@sanity/cli 6.1.7 → 6.1.8

package/dist/actions/build/buildStudio.js

@@ -39,7 +39,7 @@ import { shouldAutoUpdate } from './shouldAutoUpdate.js';
         output,
         workDir
     });
-    let autoUpdatesEnabled = shouldAutoUpdate({
+    let autoUpdatesEnabled = options.calledFromDeploy ? options.autoUpdatesEnabled : shouldAutoUpdate({
         cliConfig,
         flags,
         output

package/dist/actions/build/buildStudio.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/actions/build/buildStudio.ts"],"sourcesContent":["import {rm} from 'node:fs/promises'\nimport path from 'node:path'\nimport {styleText} from 'node:util'\n\nimport {getCliTelemetry, getTimer, isInteractive} from '@sanity/cli-core'\nimport {confirm, logSymbols, select, spinner, type SpinnerInstance} from '@sanity/cli-core/ux'\nimport semver from 'semver'\n\nimport {StudioBuildTrace} from '../../telemetry/build.telemetry.js'\nimport {getAppId} from '../../util/appId.js'\nimport {compareDependencyVersions} from '../../util/compareDependencyVersions.js'\nimport {formatModuleSizes, sortModulesBySize} from '../../util/moduleFormatUtils.js'\nimport {getPackageManagerChoice} from '../../util/packageManager/packageManagerChoice.js'\nimport {upgradePackages} from '../../util/packageManager/upgradePackages.js'\nimport {warnAboutMissingAppId} from '../../util/warnAboutMissingAppId.js'\nimport {buildDebug} from './buildDebug.js'\nimport {buildStaticFiles} from './buildStaticFiles.js'\nimport {buildVendorDependencies} from './buildVendorDependencies.js'\nimport {checkRequiredDependencies} from './checkRequiredDependencies.js'\nimport {checkStudioDependencyVersions} from './checkStudioDependencyVersions.js'\nimport {determineBasePath} from './determineBasePath.js'\nimport {getAutoUpdatesImportMap} from './getAutoUpdatesImportMap.js'\nimport {getStudioEnvVars} from './getStudioEnvVars.js'\nimport {handlePrereleaseVersions} from './handlePrereleaseVersions.js'\nimport {shouldAutoUpdate} from './shouldAutoUpdate.js'\nimport {type BuildOptions} from './types.js'\n\n/**\n * Build the Sanity Studio.\n *\n * @internal\n */\nexport async function buildStudio(options: BuildOptions): Promise<void> {\n  const timer = getTimer()\n  const {cliConfig, flags, outDir, output, workDir} = options\n\n  const unattendedMode = Boolean(flags.yes)\n  const defaultOutputDir = path.resolve(path.join(workDir, 'dist'))\n  const outputDir = path.resolve(outDir || defaultOutputDir)\n\n  await checkStudioDependencyVersions(workDir, output)\n\n  // If the check resulted in a dependency install, the CLI command will be re-run,\n  // thus we want to exit early\n  const {installedSanityVersion} = await checkRequiredDependencies({\n    cliConfig,\n    output,\n    workDir,\n  })\n\n  let autoUpdatesEnabled = shouldAutoUpdate({cliConfig, flags, output})\n\n  let autoUpdatesImports = {}\n\n  if (autoUpdatesEnabled) {\n    // Get the clean version without build metadata: https://semver.org/#spec-item-10\n    const cleanSanityVersion = semver.parse(installedSanityVersion)?.version\n    if (!cleanSanityVersion) {\n      throw new Error(`Failed to parse installed Sanity version: ${installedSanityVersion}`)\n    }\n\n    output.log(`${logSymbols.info} Building with auto-updates enabled`)\n\n    const projectId = cliConfig?.api?.projectId\n    const appId = getAppId(cliConfig)\n\n    // Warn if auto updates enabled but no appId configured.\n    // Skip when called from deploy, since deploy handles appId itself\n    // (prompts the user and tells them to add it to config).\n    if (!appId && !options.calledFromDeploy) {\n      warnAboutMissingAppId({appType: 'studio', output, projectId})\n    }\n\n    const sanityDependencies = [\n      {name: 'sanity', version: cleanSanityVersion},\n      {name: '@sanity/vision', version: cleanSanityVersion},\n    ]\n    autoUpdatesImports = getAutoUpdatesImportMap(sanityDependencies, {appId})\n\n    // Check the versions\n    const {mismatched, unresolvedPrerelease} = await compareDependencyVersions(\n      sanityDependencies,\n      workDir,\n      {appId},\n    )\n\n    if (unresolvedPrerelease.length > 0) {\n      await handlePrereleaseVersions({output, unattendedMode, unresolvedPrerelease})\n      autoUpdatesImports = {}\n      autoUpdatesEnabled = false\n    }\n\n    if (mismatched.length > 0 && autoUpdatesEnabled) {\n      const versionMismatchWarning =\n        `The following local package versions are different from the versions currently served at runtime.\\n` +\n        `When using auto updates, we recommend that you test locally with the same versions before deploying. \\n\\n` +\n        `${mismatched.map((mod) => ` - ${mod.pkg} (local version: ${mod.installed}, runtime version: ${mod.remote})`).join('\\n')}`\n\n      // If it is non-interactive or in unattended mode, we don't want to prompt\n      if (isInteractive() && !unattendedMode) {\n        const choice = await select({\n          choices: [\n            {\n              name: `Upgrade local versions (recommended). You will need to run the build command again`,\n              value: 'upgrade',\n            },\n            {\n              name: `Upgrade and proceed with build`,\n              value: 'upgrade-and-proceed',\n            },\n            {\n              name: `Continue anyway`,\n              value: 'continue',\n            },\n            {name: 'Cancel', value: 'cancel'},\n          ],\n          default: 'upgrade',\n          message: styleText(\n            'yellow',\n            `${logSymbols.warning} ${versionMismatchWarning}\\n\\nDo you want to upgrade local versions before deploying?`,\n          ),\n        })\n\n        if (choice === 'cancel') {\n          output.error('Declined to continue with build', {exit: 1})\n          return\n        }\n\n        if (choice === 'upgrade' || choice === 'upgrade-and-proceed') {\n          await upgradePackages(\n            {\n              packageManager: (await getPackageManagerChoice(workDir, {interactive: false})).chosen,\n              packages: mismatched.map((res) => [res.pkg, res.remote]),\n            },\n            {output, workDir},\n          )\n\n          if (choice === 'upgrade') {\n            return\n          }\n        }\n      } else {\n        // if non-interactive or unattended, just show the warning\n        output.warn(versionMismatchWarning)\n      }\n    }\n  }\n\n  const envVarKeys = getStudioEnvVars()\n  if (envVarKeys.length > 0) {\n    output.log('\\nIncluding the following environment variables as part of the JavaScript bundle:')\n    for (const key of envVarKeys) {\n      output.log(`- ${key}`)\n    }\n    output.log('')\n  }\n\n  let shouldClean = true\n  if (outputDir !== defaultOutputDir && !unattendedMode && isInteractive()) {\n    shouldClean = await confirm({\n      default: true,\n      message: `Do you want to delete the existing directory (${outputDir}) first?`,\n    })\n  }\n\n  // Determine base path for built studio\n  const basePath = determineBasePath(cliConfig, 'studio', output)\n\n  let spin: SpinnerInstance\n  if (shouldClean) {\n    timer.start('cleanOutputFolder')\n    spin = spinner('Clean output folder').start()\n    await rm(outputDir, {force: true, recursive: true})\n    const cleanDuration = timer.end('cleanOutputFolder')\n    spin.text = `Clean output folder (${cleanDuration.toFixed(0)}ms)`\n    spin.succeed()\n  }\n\n  spin = spinner(`Build Sanity Studio`).start()\n\n  const trace = getCliTelemetry().trace(StudioBuildTrace)\n  trace.start()\n\n  let importMap\n\n  if (autoUpdatesEnabled) {\n    importMap = {\n      imports: {\n        ...(await buildVendorDependencies({basePath, cwd: workDir, isApp: false, outputDir})),\n        ...autoUpdatesImports,\n      },\n    }\n  }\n\n  try {\n    timer.start('bundleStudio')\n\n    const bundle = await buildStaticFiles({\n      basePath,\n      cwd: workDir,\n      importMap,\n      minify: Boolean(flags.minify),\n      outputDir,\n      reactCompiler:\n        cliConfig && 'reactCompiler' in cliConfig ? cliConfig.reactCompiler : undefined,\n      sourceMap: Boolean(flags['source-maps']),\n      vite: cliConfig && 'vite' in cliConfig ? cliConfig.vite : undefined,\n    })\n\n    trace.log({\n      outputSize: bundle.chunks\n        .flatMap((chunk) => chunk.modules.flatMap((mod) => mod.renderedLength))\n        .reduce((sum, n) => sum + n, 0),\n    })\n    const buildDuration = timer.end('bundleStudio')\n\n    spin.text = `Build Sanity Studio (${buildDuration.toFixed(0)}ms)`\n    spin.succeed()\n\n    trace.complete()\n    if (flags.stats) {\n      output.log('\\nLargest module files:')\n      output.log(formatModuleSizes(sortModulesBySize(bundle.chunks).slice(0, 15)))\n    }\n  } catch (error) {\n    spin.fail()\n    trace.error(error)\n    const message = error instanceof Error ? error.message : String(error)\n    buildDebug(`Failed to build Sanity Studio`, {error})\n    output.error(`Failed to build Sanity Studio: ${message}`, {exit: 1})\n  }\n}\n"],"names":["rm","path","styleText","getCliTelemetry","getTimer","isInteractive","confirm","logSymbols","select","spinner","semver","StudioBuildTrace","getAppId","compareDependencyVersions","formatModuleSizes","sortModulesBySize","getPackageManagerChoice","upgradePackages","warnAboutMissingAppId","buildDebug","buildStaticFiles","buildVendorDependencies","checkRequiredDependencies","checkStudioDependencyVersions","determineBasePath","getAutoUpdatesImportMap","getStudioEnvVars","handlePrereleaseVersions","shouldAutoUpdate","buildStudio","options","timer","cliConfig","flags","outDir","output","workDir","unattendedMode","Boolean","yes","defaultOutputDir","resolve","join","outputDir","installedSanityVersion","autoUpdatesEnabled","autoUpdatesImports","cleanSanityVersion","parse","version","Error","log","info","projectId","api","appId","calledFromDeploy","appType","sanityDependencies","name","mismatched","unresolvedPrerelease","length","versionMismatchWarning","map","mod","pkg","installed","remote","choice","choices","value","default","message","warning","error","exit","packageManager","interactive","chosen","packages","res","warn","envVarKeys","key","shouldClean","basePath","spin","start","force","recursive","cleanDuration","end","text","toFixed","succeed","trace","importMap","imports","cwd","isApp","bundle","minify","reactCompiler","undefined","sourceMap","vite","outputSize","chunks","flatMap","chunk","modules","renderedLength","reduce","sum","n","buildDuration","complete","stats","slice","fail","String"],"mappings":"AAAA,SAAQA,EAAE,QAAO,mBAAkB;AACnC,OAAOC,UAAU,YAAW;AAC5B,SAAQC,SAAS,QAAO,YAAW;AAEnC,SAAQC,eAAe,EAAEC,QAAQ,EAAEC,aAAa,QAAO,mBAAkB;AACzE,SAAQC,OAAO,EAAEC,UAAU,EAAEC,MAAM,EAAEC,OAAO,QAA6B,sBAAqB;AAC9F,OAAOC,YAAY,SAAQ;AAE3B,SAAQC,gBAAgB,QAAO,qCAAoC;AACnE,SAAQC,QAAQ,QAAO,sBAAqB;AAC5C,SAAQC,yBAAyB,QAAO,0CAAyC;AACjF,SAAQC,iBAAiB,EAAEC,iBAAiB,QAAO,kCAAiC;AACpF,SAAQC,uBAAuB,QAAO,oDAAmD;AACzF,SAAQC,eAAe,QAAO,+CAA8C;AAC5E,SAAQC,qBAAqB,QAAO,sCAAqC;AACzE,SAAQC,UAAU,QAAO,kBAAiB;AAC1C,SAAQC,gBAAgB,QAAO,wBAAuB;AACtD,SAAQC,uBAAuB,QAAO,+BAA8B;AACpE,SAAQC,yBAAyB,QAAO,iCAAgC;AACxE,SAAQC,6BAA6B,QAAO,qCAAoC;AAChF,SAAQC,iBAAiB,QAAO,yBAAwB;AACxD,SAAQC,uBAAuB,QAAO,+BAA8B;AACpE,SAAQC,gBAAgB,QAAO,wBAAuB;AACtD,SAAQC,wBAAwB,QAAO,gCAA+B;AACtE,SAAQC,gBAAgB,QAAO,wBAAuB;AAGtD;;;;CAIC,GACD,OAAO,eAAeC,YAAYC,OAAqB;IACrD,MAAMC,QAAQ3B;IACd,MAAM,EAAC4B,SAAS,EAAEC,KAAK,EAAEC,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAC,GAAGN;IAEpD,MAAMO,iBAAiBC,QAAQL,MAAMM,GAAG;IACxC,MAAMC,mBAAmBvC,KAAKwC,OAAO,CAACxC,KAAKyC,IAAI,CAACN,SAAS;IACzD,MAAMO,YAAY1C,KAAKwC,OAAO,CAACP,UAAUM;IAEzC,MAAMjB,8BAA8Ba,SAASD;IAE7C,iFAAiF;IACjF,6BAA6B;IAC7B,MAAM,EAACS,sBAAsB,EAAC,GAAG,MAAMtB,0BAA0B;QAC/DU;QACAG;QACAC;IACF;IAEA,IAAIS,qBAAqBjB,iBAAiB;QAACI;QAAWC;QAAOE;IAAM;IAEnE,IAAIW,qBAAqB,CAAC;IAE1B,IAAID,oBAAoB;QACtB,iFAAiF;QACjF,MAAME,qBAAqBrC,OAAOsC,KAAK,CAACJ,yBAAyBK;QACjE,IAAI,CAACF,oBAAoB;YACvB,MAAM,IAAIG,MAAM,CAAC,0CAA0C,EAAEN,wBAAwB;QACvF;QAEAT,OAAOgB,GAAG,CAAC,GAAG5C,WAAW6C,IAAI,CAAC,mCAAmC,CAAC;QAElE,MAAMC,YAAYrB,WAAWsB,KAAKD;QAClC,MAAME,QAAQ3C,SAASoB;QAEvB,wDAAwD;QACxD,kEAAkE;QAClE,yDAAyD;QACzD,IAAI,CAACuB,SAAS,CAACzB,QAAQ0B,gBAAgB,EAAE;YACvCtC,sBAAsB;gBAACuC,SAAS;gBAAUtB;gBAAQkB;YAAS;QAC7D;QAEA,MAAMK,qBAAqB;YACzB;gBAACC,MAAM;gBAAUV,SAASF;YAAkB;YAC5C;gBAACY,MAAM;gBAAkBV,SAASF;YAAkB;SACrD;QACDD,qBAAqBrB,wBAAwBiC,oBAAoB;YAACH;QAAK;QAEvE,qBAAqB;QACrB,MAAM,EAACK,UAAU,EAAEC,oBAAoB,EAAC,GAAG,MAAMhD,0BAC/C6C,oBACAtB,SACA;YAACmB;QAAK;QAGR,IAAIM,qBAAqBC,MAAM,GAAG,GAAG;YACnC,MAAMnC,yBAAyB;gBAACQ;gBAAQE;gBAAgBwB;YAAoB;YAC5Ef,qBAAqB,CAAC;YACtBD,qBAAqB;QACvB;QAEA,IAAIe,WAAWE,MAAM,GAAG,KAAKjB,oBAAoB;YAC/C,MAAMkB,yBACJ,CAAC,mGAAmG,CAAC,GACrG,CAAC,yGAAyG,CAAC,GAC3G,GAAGH,WAAWI,GAAG,CAAC,CAACC,MAAQ,CAAC,GAAG,EAAEA,IAAIC,GAAG,CAAC,iBAAiB,EAAED,IAAIE,SAAS,CAAC,mBAAmB,EAAEF,IAAIG,MAAM,CAAC,CAAC,CAAC,EAAE1B,IAAI,CAAC,OAAO;YAE5H,0EAA0E;YAC1E,IAAIrC,mBAAmB,CAACgC,gBAAgB;gBACtC,MAAMgC,SAAS,MAAM7D,OAAO;oBAC1B8D,SAAS;wBACP;4BACEX,MAAM,CAAC,kFAAkF,CAAC;4BAC1FY,OAAO;wBACT;wBACA;4BACEZ,MAAM,CAAC,8BAA8B,CAAC;4BACtCY,OAAO;wBACT;wBACA;4BACEZ,MAAM,CAAC,eAAe,CAAC;4BACvBY,OAAO;wBACT;wBACA;4BAACZ,MAAM;4BAAUY,OAAO;wBAAQ;qBACjC;oBACDC,SAAS;oBACTC,SAASvE,UACP,UACA,GAAGK,WAAWmE,OAAO,CAAC,CAAC,EAAEX,uBAAuB,2DAA2D,CAAC;gBAEhH;gBAEA,IAAIM,WAAW,UAAU;oBACvBlC,OAAOwC,KAAK,CAAC,mCAAmC;wBAACC,MAAM;oBAAC;oBACxD;gBACF;gBAEA,IAAIP,WAAW,aAAaA,WAAW,uBAAuB;oBAC5D,MAAMpD,gBACJ;wBACE4D,gBAAgB,AAAC,CAAA,MAAM7D,wBAAwBoB,SAAS;4BAAC0C,aAAa;wBAAK,EAAC,EAAGC,MAAM;wBACrFC,UAAUpB,WAAWI,GAAG,CAAC,CAACiB,MAAQ;gCAACA,IAAIf,GAAG;gCAAEe,IAAIb,MAAM;6BAAC;oBACzD,GACA;wBAACjC;wBAAQC;oBAAO;oBAGlB,IAAIiC,WAAW,WAAW;wBACxB;oBACF;gBACF;YACF,OAAO;gBACL,0DAA0D;gBAC1DlC,OAAO+C,IAAI,CAACnB;YACd;QACF;IACF;IAEA,MAAMoB,aAAazD;IACnB,IAAIyD,WAAWrB,MAAM,GAAG,GAAG;QACzB3B,OAAOgB,GAAG,CAAC;QACX,KAAK,MAAMiC,OAAOD,WAAY;YAC5BhD,OAAOgB,GAAG,CAAC,CAAC,EAAE,EAAEiC,KAAK;QACvB;QACAjD,OAAOgB,GAAG,CAAC;IACb;IAEA,IAAIkC,cAAc;IAClB,IAAI1C,cAAcH,oBAAoB,CAACH,kBAAkBhC,iBAAiB;QACxEgF,cAAc,MAAM/E,QAAQ;YAC1BkE,SAAS;YACTC,SAAS,CAAC,8CAA8C,EAAE9B,UAAU,QAAQ,CAAC;QAC/E;IACF;IAEA,uCAAuC;IACvC,MAAM2C,WAAW9D,kBAAkBQ,WAAW,UAAUG;IAExD,IAAIoD;IACJ,IAAIF,aAAa;QACftD,MAAMyD,KAAK,CAAC;QACZD,OAAO9E,QAAQ,uBAAuB+E,KAAK;QAC3C,MAAMxF,GAAG2C,WAAW;YAAC8C,OAAO;YAAMC,WAAW;QAAI;QACjD,MAAMC,gBAAgB5D,MAAM6D,GAAG,CAAC;QAChCL,KAAKM,IAAI,GAAG,CAAC,qBAAqB,EAAEF,cAAcG,OAAO,CAAC,GAAG,GAAG,CAAC;QACjEP,KAAKQ,OAAO;IACd;IAEAR,OAAO9E,QAAQ,CAAC,mBAAmB,CAAC,EAAE+E,KAAK;IAE3C,MAAMQ,QAAQ7F,kBAAkB6F,KAAK,CAACrF;IACtCqF,MAAMR,KAAK;IAEX,IAAIS;IAEJ,IAAIpD,oBAAoB;QACtBoD,YAAY;YACVC,SAAS;gBACP,GAAI,MAAM7E,wBAAwB;oBAACiE;oBAAUa,KAAK/D;oBAASgE,OAAO;oBAAOzD;gBAAS,EAAE;gBACpF,GAAGG,kBAAkB;YACvB;QACF;IACF;IAEA,IAAI;QACFf,MAAMyD,KAAK,CAAC;QAEZ,MAAMa,SAAS,MAAMjF,iBAAiB;YACpCkE;YACAa,KAAK/D;YACL6D;YACAK,QAAQhE,QAAQL,MAAMqE,MAAM;YAC5B3D;YACA4D,eACEvE,aAAa,mBAAmBA,YAAYA,UAAUuE,aAAa,GAAGC;YACxEC,WAAWnE,QAAQL,KAAK,CAAC,cAAc;YACvCyE,MAAM1E,aAAa,UAAUA,YAAYA,UAAU0E,IAAI,GAAGF;QAC5D;QAEAR,MAAM7C,GAAG,CAAC;YACRwD,YAAYN,OAAOO,MAAM,CACtBC,OAAO,CAAC,CAACC,QAAUA,MAAMC,OAAO,CAACF,OAAO,CAAC,CAAC5C,MAAQA,IAAI+C,cAAc,GACpEC,MAAM,CAAC,CAACC,KAAKC,IAAMD,MAAMC,GAAG;QACjC;QACA,MAAMC,gBAAgBrF,MAAM6D,GAAG,CAAC;QAEhCL,KAAKM,IAAI,GAAG,CAAC,qBAAqB,EAAEuB,cAActB,OAAO,CAAC,GAAG,GAAG,CAAC;QACjEP,KAAKQ,OAAO;QAEZC,MAAMqB,QAAQ;QACd,IAAIpF,MAAMqF,KAAK,EAAE;YACfnF,OAAOgB,GAAG,CAAC;YACXhB,OAAOgB,GAAG,CAACrC,kBAAkBC,kBAAkBsF,OAAOO,MAAM,EAAEW,KAAK,CAAC,GAAG;QACzE;IACF,EAAE,OAAO5C,OAAO;QACdY,KAAKiC,IAAI;QACTxB,MAAMrB,KAAK,CAACA;QACZ,MAAMF,UAAUE,iBAAiBzB,QAAQyB,MAAMF,OAAO,GAAGgD,OAAO9C;QAChExD,WAAW,CAAC,6BAA6B,CAAC,EAAE;YAACwD;QAAK;QAClDxC,OAAOwC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,SAAS,EAAE;YAACG,MAAM;QAAC;IACpE;AACF"}
+{"version":3,"sources":["../../../src/actions/build/buildStudio.ts"],"sourcesContent":["import {rm} from 'node:fs/promises'\nimport path from 'node:path'\nimport {styleText} from 'node:util'\n\nimport {getCliTelemetry, getTimer, isInteractive} from '@sanity/cli-core'\nimport {confirm, logSymbols, select, spinner, type SpinnerInstance} from '@sanity/cli-core/ux'\nimport semver from 'semver'\n\nimport {StudioBuildTrace} from '../../telemetry/build.telemetry.js'\nimport {getAppId} from '../../util/appId.js'\nimport {compareDependencyVersions} from '../../util/compareDependencyVersions.js'\nimport {formatModuleSizes, sortModulesBySize} from '../../util/moduleFormatUtils.js'\nimport {getPackageManagerChoice} from '../../util/packageManager/packageManagerChoice.js'\nimport {upgradePackages} from '../../util/packageManager/upgradePackages.js'\nimport {warnAboutMissingAppId} from '../../util/warnAboutMissingAppId.js'\nimport {buildDebug} from './buildDebug.js'\nimport {buildStaticFiles} from './buildStaticFiles.js'\nimport {buildVendorDependencies} from './buildVendorDependencies.js'\nimport {checkRequiredDependencies} from './checkRequiredDependencies.js'\nimport {checkStudioDependencyVersions} from './checkStudioDependencyVersions.js'\nimport {determineBasePath} from './determineBasePath.js'\nimport {getAutoUpdatesImportMap} from './getAutoUpdatesImportMap.js'\nimport {getStudioEnvVars} from './getStudioEnvVars.js'\nimport {handlePrereleaseVersions} from './handlePrereleaseVersions.js'\nimport {shouldAutoUpdate} from './shouldAutoUpdate.js'\nimport {type BuildOptions} from './types.js'\n\n/**\n * Build the Sanity Studio.\n *\n * @internal\n */\nexport async function buildStudio(options: BuildOptions): Promise<void> {\n  const timer = getTimer()\n  const {cliConfig, flags, outDir, output, workDir} = options\n\n  const unattendedMode = Boolean(flags.yes)\n  const defaultOutputDir = path.resolve(path.join(workDir, 'dist'))\n  const outputDir = path.resolve(outDir || defaultOutputDir)\n\n  await checkStudioDependencyVersions(workDir, output)\n\n  // If the check resulted in a dependency install, the CLI command will be re-run,\n  // thus we want to exit early\n  const {installedSanityVersion} = await checkRequiredDependencies({\n    cliConfig,\n    output,\n    workDir,\n  })\n\n  let autoUpdatesEnabled = options.calledFromDeploy\n    ? options.autoUpdatesEnabled\n    : shouldAutoUpdate({cliConfig, flags, output})\n\n  let autoUpdatesImports = {}\n\n  if (autoUpdatesEnabled) {\n    // Get the clean version without build metadata: https://semver.org/#spec-item-10\n    const cleanSanityVersion = semver.parse(installedSanityVersion)?.version\n    if (!cleanSanityVersion) {\n      throw new Error(`Failed to parse installed Sanity version: ${installedSanityVersion}`)\n    }\n\n    output.log(`${logSymbols.info} Building with auto-updates enabled`)\n\n    const projectId = cliConfig?.api?.projectId\n    const appId = getAppId(cliConfig)\n\n    // Warn if auto updates enabled but no appId configured.\n    // Skip when called from deploy, since deploy handles appId itself\n    // (prompts the user and tells them to add it to config).\n    if (!appId && !options.calledFromDeploy) {\n      warnAboutMissingAppId({appType: 'studio', output, projectId})\n    }\n\n    const sanityDependencies = [\n      {name: 'sanity', version: cleanSanityVersion},\n      {name: '@sanity/vision', version: cleanSanityVersion},\n    ]\n    autoUpdatesImports = getAutoUpdatesImportMap(sanityDependencies, {appId})\n\n    // Check the versions\n    const {mismatched, unresolvedPrerelease} = await compareDependencyVersions(\n      sanityDependencies,\n      workDir,\n      {appId},\n    )\n\n    if (unresolvedPrerelease.length > 0) {\n      await handlePrereleaseVersions({output, unattendedMode, unresolvedPrerelease})\n      autoUpdatesImports = {}\n      autoUpdatesEnabled = false\n    }\n\n    if (mismatched.length > 0 && autoUpdatesEnabled) {\n      const versionMismatchWarning =\n        `The following local package versions are different from the versions currently served at runtime.\\n` +\n        `When using auto updates, we recommend that you test locally with the same versions before deploying. \\n\\n` +\n        `${mismatched.map((mod) => ` - ${mod.pkg} (local version: ${mod.installed}, runtime version: ${mod.remote})`).join('\\n')}`\n\n      // If it is non-interactive or in unattended mode, we don't want to prompt\n      if (isInteractive() && !unattendedMode) {\n        const choice = await select({\n          choices: [\n            {\n              name: `Upgrade local versions (recommended). You will need to run the build command again`,\n              value: 'upgrade',\n            },\n            {\n              name: `Upgrade and proceed with build`,\n              value: 'upgrade-and-proceed',\n            },\n            {\n              name: `Continue anyway`,\n              value: 'continue',\n            },\n            {name: 'Cancel', value: 'cancel'},\n          ],\n          default: 'upgrade',\n          message: styleText(\n            'yellow',\n            `${logSymbols.warning} ${versionMismatchWarning}\\n\\nDo you want to upgrade local versions before deploying?`,\n          ),\n        })\n\n        if (choice === 'cancel') {\n          output.error('Declined to continue with build', {exit: 1})\n          return\n        }\n\n        if (choice === 'upgrade' || choice === 'upgrade-and-proceed') {\n          await upgradePackages(\n            {\n              packageManager: (await getPackageManagerChoice(workDir, {interactive: false})).chosen,\n              packages: mismatched.map((res) => [res.pkg, res.remote]),\n            },\n            {output, workDir},\n          )\n\n          if (choice === 'upgrade') {\n            return\n          }\n        }\n      } else {\n        // if non-interactive or unattended, just show the warning\n        output.warn(versionMismatchWarning)\n      }\n    }\n  }\n\n  const envVarKeys = getStudioEnvVars()\n  if (envVarKeys.length > 0) {\n    output.log('\\nIncluding the following environment variables as part of the JavaScript bundle:')\n    for (const key of envVarKeys) {\n      output.log(`- ${key}`)\n    }\n    output.log('')\n  }\n\n  let shouldClean = true\n  if (outputDir !== defaultOutputDir && !unattendedMode && isInteractive()) {\n    shouldClean = await confirm({\n      default: true,\n      message: `Do you want to delete the existing directory (${outputDir}) first?`,\n    })\n  }\n\n  // Determine base path for built studio\n  const basePath = determineBasePath(cliConfig, 'studio', output)\n\n  let spin: SpinnerInstance\n  if (shouldClean) {\n    timer.start('cleanOutputFolder')\n    spin = spinner('Clean output folder').start()\n    await rm(outputDir, {force: true, recursive: true})\n    const cleanDuration = timer.end('cleanOutputFolder')\n    spin.text = `Clean output folder (${cleanDuration.toFixed(0)}ms)`\n    spin.succeed()\n  }\n\n  spin = spinner(`Build Sanity Studio`).start()\n\n  const trace = getCliTelemetry().trace(StudioBuildTrace)\n  trace.start()\n\n  let importMap\n\n  if (autoUpdatesEnabled) {\n    importMap = {\n      imports: {\n        ...(await buildVendorDependencies({basePath, cwd: workDir, isApp: false, outputDir})),\n        ...autoUpdatesImports,\n      },\n    }\n  }\n\n  try {\n    timer.start('bundleStudio')\n\n    const bundle = await buildStaticFiles({\n      basePath,\n      cwd: workDir,\n      importMap,\n      minify: Boolean(flags.minify),\n      outputDir,\n      reactCompiler:\n        cliConfig && 'reactCompiler' in cliConfig ? cliConfig.reactCompiler : undefined,\n      sourceMap: Boolean(flags['source-maps']),\n      vite: cliConfig && 'vite' in cliConfig ? cliConfig.vite : undefined,\n    })\n\n    trace.log({\n      outputSize: bundle.chunks\n        .flatMap((chunk) => chunk.modules.flatMap((mod) => mod.renderedLength))\n        .reduce((sum, n) => sum + n, 0),\n    })\n    const buildDuration = timer.end('bundleStudio')\n\n    spin.text = `Build Sanity Studio (${buildDuration.toFixed(0)}ms)`\n    spin.succeed()\n\n    trace.complete()\n    if (flags.stats) {\n      output.log('\\nLargest module files:')\n      output.log(formatModuleSizes(sortModulesBySize(bundle.chunks).slice(0, 15)))\n    }\n  } catch (error) {\n    spin.fail()\n    trace.error(error)\n    const message = error instanceof Error ? error.message : String(error)\n    buildDebug(`Failed to build Sanity Studio`, {error})\n    output.error(`Failed to build Sanity Studio: ${message}`, {exit: 1})\n  }\n}\n"],"names":["rm","path","styleText","getCliTelemetry","getTimer","isInteractive","confirm","logSymbols","select","spinner","semver","StudioBuildTrace","getAppId","compareDependencyVersions","formatModuleSizes","sortModulesBySize","getPackageManagerChoice","upgradePackages","warnAboutMissingAppId","buildDebug","buildStaticFiles","buildVendorDependencies","checkRequiredDependencies","checkStudioDependencyVersions","determineBasePath","getAutoUpdatesImportMap","getStudioEnvVars","handlePrereleaseVersions","shouldAutoUpdate","buildStudio","options","timer","cliConfig","flags","outDir","output","workDir","unattendedMode","Boolean","yes","defaultOutputDir","resolve","join","outputDir","installedSanityVersion","autoUpdatesEnabled","calledFromDeploy","autoUpdatesImports","cleanSanityVersion","parse","version","Error","log","info","projectId","api","appId","appType","sanityDependencies","name","mismatched","unresolvedPrerelease","length","versionMismatchWarning","map","mod","pkg","installed","remote","choice","choices","value","default","message","warning","error","exit","packageManager","interactive","chosen","packages","res","warn","envVarKeys","key","shouldClean","basePath","spin","start","force","recursive","cleanDuration","end","text","toFixed","succeed","trace","importMap","imports","cwd","isApp","bundle","minify","reactCompiler","undefined","sourceMap","vite","outputSize","chunks","flatMap","chunk","modules","renderedLength","reduce","sum","n","buildDuration","complete","stats","slice","fail","String"],"mappings":"AAAA,SAAQA,EAAE,QAAO,mBAAkB;AACnC,OAAOC,UAAU,YAAW;AAC5B,SAAQC,SAAS,QAAO,YAAW;AAEnC,SAAQC,eAAe,EAAEC,QAAQ,EAAEC,aAAa,QAAO,mBAAkB;AACzE,SAAQC,OAAO,EAAEC,UAAU,EAAEC,MAAM,EAAEC,OAAO,QAA6B,sBAAqB;AAC9F,OAAOC,YAAY,SAAQ;AAE3B,SAAQC,gBAAgB,QAAO,qCAAoC;AACnE,SAAQC,QAAQ,QAAO,sBAAqB;AAC5C,SAAQC,yBAAyB,QAAO,0CAAyC;AACjF,SAAQC,iBAAiB,EAAEC,iBAAiB,QAAO,kCAAiC;AACpF,SAAQC,uBAAuB,QAAO,oDAAmD;AACzF,SAAQC,eAAe,QAAO,+CAA8C;AAC5E,SAAQC,qBAAqB,QAAO,sCAAqC;AACzE,SAAQC,UAAU,QAAO,kBAAiB;AAC1C,SAAQC,gBAAgB,QAAO,wBAAuB;AACtD,SAAQC,uBAAuB,QAAO,+BAA8B;AACpE,SAAQC,yBAAyB,QAAO,iCAAgC;AACxE,SAAQC,6BAA6B,QAAO,qCAAoC;AAChF,SAAQC,iBAAiB,QAAO,yBAAwB;AACxD,SAAQC,uBAAuB,QAAO,+BAA8B;AACpE,SAAQC,gBAAgB,QAAO,wBAAuB;AACtD,SAAQC,wBAAwB,QAAO,gCAA+B;AACtE,SAAQC,gBAAgB,QAAO,wBAAuB;AAGtD;;;;CAIC,GACD,OAAO,eAAeC,YAAYC,OAAqB;IACrD,MAAMC,QAAQ3B;IACd,MAAM,EAAC4B,SAAS,EAAEC,KAAK,EAAEC,MAAM,EAAEC,MAAM,EAAEC,OAAO,EAAC,GAAGN;IAEpD,MAAMO,iBAAiBC,QAAQL,MAAMM,GAAG;IACxC,MAAMC,mBAAmBvC,KAAKwC,OAAO,CAACxC,KAAKyC,IAAI,CAACN,SAAS;IACzD,MAAMO,YAAY1C,KAAKwC,OAAO,CAACP,UAAUM;IAEzC,MAAMjB,8BAA8Ba,SAASD;IAE7C,iFAAiF;IACjF,6BAA6B;IAC7B,MAAM,EAACS,sBAAsB,EAAC,GAAG,MAAMtB,0BAA0B;QAC/DU;QACAG;QACAC;IACF;IAEA,IAAIS,qBAAqBf,QAAQgB,gBAAgB,GAC7ChB,QAAQe,kBAAkB,GAC1BjB,iBAAiB;QAACI;QAAWC;QAAOE;IAAM;IAE9C,IAAIY,qBAAqB,CAAC;IAE1B,IAAIF,oBAAoB;QACtB,iFAAiF;QACjF,MAAMG,qBAAqBtC,OAAOuC,KAAK,CAACL,yBAAyBM;QACjE,IAAI,CAACF,oBAAoB;YACvB,MAAM,IAAIG,MAAM,CAAC,0CAA0C,EAAEP,wBAAwB;QACvF;QAEAT,OAAOiB,GAAG,CAAC,GAAG7C,WAAW8C,IAAI,CAAC,mCAAmC,CAAC;QAElE,MAAMC,YAAYtB,WAAWuB,KAAKD;QAClC,MAAME,QAAQ5C,SAASoB;QAEvB,wDAAwD;QACxD,kEAAkE;QAClE,yDAAyD;QACzD,IAAI,CAACwB,SAAS,CAAC1B,QAAQgB,gBAAgB,EAAE;YACvC5B,sBAAsB;gBAACuC,SAAS;gBAAUtB;gBAAQmB;YAAS;QAC7D;QAEA,MAAMI,qBAAqB;YACzB;gBAACC,MAAM;gBAAUT,SAASF;YAAkB;YAC5C;gBAACW,MAAM;gBAAkBT,SAASF;YAAkB;SACrD;QACDD,qBAAqBtB,wBAAwBiC,oBAAoB;YAACF;QAAK;QAEvE,qBAAqB;QACrB,MAAM,EAACI,UAAU,EAAEC,oBAAoB,EAAC,GAAG,MAAMhD,0BAC/C6C,oBACAtB,SACA;YAACoB;QAAK;QAGR,IAAIK,qBAAqBC,MAAM,GAAG,GAAG;YACnC,MAAMnC,yBAAyB;gBAACQ;gBAAQE;gBAAgBwB;YAAoB;YAC5Ed,qBAAqB,CAAC;YACtBF,qBAAqB;QACvB;QAEA,IAAIe,WAAWE,MAAM,GAAG,KAAKjB,oBAAoB;YAC/C,MAAMkB,yBACJ,CAAC,mGAAmG,CAAC,GACrG,CAAC,yGAAyG,CAAC,GAC3G,GAAGH,WAAWI,GAAG,CAAC,CAACC,MAAQ,CAAC,GAAG,EAAEA,IAAIC,GAAG,CAAC,iBAAiB,EAAED,IAAIE,SAAS,CAAC,mBAAmB,EAAEF,IAAIG,MAAM,CAAC,CAAC,CAAC,EAAE1B,IAAI,CAAC,OAAO;YAE5H,0EAA0E;YAC1E,IAAIrC,mBAAmB,CAACgC,gBAAgB;gBACtC,MAAMgC,SAAS,MAAM7D,OAAO;oBAC1B8D,SAAS;wBACP;4BACEX,MAAM,CAAC,kFAAkF,CAAC;4BAC1FY,OAAO;wBACT;wBACA;4BACEZ,MAAM,CAAC,8BAA8B,CAAC;4BACtCY,OAAO;wBACT;wBACA;4BACEZ,MAAM,CAAC,eAAe,CAAC;4BACvBY,OAAO;wBACT;wBACA;4BAACZ,MAAM;4BAAUY,OAAO;wBAAQ;qBACjC;oBACDC,SAAS;oBACTC,SAASvE,UACP,UACA,GAAGK,WAAWmE,OAAO,CAAC,CAAC,EAAEX,uBAAuB,2DAA2D,CAAC;gBAEhH;gBAEA,IAAIM,WAAW,UAAU;oBACvBlC,OAAOwC,KAAK,CAAC,mCAAmC;wBAACC,MAAM;oBAAC;oBACxD;gBACF;gBAEA,IAAIP,WAAW,aAAaA,WAAW,uBAAuB;oBAC5D,MAAMpD,gBACJ;wBACE4D,gBAAgB,AAAC,CAAA,MAAM7D,wBAAwBoB,SAAS;4BAAC0C,aAAa;wBAAK,EAAC,EAAGC,MAAM;wBACrFC,UAAUpB,WAAWI,GAAG,CAAC,CAACiB,MAAQ;gCAACA,IAAIf,GAAG;gCAAEe,IAAIb,MAAM;6BAAC;oBACzD,GACA;wBAACjC;wBAAQC;oBAAO;oBAGlB,IAAIiC,WAAW,WAAW;wBACxB;oBACF;gBACF;YACF,OAAO;gBACL,0DAA0D;gBAC1DlC,OAAO+C,IAAI,CAACnB;YACd;QACF;IACF;IAEA,MAAMoB,aAAazD;IACnB,IAAIyD,WAAWrB,MAAM,GAAG,GAAG;QACzB3B,OAAOiB,GAAG,CAAC;QACX,KAAK,MAAMgC,OAAOD,WAAY;YAC5BhD,OAAOiB,GAAG,CAAC,CAAC,EAAE,EAAEgC,KAAK;QACvB;QACAjD,OAAOiB,GAAG,CAAC;IACb;IAEA,IAAIiC,cAAc;IAClB,IAAI1C,cAAcH,oBAAoB,CAACH,kBAAkBhC,iBAAiB;QACxEgF,cAAc,MAAM/E,QAAQ;YAC1BkE,SAAS;YACTC,SAAS,CAAC,8CAA8C,EAAE9B,UAAU,QAAQ,CAAC;QAC/E;IACF;IAEA,uCAAuC;IACvC,MAAM2C,WAAW9D,kBAAkBQ,WAAW,UAAUG;IAExD,IAAIoD;IACJ,IAAIF,aAAa;QACftD,MAAMyD,KAAK,CAAC;QACZD,OAAO9E,QAAQ,uBAAuB+E,KAAK;QAC3C,MAAMxF,GAAG2C,WAAW;YAAC8C,OAAO;YAAMC,WAAW;QAAI;QACjD,MAAMC,gBAAgB5D,MAAM6D,GAAG,CAAC;QAChCL,KAAKM,IAAI,GAAG,CAAC,qBAAqB,EAAEF,cAAcG,OAAO,CAAC,GAAG,GAAG,CAAC;QACjEP,KAAKQ,OAAO;IACd;IAEAR,OAAO9E,QAAQ,CAAC,mBAAmB,CAAC,EAAE+E,KAAK;IAE3C,MAAMQ,QAAQ7F,kBAAkB6F,KAAK,CAACrF;IACtCqF,MAAMR,KAAK;IAEX,IAAIS;IAEJ,IAAIpD,oBAAoB;QACtBoD,YAAY;YACVC,SAAS;gBACP,GAAI,MAAM7E,wBAAwB;oBAACiE;oBAAUa,KAAK/D;oBAASgE,OAAO;oBAAOzD;gBAAS,EAAE;gBACpF,GAAGI,kBAAkB;YACvB;QACF;IACF;IAEA,IAAI;QACFhB,MAAMyD,KAAK,CAAC;QAEZ,MAAMa,SAAS,MAAMjF,iBAAiB;YACpCkE;YACAa,KAAK/D;YACL6D;YACAK,QAAQhE,QAAQL,MAAMqE,MAAM;YAC5B3D;YACA4D,eACEvE,aAAa,mBAAmBA,YAAYA,UAAUuE,aAAa,GAAGC;YACxEC,WAAWnE,QAAQL,KAAK,CAAC,cAAc;YACvCyE,MAAM1E,aAAa,UAAUA,YAAYA,UAAU0E,IAAI,GAAGF;QAC5D;QAEAR,MAAM5C,GAAG,CAAC;YACRuD,YAAYN,OAAOO,MAAM,CACtBC,OAAO,CAAC,CAACC,QAAUA,MAAMC,OAAO,CAACF,OAAO,CAAC,CAAC5C,MAAQA,IAAI+C,cAAc,GACpEC,MAAM,CAAC,CAACC,KAAKC,IAAMD,MAAMC,GAAG;QACjC;QACA,MAAMC,gBAAgBrF,MAAM6D,GAAG,CAAC;QAEhCL,KAAKM,IAAI,GAAG,CAAC,qBAAqB,EAAEuB,cAActB,OAAO,CAAC,GAAG,GAAG,CAAC;QACjEP,KAAKQ,OAAO;QAEZC,MAAMqB,QAAQ;QACd,IAAIpF,MAAMqF,KAAK,EAAE;YACfnF,OAAOiB,GAAG,CAAC;YACXjB,OAAOiB,GAAG,CAACtC,kBAAkBC,kBAAkBsF,OAAOO,MAAM,EAAEW,KAAK,CAAC,GAAG;QACzE;IACF,EAAE,OAAO5C,OAAO;QACdY,KAAKiC,IAAI;QACTxB,MAAMrB,KAAK,CAACA;QACZ,MAAMF,UAAUE,iBAAiBxB,QAAQwB,MAAMF,OAAO,GAAGgD,OAAO9C;QAChExD,WAAW,CAAC,6BAA6B,CAAC,EAAE;YAACwD;QAAK;QAClDxC,OAAOwC,KAAK,CAAC,CAAC,+BAA+B,EAAEF,SAAS,EAAE;YAACG,MAAM;QAAC;IACpE;AACF"}

package/dist/services/mcp.js

@@ -1,23 +1,9 @@
 import { getGlobalCliClient, subdebug } from '@sanity/cli-core';
-import { createRequester } from '@sanity/cli-core/request';
+import { isHttpError } from '@sanity/client';
 export const MCP_API_VERSION = '2025-12-09';
 export const MCP_SERVER_URL = 'https://mcp.sanity.io';
 export const MCP_JOURNEY_API_VERSION = 'v2024-02-23';
 const debug = subdebug('mcp:service');
-let mcpRequester;
-function getMCPRequester() {
-    if (!mcpRequester) {
-        mcpRequester = createRequester({
-            middleware: {
-                httpErrors: false,
-                promise: {
-                    onlyBody: false
-                }
-            }
-        });
-    }
-    return mcpRequester;
-}
 /**
  * Create a child token for MCP usage
  * This token is tied to the parent CLI token and will be invalidated
@@ -48,42 +34,44 @@ function getMCPRequester() {
     return tokenResponse.token;
 }
 /**
- * Validate an MCP token against the MCP server.
+ * Validate an MCP token by checking it against the Sanity API.
  *
- * MCP tokens are scoped to mcp.sanity.io and are not valid against
- * api.sanity.io, so we validate against the MCP server itself.
+ * MCP tokens are standard Sanity session tokens (`sk…`), so we validate
+ * by calling `/users/me` on `api.sanity.io`. A 200 means the token is
+ * alive; a 401/403 means it is dead and the caller should prompt for
+ * re-configuration.
  *
- * Sends a minimal POST with just the Authorization header — the server
- * checks auth before content negotiation, so a valid token gets 406
- * (missing Accept header) while an invalid token gets 401. This avoids
- * the cost of a full initialize handshake.
+ * Transient errors (5xx, network failures, timeouts) are rethrown so the
+ * caller can decide how to handle them — typically by assuming the token
+ * is still valid rather than falsely marking it as expired.
+ *
+ * We intentionally do NOT probe `mcp.sanity.io` because the MCP server
+ * lets invalid bearer tokens through for protocol-compatibility reasons,
+ * which causes the CLI to falsely treat dead tokens as valid.
  *
  * @internal
  */ export async function validateMCPToken(token) {
-    const request = getMCPRequester();
-    // Use a 2500ms timeout — long enough for VPN/proxy/distant-region latency,
-    // short enough to not stall the init flow. If the request times out or the
-    // server returns an unexpected status, we assume the token is valid rather
-    // than falsely marking it as expired (see below).
-    const res = await request({
-        body: '{}',
-        headers: {
-            Authorization: `Bearer ${token}`,
-            'Content-Type': 'application/json'
-        },
-        method: 'POST',
-        timeout: 2500,
-        url: MCP_SERVER_URL
+    const client = await getGlobalCliClient({
+        apiVersion: MCP_API_VERSION,
+        requireUser: false,
+        token
     });
-    // 401/403 are the only responses that definitively mean "bad token".
-    // Everything else (406 = valid, 5xx = server issue, 2xx = unexpected)
-    // is treated as "assume valid" — we'd rather skip a re-auth prompt
-    // than force users to re-configure because of a transient server error.
-    if (res.statusCode === 401 || res.statusCode === 403) {
-        debug('MCP token validation failed with %d', res.statusCode);
-        return false;
+    try {
+        await client.request({
+            timeout: 2500,
+            uri: '/users/me'
+        });
+        return true;
+    } catch (err) {
+        // 401/403 definitively mean "dead token"
+        if (isHttpError(err) && (err.statusCode === 401 || err.statusCode === 403)) {
+            debug('MCP token validation failed with %d', err.statusCode);
+            return false;
+        }
+        // Everything else (5xx, network errors, timeouts) is rethrown so the
+        // caller can decide — typically assumes valid rather than forcing re-auth.
+        throw err;
     }
-    return true;
 }
 /**
  * Fetches the post-init MCP prompt from the Journey API and interpolates editor names.

package/dist/services/mcp.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/services/mcp.ts"],"sourcesContent":["import {getGlobalCliClient, subdebug} from '@sanity/cli-core'\nimport {createRequester, type Requester} from '@sanity/cli-core/request'\n\nexport const MCP_API_VERSION = '2025-12-09'\nexport const MCP_SERVER_URL = 'https://mcp.sanity.io'\nexport const MCP_JOURNEY_API_VERSION = 'v2024-02-23'\n\nconst debug = subdebug('mcp:service')\n\nlet mcpRequester: Requester | undefined\n\nfunction getMCPRequester(): Requester {\n  if (!mcpRequester) {\n    mcpRequester = createRequester({\n      middleware: {httpErrors: false, promise: {onlyBody: false}},\n    })\n  }\n  return mcpRequester\n}\n\ninterface PostInitPromptResponse {\n  message?: string\n}\n\n/**\n * Create a child token for MCP usage\n * This token is tied to the parent CLI token and will be invalidated\n * when the parent token is invalidated (e.g., on logout)\n *\n * @returns The MCP token string\n * @internal\n */\nexport async function createMCPToken(): Promise<string> {\n  const client = await getGlobalCliClient({\n    apiVersion: MCP_API_VERSION,\n    requireUser: true,\n  })\n\n  const sessionResponse = await client.request<{id: string; sid: string}>({\n    body: {\n      sourceId: 'sanity-mcp',\n      withStamp: false,\n    },\n    method: 'POST',\n    uri: '/auth/session/create',\n  })\n\n  const tokenResponse = await client.request<{label: string; token: string}>({\n    method: 'GET',\n    query: {sid: sessionResponse.sid},\n    uri: '/auth/fetch',\n  })\n\n  return tokenResponse.token\n}\n\n/**\n * Validate an MCP token against the MCP server.\n *\n * MCP tokens are scoped to mcp.sanity.io and are not valid against\n * api.sanity.io, so we validate against the MCP server itself.\n *\n * Sends a minimal POST with just the Authorization header — the server\n * checks auth before content negotiation, so a valid token gets 406\n * (missing Accept header) while an invalid token gets 401. This avoids\n * the cost of a full initialize handshake.\n *\n * @internal\n */\nexport async function validateMCPToken(token: string): Promise<boolean> {\n  const request = getMCPRequester()\n\n  // Use a 2500ms timeout — long enough for VPN/proxy/distant-region latency,\n  // short enough to not stall the init flow. If the request times out or the\n  // server returns an unexpected status, we assume the token is valid rather\n  // than falsely marking it as expired (see below).\n  const res = await request({\n    body: '{}',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n    method: 'POST',\n    timeout: 2500,\n    url: MCP_SERVER_URL,\n  })\n\n  // 401/403 are the only responses that definitively mean \"bad token\".\n  // Everything else (406 = valid, 5xx = server issue, 2xx = unexpected)\n  // is treated as \"assume valid\" — we'd rather skip a re-auth prompt\n  // than force users to re-configure because of a transient server error.\n  if (res.statusCode === 401 || res.statusCode === 403) {\n    debug('MCP token validation failed with %d', res.statusCode)\n    return false\n  }\n\n  return true\n}\n\n/**\n * Fetches the post-init MCP prompt from the Journey API and interpolates editor names.\n * Falls back to a hardcoded default if the API call fails, times out, or returns empty.\n * Text wrapped in **markers** will be formatted with cyan color.\n */\nexport async function getPostInitPrompt() {\n  const client = await getGlobalCliClient({apiVersion: MCP_JOURNEY_API_VERSION, requireUser: false})\n  return await client.request<PostInitPromptResponse | null>({\n    method: 'GET',\n    timeout: 1000,\n    uri: '/journey/mcp/post-init-prompt',\n  })\n}\n"],"names":["getGlobalCliClient","subdebug","createRequester","MCP_API_VERSION","MCP_SERVER_URL","MCP_JOURNEY_API_VERSION","debug","mcpRequester","getMCPRequester","middleware","httpErrors","promise","onlyBody","createMCPToken","client","apiVersion","requireUser","sessionResponse","request","body","sourceId","withStamp","method","uri","tokenResponse","query","sid","token","validateMCPToken","res","headers","Authorization","timeout","url","statusCode","getPostInitPrompt"],"mappings":"AAAA,SAAQA,kBAAkB,EAAEC,QAAQ,QAAO,mBAAkB;AAC7D,SAAQC,eAAe,QAAuB,2BAA0B;AAExE,OAAO,MAAMC,kBAAkB,aAAY;AAC3C,OAAO,MAAMC,iBAAiB,wBAAuB;AACrD,OAAO,MAAMC,0BAA0B,cAAa;AAEpD,MAAMC,QAAQL,SAAS;AAEvB,IAAIM;AAEJ,SAASC;IACP,IAAI,CAACD,cAAc;QACjBA,eAAeL,gBAAgB;YAC7BO,YAAY;gBAACC,YAAY;gBAAOC,SAAS;oBAACC,UAAU;gBAAK;YAAC;QAC5D;IACF;IACA,OAAOL;AACT;AAMA;;;;;;;CAOC,GACD,OAAO,eAAeM;IACpB,MAAMC,SAAS,MAAMd,mBAAmB;QACtCe,YAAYZ;QACZa,aAAa;IACf;IAEA,MAAMC,kBAAkB,MAAMH,OAAOI,OAAO,CAA4B;QACtEC,MAAM;YACJC,UAAU;YACVC,WAAW;QACb;QACAC,QAAQ;QACRC,KAAK;IACP;IAEA,MAAMC,gBAAgB,MAAMV,OAAOI,OAAO,CAAiC;QACzEI,QAAQ;QACRG,OAAO;YAACC,KAAKT,gBAAgBS,GAAG;QAAA;QAChCH,KAAK;IACP;IAEA,OAAOC,cAAcG,KAAK;AAC5B;AAEA;;;;;;;;;;;;CAYC,GACD,OAAO,eAAeC,iBAAiBD,KAAa;IAClD,MAAMT,UAAUV;IAEhB,2EAA2E;IAC3E,2EAA2E;IAC3E,2EAA2E;IAC3E,kDAAkD;IAClD,MAAMqB,MAAM,MAAMX,QAAQ;QACxBC,MAAM;QACNW,SAAS;YACPC,eAAe,CAAC,OAAO,EAAEJ,OAAO;YAChC,gBAAgB;QAClB;QACAL,QAAQ;QACRU,SAAS;QACTC,KAAK7B;IACP;IAEA,qEAAqE;IACrE,sEAAsE;IACtE,mEAAmE;IACnE,wEAAwE;IACxE,IAAIyB,IAAIK,UAAU,KAAK,OAAOL,IAAIK,UAAU,KAAK,KAAK;QACpD5B,MAAM,uCAAuCuB,IAAIK,UAAU;QAC3D,OAAO;IACT;IAEA,OAAO;AACT;AAEA;;;;CAIC,GACD,OAAO,eAAeC;IACpB,MAAMrB,SAAS,MAAMd,mBAAmB;QAACe,YAAYV;QAAyBW,aAAa;IAAK;IAChG,OAAO,MAAMF,OAAOI,OAAO,CAAgC;QACzDI,QAAQ;QACRU,SAAS;QACTT,KAAK;IACP;AACF"}
+{"version":3,"sources":["../../src/services/mcp.ts"],"sourcesContent":["import {getGlobalCliClient, subdebug} from '@sanity/cli-core'\nimport {isHttpError} from '@sanity/client'\n\nexport const MCP_API_VERSION = '2025-12-09'\nexport const MCP_SERVER_URL = 'https://mcp.sanity.io'\nexport const MCP_JOURNEY_API_VERSION = 'v2024-02-23'\n\nconst debug = subdebug('mcp:service')\n\ninterface PostInitPromptResponse {\n  message?: string\n}\n\n/**\n * Create a child token for MCP usage\n * This token is tied to the parent CLI token and will be invalidated\n * when the parent token is invalidated (e.g., on logout)\n *\n * @returns The MCP token string\n * @internal\n */\nexport async function createMCPToken(): Promise<string> {\n  const client = await getGlobalCliClient({\n    apiVersion: MCP_API_VERSION,\n    requireUser: true,\n  })\n\n  const sessionResponse = await client.request<{id: string; sid: string}>({\n    body: {\n      sourceId: 'sanity-mcp',\n      withStamp: false,\n    },\n    method: 'POST',\n    uri: '/auth/session/create',\n  })\n\n  const tokenResponse = await client.request<{label: string; token: string}>({\n    method: 'GET',\n    query: {sid: sessionResponse.sid},\n    uri: '/auth/fetch',\n  })\n\n  return tokenResponse.token\n}\n\n/**\n * Validate an MCP token by checking it against the Sanity API.\n *\n * MCP tokens are standard Sanity session tokens (`sk…`), so we validate\n * by calling `/users/me` on `api.sanity.io`. A 200 means the token is\n * alive; a 401/403 means it is dead and the caller should prompt for\n * re-configuration.\n *\n * Transient errors (5xx, network failures, timeouts) are rethrown so the\n * caller can decide how to handle them — typically by assuming the token\n * is still valid rather than falsely marking it as expired.\n *\n * We intentionally do NOT probe `mcp.sanity.io` because the MCP server\n * lets invalid bearer tokens through for protocol-compatibility reasons,\n * which causes the CLI to falsely treat dead tokens as valid.\n *\n * @internal\n */\nexport async function validateMCPToken(token: string): Promise<boolean> {\n  const client = await getGlobalCliClient({\n    apiVersion: MCP_API_VERSION,\n    requireUser: false,\n    token,\n  })\n\n  try {\n    await client.request({timeout: 2500, uri: '/users/me'})\n    return true\n  } catch (err) {\n    // 401/403 definitively mean \"dead token\"\n    if (isHttpError(err) && (err.statusCode === 401 || err.statusCode === 403)) {\n      debug('MCP token validation failed with %d', err.statusCode)\n      return false\n    }\n\n    // Everything else (5xx, network errors, timeouts) is rethrown so the\n    // caller can decide — typically assumes valid rather than forcing re-auth.\n    throw err\n  }\n}\n\n/**\n * Fetches the post-init MCP prompt from the Journey API and interpolates editor names.\n * Falls back to a hardcoded default if the API call fails, times out, or returns empty.\n * Text wrapped in **markers** will be formatted with cyan color.\n */\nexport async function getPostInitPrompt() {\n  const client = await getGlobalCliClient({apiVersion: MCP_JOURNEY_API_VERSION, requireUser: false})\n  return await client.request<PostInitPromptResponse | null>({\n    method: 'GET',\n    timeout: 1000,\n    uri: '/journey/mcp/post-init-prompt',\n  })\n}\n"],"names":["getGlobalCliClient","subdebug","isHttpError","MCP_API_VERSION","MCP_SERVER_URL","MCP_JOURNEY_API_VERSION","debug","createMCPToken","client","apiVersion","requireUser","sessionResponse","request","body","sourceId","withStamp","method","uri","tokenResponse","query","sid","token","validateMCPToken","timeout","err","statusCode","getPostInitPrompt"],"mappings":"AAAA,SAAQA,kBAAkB,EAAEC,QAAQ,QAAO,mBAAkB;AAC7D,SAAQC,WAAW,QAAO,iBAAgB;AAE1C,OAAO,MAAMC,kBAAkB,aAAY;AAC3C,OAAO,MAAMC,iBAAiB,wBAAuB;AACrD,OAAO,MAAMC,0BAA0B,cAAa;AAEpD,MAAMC,QAAQL,SAAS;AAMvB;;;;;;;CAOC,GACD,OAAO,eAAeM;IACpB,MAAMC,SAAS,MAAMR,mBAAmB;QACtCS,YAAYN;QACZO,aAAa;IACf;IAEA,MAAMC,kBAAkB,MAAMH,OAAOI,OAAO,CAA4B;QACtEC,MAAM;YACJC,UAAU;YACVC,WAAW;QACb;QACAC,QAAQ;QACRC,KAAK;IACP;IAEA,MAAMC,gBAAgB,MAAMV,OAAOI,OAAO,CAAiC;QACzEI,QAAQ;QACRG,OAAO;YAACC,KAAKT,gBAAgBS,GAAG;QAAA;QAChCH,KAAK;IACP;IAEA,OAAOC,cAAcG,KAAK;AAC5B;AAEA;;;;;;;;;;;;;;;;;CAiBC,GACD,OAAO,eAAeC,iBAAiBD,KAAa;IAClD,MAAMb,SAAS,MAAMR,mBAAmB;QACtCS,YAAYN;QACZO,aAAa;QACbW;IACF;IAEA,IAAI;QACF,MAAMb,OAAOI,OAAO,CAAC;YAACW,SAAS;YAAMN,KAAK;QAAW;QACrD,OAAO;IACT,EAAE,OAAOO,KAAK;QACZ,yCAAyC;QACzC,IAAItB,YAAYsB,QAASA,CAAAA,IAAIC,UAAU,KAAK,OAAOD,IAAIC,UAAU,KAAK,GAAE,GAAI;YAC1EnB,MAAM,uCAAuCkB,IAAIC,UAAU;YAC3D,OAAO;QACT;QAEA,qEAAqE;QACrE,2EAA2E;QAC3E,MAAMD;IACR;AACF;AAEA;;;;CAIC,GACD,OAAO,eAAeE;IACpB,MAAMlB,SAAS,MAAMR,mBAAmB;QAACS,YAAYJ;QAAyBK,aAAa;IAAK;IAChG,OAAO,MAAMF,OAAOI,OAAO,CAAgC;QACzDI,QAAQ;QACRO,SAAS;QACTN,KAAK;IACP;AACF"}

package/oclif.manifest.json

@@ -953,6 +953,160 @@
         "versions.js"
       ]
     },
+    "cors:add": {
+      "aliases": [],
+      "args": {
+        "origin": {
+          "description": "Origin to allow (e.g., https://example.com)",
+          "name": "origin",
+          "required": true
+        }
+      },
+      "description": "Allow a new origin to use your project API through CORS",
+      "examples": [
+        {
+          "command": "<%= config.bin %> <%= command.id %>",
+          "description": "Interactively add a CORS origin"
+        },
+        {
+          "command": "<%= config.bin %> <%= command.id %> http://localhost:3000 --no-credentials",
+          "description": "Add a localhost origin without credentials"
+        },
+        {
+          "command": "<%= config.bin %> <%= command.id %> https://myapp.com --credentials",
+          "description": "Add a production origin with credentials allowed"
+        },
+        {
+          "command": "<%= config.bin %> <%= command.id %> https://myapp.com --project-id abc123",
+          "description": "Add a CORS origin for a specific project"
+        }
+      ],
+      "flags": {
+        "project-id": {
+          "char": "p",
+          "description": "Project ID to add CORS origin to (overrides CLI configuration)",
+          "helpGroup": "OVERRIDE",
+          "name": "project-id",
+          "hasDynamicHelp": false,
+          "helpValue": "<id>",
+          "multiple": false,
+          "type": "option"
+        },
+        "credentials": {
+          "description": "Allow credentials (token/cookie) to be sent from this origin",
+          "name": "credentials",
+          "required": false,
+          "allowNo": true,
+          "type": "boolean"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cors:add",
+      "pluginAlias": "@sanity/cli",
+      "pluginName": "@sanity/cli",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cors",
+        "add.js"
+      ]
+    },
+    "cors:delete": {
+      "aliases": [],
+      "args": {
+        "origin": {
+          "description": "Origin to delete (will prompt if not provided)",
+          "name": "origin",
+          "required": false
+        }
+      },
+      "description": "Delete an existing CORS origin from your project",
+      "examples": [
+        {
+          "command": "<%= config.bin %> <%= command.id %>",
+          "description": "Interactively select and delete a CORS origin"
+        },
+        {
+          "command": "<%= config.bin %> <%= command.id %> https://example.com",
+          "description": "Delete a specific CORS origin"
+        },
+        {
+          "command": "<%= config.bin %> <%= command.id %> --project-id abc123",
+          "description": "Delete a CORS origin from a specific project"
+        }
+      ],
+      "flags": {
+        "project-id": {
+          "char": "p",
+          "description": "Project ID to delete CORS origin from (overrides CLI configuration)",
+          "helpGroup": "OVERRIDE",
+          "name": "project-id",
+          "hasDynamicHelp": false,
+          "helpValue": "<id>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cors:delete",
+      "pluginAlias": "@sanity/cli",
+      "pluginName": "@sanity/cli",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cors",
+        "delete.js"
+      ]
+    },
+    "cors:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List all origins allowed to access the API for this project",
+      "examples": [
+        {
+          "command": "<%= config.bin %> <%= command.id %>",
+          "description": "List CORS origins for the current project"
+        },
+        {
+          "command": "<%= config.bin %> <%= command.id %> --project-id abc123",
+          "description": "List CORS origins for a specific project"
+        }
+      ],
+      "flags": {
+        "project-id": {
+          "char": "p",
+          "description": "Project ID to list CORS origins for (overrides CLI configuration)",
+          "helpGroup": "OVERRIDE",
+          "name": "project-id",
+          "hasDynamicHelp": false,
+          "helpValue": "<id>",
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "cors:list",
+      "pluginAlias": "@sanity/cli",
+      "pluginName": "@sanity/cli",
+      "pluginType": "core",
+      "strict": true,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "cors",
+        "list.js"
+      ]
+    },
     "backup:disable": {
       "aliases": [],
       "args": {
@@ -1208,160 +1362,6 @@
         "list.js"
       ]
     },
-    "cors:add": {
-      "aliases": [],
-      "args": {
-        "origin": {
-          "description": "Origin to allow (e.g., https://example.com)",
-          "name": "origin",
-          "required": true
-        }
-      },
-      "description": "Allow a new origin to use your project API through CORS",
-      "examples": [
-        {
-          "command": "<%= config.bin %> <%= command.id %>",
-          "description": "Interactively add a CORS origin"
-        },
-        {
-          "command": "<%= config.bin %> <%= command.id %> http://localhost:3000 --no-credentials",
-          "description": "Add a localhost origin without credentials"
-        },
-        {
-          "command": "<%= config.bin %> <%= command.id %> https://myapp.com --credentials",
-          "description": "Add a production origin with credentials allowed"
-        },
-        {
-          "command": "<%= config.bin %> <%= command.id %> https://myapp.com --project-id abc123",
-          "description": "Add a CORS origin for a specific project"
-        }
-      ],
-      "flags": {
-        "project-id": {
-          "char": "p",
-          "description": "Project ID to add CORS origin to (overrides CLI configuration)",
-          "helpGroup": "OVERRIDE",
-          "name": "project-id",
-          "hasDynamicHelp": false,
-          "helpValue": "<id>",
-          "multiple": false,
-          "type": "option"
-        },
-        "credentials": {
-          "description": "Allow credentials (token/cookie) to be sent from this origin",
-          "name": "credentials",
-          "required": false,
-          "allowNo": true,
-          "type": "boolean"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "cors:add",
-      "pluginAlias": "@sanity/cli",
-      "pluginName": "@sanity/cli",
-      "pluginType": "core",
-      "strict": true,
-      "isESM": true,
-      "relativePath": [
-        "dist",
-        "commands",
-        "cors",
-        "add.js"
-      ]
-    },
-    "cors:delete": {
-      "aliases": [],
-      "args": {
-        "origin": {
-          "description": "Origin to delete (will prompt if not provided)",
-          "name": "origin",
-          "required": false
-        }
-      },
-      "description": "Delete an existing CORS origin from your project",
-      "examples": [
-        {
-          "command": "<%= config.bin %> <%= command.id %>",
-          "description": "Interactively select and delete a CORS origin"
-        },
-        {
-          "command": "<%= config.bin %> <%= command.id %> https://example.com",
-          "description": "Delete a specific CORS origin"
-        },
-        {
-          "command": "<%= config.bin %> <%= command.id %> --project-id abc123",
-          "description": "Delete a CORS origin from a specific project"
-        }
-      ],
-      "flags": {
-        "project-id": {
-          "char": "p",
-          "description": "Project ID to delete CORS origin from (overrides CLI configuration)",
-          "helpGroup": "OVERRIDE",
-          "name": "project-id",
-          "hasDynamicHelp": false,
-          "helpValue": "<id>",
-          "multiple": false,
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "cors:delete",
-      "pluginAlias": "@sanity/cli",
-      "pluginName": "@sanity/cli",
-      "pluginType": "core",
-      "strict": true,
-      "isESM": true,
-      "relativePath": [
-        "dist",
-        "commands",
-        "cors",
-        "delete.js"
-      ]
-    },
-    "cors:list": {
-      "aliases": [],
-      "args": {},
-      "description": "List all origins allowed to access the API for this project",
-      "examples": [
-        {
-          "command": "<%= config.bin %> <%= command.id %>",
-          "description": "List CORS origins for the current project"
-        },
-        {
-          "command": "<%= config.bin %> <%= command.id %> --project-id abc123",
-          "description": "List CORS origins for a specific project"
-        }
-      ],
-      "flags": {
-        "project-id": {
-          "char": "p",
-          "description": "Project ID to list CORS origins for (overrides CLI configuration)",
-          "helpGroup": "OVERRIDE",
-          "name": "project-id",
-          "hasDynamicHelp": false,
-          "helpValue": "<id>",
-          "multiple": false,
-          "type": "option"
-        }
-      },
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "cors:list",
-      "pluginAlias": "@sanity/cli",
-      "pluginName": "@sanity/cli",
-      "pluginType": "core",
-      "strict": true,
-      "isESM": true,
-      "relativePath": [
-        "dist",
-        "commands",
-        "cors",
-        "list.js"
-      ]
-    },
     "dataset:copy": {
       "aliases": [],
       "args": {
@@ -4943,5 +4943,5 @@
       ]
     }
   },
-  "version": "6.1.7"
+  "version": "6.1.8"
 }