@sanity/cli 7.13.0 → 7.14.0

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js

@@ -0,0 +1,167 @@
+import { allow, conditionalDenyFlags, conditionalPolicy, deny } from './policy.js';
+/**
+ * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command
+ * read the host's filesystem or stdin (raw `-f` fields are always verbatim).
+ */ function fieldReadsFromHost(field) {
+    if (typeof field !== 'string') return false;
+    const separatorIndex = field.indexOf('=');
+    return separatorIndex > 0 && field[separatorIndex + 1] === '@';
+}
+/**
+ * MCP programmatic mode disables local project/config discovery (see the CLI
+ * execution context). Missing project or dataset values may therefore produce
+ * a usage error, but cannot cause local filesystem access. Destructive remote
+ * operations are allowed and do not by themselves make a command unsafe.
+ *
+ * Every manifest command must have exactly one policy here:
+ * - allow: every valid invocation is safe
+ * - conditional: safety depends on parsed arguments or flags
+ * - deny: no invocation is safe
+ */ export const mcpPolicy = {
+    // Special exception, this can be very dangerous but is also super useful
+    // to expose. Only the host input channels are refused: `--input` reads the
+    // request body from the host's filesystem or stdin, and `-F key=@<file>` /
+    // `-F key=@-` field values do the same.
+    api: conditionalPolicy({
+        deniedFlags: [
+            'input'
+        ],
+        validate: ({ flags })=>!Array.isArray(flags.field) || !flags.field.some((field)=>fieldReadsFromHost(field))
+    }),
+    'backups:disable': allow,
+    // Writes a downloaded backup to the local filesystem.
+    'backups:download': deny,
+    'backups:enable': allow,
+    'backups:list': allow,
+    // Requires a local Studio project and writes build output to disk.
+    build: deny,
+    // Reads and rewrites local source code.
+    codemod: deny,
+    'cors:add': allow,
+    'cors:delete': allow,
+    'cors:list': allow,
+    'datasets:alias:create': allow,
+    'datasets:alias:delete': allow,
+    'datasets:alias:link': allow,
+    'datasets:alias:unlink': allow,
+    'datasets:copy': allow,
+    'datasets:create': allow,
+    'datasets:delete': allow,
+    'datasets:embeddings:disable': allow,
+    'datasets:embeddings:enable': allow,
+    'datasets:embeddings:status': allow,
+    // Writes dataset contents and assets to the local filesystem.
+    'datasets:export': deny,
+    // Reads import data from the local filesystem and may replace documents.
+    'datasets:import': deny,
+    'datasets:list': allow,
+    'datasets:visibility:get': allow,
+    'datasets:visibility:set': allow,
+    // Inspects local project files and can print authentication secrets.
+    debug: deny,
+    // Reads, builds, and deploys a local Studio project.
+    deploy: deny,
+    // Loads a local Studio project and starts a development server.
+    dev: deny,
+    // Opens a browser on the machine running the MCP server.
+    'docs:browse': deny,
+    // --web opens a browser on the machine running the MCP server.
+    'docs:read': conditionalDenyFlags('web'),
+    'docs:search': allow,
+    // Reads and executes local project configuration for diagnostics.
+    doctor: deny,
+    // Reads document input from disk or launches a local editor.
+    'documents:create': deny,
+    'documents:delete': allow,
+    'documents:get': allow,
+    'documents:query': allow,
+    // Loads a local Studio schema to validate documents.
+    'documents:validate': deny,
+    // Executes arbitrary code in the local Studio context.
+    exec: deny,
+    // Loads a local schema and deploys a GraphQL API.
+    'graphql:deploy': deny,
+    'graphql:list': allow,
+    // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.
+    'graphql:undeploy': conditionalDenyFlags('api'),
+    'hooks:attempt': allow,
+    'hooks:create': allow,
+    'hooks:delete': allow,
+    'hooks:list': allow,
+    'hooks:logs': allow,
+    // Creates or modifies a local project and may install dependencies.
+    init: deny,
+    // Installs packages into the local project.
+    install: deny,
+    // Opens a browser on the machine running the MCP server.
+    learn: deny,
+    // Performs an authentication flow.
+    login: deny,
+    // Performs an authentication operation and clears local credentials.
+    logout: deny,
+    // Reads local project configuration and opens a browser.
+    manage: deny,
+    // Loads local Studio configuration and writes manifest files.
+    'manifest:extract': deny,
+    // Reads and writes local MCP client configuration.
+    'mcp:configure': deny,
+    // Writes an aspect definition to the local filesystem.
+    'media:create-aspect': deny,
+    'media:delete-aspect': allow,
+    // Reads a local aspect definition before deploying it.
+    'media:deploy-aspect': deny,
+    // Writes media assets to the local filesystem.
+    'media:export': deny,
+    // Reads media assets from the local filesystem.
+    'media:import': deny,
+    // Creates migration source files in the local project.
+    'migrations:create': deny,
+    // Reads and loads migration definitions from the local project.
+    'migrations:list': deny,
+    // Executes local migration code that may perform arbitrary document mutations.
+    'migrations:run': deny,
+    // --web opens a browser on the machine running the MCP server.
+    'openapi:get': conditionalDenyFlags('web'),
+    'openapi:list': conditionalDenyFlags('web'),
+    'organizations:create': allow,
+    'organizations:delete': allow,
+    'organizations:get': allow,
+    'organizations:list': allow,
+    'organizations:update': allow,
+    // Serves a local production build.
+    preview: deny,
+    'projects:create': allow,
+    'projects:list': allow,
+    // Loads the local Studio configuration to resolve the datasets containing each schema.
+    'schemas:delete': deny,
+    // Loads local schema files before deploying them.
+    'schemas:deploy': deny,
+    // Loads local Studio configuration and writes an extracted schema to disk.
+    'schemas:extract': deny,
+    // Requires a local project and loads its schema configuration.
+    'schemas:list': deny,
+    // Loads and executes a local Studio schema.
+    'schemas:validate': deny,
+    // Installs skills into local editor configuration directories.
+    'skills:install': deny,
+    // Changes account telemetry preferences and mutates local cached configuration.
+    'telemetry:disable': deny,
+    // Changes account telemetry preferences and mutates local cached configuration.
+    'telemetry:enable': deny,
+    'telemetry:status': allow,
+    // Creates authentication credentials.
+    'tokens:create': deny,
+    // Deletes authentication credentials.
+    'tokens:delete': deny,
+    // Exposes authentication credential metadata.
+    'tokens:list': deny,
+    // Loads local CLI and workbench configuration to identify the deployed Studio or application.
+    undeploy: deny,
+    // Grants a user access to a project.
+    'users:invite': deny,
+    'users:list': allow,
+    // Reads the local project and installed package tree.
+    versions: deny
+};
+
+//# sourceMappingURL=mcpPolicy.js.map

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/mcpPolicy.ts"],"sourcesContent":["import {\n  allow,\n  type CommandPolicySet,\n  conditionalDenyFlags,\n  conditionalPolicy,\n  deny,\n} from './policy.js'\n\n/**\n * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command\n * read the host's filesystem or stdin (raw `-f` fields are always verbatim).\n */\nfunction fieldReadsFromHost(field: unknown): boolean {\n  if (typeof field !== 'string') return false\n  const separatorIndex = field.indexOf('=')\n  return separatorIndex > 0 && field[separatorIndex + 1] === '@'\n}\n\n/**\n * MCP programmatic mode disables local project/config discovery (see the CLI\n * execution context). Missing project or dataset values may therefore produce\n * a usage error, but cannot cause local filesystem access. Destructive remote\n * operations are allowed and do not by themselves make a command unsafe.\n *\n * Every manifest command must have exactly one policy here:\n * - allow: every valid invocation is safe\n * - conditional: safety depends on parsed arguments or flags\n * - deny: no invocation is safe\n */\nexport const mcpPolicy: CommandPolicySet = {\n  // Special exception, this can be very dangerous but is also super useful\n  // to expose. Only the host input channels are refused: `--input` reads the\n  // request body from the host's filesystem or stdin, and `-F key=@<file>` /\n  // `-F key=@-` field values do the same.\n  api: conditionalPolicy({\n    deniedFlags: ['input'],\n    validate: ({flags}) =>\n      !Array.isArray(flags.field) || !flags.field.some((field) => fieldReadsFromHost(field)),\n  }),\n\n  'backups:disable': allow,\n  // Writes a downloaded backup to the local filesystem.\n  'backups:download': deny,\n  'backups:enable': allow,\n  'backups:list': allow,\n\n  // Requires a local Studio project and writes build output to disk.\n  build: deny,\n\n  // Reads and rewrites local source code.\n  codemod: deny,\n\n  'cors:add': allow,\n  'cors:delete': allow,\n  'cors:list': allow,\n\n  'datasets:alias:create': allow,\n  'datasets:alias:delete': allow,\n  'datasets:alias:link': allow,\n  'datasets:alias:unlink': allow,\n  'datasets:copy': allow,\n  'datasets:create': allow,\n  'datasets:delete': allow,\n  'datasets:embeddings:disable': allow,\n  'datasets:embeddings:enable': allow,\n  'datasets:embeddings:status': allow,\n  // Writes dataset contents and assets to the local filesystem.\n  'datasets:export': deny,\n  // Reads import data from the local filesystem and may replace documents.\n  'datasets:import': deny,\n  'datasets:list': allow,\n  'datasets:visibility:get': allow,\n  'datasets:visibility:set': allow,\n\n  // Inspects local project files and can print authentication secrets.\n  debug: deny,\n\n  // Reads, builds, and deploys a local Studio project.\n  deploy: deny,\n\n  // Loads a local Studio project and starts a development server.\n  dev: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  'docs:browse': deny,\n  // --web opens a browser on the machine running the MCP server.\n  'docs:read': conditionalDenyFlags('web'),\n  'docs:search': allow,\n\n  // Reads and executes local project configuration for diagnostics.\n  doctor: deny,\n\n  // Reads document input from disk or launches a local editor.\n  'documents:create': deny,\n  'documents:delete': allow,\n  'documents:get': allow,\n  'documents:query': allow,\n  // Loads a local Studio schema to validate documents.\n  'documents:validate': deny,\n\n  // Executes arbitrary code in the local Studio context.\n  exec: deny,\n\n  // Loads a local schema and deploys a GraphQL API.\n  'graphql:deploy': deny,\n  'graphql:list': allow,\n  // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.\n  'graphql:undeploy': conditionalDenyFlags('api'),\n\n  'hooks:attempt': allow,\n  'hooks:create': allow,\n  'hooks:delete': allow,\n  'hooks:list': allow,\n  'hooks:logs': allow,\n\n  // Creates or modifies a local project and may install dependencies.\n  init: deny,\n\n  // Installs packages into the local project.\n  install: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  learn: deny,\n\n  // Performs an authentication flow.\n  login: deny,\n\n  // Performs an authentication operation and clears local credentials.\n  logout: deny,\n\n  // Reads local project configuration and opens a browser.\n  manage: deny,\n\n  // Loads local Studio configuration and writes manifest files.\n  'manifest:extract': deny,\n\n  // Reads and writes local MCP client configuration.\n  'mcp:configure': deny,\n\n  // Writes an aspect definition to the local filesystem.\n  'media:create-aspect': deny,\n  'media:delete-aspect': allow,\n  // Reads a local aspect definition before deploying it.\n  'media:deploy-aspect': deny,\n  // Writes media assets to the local filesystem.\n  'media:export': deny,\n  // Reads media assets from the local filesystem.\n  'media:import': deny,\n\n  // Creates migration source files in the local project.\n  'migrations:create': deny,\n  // Reads and loads migration definitions from the local project.\n  'migrations:list': deny,\n  // Executes local migration code that may perform arbitrary document mutations.\n  'migrations:run': deny,\n\n  // --web opens a browser on the machine running the MCP server.\n  'openapi:get': conditionalDenyFlags('web'),\n  'openapi:list': conditionalDenyFlags('web'),\n\n  'organizations:create': allow,\n  'organizations:delete': allow,\n  'organizations:get': allow,\n  'organizations:list': allow,\n  'organizations:update': allow,\n\n  // Serves a local production build.\n  preview: deny,\n\n  'projects:create': allow,\n  'projects:list': allow,\n\n  // Loads the local Studio configuration to resolve the datasets containing each schema.\n  'schemas:delete': deny,\n  // Loads local schema files before deploying them.\n  'schemas:deploy': deny,\n  // Loads local Studio configuration and writes an extracted schema to disk.\n  'schemas:extract': deny,\n  // Requires a local project and loads its schema configuration.\n  'schemas:list': deny,\n  // Loads and executes a local Studio schema.\n  'schemas:validate': deny,\n\n  // Installs skills into local editor configuration directories.\n  'skills:install': deny,\n\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:disable': deny,\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:enable': deny,\n  'telemetry:status': allow,\n\n  // Creates authentication credentials.\n  'tokens:create': deny,\n  // Deletes authentication credentials.\n  'tokens:delete': deny,\n  // Exposes authentication credential metadata.\n  'tokens:list': deny,\n\n  // Loads local CLI and workbench configuration to identify the deployed Studio or application.\n  undeploy: deny,\n\n  // Grants a user access to a project.\n  'users:invite': deny,\n  'users:list': allow,\n\n  // Reads the local project and installed package tree.\n  versions: deny,\n}\n"],"names":["allow","conditionalDenyFlags","conditionalPolicy","deny","fieldReadsFromHost","field","separatorIndex","indexOf","mcpPolicy","api","deniedFlags","validate","flags","Array","isArray","some","build","codemod","debug","deploy","dev","doctor","exec","init","install","learn","login","logout","manage","preview","undeploy","versions"],"mappings":"AAAA,SACEA,KAAK,EAELC,oBAAoB,EACpBC,iBAAiB,EACjBC,IAAI,QACC,cAAa;AAEpB;;;CAGC,GACD,SAASC,mBAAmBC,KAAc;IACxC,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMC,iBAAiBD,MAAME,OAAO,CAAC;IACrC,OAAOD,iBAAiB,KAAKD,KAAK,CAACC,iBAAiB,EAAE,KAAK;AAC7D;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAME,YAA8B;IACzC,yEAAyE;IACzE,2EAA2E;IAC3E,2EAA2E;IAC3E,wCAAwC;IACxCC,KAAKP,kBAAkB;QACrBQ,aAAa;YAAC;SAAQ;QACtBC,UAAU,CAAC,EAACC,KAAK,EAAC,GAChB,CAACC,MAAMC,OAAO,CAACF,MAAMP,KAAK,KAAK,CAACO,MAAMP,KAAK,CAACU,IAAI,CAAC,CAACV,QAAUD,mBAAmBC;IACnF;IAEA,mBAAmBL;IACnB,sDAAsD;IACtD,oBAAoBG;IACpB,kBAAkBH;IAClB,gBAAgBA;IAEhB,mEAAmE;IACnEgB,OAAOb;IAEP,wCAAwC;IACxCc,SAASd;IAET,YAAYH;IACZ,eAAeA;IACf,aAAaA;IAEb,yBAAyBA;IACzB,yBAAyBA;IACzB,uBAAuBA;IACvB,yBAAyBA;IACzB,iBAAiBA;IACjB,mBAAmBA;IACnB,mBAAmBA;IACnB,+BAA+BA;IAC/B,8BAA8BA;IAC9B,8BAA8BA;IAC9B,8DAA8D;IAC9D,mBAAmBG;IACnB,yEAAyE;IACzE,mBAAmBA;IACnB,iBAAiBH;IACjB,2BAA2BA;IAC3B,2BAA2BA;IAE3B,qEAAqE;IACrEkB,OAAOf;IAEP,qDAAqD;IACrDgB,QAAQhB;IAER,gEAAgE;IAChEiB,KAAKjB;IAEL,yDAAyD;IACzD,eAAeA;IACf,+DAA+D;IAC/D,aAAaF,qBAAqB;IAClC,eAAeD;IAEf,kEAAkE;IAClEqB,QAAQlB;IAER,6DAA6D;IAC7D,oBAAoBA;IACpB,oBAAoBH;IACpB,iBAAiBA;IACjB,mBAAmBA;IACnB,qDAAqD;IACrD,sBAAsBG;IAEtB,uDAAuD;IACvDmB,MAAMnB;IAEN,kDAAkD;IAClD,kBAAkBA;IAClB,gBAAgBH;IAChB,mGAAmG;IACnG,oBAAoBC,qBAAqB;IAEzC,iBAAiBD;IACjB,gBAAgBA;IAChB,gBAAgBA;IAChB,cAAcA;IACd,cAAcA;IAEd,oEAAoE;IACpEuB,MAAMpB;IAEN,4CAA4C;IAC5CqB,SAASrB;IAET,yDAAyD;IACzDsB,OAAOtB;IAEP,mCAAmC;IACnCuB,OAAOvB;IAEP,qEAAqE;IACrEwB,QAAQxB;IAER,yDAAyD;IACzDyB,QAAQzB;IAER,8DAA8D;IAC9D,oBAAoBA;IAEpB,mDAAmD;IACnD,iBAAiBA;IAEjB,uDAAuD;IACvD,uBAAuBA;IACvB,uBAAuBH;IACvB,uDAAuD;IACvD,uBAAuBG;IACvB,+CAA+C;IAC/C,gBAAgBA;IAChB,gDAAgD;IAChD,gBAAgBA;IAEhB,uDAAuD;IACvD,qBAAqBA;IACrB,gEAAgE;IAChE,mBAAmBA;IACnB,+EAA+E;IAC/E,kBAAkBA;IAElB,+DAA+D;IAC/D,eAAeF,qBAAqB;IACpC,gBAAgBA,qBAAqB;IAErC,wBAAwBD;IACxB,wBAAwBA;IACxB,qBAAqBA;IACrB,sBAAsBA;IACtB,wBAAwBA;IAExB,mCAAmC;IACnC6B,SAAS1B;IAET,mBAAmBH;IACnB,iBAAiBA;IAEjB,uFAAuF;IACvF,kBAAkBG;IAClB,kDAAkD;IAClD,kBAAkBA;IAClB,2EAA2E;IAC3E,mBAAmBA;IACnB,+DAA+D;IAC/D,gBAAgBA;IAChB,4CAA4C;IAC5C,oBAAoBA;IAEpB,+DAA+D;IAC/D,kBAAkBA;IAElB,gFAAgF;IAChF,qBAAqBA;IACrB,gFAAgF;IAChF,oBAAoBA;IACpB,oBAAoBH;IAEpB,sCAAsC;IACtC,iBAAiBG;IACjB,sCAAsC;IACtC,iBAAiBA;IACjB,8CAA8C;IAC9C,eAAeA;IAEf,8FAA8F;IAC9F2B,UAAU3B;IAEV,qCAAqC;IACrC,gBAAgBA;IAChB,cAAcH;IAEd,sDAAsD;IACtD+B,UAAU5B;AACZ,EAAC"}

package/dist/exports/invokeSanityCli/commandPolicies/policy.js

@@ -0,0 +1,46 @@
+/**
+ * Per-source command policies for programmatic CLI invocation.
+ *
+ * A policy decides, for one invocation source (e.g. the remote MCP server),
+ * which commands may be invoked and — for conditional entries — which parsed
+ * invocations of those commands are acceptable. Policies are exhaustive:
+ * every command in this package's oclif manifest has exactly one entry, so a
+ * newly added CLI command cannot slip into (or ambiguously stay out of) the
+ * invokable surface. A unit test enforces this; at runtime an uncategorized
+ * command id fails closed (treated as deny).
+ */ /** The parsed command invocation a conditional policy is evaluated against. */ /** Every valid invocation of the command is safe. */ export const allow = {
+    kind: 'allow',
+    validate: ()=>true
+};
+/** No invocation of the command is safe. Behaves like an unknown command. */ export const deny = {
+    kind: 'deny',
+    validate: ()=>false
+};
+/**
+ * Conditional policies to deny flags. The flags are also hidden
+ * from rendered help, so hosts are never told about surface they cannot use.
+ */ export function conditionalDenyFlags(...names) {
+    return {
+        deniedFlags: names,
+        kind: 'conditional',
+        validate: ({ flags })=>names.every((name)=>flags[name] === undefined || flags[name] === false)
+    };
+}
+/**
+ * Conditional policy combining {@link conditionalDenyFlags} with an extra
+ * predicate on the parsed invocation, for conditions a flag name alone
+ * cannot express — e.g. flag values that would read from the host machine.
+ * `deniedFlags` are hidden from rendered help; the predicate is not
+ * expressible there, so flags it constrains stay advertised.
+ */ export function conditionalPolicy(options) {
+    const denyFlags = conditionalDenyFlags(...options.deniedFlags ?? []);
+    return {
+        ...denyFlags,
+        validate: (invocation)=>denyFlags.validate(invocation) && options.validate(invocation)
+    };
+}
+export function isConditionalInvocationPolicy(policy) {
+    return policy.kind === 'conditional';
+}
+
+//# sourceMappingURL=policy.js.map

package/dist/exports/invokeSanityCli/commandPolicies/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/policy.ts"],"sourcesContent":["/**\n * Per-source command policies for programmatic CLI invocation.\n *\n * A policy decides, for one invocation source (e.g. the remote MCP server),\n * which commands may be invoked and — for conditional entries — which parsed\n * invocations of those commands are acceptable. Policies are exhaustive:\n * every command in this package's oclif manifest has exactly one entry, so a\n * newly added CLI command cannot slip into (or ambiguously stay out of) the\n * invokable surface. A unit test enforces this; at runtime an uncategorized\n * command id fails closed (treated as deny).\n */\n\n/** The parsed command invocation a conditional policy is evaluated against. */\ninterface Invocation {\n  args: Readonly<Record<string, unknown>>\n  flags: Readonly<Record<string, unknown>>\n}\n\ntype InvocationPolicy = (invocation: Invocation) => boolean\n\ntype ConditionalInvocationPolicy = CommandPolicy & {\n  /**\n   * Flag names this policy refuses. Declarative so the help renderer can\n   * omit them (and examples using them) from the advertised command surface.\n   */\n  deniedFlags: readonly string[]\n\n  kind: 'conditional'\n}\n\nexport interface CommandPolicy {\n  kind: 'allow' | 'conditional' | 'deny'\n  validate: InvocationPolicy\n}\n\n/** Every valid invocation of the command is safe. */\nexport const allow: CommandPolicy = {kind: 'allow', validate: () => true}\n\n/** No invocation of the command is safe. Behaves like an unknown command. */\nexport const deny: CommandPolicy = {kind: 'deny', validate: () => false}\n\n/**\n * Conditional policies to deny flags. The flags are also hidden\n * from rendered help, so hosts are never told about surface they cannot use.\n */\nexport function conditionalDenyFlags(...names: string[]): ConditionalInvocationPolicy {\n  return {\n    deniedFlags: names,\n    kind: 'conditional',\n    validate: ({flags}) =>\n      names.every((name) => flags[name] === undefined || flags[name] === false),\n  }\n}\n\n/**\n * Conditional policy combining {@link conditionalDenyFlags} with an extra\n * predicate on the parsed invocation, for conditions a flag name alone\n * cannot express — e.g. flag values that would read from the host machine.\n * `deniedFlags` are hidden from rendered help; the predicate is not\n * expressible there, so flags it constrains stay advertised.\n */\nexport function conditionalPolicy(options: {\n  deniedFlags?: string[]\n  validate: InvocationPolicy\n}): ConditionalInvocationPolicy {\n  const denyFlags = conditionalDenyFlags(...(options.deniedFlags ?? []))\n  return {\n    ...denyFlags,\n    validate: (invocation) => denyFlags.validate(invocation) && options.validate(invocation),\n  }\n}\n\nexport function isConditionalInvocationPolicy(\n  policy: CommandPolicy,\n): policy is ConditionalInvocationPolicy {\n  return policy.kind === 'conditional'\n}\n\n/** A complete policy table, keyed by oclif command id. */\nexport type CommandPolicySet = Readonly<Record<string, CommandPolicy>>\n\n/** Where an invocation originates; selects the policy to enforce. */\nexport type InvocationSource = 'mcp'\n"],"names":["allow","kind","validate","deny","conditionalDenyFlags","names","deniedFlags","flags","every","name","undefined","conditionalPolicy","options","denyFlags","invocation","isConditionalInvocationPolicy","policy"],"mappings":"AAAA;;;;;;;;;;CAUC,GAED,6EAA6E,GAuB7E,mDAAmD,GACnD,OAAO,MAAMA,QAAuB;IAACC,MAAM;IAASC,UAAU,IAAM;AAAI,EAAC;AAEzE,2EAA2E,GAC3E,OAAO,MAAMC,OAAsB;IAACF,MAAM;IAAQC,UAAU,IAAM;AAAK,EAAC;AAExE;;;CAGC,GACD,OAAO,SAASE,qBAAqB,GAAGC,KAAe;IACrD,OAAO;QACLC,aAAaD;QACbJ,MAAM;QACNC,UAAU,CAAC,EAACK,KAAK,EAAC,GAChBF,MAAMG,KAAK,CAAC,CAACC,OAASF,KAAK,CAACE,KAAK,KAAKC,aAAaH,KAAK,CAACE,KAAK,KAAK;IACvE;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASE,kBAAkBC,OAGjC;IACC,MAAMC,YAAYT,wBAAyBQ,QAAQN,WAAW,IAAI,EAAE;IACpE,OAAO;QACL,GAAGO,SAAS;QACZX,UAAU,CAACY,aAAeD,UAAUX,QAAQ,CAACY,eAAeF,QAAQV,QAAQ,CAACY;IAC/E;AACF;AAEA,OAAO,SAASC,8BACdC,MAAqB;IAErB,OAAOA,OAAOf,IAAI,KAAK;AACzB"}

package/dist/exports/invokeSanityCli/help.js

@@ -0,0 +1,146 @@
+import { Help } from '@oclif/core';
+import { getHelpFlagAdditions } from '@oclif/core/help';
+import { isConditionalInvocationPolicy } from './commandPolicies/policy.js';
+/** Command ids a policy exposes: entries that are not denied. */ function visibleCommandIds(policySet) {
+    return new Set(Object.entries(policySet).filter(([, policy])=>policy.kind !== 'deny').map(([id])=>id));
+}
+/** Topic names covering the visible commands: every prefix of every id. */ function visibleTopicNames(commandIds) {
+    const names = new Set();
+    for (const id of commandIds){
+        const parts = id.split(':');
+        for(let length = 1; length < parts.length; length++){
+            names.add(parts.slice(0, length).join(':'));
+        }
+    }
+    return names;
+}
+/** Thrown when help is requested for a subject outside the policy surface. */ class NotInvokableError extends Error {
+}
+/**
+ * A copy of `command` without the policy's denied flags, and without examples
+ * that use them (under any spelling: `--web`, `--w`, `-w`), so rendered help
+ * only advertises invocations the policy accepts.
+ */ function withoutDeniedFlags(command, policy) {
+    if (!policy || !isConditionalInvocationPolicy(policy)) return {
+        ...command
+    };
+    const denied = policy.deniedFlags;
+    if (denied.length === 0) return {
+        ...command
+    };
+    const flags = {
+        ...command.flags
+    };
+    const spellings = [];
+    for (const name of denied){
+        const definition = flags[name];
+        if (!definition) continue;
+        spellings.push(`--${name}`);
+        if (definition.char) spellings.push(`-${definition.char}`);
+        for (const alias of definition.aliases ?? [])spellings.push(`--${alias}`, `-${alias}`);
+        delete flags[name];
+    }
+    const usesDeniedFlag = (example)=>{
+        const text = typeof example === 'string' ? example : example.command;
+        return spellings.some((spelling)=>new RegExp(String.raw`(^|\s)${spelling}(=|\s|$)`).test(text ?? ''));
+    };
+    return {
+        ...command,
+        examples: command.examples?.filter((example)=>!usesDeniedFlag(example)),
+        flags
+    };
+}
+/**
+ * oclif help renderer scoped to a policy's command surface. Subject
+ * resolution (root vs topic vs command help) is oclif's own; the policy is
+ * enforced at the rendering entry points so the rest of the CLI stays
+ * invisible to embedding hosts, and listings are filtered to non-denied
+ * commands and their topics only.
+ *
+ * Output is collected in {@link InvokableHelp.lines} instead of being written
+ * to the process streams.
+ */ class InvokableHelp extends Help {
+    lines = [];
+    commandIds;
+    policySet;
+    topicNames;
+    constructor(config, policySet){
+        super(config, {
+            stripAnsi: true
+        });
+        this.policySet = policySet;
+        this.commandIds = visibleCommandIds(policySet);
+        this.topicNames = visibleTopicNames(this.commandIds);
+    }
+    // The copies below are load-bearing: oclif's formatters rewrite ids/names
+    // in place (`cors:list` → `cors list`). Without copies those writes corrupt
+    // the shared (cached) config, breaking the policy checks on subsequent
+    // invocations.
+    get sortedCommands() {
+        return super.sortedCommands.filter((command)=>this.commandIds.has(command.id)).map((command)=>({
+                ...command
+            }));
+    }
+    get sortedTopics() {
+        // Topic names and descriptions come from the oclif config (oclif.config.js)
+        return super.sortedTopics.filter((topic)=>this.topicNames.has(topic.name)).map((topic)=>({
+                ...topic
+            }));
+    }
+    log(...args) {
+        this.lines.push(...args);
+    }
+    async showCommandHelp(command) {
+        if (!this.commandIds.has(command.id)) throw new NotInvokableError(command.id);
+        return super.showCommandHelp(withoutDeniedFlags(command, this.policySet[command.id]));
+    }
+    async showTopicHelp(topic) {
+        if (!this.topicNames.has(topic.name)) throw new NotInvokableError(topic.name);
+        return super.showTopicHelp({
+            ...topic
+        });
+    }
+}
+/**
+ * Render help text for a policy's command surface: root help for a bare help
+ * request, or topic/command help when `argv` names a subject (e.g.
+ * `['cors', '--help']`), exactly as oclif would resolve it. ANSI styling is
+ * stripped so programmatic callers get plain text.
+ *
+ * Returns `undefined` when the subject is unknown or denied — callers should
+ * respond the same way as for an unknown command, so hosts cannot probe the
+ * full CLI surface through help.
+ *
+ * @internal
+ */ export async function renderInvokableHelp(config, argv, policySet) {
+    const help = new InvokableHelp(config, policySet);
+    try {
+        await help.showHelp(argv);
+    } catch (err) {
+        // Subjects outside the policy surface (NotInvokableError) and subjects
+        // oclif itself cannot resolve (CLIError, marked with an `oclif` property)
+        // both yield no help output.
+        if (err instanceof NotInvokableError || err.oclif) return undefined;
+        throw err;
+    }
+    return help.lines.join('\n').trimEnd();
+}
+/**
+ * Whether `argv` asks for help rather than a command invocation: a leading
+ * `help` (oclif's help command), or a recognized help flag before any `--`
+ * terminator. The flags come from {@link getHelpFlagAdditions} — the same
+ * source oclif's own dispatch consults — so this surface recognizes exactly
+ * what the regular CLI recognizes.
+ *
+ * @internal
+ */ export function isHelpRequest(argv, config) {
+    if (argv[0] === 'help') return true;
+    const helpFlags = getHelpFlagAdditions(config);
+    for (const token of argv){
+        if (token === '--') return false;
+        if (helpFlags.includes(token)) return true;
+    }
+    return false;
+}
+
+//# sourceMappingURL=help.js.map

package/dist/exports/invokeSanityCli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/exports/invokeSanityCli/help.ts"],"sourcesContent":["import {type Command, type Config, Help, type Interfaces} from '@oclif/core'\nimport {getHelpFlagAdditions} from '@oclif/core/help'\n\nimport {\n  type CommandPolicy,\n  type CommandPolicySet,\n  isConditionalInvocationPolicy,\n} from './commandPolicies/policy.js'\n\n/** Command ids a policy exposes: entries that are not denied. */\nfunction visibleCommandIds(policySet: CommandPolicySet): Set<string> {\n  return new Set(\n    Object.entries(policySet)\n      .filter(([, policy]) => policy.kind !== 'deny')\n      .map(([id]) => id),\n  )\n}\n\n/** Topic names covering the visible commands: every prefix of every id. */\nfunction visibleTopicNames(commandIds: Set<string>): Set<string> {\n  const names = new Set<string>()\n  for (const id of commandIds) {\n    const parts = id.split(':')\n    for (let length = 1; length < parts.length; length++) {\n      names.add(parts.slice(0, length).join(':'))\n    }\n  }\n  return names\n}\n\n/** Thrown when help is requested for a subject outside the policy surface. */\nclass NotInvokableError extends Error {}\n\n/**\n * A copy of `command` without the policy's denied flags, and without examples\n * that use them (under any spelling: `--web`, `--w`, `-w`), so rendered help\n * only advertises invocations the policy accepts.\n */\nfunction withoutDeniedFlags(command: Command.Loadable, policy?: CommandPolicy): Command.Loadable {\n  if (!policy || !isConditionalInvocationPolicy(policy)) return {...command}\n\n  const denied = policy.deniedFlags\n  if (denied.length === 0) return {...command}\n\n  const flags = {...command.flags}\n  const spellings: string[] = []\n  for (const name of denied) {\n    const definition = flags[name]\n    if (!definition) continue\n    spellings.push(`--${name}`)\n    if (definition.char) spellings.push(`-${definition.char}`)\n    for (const alias of definition.aliases ?? []) spellings.push(`--${alias}`, `-${alias}`)\n    delete flags[name]\n  }\n\n  const usesDeniedFlag = (example: Command.Example) => {\n    const text = typeof example === 'string' ? example : example.command\n    return spellings.some((spelling) =>\n      new RegExp(String.raw`(^|\\s)${spelling}(=|\\s|$)`).test(text ?? ''),\n    )\n  }\n\n  return {\n    ...command,\n    examples: command.examples?.filter((example) => !usesDeniedFlag(example)),\n    flags,\n  }\n}\n\n/**\n * oclif help renderer scoped to a policy's command surface. Subject\n * resolution (root vs topic vs command help) is oclif's own; the policy is\n * enforced at the rendering entry points so the rest of the CLI stays\n * invisible to embedding hosts, and listings are filtered to non-denied\n * commands and their topics only.\n *\n * Output is collected in {@link InvokableHelp.lines} instead of being written\n * to the process streams.\n */\nclass InvokableHelp extends Help {\n  public readonly lines: string[] = []\n\n  private readonly commandIds: Set<string>\n  private readonly policySet: CommandPolicySet\n  private readonly topicNames: Set<string>\n\n  constructor(config: Config, policySet: CommandPolicySet) {\n    super(config, {stripAnsi: true})\n    this.policySet = policySet\n    this.commandIds = visibleCommandIds(policySet)\n    this.topicNames = visibleTopicNames(this.commandIds)\n  }\n\n  // The copies below are load-bearing: oclif's formatters rewrite ids/names\n  // in place (`cors:list` → `cors list`). Without copies those writes corrupt\n  // the shared (cached) config, breaking the policy checks on subsequent\n  // invocations.\n\n  protected override get sortedCommands(): Command.Loadable[] {\n    return super.sortedCommands\n      .filter((command) => this.commandIds.has(command.id))\n      .map((command) => ({...command}))\n  }\n\n  protected override get sortedTopics(): Interfaces.Topic[] {\n    // Topic names and descriptions come from the oclif config (oclif.config.js)\n    return super.sortedTopics\n      .filter((topic) => this.topicNames.has(topic.name))\n      .map((topic) => ({...topic}))\n  }\n\n  protected override log(...args: string[]): void {\n    this.lines.push(...args)\n  }\n\n  public override async showCommandHelp(command: Command.Loadable): Promise<void> {\n    if (!this.commandIds.has(command.id)) throw new NotInvokableError(command.id)\n    return super.showCommandHelp(withoutDeniedFlags(command, this.policySet[command.id]))\n  }\n\n  protected override async showTopicHelp(topic: Interfaces.Topic): Promise<void> {\n    if (!this.topicNames.has(topic.name)) throw new NotInvokableError(topic.name)\n    return super.showTopicHelp({...topic})\n  }\n}\n\n/**\n * Render help text for a policy's command surface: root help for a bare help\n * request, or topic/command help when `argv` names a subject (e.g.\n * `['cors', '--help']`), exactly as oclif would resolve it. ANSI styling is\n * stripped so programmatic callers get plain text.\n *\n * Returns `undefined` when the subject is unknown or denied — callers should\n * respond the same way as for an unknown command, so hosts cannot probe the\n * full CLI surface through help.\n *\n * @internal\n */\nexport async function renderInvokableHelp(\n  config: Config,\n  argv: string[],\n  policySet: CommandPolicySet,\n): Promise<string | undefined> {\n  const help = new InvokableHelp(config, policySet)\n  try {\n    await help.showHelp(argv)\n  } catch (err) {\n    // Subjects outside the policy surface (NotInvokableError) and subjects\n    // oclif itself cannot resolve (CLIError, marked with an `oclif` property)\n    // both yield no help output.\n    if (err instanceof NotInvokableError || err.oclif) return undefined\n    throw err\n  }\n  return help.lines.join('\\n').trimEnd()\n}\n\n/**\n * Whether `argv` asks for help rather than a command invocation: a leading\n * `help` (oclif's help command), or a recognized help flag before any `--`\n * terminator. The flags come from {@link getHelpFlagAdditions} — the same\n * source oclif's own dispatch consults — so this surface recognizes exactly\n * what the regular CLI recognizes.\n *\n * @internal\n */\nexport function isHelpRequest(argv: string[], config: Config): boolean {\n  if (argv[0] === 'help') return true\n  const helpFlags = getHelpFlagAdditions(config)\n  for (const token of argv) {\n    if (token === '--') return false\n    if (helpFlags.includes(token)) return true\n  }\n  return false\n}\n"],"names":["Help","getHelpFlagAdditions","isConditionalInvocationPolicy","visibleCommandIds","policySet","Set","Object","entries","filter","policy","kind","map","id","visibleTopicNames","commandIds","names","parts","split","length","add","slice","join","NotInvokableError","Error","withoutDeniedFlags","command","denied","deniedFlags","flags","spellings","name","definition","push","char","alias","aliases","usesDeniedFlag","example","text","some","spelling","RegExp","String","raw","test","examples","InvokableHelp","lines","topicNames","config","stripAnsi","sortedCommands","has","sortedTopics","topic","log","args","showCommandHelp","showTopicHelp","renderInvokableHelp","argv","help","showHelp","err","oclif","undefined","trimEnd","isHelpRequest","helpFlags","token","includes"],"mappings":"AAAA,SAAmCA,IAAI,QAAwB,cAAa;AAC5E,SAAQC,oBAAoB,QAAO,mBAAkB;AAErD,SAGEC,6BAA6B,QACxB,8BAA6B;AAEpC,+DAA+D,GAC/D,SAASC,kBAAkBC,SAA2B;IACpD,OAAO,IAAIC,IACTC,OAAOC,OAAO,CAACH,WACZI,MAAM,CAAC,CAAC,GAAGC,OAAO,GAAKA,OAAOC,IAAI,KAAK,QACvCC,GAAG,CAAC,CAAC,CAACC,GAAG,GAAKA;AAErB;AAEA,yEAAyE,GACzE,SAASC,kBAAkBC,UAAuB;IAChD,MAAMC,QAAQ,IAAIV;IAClB,KAAK,MAAMO,MAAME,WAAY;QAC3B,MAAME,QAAQJ,GAAGK,KAAK,CAAC;QACvB,IAAK,IAAIC,SAAS,GAAGA,SAASF,MAAME,MAAM,EAAEA,SAAU;YACpDH,MAAMI,GAAG,CAACH,MAAMI,KAAK,CAAC,GAAGF,QAAQG,IAAI,CAAC;QACxC;IACF;IACA,OAAON;AACT;AAEA,4EAA4E,GAC5E,MAAMO,0BAA0BC;AAAO;AAEvC;;;;CAIC,GACD,SAASC,mBAAmBC,OAAyB,EAAEhB,MAAsB;IAC3E,IAAI,CAACA,UAAU,CAACP,8BAA8BO,SAAS,OAAO;QAAC,GAAGgB,OAAO;IAAA;IAEzE,MAAMC,SAASjB,OAAOkB,WAAW;IACjC,IAAID,OAAOR,MAAM,KAAK,GAAG,OAAO;QAAC,GAAGO,OAAO;IAAA;IAE3C,MAAMG,QAAQ;QAAC,GAAGH,QAAQG,KAAK;IAAA;IAC/B,MAAMC,YAAsB,EAAE;IAC9B,KAAK,MAAMC,QAAQJ,OAAQ;QACzB,MAAMK,aAAaH,KAAK,CAACE,KAAK;QAC9B,IAAI,CAACC,YAAY;QACjBF,UAAUG,IAAI,CAAC,CAAC,EAAE,EAAEF,MAAM;QAC1B,IAAIC,WAAWE,IAAI,EAAEJ,UAAUG,IAAI,CAAC,CAAC,CAAC,EAAED,WAAWE,IAAI,EAAE;QACzD,KAAK,MAAMC,SAASH,WAAWI,OAAO,IAAI,EAAE,CAAEN,UAAUG,IAAI,CAAC,CAAC,EAAE,EAAEE,OAAO,EAAE,CAAC,CAAC,EAAEA,OAAO;QACtF,OAAON,KAAK,CAACE,KAAK;IACpB;IAEA,MAAMM,iBAAiB,CAACC;QACtB,MAAMC,OAAO,OAAOD,YAAY,WAAWA,UAAUA,QAAQZ,OAAO;QACpE,OAAOI,UAAUU,IAAI,CAAC,CAACC,WACrB,IAAIC,OAAOC,OAAOC,GAAG,CAAC,MAAM,EAAEH,SAAS,QAAQ,CAAC,EAAEI,IAAI,CAACN,QAAQ;IAEnE;IAEA,OAAO;QACL,GAAGb,OAAO;QACVoB,UAAUpB,QAAQoB,QAAQ,EAAErC,OAAO,CAAC6B,UAAY,CAACD,eAAeC;QAChET;IACF;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMkB,sBAAsB9C;IACV+C,QAAkB,EAAE,CAAA;IAEnBjC,WAAuB;IACvBV,UAA2B;IAC3B4C,WAAuB;IAExC,YAAYC,MAAc,EAAE7C,SAA2B,CAAE;QACvD,KAAK,CAAC6C,QAAQ;YAACC,WAAW;QAAI;QAC9B,IAAI,CAAC9C,SAAS,GAAGA;QACjB,IAAI,CAACU,UAAU,GAAGX,kBAAkBC;QACpC,IAAI,CAAC4C,UAAU,GAAGnC,kBAAkB,IAAI,CAACC,UAAU;IACrD;IAEA,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,eAAe;IAEf,IAAuBqC,iBAAqC;QAC1D,OAAO,KAAK,CAACA,eACV3C,MAAM,CAAC,CAACiB,UAAY,IAAI,CAACX,UAAU,CAACsC,GAAG,CAAC3B,QAAQb,EAAE,GAClDD,GAAG,CAAC,CAACc,UAAa,CAAA;gBAAC,GAAGA,OAAO;YAAA,CAAA;IAClC;IAEA,IAAuB4B,eAAmC;QACxD,4EAA4E;QAC5E,OAAO,KAAK,CAACA,aACV7C,MAAM,CAAC,CAAC8C,QAAU,IAAI,CAACN,UAAU,CAACI,GAAG,CAACE,MAAMxB,IAAI,GAChDnB,GAAG,CAAC,CAAC2C,QAAW,CAAA;gBAAC,GAAGA,KAAK;YAAA,CAAA;IAC9B;IAEmBC,IAAI,GAAGC,IAAc,EAAQ;QAC9C,IAAI,CAACT,KAAK,CAACf,IAAI,IAAIwB;IACrB;IAEA,MAAsBC,gBAAgBhC,OAAyB,EAAiB;QAC9E,IAAI,CAAC,IAAI,CAACX,UAAU,CAACsC,GAAG,CAAC3B,QAAQb,EAAE,GAAG,MAAM,IAAIU,kBAAkBG,QAAQb,EAAE;QAC5E,OAAO,KAAK,CAAC6C,gBAAgBjC,mBAAmBC,SAAS,IAAI,CAACrB,SAAS,CAACqB,QAAQb,EAAE,CAAC;IACrF;IAEA,MAAyB8C,cAAcJ,KAAuB,EAAiB;QAC7E,IAAI,CAAC,IAAI,CAACN,UAAU,CAACI,GAAG,CAACE,MAAMxB,IAAI,GAAG,MAAM,IAAIR,kBAAkBgC,MAAMxB,IAAI;QAC5E,OAAO,KAAK,CAAC4B,cAAc;YAAC,GAAGJ,KAAK;QAAA;IACtC;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeK,oBACpBV,MAAc,EACdW,IAAc,EACdxD,SAA2B;IAE3B,MAAMyD,OAAO,IAAIf,cAAcG,QAAQ7C;IACvC,IAAI;QACF,MAAMyD,KAAKC,QAAQ,CAACF;IACtB,EAAE,OAAOG,KAAK;QACZ,uEAAuE;QACvE,0EAA0E;QAC1E,6BAA6B;QAC7B,IAAIA,eAAezC,qBAAqByC,IAAIC,KAAK,EAAE,OAAOC;QAC1D,MAAMF;IACR;IACA,OAAOF,KAAKd,KAAK,CAAC1B,IAAI,CAAC,MAAM6C,OAAO;AACtC;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,cAAcP,IAAc,EAAEX,MAAc;IAC1D,IAAIW,IAAI,CAAC,EAAE,KAAK,QAAQ,OAAO;IAC/B,MAAMQ,YAAYnE,qBAAqBgD;IACvC,KAAK,MAAMoB,SAAST,KAAM;QACxB,IAAIS,UAAU,MAAM,OAAO;QAC3B,IAAID,UAAUE,QAAQ,CAACD,QAAQ,OAAO;IACxC;IACA,OAAO;AACT"}

package/dist/exports/invokeSanityCli/index.d.ts

@@ -0,0 +1,60 @@
+import { Config } from "@oclif/core";
+
+/** Where an invocation originates; selects the policy to enforce. */
+declare type InvocationSource = "mcp";
+
+/**
+ * Run a policy-permitted CLI command in-process and capture its result.
+ *
+ * Command-level failures (unknown command, bad flags, API errors) are
+ * reported through `exitCode`/`output` rather than thrown, so callers can
+ * relay them verbatim.
+ *
+ * @internal
+ */
+export declare function invokeSanityCli({
+  args,
+  config,
+  source,
+  token,
+}: InvokeSanityCliOptions): Promise<InvokeSanityCliResult>;
+
+/**
+ * @internal
+ */
+export declare interface InvokeSanityCliOptions {
+  /**
+   * Arguments after `sanity` (a leading `sanity` token is tolerated), either
+   * as a single string — shell-style quoting is supported, but no shell is
+   * ever executed — or as a pre-split argv array.
+   */
+  args: string | string[];
+  /**
+   * Where this invocation originates. Selects the command policy to enforce:
+   * which commands are invokable and which invocations of them are permitted.
+   */
+  source: InvocationSource;
+  /**
+   * Auth token for this invocation. Scoped to this call via the CLI execution
+   * context: it never touches process env or the process-wide token cache, so
+   * concurrent invocations with different tokens are fully isolated.
+   */
+  token: string;
+  /**
+   * Optional oclif config override (mainly for tests). Defaults to this
+   * package's config, loaded once and cached across invocations.
+   */
+  config?: Config;
+}
+
+/**
+ * @internal
+ */
+export declare interface InvokeSanityCliResult {
+  /** `0` on success, the command's exit code otherwise. */
+  exitCode: number;
+  /** Combined stdout and stderr output, in emission order. */
+  output: string;
+}
+
+export {};

package/dist/exports/invokeSanityCli/index.js

@@ -0,0 +1,177 @@
+/**
+ * Programmatic (in-process) invocation of CLI commands, e.g. from an MCP
+ * server. The invokable surface is governed by a per-source command policy
+ * (see ./commandPolicies): every CLI command is explicitly allowed, denied,
+ * or allowed conditionally on the parsed invocation.
+ *
+ * {@link invokeSanityCli} handles arg parsing, policy enforcement, command
+ * dispatch, per-invocation auth, and output capture.
+ * ```ts
+ * import {invokeSanityCli} from '@sanity/cli/invokeSanityCli'
+ *
+ * const {exitCode, output} = await invokeSanityCli({
+ *   args: 'cors list --project-id abc123',
+ *   source: 'mcp',
+ *   token: extra.authInfo.token,
+ * })
+ * ```
+ *
+ * Help works like the regular CLI, scoped to the source's policy: `--help`
+ * (or `help`) renders root help listing the invokable topics, and a subject
+ * (`cors --help`, `cors list --help`) renders topic or command help.
+ */ import { Config, Parser } from '@oclif/core';
+import { getHelpFlagAdditions, normalizeArgv } from '@oclif/core/help';
+import { CLI_TELEMETRY_SYMBOL, exitCodes, noopLogger, setCliTelemetry } from '@sanity/cli-core';
+import { runWithCliExecutionContext } from '@sanity/cli-core/executionContext';
+import { parseArgsStringToArgv } from 'string-argv';
+import { commandPolicies } from './commandPolicies/index.js';
+import { deny, isConditionalInvocationPolicy } from './commandPolicies/policy.js';
+import { isHelpRequest, renderInvokableHelp } from './help.js';
+/**
+ * Load the oclif `Config` for this package, needed to resolve, load, and run
+ * commands. Loading it once and reusing it across invocations avoids
+ * re-reading the command manifest per call.
+ */ function loadCliCommandConfig() {
+    return Config.load(import.meta.url);
+}
+function unknownCommandResult(argv, policySet) {
+    const available = Object.entries(policySet).filter(([, policy])=>policy.kind !== 'deny').map(([id])=>id.replaceAll(':', ' ')).toSorted();
+    return {
+        exitCode: exitCodes.USAGE_ERROR,
+        output: [
+            `Unknown or unsupported command: ${argv.slice(0, 2).join(' ') || '(none)'}`,
+            `Available commands: ${available.join(', ')}`
+        ].join('\n')
+    };
+}
+let cachedConfig;
+/**
+ * Unlike a shell, string-argv keeps quotes that are glued to unquoted text:
+ * `--name="my project"` tokenizes with the quotes intact. Strip a matching
+ * wrapping quote pair from the value side of `--flag=`-shaped tokens so the
+ * common shell-style form yields the value the caller intended.
+ */ function stripFlagQuotes(rawToken) {
+    const match = /^(-{1,2}[^\s=]+=)(['"])([\s\S]*)\2$/.exec(rawToken);
+    return match ? match[1] + match[3] : rawToken;
+}
+/**
+ * Run a policy-permitted CLI command in-process and capture its result.
+ *
+ * Command-level failures (unknown command, bad flags, API errors) are
+ * reported through `exitCode`/`output` rather than thrown, so callers can
+ * relay them verbatim.
+ *
+ * @internal
+ */ export async function invokeSanityCli({ args, config, source, token }) {
+    const resolvedConfig = config ?? await (cachedConfig ??= loadCliCommandConfig());
+    const policySet = commandPolicies[source];
+    // Commands log through the global telemetry store; default it to a noop
+    // store so embedding hosts need no telemetry wiring (and see no warnings),
+    // without clobbering a store the host may have installed itself.
+    if (!globalThis[CLI_TELEMETRY_SYMBOL]) {
+        setCliTelemetry(noopLogger);
+    }
+    // Pre-split argv arrays are taken verbatim; only string input goes through
+    // shell-style tokenization and quote normalization.
+    let argv = typeof args === 'string' ? parseArgsStringToArgv(args).map((t)=>stripFlagQuotes(t)) : [
+        ...args
+    ];
+    if (argv[0] === 'sanity') argv = argv.slice(1);
+    // Help requests are routed through oclif's help system, scoped to the
+    // source's policy: root help for a bare request, topic/command help when a
+    // subject is given. Denied subjects get the standard unknown-command
+    // response (identical to a truly unknown command, so hosts can't probe the
+    // full CLI surface through help), and a help request never executes a
+    // command.
+    if (isHelpRequest(argv, resolvedConfig)) {
+        try {
+            // Drop a leading `help` so the rest is the subject, mirroring how
+            // oclif's dispatch consumes the token before the help command sees argv
+            const helpArgv = argv[0] === 'help' ? argv.slice(1) : argv;
+            const output = await renderInvokableHelp(resolvedConfig, helpArgv, policySet);
+            if (output !== undefined) return {
+                exitCode: exitCodes.SUCCESS,
+                output
+            };
+            const helpFlags = getHelpFlagAdditions(resolvedConfig);
+            return unknownCommandResult(helpArgv.filter((token)=>!helpFlags.includes(token)), policySet);
+        } catch (err) {
+            return {
+                exitCode: exitCodes.RUNTIME_ERROR,
+                output: err instanceof Error ? err.message : String(err)
+            };
+        }
+    }
+    // Resolve the command id the same way oclif's dispatch would (collating
+    // space-separated topics, accepting colon-separated ids as-is), then apply
+    // the policy. Denied and uncategorized ids fail closed, indistinguishable
+    // from commands that don't exist.
+    const [commandId = '', ...commandArgv] = normalizeArgv(resolvedConfig, argv);
+    const policy = policySet[commandId] ?? deny;
+    const commandDefinition = policy.kind === 'deny' ? undefined : resolvedConfig.findCommand(commandId);
+    if (!commandDefinition) return unknownCommandResult(argv, policySet);
+    const CommandClass = await commandDefinition.load();
+    // Parse with the command's real definitions (without executing anything) so
+    // conditional policies are evaluated against typed args/flags, not tokens.
+    let invocation;
+    try {
+        const parsed = await Parser.parse(commandArgv, {
+            args: CommandClass.args,
+            baseFlags: CommandClass.baseFlags,
+            enableJsonFlag: CommandClass.enableJsonFlag,
+            flags: CommandClass.flags,
+            strict: CommandClass.strict
+        });
+        invocation = {
+            args: parsed.args,
+            flags: parsed.flags
+        };
+    } catch (err) {
+        return {
+            exitCode: exitCodes.USAGE_ERROR,
+            output: err instanceof Error ? err.message : String(err)
+        };
+    }
+    if (!policy.validate(invocation)) {
+        const displayId = commandId.replaceAll(':', ' ');
+        let output = `This invocation of \`${displayId}\` is not supported here`;
+        if (isConditionalInvocationPolicy(policy)) {
+            const usedDeniedFlags = policy.deniedFlags.filter((name)=>invocation.flags[name] !== undefined && invocation.flags[name] !== false);
+            output = `\nThe ${usedDeniedFlags.map((name)=>`--${name}`).join(', ')} flag is not supported here for \`${displayId}\``;
+        }
+        return {
+            exitCode: exitCodes.USAGE_ERROR,
+            output
+        };
+    }
+    const output = [];
+    const sink = (line)=>output.push(line);
+    try {
+        await runWithCliExecutionContext({
+            stderr: sink,
+            stdout: sink,
+            token
+        }, ()=>CommandClass.run(commandArgv, resolvedConfig));
+        return {
+            exitCode: exitCodes.SUCCESS,
+            output: output.join('\n')
+        };
+    } catch (err) {
+        const exit = err.oclif?.exit;
+        // `this.exit(0)` throws an ExitError but is a successful outcome
+        if (exit === exitCodes.SUCCESS) {
+            return {
+                exitCode: exitCodes.SUCCESS,
+                output: output.join('\n')
+            };
+        }
+        const message = err instanceof Error ? err.message : String(err);
+        if (message) output.push(message);
+        return {
+            exitCode: typeof exit === 'number' ? exit : exitCodes.RUNTIME_ERROR,
+            output: output.join('\n')
+        };
+    }
+}
+
+//# sourceMappingURL=index.js.map