@sanity/cli 7.12.1 → 7.14.0

package/dist/commands/debug.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/commands/debug.ts"],"sourcesContent":["import {styleText} from 'node:util'\n\nimport {Flags} from '@oclif/core'\nimport {ProjectRootNotFoundError, SanityCommand} from '@sanity/cli-core'\n\nimport {\n  gatherAuthInfo,\n  gatherCliInfo,\n  gatherProjectInfo,\n  gatherResolvedWorkspaces,\n  gatherStudioWorkspaces,\n  gatherUserInfo,\n} from '../actions/debug/gatherDebugInfo.js'\nimport {formatKeyValue, sectionHeader} from '../actions/debug/output.js'\nimport {type StudioWorkspace, type UserInfo} from '../actions/debug/types.js'\n\ntype ConfigLoadResult<T> = {error: Error; value?: never} | {error?: never; value: T}\n\nexport class Debug extends SanityCommand<typeof Debug> {\n  static override description = 'Print diagnostic info for troubleshooting'\n\n  static override examples = [\n    '<%= config.bin %> <%= command.id %>',\n    '<%= config.bin %> <%= command.id %> --secrets',\n  ]\n\n  static override flags = {\n    secrets: Flags.boolean({\n      default: false,\n      description: 'Include API keys in output',\n    }),\n    verbose: Flags.boolean({\n      default: false,\n      description: 'Show full error details including stack traces',\n    }),\n  }\n\n  public async run(): Promise<void> {\n    const {flags} = this\n\n    let projectDirectory: string | undefined\n    try {\n      const projectRoot = await this.getProjectRoot()\n      projectDirectory = projectRoot.directory\n    } catch (err) {\n      if (!(err instanceof ProjectRootNotFoundError)) throw err\n    }\n\n    // Try loading CLI config, capturing errors\n    let cliConfigLoad: ConfigLoadResult<Awaited<ReturnType<typeof this.getCliConfig>>> | undefined\n    if (projectDirectory) {\n      try {\n        cliConfigLoad = {value: await this.getCliConfig()}\n      } catch (err) {\n        cliConfigLoad = {error: err instanceof Error ? err : new Error(String(err))}\n      }\n    }\n\n    const projectId = cliConfigLoad?.value?.api?.projectId\n\n    // Gather project info once, shared between Project and Studio sections\n    const project = projectDirectory ? await gatherProjectInfo(projectDirectory) : undefined\n\n    // Pre-load studio workspaces so we know if the config is valid\n    let studioLoad: ConfigLoadResult<StudioWorkspace[]> | undefined\n    if (project?.studioConfigPath && projectDirectory) {\n      try {\n        studioLoad = {value: await gatherStudioWorkspaces(projectDirectory)}\n      } catch (err) {\n        studioLoad = {error: err instanceof Error ? err : new Error(String(err))}\n      }\n    }\n\n    // Section 1: User\n    const user = await this.printUserSection(projectId)\n    const userId = user instanceof Error ? undefined : user.id\n\n    // Section 2: Authentication (only when logged in)\n    await this.printAuthSection(flags.secrets)\n\n    // Section 3: CLI\n    await this.printCliSection()\n\n    // Section 4: Project\n    this.printProjectSection(project, cliConfigLoad, studioLoad)\n\n    // Section 5: Studio (when studio config file exists)\n    if (projectDirectory && project?.studioConfigPath && studioLoad) {\n      await this.printStudioSection(projectDirectory, studioLoad, flags.verbose, projectId, userId)\n    }\n  }\n\n  private async printAuthSection(includeSecrets: boolean): Promise<void> {\n    const auth = await gatherAuthInfo(includeSecrets)\n    if (!auth.hasToken) return\n\n    this.log(sectionHeader('Authentication'))\n    const padTo = 10 // \"Auth token\" is the longest key\n    this.log(formatKeyValue('Auth token', auth.authToken, {padTo}))\n    this.log(formatKeyValue('User type', auth.userType, {padTo}))\n\n    if (!includeSecrets) {\n      this.log('  (run with --secrets to reveal token)')\n    }\n    this.log('')\n  }\n\n  private async printCliSection(): Promise<void> {\n    this.log(sectionHeader('CLI'))\n\n    try {\n      const cliInfo = await gatherCliInfo()\n      const padTo = 9 // \"Installed\" is the longest key\n      this.log(formatKeyValue('Version', cliInfo.version, {padTo}))\n      this.log(formatKeyValue('Installed', cliInfo.installContext, {padTo}))\n    } catch {\n      this.log(`  ${styleText('red', 'Unable to determine CLI version')}`)\n    }\n    this.log('')\n  }\n\n  private printConfigStatus(\n    label: string,\n    fileName: string | undefined,\n    loadResult: ConfigLoadResult<unknown> | undefined,\n    padTo: number,\n  ): void {\n    if (!fileName) {\n      this.log(formatKeyValue(label, `${styleText('red', '\\u274C')} not found`, {padTo}))\n      return\n    }\n\n    if (loadResult?.error) {\n      this.log(\n        formatKeyValue(\n          label,\n          `${styleText('yellow', '\\u26A0\\uFE0F')}  ${styleText('yellow', fileName)} (has errors)`,\n          {padTo},\n        ),\n      )\n    } else {\n      this.log(\n        formatKeyValue(label, `${styleText('green', '\\u2705')} ${styleText('yellow', fileName)}`, {\n          padTo,\n        }),\n      )\n    }\n  }\n\n  private printProjectSection(\n    project: Awaited<ReturnType<typeof gatherProjectInfo>>,\n    cliConfigLoad: ConfigLoadResult<unknown> | undefined,\n    studioLoad: ConfigLoadResult<unknown> | undefined,\n  ): void {\n    this.log(sectionHeader('Project'))\n\n    if (!project) {\n      this.log('  No project found\\n')\n      return\n    }\n\n    const padTo = 14\n    this.log(formatKeyValue('Root path', project.rootPath, {padTo}))\n    this.printConfigStatus('CLI config', project.cliConfigPath, cliConfigLoad, padTo)\n    this.printConfigStatus('Studio config', project.studioConfigPath, studioLoad, padTo)\n    this.log('')\n  }\n\n  private async printStudioSection(\n    projectDirectory: string,\n    studioLoad: ConfigLoadResult<StudioWorkspace[]>,\n    verbose: boolean,\n    projectId: string | undefined,\n    userId: string | undefined,\n  ): Promise<void> {\n    this.log(sectionHeader('Studio'))\n\n    if (studioLoad.error) {\n      this.log(`  ${styleText('red', 'Failed to load studio configuration:')}`)\n      if (verbose) {\n        this.log(`  ${studioLoad.error.stack ?? studioLoad.error.message}\\n`)\n      } else {\n        this.log(`  ${truncate(studioLoad.error.message)}\\n`)\n      }\n      return\n    }\n\n    this.log('  Workspaces:')\n    for (const ws of studioLoad.value) {\n      const label = ws.name ?? 'default'\n      this.log(`    ${label}`)\n      this.log(formatKeyValue('Project ID', ws.projectId, {indent: 6, padTo: 10}))\n      this.log(formatKeyValue('Dataset', ws.dataset, {indent: 6, padTo: 10}))\n    }\n\n    // Full resolution: try to resolve plugins and get roles\n    try {\n      const resolved = await gatherResolvedWorkspaces(projectDirectory, userId)\n\n      this.log('')\n      this.log('  Resolved configuration:')\n      for (const ws of resolved) {\n        this.log(`    ${ws.name} (${ws.title})`)\n        if (ws.roles.length > 0) {\n          this.log(formatKeyValue('Roles', ws.roles, {indent: 6, padTo: 5}))\n        }\n      }\n    } catch (err) {\n      this.log('')\n      if (verbose && err instanceof Error && err.stack) {\n        this.log(`  ${styleText('dim', 'Unable to resolve full studio configuration:')}`)\n        this.log(`  ${styleText('dim', err.stack)}`)\n      } else {\n        const reason = truncate(err instanceof Error ? err.message : String(err))\n        this.log(\n          `  ${styleText('dim', `(unable to resolve full studio configuration: ${reason})`)}`,\n        )\n      }\n    }\n    this.log('')\n  }\n\n  private async printUserSection(projectId: string | undefined): Promise<Error | UserInfo> {\n    this.log(`\\n${sectionHeader('User')}`)\n\n    const user = await gatherUserInfo(projectId)\n    if (user instanceof Error) {\n      this.log(`  ${user.message}\\n`)\n      return user\n    }\n\n    const padTo = 8 // \"Provider\" is the longest key\n    this.log(formatKeyValue('Name', user.name, {padTo}))\n    this.log(formatKeyValue('Email', user.email, {padTo}))\n    this.log(formatKeyValue('ID', user.id, {padTo}))\n    this.log(formatKeyValue('Provider', user.provider, {padTo}))\n    this.log('')\n    return user\n  }\n}\n\nconst MAX_ERROR_LENGTH = 200\n\nfunction truncate(str: string): string {\n  const collapsed = str.replaceAll(/\\s*\\n\\s*/g, ' ').trim()\n  if (collapsed.length <= MAX_ERROR_LENGTH) return collapsed\n  return `${collapsed.slice(0, MAX_ERROR_LENGTH)}...`\n}\n"],"names":["styleText","Flags","ProjectRootNotFoundError","SanityCommand","gatherAuthInfo","gatherCliInfo","gatherProjectInfo","gatherResolvedWorkspaces","gatherStudioWorkspaces","gatherUserInfo","formatKeyValue","sectionHeader","Debug","description","examples","flags","secrets","boolean","default","verbose","run","projectDirectory","projectRoot","getProjectRoot","directory","err","cliConfigLoad","value","getCliConfig","error","Error","String","projectId","api","project","undefined","studioLoad","studioConfigPath","user","printUserSection","userId","id","printAuthSection","printCliSection","printProjectSection","printStudioSection","includeSecrets","auth","hasToken","log","padTo","authToken","userType","cliInfo","version","installContext","printConfigStatus","label","fileName","loadResult","rootPath","cliConfigPath","stack","message","truncate","ws","name","indent","dataset","resolved","title","roles","length","reason","email","provider","MAX_ERROR_LENGTH","str","collapsed","replaceAll","trim","slice"],"mappings":"AAAA,SAAQA,SAAS,QAAO,YAAW;AAEnC,SAAQC,KAAK,QAAO,cAAa;AACjC,SAAQC,wBAAwB,EAAEC,aAAa,QAAO,mBAAkB;AAExE,SACEC,cAAc,EACdC,aAAa,EACbC,iBAAiB,EACjBC,wBAAwB,EACxBC,sBAAsB,EACtBC,cAAc,QACT,sCAAqC;AAC5C,SAAQC,cAAc,EAAEC,aAAa,QAAO,6BAA4B;AAKxE,OAAO,MAAMC,cAAcT;IACzB,OAAgBU,cAAc,4CAA2C;IAEzE,OAAgBC,WAAW;QACzB;QACA;KACD,CAAA;IAED,OAAgBC,QAAQ;QACtBC,SAASf,MAAMgB,OAAO,CAAC;YACrBC,SAAS;YACTL,aAAa;QACf;QACAM,SAASlB,MAAMgB,OAAO,CAAC;YACrBC,SAAS;YACTL,aAAa;QACf;IACF,EAAC;IAED,MAAaO,MAAqB;QAChC,MAAM,EAACL,KAAK,EAAC,GAAG,IAAI;QAEpB,IAAIM;QACJ,IAAI;YACF,MAAMC,cAAc,MAAM,IAAI,CAACC,cAAc;YAC7CF,mBAAmBC,YAAYE,SAAS;QAC1C,EAAE,OAAOC,KAAK;YACZ,IAAI,CAAEA,CAAAA,eAAevB,wBAAuB,GAAI,MAAMuB;QACxD;QAEA,2CAA2C;QAC3C,IAAIC;QACJ,IAAIL,kBAAkB;YACpB,IAAI;gBACFK,gBAAgB;oBAACC,OAAO,MAAM,IAAI,CAACC,YAAY;gBAAE;YACnD,EAAE,OAAOH,KAAK;gBACZC,gBAAgB;oBAACG,OAAOJ,eAAeK,QAAQL,MAAM,IAAIK,MAAMC,OAAON;gBAAK;YAC7E;QACF;QAEA,MAAMO,YAAYN,eAAeC,OAAOM,KAAKD;QAE7C,uEAAuE;QACvE,MAAME,UAAUb,mBAAmB,MAAMf,kBAAkBe,oBAAoBc;QAE/E,+DAA+D;QAC/D,IAAIC;QACJ,IAAIF,SAASG,oBAAoBhB,kBAAkB;YACjD,IAAI;gBACFe,aAAa;oBAACT,OAAO,MAAMnB,uBAAuBa;gBAAiB;YACrE,EAAE,OAAOI,KAAK;gBACZW,aAAa;oBAACP,OAAOJ,eAAeK,QAAQL,MAAM,IAAIK,MAAMC,OAAON;gBAAK;YAC1E;QACF;QAEA,kBAAkB;QAClB,MAAMa,OAAO,MAAM,IAAI,CAACC,gBAAgB,CAACP;QACzC,MAAMQ,SAASF,gBAAgBR,QAAQK,YAAYG,KAAKG,EAAE;QAE1D,kDAAkD;QAClD,MAAM,IAAI,CAACC,gBAAgB,CAAC3B,MAAMC,OAAO;QAEzC,iBAAiB;QACjB,MAAM,IAAI,CAAC2B,eAAe;QAE1B,qBAAqB;QACrB,IAAI,CAACC,mBAAmB,CAACV,SAASR,eAAeU;QAEjD,qDAAqD;QACrD,IAAIf,oBAAoBa,SAASG,oBAAoBD,YAAY;YAC/D,MAAM,IAAI,CAACS,kBAAkB,CAACxB,kBAAkBe,YAAYrB,MAAMI,OAAO,EAAEa,WAAWQ;QACxF;IACF;IAEA,MAAcE,iBAAiBI,cAAuB,EAAiB;QACrE,MAAMC,OAAO,MAAM3C,eAAe0C;QAClC,IAAI,CAACC,KAAKC,QAAQ,EAAE;QAEpB,IAAI,CAACC,GAAG,CAACtC,cAAc;QACvB,MAAMuC,QAAQ,GAAG,kCAAkC;;QACnD,IAAI,CAACD,GAAG,CAACvC,eAAe,cAAcqC,KAAKI,SAAS,EAAE;YAACD;QAAK;QAC5D,IAAI,CAACD,GAAG,CAACvC,eAAe,aAAaqC,KAAKK,QAAQ,EAAE;YAACF;QAAK;QAE1D,IAAI,CAACJ,gBAAgB;YACnB,IAAI,CAACG,GAAG,CAAC;QACX;QACA,IAAI,CAACA,GAAG,CAAC;IACX;IAEA,MAAcN,kBAAiC;QAC7C,IAAI,CAACM,GAAG,CAACtC,cAAc;QAEvB,IAAI;YACF,MAAM0C,UAAU,MAAMhD;YACtB,MAAM6C,QAAQ,EAAE,iCAAiC;;YACjD,IAAI,CAACD,GAAG,CAACvC,eAAe,WAAW2C,QAAQC,OAAO,EAAE;gBAACJ;YAAK;YAC1D,IAAI,CAACD,GAAG,CAACvC,eAAe,aAAa2C,QAAQE,cAAc,EAAE;gBAACL;YAAK;QACrE,EAAE,OAAM;YACN,IAAI,CAACD,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAO,oCAAoC;QACrE;QACA,IAAI,CAACiD,GAAG,CAAC;IACX;IAEQO,kBACNC,KAAa,EACbC,QAA4B,EAC5BC,UAAiD,EACjDT,KAAa,EACP;QACN,IAAI,CAACQ,UAAU;YACb,IAAI,CAACT,GAAG,CAACvC,eAAe+C,OAAO,GAAGzD,UAAU,OAAO,UAAU,UAAU,CAAC,EAAE;gBAACkD;YAAK;YAChF;QACF;QAEA,IAAIS,YAAY9B,OAAO;YACrB,IAAI,CAACoB,GAAG,CACNvC,eACE+C,OACA,GAAGzD,UAAU,UAAU,gBAAgB,EAAE,EAAEA,UAAU,UAAU0D,UAAU,aAAa,CAAC,EACvF;gBAACR;YAAK;QAGZ,OAAO;YACL,IAAI,CAACD,GAAG,CACNvC,eAAe+C,OAAO,GAAGzD,UAAU,SAAS,UAAU,CAAC,EAAEA,UAAU,UAAU0D,WAAW,EAAE;gBACxFR;YACF;QAEJ;IACF;IAEQN,oBACNV,OAAsD,EACtDR,aAAoD,EACpDU,UAAiD,EAC3C;QACN,IAAI,CAACa,GAAG,CAACtC,cAAc;QAEvB,IAAI,CAACuB,SAAS;YACZ,IAAI,CAACe,GAAG,CAAC;YACT;QACF;QAEA,MAAMC,QAAQ;QACd,IAAI,CAACD,GAAG,CAACvC,eAAe,aAAawB,QAAQ0B,QAAQ,EAAE;YAACV;QAAK;QAC7D,IAAI,CAACM,iBAAiB,CAAC,cAActB,QAAQ2B,aAAa,EAAEnC,eAAewB;QAC3E,IAAI,CAACM,iBAAiB,CAAC,iBAAiBtB,QAAQG,gBAAgB,EAAED,YAAYc;QAC9E,IAAI,CAACD,GAAG,CAAC;IACX;IAEA,MAAcJ,mBACZxB,gBAAwB,EACxBe,UAA+C,EAC/CjB,OAAgB,EAChBa,SAA6B,EAC7BQ,MAA0B,EACX;QACf,IAAI,CAACS,GAAG,CAACtC,cAAc;QAEvB,IAAIyB,WAAWP,KAAK,EAAE;YACpB,IAAI,CAACoB,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAO,yCAAyC;YACxE,IAAImB,SAAS;gBACX,IAAI,CAAC8B,GAAG,CAAC,CAAC,EAAE,EAAEb,WAAWP,KAAK,CAACiC,KAAK,IAAI1B,WAAWP,KAAK,CAACkC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,IAAI,CAACd,GAAG,CAAC,CAAC,EAAE,EAAEe,SAAS5B,WAAWP,KAAK,CAACkC,OAAO,EAAE,EAAE,CAAC;YACtD;YACA;QACF;QAEA,IAAI,CAACd,GAAG,CAAC;QACT,KAAK,MAAMgB,MAAM7B,WAAWT,KAAK,CAAE;YACjC,MAAM8B,QAAQQ,GAAGC,IAAI,IAAI;YACzB,IAAI,CAACjB,GAAG,CAAC,CAAC,IAAI,EAAEQ,OAAO;YACvB,IAAI,CAACR,GAAG,CAACvC,eAAe,cAAcuD,GAAGjC,SAAS,EAAE;gBAACmC,QAAQ;gBAAGjB,OAAO;YAAE;YACzE,IAAI,CAACD,GAAG,CAACvC,eAAe,WAAWuD,GAAGG,OAAO,EAAE;gBAACD,QAAQ;gBAAGjB,OAAO;YAAE;QACtE;QAEA,wDAAwD;QACxD,IAAI;YACF,MAAMmB,WAAW,MAAM9D,yBAAyBc,kBAAkBmB;YAElE,IAAI,CAACS,GAAG,CAAC;YACT,IAAI,CAACA,GAAG,CAAC;YACT,KAAK,MAAMgB,MAAMI,SAAU;gBACzB,IAAI,CAACpB,GAAG,CAAC,CAAC,IAAI,EAAEgB,GAAGC,IAAI,CAAC,EAAE,EAAED,GAAGK,KAAK,CAAC,CAAC,CAAC;gBACvC,IAAIL,GAAGM,KAAK,CAACC,MAAM,GAAG,GAAG;oBACvB,IAAI,CAACvB,GAAG,CAACvC,eAAe,SAASuD,GAAGM,KAAK,EAAE;wBAACJ,QAAQ;wBAAGjB,OAAO;oBAAC;gBACjE;YACF;QACF,EAAE,OAAOzB,KAAK;YACZ,IAAI,CAACwB,GAAG,CAAC;YACT,IAAI9B,WAAWM,eAAeK,SAASL,IAAIqC,KAAK,EAAE;gBAChD,IAAI,CAACb,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAO,iDAAiD;gBAChF,IAAI,CAACiD,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAOyB,IAAIqC,KAAK,GAAG;YAC7C,OAAO;gBACL,MAAMW,SAAST,SAASvC,eAAeK,QAAQL,IAAIsC,OAAO,GAAGhC,OAAON;gBACpE,IAAI,CAACwB,GAAG,CACN,CAAC,EAAE,EAAEjD,UAAU,OAAO,CAAC,8CAA8C,EAAEyE,OAAO,CAAC,CAAC,GAAG;YAEvF;QACF;QACA,IAAI,CAACxB,GAAG,CAAC;IACX;IAEA,MAAcV,iBAAiBP,SAA6B,EAA6B;QACvF,IAAI,CAACiB,GAAG,CAAC,CAAC,EAAE,EAAEtC,cAAc,SAAS;QAErC,MAAM2B,OAAO,MAAM7B,eAAeuB;QAClC,IAAIM,gBAAgBR,OAAO;YACzB,IAAI,CAACmB,GAAG,CAAC,CAAC,EAAE,EAAEX,KAAKyB,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAOzB;QACT;QAEA,MAAMY,QAAQ,EAAE,gCAAgC;;QAChD,IAAI,CAACD,GAAG,CAACvC,eAAe,QAAQ4B,KAAK4B,IAAI,EAAE;YAAChB;QAAK;QACjD,IAAI,CAACD,GAAG,CAACvC,eAAe,SAAS4B,KAAKoC,KAAK,EAAE;YAACxB;QAAK;QACnD,IAAI,CAACD,GAAG,CAACvC,eAAe,MAAM4B,KAAKG,EAAE,EAAE;YAACS;QAAK;QAC7C,IAAI,CAACD,GAAG,CAACvC,eAAe,YAAY4B,KAAKqC,QAAQ,EAAE;YAACzB;QAAK;QACzD,IAAI,CAACD,GAAG,CAAC;QACT,OAAOX;IACT;AACF;AAEA,MAAMsC,mBAAmB;AAEzB,SAASZ,SAASa,GAAW;IAC3B,MAAMC,YAAYD,IAAIE,UAAU,CAAC,aAAa,KAAKC,IAAI;IACvD,IAAIF,UAAUN,MAAM,IAAII,kBAAkB,OAAOE;IACjD,OAAO,GAAGA,UAAUG,KAAK,CAAC,GAAGL,kBAAkB,GAAG,CAAC;AACrD"}
+{"version":3,"sources":["../../src/commands/debug.ts"],"sourcesContent":["import {styleText} from 'node:util'\n\nimport {Flags} from '@oclif/core'\nimport {ProjectRootNotFoundError, SanityCommand} from '@sanity/cli-core'\n\nimport {\n  gatherAuthInfo,\n  gatherCliInfo,\n  gatherProjectInfo,\n  gatherResolvedWorkspaces,\n  gatherStudioWorkspaces,\n  gatherUserInfo,\n} from '../actions/debug/gatherDebugInfo.js'\nimport {formatKeyValue, sectionHeader} from '../actions/debug/output.js'\nimport {type StudioWorkspace, type UserInfo} from '../actions/debug/types.js'\n\ntype ConfigLoadResult<T> = {error: Error; value?: never} | {error?: never; value: T}\n\nexport class Debug extends SanityCommand<typeof Debug> {\n  static override description = 'Print diagnostic info for troubleshooting'\n\n  static override examples = [\n    '<%= config.bin %> <%= command.id %>',\n    '<%= config.bin %> <%= command.id %> --secrets',\n  ]\n\n  static override flags = {\n    secrets: Flags.boolean({\n      default: false,\n      description: 'Include API keys in output',\n    }),\n    verbose: Flags.boolean({\n      default: false,\n      description: 'Show full error details including stack traces',\n    }),\n  }\n\n  public async run(): Promise<void> {\n    const {flags} = this\n\n    let projectDirectory: string | undefined\n    try {\n      const projectRoot = await this.getProjectRoot()\n      projectDirectory = projectRoot.directory\n    } catch (err) {\n      if (!(err instanceof ProjectRootNotFoundError)) throw err\n    }\n\n    // Try loading CLI config, capturing errors\n    let cliConfigLoad: ConfigLoadResult<Awaited<ReturnType<typeof this.getCliConfig>>> | undefined\n    if (projectDirectory) {\n      try {\n        cliConfigLoad = {value: await this.getCliConfig()}\n      } catch (err) {\n        cliConfigLoad = {error: err instanceof Error ? err : new Error(String(err))}\n      }\n    }\n\n    const projectId = cliConfigLoad?.value?.api?.projectId\n\n    // Gather project info once, shared between Project and Studio sections\n    const project = projectDirectory ? await gatherProjectInfo(projectDirectory) : undefined\n\n    // Pre-load studio workspaces so we know if the config is valid\n    let studioLoad: ConfigLoadResult<StudioWorkspace[]> | undefined\n    if (project?.studioConfigPath && projectDirectory) {\n      try {\n        studioLoad = {value: await gatherStudioWorkspaces(projectDirectory)}\n      } catch (err) {\n        studioLoad = {error: err instanceof Error ? err : new Error(String(err))}\n      }\n    }\n\n    // Section 1: User\n    const user = await this.printUserSection(projectId)\n    const userId = user instanceof Error ? undefined : user.id\n\n    // Section 2: Authentication (only when logged in)\n    await this.printAuthSection(flags.secrets)\n\n    // Section 3: CLI\n    await this.printCliSection()\n\n    // Section 4: Project\n    this.printProjectSection(project, cliConfigLoad, studioLoad)\n\n    // Section 5: Studio (when studio config file exists)\n    if (projectDirectory && project?.studioConfigPath && studioLoad) {\n      await this.printStudioSection(projectDirectory, studioLoad, flags.verbose, projectId, userId)\n    }\n  }\n\n  private async printAuthSection(includeSecrets: boolean): Promise<void> {\n    const auth = await gatherAuthInfo(includeSecrets)\n    if (!auth.hasToken) return\n\n    this.log(sectionHeader('Authentication'))\n    const padTo = 10 // \"Auth token\" is the longest key\n    this.log(formatKeyValue('Auth token', auth.authToken, {padTo}))\n    this.log(formatKeyValue('User type', auth.userType, {padTo}))\n\n    if (!includeSecrets) {\n      this.log('  (run with --secrets to reveal token)')\n    }\n    this.log('')\n  }\n\n  private async printCliSection(): Promise<void> {\n    this.log(sectionHeader('CLI'))\n\n    try {\n      const cliInfo = await gatherCliInfo()\n      const padTo = 9 // \"Installed\" is the longest key\n      this.log(formatKeyValue('Version', cliInfo.version, {padTo}))\n      this.log(formatKeyValue('Installed', cliInfo.installContext, {padTo}))\n    } catch {\n      this.log(`  ${styleText('red', 'Unable to determine CLI version')}`)\n    }\n    this.log('')\n  }\n\n  private printConfigStatus(\n    label: string,\n    fileName: string | undefined,\n    loadResult: ConfigLoadResult<unknown> | undefined,\n    padTo: number,\n  ): void {\n    if (!fileName) {\n      this.log(formatKeyValue(label, `${styleText('red', '\\u274C')} not found`, {padTo}))\n      return\n    }\n\n    if (loadResult?.error) {\n      this.log(\n        formatKeyValue(\n          label,\n          `${styleText('yellow', '\\u26A0\\uFE0F')}  ${styleText('yellow', fileName)} (has errors)`,\n          {padTo},\n        ),\n      )\n    } else {\n      this.log(\n        formatKeyValue(label, `${styleText('green', '\\u2705')} ${styleText('yellow', fileName)}`, {\n          padTo,\n        }),\n      )\n    }\n  }\n\n  private printProjectSection(\n    project: Awaited<ReturnType<typeof gatherProjectInfo>>,\n    cliConfigLoad: ConfigLoadResult<unknown> | undefined,\n    studioLoad: ConfigLoadResult<unknown> | undefined,\n  ): void {\n    this.log(sectionHeader('Project'))\n\n    if (!project) {\n      this.log('  No project found\\n')\n      return\n    }\n\n    const padTo = 14\n    this.log(formatKeyValue('Root path', project.rootPath, {padTo}))\n    this.printConfigStatus('CLI config', project.cliConfigPath, cliConfigLoad, padTo)\n    this.printConfigStatus('Studio config', project.studioConfigPath, studioLoad, padTo)\n    this.log('')\n  }\n\n  private async printStudioSection(\n    projectDirectory: string,\n    studioLoad: ConfigLoadResult<StudioWorkspace[]>,\n    verbose: boolean,\n    projectId: string | undefined,\n    userId: string | undefined,\n  ): Promise<void> {\n    this.log(sectionHeader('Studio'))\n\n    if (studioLoad.error) {\n      this.log(`  ${styleText('red', 'Failed to load studio configuration:')}`)\n      if (verbose) {\n        this.log(`  ${studioLoad.error.stack ?? studioLoad.error.message}\\n`)\n      } else {\n        this.log(`  ${truncate(studioLoad.error.message)}\\n`)\n      }\n      return\n    }\n\n    this.log('  Workspaces:')\n    for (const ws of studioLoad.value) {\n      const label = ws.name ?? 'default'\n      this.log(`    ${label}`)\n      this.log(formatKeyValue('Project ID', ws.projectId, {indent: 6, padTo: 10}))\n      this.log(formatKeyValue('Dataset', ws.dataset, {indent: 6, padTo: 10}))\n    }\n\n    // Full resolution: try to resolve plugins and get roles\n    try {\n      const resolved = await gatherResolvedWorkspaces(projectDirectory, userId)\n\n      this.log('')\n      this.log('  Resolved configuration:')\n      for (const ws of resolved) {\n        this.log(`    ${ws.name} (${ws.title})`)\n        if (ws.roles.length > 0) {\n          this.log(formatKeyValue('Roles', ws.roles, {indent: 6, padTo: 5}))\n        }\n      }\n    } catch (err) {\n      this.log('')\n      if (verbose && err instanceof Error && err.stack) {\n        this.log(`  ${styleText('dim', 'Unable to resolve full studio configuration:')}`)\n        this.log(`  ${styleText('dim', err.stack)}`)\n      } else {\n        const reason = truncate(err instanceof Error ? err.message : String(err))\n        this.log(\n          `  ${styleText('dim', `(unable to resolve full studio configuration: ${reason})`)}`,\n        )\n      }\n    }\n    this.log('')\n  }\n\n  private async printUserSection(projectId: string | undefined): Promise<Error | UserInfo> {\n    this.log(`\\n${sectionHeader('User')}`)\n\n    const user = await gatherUserInfo(projectId)\n    if (user instanceof Error) {\n      this.log(`  ${user.message}\\n`)\n      return user\n    }\n\n    const padTo = 8 // \"Provider\" is the longest key\n    this.log(formatKeyValue('Name', user.name, {padTo}))\n    this.log(formatKeyValue('Email', user.email ?? '(none)', {padTo}))\n    this.log(formatKeyValue('ID', user.id, {padTo}))\n    this.log(formatKeyValue('Provider', user.provider, {padTo}))\n    this.log('')\n    return user\n  }\n}\n\nconst MAX_ERROR_LENGTH = 200\n\nfunction truncate(str: string): string {\n  const collapsed = str.replaceAll(/\\s*\\n\\s*/g, ' ').trim()\n  if (collapsed.length <= MAX_ERROR_LENGTH) return collapsed\n  return `${collapsed.slice(0, MAX_ERROR_LENGTH)}...`\n}\n"],"names":["styleText","Flags","ProjectRootNotFoundError","SanityCommand","gatherAuthInfo","gatherCliInfo","gatherProjectInfo","gatherResolvedWorkspaces","gatherStudioWorkspaces","gatherUserInfo","formatKeyValue","sectionHeader","Debug","description","examples","flags","secrets","boolean","default","verbose","run","projectDirectory","projectRoot","getProjectRoot","directory","err","cliConfigLoad","value","getCliConfig","error","Error","String","projectId","api","project","undefined","studioLoad","studioConfigPath","user","printUserSection","userId","id","printAuthSection","printCliSection","printProjectSection","printStudioSection","includeSecrets","auth","hasToken","log","padTo","authToken","userType","cliInfo","version","installContext","printConfigStatus","label","fileName","loadResult","rootPath","cliConfigPath","stack","message","truncate","ws","name","indent","dataset","resolved","title","roles","length","reason","email","provider","MAX_ERROR_LENGTH","str","collapsed","replaceAll","trim","slice"],"mappings":"AAAA,SAAQA,SAAS,QAAO,YAAW;AAEnC,SAAQC,KAAK,QAAO,cAAa;AACjC,SAAQC,wBAAwB,EAAEC,aAAa,QAAO,mBAAkB;AAExE,SACEC,cAAc,EACdC,aAAa,EACbC,iBAAiB,EACjBC,wBAAwB,EACxBC,sBAAsB,EACtBC,cAAc,QACT,sCAAqC;AAC5C,SAAQC,cAAc,EAAEC,aAAa,QAAO,6BAA4B;AAKxE,OAAO,MAAMC,cAAcT;IACzB,OAAgBU,cAAc,4CAA2C;IAEzE,OAAgBC,WAAW;QACzB;QACA;KACD,CAAA;IAED,OAAgBC,QAAQ;QACtBC,SAASf,MAAMgB,OAAO,CAAC;YACrBC,SAAS;YACTL,aAAa;QACf;QACAM,SAASlB,MAAMgB,OAAO,CAAC;YACrBC,SAAS;YACTL,aAAa;QACf;IACF,EAAC;IAED,MAAaO,MAAqB;QAChC,MAAM,EAACL,KAAK,EAAC,GAAG,IAAI;QAEpB,IAAIM;QACJ,IAAI;YACF,MAAMC,cAAc,MAAM,IAAI,CAACC,cAAc;YAC7CF,mBAAmBC,YAAYE,SAAS;QAC1C,EAAE,OAAOC,KAAK;YACZ,IAAI,CAAEA,CAAAA,eAAevB,wBAAuB,GAAI,MAAMuB;QACxD;QAEA,2CAA2C;QAC3C,IAAIC;QACJ,IAAIL,kBAAkB;YACpB,IAAI;gBACFK,gBAAgB;oBAACC,OAAO,MAAM,IAAI,CAACC,YAAY;gBAAE;YACnD,EAAE,OAAOH,KAAK;gBACZC,gBAAgB;oBAACG,OAAOJ,eAAeK,QAAQL,MAAM,IAAIK,MAAMC,OAAON;gBAAK;YAC7E;QACF;QAEA,MAAMO,YAAYN,eAAeC,OAAOM,KAAKD;QAE7C,uEAAuE;QACvE,MAAME,UAAUb,mBAAmB,MAAMf,kBAAkBe,oBAAoBc;QAE/E,+DAA+D;QAC/D,IAAIC;QACJ,IAAIF,SAASG,oBAAoBhB,kBAAkB;YACjD,IAAI;gBACFe,aAAa;oBAACT,OAAO,MAAMnB,uBAAuBa;gBAAiB;YACrE,EAAE,OAAOI,KAAK;gBACZW,aAAa;oBAACP,OAAOJ,eAAeK,QAAQL,MAAM,IAAIK,MAAMC,OAAON;gBAAK;YAC1E;QACF;QAEA,kBAAkB;QAClB,MAAMa,OAAO,MAAM,IAAI,CAACC,gBAAgB,CAACP;QACzC,MAAMQ,SAASF,gBAAgBR,QAAQK,YAAYG,KAAKG,EAAE;QAE1D,kDAAkD;QAClD,MAAM,IAAI,CAACC,gBAAgB,CAAC3B,MAAMC,OAAO;QAEzC,iBAAiB;QACjB,MAAM,IAAI,CAAC2B,eAAe;QAE1B,qBAAqB;QACrB,IAAI,CAACC,mBAAmB,CAACV,SAASR,eAAeU;QAEjD,qDAAqD;QACrD,IAAIf,oBAAoBa,SAASG,oBAAoBD,YAAY;YAC/D,MAAM,IAAI,CAACS,kBAAkB,CAACxB,kBAAkBe,YAAYrB,MAAMI,OAAO,EAAEa,WAAWQ;QACxF;IACF;IAEA,MAAcE,iBAAiBI,cAAuB,EAAiB;QACrE,MAAMC,OAAO,MAAM3C,eAAe0C;QAClC,IAAI,CAACC,KAAKC,QAAQ,EAAE;QAEpB,IAAI,CAACC,GAAG,CAACtC,cAAc;QACvB,MAAMuC,QAAQ,GAAG,kCAAkC;;QACnD,IAAI,CAACD,GAAG,CAACvC,eAAe,cAAcqC,KAAKI,SAAS,EAAE;YAACD;QAAK;QAC5D,IAAI,CAACD,GAAG,CAACvC,eAAe,aAAaqC,KAAKK,QAAQ,EAAE;YAACF;QAAK;QAE1D,IAAI,CAACJ,gBAAgB;YACnB,IAAI,CAACG,GAAG,CAAC;QACX;QACA,IAAI,CAACA,GAAG,CAAC;IACX;IAEA,MAAcN,kBAAiC;QAC7C,IAAI,CAACM,GAAG,CAACtC,cAAc;QAEvB,IAAI;YACF,MAAM0C,UAAU,MAAMhD;YACtB,MAAM6C,QAAQ,EAAE,iCAAiC;;YACjD,IAAI,CAACD,GAAG,CAACvC,eAAe,WAAW2C,QAAQC,OAAO,EAAE;gBAACJ;YAAK;YAC1D,IAAI,CAACD,GAAG,CAACvC,eAAe,aAAa2C,QAAQE,cAAc,EAAE;gBAACL;YAAK;QACrE,EAAE,OAAM;YACN,IAAI,CAACD,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAO,oCAAoC;QACrE;QACA,IAAI,CAACiD,GAAG,CAAC;IACX;IAEQO,kBACNC,KAAa,EACbC,QAA4B,EAC5BC,UAAiD,EACjDT,KAAa,EACP;QACN,IAAI,CAACQ,UAAU;YACb,IAAI,CAACT,GAAG,CAACvC,eAAe+C,OAAO,GAAGzD,UAAU,OAAO,UAAU,UAAU,CAAC,EAAE;gBAACkD;YAAK;YAChF;QACF;QAEA,IAAIS,YAAY9B,OAAO;YACrB,IAAI,CAACoB,GAAG,CACNvC,eACE+C,OACA,GAAGzD,UAAU,UAAU,gBAAgB,EAAE,EAAEA,UAAU,UAAU0D,UAAU,aAAa,CAAC,EACvF;gBAACR;YAAK;QAGZ,OAAO;YACL,IAAI,CAACD,GAAG,CACNvC,eAAe+C,OAAO,GAAGzD,UAAU,SAAS,UAAU,CAAC,EAAEA,UAAU,UAAU0D,WAAW,EAAE;gBACxFR;YACF;QAEJ;IACF;IAEQN,oBACNV,OAAsD,EACtDR,aAAoD,EACpDU,UAAiD,EAC3C;QACN,IAAI,CAACa,GAAG,CAACtC,cAAc;QAEvB,IAAI,CAACuB,SAAS;YACZ,IAAI,CAACe,GAAG,CAAC;YACT;QACF;QAEA,MAAMC,QAAQ;QACd,IAAI,CAACD,GAAG,CAACvC,eAAe,aAAawB,QAAQ0B,QAAQ,EAAE;YAACV;QAAK;QAC7D,IAAI,CAACM,iBAAiB,CAAC,cAActB,QAAQ2B,aAAa,EAAEnC,eAAewB;QAC3E,IAAI,CAACM,iBAAiB,CAAC,iBAAiBtB,QAAQG,gBAAgB,EAAED,YAAYc;QAC9E,IAAI,CAACD,GAAG,CAAC;IACX;IAEA,MAAcJ,mBACZxB,gBAAwB,EACxBe,UAA+C,EAC/CjB,OAAgB,EAChBa,SAA6B,EAC7BQ,MAA0B,EACX;QACf,IAAI,CAACS,GAAG,CAACtC,cAAc;QAEvB,IAAIyB,WAAWP,KAAK,EAAE;YACpB,IAAI,CAACoB,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAO,yCAAyC;YACxE,IAAImB,SAAS;gBACX,IAAI,CAAC8B,GAAG,CAAC,CAAC,EAAE,EAAEb,WAAWP,KAAK,CAACiC,KAAK,IAAI1B,WAAWP,KAAK,CAACkC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO;gBACL,IAAI,CAACd,GAAG,CAAC,CAAC,EAAE,EAAEe,SAAS5B,WAAWP,KAAK,CAACkC,OAAO,EAAE,EAAE,CAAC;YACtD;YACA;QACF;QAEA,IAAI,CAACd,GAAG,CAAC;QACT,KAAK,MAAMgB,MAAM7B,WAAWT,KAAK,CAAE;YACjC,MAAM8B,QAAQQ,GAAGC,IAAI,IAAI;YACzB,IAAI,CAACjB,GAAG,CAAC,CAAC,IAAI,EAAEQ,OAAO;YACvB,IAAI,CAACR,GAAG,CAACvC,eAAe,cAAcuD,GAAGjC,SAAS,EAAE;gBAACmC,QAAQ;gBAAGjB,OAAO;YAAE;YACzE,IAAI,CAACD,GAAG,CAACvC,eAAe,WAAWuD,GAAGG,OAAO,EAAE;gBAACD,QAAQ;gBAAGjB,OAAO;YAAE;QACtE;QAEA,wDAAwD;QACxD,IAAI;YACF,MAAMmB,WAAW,MAAM9D,yBAAyBc,kBAAkBmB;YAElE,IAAI,CAACS,GAAG,CAAC;YACT,IAAI,CAACA,GAAG,CAAC;YACT,KAAK,MAAMgB,MAAMI,SAAU;gBACzB,IAAI,CAACpB,GAAG,CAAC,CAAC,IAAI,EAAEgB,GAAGC,IAAI,CAAC,EAAE,EAAED,GAAGK,KAAK,CAAC,CAAC,CAAC;gBACvC,IAAIL,GAAGM,KAAK,CAACC,MAAM,GAAG,GAAG;oBACvB,IAAI,CAACvB,GAAG,CAACvC,eAAe,SAASuD,GAAGM,KAAK,EAAE;wBAACJ,QAAQ;wBAAGjB,OAAO;oBAAC;gBACjE;YACF;QACF,EAAE,OAAOzB,KAAK;YACZ,IAAI,CAACwB,GAAG,CAAC;YACT,IAAI9B,WAAWM,eAAeK,SAASL,IAAIqC,KAAK,EAAE;gBAChD,IAAI,CAACb,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAO,iDAAiD;gBAChF,IAAI,CAACiD,GAAG,CAAC,CAAC,EAAE,EAAEjD,UAAU,OAAOyB,IAAIqC,KAAK,GAAG;YAC7C,OAAO;gBACL,MAAMW,SAAST,SAASvC,eAAeK,QAAQL,IAAIsC,OAAO,GAAGhC,OAAON;gBACpE,IAAI,CAACwB,GAAG,CACN,CAAC,EAAE,EAAEjD,UAAU,OAAO,CAAC,8CAA8C,EAAEyE,OAAO,CAAC,CAAC,GAAG;YAEvF;QACF;QACA,IAAI,CAACxB,GAAG,CAAC;IACX;IAEA,MAAcV,iBAAiBP,SAA6B,EAA6B;QACvF,IAAI,CAACiB,GAAG,CAAC,CAAC,EAAE,EAAEtC,cAAc,SAAS;QAErC,MAAM2B,OAAO,MAAM7B,eAAeuB;QAClC,IAAIM,gBAAgBR,OAAO;YACzB,IAAI,CAACmB,GAAG,CAAC,CAAC,EAAE,EAAEX,KAAKyB,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAOzB;QACT;QAEA,MAAMY,QAAQ,EAAE,gCAAgC;;QAChD,IAAI,CAACD,GAAG,CAACvC,eAAe,QAAQ4B,KAAK4B,IAAI,EAAE;YAAChB;QAAK;QACjD,IAAI,CAACD,GAAG,CAACvC,eAAe,SAAS4B,KAAKoC,KAAK,IAAI,UAAU;YAACxB;QAAK;QAC/D,IAAI,CAACD,GAAG,CAACvC,eAAe,MAAM4B,KAAKG,EAAE,EAAE;YAACS;QAAK;QAC7C,IAAI,CAACD,GAAG,CAACvC,eAAe,YAAY4B,KAAKqC,QAAQ,EAAE;YAACzB;QAAK;QACzD,IAAI,CAACD,GAAG,CAAC;QACT,OAAOX;IACT;AACF;AAEA,MAAMsC,mBAAmB;AAEzB,SAASZ,SAASa,GAAW;IAC3B,MAAMC,YAAYD,IAAIE,UAAU,CAAC,aAAa,KAAKC,IAAI;IACvD,IAAIF,UAAUN,MAAM,IAAII,kBAAkB,OAAOE;IACjD,OAAO,GAAGA,UAAUG,KAAK,CAAC,GAAGL,kBAAkB,GAAG,CAAC;AACrD"}

package/dist/exports/invokeSanityCli/commandPolicies/index.js

@@ -0,0 +1,6 @@
+import { mcpPolicy } from './mcpPolicy.js';
+export const commandPolicies = {
+    mcp: mcpPolicy
+};
+
+//# sourceMappingURL=index.js.map

package/dist/exports/invokeSanityCli/commandPolicies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/index.ts"],"sourcesContent":["import {mcpPolicy} from './mcpPolicy.js'\nimport {type CommandPolicySet, type InvocationSource} from './policy.js'\n\nexport const commandPolicies: Record<InvocationSource, CommandPolicySet> = {\n  mcp: mcpPolicy,\n}\n"],"names":["mcpPolicy","commandPolicies","mcp"],"mappings":"AAAA,SAAQA,SAAS,QAAO,iBAAgB;AAGxC,OAAO,MAAMC,kBAA8D;IACzEC,KAAKF;AACP,EAAC"}

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js

@@ -0,0 +1,167 @@
+import { allow, conditionalDenyFlags, conditionalPolicy, deny } from './policy.js';
+/**
+ * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command
+ * read the host's filesystem or stdin (raw `-f` fields are always verbatim).
+ */ function fieldReadsFromHost(field) {
+    if (typeof field !== 'string') return false;
+    const separatorIndex = field.indexOf('=');
+    return separatorIndex > 0 && field[separatorIndex + 1] === '@';
+}
+/**
+ * MCP programmatic mode disables local project/config discovery (see the CLI
+ * execution context). Missing project or dataset values may therefore produce
+ * a usage error, but cannot cause local filesystem access. Destructive remote
+ * operations are allowed and do not by themselves make a command unsafe.
+ *
+ * Every manifest command must have exactly one policy here:
+ * - allow: every valid invocation is safe
+ * - conditional: safety depends on parsed arguments or flags
+ * - deny: no invocation is safe
+ */ export const mcpPolicy = {
+    // Special exception, this can be very dangerous but is also super useful
+    // to expose. Only the host input channels are refused: `--input` reads the
+    // request body from the host's filesystem or stdin, and `-F key=@<file>` /
+    // `-F key=@-` field values do the same.
+    api: conditionalPolicy({
+        deniedFlags: [
+            'input'
+        ],
+        validate: ({ flags })=>!Array.isArray(flags.field) || !flags.field.some((field)=>fieldReadsFromHost(field))
+    }),
+    'backups:disable': allow,
+    // Writes a downloaded backup to the local filesystem.
+    'backups:download': deny,
+    'backups:enable': allow,
+    'backups:list': allow,
+    // Requires a local Studio project and writes build output to disk.
+    build: deny,
+    // Reads and rewrites local source code.
+    codemod: deny,
+    'cors:add': allow,
+    'cors:delete': allow,
+    'cors:list': allow,
+    'datasets:alias:create': allow,
+    'datasets:alias:delete': allow,
+    'datasets:alias:link': allow,
+    'datasets:alias:unlink': allow,
+    'datasets:copy': allow,
+    'datasets:create': allow,
+    'datasets:delete': allow,
+    'datasets:embeddings:disable': allow,
+    'datasets:embeddings:enable': allow,
+    'datasets:embeddings:status': allow,
+    // Writes dataset contents and assets to the local filesystem.
+    'datasets:export': deny,
+    // Reads import data from the local filesystem and may replace documents.
+    'datasets:import': deny,
+    'datasets:list': allow,
+    'datasets:visibility:get': allow,
+    'datasets:visibility:set': allow,
+    // Inspects local project files and can print authentication secrets.
+    debug: deny,
+    // Reads, builds, and deploys a local Studio project.
+    deploy: deny,
+    // Loads a local Studio project and starts a development server.
+    dev: deny,
+    // Opens a browser on the machine running the MCP server.
+    'docs:browse': deny,
+    // --web opens a browser on the machine running the MCP server.
+    'docs:read': conditionalDenyFlags('web'),
+    'docs:search': allow,
+    // Reads and executes local project configuration for diagnostics.
+    doctor: deny,
+    // Reads document input from disk or launches a local editor.
+    'documents:create': deny,
+    'documents:delete': allow,
+    'documents:get': allow,
+    'documents:query': allow,
+    // Loads a local Studio schema to validate documents.
+    'documents:validate': deny,
+    // Executes arbitrary code in the local Studio context.
+    exec: deny,
+    // Loads a local schema and deploys a GraphQL API.
+    'graphql:deploy': deny,
+    'graphql:list': allow,
+    // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.
+    'graphql:undeploy': conditionalDenyFlags('api'),
+    'hooks:attempt': allow,
+    'hooks:create': allow,
+    'hooks:delete': allow,
+    'hooks:list': allow,
+    'hooks:logs': allow,
+    // Creates or modifies a local project and may install dependencies.
+    init: deny,
+    // Installs packages into the local project.
+    install: deny,
+    // Opens a browser on the machine running the MCP server.
+    learn: deny,
+    // Performs an authentication flow.
+    login: deny,
+    // Performs an authentication operation and clears local credentials.
+    logout: deny,
+    // Reads local project configuration and opens a browser.
+    manage: deny,
+    // Loads local Studio configuration and writes manifest files.
+    'manifest:extract': deny,
+    // Reads and writes local MCP client configuration.
+    'mcp:configure': deny,
+    // Writes an aspect definition to the local filesystem.
+    'media:create-aspect': deny,
+    'media:delete-aspect': allow,
+    // Reads a local aspect definition before deploying it.
+    'media:deploy-aspect': deny,
+    // Writes media assets to the local filesystem.
+    'media:export': deny,
+    // Reads media assets from the local filesystem.
+    'media:import': deny,
+    // Creates migration source files in the local project.
+    'migrations:create': deny,
+    // Reads and loads migration definitions from the local project.
+    'migrations:list': deny,
+    // Executes local migration code that may perform arbitrary document mutations.
+    'migrations:run': deny,
+    // --web opens a browser on the machine running the MCP server.
+    'openapi:get': conditionalDenyFlags('web'),
+    'openapi:list': conditionalDenyFlags('web'),
+    'organizations:create': allow,
+    'organizations:delete': allow,
+    'organizations:get': allow,
+    'organizations:list': allow,
+    'organizations:update': allow,
+    // Serves a local production build.
+    preview: deny,
+    'projects:create': allow,
+    'projects:list': allow,
+    // Loads the local Studio configuration to resolve the datasets containing each schema.
+    'schemas:delete': deny,
+    // Loads local schema files before deploying them.
+    'schemas:deploy': deny,
+    // Loads local Studio configuration and writes an extracted schema to disk.
+    'schemas:extract': deny,
+    // Requires a local project and loads its schema configuration.
+    'schemas:list': deny,
+    // Loads and executes a local Studio schema.
+    'schemas:validate': deny,
+    // Installs skills into local editor configuration directories.
+    'skills:install': deny,
+    // Changes account telemetry preferences and mutates local cached configuration.
+    'telemetry:disable': deny,
+    // Changes account telemetry preferences and mutates local cached configuration.
+    'telemetry:enable': deny,
+    'telemetry:status': allow,
+    // Creates authentication credentials.
+    'tokens:create': deny,
+    // Deletes authentication credentials.
+    'tokens:delete': deny,
+    // Exposes authentication credential metadata.
+    'tokens:list': deny,
+    // Loads local CLI and workbench configuration to identify the deployed Studio or application.
+    undeploy: deny,
+    // Grants a user access to a project.
+    'users:invite': deny,
+    'users:list': allow,
+    // Reads the local project and installed package tree.
+    versions: deny
+};
+
+//# sourceMappingURL=mcpPolicy.js.map

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/mcpPolicy.ts"],"sourcesContent":["import {\n  allow,\n  type CommandPolicySet,\n  conditionalDenyFlags,\n  conditionalPolicy,\n  deny,\n} from './policy.js'\n\n/**\n * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command\n * read the host's filesystem or stdin (raw `-f` fields are always verbatim).\n */\nfunction fieldReadsFromHost(field: unknown): boolean {\n  if (typeof field !== 'string') return false\n  const separatorIndex = field.indexOf('=')\n  return separatorIndex > 0 && field[separatorIndex + 1] === '@'\n}\n\n/**\n * MCP programmatic mode disables local project/config discovery (see the CLI\n * execution context). Missing project or dataset values may therefore produce\n * a usage error, but cannot cause local filesystem access. Destructive remote\n * operations are allowed and do not by themselves make a command unsafe.\n *\n * Every manifest command must have exactly one policy here:\n * - allow: every valid invocation is safe\n * - conditional: safety depends on parsed arguments or flags\n * - deny: no invocation is safe\n */\nexport const mcpPolicy: CommandPolicySet = {\n  // Special exception, this can be very dangerous but is also super useful\n  // to expose. Only the host input channels are refused: `--input` reads the\n  // request body from the host's filesystem or stdin, and `-F key=@<file>` /\n  // `-F key=@-` field values do the same.\n  api: conditionalPolicy({\n    deniedFlags: ['input'],\n    validate: ({flags}) =>\n      !Array.isArray(flags.field) || !flags.field.some((field) => fieldReadsFromHost(field)),\n  }),\n\n  'backups:disable': allow,\n  // Writes a downloaded backup to the local filesystem.\n  'backups:download': deny,\n  'backups:enable': allow,\n  'backups:list': allow,\n\n  // Requires a local Studio project and writes build output to disk.\n  build: deny,\n\n  // Reads and rewrites local source code.\n  codemod: deny,\n\n  'cors:add': allow,\n  'cors:delete': allow,\n  'cors:list': allow,\n\n  'datasets:alias:create': allow,\n  'datasets:alias:delete': allow,\n  'datasets:alias:link': allow,\n  'datasets:alias:unlink': allow,\n  'datasets:copy': allow,\n  'datasets:create': allow,\n  'datasets:delete': allow,\n  'datasets:embeddings:disable': allow,\n  'datasets:embeddings:enable': allow,\n  'datasets:embeddings:status': allow,\n  // Writes dataset contents and assets to the local filesystem.\n  'datasets:export': deny,\n  // Reads import data from the local filesystem and may replace documents.\n  'datasets:import': deny,\n  'datasets:list': allow,\n  'datasets:visibility:get': allow,\n  'datasets:visibility:set': allow,\n\n  // Inspects local project files and can print authentication secrets.\n  debug: deny,\n\n  // Reads, builds, and deploys a local Studio project.\n  deploy: deny,\n\n  // Loads a local Studio project and starts a development server.\n  dev: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  'docs:browse': deny,\n  // --web opens a browser on the machine running the MCP server.\n  'docs:read': conditionalDenyFlags('web'),\n  'docs:search': allow,\n\n  // Reads and executes local project configuration for diagnostics.\n  doctor: deny,\n\n  // Reads document input from disk or launches a local editor.\n  'documents:create': deny,\n  'documents:delete': allow,\n  'documents:get': allow,\n  'documents:query': allow,\n  // Loads a local Studio schema to validate documents.\n  'documents:validate': deny,\n\n  // Executes arbitrary code in the local Studio context.\n  exec: deny,\n\n  // Loads a local schema and deploys a GraphQL API.\n  'graphql:deploy': deny,\n  'graphql:list': allow,\n  // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.\n  'graphql:undeploy': conditionalDenyFlags('api'),\n\n  'hooks:attempt': allow,\n  'hooks:create': allow,\n  'hooks:delete': allow,\n  'hooks:list': allow,\n  'hooks:logs': allow,\n\n  // Creates or modifies a local project and may install dependencies.\n  init: deny,\n\n  // Installs packages into the local project.\n  install: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  learn: deny,\n\n  // Performs an authentication flow.\n  login: deny,\n\n  // Performs an authentication operation and clears local credentials.\n  logout: deny,\n\n  // Reads local project configuration and opens a browser.\n  manage: deny,\n\n  // Loads local Studio configuration and writes manifest files.\n  'manifest:extract': deny,\n\n  // Reads and writes local MCP client configuration.\n  'mcp:configure': deny,\n\n  // Writes an aspect definition to the local filesystem.\n  'media:create-aspect': deny,\n  'media:delete-aspect': allow,\n  // Reads a local aspect definition before deploying it.\n  'media:deploy-aspect': deny,\n  // Writes media assets to the local filesystem.\n  'media:export': deny,\n  // Reads media assets from the local filesystem.\n  'media:import': deny,\n\n  // Creates migration source files in the local project.\n  'migrations:create': deny,\n  // Reads and loads migration definitions from the local project.\n  'migrations:list': deny,\n  // Executes local migration code that may perform arbitrary document mutations.\n  'migrations:run': deny,\n\n  // --web opens a browser on the machine running the MCP server.\n  'openapi:get': conditionalDenyFlags('web'),\n  'openapi:list': conditionalDenyFlags('web'),\n\n  'organizations:create': allow,\n  'organizations:delete': allow,\n  'organizations:get': allow,\n  'organizations:list': allow,\n  'organizations:update': allow,\n\n  // Serves a local production build.\n  preview: deny,\n\n  'projects:create': allow,\n  'projects:list': allow,\n\n  // Loads the local Studio configuration to resolve the datasets containing each schema.\n  'schemas:delete': deny,\n  // Loads local schema files before deploying them.\n  'schemas:deploy': deny,\n  // Loads local Studio configuration and writes an extracted schema to disk.\n  'schemas:extract': deny,\n  // Requires a local project and loads its schema configuration.\n  'schemas:list': deny,\n  // Loads and executes a local Studio schema.\n  'schemas:validate': deny,\n\n  // Installs skills into local editor configuration directories.\n  'skills:install': deny,\n\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:disable': deny,\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:enable': deny,\n  'telemetry:status': allow,\n\n  // Creates authentication credentials.\n  'tokens:create': deny,\n  // Deletes authentication credentials.\n  'tokens:delete': deny,\n  // Exposes authentication credential metadata.\n  'tokens:list': deny,\n\n  // Loads local CLI and workbench configuration to identify the deployed Studio or application.\n  undeploy: deny,\n\n  // Grants a user access to a project.\n  'users:invite': deny,\n  'users:list': allow,\n\n  // Reads the local project and installed package tree.\n  versions: deny,\n}\n"],"names":["allow","conditionalDenyFlags","conditionalPolicy","deny","fieldReadsFromHost","field","separatorIndex","indexOf","mcpPolicy","api","deniedFlags","validate","flags","Array","isArray","some","build","codemod","debug","deploy","dev","doctor","exec","init","install","learn","login","logout","manage","preview","undeploy","versions"],"mappings":"AAAA,SACEA,KAAK,EAELC,oBAAoB,EACpBC,iBAAiB,EACjBC,IAAI,QACC,cAAa;AAEpB;;;CAGC,GACD,SAASC,mBAAmBC,KAAc;IACxC,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMC,iBAAiBD,MAAME,OAAO,CAAC;IACrC,OAAOD,iBAAiB,KAAKD,KAAK,CAACC,iBAAiB,EAAE,KAAK;AAC7D;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAME,YAA8B;IACzC,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,wCAAwC;IACxCC,KAAKP,kBAAkB;QACrBQ,aAAa;YAAC;SAAQ;QACtBC,UAAU,CAAC,EAACC,KAAK,EAAC,GAChB,CAACC,MAAMC,OAAO,CAACF,MAAMP,KAAK,KAAK,CAACO,MAAMP,KAAK,CAACU,IAAI,CAAC,CAACV,QAAUD,mBAAmBC;IACnF;IAEA,mBAAmBL;IACnB,sDAAsD;IACtD,oBAAoBG;IACpB,kBAAkBH;IAClB,gBAAgBA;IAEhB,mEAAmE;IACnEgB,OAAOb;IAEP,wCAAwC;IACxCc,SAASd;IAET,YAAYH;IACZ,eAAeA;IACf,aAAaA;IAEb,yBAAyBA;IACzB,yBAAyBA;IACzB,uBAAuBA;IACvB,yBAAyBA;IACzB,iBAAiBA;IACjB,mBAAmBA;IACnB,mBAAmBA;IACnB,+BAA+BA;IAC/B,8BAA8BA;IAC9B,8BAA8BA;IAC9B,8DAA8D;IAC9D,mBAAmBG;IACnB,yEAAyE;IACzE,mBAAmBA;IACnB,iBAAiBH;IACjB,2BAA2BA;IAC3B,2BAA2BA;IAE3B,qEAAqE;IACrEkB,OAAOf;IAEP,qDAAqD;IACrDgB,QAAQhB;IAER,gEAAgE;IAChEiB,KAAKjB;IAEL,yDAAyD;IACzD,eAAeA;IACf,+DAA+D;IAC/D,aAAaF,qBAAqB;IAClC,eAAeD;IAEf,kEAAkE;IAClEqB,QAAQlB;IAER,6DAA6D;IAC7D,oBAAoBA;IACpB,oBAAoBH;IACpB,iBAAiBA;IACjB,mBAAmBA;IACnB,qDAAqD;IACrD,sBAAsBG;IAEtB,uDAAuD;IACvDmB,MAAMnB;IAEN,kDAAkD;IAClD,kBAAkBA;IAClB,gBAAgBH;IAChB,mGAAmG;IACnG,oBAAoBC,qBAAqB;IAEzC,iBAAiBD;IACjB,gBAAgBA;IAChB,gBAAgBA;IAChB,cAAcA;IACd,cAAcA;IAEd,oEAAoE;IACpEuB,MAAMpB;IAEN,4CAA4C;IAC5CqB,SAASrB;IAET,yDAAyD;IACzDsB,OAAOtB;IAEP,mCAAmC;IACnCuB,OAAOvB;IAEP,qEAAqE;IACrEwB,QAAQxB;IAER,yDAAyD;IACzDyB,QAAQzB;IAER,8DAA8D;IAC9D,oBAAoBA;IAEpB,mDAAmD;IACnD,iBAAiBA;IAEjB,uDAAuD;IACvD,uBAAuBA;IACvB,uBAAuBH;IACvB,uDAAuD;IACvD,uBAAuBG;IACvB,+CAA+C;IAC/C,gBAAgBA;IAChB,gDAAgD;IAChD,gBAAgBA;IAEhB,uDAAuD;IACvD,qBAAqBA;IACrB,gEAAgE;IAChE,mBAAmBA;IACnB,+EAA+E;IAC/E,kBAAkBA;IAElB,+DAA+D;IAC/D,eAAeF,qBAAqB;IACpC,gBAAgBA,qBAAqB;IAErC,wBAAwBD;IACxB,wBAAwBA;IACxB,qBAAqBA;IACrB,sBAAsBA;IACtB,wBAAwBA;IAExB,mCAAmC;IACnC6B,SAAS1B;IAET,mBAAmBH;IACnB,iBAAiBA;IAEjB,uFAAuF;IACvF,kBAAkBG;IAClB,kDAAkD;IAClD,kBAAkBA;IAClB,2EAA2E;IAC3E,mBAAmBA;IACnB,+DAA+D;IAC/D,gBAAgBA;IAChB,4CAA4C;IAC5C,oBAAoBA;IAEpB,+DAA+D;IAC/D,kBAAkBA;IAElB,gFAAgF;IAChF,qBAAqBA;IACrB,gFAAgF;IAChF,oBAAoBA;IACpB,oBAAoBH;IAEpB,sCAAsC;IACtC,iBAAiBG;IACjB,sCAAsC;IACtC,iBAAiBA;IACjB,8CAA8C;IAC9C,eAAeA;IAEf,8FAA8F;IAC9F2B,UAAU3B;IAEV,qCAAqC;IACrC,gBAAgBA;IAChB,cAAcH;IAEd,sDAAsD;IACtD+B,UAAU5B;AACZ,EAAC"}

package/dist/exports/invokeSanityCli/commandPolicies/policy.js

@@ -0,0 +1,46 @@
+/**
+ * Per-source command policies for programmatic CLI invocation.
+ *
+ * A policy decides, for one invocation source (e.g. the remote MCP server),
+ * which commands may be invoked and — for conditional entries — which parsed
+ * invocations of those commands are acceptable. Policies are exhaustive:
+ * every command in this package's oclif manifest has exactly one entry, so a
+ * newly added CLI command cannot slip into (or ambiguously stay out of) the
+ * invokable surface. A unit test enforces this; at runtime an uncategorized
+ * command id fails closed (treated as deny).
+ */ /** The parsed command invocation a conditional policy is evaluated against. */ /** Every valid invocation of the command is safe. */ export const allow = {
+    kind: 'allow',
+    validate: ()=>true
+};
+/** No invocation of the command is safe. Behaves like an unknown command. */ export const deny = {
+    kind: 'deny',
+    validate: ()=>false
+};
+/**
+ * Conditional policies to deny flags. The flags are also hidden
+ * from rendered help, so hosts are never told about surface they cannot use.
+ */ export function conditionalDenyFlags(...names) {
+    return {
+        deniedFlags: names,
+        kind: 'conditional',
+        validate: ({ flags })=>names.every((name)=>flags[name] === undefined || flags[name] === false)
+    };
+}
+/**
+ * Conditional policy combining {@link conditionalDenyFlags} with an extra
+ * predicate on the parsed invocation, for conditions a flag name alone
+ * cannot express — e.g. flag values that would read from the host machine.
+ * `deniedFlags` are hidden from rendered help; the predicate is not
+ * expressible there, so flags it constrains stay advertised.
+ */ export function conditionalPolicy(options) {
+    const denyFlags = conditionalDenyFlags(...options.deniedFlags ?? []);
+    return {
+        ...denyFlags,
+        validate: (invocation)=>denyFlags.validate(invocation) && options.validate(invocation)
+    };
+}
+export function isConditionalInvocationPolicy(policy) {
+    return policy.kind === 'conditional';
+}
+
+//# sourceMappingURL=policy.js.map

package/dist/exports/invokeSanityCli/commandPolicies/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/policy.ts"],"sourcesContent":["/**\n * Per-source command policies for programmatic CLI invocation.\n *\n * A policy decides, for one invocation source (e.g. the remote MCP server),\n * which commands may be invoked and — for conditional entries — which parsed\n * invocations of those commands are acceptable. Policies are exhaustive:\n * every command in this package's oclif manifest has exactly one entry, so a\n * newly added CLI command cannot slip into (or ambiguously stay out of) the\n * invokable surface. A unit test enforces this; at runtime an uncategorized\n * command id fails closed (treated as deny).\n */\n\n/** The parsed command invocation a conditional policy is evaluated against. */\ninterface Invocation {\n  args: Readonly<Record<string, unknown>>\n  flags: Readonly<Record<string, unknown>>\n}\n\ntype InvocationPolicy = (invocation: Invocation) => boolean\n\ntype ConditionalInvocationPolicy = CommandPolicy & {\n  /**\n   * Flag names this policy refuses. Declarative so the help renderer can\n   * omit them (and examples using them) from the advertised command surface.\n   */\n  deniedFlags: readonly string[]\n\n  kind: 'conditional'\n}\n\nexport interface CommandPolicy {\n  kind: 'allow' | 'conditional' | 'deny'\n  validate: InvocationPolicy\n}\n\n/** Every valid invocation of the command is safe. */\nexport const allow: CommandPolicy = {kind: 'allow', validate: () => true}\n\n/** No invocation of the command is safe. Behaves like an unknown command. */\nexport const deny: CommandPolicy = {kind: 'deny', validate: () => false}\n\n/**\n * Conditional policies to deny flags. The flags are also hidden\n * from rendered help, so hosts are never told about surface they cannot use.\n */\nexport function conditionalDenyFlags(...names: string[]): ConditionalInvocationPolicy {\n  return {\n    deniedFlags: names,\n    kind: 'conditional',\n    validate: ({flags}) =>\n      names.every((name) => flags[name] === undefined || flags[name] === false),\n  }\n}\n\n/**\n * Conditional policy combining {@link conditionalDenyFlags} with an extra\n * predicate on the parsed invocation, for conditions a flag name alone\n * cannot express — e.g. flag values that would read from the host machine.\n * `deniedFlags` are hidden from rendered help; the predicate is not\n * expressible there, so flags it constrains stay advertised.\n */\nexport function conditionalPolicy(options: {\n  deniedFlags?: string[]\n  validate: InvocationPolicy\n}): ConditionalInvocationPolicy {\n  const denyFlags = conditionalDenyFlags(...(options.deniedFlags ?? []))\n  return {\n    ...denyFlags,\n    validate: (invocation) => denyFlags.validate(invocation) && options.validate(invocation),\n  }\n}\n\nexport function isConditionalInvocationPolicy(\n  policy: CommandPolicy,\n): policy is ConditionalInvocationPolicy {\n  return policy.kind === 'conditional'\n}\n\n/** A complete policy table, keyed by oclif command id. */\nexport type CommandPolicySet = Readonly<Record<string, CommandPolicy>>\n\n/** Where an invocation originates; selects the policy to enforce. */\nexport type InvocationSource = 'mcp'\n"],"names":["allow","kind","validate","deny","conditionalDenyFlags","names","deniedFlags","flags","every","name","undefined","conditionalPolicy","options","denyFlags","invocation","isConditionalInvocationPolicy","policy"],"mappings":"AAAA;;;;;;;;;;CAUC,GAED,6EAA6E,GAuB7E,mDAAmD,GACnD,OAAO,MAAMA,QAAuB;IAACC,MAAM;IAASC,UAAU,IAAM;AAAI,EAAC;AAEzE,2EAA2E,GAC3E,OAAO,MAAMC,OAAsB;IAACF,MAAM;IAAQC,UAAU,IAAM;AAAK,EAAC;AAExE;;;CAGC,GACD,OAAO,SAASE,qBAAqB,GAAGC,KAAe;IACrD,OAAO;QACLC,aAAaD;QACbJ,MAAM;QACNC,UAAU,CAAC,EAACK,KAAK,EAAC,GAChBF,MAAMG,KAAK,CAAC,CAACC,OAASF,KAAK,CAACE,KAAK,KAAKC,aAAaH,KAAK,CAACE,KAAK,KAAK;IACvE;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASE,kBAAkBC,OAGjC;IACC,MAAMC,YAAYT,wBAAyBQ,QAAQN,WAAW,IAAI,EAAE;IACpE,OAAO;QACL,GAAGO,SAAS;QACZX,UAAU,CAACY,aAAeD,UAAUX,QAAQ,CAACY,eAAeF,QAAQV,QAAQ,CAACY;IAC/E;AACF;AAEA,OAAO,SAASC,8BACdC,MAAqB;IAErB,OAAOA,OAAOf,IAAI,KAAK;AACzB"}

package/dist/exports/invokeSanityCli/help.js

@@ -0,0 +1,146 @@
+import { Help } from '@oclif/core';
+import { getHelpFlagAdditions } from '@oclif/core/help';
+import { isConditionalInvocationPolicy } from './commandPolicies/policy.js';
+/** Command ids a policy exposes: entries that are not denied. */ function visibleCommandIds(policySet) {
+    return new Set(Object.entries(policySet).filter(([, policy])=>policy.kind !== 'deny').map(([id])=>id));
+}
+/** Topic names covering the visible commands: every prefix of every id. */ function visibleTopicNames(commandIds) {
+    const names = new Set();
+    for (const id of commandIds){
+        const parts = id.split(':');
+        for(let length = 1; length < parts.length; length++){
+            names.add(parts.slice(0, length).join(':'));
+        }
+    }
+    return names;
+}
+/** Thrown when help is requested for a subject outside the policy surface. */ class NotInvokableError extends Error {
+}
+/**
+ * A copy of `command` without the policy's denied flags, and without examples
+ * that use them (under any spelling: `--web`, `--w`, `-w`), so rendered help
+ * only advertises invocations the policy accepts.
+ */ function withoutDeniedFlags(command, policy) {
+    if (!policy || !isConditionalInvocationPolicy(policy)) return {
+        ...command
+    };
+    const denied = policy.deniedFlags;
+    if (denied.length === 0) return {
+        ...command
+    };
+    const flags = {
+        ...command.flags
+    };
+    const spellings = [];
+    for (const name of denied){
+        const definition = flags[name];
+        if (!definition) continue;
+        spellings.push(`--${name}`);
+        if (definition.char) spellings.push(`-${definition.char}`);
+        for (const alias of definition.aliases ?? [])spellings.push(`--${alias}`, `-${alias}`);
+        delete flags[name];
+    }
+    const usesDeniedFlag = (example)=>{
+        const text = typeof example === 'string' ? example : example.command;
+        return spellings.some((spelling)=>new RegExp(String.raw`(^|\s)${spelling}(=|\s|$)`).test(text ?? ''));
+    };
+    return {
+        ...command,
+        examples: command.examples?.filter((example)=>!usesDeniedFlag(example)),
+        flags
+    };
+}
+/**
+ * oclif help renderer scoped to a policy's command surface. Subject
+ * resolution (root vs topic vs command help) is oclif's own; the policy is
+ * enforced at the rendering entry points so the rest of the CLI stays
+ * invisible to embedding hosts, and listings are filtered to non-denied
+ * commands and their topics only.
+ *
+ * Output is collected in {@link InvokableHelp.lines} instead of being written
+ * to the process streams.
+ */ class InvokableHelp extends Help {
+    lines = [];
+    commandIds;
+    policySet;
+    topicNames;
+    constructor(config, policySet){
+        super(config, {
+            stripAnsi: true
+        });
+        this.policySet = policySet;
+        this.commandIds = visibleCommandIds(policySet);
+        this.topicNames = visibleTopicNames(this.commandIds);
+    }
+    // The copies below are load-bearing: oclif's formatters rewrite ids/names
+    // in place (`cors:list` → `cors list`). Without copies those writes corrupt
+    // the shared (cached) config, breaking the policy checks on subsequent
+    // invocations.
+    get sortedCommands() {
+        return super.sortedCommands.filter((command)=>this.commandIds.has(command.id)).map((command)=>({
+                ...command
+            }));
+    }
+    get sortedTopics() {
+        // Topic names and descriptions come from the oclif config (oclif.config.js)
+        return super.sortedTopics.filter((topic)=>this.topicNames.has(topic.name)).map((topic)=>({
+                ...topic
+            }));
+    }
+    log(...args) {
+        this.lines.push(...args);
+    }
+    async showCommandHelp(command) {
+        if (!this.commandIds.has(command.id)) throw new NotInvokableError(command.id);
+        return super.showCommandHelp(withoutDeniedFlags(command, this.policySet[command.id]));
+    }
+    async showTopicHelp(topic) {
+        if (!this.topicNames.has(topic.name)) throw new NotInvokableError(topic.name);
+        return super.showTopicHelp({
+            ...topic
+        });
+    }
+}
+/**
+ * Render help text for a policy's command surface: root help for a bare help
+ * request, or topic/command help when `argv` names a subject (e.g.
+ * `['cors', '--help']`), exactly as oclif would resolve it. ANSI styling is
+ * stripped so programmatic callers get plain text.
+ *
+ * Returns `undefined` when the subject is unknown or denied — callers should
+ * respond the same way as for an unknown command, so hosts cannot probe the
+ * full CLI surface through help.
+ *
+ * @internal
+ */ export async function renderInvokableHelp(config, argv, policySet) {
+    const help = new InvokableHelp(config, policySet);
+    try {
+        await help.showHelp(argv);
+    } catch (err) {
+        // Subjects outside the policy surface (NotInvokableError) and subjects
+        // oclif itself cannot resolve (CLIError, marked with an `oclif` property)
+        // both yield no help output.
+        if (err instanceof NotInvokableError || err.oclif) return undefined;
+        throw err;
+    }
+    return help.lines.join('\n').trimEnd();
+}
+/**
+ * Whether `argv` asks for help rather than a command invocation: a leading
+ * `help` (oclif's help command), or a recognized help flag before any `--`
+ * terminator. The flags come from {@link getHelpFlagAdditions} — the same
+ * source oclif's own dispatch consults — so this surface recognizes exactly
+ * what the regular CLI recognizes.
+ *
+ * @internal
+ */ export function isHelpRequest(argv, config) {
+    if (argv[0] === 'help') return true;
+    const helpFlags = getHelpFlagAdditions(config);
+    for (const token of argv){
+        if (token === '--') return false;
+        if (helpFlags.includes(token)) return true;
+    }
+    return false;
+}
+
+//# sourceMappingURL=help.js.map

package/dist/exports/invokeSanityCli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/exports/invokeSanityCli/help.ts"],"sourcesContent":["import {type Command, type Config, Help, type Interfaces} from '@oclif/core'\nimport {getHelpFlagAdditions} from '@oclif/core/help'\n\nimport {\n  type CommandPolicy,\n  type CommandPolicySet,\n  isConditionalInvocationPolicy,\n} from './commandPolicies/policy.js'\n\n/** Command ids a policy exposes: entries that are not denied. */\nfunction visibleCommandIds(policySet: CommandPolicySet): Set<string> {\n  return new Set(\n    Object.entries(policySet)\n      .filter(([, policy]) => policy.kind !== 'deny')\n      .map(([id]) => id),\n  )\n}\n\n/** Topic names covering the visible commands: every prefix of every id. */\nfunction visibleTopicNames(commandIds: Set<string>): Set<string> {\n  const names = new Set<string>()\n  for (const id of commandIds) {\n    const parts = id.split(':')\n    for (let length = 1; length < parts.length; length++) {\n      names.add(parts.slice(0, length).join(':'))\n    }\n  }\n  return names\n}\n\n/** Thrown when help is requested for a subject outside the policy surface. */\nclass NotInvokableError extends Error {}\n\n/**\n * A copy of `command` without the policy's denied flags, and without examples\n * that use them (under any spelling: `--web`, `--w`, `-w`), so rendered help\n * only advertises invocations the policy accepts.\n */\nfunction withoutDeniedFlags(command: Command.Loadable, policy?: CommandPolicy): Command.Loadable {\n  if (!policy || !isConditionalInvocationPolicy(policy)) return {...command}\n\n  const denied = policy.deniedFlags\n  if (denied.length === 0) return {...command}\n\n  const flags = {...command.flags}\n  const spellings: string[] = []\n  for (const name of denied) {\n    const definition = flags[name]\n    if (!definition) continue\n    spellings.push(`--${name}`)\n    if (definition.char) spellings.push(`-${definition.char}`)\n    for (const alias of definition.aliases ?? []) spellings.push(`--${alias}`, `-${alias}`)\n    delete flags[name]\n  }\n\n  const usesDeniedFlag = (example: Command.Example) => {\n    const text = typeof example === 'string' ? example : example.command\n    return spellings.some((spelling) =>\n      new RegExp(String.raw`(^|\\s)${spelling}(=|\\s|$)`).test(text ?? ''),\n    )\n  }\n\n  return {\n    ...command,\n    examples: command.examples?.filter((example) => !usesDeniedFlag(example)),\n    flags,\n  }\n}\n\n/**\n * oclif help renderer scoped to a policy's command surface. Subject\n * resolution (root vs topic vs command help) is oclif's own; the policy is\n * enforced at the rendering entry points so the rest of the CLI stays\n * invisible to embedding hosts, and listings are filtered to non-denied\n * commands and their topics only.\n *\n * Output is collected in {@link InvokableHelp.lines} instead of being written\n * to the process streams.\n */\nclass InvokableHelp extends Help {\n  public readonly lines: string[] = []\n\n  private readonly commandIds: Set<string>\n  private readonly policySet: CommandPolicySet\n  private readonly topicNames: Set<string>\n\n  constructor(config: Config, policySet: CommandPolicySet) {\n    super(config, {stripAnsi: true})\n    this.policySet = policySet\n    this.commandIds = visibleCommandIds(policySet)\n    this.topicNames = visibleTopicNames(this.commandIds)\n  }\n\n  // The copies below are load-bearing: oclif's formatters rewrite ids/names\n  // in place (`cors:list` → `cors list`). Without copies those writes corrupt\n  // the shared (cached) config, breaking the policy checks on subsequent\n  // invocations.\n\n  protected override get sortedCommands(): Command.Loadable[] {\n    return super.sortedCommands\n      .filter((command) => this.commandIds.has(command.id))\n      .map((command) => ({...command}))\n  }\n\n  protected override get sortedTopics(): Interfaces.Topic[] {\n    // Topic names and descriptions come from the oclif config (oclif.config.js)\n    return super.sortedTopics\n      .filter((topic) => this.topicNames.has(topic.name))\n      .map((topic) => ({...topic}))\n  }\n\n  protected override log(...args: string[]): void {\n    this.lines.push(...args)\n  }\n\n  public override async showCommandHelp(command: Command.Loadable): Promise<void> {\n    if (!this.commandIds.has(command.id)) throw new NotInvokableError(command.id)\n    return super.showCommandHelp(withoutDeniedFlags(command, this.policySet[command.id]))\n  }\n\n  protected override async showTopicHelp(topic: Interfaces.Topic): Promise<void> {\n    if (!this.topicNames.has(topic.name)) throw new NotInvokableError(topic.name)\n    return super.showTopicHelp({...topic})\n  }\n}\n\n/**\n * Render help text for a policy's command surface: root help for a bare help\n * request, or topic/command help when `argv` names a subject (e.g.\n * `['cors', '--help']`), exactly as oclif would resolve it. ANSI styling is\n * stripped so programmatic callers get plain text.\n *\n * Returns `undefined` when the subject is unknown or denied — callers should\n * respond the same way as for an unknown command, so hosts cannot probe the\n * full CLI surface through help.\n *\n * @internal\n */\nexport async function renderInvokableHelp(\n  config: Config,\n  argv: string[],\n  policySet: CommandPolicySet,\n): Promise<string | undefined> {\n  const help = new InvokableHelp(config, policySet)\n  try {\n    await help.showHelp(argv)\n  } catch (err) {\n    // Subjects outside the policy surface (NotInvokableError) and subjects\n    // oclif itself cannot resolve (CLIError, marked with an `oclif` property)\n    // both yield no help output.\n    if (err instanceof NotInvokableError || err.oclif) return undefined\n    throw err\n  }\n  return help.lines.join('\\n').trimEnd()\n}\n\n/**\n * Whether `argv` asks for help rather than a command invocation: a leading\n * `help` (oclif's help command), or a recognized help flag before any `--`\n * terminator. The flags come from {@link getHelpFlagAdditions} — the same\n * source oclif's own dispatch consults — so this surface recognizes exactly\n * what the regular CLI recognizes.\n *\n * @internal\n */\nexport function isHelpRequest(argv: string[], config: Config): boolean {\n  if (argv[0] === 'help') return true\n  const helpFlags = getHelpFlagAdditions(config)\n  for (const token of argv) {\n    if (token === '--') return false\n    if (helpFlags.includes(token)) return true\n  }\n  return false\n}\n"],"names":["Help","getHelpFlagAdditions","isConditionalInvocationPolicy","visibleCommandIds","policySet","Set","Object","entries","filter","policy","kind","map","id","visibleTopicNames","commandIds","names","parts","split","length","add","slice","join","NotInvokableError","Error","withoutDeniedFlags","command","denied","deniedFlags","flags","spellings","name","definition","push","char","alias","aliases","usesDeniedFlag","example","text","some","spelling","RegExp","String","raw","test","examples","InvokableHelp","lines","topicNames","config","stripAnsi","sortedCommands","has","sortedTopics","topic","log","args","showCommandHelp","showTopicHelp","renderInvokableHelp","argv","help","showHelp","err","oclif","undefined","trimEnd","isHelpRequest","helpFlags","token","includes"],"mappings":"AAAA,SAAmCA,IAAI,QAAwB,cAAa;AAC5E,SAAQC,oBAAoB,QAAO,mBAAkB;AAErD,SAGEC,6BAA6B,QACxB,8BAA6B;AAEpC,+DAA+D,GAC/D,SAASC,kBAAkBC,SAA2B;IACpD,OAAO,IAAIC,IACTC,OAAOC,OAAO,CAACH,WACZI,MAAM,CAAC,CAAC,GAAGC,OAAO,GAAKA,OAAOC,IAAI,KAAK,QACvCC,GAAG,CAAC,CAAC,CAACC,GAAG,GAAKA;AAErB;AAEA,yEAAyE,GACzE,SAASC,kBAAkBC,UAAuB;IAChD,MAAMC,QAAQ,IAAIV;IAClB,KAAK,MAAMO,MAAME,WAAY;QAC3B,MAAME,QAAQJ,GAAGK,KAAK,CAAC;QACvB,IAAK,IAAIC,SAAS,GAAGA,SAASF,MAAME,MAAM,EAAEA,SAAU;YACpDH,MAAMI,GAAG,CAACH,MAAMI,KAAK,CAAC,GAAGF,QAAQG,IAAI,CAAC;QACxC;IACF;IACA,OAAON;AACT;AAEA,4EAA4E,GAC5E,MAAMO,0BAA0BC;AAAO;AAEvC;;;;CAIC,GACD,SAASC,mBAAmBC,OAAyB,EAAEhB,MAAsB;IAC3E,IAAI,CAACA,UAAU,CAACP,8BAA8BO,SAAS,OAAO;QAAC,GAAGgB,OAAO;IAAA;IAEzE,MAAMC,SAASjB,OAAOkB,WAAW;IACjC,IAAID,OAAOR,MAAM,KAAK,GAAG,OAAO;QAAC,GAAGO,OAAO;IAAA;IAE3C,MAAMG,QAAQ;QAAC,GAAGH,QAAQG,KAAK;IAAA;IAC/B,MAAMC,YAAsB,EAAE;IAC9B,KAAK,MAAMC,QAAQJ,OAAQ;QACzB,MAAMK,aAAaH,KAAK,CAACE,KAAK;QAC9B,IAAI,CAACC,YAAY;QACjBF,UAAUG,IAAI,CAAC,CAAC,EAAE,EAAEF,MAAM;QAC1B,IAAIC,WAAWE,IAAI,EAAEJ,UAAUG,IAAI,CAAC,CAAC,CAAC,EAAED,WAAWE,IAAI,EAAE;QACzD,KAAK,MAAMC,SAASH,WAAWI,OAAO,IAAI,EAAE,CAAEN,UAAUG,IAAI,CAAC,CAAC,EAAE,EAAEE,OAAO,EAAE,CAAC,CAAC,EAAEA,OAAO;QACtF,OAAON,KAAK,CAACE,KAAK;IACpB;IAEA,MAAMM,iBAAiB,CAACC;QACtB,MAAMC,OAAO,OAAOD,YAAY,WAAWA,UAAUA,QAAQZ,OAAO;QACpE,OAAOI,UAAUU,IAAI,CAAC,CAACC,WACrB,IAAIC,OAAOC,OAAOC,GAAG,CAAC,MAAM,EAAEH,SAAS,QAAQ,CAAC,EAAEI,IAAI,CAACN,QAAQ;IAEnE;IAEA,OAAO;QACL,GAAGb,OAAO;QACVoB,UAAUpB,QAAQoB,QAAQ,EAAErC,OAAO,CAAC6B,UAAY,CAACD,eAAeC;QAChET;IACF;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMkB,sBAAsB9C;IACV+C,QAAkB,EAAE,CAAA;IAEnBjC,WAAuB;IACvBV,UAA2B;IAC3B4C,WAAuB;IAExC,YAAYC,MAAc,EAAE7C,SAA2B,CAAE;QACvD,KAAK,CAAC6C,QAAQ;YAACC,WAAW;QAAI;QAC9B,IAAI,CAAC9C,SAAS,GAAGA;QACjB,IAAI,CAACU,UAAU,GAAGX,kBAAkBC;QACpC,IAAI,CAAC4C,UAAU,GAAGnC,kBAAkB,IAAI,CAACC,UAAU;IACrD;IAEA,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,eAAe;IAEf,IAAuBqC,iBAAqC;QAC1D,OAAO,KAAK,CAACA,eACV3C,MAAM,CAAC,CAACiB,UAAY,IAAI,CAACX,UAAU,CAACsC,GAAG,CAAC3B,QAAQb,EAAE,GAClDD,GAAG,CAAC,CAACc,UAAa,CAAA;gBAAC,GAAGA,OAAO;YAAA,CAAA;IAClC;IAEA,IAAuB4B,eAAmC;QACxD,4EAA4E;QAC5E,OAAO,KAAK,CAACA,aACV7C,MAAM,CAAC,CAAC8C,QAAU,IAAI,CAACN,UAAU,CAACI,GAAG,CAACE,MAAMxB,IAAI,GAChDnB,GAAG,CAAC,CAAC2C,QAAW,CAAA;gBAAC,GAAGA,KAAK;YAAA,CAAA;IAC9B;IAEmBC,IAAI,GAAGC,IAAc,EAAQ;QAC9C,IAAI,CAACT,KAAK,CAACf,IAAI,IAAIwB;IACrB;IAEA,MAAsBC,gBAAgBhC,OAAyB,EAAiB;QAC9E,IAAI,CAAC,IAAI,CAACX,UAAU,CAACsC,GAAG,CAAC3B,QAAQb,EAAE,GAAG,MAAM,IAAIU,kBAAkBG,QAAQb,EAAE;QAC5E,OAAO,KAAK,CAAC6C,gBAAgBjC,mBAAmBC,SAAS,IAAI,CAACrB,SAAS,CAACqB,QAAQb,EAAE,CAAC;IACrF;IAEA,MAAyB8C,cAAcJ,KAAuB,EAAiB;QAC7E,IAAI,CAAC,IAAI,CAACN,UAAU,CAACI,GAAG,CAACE,MAAMxB,IAAI,GAAG,MAAM,IAAIR,kBAAkBgC,MAAMxB,IAAI;QAC5E,OAAO,KAAK,CAAC4B,cAAc;YAAC,GAAGJ,KAAK;QAAA;IACtC;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeK,oBACpBV,MAAc,EACdW,IAAc,EACdxD,SAA2B;IAE3B,MAAMyD,OAAO,IAAIf,cAAcG,QAAQ7C;IACvC,IAAI;QACF,MAAMyD,KAAKC,QAAQ,CAACF;IACtB,EAAE,OAAOG,KAAK;QACZ,uEAAuE;QACvE,0EAA0E;QAC1E,6BAA6B;QAC7B,IAAIA,eAAezC,qBAAqByC,IAAIC,KAAK,EAAE,OAAOC;QAC1D,MAAMF;IACR;IACA,OAAOF,KAAKd,KAAK,CAAC1B,IAAI,CAAC,MAAM6C,OAAO;AACtC;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,cAAcP,IAAc,EAAEX,MAAc;IAC1D,IAAIW,IAAI,CAAC,EAAE,KAAK,QAAQ,OAAO;IAC/B,MAAMQ,YAAYnE,qBAAqBgD;IACvC,KAAK,MAAMoB,SAAST,KAAM;QACxB,IAAIS,UAAU,MAAM,OAAO;QAC3B,IAAID,UAAUE,QAAQ,CAACD,QAAQ,OAAO;IACxC;IACA,OAAO;AACT"}

package/dist/exports/invokeSanityCli/index.d.ts

@@ -0,0 +1,60 @@
+import { Config } from "@oclif/core";
+
+/** Where an invocation originates; selects the policy to enforce. */
+declare type InvocationSource = "mcp";
+
+/**
+ * Run a policy-permitted CLI command in-process and capture its result.
+ *
+ * Command-level failures (unknown command, bad flags, API errors) are
+ * reported through `exitCode`/`output` rather than thrown, so callers can
+ * relay them verbatim.
+ *
+ * @internal
+ */
+export declare function invokeSanityCli({
+  args,
+  config,
+  source,
+  token,
+}: InvokeSanityCliOptions): Promise<InvokeSanityCliResult>;
+
+/**
+ * @internal
+ */
+export declare interface InvokeSanityCliOptions {
+  /**
+   * Arguments after `sanity` (a leading `sanity` token is tolerated), either
+   * as a single string — shell-style quoting is supported, but no shell is
+   * ever executed — or as a pre-split argv array.
+   */
+  args: string | string[];
+  /**
+   * Where this invocation originates. Selects the command policy to enforce:
+   * which commands are invokable and which invocations of them are permitted.
+   */
+  source: InvocationSource;
+  /**
+   * Auth token for this invocation. Scoped to this call via the CLI execution
+   * context: it never touches process env or the process-wide token cache, so
+   * concurrent invocations with different tokens are fully isolated.
+   */
+  token: string;
+  /**
+   * Optional oclif config override (mainly for tests). Defaults to this
+   * package's config, loaded once and cached across invocations.
+   */
+  config?: Config;
+}
+
+/**
+ * @internal
+ */
+export declare interface InvokeSanityCliResult {
+  /** `0` on success, the command's exit code otherwise. */
+  exitCode: number;
+  /** Combined stdout and stderr output, in emission order. */
+  output: string;
+}
+
+export {};