@sanity/cli 7.13.0 → 7.15.0

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/commands/login.ts"],"sourcesContent":["import {text} from 'node:stream/consumers'\n\nimport {Command, Flags} from '@oclif/core'\nimport {type FlagInput} from '@oclif/core/interfaces'\nimport {exitCodes, SanityCommand} from '@sanity/cli-core'\n\nimport {login} from '../actions/auth/login/login.js'\nimport {LOGIN_PROVIDER_IDS} from '../actions/auth/login/loginInstructions.js'\n\nexport class LoginCommand extends SanityCommand<typeof LoginCommand> {\n  static override description = 'Log in to your Sanity account'\n  static override examples: Array<Command.Example> = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'Log in using default settings',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --provider github --no-open',\n      description: 'Login with GitHub provider, but do not open a browser window automatically',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --sso my-organization',\n      description: 'Log in using Single Sign-On with the \"my-organization\" slug',\n    },\n    {\n      command:\n        '<%= config.bin %> <%= command.id %> --sso my-organization --sso-provider \"Okta SSO\"',\n      description: 'Log in using a specific SSO provider within an organization',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --with-token < token.txt',\n      description: 'Log in using a token from standard input',\n    },\n  ]\n  static override flags = {\n    experimental: Flags.boolean({\n      default: false,\n      hidden: true,\n    }),\n    open: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Open a browser window to log in (`--no-open` only prints URL)',\n    }),\n    provider: Flags.string({\n      description: `Log in using a provider ID (${LOGIN_PROVIDER_IDS.join(', ')})`,\n      exclusive: ['sso', 'with-token'],\n      helpValue: '<providerId>',\n    }),\n    sso: Flags.string({\n      description: 'Log in using Single Sign-On, using the given organization slug',\n      exclusive: ['provider', 'with-token'],\n      helpValue: '<slug>',\n    }),\n    'sso-provider': Flags.string({\n      dependsOn: ['sso'],\n      description: 'Select a specific SSO provider by name (use with --sso)',\n      helpValue: '<name>',\n    }),\n    'with-token': Flags.boolean({\n      description: 'Read token from standard input',\n      exclusive: ['provider', 'sso'],\n    }),\n  } satisfies FlagInput\n\n  public async run(): Promise<void> {\n    const {flags} = await this.parse(LoginCommand)\n    const {'sso-provider': ssoProvider, 'with-token': withToken, ...loginFlags} = flags\n\n    try {\n      const token = withToken ? await readTokenFromStdin() : undefined\n\n      await login({\n        ...loginFlags,\n        output: this.output,\n        ssoProvider,\n        telemetry: this.telemetry,\n        token,\n      })\n      this.log('Login successful')\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n      this.error(`Login failed: ${message}`, {exit: exitCodes.RUNTIME_ERROR})\n    }\n  }\n}\n\nasync function readTokenFromStdin(): Promise<string> {\n  if (process.stdin.isTTY) {\n    throw new Error(\n      'Token is required on standard input. Run `sanity login --with-token < token.txt`.',\n    )\n  }\n\n  return text(process.stdin)\n}\n"],"names":["text","Flags","exitCodes","SanityCommand","login","LOGIN_PROVIDER_IDS","LoginCommand","description","examples","command","flags","experimental","boolean","default","hidden","open","allowNo","provider","string","join","exclusive","helpValue","sso","dependsOn","run","parse","ssoProvider","withToken","loginFlags","token","readTokenFromStdin","undefined","output","telemetry","log","error","message","Error","String","exit","RUNTIME_ERROR","process","stdin","isTTY"],"mappings":"AAAA,SAAQA,IAAI,QAAO,wBAAuB;AAE1C,SAAiBC,KAAK,QAAO,cAAa;AAE1C,SAAQC,SAAS,EAAEC,aAAa,QAAO,mBAAkB;AAEzD,SAAQC,KAAK,QAAO,iCAAgC;AACpD,SAAQC,kBAAkB,QAAO,6CAA4C;AAE7E,OAAO,MAAMC,qBAAqBH;IAChC,OAAgBI,cAAc,gCAA+B;IAC7D,OAAgBC,WAAmC;QACjD;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SACE;YACFF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtBC,cAAcV,MAAMW,OAAO,CAAC;YAC1BC,SAAS;YACTC,QAAQ;QACV;QACAC,MAAMd,MAAMW,OAAO,CAAC;YAClBI,SAAS;YACTH,SAAS;YACTN,aAAa;QACf;QACAU,UAAUhB,MAAMiB,MAAM,CAAC;YACrBX,aAAa,CAAC,4BAA4B,EAAEF,mBAAmBc,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5EC,WAAW;gBAAC;gBAAO;aAAa;YAChCC,WAAW;QACb;QACAC,KAAKrB,MAAMiB,MAAM,CAAC;YAChBX,aAAa;YACba,WAAW;gBAAC;gBAAY;aAAa;YACrCC,WAAW;QACb;QACA,gBAAgBpB,MAAMiB,MAAM,CAAC;YAC3BK,WAAW;gBAAC;aAAM;YAClBhB,aAAa;YACbc,WAAW;QACb;QACA,cAAcpB,MAAMW,OAAO,CAAC;YAC1BL,aAAa;YACba,WAAW;gBAAC;gBAAY;aAAM;QAChC;IACF,EAAqB;IAErB,MAAaI,MAAqB;QAChC,MAAM,EAACd,KAAK,EAAC,GAAG,MAAM,IAAI,CAACe,KAAK,CAACnB;QACjC,MAAM,EAAC,gBAAgBoB,WAAW,EAAE,cAAcC,SAAS,EAAE,GAAGC,YAAW,GAAGlB;QAE9E,IAAI;YACF,MAAMmB,QAAQF,YAAY,MAAMG,uBAAuBC;YAEvD,MAAM3B,MAAM;gBACV,GAAGwB,UAAU;gBACbI,QAAQ,IAAI,CAACA,MAAM;gBACnBN;gBACAO,WAAW,IAAI,CAACA,SAAS;gBACzBJ;YACF;YACA,IAAI,CAACK,GAAG,CAAC;QACX,EAAE,OAAOC,OAAO;YACd,MAAMC,UAAUD,iBAAiBE,QAAQF,MAAMC,OAAO,GAAGE,OAAOH;YAChE,IAAI,CAACA,KAAK,CAAC,CAAC,cAAc,EAAEC,SAAS,EAAE;gBAACG,MAAMrC,UAAUsC,aAAa;YAAA;QACvE;IACF;AACF;AAEA,eAAeV;IACb,IAAIW,QAAQC,KAAK,CAACC,KAAK,EAAE;QACvB,MAAM,IAAIN,MACR;IAEJ;IAEA,OAAOrC,KAAKyC,QAAQC,KAAK;AAC3B"}
+{"version":3,"sources":["../../src/commands/login.ts"],"sourcesContent":["import {text} from 'node:stream/consumers'\n\nimport {Command, Flags} from '@oclif/core'\nimport {type FlagInput} from '@oclif/core/interfaces'\nimport {exitCodes, SanityCommand} from '@sanity/cli-core'\n\nimport {login} from '../actions/auth/login/login.js'\nimport {LOGIN_PROVIDER_IDS} from '../actions/auth/login/loginInstructions.js'\n\nexport class LoginCommand extends SanityCommand<typeof LoginCommand> {\n  static override description = 'Log in to your Sanity account'\n  static override examples: Array<Command.Example> = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'Log in using default settings',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --with-token < token.txt',\n      description: 'Log in using a token from standard input',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --provider github --no-open',\n      description: 'Login with GitHub provider, but do not open a browser window automatically',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --sso my-organization',\n      description: 'Log in using Single Sign-On with the \"my-organization\" slug',\n    },\n    {\n      command:\n        '<%= config.bin %> <%= command.id %> --sso my-organization --sso-provider \"Okta SSO\"',\n      description: 'Log in using a specific SSO provider within an organization',\n    },\n  ]\n  static override flags = {\n    'with-token': Flags.boolean({\n      description: 'Read token from standard input',\n      exclusive: ['provider', 'sso'],\n    }),\n    // eslint-disable-next-line perfectionist/sort-objects -- Keep token login first in generated usage.\n    experimental: Flags.boolean({\n      default: false,\n      hidden: true,\n    }),\n    open: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Open a browser window to log in (`--no-open` only prints URL)',\n    }),\n    provider: Flags.string({\n      description: `Log in using a provider ID (${LOGIN_PROVIDER_IDS.join(', ')})`,\n      exclusive: ['sso', 'with-token'],\n      helpValue: '<providerId>',\n    }),\n    sso: Flags.string({\n      description: 'Log in using Single Sign-On, using the given organization slug',\n      exclusive: ['provider', 'with-token'],\n      helpValue: '<slug>',\n    }),\n    'sso-provider': Flags.string({\n      dependsOn: ['sso'],\n      description: 'Select a specific SSO provider by name (use with --sso)',\n      helpValue: '<name>',\n    }),\n  } satisfies FlagInput\n\n  public async run(): Promise<void> {\n    const {flags} = await this.parse(LoginCommand)\n    const {'sso-provider': ssoProvider, 'with-token': withToken, ...loginFlags} = flags\n\n    try {\n      const token = withToken ? await readTokenFromStdin() : undefined\n\n      await login({\n        ...loginFlags,\n        output: this.output,\n        ssoProvider,\n        telemetry: this.telemetry,\n        token,\n      })\n      this.log('Login successful')\n    } catch (error) {\n      const message = error instanceof Error ? error.message : String(error)\n      this.error(`Login failed: ${message}`, {exit: exitCodes.RUNTIME_ERROR})\n    }\n  }\n}\n\nasync function readTokenFromStdin(): Promise<string> {\n  if (process.stdin.isTTY) {\n    throw new Error(\n      'Token is required on standard input. Run `sanity login --with-token < token.txt`.',\n    )\n  }\n\n  return text(process.stdin)\n}\n"],"names":["text","Flags","exitCodes","SanityCommand","login","LOGIN_PROVIDER_IDS","LoginCommand","description","examples","command","flags","boolean","exclusive","experimental","default","hidden","open","allowNo","provider","string","join","helpValue","sso","dependsOn","run","parse","ssoProvider","withToken","loginFlags","token","readTokenFromStdin","undefined","output","telemetry","log","error","message","Error","String","exit","RUNTIME_ERROR","process","stdin","isTTY"],"mappings":"AAAA,SAAQA,IAAI,QAAO,wBAAuB;AAE1C,SAAiBC,KAAK,QAAO,cAAa;AAE1C,SAAQC,SAAS,EAAEC,aAAa,QAAO,mBAAkB;AAEzD,SAAQC,KAAK,QAAO,iCAAgC;AACpD,SAAQC,kBAAkB,QAAO,6CAA4C;AAE7E,OAAO,MAAMC,qBAAqBH;IAChC,OAAgBI,cAAc,gCAA+B;IAC7D,OAAgBC,WAAmC;QACjD;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SACE;YACFF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtB,cAAcT,MAAMU,OAAO,CAAC;YAC1BJ,aAAa;YACbK,WAAW;gBAAC;gBAAY;aAAM;QAChC;QACA,oGAAoG;QACpGC,cAAcZ,MAAMU,OAAO,CAAC;YAC1BG,SAAS;YACTC,QAAQ;QACV;QACAC,MAAMf,MAAMU,OAAO,CAAC;YAClBM,SAAS;YACTH,SAAS;YACTP,aAAa;QACf;QACAW,UAAUjB,MAAMkB,MAAM,CAAC;YACrBZ,aAAa,CAAC,4BAA4B,EAAEF,mBAAmBe,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5ER,WAAW;gBAAC;gBAAO;aAAa;YAChCS,WAAW;QACb;QACAC,KAAKrB,MAAMkB,MAAM,CAAC;YAChBZ,aAAa;YACbK,WAAW;gBAAC;gBAAY;aAAa;YACrCS,WAAW;QACb;QACA,gBAAgBpB,MAAMkB,MAAM,CAAC;YAC3BI,WAAW;gBAAC;aAAM;YAClBhB,aAAa;YACbc,WAAW;QACb;IACF,EAAqB;IAErB,MAAaG,MAAqB;QAChC,MAAM,EAACd,KAAK,EAAC,GAAG,MAAM,IAAI,CAACe,KAAK,CAACnB;QACjC,MAAM,EAAC,gBAAgBoB,WAAW,EAAE,cAAcC,SAAS,EAAE,GAAGC,YAAW,GAAGlB;QAE9E,IAAI;YACF,MAAMmB,QAAQF,YAAY,MAAMG,uBAAuBC;YAEvD,MAAM3B,MAAM;gBACV,GAAGwB,UAAU;gBACbI,QAAQ,IAAI,CAACA,MAAM;gBACnBN;gBACAO,WAAW,IAAI,CAACA,SAAS;gBACzBJ;YACF;YACA,IAAI,CAACK,GAAG,CAAC;QACX,EAAE,OAAOC,OAAO;YACd,MAAMC,UAAUD,iBAAiBE,QAAQF,MAAMC,OAAO,GAAGE,OAAOH;YAChE,IAAI,CAACA,KAAK,CAAC,CAAC,cAAc,EAAEC,SAAS,EAAE;gBAACG,MAAMrC,UAAUsC,aAAa;YAAA;QACvE;IACF;AACF;AAEA,eAAeV;IACb,IAAIW,QAAQC,KAAK,CAACC,KAAK,EAAE;QACvB,MAAM,IAAIN,MACR;IAEJ;IAEA,OAAOrC,KAAKyC,QAAQC,KAAK;AAC3B"}

package/dist/exports/invokeSanityCli/commandPolicies/index.js

@@ -0,0 +1,6 @@
+import { mcpPolicy } from './mcpPolicy.js';
+export const commandPolicies = {
+    mcp: mcpPolicy
+};
+
+//# sourceMappingURL=index.js.map

package/dist/exports/invokeSanityCli/commandPolicies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/index.ts"],"sourcesContent":["import {mcpPolicy} from './mcpPolicy.js'\nimport {type CommandPolicySet, type InvocationSource} from './policy.js'\n\nexport const commandPolicies: Record<InvocationSource, CommandPolicySet> = {\n  mcp: mcpPolicy,\n}\n"],"names":["mcpPolicy","commandPolicies","mcp"],"mappings":"AAAA,SAAQA,SAAS,QAAO,iBAAgB;AAGxC,OAAO,MAAMC,kBAA8D;IACzEC,KAAKF;AACP,EAAC"}

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js

@@ -0,0 +1,174 @@
+import { allow, conditionalDenyFlags, conditionalPolicy, deny } from './policy.js';
+/**
+ * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command
+ * read the host's filesystem or stdin (raw `-f` fields are always verbatim).
+ */ function fieldReadsFromHost(field) {
+    if (typeof field !== 'string') return false;
+    const separatorIndex = field.indexOf('=');
+    return separatorIndex > 0 && field[separatorIndex + 1] === '@';
+}
+/** A `-H/--header` value that replaces the invocation's authentication. */ function headerOverridesAuthentication(header) {
+    if (typeof header !== 'string') return false;
+    const separatorIndex = header.indexOf(':');
+    return separatorIndex > 0 && header.slice(0, separatorIndex).trim().toLowerCase() === 'authorization';
+}
+/**
+ * MCP programmatic mode disables local project/config discovery (see the CLI
+ * execution context). Missing project or dataset values may therefore produce
+ * a usage error, but cannot cause local filesystem access. Destructive remote
+ * operations are allowed and do not by themselves make a command unsafe.
+ *
+ * Every manifest command must have exactly one policy here:
+ * - allow: every valid invocation is safe
+ * - conditional: safety depends on parsed arguments or flags
+ * - deny: no invocation is safe
+ */ export const mcpPolicy = {
+    // Special exception, this can be very dangerous but is also super useful
+    // to expose. Refuse authentication overrides and host input channels:
+    // `--token` and an Authorization header replace the MCP user's token,
+    // `--input` reads the request body from the host's filesystem or stdin, and
+    // `-F key=@<file>` / `-F key=@-` field values do the same.
+    api: conditionalPolicy({
+        deniedFlags: [
+            'input',
+            'token'
+        ],
+        validate: ({ flags })=>(!Array.isArray(flags.field) || !flags.field.some((field)=>fieldReadsFromHost(field))) && (!Array.isArray(flags.header) || !flags.header.some((header)=>headerOverridesAuthentication(header)))
+    }),
+    'backups:disable': allow,
+    // Writes a downloaded backup to the local filesystem.
+    'backups:download': deny,
+    'backups:enable': allow,
+    'backups:list': allow,
+    // Requires a local Studio project and writes build output to disk.
+    build: deny,
+    // Reads and rewrites local source code.
+    codemod: deny,
+    'cors:add': allow,
+    'cors:delete': allow,
+    'cors:list': allow,
+    'datasets:alias:create': allow,
+    'datasets:alias:delete': allow,
+    'datasets:alias:link': allow,
+    'datasets:alias:unlink': allow,
+    'datasets:copy': allow,
+    'datasets:create': allow,
+    'datasets:delete': allow,
+    'datasets:embeddings:disable': allow,
+    'datasets:embeddings:enable': allow,
+    'datasets:embeddings:status': allow,
+    // Writes dataset contents and assets to the local filesystem.
+    'datasets:export': deny,
+    // Reads import data from the local filesystem and may replace documents.
+    'datasets:import': deny,
+    'datasets:list': allow,
+    'datasets:visibility:get': allow,
+    'datasets:visibility:set': allow,
+    // Inspects local project files and can print authentication secrets.
+    debug: deny,
+    // Reads, builds, and deploys a local Studio project.
+    deploy: deny,
+    // Loads a local Studio project and starts a development server.
+    dev: deny,
+    // Opens a browser on the machine running the MCP server.
+    'docs:browse': deny,
+    // --web opens a browser on the machine running the MCP server.
+    'docs:read': conditionalDenyFlags('web'),
+    'docs:search': allow,
+    // Reads and executes local project configuration for diagnostics.
+    doctor: deny,
+    // Reads document input from disk or launches a local editor.
+    'documents:create': deny,
+    'documents:delete': allow,
+    'documents:get': allow,
+    'documents:query': allow,
+    // Loads a local Studio schema to validate documents.
+    'documents:validate': deny,
+    // Executes arbitrary code in the local Studio context.
+    exec: deny,
+    // Loads a local schema and deploys a GraphQL API.
+    'graphql:deploy': deny,
+    'graphql:list': allow,
+    // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.
+    'graphql:undeploy': conditionalDenyFlags('api'),
+    'hooks:attempt': allow,
+    'hooks:create': allow,
+    'hooks:delete': allow,
+    'hooks:list': allow,
+    'hooks:logs': allow,
+    // Creates or modifies a local project and may install dependencies.
+    init: deny,
+    // Installs packages into the local project.
+    install: deny,
+    // Opens a browser on the machine running the MCP server.
+    learn: deny,
+    // Performs an authentication flow.
+    login: deny,
+    // Performs an authentication operation and clears local credentials.
+    logout: deny,
+    // Reads local project configuration and opens a browser.
+    manage: deny,
+    // Loads local Studio configuration and writes manifest files.
+    'manifest:extract': deny,
+    // Reads and writes local MCP client configuration.
+    'mcp:configure': deny,
+    // Writes an aspect definition to the local filesystem.
+    'media:create-aspect': deny,
+    'media:delete-aspect': allow,
+    // Reads a local aspect definition before deploying it.
+    'media:deploy-aspect': deny,
+    // Writes media assets to the local filesystem.
+    'media:export': deny,
+    // Reads media assets from the local filesystem.
+    'media:import': deny,
+    // Creates migration source files in the local project.
+    'migrations:create': deny,
+    // Reads and loads migration definitions from the local project.
+    'migrations:list': deny,
+    // Executes local migration code that may perform arbitrary document mutations.
+    'migrations:run': deny,
+    // --web opens a browser on the machine running the MCP server.
+    'openapi:get': conditionalDenyFlags('web'),
+    'openapi:list': conditionalDenyFlags('web'),
+    'organizations:create': allow,
+    'organizations:delete': allow,
+    'organizations:get': allow,
+    'organizations:list': allow,
+    'organizations:update': allow,
+    // Serves a local production build.
+    preview: deny,
+    'projects:create': allow,
+    'projects:list': allow,
+    // Loads the local Studio configuration to resolve the datasets containing each schema.
+    'schemas:delete': deny,
+    // Loads local schema files before deploying them.
+    'schemas:deploy': deny,
+    // Loads local Studio configuration and writes an extracted schema to disk.
+    'schemas:extract': deny,
+    // Requires a local project and loads its schema configuration.
+    'schemas:list': deny,
+    // Loads and executes a local Studio schema.
+    'schemas:validate': deny,
+    // Installs skills into local editor configuration directories.
+    'skills:install': deny,
+    // Changes account telemetry preferences and mutates local cached configuration.
+    'telemetry:disable': deny,
+    // Changes account telemetry preferences and mutates local cached configuration.
+    'telemetry:enable': deny,
+    'telemetry:status': allow,
+    // Creates authentication credentials.
+    'tokens:create': deny,
+    // Deletes authentication credentials.
+    'tokens:delete': deny,
+    // Exposes authentication credential metadata.
+    'tokens:list': deny,
+    // Loads local CLI and workbench configuration to identify the deployed Studio or application.
+    undeploy: deny,
+    // Grants a user access to a project.
+    'users:invite': deny,
+    'users:list': allow,
+    // Reads the local project and installed package tree.
+    versions: deny
+};
+
+//# sourceMappingURL=mcpPolicy.js.map

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/mcpPolicy.ts"],"sourcesContent":["import {\n  allow,\n  type CommandPolicySet,\n  conditionalDenyFlags,\n  conditionalPolicy,\n  deny,\n} from './policy.js'\n\n/**\n * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command\n * read the host's filesystem or stdin (raw `-f` fields are always verbatim).\n */\nfunction fieldReadsFromHost(field: unknown): boolean {\n  if (typeof field !== 'string') return false\n  const separatorIndex = field.indexOf('=')\n  return separatorIndex > 0 && field[separatorIndex + 1] === '@'\n}\n\n/** A `-H/--header` value that replaces the invocation's authentication. */\nfunction headerOverridesAuthentication(header: unknown): boolean {\n  if (typeof header !== 'string') return false\n  const separatorIndex = header.indexOf(':')\n  return (\n    separatorIndex > 0 && header.slice(0, separatorIndex).trim().toLowerCase() === 'authorization'\n  )\n}\n\n/**\n * MCP programmatic mode disables local project/config discovery (see the CLI\n * execution context). Missing project or dataset values may therefore produce\n * a usage error, but cannot cause local filesystem access. Destructive remote\n * operations are allowed and do not by themselves make a command unsafe.\n *\n * Every manifest command must have exactly one policy here:\n * - allow: every valid invocation is safe\n * - conditional: safety depends on parsed arguments or flags\n * - deny: no invocation is safe\n */\nexport const mcpPolicy: CommandPolicySet = {\n  // Special exception, this can be very dangerous but is also super useful\n  // to expose. Refuse authentication overrides and host input channels:\n  // `--token` and an Authorization header replace the MCP user's token,\n  // `--input` reads the request body from the host's filesystem or stdin, and\n  // `-F key=@<file>` / `-F key=@-` field values do the same.\n  api: conditionalPolicy({\n    deniedFlags: ['input', 'token'],\n    validate: ({flags}) =>\n      (!Array.isArray(flags.field) || !flags.field.some((field) => fieldReadsFromHost(field))) &&\n      (!Array.isArray(flags.header) ||\n        !flags.header.some((header) => headerOverridesAuthentication(header))),\n  }),\n\n  'backups:disable': allow,\n  // Writes a downloaded backup to the local filesystem.\n  'backups:download': deny,\n  'backups:enable': allow,\n  'backups:list': allow,\n\n  // Requires a local Studio project and writes build output to disk.\n  build: deny,\n\n  // Reads and rewrites local source code.\n  codemod: deny,\n\n  'cors:add': allow,\n  'cors:delete': allow,\n  'cors:list': allow,\n\n  'datasets:alias:create': allow,\n  'datasets:alias:delete': allow,\n  'datasets:alias:link': allow,\n  'datasets:alias:unlink': allow,\n  'datasets:copy': allow,\n  'datasets:create': allow,\n  'datasets:delete': allow,\n  'datasets:embeddings:disable': allow,\n  'datasets:embeddings:enable': allow,\n  'datasets:embeddings:status': allow,\n  // Writes dataset contents and assets to the local filesystem.\n  'datasets:export': deny,\n  // Reads import data from the local filesystem and may replace documents.\n  'datasets:import': deny,\n  'datasets:list': allow,\n  'datasets:visibility:get': allow,\n  'datasets:visibility:set': allow,\n\n  // Inspects local project files and can print authentication secrets.\n  debug: deny,\n\n  // Reads, builds, and deploys a local Studio project.\n  deploy: deny,\n\n  // Loads a local Studio project and starts a development server.\n  dev: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  'docs:browse': deny,\n  // --web opens a browser on the machine running the MCP server.\n  'docs:read': conditionalDenyFlags('web'),\n  'docs:search': allow,\n\n  // Reads and executes local project configuration for diagnostics.\n  doctor: deny,\n\n  // Reads document input from disk or launches a local editor.\n  'documents:create': deny,\n  'documents:delete': allow,\n  'documents:get': allow,\n  'documents:query': allow,\n  // Loads a local Studio schema to validate documents.\n  'documents:validate': deny,\n\n  // Executes arbitrary code in the local Studio context.\n  exec: deny,\n\n  // Loads a local schema and deploys a GraphQL API.\n  'graphql:deploy': deny,\n  'graphql:list': allow,\n  // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.\n  'graphql:undeploy': conditionalDenyFlags('api'),\n\n  'hooks:attempt': allow,\n  'hooks:create': allow,\n  'hooks:delete': allow,\n  'hooks:list': allow,\n  'hooks:logs': allow,\n\n  // Creates or modifies a local project and may install dependencies.\n  init: deny,\n\n  // Installs packages into the local project.\n  install: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  learn: deny,\n\n  // Performs an authentication flow.\n  login: deny,\n\n  // Performs an authentication operation and clears local credentials.\n  logout: deny,\n\n  // Reads local project configuration and opens a browser.\n  manage: deny,\n\n  // Loads local Studio configuration and writes manifest files.\n  'manifest:extract': deny,\n\n  // Reads and writes local MCP client configuration.\n  'mcp:configure': deny,\n\n  // Writes an aspect definition to the local filesystem.\n  'media:create-aspect': deny,\n  'media:delete-aspect': allow,\n  // Reads a local aspect definition before deploying it.\n  'media:deploy-aspect': deny,\n  // Writes media assets to the local filesystem.\n  'media:export': deny,\n  // Reads media assets from the local filesystem.\n  'media:import': deny,\n\n  // Creates migration source files in the local project.\n  'migrations:create': deny,\n  // Reads and loads migration definitions from the local project.\n  'migrations:list': deny,\n  // Executes local migration code that may perform arbitrary document mutations.\n  'migrations:run': deny,\n\n  // --web opens a browser on the machine running the MCP server.\n  'openapi:get': conditionalDenyFlags('web'),\n  'openapi:list': conditionalDenyFlags('web'),\n\n  'organizations:create': allow,\n  'organizations:delete': allow,\n  'organizations:get': allow,\n  'organizations:list': allow,\n  'organizations:update': allow,\n\n  // Serves a local production build.\n  preview: deny,\n\n  'projects:create': allow,\n  'projects:list': allow,\n\n  // Loads the local Studio configuration to resolve the datasets containing each schema.\n  'schemas:delete': deny,\n  // Loads local schema files before deploying them.\n  'schemas:deploy': deny,\n  // Loads local Studio configuration and writes an extracted schema to disk.\n  'schemas:extract': deny,\n  // Requires a local project and loads its schema configuration.\n  'schemas:list': deny,\n  // Loads and executes a local Studio schema.\n  'schemas:validate': deny,\n\n  // Installs skills into local editor configuration directories.\n  'skills:install': deny,\n\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:disable': deny,\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:enable': deny,\n  'telemetry:status': allow,\n\n  // Creates authentication credentials.\n  'tokens:create': deny,\n  // Deletes authentication credentials.\n  'tokens:delete': deny,\n  // Exposes authentication credential metadata.\n  'tokens:list': deny,\n\n  // Loads local CLI and workbench configuration to identify the deployed Studio or application.\n  undeploy: deny,\n\n  // Grants a user access to a project.\n  'users:invite': deny,\n  'users:list': allow,\n\n  // Reads the local project and installed package tree.\n  versions: deny,\n}\n"],"names":["allow","conditionalDenyFlags","conditionalPolicy","deny","fieldReadsFromHost","field","separatorIndex","indexOf","headerOverridesAuthentication","header","slice","trim","toLowerCase","mcpPolicy","api","deniedFlags","validate","flags","Array","isArray","some","build","codemod","debug","deploy","dev","doctor","exec","init","install","learn","login","logout","manage","preview","undeploy","versions"],"mappings":"AAAA,SACEA,KAAK,EAELC,oBAAoB,EACpBC,iBAAiB,EACjBC,IAAI,QACC,cAAa;AAEpB;;;CAGC,GACD,SAASC,mBAAmBC,KAAc;IACxC,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMC,iBAAiBD,MAAME,OAAO,CAAC;IACrC,OAAOD,iBAAiB,KAAKD,KAAK,CAACC,iBAAiB,EAAE,KAAK;AAC7D;AAEA,yEAAyE,GACzE,SAASE,8BAA8BC,MAAe;IACpD,IAAI,OAAOA,WAAW,UAAU,OAAO;IACvC,MAAMH,iBAAiBG,OAAOF,OAAO,CAAC;IACtC,OACED,iBAAiB,KAAKG,OAAOC,KAAK,CAAC,GAAGJ,gBAAgBK,IAAI,GAAGC,WAAW,OAAO;AAEnF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,YAA8B;IACzC,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,4EAA4E;IAC5E,2DAA2D;IAC3DC,KAAKZ,kBAAkB;QACrBa,aAAa;YAAC;YAAS;SAAQ;QAC/BC,UAAU,CAAC,EAACC,KAAK,EAAC,GAChB,AAAC,CAAA,CAACC,MAAMC,OAAO,CAACF,MAAMZ,KAAK,KAAK,CAACY,MAAMZ,KAAK,CAACe,IAAI,CAAC,CAACf,QAAUD,mBAAmBC,OAAM,KACrF,CAAA,CAACa,MAAMC,OAAO,CAACF,MAAMR,MAAM,KAC1B,CAACQ,MAAMR,MAAM,CAACW,IAAI,CAAC,CAACX,SAAWD,8BAA8BC,QAAO;IAC1E;IAEA,mBAAmBT;IACnB,sDAAsD;IACtD,oBAAoBG;IACpB,kBAAkBH;IAClB,gBAAgBA;IAEhB,mEAAmE;IACnEqB,OAAOlB;IAEP,wCAAwC;IACxCmB,SAASnB;IAET,YAAYH;IACZ,eAAeA;IACf,aAAaA;IAEb,yBAAyBA;IACzB,yBAAyBA;IACzB,uBAAuBA;IACvB,yBAAyBA;IACzB,iBAAiBA;IACjB,mBAAmBA;IACnB,mBAAmBA;IACnB,+BAA+BA;IAC/B,8BAA8BA;IAC9B,8BAA8BA;IAC9B,8DAA8D;IAC9D,mBAAmBG;IACnB,yEAAyE;IACzE,mBAAmBA;IACnB,iBAAiBH;IACjB,2BAA2BA;IAC3B,2BAA2BA;IAE3B,qEAAqE;IACrEuB,OAAOpB;IAEP,qDAAqD;IACrDqB,QAAQrB;IAER,gEAAgE;IAChEsB,KAAKtB;IAEL,yDAAyD;IACzD,eAAeA;IACf,+DAA+D;IAC/D,aAAaF,qBAAqB;IAClC,eAAeD;IAEf,kEAAkE;IAClE0B,QAAQvB;IAER,6DAA6D;IAC7D,oBAAoBA;IACpB,oBAAoBH;IACpB,iBAAiBA;IACjB,mBAAmBA;IACnB,qDAAqD;IACrD,sBAAsBG;IAEtB,uDAAuD;IACvDwB,MAAMxB;IAEN,kDAAkD;IAClD,kBAAkBA;IAClB,gBAAgBH;IAChB,mGAAmG;IACnG,oBAAoBC,qBAAqB;IAEzC,iBAAiBD;IACjB,gBAAgBA;IAChB,gBAAgBA;IAChB,cAAcA;IACd,cAAcA;IAEd,oEAAoE;IACpE4B,MAAMzB;IAEN,4CAA4C;IAC5C0B,SAAS1B;IAET,yDAAyD;IACzD2B,OAAO3B;IAEP,mCAAmC;IACnC4B,OAAO5B;IAEP,qEAAqE;IACrE6B,QAAQ7B;IAER,yDAAyD;IACzD8B,QAAQ9B;IAER,8DAA8D;IAC9D,oBAAoBA;IAEpB,mDAAmD;IACnD,iBAAiBA;IAEjB,uDAAuD;IACvD,uBAAuBA;IACvB,uBAAuBH;IACvB,uDAAuD;IACvD,uBAAuBG;IACvB,+CAA+C;IAC/C,gBAAgBA;IAChB,gDAAgD;IAChD,gBAAgBA;IAEhB,uDAAuD;IACvD,qBAAqBA;IACrB,gEAAgE;IAChE,mBAAmBA;IACnB,+EAA+E;IAC/E,kBAAkBA;IAElB,+DAA+D;IAC/D,eAAeF,qBAAqB;IACpC,gBAAgBA,qBAAqB;IAErC,wBAAwBD;IACxB,wBAAwBA;IACxB,qBAAqBA;IACrB,sBAAsBA;IACtB,wBAAwBA;IAExB,mCAAmC;IACnCkC,SAAS/B;IAET,mBAAmBH;IACnB,iBAAiBA;IAEjB,uFAAuF;IACvF,kBAAkBG;IAClB,kDAAkD;IAClD,kBAAkBA;IAClB,2EAA2E;IAC3E,mBAAmBA;IACnB,+DAA+D;IAC/D,gBAAgBA;IAChB,4CAA4C;IAC5C,oBAAoBA;IAEpB,+DAA+D;IAC/D,kBAAkBA;IAElB,gFAAgF;IAChF,qBAAqBA;IACrB,gFAAgF;IAChF,oBAAoBA;IACpB,oBAAoBH;IAEpB,sCAAsC;IACtC,iBAAiBG;IACjB,sCAAsC;IACtC,iBAAiBA;IACjB,8CAA8C;IAC9C,eAAeA;IAEf,8FAA8F;IAC9FgC,UAAUhC;IAEV,qCAAqC;IACrC,gBAAgBA;IAChB,cAAcH;IAEd,sDAAsD;IACtDoC,UAAUjC;AACZ,EAAC"}

package/dist/exports/invokeSanityCli/commandPolicies/policy.js

@@ -0,0 +1,46 @@
+/**
+ * Per-source command policies for programmatic CLI invocation.
+ *
+ * A policy decides, for one invocation source (e.g. the remote MCP server),
+ * which commands may be invoked and — for conditional entries — which parsed
+ * invocations of those commands are acceptable. Policies are exhaustive:
+ * every command in this package's oclif manifest has exactly one entry, so a
+ * newly added CLI command cannot slip into (or ambiguously stay out of) the
+ * invokable surface. A unit test enforces this; at runtime an uncategorized
+ * command id fails closed (treated as deny).
+ */ /** The parsed command invocation a conditional policy is evaluated against. */ /** Every valid invocation of the command is safe. */ export const allow = {
+    kind: 'allow',
+    validate: ()=>true
+};
+/** No invocation of the command is safe. Behaves like an unknown command. */ export const deny = {
+    kind: 'deny',
+    validate: ()=>false
+};
+/**
+ * Conditional policies to deny flags. The flags are also hidden
+ * from rendered help, so hosts are never told about surface they cannot use.
+ */ export function conditionalDenyFlags(...names) {
+    return {
+        deniedFlags: names,
+        kind: 'conditional',
+        validate: ({ flags })=>names.every((name)=>flags[name] === undefined || flags[name] === false)
+    };
+}
+/**
+ * Conditional policy combining {@link conditionalDenyFlags} with an extra
+ * predicate on the parsed invocation, for conditions a flag name alone
+ * cannot express — e.g. flag values that would read from the host machine.
+ * `deniedFlags` are hidden from rendered help; the predicate is not
+ * expressible there, so flags it constrains stay advertised.
+ */ export function conditionalPolicy(options) {
+    const denyFlags = conditionalDenyFlags(...options.deniedFlags ?? []);
+    return {
+        ...denyFlags,
+        validate: (invocation)=>denyFlags.validate(invocation) && options.validate(invocation)
+    };
+}
+export function isConditionalInvocationPolicy(policy) {
+    return policy.kind === 'conditional';
+}
+
+//# sourceMappingURL=policy.js.map

package/dist/exports/invokeSanityCli/commandPolicies/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/policy.ts"],"sourcesContent":["/**\n * Per-source command policies for programmatic CLI invocation.\n *\n * A policy decides, for one invocation source (e.g. the remote MCP server),\n * which commands may be invoked and — for conditional entries — which parsed\n * invocations of those commands are acceptable. Policies are exhaustive:\n * every command in this package's oclif manifest has exactly one entry, so a\n * newly added CLI command cannot slip into (or ambiguously stay out of) the\n * invokable surface. A unit test enforces this; at runtime an uncategorized\n * command id fails closed (treated as deny).\n */\n\n/** The parsed command invocation a conditional policy is evaluated against. */\ninterface Invocation {\n  args: Readonly<Record<string, unknown>>\n  flags: Readonly<Record<string, unknown>>\n}\n\ntype InvocationPolicy = (invocation: Invocation) => boolean\n\ntype ConditionalInvocationPolicy = CommandPolicy & {\n  /**\n   * Flag names this policy refuses. Declarative so the help renderer can\n   * omit them (and examples using them) from the advertised command surface.\n   */\n  deniedFlags: readonly string[]\n\n  kind: 'conditional'\n}\n\nexport interface CommandPolicy {\n  kind: 'allow' | 'conditional' | 'deny'\n  validate: InvocationPolicy\n}\n\n/** Every valid invocation of the command is safe. */\nexport const allow: CommandPolicy = {kind: 'allow', validate: () => true}\n\n/** No invocation of the command is safe. Behaves like an unknown command. */\nexport const deny: CommandPolicy = {kind: 'deny', validate: () => false}\n\n/**\n * Conditional policies to deny flags. The flags are also hidden\n * from rendered help, so hosts are never told about surface they cannot use.\n */\nexport function conditionalDenyFlags(...names: string[]): ConditionalInvocationPolicy {\n  return {\n    deniedFlags: names,\n    kind: 'conditional',\n    validate: ({flags}) =>\n      names.every((name) => flags[name] === undefined || flags[name] === false),\n  }\n}\n\n/**\n * Conditional policy combining {@link conditionalDenyFlags} with an extra\n * predicate on the parsed invocation, for conditions a flag name alone\n * cannot express — e.g. flag values that would read from the host machine.\n * `deniedFlags` are hidden from rendered help; the predicate is not\n * expressible there, so flags it constrains stay advertised.\n */\nexport function conditionalPolicy(options: {\n  deniedFlags?: string[]\n  validate: InvocationPolicy\n}): ConditionalInvocationPolicy {\n  const denyFlags = conditionalDenyFlags(...(options.deniedFlags ?? []))\n  return {\n    ...denyFlags,\n    validate: (invocation) => denyFlags.validate(invocation) && options.validate(invocation),\n  }\n}\n\nexport function isConditionalInvocationPolicy(\n  policy: CommandPolicy,\n): policy is ConditionalInvocationPolicy {\n  return policy.kind === 'conditional'\n}\n\n/** A complete policy table, keyed by oclif command id. */\nexport type CommandPolicySet = Readonly<Record<string, CommandPolicy>>\n\n/** Where an invocation originates; selects the policy to enforce. */\nexport type InvocationSource = 'mcp'\n"],"names":["allow","kind","validate","deny","conditionalDenyFlags","names","deniedFlags","flags","every","name","undefined","conditionalPolicy","options","denyFlags","invocation","isConditionalInvocationPolicy","policy"],"mappings":"AAAA;;;;;;;;;;CAUC,GAED,6EAA6E,GAuB7E,mDAAmD,GACnD,OAAO,MAAMA,QAAuB;IAACC,MAAM;IAASC,UAAU,IAAM;AAAI,EAAC;AAEzE,2EAA2E,GAC3E,OAAO,MAAMC,OAAsB;IAACF,MAAM;IAAQC,UAAU,IAAM;AAAK,EAAC;AAExE;;;CAGC,GACD,OAAO,SAASE,qBAAqB,GAAGC,KAAe;IACrD,OAAO;QACLC,aAAaD;QACbJ,MAAM;QACNC,UAAU,CAAC,EAACK,KAAK,EAAC,GAChBF,MAAMG,KAAK,CAAC,CAACC,OAASF,KAAK,CAACE,KAAK,KAAKC,aAAaH,KAAK,CAACE,KAAK,KAAK;IACvE;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAASE,kBAAkBC,OAGjC;IACC,MAAMC,YAAYT,wBAAyBQ,QAAQN,WAAW,IAAI,EAAE;IACpE,OAAO;QACL,GAAGO,SAAS;QACZX,UAAU,CAACY,aAAeD,UAAUX,QAAQ,CAACY,eAAeF,QAAQV,QAAQ,CAACY;IAC/E;AACF;AAEA,OAAO,SAASC,8BACdC,MAAqB;IAErB,OAAOA,OAAOf,IAAI,KAAK;AACzB"}

package/dist/exports/invokeSanityCli/help.js

@@ -0,0 +1,153 @@
+import { Help } from '@oclif/core';
+import { getHelpFlagAdditions } from '@oclif/core/help';
+import { isConditionalInvocationPolicy } from './commandPolicies/policy.js';
+/** Command ids a policy exposes: entries that are not denied. */ function visibleCommandIds(policySet) {
+    return new Set(Object.entries(policySet).filter(([, policy])=>policy.kind !== 'deny').map(([id])=>id));
+}
+/** Topic names covering the visible commands: every prefix of every id. */ function visibleTopicNames(commandIds) {
+    const names = new Set();
+    for (const id of commandIds){
+        const parts = id.split(':');
+        for(let length = 1; length < parts.length; length++){
+            names.add(parts.slice(0, length).join(':'));
+        }
+    }
+    return names;
+}
+/** Thrown when help is requested for a subject outside the policy surface. */ class NotInvokableError extends Error {
+}
+/**
+ * A copy of `command` without the policy's denied flags, and without examples
+ * that use them (under any spelling: `--web`, `--w`, `-w`), so rendered help
+ * only advertises invocations the policy accepts.
+ */ function withoutDeniedFlags(command, policy) {
+    if (!policy || !isConditionalInvocationPolicy(policy)) return {
+        ...command
+    };
+    const denied = policy.deniedFlags;
+    if (denied.length === 0) return {
+        ...command
+    };
+    const flags = {
+        ...command.flags
+    };
+    const spellings = [];
+    for (const name of denied){
+        const definition = flags[name];
+        if (!definition) continue;
+        spellings.push(`--${name}`);
+        if (definition.char) spellings.push(`-${definition.char}`);
+        for (const alias of definition.aliases ?? [])spellings.push(`--${alias}`, `-${alias}`);
+        delete flags[name];
+    }
+    const usesDeniedFlag = (example)=>{
+        const text = typeof example === 'string' ? example : example.command;
+        return spellings.some((spelling)=>new RegExp(String.raw`(^|\s)${spelling}(=|\s|$)`).test(text ?? ''));
+    };
+    return {
+        ...command,
+        examples: command.examples?.filter((example)=>!usesDeniedFlag(example)),
+        flags
+    };
+}
+/**
+ * oclif help renderer scoped to a policy's command surface. Subject
+ * resolution (root vs topic vs command help) is oclif's own; the policy is
+ * enforced at the rendering entry points so the rest of the CLI stays
+ * invisible to embedding hosts, and listings are filtered to non-denied
+ * commands and their topics only.
+ *
+ * Output is collected in {@link InvokableHelp.lines} instead of being written
+ * to the process streams.
+ */ class InvokableHelp extends Help {
+    commandId;
+    lines = [];
+    commandIds;
+    policySet;
+    topicNames;
+    constructor(config, policySet){
+        super(config, {
+            stripAnsi: true
+        });
+        this.policySet = policySet;
+        this.commandIds = visibleCommandIds(policySet);
+        this.topicNames = visibleTopicNames(this.commandIds);
+    }
+    // The copies below are load-bearing: oclif's formatters rewrite ids/names
+    // in place (`cors:list` → `cors list`). Without copies those writes corrupt
+    // the shared (cached) config, breaking the policy checks on subsequent
+    // invocations.
+    get sortedCommands() {
+        return super.sortedCommands.filter((command)=>this.commandIds.has(command.id)).map((command)=>({
+                ...command
+            }));
+    }
+    get sortedTopics() {
+        // Topic names and descriptions come from the oclif config (oclif.config.js)
+        return super.sortedTopics.filter((topic)=>this.topicNames.has(topic.name)).map((topic)=>({
+                ...topic
+            }));
+    }
+    log(...args) {
+        this.lines.push(...args);
+    }
+    async showCommandHelp(command) {
+        if (!this.commandIds.has(command.id)) throw new NotInvokableError(command.id);
+        this.commandId = command.id;
+        return super.showCommandHelp(withoutDeniedFlags(command, this.policySet[command.id]));
+    }
+    async showTopicHelp(topic) {
+        if (!this.topicNames.has(topic.name)) throw new NotInvokableError(topic.name);
+        return super.showTopicHelp({
+            ...topic
+        });
+    }
+}
+/**
+ * Render help text for a policy's command surface: root help for a bare help
+ * request, or topic/command help when `argv` names a subject (e.g.
+ * `['cors', '--help']`), exactly as oclif would resolve it. ANSI styling is
+ * stripped so programmatic callers get plain text.
+ *
+ * Returns `undefined` when the subject is unknown or denied — callers should
+ * respond the same way as for an unknown command, so hosts cannot probe the
+ * full CLI surface through help.
+ *
+ * @internal
+ */ export async function renderInvokableHelp(config, argv, policySet) {
+    const help = new InvokableHelp(config, policySet);
+    try {
+        await help.showHelp(argv);
+    } catch (err) {
+        // Subjects outside the policy surface (NotInvokableError) and subjects
+        // oclif itself cannot resolve (CLIError, marked with an `oclif` property)
+        // both yield no help output.
+        if (err instanceof NotInvokableError || err.oclif) return undefined;
+        throw err;
+    }
+    return {
+        ...help.commandId && {
+            commandId: help.commandId
+        },
+        output: help.lines.join('\n').trimEnd()
+    };
+}
+/**
+ * Whether `argv` asks for help rather than a command invocation: a leading
+ * `help` (oclif's help command), or a recognized help flag before any `--`
+ * terminator. The flags come from {@link getHelpFlagAdditions} — the same
+ * source oclif's own dispatch consults — so this surface recognizes exactly
+ * what the regular CLI recognizes.
+ *
+ * @internal
+ */ export function isHelpRequest(argv, config) {
+    if (argv[0] === 'help') return true;
+    const helpFlags = getHelpFlagAdditions(config);
+    for (const token of argv){
+        if (token === '--') return false;
+        if (helpFlags.includes(token)) return true;
+    }
+    return false;
+}
+
+//# sourceMappingURL=help.js.map

package/dist/exports/invokeSanityCli/help.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/exports/invokeSanityCli/help.ts"],"sourcesContent":["import {type Command, type Config, Help, type Interfaces} from '@oclif/core'\nimport {getHelpFlagAdditions} from '@oclif/core/help'\n\nimport {\n  type CommandPolicy,\n  type CommandPolicySet,\n  isConditionalInvocationPolicy,\n} from './commandPolicies/policy.js'\n\n/** Command ids a policy exposes: entries that are not denied. */\nfunction visibleCommandIds(policySet: CommandPolicySet): Set<string> {\n  return new Set(\n    Object.entries(policySet)\n      .filter(([, policy]) => policy.kind !== 'deny')\n      .map(([id]) => id),\n  )\n}\n\n/** Topic names covering the visible commands: every prefix of every id. */\nfunction visibleTopicNames(commandIds: Set<string>): Set<string> {\n  const names = new Set<string>()\n  for (const id of commandIds) {\n    const parts = id.split(':')\n    for (let length = 1; length < parts.length; length++) {\n      names.add(parts.slice(0, length).join(':'))\n    }\n  }\n  return names\n}\n\n/** Thrown when help is requested for a subject outside the policy surface. */\nclass NotInvokableError extends Error {}\n\n/**\n * A copy of `command` without the policy's denied flags, and without examples\n * that use them (under any spelling: `--web`, `--w`, `-w`), so rendered help\n * only advertises invocations the policy accepts.\n */\nfunction withoutDeniedFlags(command: Command.Loadable, policy?: CommandPolicy): Command.Loadable {\n  if (!policy || !isConditionalInvocationPolicy(policy)) return {...command}\n\n  const denied = policy.deniedFlags\n  if (denied.length === 0) return {...command}\n\n  const flags = {...command.flags}\n  const spellings: string[] = []\n  for (const name of denied) {\n    const definition = flags[name]\n    if (!definition) continue\n    spellings.push(`--${name}`)\n    if (definition.char) spellings.push(`-${definition.char}`)\n    for (const alias of definition.aliases ?? []) spellings.push(`--${alias}`, `-${alias}`)\n    delete flags[name]\n  }\n\n  const usesDeniedFlag = (example: Command.Example) => {\n    const text = typeof example === 'string' ? example : example.command\n    return spellings.some((spelling) =>\n      new RegExp(String.raw`(^|\\s)${spelling}(=|\\s|$)`).test(text ?? ''),\n    )\n  }\n\n  return {\n    ...command,\n    examples: command.examples?.filter((example) => !usesDeniedFlag(example)),\n    flags,\n  }\n}\n\n/**\n * oclif help renderer scoped to a policy's command surface. Subject\n * resolution (root vs topic vs command help) is oclif's own; the policy is\n * enforced at the rendering entry points so the rest of the CLI stays\n * invisible to embedding hosts, and listings are filtered to non-denied\n * commands and their topics only.\n *\n * Output is collected in {@link InvokableHelp.lines} instead of being written\n * to the process streams.\n */\nclass InvokableHelp extends Help {\n  public commandId: string | undefined\n  public readonly lines: string[] = []\n\n  private readonly commandIds: Set<string>\n  private readonly policySet: CommandPolicySet\n  private readonly topicNames: Set<string>\n\n  constructor(config: Config, policySet: CommandPolicySet) {\n    super(config, {stripAnsi: true})\n    this.policySet = policySet\n    this.commandIds = visibleCommandIds(policySet)\n    this.topicNames = visibleTopicNames(this.commandIds)\n  }\n\n  // The copies below are load-bearing: oclif's formatters rewrite ids/names\n  // in place (`cors:list` → `cors list`). Without copies those writes corrupt\n  // the shared (cached) config, breaking the policy checks on subsequent\n  // invocations.\n\n  protected override get sortedCommands(): Command.Loadable[] {\n    return super.sortedCommands\n      .filter((command) => this.commandIds.has(command.id))\n      .map((command) => ({...command}))\n  }\n\n  protected override get sortedTopics(): Interfaces.Topic[] {\n    // Topic names and descriptions come from the oclif config (oclif.config.js)\n    return super.sortedTopics\n      .filter((topic) => this.topicNames.has(topic.name))\n      .map((topic) => ({...topic}))\n  }\n\n  protected override log(...args: string[]): void {\n    this.lines.push(...args)\n  }\n\n  public override async showCommandHelp(command: Command.Loadable): Promise<void> {\n    if (!this.commandIds.has(command.id)) throw new NotInvokableError(command.id)\n    this.commandId = command.id\n    return super.showCommandHelp(withoutDeniedFlags(command, this.policySet[command.id]))\n  }\n\n  protected override async showTopicHelp(topic: Interfaces.Topic): Promise<void> {\n    if (!this.topicNames.has(topic.name)) throw new NotInvokableError(topic.name)\n    return super.showTopicHelp({...topic})\n  }\n}\n\n/**\n * Render help text for a policy's command surface: root help for a bare help\n * request, or topic/command help when `argv` names a subject (e.g.\n * `['cors', '--help']`), exactly as oclif would resolve it. ANSI styling is\n * stripped so programmatic callers get plain text.\n *\n * Returns `undefined` when the subject is unknown or denied — callers should\n * respond the same way as for an unknown command, so hosts cannot probe the\n * full CLI surface through help.\n *\n * @internal\n */\nexport async function renderInvokableHelp(\n  config: Config,\n  argv: string[],\n  policySet: CommandPolicySet,\n): Promise<{commandId?: string; output: string} | undefined> {\n  const help = new InvokableHelp(config, policySet)\n  try {\n    await help.showHelp(argv)\n  } catch (err) {\n    // Subjects outside the policy surface (NotInvokableError) and subjects\n    // oclif itself cannot resolve (CLIError, marked with an `oclif` property)\n    // both yield no help output.\n    if (err instanceof NotInvokableError || err.oclif) return undefined\n    throw err\n  }\n  return {\n    ...(help.commandId && {commandId: help.commandId}),\n    output: help.lines.join('\\n').trimEnd(),\n  }\n}\n\n/**\n * Whether `argv` asks for help rather than a command invocation: a leading\n * `help` (oclif's help command), or a recognized help flag before any `--`\n * terminator. The flags come from {@link getHelpFlagAdditions} — the same\n * source oclif's own dispatch consults — so this surface recognizes exactly\n * what the regular CLI recognizes.\n *\n * @internal\n */\nexport function isHelpRequest(argv: string[], config: Config): boolean {\n  if (argv[0] === 'help') return true\n  const helpFlags = getHelpFlagAdditions(config)\n  for (const token of argv) {\n    if (token === '--') return false\n    if (helpFlags.includes(token)) return true\n  }\n  return false\n}\n"],"names":["Help","getHelpFlagAdditions","isConditionalInvocationPolicy","visibleCommandIds","policySet","Set","Object","entries","filter","policy","kind","map","id","visibleTopicNames","commandIds","names","parts","split","length","add","slice","join","NotInvokableError","Error","withoutDeniedFlags","command","denied","deniedFlags","flags","spellings","name","definition","push","char","alias","aliases","usesDeniedFlag","example","text","some","spelling","RegExp","String","raw","test","examples","InvokableHelp","commandId","lines","topicNames","config","stripAnsi","sortedCommands","has","sortedTopics","topic","log","args","showCommandHelp","showTopicHelp","renderInvokableHelp","argv","help","showHelp","err","oclif","undefined","output","trimEnd","isHelpRequest","helpFlags","token","includes"],"mappings":"AAAA,SAAmCA,IAAI,QAAwB,cAAa;AAC5E,SAAQC,oBAAoB,QAAO,mBAAkB;AAErD,SAGEC,6BAA6B,QACxB,8BAA6B;AAEpC,+DAA+D,GAC/D,SAASC,kBAAkBC,SAA2B;IACpD,OAAO,IAAIC,IACTC,OAAOC,OAAO,CAACH,WACZI,MAAM,CAAC,CAAC,GAAGC,OAAO,GAAKA,OAAOC,IAAI,KAAK,QACvCC,GAAG,CAAC,CAAC,CAACC,GAAG,GAAKA;AAErB;AAEA,yEAAyE,GACzE,SAASC,kBAAkBC,UAAuB;IAChD,MAAMC,QAAQ,IAAIV;IAClB,KAAK,MAAMO,MAAME,WAAY;QAC3B,MAAME,QAAQJ,GAAGK,KAAK,CAAC;QACvB,IAAK,IAAIC,SAAS,GAAGA,SAASF,MAAME,MAAM,EAAEA,SAAU;YACpDH,MAAMI,GAAG,CAACH,MAAMI,KAAK,CAAC,GAAGF,QAAQG,IAAI,CAAC;QACxC;IACF;IACA,OAAON;AACT;AAEA,4EAA4E,GAC5E,MAAMO,0BAA0BC;AAAO;AAEvC;;;;CAIC,GACD,SAASC,mBAAmBC,OAAyB,EAAEhB,MAAsB;IAC3E,IAAI,CAACA,UAAU,CAACP,8BAA8BO,SAAS,OAAO;QAAC,GAAGgB,OAAO;IAAA;IAEzE,MAAMC,SAASjB,OAAOkB,WAAW;IACjC,IAAID,OAAOR,MAAM,KAAK,GAAG,OAAO;QAAC,GAAGO,OAAO;IAAA;IAE3C,MAAMG,QAAQ;QAAC,GAAGH,QAAQG,KAAK;IAAA;IAC/B,MAAMC,YAAsB,EAAE;IAC9B,KAAK,MAAMC,QAAQJ,OAAQ;QACzB,MAAMK,aAAaH,KAAK,CAACE,KAAK;QAC9B,IAAI,CAACC,YAAY;QACjBF,UAAUG,IAAI,CAAC,CAAC,EAAE,EAAEF,MAAM;QAC1B,IAAIC,WAAWE,IAAI,EAAEJ,UAAUG,IAAI,CAAC,CAAC,CAAC,EAAED,WAAWE,IAAI,EAAE;QACzD,KAAK,MAAMC,SAASH,WAAWI,OAAO,IAAI,EAAE,CAAEN,UAAUG,IAAI,CAAC,CAAC,EAAE,EAAEE,OAAO,EAAE,CAAC,CAAC,EAAEA,OAAO;QACtF,OAAON,KAAK,CAACE,KAAK;IACpB;IAEA,MAAMM,iBAAiB,CAACC;QACtB,MAAMC,OAAO,OAAOD,YAAY,WAAWA,UAAUA,QAAQZ,OAAO;QACpE,OAAOI,UAAUU,IAAI,CAAC,CAACC,WACrB,IAAIC,OAAOC,OAAOC,GAAG,CAAC,MAAM,EAAEH,SAAS,QAAQ,CAAC,EAAEI,IAAI,CAACN,QAAQ;IAEnE;IAEA,OAAO;QACL,GAAGb,OAAO;QACVoB,UAAUpB,QAAQoB,QAAQ,EAAErC,OAAO,CAAC6B,UAAY,CAACD,eAAeC;QAChET;IACF;AACF;AAEA;;;;;;;;;CASC,GACD,MAAMkB,sBAAsB9C;IACnB+C,UAA6B;IACpBC,QAAkB,EAAE,CAAA;IAEnBlC,WAAuB;IACvBV,UAA2B;IAC3B6C,WAAuB;IAExC,YAAYC,MAAc,EAAE9C,SAA2B,CAAE;QACvD,KAAK,CAAC8C,QAAQ;YAACC,WAAW;QAAI;QAC9B,IAAI,CAAC/C,SAAS,GAAGA;QACjB,IAAI,CAACU,UAAU,GAAGX,kBAAkBC;QACpC,IAAI,CAAC6C,UAAU,GAAGpC,kBAAkB,IAAI,CAACC,UAAU;IACrD;IAEA,0EAA0E;IAC1E,4EAA4E;IAC5E,uEAAuE;IACvE,eAAe;IAEf,IAAuBsC,iBAAqC;QAC1D,OAAO,KAAK,CAACA,eACV5C,MAAM,CAAC,CAACiB,UAAY,IAAI,CAACX,UAAU,CAACuC,GAAG,CAAC5B,QAAQb,EAAE,GAClDD,GAAG,CAAC,CAACc,UAAa,CAAA;gBAAC,GAAGA,OAAO;YAAA,CAAA;IAClC;IAEA,IAAuB6B,eAAmC;QACxD,4EAA4E;QAC5E,OAAO,KAAK,CAACA,aACV9C,MAAM,CAAC,CAAC+C,QAAU,IAAI,CAACN,UAAU,CAACI,GAAG,CAACE,MAAMzB,IAAI,GAChDnB,GAAG,CAAC,CAAC4C,QAAW,CAAA;gBAAC,GAAGA,KAAK;YAAA,CAAA;IAC9B;IAEmBC,IAAI,GAAGC,IAAc,EAAQ;QAC9C,IAAI,CAACT,KAAK,CAAChB,IAAI,IAAIyB;IACrB;IAEA,MAAsBC,gBAAgBjC,OAAyB,EAAiB;QAC9E,IAAI,CAAC,IAAI,CAACX,UAAU,CAACuC,GAAG,CAAC5B,QAAQb,EAAE,GAAG,MAAM,IAAIU,kBAAkBG,QAAQb,EAAE;QAC5E,IAAI,CAACmC,SAAS,GAAGtB,QAAQb,EAAE;QAC3B,OAAO,KAAK,CAAC8C,gBAAgBlC,mBAAmBC,SAAS,IAAI,CAACrB,SAAS,CAACqB,QAAQb,EAAE,CAAC;IACrF;IAEA,MAAyB+C,cAAcJ,KAAuB,EAAiB;QAC7E,IAAI,CAAC,IAAI,CAACN,UAAU,CAACI,GAAG,CAACE,MAAMzB,IAAI,GAAG,MAAM,IAAIR,kBAAkBiC,MAAMzB,IAAI;QAC5E,OAAO,KAAK,CAAC6B,cAAc;YAAC,GAAGJ,KAAK;QAAA;IACtC;AACF;AAEA;;;;;;;;;;;CAWC,GACD,OAAO,eAAeK,oBACpBV,MAAc,EACdW,IAAc,EACdzD,SAA2B;IAE3B,MAAM0D,OAAO,IAAIhB,cAAcI,QAAQ9C;IACvC,IAAI;QACF,MAAM0D,KAAKC,QAAQ,CAACF;IACtB,EAAE,OAAOG,KAAK;QACZ,uEAAuE;QACvE,0EAA0E;QAC1E,6BAA6B;QAC7B,IAAIA,eAAe1C,qBAAqB0C,IAAIC,KAAK,EAAE,OAAOC;QAC1D,MAAMF;IACR;IACA,OAAO;QACL,GAAIF,KAAKf,SAAS,IAAI;YAACA,WAAWe,KAAKf,SAAS;QAAA,CAAC;QACjDoB,QAAQL,KAAKd,KAAK,CAAC3B,IAAI,CAAC,MAAM+C,OAAO;IACvC;AACF;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASC,cAAcR,IAAc,EAAEX,MAAc;IAC1D,IAAIW,IAAI,CAAC,EAAE,KAAK,QAAQ,OAAO;IAC/B,MAAMS,YAAYrE,qBAAqBiD;IACvC,KAAK,MAAMqB,SAASV,KAAM;QACxB,IAAIU,UAAU,MAAM,OAAO;QAC3B,IAAID,UAAUE,QAAQ,CAACD,QAAQ,OAAO;IACxC;IACA,OAAO;AACT"}

package/dist/exports/invokeSanityCli/index.d.ts

@@ -0,0 +1,73 @@
+import { Config } from "@oclif/core";
+import { SanityEnvironment } from "@sanity/cli-core/executionContext";
+
+/** Where an invocation originates; selects the policy to enforce. */
+declare type InvocationSource = "mcp";
+
+/**
+ * Run a policy-permitted CLI command in-process and capture its result.
+ *
+ * Command-level failures (unknown command, bad flags, API errors) are
+ * reported through `exitCode`/`output` rather than thrown, so callers can
+ * relay them verbatim.
+ *
+ * @internal
+ */
+export declare function invokeSanityCli({
+  args,
+  config,
+  sanityEnv,
+  source,
+  token,
+}: InvokeSanityCliOptions): Promise<InvokeSanityCliResult>;
+
+/**
+ * @internal
+ */
+export declare interface InvokeSanityCliOptions {
+  /**
+   * Arguments after `sanity` (a leading `sanity` token is tolerated), either
+   * as a single string — shell-style quoting is supported, but no shell is
+   * ever executed — or as a pre-split argv array.
+   */
+  args: string | string[];
+  /**
+   * Where this invocation originates. Selects the command policy to enforce:
+   * which commands are invokable and which invocations of them are permitted.
+   */
+  source: InvocationSource;
+  /**
+   * Auth token for this invocation. Scoped to this call via the CLI execution
+   * context: it never touches process env or the process-wide token cache, so
+   * concurrent invocations with different tokens are fully isolated.
+   */
+  token: string;
+  /**
+   * Optional oclif config override (mainly for tests). Defaults to this
+   * package's config, loaded once and cached across invocations.
+   */
+  config?: Config;
+  /**
+   * Sanity deployment environment for this invocation. Scoped to this call
+   * via the CLI execution context and defaults to `SANITY_INTERNAL_ENV` (or
+   * production when it is unset).
+   */
+  sanityEnv?: SanityEnvironment;
+}
+
+/**
+ * @internal
+ */
+export declare interface InvokeSanityCliResult {
+  /** `0` on success, the command's exit code otherwise. */
+  exitCode: number;
+  /** Combined stdout and stderr output, in emission order. */
+  output: string;
+  /**
+   * Canonical oclif command id when the invocation resolved to a command
+   * exposed by the selected policy (for example, `datasets:create`).
+   */
+  commandId?: string;
+}
+
+export {};