+    if (!hasPath && !hasChildren) {
+      throw new Error("Each nav entry needs path and/or children");
+    }
+    const entry = { title: rec["title"] };
+    if (hasPath) {
+      entry.path = rec["path"].replace(/\\/g, "/");
+    }
+    if (Array.isArray(rec["children"])) {
+      entry.children = parseNavEntries(rec["children"]);
+    }
+    entries.push(entry);
+  }
+  return entries;
+}
+function getExplicitNav(config2) {
+  const nav = config2.content?.nav;
+  if (nav === void 0 || nav === "auto") return null;
+  if (Array.isArray(nav)) return parseNavEntries(nav);
+  throw new Error('content.nav must be "auto" or a list of entries');
+}
+function validateNavPaths(entries, contentDir) {
+  const errors = [];
+  const seen = /* @__PURE__ */ new Set();
+  const walk = (list2) => {
+    for (const e of list2) {
+      if (!e.path && !e.children?.length) {
+        errors.push(`Nav entry "${e.title}" has no path or children`);
+        continue;
+      }
+      if (e.path) {
+        const p = e.path.replace(/\\/g, "/");
+        if (seen.has(p)) {
+          errors.push(`Duplicate nav path: ${p}`);
+        }
+        seen.add(p);
+        const full = path4.join(contentDir, p);
+        if (!fs3.existsSync(full)) {
+          errors.push(`Nav path not found: ${p}`);
+        }
+      }
+      if (e.children?.length) walk(e.children);
+    }
+  };
+  walk(entries);
+  return { valid: errors.length === 0, errors };
+}
+function resolveContentIndex(navEntries, indexPath = "index.md") {
+  const paths = flattenNavPaths(navEntries);
+  const preferred = indexPath.replace(/\\/g, "/");
+  if (paths.includes(preferred)) return preferred;
+  return paths[0];
+}
+function writeNavToConfig(configPath, navEntries, options) {
+  const generatedBy = options?.generatedBy ?? "nrdocs nav generate";
+  let raw = fs3.readFileSync(configPath, "utf-8");
+  raw = raw.replace(/^# content\.nav generated by: .+\n/gm, "");
+  const config2 = YAML.parse(raw);
+  if (!config2 || typeof config2 !== "object") {
+    throw new Error(`Invalid config: ${configPath}`);
+  }
+  if (!config2.content) {
+    config2.content = {};
+  }
+  config2.content.nav = navEntries;
+  config2.content.index = resolveContentIndex(navEntries, options?.indexPath);
+  const doc = new YAML.Document(config2);
+  const header = `# content.nav generated by: ${generatedBy}
+`;
+  const body = doc.toString();
+  fs3.writeFileSync(configPath, header + body, "utf-8");
+}
+function generateNavInConfig(docsDir, options) {
+  const loaded = loadDocsConfig(docsDir);
+  const indexPath = options?.indexPath ?? loaded.config.content?.index ?? "index.md";
+  const entries = discoverNavEntries(loaded.contentDir, { indexPath });
+  const pageCount = flattenNavPaths(entries).length;
+  if (pageCount === 0) return 0;
+  writeNavToConfig(loaded.configPath, entries, { ...options, indexPath });
+  return pageCount;
+}
+function formatNavYaml(navEntries) {
+  const partial = {
+    content: {
+      nav: navEntries
+    }
+  };
+  return YAML.stringify(partial).trimEnd();
+}
+
+// src/commands/init.ts
 async function prompt2(question, defaultValue) {
   const rl = readline2.createInterface({
     input: process.stdin,
@@ -622,7 +905,8 @@ site:
   api_url: ${apiUrl}
 
 content:
-  index: index.md
+  source_dir: .
+  nav: auto
 `;
   if (requestedAccess) {
     yml += `
@@ -632,16 +916,6 @@ request:
   }
   return yml;
 }
-function generateIndexMd(title) {
-  return `# ${title}
-
-Welcome to your documentation site powered by nrdocs.
-
-## Getting Started
-
-Edit this file to add your documentation content.
-`;
-}
 function generateWorkflowYml(docsDir, apiUrl) {
   return `name: Publish Docs (nrdocs)
 
@@ -680,6 +954,7 @@ jobs:
         run: nrdocs publish --docs-dir ${docsDir}
         env:
           NRDOCS_API_URL: ${apiUrl}
+          NRDOCS_DOCS_PASSWORD: \${{ secrets.NRDOCS_DOCS_PASSWORD }}
 `;
 }
 function parseInitArgs(args2) {
@@ -716,9 +991,9 @@ function normalizeUrl(url) {
   return normalized;
 }
 function readExistingConfig(configPath) {
-  if (!fs2.existsSync(configPath)) return {};
+  if (!fs4.existsSync(configPath)) return {};
   try {
-    const content = fs2.readFileSync(configPath, "utf-8");
+    const content = fs4.readFileSync(configPath, "utf-8");
     const titleMatch = content.match(/(?:title|name):\s*["']?([^"'\n]+)["']?/);
     const apiMatch = content.match(/api_url:\s*["']?([^"'\n]+)["']?/);
     return {
@@ -736,11 +1011,11 @@ async function handleInit(args2) {
     process.exit(2);
   }
   const docsDir = opts.docsDir || "docs";
-  const docsPath = path3.resolve(docsDir);
-  const configFile = path3.join(docsPath, "nrdocs.yml");
+  const docsPath = path5.resolve(docsDir);
+  const configFile = path5.join(docsPath, "nrdocs.yml");
   const existing = readExistingConfig(configFile);
-  const configExists = fs2.existsSync(configFile);
-  const dirName = path3.basename(process.cwd());
+  const configExists = fs4.existsSync(configFile);
+  const dirName = path5.basename(process.cwd());
   let title = opts.title || existing.title;
   if (!title) {
     title = await prompt2("Site title", `${dirName} Docs`);
@@ -773,43 +1048,46 @@ async function handleInit(args2) {
     process.exit(2);
   }
   apiUrl = normalizeUrl(apiUrl);
-  const indexFile = path3.join(docsPath, "index.md");
-  const workflowDir = path3.resolve(".github", "workflows");
-  const workflowFile = path3.join(workflowDir, "nrdocs.yml");
-  if (!opts.force && fs2.existsSync(workflowFile)) {
+  const workflowDir = path5.resolve(".github", "workflows");
+  const workflowFile = path5.join(workflowDir, "nrdocs.yml");
+  if (!opts.force && fs4.existsSync(workflowFile)) {
     console.error("Error: Workflow already exists:");
     console.error(`  ${workflowFile}`);
     console.error("Use --force to overwrite.");
     process.exit(3);
   }
-  fs2.mkdirSync(docsPath, { recursive: true });
-  fs2.mkdirSync(workflowDir, { recursive: true });
+  fs4.mkdirSync(docsPath, { recursive: true });
+  fs4.mkdirSync(workflowDir, { recursive: true });
   const createdConfig = !configExists || opts.force;
   if (createdConfig) {
-    fs2.writeFileSync(configFile, generateNrdocsYml(title, apiUrl, opts.requestedAccess));
+    fs4.writeFileSync(configFile, generateNrdocsYml(title, apiUrl, opts.requestedAccess));
   }
-  const createdIndex = !fs2.existsSync(indexFile);
-  if (createdIndex) {
-    fs2.writeFileSync(indexFile, generateIndexMd(title));
+  fs4.writeFileSync(workflowFile, generateWorkflowYml(docsDir, apiUrl));
+  let navPageCount = 0;
+  if (createdConfig || opts.force) {
+    navPageCount = generateNavInConfig(docsDir, { generatedBy: "nrdocs init" });
   }
-  fs2.writeFileSync(workflowFile, generateWorkflowYml(docsDir, apiUrl));
   console.log("nrdocs initialized successfully!");
   console.log("");
   console.log("Created/updated:");
   if (createdConfig) {
-    console.log(`  ${path3.relative(process.cwd(), configFile)}`);
-  }
-  if (createdIndex) {
-    console.log(`  ${path3.relative(process.cwd(), indexFile)}`);
+    console.log(`  ${path5.relative(process.cwd(), configFile)}`);
   }
-  console.log(`  ${path3.relative(process.cwd(), workflowFile)}`);
+  console.log(`  ${path5.relative(process.cwd(), workflowFile)}`);
   if (!createdConfig) {
     console.log("");
-    console.log(`Using existing: ${path3.relative(process.cwd(), configFile)}`);
+    console.log(`Using existing: ${path5.relative(process.cwd(), configFile)}`);
+  }
+  if (navPageCount > 0) {
+    console.log(`  content.nav: ${navPageCount} page(s) from markdown under ${docsDir}/`);
   }
   console.log("");
   console.log("Next steps:");
-  console.log("  1. Add markdown files under docs/, then run: nrdocs nav generate");
+  if (navPageCount === 0) {
+    console.log(`  1. Add markdown files under ${docsDir}/, then run: nrdocs nav generate`);
+  } else {
+    console.log(`  1. Edit content.nav in ${path5.relative(process.cwd(), configFile)} to reorder pages`);
+  }
   console.log("  2. Commit and push to trigger the workflow");
   console.log("  3. Ask your operator to approve the repo");
 }
@@ -818,8 +1096,8 @@ async function handleInit(args2) {
 import * as fs8 from "node:fs";
 
 // src/renderer/index.ts
-import * as fs6 from "node:fs";
-import * as path7 from "node:path";
+import * as fs7 from "node:fs";
+import * as path8 from "node:path";
 
 // ../../node_modules/.pnpm/markdown-it@14.1.1/node_modules/markdown-it/lib/common/utils.mjs
 var utils_exports = {};
@@ -6021,97 +6299,6 @@ function renderMarkdown(content) {
   return md.render(content);
 }
 
-// src/renderer/navigation.ts
-import * as fs3 from "node:fs";
-import * as path4 from "node:path";
-function extractTitle(markdownContent, filePath) {
-  const match2 = markdownContent.match(/^#\s+(.+)$/m);
-  if (match2) {
-    return match2[1].trim();
-  }
-  const basename3 = path4.basename(filePath, ".md");
-  if (basename3 === "index") {
-    return "Home";
-  }
-  return basename3.replace(/[-_]/g, " ").replace(/\b\w/g, (c) => c.toUpperCase());
-}
-function findMarkdownFiles(dir, relativeTo) {
-  const results = [];
-  if (!fs3.existsSync(dir)) return results;
-  const entries = fs3.readdirSync(dir, { withFileTypes: true });
-  for (const entry of entries) {
-    const fullPath = path4.join(dir, entry.name);
-    if (entry.isDirectory()) {
-      results.push(...findMarkdownFiles(fullPath, relativeTo));
-    } else if (entry.isFile() && entry.name.endsWith(".md")) {
-      results.push(path4.relative(relativeTo, fullPath).replace(/\\/g, "/"));
-    }
-  }
-  return results;
-}
-function sortNavPaths(files, indexPath = "index.md") {
-  const normalizedIndex = indexPath.replace(/\\/g, "/");
-  const sorted = [...files].sort((a, b) => a.localeCompare(b, void 0, { numeric: true }));
-  const indexIdx = sorted.indexOf(normalizedIndex);
-  if (indexIdx <= 0) return sorted;
-  const without = sorted.filter((f) => f !== normalizedIndex);
-  return [normalizedIndex, ...without];
-}
-function mdPathToHref(filePath) {
-  const normalized = filePath.replace(/\\/g, "/");
-  const withoutExt = normalized.replace(/\.md$/, "");
-  if (withoutExt === "index" || withoutExt.endsWith("/index")) {
-    const dir = withoutExt === "index" ? "" : withoutExt.slice(0, -"/index".length);
-    return dir ? `${dir}/` : "";
-  }
-  return `${withoutExt}/`;
-}
-function discoverNavEntries(contentDir, options) {
-  const indexPath = (options?.indexPath ?? "index.md").replace(/\\/g, "/");
-  const files = findMarkdownFiles(contentDir, contentDir);
-  const sorted = sortNavPaths(files, indexPath);
-  return sorted.map((file) => {
-    const fullPath = path4.join(contentDir, file);
-    const content = fs3.readFileSync(fullPath, "utf-8");
-    return {
-      title: extractTitle(content, file),
-      path: file
-    };
-  });
-}
-function navConfigToNavItems(entries, contentDir) {
-  const items = [];
-  const walk = (list2) => {
-    for (const entry of list2) {
-      const normalizedPath = entry.path.replace(/\\/g, "/");
-      items.push({
-        title: entry.title,
-        path: normalizedPath,
-        href: mdPathToHref(normalizedPath)
-      });
-      if (entry.children?.length) {
-        walk(entry.children);
-      }
-    }
-  };
-  walk(entries);
-  for (const item of items) {
-    const full = path4.join(contentDir, item.path);
-    if (!fs3.existsSync(full)) {
-      throw new Error(`Nav path not found: ${item.path}`);
-    }
-  }
-  return items;
-}
-function generateAutoNav(docsDir, indexPath = "index.md") {
-  const entries = discoverNavEntries(docsDir, { indexPath });
-  return entries.map((e) => ({
-    title: e.title,
-    path: e.path,
-    href: mdPathToHref(e.path)
-  }));
-}
-
 // src/renderer/links.ts
 function rewriteLinks(html, basePath, owner, repo) {
   return html.replace(/<a\s+([^>]*?)href="([^"]*)"([^>]*?)>/g, (_match, before, href, after) => {
@@ -6281,6 +6468,13 @@ nav.sidebar .site-title{font-weight:700;font-size:1.1rem;color:var(--text);flex:
 #theme-toggle:hover{background:var(--bg-active)}
 nav.sidebar ul{list-style:none}
 nav.sidebar li{margin-bottom:0.25rem}
+nav.sidebar .nav-section{margin-top:0.5rem}
+nav.sidebar .nav-section>summary{cursor:pointer;font-size:0.8rem;font-weight:600;text-transform:uppercase;letter-spacing:0.04em;color:var(--toc-title);padding:0.35rem 0.6rem;list-style:none;border-radius:4px;user-select:none}
+nav.sidebar .nav-section>summary::-webkit-details-marker{display:none}
+nav.sidebar .nav-section>summary::before{content:"\u25B8";display:inline-block;margin-right:0.35rem;transition:transform 0.15s ease}
+nav.sidebar .nav-section[open]>summary::before{transform:rotate(90deg)}
+nav.sidebar .nav-section>summary:hover{background:var(--bg-hover);color:var(--text)}
+nav.sidebar .nav-section ul{padding-left:0.25rem;margin-top:0.15rem;margin-bottom:0.35rem}
 nav.sidebar a{color:var(--text-muted);text-decoration:none;padding:0.3rem 0.6rem;display:block;border-radius:4px;font-size:0.95rem}
 nav.sidebar a:hover{background:var(--bg-hover);color:var(--text)}
 nav.sidebar a.active{background:var(--bg-active);color:var(--link-active);font-weight:500}
@@ -6322,7 +6516,7 @@ footer a{color:var(--link)}
 <button type="button" id="theme-toggle" aria-label="Toggle color theme" title="Toggle light/dark mode">&#9789;</button>
 </div>
 <ul>
-${renderNavItems(nav, baseUrl)}
+${renderNavTree(nav, baseUrl)}
 </ul>
 </nav>
 <div class="content-wrapper">
@@ -6373,22 +6567,30 @@ ${items}
 </ul>
 </aside>`;
 }
-function renderNavItems(items, baseUrl) {
-  return items.map((item) => {
-    const href = baseUrl + item.href;
-    const activeClass = item.active ? ' class="active"' : "";
-    return `<li><a href="${escapeHtml2(href)}"${activeClass}>${escapeHtml2(item.title)}</a></li>`;
-  }).join("\n");
+function renderNavTree(entries, baseUrl) {
+  return entries.map((entry) => renderNavNode(entry, baseUrl)).join("\n");
+}
+function renderNavNode(entry, baseUrl) {
+  if (entry.kind === "link") {
+    const href = baseUrl + entry.href;
+    const activeClass = entry.active ? ' class="active"' : "";
+    return `<li><a href="${escapeHtml2(href)}"${activeClass}>${escapeHtml2(entry.title)}</a></li>`;
+  }
+  const openAttr = entry.open !== false ? " open" : "";
+  const childItems = entry.children.map((c) => renderNavNode(c, baseUrl)).join("\n");
+  return `<li class="nav-section"><details class="nav-details"${openAttr}><summary>${escapeHtml2(entry.title)}</summary><ul>
+${childItems}
+</ul></details></li>`;
 }
 function escapeHtml2(str) {
   return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
 
 // src/renderer/assets.ts
-import * as fs4 from "node:fs";
-import * as path5 from "node:path";
+import * as fs5 from "node:fs";
+import * as path6 from "node:path";
 function collectAssets(docsDir) {
-  const resolvedDocsDir = path5.resolve(docsDir);
+  const resolvedDocsDir = path6.resolve(docsDir);
   const files = [];
   collectFromDir(resolvedDocsDir, resolvedDocsDir, files);
   return files;
@@ -6396,13 +6598,13 @@ function collectAssets(docsDir) {
 function collectFromDir(dir, rootDir, results) {
   let entries;
   try {
-    entries = fs4.readdirSync(dir, { withFileTypes: true });
+    entries = fs5.readdirSync(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const fullPath = path5.join(dir, entry.name);
-    const resolved = path5.resolve(fullPath);
+    const fullPath = path6.join(dir, entry.name);
+    const resolved = path6.resolve(fullPath);
     if (!resolved.startsWith(rootDir)) {
       continue;
     }
@@ -6410,37 +6612,37 @@ function collectFromDir(dir, rootDir, results) {
       if (entry.name.startsWith(".")) continue;
       collectFromDir(fullPath, rootDir, results);
     } else if (entry.isFile()) {
-      const ext = path5.extname(entry.name).toLowerCase();
+      const ext = path6.extname(entry.name).toLowerCase();
       if (ext === ".md") continue;
       if (REJECTED_EXTENSIONS.has(ext)) continue;
       if (!ALLOWED_ASSET_EXTENSIONS.has(ext)) continue;
-      const relativePath = path5.relative(rootDir, fullPath);
+      const relativePath = path6.relative(rootDir, fullPath);
       if (relativePath.includes("..")) continue;
       results.push({
         path: relativePath.replace(/\\/g, "/"),
-        content: fs4.readFileSync(fullPath)
+        content: fs5.readFileSync(fullPath)
       });
     }
   }
 }
 
 // src/renderer/mermaid-runtime.ts
-import * as fs5 from "node:fs";
-import * as path6 from "node:path";
+import * as fs6 from "node:fs";
+import * as path7 from "node:path";
 import { fileURLToPath } from "node:url";
-var __dirname = path6.dirname(fileURLToPath(import.meta.url));
+var __dirname = path7.dirname(fileURLToPath(import.meta.url));
 var MERMAID_RUNTIME_REL = "runtime/mermaid.min.js";
 var MERMAID_ARTIFACT_PATH = "_nrdocs/mermaid.min.js";
 function mermaidRuntimeCandidates() {
   return [
-    path6.join(__dirname, MERMAID_RUNTIME_REL),
-    path6.join(__dirname, "../../dist/runtime/mermaid.min.js")
+    path7.join(__dirname, MERMAID_RUNTIME_REL),
+    path7.join(__dirname, "../../dist/runtime/mermaid.min.js")
   ];
 }
 function loadMermaidRuntime() {
   for (const candidate of mermaidRuntimeCandidates()) {
-    if (fs5.existsSync(candidate)) {
-      return fs5.readFileSync(candidate);
+    if (fs6.existsSync(candidate)) {
+      return fs6.readFileSync(candidate);
     }
   }
   throw new Error(
@@ -6454,40 +6656,44 @@ function mermaidScriptSrcForOutput(outputPath) {
 }
 
 // src/renderer/index.ts
-function resolveNavItems(resolvedDocsDir, nav, indexPath) {
+function resolveNav(resolvedDocsDir, nav, indexPath) {
   if (nav && nav !== "auto" && Array.isArray(nav)) {
-    return navConfigToNavItems(nav, resolvedDocsDir);
+    return {
+      items: navConfigToNavItems(nav, resolvedDocsDir),
+      sidebarConfig: nav
+    };
   }
-  return generateAutoNav(resolvedDocsDir, indexPath);
+  const sidebarConfig = discoverNavEntries(resolvedDocsDir, { indexPath });
+  return {
+    items: navConfigToNavItems(sidebarConfig, resolvedDocsDir),
+    sidebarConfig
+  };
 }
 async function renderSite(options) {
   const { docsDir, siteTitle, baseUrl, owner, repo, nav, indexPath = "index.md" } = options;
-  const resolvedDocsDir = path7.resolve(docsDir);
-  const navItems = resolveNavItems(resolvedDocsDir, nav, indexPath);
+  const resolvedDocsDir = path8.resolve(docsDir);
+  const { items: navItems, sidebarConfig } = resolveNav(resolvedDocsDir, nav, indexPath);
   const siteBase = `/${owner}/${repo}/`;
   const renderedFiles = [];
   let siteHasMermaid = false;
   for (const navItem of navItems) {
-    const filePath = path7.join(resolvedDocsDir, navItem.path);
-    const markdownContent = fs6.readFileSync(filePath, "utf-8");
+    const filePath = path8.join(resolvedDocsDir, navItem.path);
+    const markdownContent = fs7.readFileSync(filePath, "utf-8");
     const pageHasMermaid = contentHasMermaid(markdownContent);
     if (pageHasMermaid) siteHasMermaid = true;
     let html = renderMarkdown(markdownContent);
-    const fileDir = path7.dirname(navItem.path);
+    const fileDir = path8.dirname(navItem.path);
     const baseLinkPath = fileDir === "." ? "" : fileDir;
     html = rewriteLinks(html, baseLinkPath, owner, repo);
     const pageTitle = extractTitle(markdownContent, navItem.path);
     const canonicalUrl = `${baseUrl}${siteBase}${navItem.href}`;
-    const navWithActive = navItems.map((item) => ({
-      ...item,
-      active: item.path === navItem.path
-    }));
+    const sidebar = navConfigToSidebar(sidebarConfig, navItem.path);
     const outputPath = navItem.href === "" ? "index.html" : navItem.href.replace(/\/$/, "") + "/index.html";
     const fullHtml = wrapInTemplate({
       title: pageTitle,
       siteTitle,
       content: html,
-      nav: navWithActive,
+      nav: sidebar,
       canonicalUrl,
       baseUrl: siteBase,
       includeMermaid: pageHasMermaid,
@@ -6918,15 +7124,23 @@ var ApiClient = class {
       password
     });
   }
+  async setSelfPasswordAllow(owner, repo, allow) {
+    const path12 = allow ? `/api/repos/${owner}/${repo}/allow-self-password` : `/api/repos/${owner}/${repo}/disallow-self-password`;
+    return this.request("POST", path12);
+  }
   async listRules() {
     return this.request("GET", "/api/auto-approval-rules");
   }
-  async addRule(pattern, accessMode, applyExisting) {
-    return this.request("POST", "/api/auto-approval-rules", {
+  async addRule(pattern, accessMode, applyExisting, defaultAllowSelfPassword) {
+    const body = {
       pattern,
       access_mode: accessMode,
       apply_existing: applyExisting ?? false
-    });
+    };
+    if (defaultAllowSelfPassword !== void 0) {
+      body["default_allow_repo_owner_password"] = defaultAllowSelfPassword;
+    }
+    return this.request("POST", "/api/auto-approval-rules", body);
   }
   async removeRule(ruleId) {
     return this.request("DELETE", `/api/auto-approval-rules/${ruleId}`);
@@ -6980,102 +7194,6 @@ var ApiClient = class {
   }
 };
 
-// src/config/docs-config.ts
-import * as fs7 from "node:fs";
-import * as path8 from "node:path";
-import YAML from "yaml";
-function loadDocsConfig(docsDir) {
-  const configPath = path8.resolve(docsDir, "nrdocs.yml");
-  if (!fs7.existsSync(configPath)) {
-    throw new Error(`Config file not found: ${configPath}`);
-  }
-  const raw = fs7.readFileSync(configPath, "utf-8");
-  const config2 = YAML.parse(raw);
-  if (!config2 || typeof config2 !== "object") {
-    throw new Error(`Invalid config: ${configPath}`);
-  }
-  const sourceDir = config2.content?.source_dir ?? ".";
-  const contentDir = path8.resolve(docsDir, sourceDir);
-  return { config: config2, configPath, contentDir };
-}
-function hasExplicitNav(config2) {
-  return Array.isArray(config2.content?.nav);
-}
-function parseNavEntries(nav) {
-  if (!Array.isArray(nav)) {
-    throw new Error('content.nav must be a list or "auto"');
-  }
-  const entries = [];
-  for (const item of nav) {
-    if (!item || typeof item !== "object") {
-      throw new Error("Each nav entry must have title and path");
-    }
-    const rec = item;
-    if (typeof rec["title"] !== "string" || typeof rec["path"] !== "string") {
-      throw new Error("Each nav entry must have title and path strings");
-    }
-    const entry = {
-      title: rec["title"],
-      path: rec["path"].replace(/\\/g, "/")
-    };
-    if (Array.isArray(rec["children"])) {
-      entry.children = parseNavEntries(rec["children"]);
-    }
-    entries.push(entry);
-  }
-  return entries;
-}
-function getExplicitNav(config2) {
-  const nav = config2.content?.nav;
-  if (nav === void 0 || nav === "auto") return null;
-  if (Array.isArray(nav)) return parseNavEntries(nav);
-  throw new Error('content.nav must be "auto" or a list of entries');
-}
-function validateNavPaths(entries, contentDir) {
-  const errors = [];
-  const seen = /* @__PURE__ */ new Set();
-  const walk = (list2) => {
-    for (const e of list2) {
-      const p = e.path.replace(/\\/g, "/");
-      if (seen.has(p)) {
-        errors.push(`Duplicate nav path: ${p}`);
-      }
-      seen.add(p);
-      const full = path8.join(contentDir, p);
-      if (!fs7.existsSync(full)) {
-        errors.push(`Nav path not found: ${p}`);
-      }
-      if (e.children?.length) walk(e.children);
-    }
-  };
-  walk(entries);
-  return { valid: errors.length === 0, errors };
-}
-function writeNavToConfig(configPath, navEntries) {
-  let raw = fs7.readFileSync(configPath, "utf-8");
-  raw = raw.replace(/^# content\.nav generated by: nrdocs nav generate\n/gm, "");
-  const config2 = YAML.parse(raw);
-  if (!config2 || typeof config2 !== "object") {
-    throw new Error(`Invalid config: ${configPath}`);
-  }
-  if (!config2.content) {
-    config2.content = {};
-  }
-  config2.content.nav = navEntries;
-  const doc = new YAML.Document(config2);
-  const header = "# content.nav generated by: nrdocs nav generate\n";
-  const body = doc.toString();
-  fs7.writeFileSync(configPath, header + body, "utf-8");
-}
-function formatNavYaml(navEntries) {
-  const partial = {
-    content: {
-      nav: navEntries
-    }
-  };
-  return YAML.stringify(partial).trimEnd();
-}
-
 // src/commands/publish.ts
 function parsePublishArgs(args2) {
   const opts = {};
@@ -7228,6 +7346,10 @@ async function handlePublish(args2) {
     artifact: { format: "tar.gz", size_bytes: archive.length },
     nrdocs: { cli_version: "0.1.1" }
   }));
+  const docsPasswordRaw = process.env["NRDOCS_DOCS_PASSWORD"];
+  if (typeof docsPasswordRaw === "string" && docsPasswordRaw.length > 0) {
+    formData.append("password", docsPasswordRaw);
+  }
   const result = await client.publish(formData, opts.verbose);
   if (result.ok) {
     const data = result.data;
@@ -7556,7 +7678,7 @@ async function handleNavGenerate(args2) {
     console.log(formatNavYaml(entries));
     return;
   }
-  writeNavToConfig(loaded.configPath, entries);
+  generateNavInConfig(docsDir, { generatedBy: "nrdocs nav generate", indexPath });
   if (!opts.json) {
     console.log(`Generated navigation for ${entries.length} page(s) in ${path10.relative(process.cwd(), configPath)}`);
     console.log("Edit the file to reorder or rename entries, then run publish.");
@@ -8188,6 +8310,83 @@ async function handlePasswordSet(args2) {
     console.log(`Password set for ${owner}/${repo}.`);
   }
 }
+function parsePasswordAllowArgs(args2) {
+  const opts = {};
+  for (let i = 0; i < args2.length; i++) {
+    const arg = args2[i];
+    if (arg === "--json") {
+      opts.json = true;
+    } else if (!arg?.startsWith("--") && !opts.repo) {
+      opts.repo = arg;
+    }
+  }
+  return opts;
+}
+function parsePasswordDisallowArgs(args2) {
+  return parsePasswordAllowArgs(args2);
+}
+async function handlePasswordAllow(args2) {
+  const opts = parsePasswordAllowArgs(args2);
+  if (!opts.repo) {
+    console.error("Error: Repository required. Usage: nrdocs password allow owner/repo");
+    process.exit(2);
+  }
+  const parts = opts.repo.split("/");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    console.error('Error: Repository must be in "owner/repo" format.');
+    process.exit(2);
+  }
+  const [owner, repo] = parts;
+  let creds;
+  try {
+    creds = resolveCredentials();
+  } catch (e) {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+  const client = new ApiClient(creds.api_url, creds.operator_token);
+  const res = await client.setSelfPasswordAllow(owner, repo, true);
+  if (!res.ok) {
+    console.error(`Error: ${res.error?.message ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(res.data, null, 2));
+  } else {
+    console.log(`Self-service password enabled for ${owner}/${repo}.`);
+  }
+}
+async function handlePasswordDisallow(args2) {
+  const opts = parsePasswordDisallowArgs(args2);
+  if (!opts.repo) {
+    console.error("Error: Repository required. Usage: nrdocs password disallow owner/repo");
+    process.exit(2);
+  }
+  const parts = opts.repo.split("/");
+  if (parts.length !== 2 || !parts[0] || !parts[1]) {
+    console.error('Error: Repository must be in "owner/repo" format.');
+    process.exit(2);
+  }
+  const [owner, repo] = parts;
+  let creds;
+  try {
+    creds = resolveCredentials();
+  } catch (e) {
+    console.error(e instanceof Error ? e.message : String(e));
+    process.exit(1);
+  }
+  const client = new ApiClient(creds.api_url, creds.operator_token);
+  const res = await client.setSelfPasswordAllow(owner, repo, false);
+  if (!res.ok) {
+    console.error(`Error: ${res.error?.message ?? "Unknown error"}`);
+    process.exit(1);
+  }
+  if (opts.json) {
+    console.log(JSON.stringify(res.data, null, 2));
+  } else {
+    console.log(`Self-service password disabled for ${owner}/${repo}.`);
+  }
+}
 
 // src/commands/rules.ts
 function parseRulesListArgs(args2) {
@@ -8206,6 +8405,13 @@ function parseRulesAddArgs(args2) {
       opts.access = args2[++i];
     } else if (arg === "--apply-existing") {
       opts.applyExisting = true;
+    } else if (arg === "--self-set-password" && i + 1 < args2.length) {
+      const v = args2[++i];
+      if (v === "allow" || v === "deny") {
+        opts.selfSetPassword = v;
+      } else {
+        opts.selfSetPassword = "__invalid__";
+      }
     } else if (arg === "--json") {
       opts.json = true;
     } else if (!arg?.startsWith("--")) {
@@ -8229,11 +8435,12 @@ function parseRulesRemoveArgs(args2) {
 }
 function formatRulesTable(rules) {
   if (rules.length === 0) return "No rules configured.";
-  const headers = ["ID", "PATTERN", "ACCESS", "ENABLED", "PRIORITY"];
+  const headers = ["ID", "PATTERN", "ACCESS", "SELF-PWD", "ENABLED", "PRIORITY"];
   const rows = rules.map((r) => [
     String(r["id"] ?? "-").slice(0, 8),
     String(r["pattern"] ?? "-"),
     String(r["access_mode"] ?? "-"),
+    r["default_allow_repo_owner_password"] === true ? "allow" : "deny",
     String(r["enabled"] ?? "-"),
     String(r["priority"] ?? "-")
   ]);
@@ -8286,6 +8493,11 @@ async function handleRulesAdd(args2) {
     console.error('Error: --access is required and must be "public" or "password".');
     process.exit(2);
   }
+  if (opts.selfSetPassword !== void 0 && opts.selfSetPassword !== "allow" && opts.selfSetPassword !== "deny") {
+    console.error('Error: --self-set-password must be "allow" or "deny".');
+    process.exit(2);
+  }
+  const defaultAllowSelfPassword = opts.selfSetPassword === void 0 ? true : opts.selfSetPassword === "allow";
   let creds;
   try {
     creds = resolveCredentials();
@@ -8294,7 +8506,7 @@ async function handleRulesAdd(args2) {
     process.exit(1);
   }
   const client = new ApiClient(creds.api_url, creds.operator_token);
-  const res = await client.addRule(opts.pattern, opts.access, opts.applyExisting);
+  const res = await client.addRule(opts.pattern, opts.access, opts.applyExisting, defaultAllowSelfPassword);
   if (!res.ok) {
     console.error(`Error: ${res.error?.message ?? "Unknown error"}`);
     process.exit(1);
@@ -8564,11 +8776,19 @@ async function runCommand(args2) {
       }
       break;
     case "password":
-      if (subCmd === "set") {
-        await handlePasswordSet(args2.slice(2));
-      } else {
-        console.error("Usage: nrdocs password set <owner/repo> [--from-stdin]");
-        process.exitCode = 1;
+      switch (subCmd) {
+        case "set":
+          await handlePasswordSet(args2.slice(2));
+          break;
+        case "allow":
+          await handlePasswordAllow(args2.slice(2));
+          break;
+        case "disallow":
+          await handlePasswordDisallow(args2.slice(2));
+          break;
+        default:
+          console.error("Usage: nrdocs password <set|allow|disallow> <owner/repo> [...]");
+          process.exitCode = 1;
       }
       break;
     case "rules":
@@ -8682,7 +8902,7 @@ Operator commands:
   approve     Approve a repo for serving
   disable     Disable serving for a repo
   access      Change access mode
-  password    Set or rotate password
+  password    Manage passwords (set | allow | disallow)
   rules       Manage auto-approval rules
   status      Show repo status
   config      Show configuration

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nrdocs",
-  "version": "0.1.8",
+  "version": "0.2.1",
   "description": "CLI for nrdocs - serverless docs publishing for private GitHub repos",
   "type": "module",
   "bin": {
@@ -23,8 +23,9 @@
     "@types/markdown-it": "^14.1.2",
     "@types/node": "^20.14.0",
     "esbuild": "^0.28.0",
-    "mermaid": "^11.6.0",
+    "fast-check": "^4.8.0",
     "markdown-it": "^14.1.1",
+    "mermaid": "^11.6.0",
     "typescript": "^5.5.0",
     "vitest": "^2.0.0"
   },