@sanity/cli 7.15.0 → 7.16.0

package/dist/commands/tokens/list.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/commands/tokens/list.ts"],"sourcesContent":["import {Flags} from '@oclif/core'\nimport {exitCodes, SanityCommand, subdebug} from '@sanity/cli-core'\nimport {getErrorMessage} from '@sanity/cli-core/errors'\nimport {Table} from 'console-table-printer'\n\nimport {type Token} from '../../actions/tokens/types.js'\nimport {promptForProject} from '../../prompts/promptForProject.js'\nimport {getTokens} from '../../services/tokens.js'\nimport {getProjectIdFlag} from '../../util/sharedFlags.js'\n\nconst listTokenDebug = subdebug('tokens:list')\n\nexport class TokensListCommand extends SanityCommand<typeof TokensListCommand> {\n  static override description = 'List API tokens for the project'\n  static override examples = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'List tokens for the project',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --json',\n      description: 'List tokens in JSON format',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --project-id abc123',\n      description: 'List tokens for a specific project',\n    },\n  ]\n  static override flags = {\n    ...getProjectIdFlag({\n      description: 'Project ID to list tokens for',\n      semantics: 'override',\n    }),\n    json: Flags.boolean({\n      default: false,\n      description: 'Output tokens in JSON format',\n    }),\n  }\n\n  static override hiddenAliases: string[] = ['token:list']\n\n  public async run(): Promise<void> {\n    const {flags} = await this.parse(TokensListCommand)\n    const {json} = flags\n    const outputJson = json ?? false\n\n    // Ensure we have project context\n    const projectId = await this.getProjectId({\n      fallback: () =>\n        promptForProject({\n          requiredPermissions: [{grant: 'read', permission: 'sanity.project.tokens'}],\n        }),\n    })\n\n    let tokens: Token[]\n    try {\n      tokens = await getTokens(projectId)\n    } catch (error) {\n      const message = getErrorMessage(error)\n      listTokenDebug(`Error fetching tokens for project ${projectId}`, error)\n      this.error(`Token list retrieval failed:\\n${message}`, {exit: exitCodes.RUNTIME_ERROR})\n    }\n\n    if (outputJson) {\n      this.log(JSON.stringify(tokens, null, 2))\n      return\n    }\n\n    if (tokens.length === 0) {\n      this.log('No API tokens found for this project.')\n      return\n    }\n\n    const table = new Table({\n      columns: [\n        {alignment: 'left', maxLen: 40, name: 'label', title: 'Label'},\n        {alignment: 'left', maxLen: 20, name: 'id', title: 'Token ID'},\n        {alignment: 'left', maxLen: 30, name: 'roles', title: 'Roles'},\n      ],\n      title: `Found ${tokens.length} API tokens`,\n    })\n\n    for (const token of tokens) {\n      const roles = token.roles?.map((role) => role.title).join(', ') || 'No roles'\n      const truncatedLabel =\n        token.label.length > 37 ? `${token.label.slice(0, 37)}...` : token.label\n      const truncatedRoles = roles.length > 27 ? `${roles.slice(0, 27)}...` : roles\n\n      table.addRow({\n        id: token.id,\n        label: truncatedLabel,\n        roles: truncatedRoles,\n      })\n    }\n\n    table.printTable()\n  }\n}\n"],"names":["Flags","exitCodes","SanityCommand","subdebug","getErrorMessage","Table","promptForProject","getTokens","getProjectIdFlag","listTokenDebug","TokensListCommand","description","examples","command","flags","semantics","json","boolean","default","hiddenAliases","run","parse","outputJson","projectId","getProjectId","fallback","requiredPermissions","grant","permission","tokens","error","message","exit","RUNTIME_ERROR","log","JSON","stringify","length","table","columns","alignment","maxLen","name","title","token","roles","map","role","join","truncatedLabel","label","slice","truncatedRoles","addRow","id","printTable"],"mappings":"AAAA,SAAQA,KAAK,QAAO,cAAa;AACjC,SAAQC,SAAS,EAAEC,aAAa,EAAEC,QAAQ,QAAO,mBAAkB;AACnE,SAAQC,eAAe,QAAO,0BAAyB;AACvD,SAAQC,KAAK,QAAO,wBAAuB;AAG3C,SAAQC,gBAAgB,QAAO,oCAAmC;AAClE,SAAQC,SAAS,QAAO,2BAA0B;AAClD,SAAQC,gBAAgB,QAAO,4BAA2B;AAE1D,MAAMC,iBAAiBN,SAAS;AAEhC,OAAO,MAAMO,0BAA0BR;IACrC,OAAgBS,cAAc,kCAAiC;IAC/D,OAAgBC,WAAW;QACzB;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtB,GAAGN,iBAAiB;YAClBG,aAAa;YACbI,WAAW;QACb,EAAE;QACFC,MAAMhB,MAAMiB,OAAO,CAAC;YAClBC,SAAS;YACTP,aAAa;QACf;IACF,EAAC;IAED,OAAgBQ,gBAA0B;QAAC;KAAa,CAAA;IAExD,MAAaC,MAAqB;QAChC,MAAM,EAACN,KAAK,EAAC,GAAG,MAAM,IAAI,CAACO,KAAK,CAACX;QACjC,MAAM,EAACM,IAAI,EAAC,GAAGF;QACf,MAAMQ,aAAaN,QAAQ;QAE3B,iCAAiC;QACjC,MAAMO,YAAY,MAAM,IAAI,CAACC,YAAY,CAAC;YACxCC,UAAU,IACRnB,iBAAiB;oBACfoB,qBAAqB;wBAAC;4BAACC,OAAO;4BAAQC,YAAY;wBAAuB;qBAAE;gBAC7E;QACJ;QAEA,IAAIC;QACJ,IAAI;YACFA,SAAS,MAAMtB,UAAUgB;QAC3B,EAAE,OAAOO,OAAO;YACd,MAAMC,UAAU3B,gBAAgB0B;YAChCrB,eAAe,CAAC,kCAAkC,EAAEc,WAAW,EAAEO;YACjE,IAAI,CAACA,KAAK,CAAC,CAAC,8BAA8B,EAAEC,SAAS,EAAE;gBAACC,MAAM/B,UAAUgC,aAAa;YAAA;QACvF;QAEA,IAAIX,YAAY;YACd,IAAI,CAACY,GAAG,CAACC,KAAKC,SAAS,CAACP,QAAQ,MAAM;YACtC;QACF;QAEA,IAAIA,OAAOQ,MAAM,KAAK,GAAG;YACvB,IAAI,CAACH,GAAG,CAAC;YACT;QACF;QAEA,MAAMI,QAAQ,IAAIjC,MAAM;YACtBkC,SAAS;gBACP;oBAACC,WAAW;oBAAQC,QAAQ;oBAAIC,MAAM;oBAASC,OAAO;gBAAO;gBAC7D;oBAACH,WAAW;oBAAQC,QAAQ;oBAAIC,MAAM;oBAAMC,OAAO;gBAAU;gBAC7D;oBAACH,WAAW;oBAAQC,QAAQ;oBAAIC,MAAM;oBAASC,OAAO;gBAAO;aAC9D;YACDA,OAAO,CAAC,MAAM,EAAEd,OAAOQ,MAAM,CAAC,WAAW,CAAC;QAC5C;QAEA,KAAK,MAAMO,SAASf,OAAQ;YAC1B,MAAMgB,QAAQD,MAAMC,KAAK,EAAEC,IAAI,CAACC,OAASA,KAAKJ,KAAK,EAAEK,KAAK,SAAS;YACnE,MAAMC,iBACJL,MAAMM,KAAK,CAACb,MAAM,GAAG,KAAK,GAAGO,MAAMM,KAAK,CAACC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GAAGP,MAAMM,KAAK;YAC1E,MAAME,iBAAiBP,MAAMR,MAAM,GAAG,KAAK,GAAGQ,MAAMM,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GAAGN;YAExEP,MAAMe,MAAM,CAAC;gBACXC,IAAIV,MAAMU,EAAE;gBACZJ,OAAOD;gBACPJ,OAAOO;YACT;QACF;QAEAd,MAAMiB,UAAU;IAClB;AACF"}
+{"version":3,"sources":["../../../src/commands/tokens/list.ts"],"sourcesContent":["import {Flags} from '@oclif/core'\nimport {exitCodes, SanityCommand, subdebug} from '@sanity/cli-core'\nimport {getErrorMessage} from '@sanity/cli-core/errors'\nimport {Table} from 'console-table-printer'\n\nimport {type Token} from '../../actions/tokens/types.js'\nimport {promptForProject} from '../../prompts/promptForProject.js'\nimport {getTokens} from '../../services/tokens.js'\nimport {getProjectIdFlag} from '../../util/sharedFlags.js'\n\nconst listTokenDebug = subdebug('tokens:list')\n\nexport class TokensListCommand extends SanityCommand<typeof TokensListCommand> {\n  static override description = 'List API tokens for the project'\n  static override examples = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'List tokens for the project',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --json',\n      description: 'List tokens in JSON format',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --project-id abc123',\n      description: 'List tokens for a specific project',\n    },\n  ]\n  static override flags = {\n    ...getProjectIdFlag({\n      description: 'Project ID to list tokens for',\n      semantics: 'override',\n    }),\n    json: Flags.boolean({\n      default: false,\n      description: 'Output tokens in JSON format',\n    }),\n  }\n\n  static override hiddenAliases: string[] = ['token:list']\n\n  public async run(): Promise<void> {\n    const {flags} = await this.parse(TokensListCommand)\n    const {json} = flags\n    const outputJson = json ?? false\n\n    // Ensure we have project context\n    const projectId = await this.getProjectId({\n      fallback: () =>\n        promptForProject({\n          requiredPermissions: [{grant: 'read', permission: 'sanity.project.tokens'}],\n        }),\n    })\n\n    let tokens: Token[]\n    try {\n      tokens = await getTokens(projectId)\n    } catch (error) {\n      const message = getErrorMessage(error)\n      listTokenDebug(`Error fetching tokens for project ${projectId}`, error)\n      this.error(`Token list retrieval failed:\\n${message}`, {exit: exitCodes.RUNTIME_ERROR})\n    }\n\n    if (outputJson) {\n      this.log(JSON.stringify(tokens, null, 2))\n      return\n    }\n\n    if (tokens.length === 0) {\n      this.log('No API tokens found for this project.')\n      return\n    }\n\n    const table = new Table({\n      columns: [\n        {alignment: 'left', maxLen: 40, name: 'label', title: 'Label'},\n        {alignment: 'left', maxLen: 20, name: 'id', title: 'Token ID'},\n        {alignment: 'left', maxLen: 30, name: 'roles', title: 'Roles'},\n      ],\n      title: `Found ${tokens.length} API tokens`,\n    })\n\n    for (const token of tokens) {\n      const roles = token.roles?.map((role) => role.title).join(', ') || 'No roles'\n      const truncatedLabel =\n        token.label.length > 37 ? `${token.label.slice(0, 37)}...` : token.label\n      const truncatedRoles = roles.length > 27 ? `${roles.slice(0, 27)}...` : roles\n\n      table.addRow({\n        id: token.id,\n        label: truncatedLabel,\n        roles: truncatedRoles,\n      })\n    }\n\n    this.log(table.render())\n  }\n}\n"],"names":["Flags","exitCodes","SanityCommand","subdebug","getErrorMessage","Table","promptForProject","getTokens","getProjectIdFlag","listTokenDebug","TokensListCommand","description","examples","command","flags","semantics","json","boolean","default","hiddenAliases","run","parse","outputJson","projectId","getProjectId","fallback","requiredPermissions","grant","permission","tokens","error","message","exit","RUNTIME_ERROR","log","JSON","stringify","length","table","columns","alignment","maxLen","name","title","token","roles","map","role","join","truncatedLabel","label","slice","truncatedRoles","addRow","id","render"],"mappings":"AAAA,SAAQA,KAAK,QAAO,cAAa;AACjC,SAAQC,SAAS,EAAEC,aAAa,EAAEC,QAAQ,QAAO,mBAAkB;AACnE,SAAQC,eAAe,QAAO,0BAAyB;AACvD,SAAQC,KAAK,QAAO,wBAAuB;AAG3C,SAAQC,gBAAgB,QAAO,oCAAmC;AAClE,SAAQC,SAAS,QAAO,2BAA0B;AAClD,SAAQC,gBAAgB,QAAO,4BAA2B;AAE1D,MAAMC,iBAAiBN,SAAS;AAEhC,OAAO,MAAMO,0BAA0BR;IACrC,OAAgBS,cAAc,kCAAiC;IAC/D,OAAgBC,WAAW;QACzB;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtB,GAAGN,iBAAiB;YAClBG,aAAa;YACbI,WAAW;QACb,EAAE;QACFC,MAAMhB,MAAMiB,OAAO,CAAC;YAClBC,SAAS;YACTP,aAAa;QACf;IACF,EAAC;IAED,OAAgBQ,gBAA0B;QAAC;KAAa,CAAA;IAExD,MAAaC,MAAqB;QAChC,MAAM,EAACN,KAAK,EAAC,GAAG,MAAM,IAAI,CAACO,KAAK,CAACX;QACjC,MAAM,EAACM,IAAI,EAAC,GAAGF;QACf,MAAMQ,aAAaN,QAAQ;QAE3B,iCAAiC;QACjC,MAAMO,YAAY,MAAM,IAAI,CAACC,YAAY,CAAC;YACxCC,UAAU,IACRnB,iBAAiB;oBACfoB,qBAAqB;wBAAC;4BAACC,OAAO;4BAAQC,YAAY;wBAAuB;qBAAE;gBAC7E;QACJ;QAEA,IAAIC;QACJ,IAAI;YACFA,SAAS,MAAMtB,UAAUgB;QAC3B,EAAE,OAAOO,OAAO;YACd,MAAMC,UAAU3B,gBAAgB0B;YAChCrB,eAAe,CAAC,kCAAkC,EAAEc,WAAW,EAAEO;YACjE,IAAI,CAACA,KAAK,CAAC,CAAC,8BAA8B,EAAEC,SAAS,EAAE;gBAACC,MAAM/B,UAAUgC,aAAa;YAAA;QACvF;QAEA,IAAIX,YAAY;YACd,IAAI,CAACY,GAAG,CAACC,KAAKC,SAAS,CAACP,QAAQ,MAAM;YACtC;QACF;QAEA,IAAIA,OAAOQ,MAAM,KAAK,GAAG;YACvB,IAAI,CAACH,GAAG,CAAC;YACT;QACF;QAEA,MAAMI,QAAQ,IAAIjC,MAAM;YACtBkC,SAAS;gBACP;oBAACC,WAAW;oBAAQC,QAAQ;oBAAIC,MAAM;oBAASC,OAAO;gBAAO;gBAC7D;oBAACH,WAAW;oBAAQC,QAAQ;oBAAIC,MAAM;oBAAMC,OAAO;gBAAU;gBAC7D;oBAACH,WAAW;oBAAQC,QAAQ;oBAAIC,MAAM;oBAASC,OAAO;gBAAO;aAC9D;YACDA,OAAO,CAAC,MAAM,EAAEd,OAAOQ,MAAM,CAAC,WAAW,CAAC;QAC5C;QAEA,KAAK,MAAMO,SAASf,OAAQ;YAC1B,MAAMgB,QAAQD,MAAMC,KAAK,EAAEC,IAAI,CAACC,OAASA,KAAKJ,KAAK,EAAEK,KAAK,SAAS;YACnE,MAAMC,iBACJL,MAAMM,KAAK,CAACb,MAAM,GAAG,KAAK,GAAGO,MAAMM,KAAK,CAACC,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GAAGP,MAAMM,KAAK;YAC1E,MAAME,iBAAiBP,MAAMR,MAAM,GAAG,KAAK,GAAGQ,MAAMM,KAAK,CAAC,GAAG,IAAI,GAAG,CAAC,GAAGN;YAExEP,MAAMe,MAAM,CAAC;gBACXC,IAAIV,MAAMU,EAAE;gBACZJ,OAAOD;gBACPJ,OAAOO;YACT;QACF;QAEA,IAAI,CAAClB,GAAG,CAACI,MAAMiB,MAAM;IACvB;AACF"}

package/dist/commands/users/list.js

@@ -93,6 +93,10 @@ export class List extends SanityCommand {
             includeRobots: robots,
             projectId
         });
+        if (members.length === 0) {
+            this.log('No members found for this project.');
+            return;
+        }
         const ordered = sortBy(members.map(({ date, id, name, roles })=>[
                 id,
                 name,
@@ -140,7 +144,7 @@ export class List extends SanityCommand {
                 roles: dimText(roles, isPending)
             });
         }
-        table.printTable();
+        this.log(table.render());
     }
 }
 

package/dist/commands/users/list.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/commands/users/list.ts"],"sourcesContent":["import {styleText} from 'node:util'\n\nimport {Flags} from '@oclif/core'\nimport {SanityCommand} from '@sanity/cli-core'\nimport {Table} from 'console-table-printer'\nimport sortBy from 'lodash-es/sortBy.js'\n\nimport {getMembersForProject} from '../../actions/users/getMembersForProject.js'\nimport {promptForProject} from '../../prompts/promptForProject.js'\nimport {getProjectIdFlag} from '../../util/sharedFlags.js'\n\nconst sortFields = ['id', 'name', 'role', 'date']\n\nfunction dimText(value: string, isDim: boolean): string {\n  return isDim ? styleText('dim', value) : value\n}\n\nexport class List extends SanityCommand<typeof List> {\n  static override description = 'List project members'\n  static override examples = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'List all users of the project',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --no-invitations --no-robots',\n      description: 'List all users of the project, but exclude pending invitations and robots',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --sort role',\n      description: 'List all users, sorted by role',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --project-id abc123',\n      description: 'List users for a specific project',\n    },\n  ]\n  static override flags = {\n    ...getProjectIdFlag({\n      description: 'Project ID to list users for',\n      semantics: 'override',\n    }),\n    invitations: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Includes or excludes pending invitations',\n    }),\n    order: Flags.string({\n      default: 'asc',\n      description: 'Sort output ascending/descending',\n      options: ['asc', 'desc'],\n    }),\n    robots: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Includes or excludes robots (token users)',\n    }),\n    sort: Flags.string({\n      default: 'date',\n      description: 'Sort users by specified column',\n      options: ['id', 'name', 'role', 'date'],\n    }),\n  }\n\n  static override hiddenAliases: string[] = ['user:list']\n\n  public async run(): Promise<void> {\n    const {invitations, order, robots, sort} = this.flags\n\n    const projectId = await this.getProjectId({\n      fallback: () =>\n        promptForProject({\n          requiredPermissions: [\n            {grant: 'read', permission: 'sanity.project'},\n            {grant: 'read', permission: 'sanity.project.members'},\n          ],\n        }),\n    })\n\n    const members = await getMembersForProject({\n      includeInvitations: invitations,\n      includeRobots: robots,\n      projectId,\n    })\n\n    const ordered = sortBy(\n      members.map(({date, id, name, roles}) => [\n        id,\n        name,\n        roles\n          ?.map((role) => role.title)\n          .join(', ')\n          .trim() || '-',\n        date,\n      ]),\n      [sortFields.indexOf(sort)],\n    )\n\n    const rows = order === 'asc' ? ordered : ordered.toReversed()\n\n    const table = new Table({\n      columns: [\n        {alignment: 'left', maxLen: 30, name: 'id', title: 'ID'},\n        {alignment: 'left', maxLen: 40, name: 'name', title: 'Name'},\n        {alignment: 'left', maxLen: 30, name: 'roles', title: 'Roles'},\n        {alignment: 'left', maxLen: 12, name: 'date', title: 'Date'},\n      ],\n      rowSeparator: true,\n    })\n\n    for (const [id, name, roles, date] of rows) {\n      const isPending = id === '<pending>'\n      table.addRow({\n        date: dimText(date, isPending),\n        id: dimText(id, isPending),\n        name: dimText(name, isPending),\n        roles: dimText(roles, isPending),\n      })\n    }\n\n    table.printTable()\n  }\n}\n"],"names":["styleText","Flags","SanityCommand","Table","sortBy","getMembersForProject","promptForProject","getProjectIdFlag","sortFields","dimText","value","isDim","List","description","examples","command","flags","semantics","invitations","boolean","allowNo","default","order","string","options","robots","sort","hiddenAliases","run","projectId","getProjectId","fallback","requiredPermissions","grant","permission","members","includeInvitations","includeRobots","ordered","map","date","id","name","roles","role","title","join","trim","indexOf","rows","toReversed","table","columns","alignment","maxLen","rowSeparator","isPending","addRow","printTable"],"mappings":"AAAA,SAAQA,SAAS,QAAO,YAAW;AAEnC,SAAQC,KAAK,QAAO,cAAa;AACjC,SAAQC,aAAa,QAAO,mBAAkB;AAC9C,SAAQC,KAAK,QAAO,wBAAuB;AAC3C,OAAOC,YAAY,sBAAqB;AAExC,SAAQC,oBAAoB,QAAO,8CAA6C;AAChF,SAAQC,gBAAgB,QAAO,oCAAmC;AAClE,SAAQC,gBAAgB,QAAO,4BAA2B;AAE1D,MAAMC,aAAa;IAAC;IAAM;IAAQ;IAAQ;CAAO;AAEjD,SAASC,QAAQC,KAAa,EAAEC,KAAc;IAC5C,OAAOA,QAAQX,UAAU,OAAOU,SAASA;AAC3C;AAEA,OAAO,MAAME,aAAaV;IACxB,OAAgBW,cAAc,uBAAsB;IACpD,OAAgBC,WAAW;QACzB;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtB,GAAGT,iBAAiB;YAClBM,aAAa;YACbI,WAAW;QACb,EAAE;QACFC,aAAajB,MAAMkB,OAAO,CAAC;YACzBC,SAAS;YACTC,SAAS;YACTR,aAAa;QACf;QACAS,OAAOrB,MAAMsB,MAAM,CAAC;YAClBF,SAAS;YACTR,aAAa;YACbW,SAAS;gBAAC;gBAAO;aAAO;QAC1B;QACAC,QAAQxB,MAAMkB,OAAO,CAAC;YACpBC,SAAS;YACTC,SAAS;YACTR,aAAa;QACf;QACAa,MAAMzB,MAAMsB,MAAM,CAAC;YACjBF,SAAS;YACTR,aAAa;YACbW,SAAS;gBAAC;gBAAM;gBAAQ;gBAAQ;aAAO;QACzC;IACF,EAAC;IAED,OAAgBG,gBAA0B;QAAC;KAAY,CAAA;IAEvD,MAAaC,MAAqB;QAChC,MAAM,EAACV,WAAW,EAAEI,KAAK,EAAEG,MAAM,EAAEC,IAAI,EAAC,GAAG,IAAI,CAACV,KAAK;QAErD,MAAMa,YAAY,MAAM,IAAI,CAACC,YAAY,CAAC;YACxCC,UAAU,IACRzB,iBAAiB;oBACf0B,qBAAqB;wBACnB;4BAACC,OAAO;4BAAQC,YAAY;wBAAgB;wBAC5C;4BAACD,OAAO;4BAAQC,YAAY;wBAAwB;qBACrD;gBACH;QACJ;QAEA,MAAMC,UAAU,MAAM9B,qBAAqB;YACzC+B,oBAAoBlB;YACpBmB,eAAeZ;YACfI;QACF;QAEA,MAAMS,UAAUlC,OACd+B,QAAQI,GAAG,CAAC,CAAC,EAACC,IAAI,EAAEC,EAAE,EAAEC,IAAI,EAAEC,KAAK,EAAC,GAAK;gBACvCF;gBACAC;gBACAC,OACIJ,IAAI,CAACK,OAASA,KAAKC,KAAK,EACzBC,KAAK,MACLC,UAAU;gBACbP;aACD,GACD;YAAChC,WAAWwC,OAAO,CAACtB;SAAM;QAG5B,MAAMuB,OAAO3B,UAAU,QAAQgB,UAAUA,QAAQY,UAAU;QAE3D,MAAMC,QAAQ,IAAIhD,MAAM;YACtBiD,SAAS;gBACP;oBAACC,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAAMG,OAAO;gBAAI;gBACvD;oBAACQ,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAAQG,OAAO;gBAAM;gBAC3D;oBAACQ,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAASG,OAAO;gBAAO;gBAC7D;oBAACQ,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAAQG,OAAO;gBAAM;aAC5D;YACDU,cAAc;QAChB;QAEA,KAAK,MAAM,CAACd,IAAIC,MAAMC,OAAOH,KAAK,IAAIS,KAAM;YAC1C,MAAMO,YAAYf,OAAO;YACzBU,MAAMM,MAAM,CAAC;gBACXjB,MAAM/B,QAAQ+B,MAAMgB;gBACpBf,IAAIhC,QAAQgC,IAAIe;gBAChBd,MAAMjC,QAAQiC,MAAMc;gBACpBb,OAAOlC,QAAQkC,OAAOa;YACxB;QACF;QAEAL,MAAMO,UAAU;IAClB;AACF"}
+{"version":3,"sources":["../../../src/commands/users/list.ts"],"sourcesContent":["import {styleText} from 'node:util'\n\nimport {Flags} from '@oclif/core'\nimport {SanityCommand} from '@sanity/cli-core'\nimport {Table} from 'console-table-printer'\nimport sortBy from 'lodash-es/sortBy.js'\n\nimport {getMembersForProject} from '../../actions/users/getMembersForProject.js'\nimport {promptForProject} from '../../prompts/promptForProject.js'\nimport {getProjectIdFlag} from '../../util/sharedFlags.js'\n\nconst sortFields = ['id', 'name', 'role', 'date']\n\nfunction dimText(value: string, isDim: boolean): string {\n  return isDim ? styleText('dim', value) : value\n}\n\nexport class List extends SanityCommand<typeof List> {\n  static override description = 'List project members'\n  static override examples = [\n    {\n      command: '<%= config.bin %> <%= command.id %>',\n      description: 'List all users of the project',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --no-invitations --no-robots',\n      description: 'List all users of the project, but exclude pending invitations and robots',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --sort role',\n      description: 'List all users, sorted by role',\n    },\n    {\n      command: '<%= config.bin %> <%= command.id %> --project-id abc123',\n      description: 'List users for a specific project',\n    },\n  ]\n  static override flags = {\n    ...getProjectIdFlag({\n      description: 'Project ID to list users for',\n      semantics: 'override',\n    }),\n    invitations: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Includes or excludes pending invitations',\n    }),\n    order: Flags.string({\n      default: 'asc',\n      description: 'Sort output ascending/descending',\n      options: ['asc', 'desc'],\n    }),\n    robots: Flags.boolean({\n      allowNo: true,\n      default: true,\n      description: 'Includes or excludes robots (token users)',\n    }),\n    sort: Flags.string({\n      default: 'date',\n      description: 'Sort users by specified column',\n      options: ['id', 'name', 'role', 'date'],\n    }),\n  }\n\n  static override hiddenAliases: string[] = ['user:list']\n\n  public async run(): Promise<void> {\n    const {invitations, order, robots, sort} = this.flags\n\n    const projectId = await this.getProjectId({\n      fallback: () =>\n        promptForProject({\n          requiredPermissions: [\n            {grant: 'read', permission: 'sanity.project'},\n            {grant: 'read', permission: 'sanity.project.members'},\n          ],\n        }),\n    })\n\n    const members = await getMembersForProject({\n      includeInvitations: invitations,\n      includeRobots: robots,\n      projectId,\n    })\n\n    if (members.length === 0) {\n      this.log('No members found for this project.')\n      return\n    }\n\n    const ordered = sortBy(\n      members.map(({date, id, name, roles}) => [\n        id,\n        name,\n        roles\n          ?.map((role) => role.title)\n          .join(', ')\n          .trim() || '-',\n        date,\n      ]),\n      [sortFields.indexOf(sort)],\n    )\n\n    const rows = order === 'asc' ? ordered : ordered.toReversed()\n\n    const table = new Table({\n      columns: [\n        {alignment: 'left', maxLen: 30, name: 'id', title: 'ID'},\n        {alignment: 'left', maxLen: 40, name: 'name', title: 'Name'},\n        {alignment: 'left', maxLen: 30, name: 'roles', title: 'Roles'},\n        {alignment: 'left', maxLen: 12, name: 'date', title: 'Date'},\n      ],\n      rowSeparator: true,\n    })\n\n    for (const [id, name, roles, date] of rows) {\n      const isPending = id === '<pending>'\n      table.addRow({\n        date: dimText(date, isPending),\n        id: dimText(id, isPending),\n        name: dimText(name, isPending),\n        roles: dimText(roles, isPending),\n      })\n    }\n\n    this.log(table.render())\n  }\n}\n"],"names":["styleText","Flags","SanityCommand","Table","sortBy","getMembersForProject","promptForProject","getProjectIdFlag","sortFields","dimText","value","isDim","List","description","examples","command","flags","semantics","invitations","boolean","allowNo","default","order","string","options","robots","sort","hiddenAliases","run","projectId","getProjectId","fallback","requiredPermissions","grant","permission","members","includeInvitations","includeRobots","length","log","ordered","map","date","id","name","roles","role","title","join","trim","indexOf","rows","toReversed","table","columns","alignment","maxLen","rowSeparator","isPending","addRow","render"],"mappings":"AAAA,SAAQA,SAAS,QAAO,YAAW;AAEnC,SAAQC,KAAK,QAAO,cAAa;AACjC,SAAQC,aAAa,QAAO,mBAAkB;AAC9C,SAAQC,KAAK,QAAO,wBAAuB;AAC3C,OAAOC,YAAY,sBAAqB;AAExC,SAAQC,oBAAoB,QAAO,8CAA6C;AAChF,SAAQC,gBAAgB,QAAO,oCAAmC;AAClE,SAAQC,gBAAgB,QAAO,4BAA2B;AAE1D,MAAMC,aAAa;IAAC;IAAM;IAAQ;IAAQ;CAAO;AAEjD,SAASC,QAAQC,KAAa,EAAEC,KAAc;IAC5C,OAAOA,QAAQX,UAAU,OAAOU,SAASA;AAC3C;AAEA,OAAO,MAAME,aAAaV;IACxB,OAAgBW,cAAc,uBAAsB;IACpD,OAAgBC,WAAW;QACzB;YACEC,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;QACA;YACEE,SAAS;YACTF,aAAa;QACf;KACD,CAAA;IACD,OAAgBG,QAAQ;QACtB,GAAGT,iBAAiB;YAClBM,aAAa;YACbI,WAAW;QACb,EAAE;QACFC,aAAajB,MAAMkB,OAAO,CAAC;YACzBC,SAAS;YACTC,SAAS;YACTR,aAAa;QACf;QACAS,OAAOrB,MAAMsB,MAAM,CAAC;YAClBF,SAAS;YACTR,aAAa;YACbW,SAAS;gBAAC;gBAAO;aAAO;QAC1B;QACAC,QAAQxB,MAAMkB,OAAO,CAAC;YACpBC,SAAS;YACTC,SAAS;YACTR,aAAa;QACf;QACAa,MAAMzB,MAAMsB,MAAM,CAAC;YACjBF,SAAS;YACTR,aAAa;YACbW,SAAS;gBAAC;gBAAM;gBAAQ;gBAAQ;aAAO;QACzC;IACF,EAAC;IAED,OAAgBG,gBAA0B;QAAC;KAAY,CAAA;IAEvD,MAAaC,MAAqB;QAChC,MAAM,EAACV,WAAW,EAAEI,KAAK,EAAEG,MAAM,EAAEC,IAAI,EAAC,GAAG,IAAI,CAACV,KAAK;QAErD,MAAMa,YAAY,MAAM,IAAI,CAACC,YAAY,CAAC;YACxCC,UAAU,IACRzB,iBAAiB;oBACf0B,qBAAqB;wBACnB;4BAACC,OAAO;4BAAQC,YAAY;wBAAgB;wBAC5C;4BAACD,OAAO;4BAAQC,YAAY;wBAAwB;qBACrD;gBACH;QACJ;QAEA,MAAMC,UAAU,MAAM9B,qBAAqB;YACzC+B,oBAAoBlB;YACpBmB,eAAeZ;YACfI;QACF;QAEA,IAAIM,QAAQG,MAAM,KAAK,GAAG;YACxB,IAAI,CAACC,GAAG,CAAC;YACT;QACF;QAEA,MAAMC,UAAUpC,OACd+B,QAAQM,GAAG,CAAC,CAAC,EAACC,IAAI,EAAEC,EAAE,EAAEC,IAAI,EAAEC,KAAK,EAAC,GAAK;gBACvCF;gBACAC;gBACAC,OACIJ,IAAI,CAACK,OAASA,KAAKC,KAAK,EACzBC,KAAK,MACLC,UAAU;gBACbP;aACD,GACD;YAAClC,WAAW0C,OAAO,CAACxB;SAAM;QAG5B,MAAMyB,OAAO7B,UAAU,QAAQkB,UAAUA,QAAQY,UAAU;QAE3D,MAAMC,QAAQ,IAAIlD,MAAM;YACtBmD,SAAS;gBACP;oBAACC,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAAMG,OAAO;gBAAI;gBACvD;oBAACQ,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAAQG,OAAO;gBAAM;gBAC3D;oBAACQ,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAASG,OAAO;gBAAO;gBAC7D;oBAACQ,WAAW;oBAAQC,QAAQ;oBAAIZ,MAAM;oBAAQG,OAAO;gBAAM;aAC5D;YACDU,cAAc;QAChB;QAEA,KAAK,MAAM,CAACd,IAAIC,MAAMC,OAAOH,KAAK,IAAIS,KAAM;YAC1C,MAAMO,YAAYf,OAAO;YACzBU,MAAMM,MAAM,CAAC;gBACXjB,MAAMjC,QAAQiC,MAAMgB;gBACpBf,IAAIlC,QAAQkC,IAAIe;gBAChBd,MAAMnC,QAAQmC,MAAMc;gBACpBb,OAAOpC,QAAQoC,OAAOa;YACxB;QACF;QAEA,IAAI,CAACnB,GAAG,CAACc,MAAMO,MAAM;IACvB;AACF"}

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js

@@ -127,6 +127,8 @@ import { allow, conditionalDenyFlags, conditionalPolicy, deny } from './policy.j
     'migrations:list': deny,
     // Executes local migration code that may perform arbitrary document mutations.
     'migrations:run': deny,
+    // Writes project setup values and scaffolds local applications.
+    new: deny,
     // --web opens a browser on the machine running the MCP server.
     'openapi:get': conditionalDenyFlags('web'),
     'openapi:list': conditionalDenyFlags('web'),
@@ -139,6 +141,8 @@ import { allow, conditionalDenyFlags, conditionalPolicy, deny } from './policy.j
     preview: deny,
     'projects:create': allow,
     'projects:list': allow,
+    // Reads locally stored claim URLs and robot tokens.
+    'projects:unclaimed': deny,
     // Loads the local Studio configuration to resolve the datasets containing each schema.
     'schemas:delete': deny,
     // Loads local schema files before deploying them.

package/dist/exports/invokeSanityCli/commandPolicies/mcpPolicy.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/mcpPolicy.ts"],"sourcesContent":["import {\n  allow,\n  type CommandPolicySet,\n  conditionalDenyFlags,\n  conditionalPolicy,\n  deny,\n} from './policy.js'\n\n/**\n * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command\n * read the host's filesystem or stdin (raw `-f` fields are always verbatim).\n */\nfunction fieldReadsFromHost(field: unknown): boolean {\n  if (typeof field !== 'string') return false\n  const separatorIndex = field.indexOf('=')\n  return separatorIndex > 0 && field[separatorIndex + 1] === '@'\n}\n\n/** A `-H/--header` value that replaces the invocation's authentication. */\nfunction headerOverridesAuthentication(header: unknown): boolean {\n  if (typeof header !== 'string') return false\n  const separatorIndex = header.indexOf(':')\n  return (\n    separatorIndex > 0 && header.slice(0, separatorIndex).trim().toLowerCase() === 'authorization'\n  )\n}\n\n/**\n * MCP programmatic mode disables local project/config discovery (see the CLI\n * execution context). Missing project or dataset values may therefore produce\n * a usage error, but cannot cause local filesystem access. Destructive remote\n * operations are allowed and do not by themselves make a command unsafe.\n *\n * Every manifest command must have exactly one policy here:\n * - allow: every valid invocation is safe\n * - conditional: safety depends on parsed arguments or flags\n * - deny: no invocation is safe\n */\nexport const mcpPolicy: CommandPolicySet = {\n  // Special exception, this can be very dangerous but is also super useful\n  // to expose. Refuse authentication overrides and host input channels:\n  // `--token` and an Authorization header replace the MCP user's token,\n  // `--input` reads the request body from the host's filesystem or stdin, and\n  // `-F key=@<file>` / `-F key=@-` field values do the same.\n  api: conditionalPolicy({\n    deniedFlags: ['input', 'token'],\n    validate: ({flags}) =>\n      (!Array.isArray(flags.field) || !flags.field.some((field) => fieldReadsFromHost(field))) &&\n      (!Array.isArray(flags.header) ||\n        !flags.header.some((header) => headerOverridesAuthentication(header))),\n  }),\n\n  'backups:disable': allow,\n  // Writes a downloaded backup to the local filesystem.\n  'backups:download': deny,\n  'backups:enable': allow,\n  'backups:list': allow,\n\n  // Requires a local Studio project and writes build output to disk.\n  build: deny,\n\n  // Reads and rewrites local source code.\n  codemod: deny,\n\n  'cors:add': allow,\n  'cors:delete': allow,\n  'cors:list': allow,\n\n  'datasets:alias:create': allow,\n  'datasets:alias:delete': allow,\n  'datasets:alias:link': allow,\n  'datasets:alias:unlink': allow,\n  'datasets:copy': allow,\n  'datasets:create': allow,\n  'datasets:delete': allow,\n  'datasets:embeddings:disable': allow,\n  'datasets:embeddings:enable': allow,\n  'datasets:embeddings:status': allow,\n  // Writes dataset contents and assets to the local filesystem.\n  'datasets:export': deny,\n  // Reads import data from the local filesystem and may replace documents.\n  'datasets:import': deny,\n  'datasets:list': allow,\n  'datasets:visibility:get': allow,\n  'datasets:visibility:set': allow,\n\n  // Inspects local project files and can print authentication secrets.\n  debug: deny,\n\n  // Reads, builds, and deploys a local Studio project.\n  deploy: deny,\n\n  // Loads a local Studio project and starts a development server.\n  dev: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  'docs:browse': deny,\n  // --web opens a browser on the machine running the MCP server.\n  'docs:read': conditionalDenyFlags('web'),\n  'docs:search': allow,\n\n  // Reads and executes local project configuration for diagnostics.\n  doctor: deny,\n\n  // Reads document input from disk or launches a local editor.\n  'documents:create': deny,\n  'documents:delete': allow,\n  'documents:get': allow,\n  'documents:query': allow,\n  // Loads a local Studio schema to validate documents.\n  'documents:validate': deny,\n\n  // Executes arbitrary code in the local Studio context.\n  exec: deny,\n\n  // Loads a local schema and deploys a GraphQL API.\n  'graphql:deploy': deny,\n  'graphql:list': allow,\n  // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.\n  'graphql:undeploy': conditionalDenyFlags('api'),\n\n  'hooks:attempt': allow,\n  'hooks:create': allow,\n  'hooks:delete': allow,\n  'hooks:list': allow,\n  'hooks:logs': allow,\n\n  // Creates or modifies a local project and may install dependencies.\n  init: deny,\n\n  // Installs packages into the local project.\n  install: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  learn: deny,\n\n  // Performs an authentication flow.\n  login: deny,\n\n  // Performs an authentication operation and clears local credentials.\n  logout: deny,\n\n  // Reads local project configuration and opens a browser.\n  manage: deny,\n\n  // Loads local Studio configuration and writes manifest files.\n  'manifest:extract': deny,\n\n  // Reads and writes local MCP client configuration.\n  'mcp:configure': deny,\n\n  // Writes an aspect definition to the local filesystem.\n  'media:create-aspect': deny,\n  'media:delete-aspect': allow,\n  // Reads a local aspect definition before deploying it.\n  'media:deploy-aspect': deny,\n  // Writes media assets to the local filesystem.\n  'media:export': deny,\n  // Reads media assets from the local filesystem.\n  'media:import': deny,\n\n  // Creates migration source files in the local project.\n  'migrations:create': deny,\n  // Reads and loads migration definitions from the local project.\n  'migrations:list': deny,\n  // Executes local migration code that may perform arbitrary document mutations.\n  'migrations:run': deny,\n\n  // --web opens a browser on the machine running the MCP server.\n  'openapi:get': conditionalDenyFlags('web'),\n  'openapi:list': conditionalDenyFlags('web'),\n\n  'organizations:create': allow,\n  'organizations:delete': allow,\n  'organizations:get': allow,\n  'organizations:list': allow,\n  'organizations:update': allow,\n\n  // Serves a local production build.\n  preview: deny,\n\n  'projects:create': allow,\n  'projects:list': allow,\n\n  // Loads the local Studio configuration to resolve the datasets containing each schema.\n  'schemas:delete': deny,\n  // Loads local schema files before deploying them.\n  'schemas:deploy': deny,\n  // Loads local Studio configuration and writes an extracted schema to disk.\n  'schemas:extract': deny,\n  // Requires a local project and loads its schema configuration.\n  'schemas:list': deny,\n  // Loads and executes a local Studio schema.\n  'schemas:validate': deny,\n\n  // Installs skills into local editor configuration directories.\n  'skills:install': deny,\n\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:disable': deny,\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:enable': deny,\n  'telemetry:status': allow,\n\n  // Creates authentication credentials.\n  'tokens:create': deny,\n  // Deletes authentication credentials.\n  'tokens:delete': deny,\n  // Exposes authentication credential metadata.\n  'tokens:list': deny,\n\n  // Loads local CLI and workbench configuration to identify the deployed Studio or application.\n  undeploy: deny,\n\n  // Grants a user access to a project.\n  'users:invite': deny,\n  'users:list': allow,\n\n  // Reads the local project and installed package tree.\n  versions: deny,\n}\n"],"names":["allow","conditionalDenyFlags","conditionalPolicy","deny","fieldReadsFromHost","field","separatorIndex","indexOf","headerOverridesAuthentication","header","slice","trim","toLowerCase","mcpPolicy","api","deniedFlags","validate","flags","Array","isArray","some","build","codemod","debug","deploy","dev","doctor","exec","init","install","learn","login","logout","manage","preview","undeploy","versions"],"mappings":"AAAA,SACEA,KAAK,EAELC,oBAAoB,EACpBC,iBAAiB,EACjBC,IAAI,QACC,cAAa;AAEpB;;;CAGC,GACD,SAASC,mBAAmBC,KAAc;IACxC,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMC,iBAAiBD,MAAME,OAAO,CAAC;IACrC,OAAOD,iBAAiB,KAAKD,KAAK,CAACC,iBAAiB,EAAE,KAAK;AAC7D;AAEA,yEAAyE,GACzE,SAASE,8BAA8BC,MAAe;IACpD,IAAI,OAAOA,WAAW,UAAU,OAAO;IACvC,MAAMH,iBAAiBG,OAAOF,OAAO,CAAC;IACtC,OACED,iBAAiB,KAAKG,OAAOC,KAAK,CAAC,GAAGJ,gBAAgBK,IAAI,GAAGC,WAAW,OAAO;AAEnF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,YAA8B;IACzC,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,4EAA4E;IAC5E,2DAA2D;IAC3DC,KAAKZ,kBAAkB;QACrBa,aAAa;YAAC;YAAS;SAAQ;QAC/BC,UAAU,CAAC,EAACC,KAAK,EAAC,GAChB,AAAC,CAAA,CAACC,MAAMC,OAAO,CAACF,MAAMZ,KAAK,KAAK,CAACY,MAAMZ,KAAK,CAACe,IAAI,CAAC,CAACf,QAAUD,mBAAmBC,OAAM,KACrF,CAAA,CAACa,MAAMC,OAAO,CAACF,MAAMR,MAAM,KAC1B,CAACQ,MAAMR,MAAM,CAACW,IAAI,CAAC,CAACX,SAAWD,8BAA8BC,QAAO;IAC1E;IAEA,mBAAmBT;IACnB,sDAAsD;IACtD,oBAAoBG;IACpB,kBAAkBH;IAClB,gBAAgBA;IAEhB,mEAAmE;IACnEqB,OAAOlB;IAEP,wCAAwC;IACxCmB,SAASnB;IAET,YAAYH;IACZ,eAAeA;IACf,aAAaA;IAEb,yBAAyBA;IACzB,yBAAyBA;IACzB,uBAAuBA;IACvB,yBAAyBA;IACzB,iBAAiBA;IACjB,mBAAmBA;IACnB,mBAAmBA;IACnB,+BAA+BA;IAC/B,8BAA8BA;IAC9B,8BAA8BA;IAC9B,8DAA8D;IAC9D,mBAAmBG;IACnB,yEAAyE;IACzE,mBAAmBA;IACnB,iBAAiBH;IACjB,2BAA2BA;IAC3B,2BAA2BA;IAE3B,qEAAqE;IACrEuB,OAAOpB;IAEP,qDAAqD;IACrDqB,QAAQrB;IAER,gEAAgE;IAChEsB,KAAKtB;IAEL,yDAAyD;IACzD,eAAeA;IACf,+DAA+D;IAC/D,aAAaF,qBAAqB;IAClC,eAAeD;IAEf,kEAAkE;IAClE0B,QAAQvB;IAER,6DAA6D;IAC7D,oBAAoBA;IACpB,oBAAoBH;IACpB,iBAAiBA;IACjB,mBAAmBA;IACnB,qDAAqD;IACrD,sBAAsBG;IAEtB,uDAAuD;IACvDwB,MAAMxB;IAEN,kDAAkD;IAClD,kBAAkBA;IAClB,gBAAgBH;IAChB,mGAAmG;IACnG,oBAAoBC,qBAAqB;IAEzC,iBAAiBD;IACjB,gBAAgBA;IAChB,gBAAgBA;IAChB,cAAcA;IACd,cAAcA;IAEd,oEAAoE;IACpE4B,MAAMzB;IAEN,4CAA4C;IAC5C0B,SAAS1B;IAET,yDAAyD;IACzD2B,OAAO3B;IAEP,mCAAmC;IACnC4B,OAAO5B;IAEP,qEAAqE;IACrE6B,QAAQ7B;IAER,yDAAyD;IACzD8B,QAAQ9B;IAER,8DAA8D;IAC9D,oBAAoBA;IAEpB,mDAAmD;IACnD,iBAAiBA;IAEjB,uDAAuD;IACvD,uBAAuBA;IACvB,uBAAuBH;IACvB,uDAAuD;IACvD,uBAAuBG;IACvB,+CAA+C;IAC/C,gBAAgBA;IAChB,gDAAgD;IAChD,gBAAgBA;IAEhB,uDAAuD;IACvD,qBAAqBA;IACrB,gEAAgE;IAChE,mBAAmBA;IACnB,+EAA+E;IAC/E,kBAAkBA;IAElB,+DAA+D;IAC/D,eAAeF,qBAAqB;IACpC,gBAAgBA,qBAAqB;IAErC,wBAAwBD;IACxB,wBAAwBA;IACxB,qBAAqBA;IACrB,sBAAsBA;IACtB,wBAAwBA;IAExB,mCAAmC;IACnCkC,SAAS/B;IAET,mBAAmBH;IACnB,iBAAiBA;IAEjB,uFAAuF;IACvF,kBAAkBG;IAClB,kDAAkD;IAClD,kBAAkBA;IAClB,2EAA2E;IAC3E,mBAAmBA;IACnB,+DAA+D;IAC/D,gBAAgBA;IAChB,4CAA4C;IAC5C,oBAAoBA;IAEpB,+DAA+D;IAC/D,kBAAkBA;IAElB,gFAAgF;IAChF,qBAAqBA;IACrB,gFAAgF;IAChF,oBAAoBA;IACpB,oBAAoBH;IAEpB,sCAAsC;IACtC,iBAAiBG;IACjB,sCAAsC;IACtC,iBAAiBA;IACjB,8CAA8C;IAC9C,eAAeA;IAEf,8FAA8F;IAC9FgC,UAAUhC;IAEV,qCAAqC;IACrC,gBAAgBA;IAChB,cAAcH;IAEd,sDAAsD;IACtDoC,UAAUjC;AACZ,EAAC"}
+{"version":3,"sources":["../../../../src/exports/invokeSanityCli/commandPolicies/mcpPolicy.ts"],"sourcesContent":["import {\n  allow,\n  type CommandPolicySet,\n  conditionalDenyFlags,\n  conditionalPolicy,\n  deny,\n} from './policy.js'\n\n/**\n * A typed `-F/--field` value of `@<file>` or `@-` makes the `api` command\n * read the host's filesystem or stdin (raw `-f` fields are always verbatim).\n */\nfunction fieldReadsFromHost(field: unknown): boolean {\n  if (typeof field !== 'string') return false\n  const separatorIndex = field.indexOf('=')\n  return separatorIndex > 0 && field[separatorIndex + 1] === '@'\n}\n\n/** A `-H/--header` value that replaces the invocation's authentication. */\nfunction headerOverridesAuthentication(header: unknown): boolean {\n  if (typeof header !== 'string') return false\n  const separatorIndex = header.indexOf(':')\n  return (\n    separatorIndex > 0 && header.slice(0, separatorIndex).trim().toLowerCase() === 'authorization'\n  )\n}\n\n/**\n * MCP programmatic mode disables local project/config discovery (see the CLI\n * execution context). Missing project or dataset values may therefore produce\n * a usage error, but cannot cause local filesystem access. Destructive remote\n * operations are allowed and do not by themselves make a command unsafe.\n *\n * Every manifest command must have exactly one policy here:\n * - allow: every valid invocation is safe\n * - conditional: safety depends on parsed arguments or flags\n * - deny: no invocation is safe\n */\nexport const mcpPolicy: CommandPolicySet = {\n  // Special exception, this can be very dangerous but is also super useful\n  // to expose. Refuse authentication overrides and host input channels:\n  // `--token` and an Authorization header replace the MCP user's token,\n  // `--input` reads the request body from the host's filesystem or stdin, and\n  // `-F key=@<file>` / `-F key=@-` field values do the same.\n  api: conditionalPolicy({\n    deniedFlags: ['input', 'token'],\n    validate: ({flags}) =>\n      (!Array.isArray(flags.field) || !flags.field.some((field) => fieldReadsFromHost(field))) &&\n      (!Array.isArray(flags.header) ||\n        !flags.header.some((header) => headerOverridesAuthentication(header))),\n  }),\n\n  'backups:disable': allow,\n  // Writes a downloaded backup to the local filesystem.\n  'backups:download': deny,\n  'backups:enable': allow,\n  'backups:list': allow,\n\n  // Requires a local Studio project and writes build output to disk.\n  build: deny,\n\n  // Reads and rewrites local source code.\n  codemod: deny,\n\n  'cors:add': allow,\n  'cors:delete': allow,\n  'cors:list': allow,\n\n  'datasets:alias:create': allow,\n  'datasets:alias:delete': allow,\n  'datasets:alias:link': allow,\n  'datasets:alias:unlink': allow,\n  'datasets:copy': allow,\n  'datasets:create': allow,\n  'datasets:delete': allow,\n  'datasets:embeddings:disable': allow,\n  'datasets:embeddings:enable': allow,\n  'datasets:embeddings:status': allow,\n  // Writes dataset contents and assets to the local filesystem.\n  'datasets:export': deny,\n  // Reads import data from the local filesystem and may replace documents.\n  'datasets:import': deny,\n  'datasets:list': allow,\n  'datasets:visibility:get': allow,\n  'datasets:visibility:set': allow,\n\n  // Inspects local project files and can print authentication secrets.\n  debug: deny,\n\n  // Reads, builds, and deploys a local Studio project.\n  deploy: deny,\n\n  // Loads a local Studio project and starts a development server.\n  dev: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  'docs:browse': deny,\n  // --web opens a browser on the machine running the MCP server.\n  'docs:read': conditionalDenyFlags('web'),\n  'docs:search': allow,\n\n  // Reads and executes local project configuration for diagnostics.\n  doctor: deny,\n\n  // Reads document input from disk or launches a local editor.\n  'documents:create': deny,\n  'documents:delete': allow,\n  'documents:get': allow,\n  'documents:query': allow,\n  // Loads a local Studio schema to validate documents.\n  'documents:validate': deny,\n\n  // Executes arbitrary code in the local Studio context.\n  exec: deny,\n\n  // Loads a local schema and deploys a GraphQL API.\n  'graphql:deploy': deny,\n  'graphql:list': allow,\n  // --api loads GraphQL definitions from the local project; explicit project/dataset flags are safe.\n  'graphql:undeploy': conditionalDenyFlags('api'),\n\n  'hooks:attempt': allow,\n  'hooks:create': allow,\n  'hooks:delete': allow,\n  'hooks:list': allow,\n  'hooks:logs': allow,\n\n  // Creates or modifies a local project and may install dependencies.\n  init: deny,\n\n  // Installs packages into the local project.\n  install: deny,\n\n  // Opens a browser on the machine running the MCP server.\n  learn: deny,\n\n  // Performs an authentication flow.\n  login: deny,\n\n  // Performs an authentication operation and clears local credentials.\n  logout: deny,\n\n  // Reads local project configuration and opens a browser.\n  manage: deny,\n\n  // Loads local Studio configuration and writes manifest files.\n  'manifest:extract': deny,\n\n  // Reads and writes local MCP client configuration.\n  'mcp:configure': deny,\n\n  // Writes an aspect definition to the local filesystem.\n  'media:create-aspect': deny,\n  'media:delete-aspect': allow,\n  // Reads a local aspect definition before deploying it.\n  'media:deploy-aspect': deny,\n  // Writes media assets to the local filesystem.\n  'media:export': deny,\n  // Reads media assets from the local filesystem.\n  'media:import': deny,\n\n  // Creates migration source files in the local project.\n  'migrations:create': deny,\n  // Reads and loads migration definitions from the local project.\n  'migrations:list': deny,\n  // Executes local migration code that may perform arbitrary document mutations.\n  'migrations:run': deny,\n\n  // Writes project setup values and scaffolds local applications.\n  new: deny,\n\n  // --web opens a browser on the machine running the MCP server.\n  'openapi:get': conditionalDenyFlags('web'),\n  'openapi:list': conditionalDenyFlags('web'),\n\n  'organizations:create': allow,\n  'organizations:delete': allow,\n  'organizations:get': allow,\n  'organizations:list': allow,\n  'organizations:update': allow,\n\n  // Serves a local production build.\n  preview: deny,\n\n  'projects:create': allow,\n  'projects:list': allow,\n  // Reads locally stored claim URLs and robot tokens.\n  'projects:unclaimed': deny,\n\n  // Loads the local Studio configuration to resolve the datasets containing each schema.\n  'schemas:delete': deny,\n  // Loads local schema files before deploying them.\n  'schemas:deploy': deny,\n  // Loads local Studio configuration and writes an extracted schema to disk.\n  'schemas:extract': deny,\n  // Requires a local project and loads its schema configuration.\n  'schemas:list': deny,\n  // Loads and executes a local Studio schema.\n  'schemas:validate': deny,\n\n  // Installs skills into local editor configuration directories.\n  'skills:install': deny,\n\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:disable': deny,\n  // Changes account telemetry preferences and mutates local cached configuration.\n  'telemetry:enable': deny,\n  'telemetry:status': allow,\n\n  // Creates authentication credentials.\n  'tokens:create': deny,\n  // Deletes authentication credentials.\n  'tokens:delete': deny,\n  // Exposes authentication credential metadata.\n  'tokens:list': deny,\n\n  // Loads local CLI and workbench configuration to identify the deployed Studio or application.\n  undeploy: deny,\n\n  // Grants a user access to a project.\n  'users:invite': deny,\n  'users:list': allow,\n\n  // Reads the local project and installed package tree.\n  versions: deny,\n}\n"],"names":["allow","conditionalDenyFlags","conditionalPolicy","deny","fieldReadsFromHost","field","separatorIndex","indexOf","headerOverridesAuthentication","header","slice","trim","toLowerCase","mcpPolicy","api","deniedFlags","validate","flags","Array","isArray","some","build","codemod","debug","deploy","dev","doctor","exec","init","install","learn","login","logout","manage","new","preview","undeploy","versions"],"mappings":"AAAA,SACEA,KAAK,EAELC,oBAAoB,EACpBC,iBAAiB,EACjBC,IAAI,QACC,cAAa;AAEpB;;;CAGC,GACD,SAASC,mBAAmBC,KAAc;IACxC,IAAI,OAAOA,UAAU,UAAU,OAAO;IACtC,MAAMC,iBAAiBD,MAAME,OAAO,CAAC;IACrC,OAAOD,iBAAiB,KAAKD,KAAK,CAACC,iBAAiB,EAAE,KAAK;AAC7D;AAEA,yEAAyE,GACzE,SAASE,8BAA8BC,MAAe;IACpD,IAAI,OAAOA,WAAW,UAAU,OAAO;IACvC,MAAMH,iBAAiBG,OAAOF,OAAO,CAAC;IACtC,OACED,iBAAiB,KAAKG,OAAOC,KAAK,CAAC,GAAGJ,gBAAgBK,IAAI,GAAGC,WAAW,OAAO;AAEnF;AAEA;;;;;;;;;;CAUC,GACD,OAAO,MAAMC,YAA8B;IACzC,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,4EAA4E;IAC5E,2DAA2D;IAC3DC,KAAKZ,kBAAkB;QACrBa,aAAa;YAAC;YAAS;SAAQ;QAC/BC,UAAU,CAAC,EAACC,KAAK,EAAC,GAChB,AAAC,CAAA,CAACC,MAAMC,OAAO,CAACF,MAAMZ,KAAK,KAAK,CAACY,MAAMZ,KAAK,CAACe,IAAI,CAAC,CAACf,QAAUD,mBAAmBC,OAAM,KACrF,CAAA,CAACa,MAAMC,OAAO,CAACF,MAAMR,MAAM,KAC1B,CAACQ,MAAMR,MAAM,CAACW,IAAI,CAAC,CAACX,SAAWD,8BAA8BC,QAAO;IAC1E;IAEA,mBAAmBT;IACnB,sDAAsD;IACtD,oBAAoBG;IACpB,kBAAkBH;IAClB,gBAAgBA;IAEhB,mEAAmE;IACnEqB,OAAOlB;IAEP,wCAAwC;IACxCmB,SAASnB;IAET,YAAYH;IACZ,eAAeA;IACf,aAAaA;IAEb,yBAAyBA;IACzB,yBAAyBA;IACzB,uBAAuBA;IACvB,yBAAyBA;IACzB,iBAAiBA;IACjB,mBAAmBA;IACnB,mBAAmBA;IACnB,+BAA+BA;IAC/B,8BAA8BA;IAC9B,8BAA8BA;IAC9B,8DAA8D;IAC9D,mBAAmBG;IACnB,yEAAyE;IACzE,mBAAmBA;IACnB,iBAAiBH;IACjB,2BAA2BA;IAC3B,2BAA2BA;IAE3B,qEAAqE;IACrEuB,OAAOpB;IAEP,qDAAqD;IACrDqB,QAAQrB;IAER,gEAAgE;IAChEsB,KAAKtB;IAEL,yDAAyD;IACzD,eAAeA;IACf,+DAA+D;IAC/D,aAAaF,qBAAqB;IAClC,eAAeD;IAEf,kEAAkE;IAClE0B,QAAQvB;IAER,6DAA6D;IAC7D,oBAAoBA;IACpB,oBAAoBH;IACpB,iBAAiBA;IACjB,mBAAmBA;IACnB,qDAAqD;IACrD,sBAAsBG;IAEtB,uDAAuD;IACvDwB,MAAMxB;IAEN,kDAAkD;IAClD,kBAAkBA;IAClB,gBAAgBH;IAChB,mGAAmG;IACnG,oBAAoBC,qBAAqB;IAEzC,iBAAiBD;IACjB,gBAAgBA;IAChB,gBAAgBA;IAChB,cAAcA;IACd,cAAcA;IAEd,oEAAoE;IACpE4B,MAAMzB;IAEN,4CAA4C;IAC5C0B,SAAS1B;IAET,yDAAyD;IACzD2B,OAAO3B;IAEP,mCAAmC;IACnC4B,OAAO5B;IAEP,qEAAqE;IACrE6B,QAAQ7B;IAER,yDAAyD;IACzD8B,QAAQ9B;IAER,8DAA8D;IAC9D,oBAAoBA;IAEpB,mDAAmD;IACnD,iBAAiBA;IAEjB,uDAAuD;IACvD,uBAAuBA;IACvB,uBAAuBH;IACvB,uDAAuD;IACvD,uBAAuBG;IACvB,+CAA+C;IAC/C,gBAAgBA;IAChB,gDAAgD;IAChD,gBAAgBA;IAEhB,uDAAuD;IACvD,qBAAqBA;IACrB,gEAAgE;IAChE,mBAAmBA;IACnB,+EAA+E;IAC/E,kBAAkBA;IAElB,gEAAgE;IAChE+B,KAAK/B;IAEL,+DAA+D;IAC/D,eAAeF,qBAAqB;IACpC,gBAAgBA,qBAAqB;IAErC,wBAAwBD;IACxB,wBAAwBA;IACxB,qBAAqBA;IACrB,sBAAsBA;IACtB,wBAAwBA;IAExB,mCAAmC;IACnCmC,SAAShC;IAET,mBAAmBH;IACnB,iBAAiBA;IACjB,oDAAoD;IACpD,sBAAsBG;IAEtB,uFAAuF;IACvF,kBAAkBA;IAClB,kDAAkD;IAClD,kBAAkBA;IAClB,2EAA2E;IAC3E,mBAAmBA;IACnB,+DAA+D;IAC/D,gBAAgBA;IAChB,4CAA4C;IAC5C,oBAAoBA;IAEpB,+DAA+D;IAC/D,kBAAkBA;IAElB,gFAAgF;IAChF,qBAAqBA;IACrB,gFAAgF;IAChF,oBAAoBA;IACpB,oBAAoBH;IAEpB,sCAAsC;IACtC,iBAAiBG;IACjB,sCAAsC;IACtC,iBAAiBA;IACjB,8CAA8C;IAC9C,eAAeA;IAEf,8FAA8F;IAC9FiC,UAAUjC;IAEV,qCAAqC;IACrC,gBAAgBA;IAChB,cAAcH;IAEd,sDAAsD;IACtDqC,UAAUlC;AACZ,EAAC"}

package/dist/exports/invokeSanityCli/index.d.ts

@@ -13,13 +13,9 @@ declare type InvocationSource = "mcp";
  *
  * @internal
  */
-export declare function invokeSanityCli({
-  args,
-  config,
-  sanityEnv,
-  source,
-  token,
-}: InvokeSanityCliOptions): Promise<InvokeSanityCliResult>;
+export declare function invokeSanityCli(
+  options: InvokeSanityCliOptions,
+): Promise<InvokeSanityCliResult>;
 
 /**
  * @internal
@@ -49,8 +45,8 @@ export declare interface InvokeSanityCliOptions {
   config?: Config;
   /**
    * Sanity deployment environment for this invocation. Scoped to this call
-   * via the CLI execution context and defaults to `SANITY_INTERNAL_ENV` (or
-   * production when it is unset).
+   * via the CLI execution context and defaults to production. The embedding
+   * process's `SANITY_INTERNAL_ENV` is never consulted.
    */
   sanityEnv?: SanityEnvironment;
 }

package/dist/exports/invokeSanityCli/index.js

@@ -19,22 +19,44 @@
  * Help works like the regular CLI, scoped to the source's policy: `--help`
  * (or `help`) renders root help listing the invokable topics, and a subject
  * (`cors --help`, `cors list --help`) renders topic or command help.
- */ import { Config, Parser } from '@oclif/core';
+ */ import { Config, Parser, settings } from '@oclif/core';
 import { getHelpFlagAdditions, normalizeArgv } from '@oclif/core/help';
-import { CLI_TELEMETRY_SYMBOL, exitCodes, noopLogger, setCliTelemetry } from '@sanity/cli-core';
+import { exitCodes } from '@sanity/cli-core';
 import { runWithCliExecutionContext } from '@sanity/cli-core/executionContext';
 import { parseArgsStringToArgv } from 'string-argv';
 import { commandPolicies } from './commandPolicies/index.js';
 import { deny, isConditionalInvocationPolicy } from './commandPolicies/policy.js';
 import { isHelpRequest, renderInvokableHelp } from './help.js';
 import { prettyPrintError } from './prettyPrintError.js';
+/**
+ * Instantiate a policy-approved command for isolated execution.
+ *
+ * Every invokable command extends `SanityCommand`, whose
+ * `runInExecutionContext()` runs the instance without oclif's static
+ * `Command.run()` — the static runner re-enters `Config.load()` (filesystem
+ * reads and a process-global config cache write) on every call. The manifest
+ * types command classes as the abstract oclif `Command`, hence the
+ * constructor cast. The method is probed rather than checked with
+ * `instanceof`, because command modules may load from the compiled build
+ * while this module runs from source, giving `SanityCommand` two identities.
+ */ function instantiateCommand(CommandClass, argv, config) {
+    const ConcreteCommand = CommandClass;
+    const command = new ConcreteCommand(argv, config);
+    if (typeof command.runInExecutionContext !== 'function') {
+        throw new TypeError(`Command "${CommandClass.id}" does not support isolated execution`);
+    }
+    return command;
+}
 /**
  * Load the oclif `Config` for this package, needed to resolve, load, and run
  * commands. Loading it once and reusing it across invocations avoids
- * re-reading the command manifest per call.
+ * re-reading the command manifest per call. It only reads this package's own
+ * installed files — process-lifetime initialization, not per-invocation host
+ * state — so it happens outside any execution context.
  */ function loadCliCommandConfig() {
     return Config.load(import.meta.url);
 }
+let cachedConfig;
 function unknownCommandResult(argv, policySet) {
     const available = Object.entries(policySet).filter(([, policy])=>policy.kind !== 'deny').map(([id])=>id.replaceAll(':', ' ')).toSorted();
     return {
@@ -45,7 +67,6 @@ function unknownCommandResult(argv, policySet) {
         ].join('\n')
     };
 }
-let cachedConfig;
 /**
  * Unlike a shell, string-argv keeps quotes that are glued to unquoted text:
  * `--name="my project"` tokenizes with the quotes intact. Strip a matching
@@ -63,15 +84,27 @@ let cachedConfig;
  * relay them verbatim.
  *
  * @internal
- */ export async function invokeSanityCli({ args, config, sanityEnv, source, token }) {
-    const resolvedConfig = config ?? await (cachedConfig ??= loadCliCommandConfig());
+ */ export async function invokeSanityCli(options) {
+    // Always load compiled command modules. Oclif's dev-mode source resolution
+    // otherwise probes tsconfigs (reading the filesystem and process.cwd) on
+    // every command load, and may register ts-node process-wide.
+    settings.enableAutoTranspile = false;
+    const resolvedConfig = options.config ?? await (cachedConfig ??= loadCliCommandConfig());
+    const output = [];
+    const sink = (line)=>output.push(line);
+    const { sanityEnv, token } = options;
+    // Establish the isolation boundary before rendering help, loading command
+    // modules, parsing, or executing. Any code reached by an external
+    // invocation can therefore fail closed on context.
+    return runWithCliExecutionContext({
+        sanityEnv,
+        stderr: sink,
+        stdout: sink,
+        token
+    }, ()=>invokeSanityCliInContext(options, resolvedConfig, output));
+}
+async function invokeSanityCliInContext({ args, source }, resolvedConfig, output) {
     const policySet = commandPolicies[source];
-    // Commands log through the global telemetry store; default it to a noop
-    // store so embedding hosts need no telemetry wiring (and see no warnings),
-    // without clobbering a store the host may have installed itself.
-    if (!globalThis[CLI_TELEMETRY_SYMBOL]) {
-        setCliTelemetry(noopLogger);
-    }
     // Pre-split argv arrays are taken verbatim; only string input goes through
     // shell-style tokenization and quote normalization.
     let argv = typeof args === 'string' ? parseArgsStringToArgv(args).map((t)=>stripFlagQuotes(t)) : [
@@ -149,15 +182,9 @@ let cachedConfig;
             output
         };
     }
-    const output = [];
-    const sink = (line)=>output.push(line);
     try {
-        await runWithCliExecutionContext({
-            sanityEnv,
-            stderr: sink,
-            stdout: sink,
-            token
-        }, ()=>CommandClass.run(commandArgv, resolvedConfig));
+        const command = instantiateCommand(CommandClass, commandArgv, resolvedConfig);
+        await command.runInExecutionContext();
         return {
             commandId,
             exitCode: exitCodes.SUCCESS,

package/dist/exports/invokeSanityCli/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/exports/invokeSanityCli/index.ts"],"sourcesContent":["/**\n * Programmatic (in-process) invocation of CLI commands, e.g. from an MCP\n * server. The invokable surface is governed by a per-source command policy\n * (see ./commandPolicies): every CLI command is explicitly allowed, denied,\n * or allowed conditionally on the parsed invocation.\n *\n * {@link invokeSanityCli} handles arg parsing, policy enforcement, command\n * dispatch, per-invocation auth, and output capture.\n * ```ts\n * import {invokeSanityCli} from '@sanity/cli/invokeSanityCli'\n *\n * const {exitCode, output} = await invokeSanityCli({\n *   args: 'cors list --project-id abc123',\n *   source: 'mcp',\n *   token: extra.authInfo.token,\n * })\n * ```\n *\n * Help works like the regular CLI, scoped to the source's policy: `--help`\n * (or `help`) renders root help listing the invokable topics, and a subject\n * (`cors --help`, `cors list --help`) renders topic or command help.\n */\nimport {Config, Parser} from '@oclif/core'\nimport {getHelpFlagAdditions, normalizeArgv} from '@oclif/core/help'\nimport {CLI_TELEMETRY_SYMBOL, exitCodes, noopLogger, setCliTelemetry} from '@sanity/cli-core'\nimport {runWithCliExecutionContext, type SanityEnvironment} from '@sanity/cli-core/executionContext'\nimport {parseArgsStringToArgv} from 'string-argv'\n\nimport {commandPolicies} from './commandPolicies/index.js'\nimport {\n  type CommandPolicySet,\n  deny,\n  type InvocationSource,\n  isConditionalInvocationPolicy,\n} from './commandPolicies/policy.js'\nimport {isHelpRequest, renderInvokableHelp} from './help.js'\nimport {prettyPrintError} from './prettyPrintError.js'\n\n/**\n * Load the oclif `Config` for this package, needed to resolve, load, and run\n * commands. Loading it once and reusing it across invocations avoids\n * re-reading the command manifest per call.\n */\nfunction loadCliCommandConfig(): Promise<Config> {\n  return Config.load(import.meta.url)\n}\n\nfunction unknownCommandResult(argv: string[], policySet: CommandPolicySet): InvokeSanityCliResult {\n  const available = Object.entries(policySet)\n    .filter(([, policy]) => policy.kind !== 'deny')\n    .map(([id]) => id.replaceAll(':', ' '))\n    .toSorted()\n  return {\n    exitCode: exitCodes.USAGE_ERROR,\n    output: [\n      `Unknown or unsupported command: ${argv.slice(0, 2).join(' ') || '(none)'}`,\n      `Available commands: ${available.join(', ')}`,\n    ].join('\\n'),\n  }\n}\n\n/**\n * @internal\n */\nexport interface InvokeSanityCliOptions {\n  /**\n   * Arguments after `sanity` (a leading `sanity` token is tolerated), either\n   * as a single string — shell-style quoting is supported, but no shell is\n   * ever executed — or as a pre-split argv array.\n   */\n  args: string | string[]\n\n  /**\n   * Where this invocation originates. Selects the command policy to enforce:\n   * which commands are invokable and which invocations of them are permitted.\n   */\n  source: InvocationSource\n\n  /**\n   * Auth token for this invocation. Scoped to this call via the CLI execution\n   * context: it never touches process env or the process-wide token cache, so\n   * concurrent invocations with different tokens are fully isolated.\n   */\n  token: string\n\n  /**\n   * Optional oclif config override (mainly for tests). Defaults to this\n   * package's config, loaded once and cached across invocations.\n   */\n  config?: Config\n\n  /**\n   * Sanity deployment environment for this invocation. Scoped to this call\n   * via the CLI execution context and defaults to `SANITY_INTERNAL_ENV` (or\n   * production when it is unset).\n   */\n  sanityEnv?: SanityEnvironment\n}\n\n/**\n * @internal\n */\nexport interface InvokeSanityCliResult {\n  /** `0` on success, the command's exit code otherwise. */\n  exitCode: number\n\n  /** Combined stdout and stderr output, in emission order. */\n  output: string\n\n  /**\n   * Canonical oclif command id when the invocation resolved to a command\n   * exposed by the selected policy (for example, `datasets:create`).\n   */\n  commandId?: string\n}\n\nlet cachedConfig: Promise<Config> | undefined\n\n/**\n * Unlike a shell, string-argv keeps quotes that are glued to unquoted text:\n * `--name=\"my project\"` tokenizes with the quotes intact. Strip a matching\n * wrapping quote pair from the value side of `--flag=`-shaped tokens so the\n * common shell-style form yields the value the caller intended.\n */\nfunction stripFlagQuotes(rawToken: string): string {\n  const match = /^(-{1,2}[^\\s=]+=)(['\"])([\\s\\S]*)\\2$/.exec(rawToken)\n  return match ? match[1] + match[3] : rawToken\n}\n\n/**\n * Run a policy-permitted CLI command in-process and capture its result.\n *\n * Command-level failures (unknown command, bad flags, API errors) are\n * reported through `exitCode`/`output` rather than thrown, so callers can\n * relay them verbatim.\n *\n * @internal\n */\nexport async function invokeSanityCli({\n  args,\n  config,\n  sanityEnv,\n  source,\n  token,\n}: InvokeSanityCliOptions): Promise<InvokeSanityCliResult> {\n  const resolvedConfig = config ?? (await (cachedConfig ??= loadCliCommandConfig()))\n  const policySet = commandPolicies[source]\n\n  // Commands log through the global telemetry store; default it to a noop\n  // store so embedding hosts need no telemetry wiring (and see no warnings),\n  // without clobbering a store the host may have installed itself.\n  if (!(globalThis as Record<symbol, unknown>)[CLI_TELEMETRY_SYMBOL]) {\n    setCliTelemetry(noopLogger)\n  }\n\n  // Pre-split argv arrays are taken verbatim; only string input goes through\n  // shell-style tokenization and quote normalization.\n  let argv =\n    typeof args === 'string'\n      ? parseArgsStringToArgv(args).map((t) => stripFlagQuotes(t))\n      : [...args]\n  if (argv[0] === 'sanity') argv = argv.slice(1)\n\n  // Help requests are routed through oclif's help system, scoped to the\n  // source's policy: root help for a bare request, topic/command help when a\n  // subject is given. Denied subjects get the standard unknown-command\n  // response (identical to a truly unknown command, so hosts can't probe the\n  // full CLI surface through help), and a help request never executes a\n  // command.\n  if (isHelpRequest(argv, resolvedConfig)) {\n    try {\n      // Drop a leading `help` so the rest is the subject, mirroring how\n      // oclif's dispatch consumes the token before the help command sees argv\n      const helpArgv = argv[0] === 'help' ? argv.slice(1) : argv\n      const result = await renderInvokableHelp(resolvedConfig, helpArgv, policySet)\n      if (result) return {...result, exitCode: exitCodes.SUCCESS}\n      const helpFlags = getHelpFlagAdditions(resolvedConfig)\n      return unknownCommandResult(\n        helpArgv.filter((token) => !helpFlags.includes(token)),\n        policySet,\n      )\n    } catch (err) {\n      return {\n        exitCode: exitCodes.RUNTIME_ERROR,\n        output: err instanceof Error ? err.message : String(err),\n      }\n    }\n  }\n\n  // Resolve the command id the same way oclif's dispatch would (collating\n  // space-separated topics, accepting colon-separated ids as-is), then apply\n  // the policy. Denied and uncategorized ids fail closed, indistinguishable\n  // from commands that don't exist.\n  const [commandId = '', ...commandArgv] = normalizeArgv(resolvedConfig, argv)\n  const policy = policySet[commandId] ?? deny\n  const commandDefinition =\n    policy.kind === 'deny' ? undefined : resolvedConfig.findCommand(commandId)\n  if (!commandDefinition) return unknownCommandResult(argv, policySet)\n\n  const CommandClass = await commandDefinition.load()\n\n  // Parse with the command's real definitions (without executing anything) so\n  // conditional policies are evaluated against typed args/flags, not tokens.\n  let invocation: {args: Record<string, unknown>; flags: Record<string, unknown>}\n  try {\n    const parsed = await Parser.parse(commandArgv, {\n      args: CommandClass.args,\n      baseFlags: CommandClass.baseFlags,\n      enableJsonFlag: CommandClass.enableJsonFlag,\n      flags: CommandClass.flags,\n      strict: CommandClass.strict,\n    })\n    invocation = {\n      args: parsed.args as Record<string, unknown>,\n      flags: parsed.flags as Record<string, unknown>,\n    }\n  } catch (err) {\n    return {\n      commandId,\n      exitCode: exitCodes.USAGE_ERROR,\n      output: err instanceof Error ? err.message : String(err),\n    }\n  }\n\n  if (!policy.validate(invocation)) {\n    const displayId = commandId.replaceAll(':', ' ')\n    let output = `This invocation of \\`${displayId}\\` is not supported here`\n\n    if (isConditionalInvocationPolicy(policy)) {\n      const usedDeniedFlags = policy.deniedFlags.filter(\n        (name) => invocation.flags[name] !== undefined && invocation.flags[name] !== false,\n      )\n      if (usedDeniedFlags.length > 0) {\n        output = `\\nThe ${usedDeniedFlags.map((name) => `--${name}`).join(', ')} flag is not supported here for \\`${displayId}\\``\n      }\n    }\n\n    return {\n      commandId,\n      exitCode: exitCodes.USAGE_ERROR,\n      output,\n    }\n  }\n\n  const output: string[] = []\n  const sink = (line: string) => output.push(line)\n\n  try {\n    await runWithCliExecutionContext({sanityEnv, stderr: sink, stdout: sink, token}, () =>\n      CommandClass.run(commandArgv, resolvedConfig),\n    )\n    return {commandId, exitCode: exitCodes.SUCCESS, output: output.join('\\n')}\n  } catch (err) {\n    const exit = err.oclif?.exit\n\n    // `this.exit(0)` throws an ExitError but is a successful outcome\n    if (exit === exitCodes.SUCCESS) {\n      return {commandId, exitCode: exitCodes.SUCCESS, output: output.join('\\n')}\n    }\n\n    const message = prettyPrintError(err) || String(err)\n    if (message) output.push(message)\n    return {\n      commandId,\n      exitCode: typeof exit === 'number' ? exit : exitCodes.RUNTIME_ERROR,\n      output: output.join('\\n'),\n    }\n  }\n}\n"],"names":["Config","Parser","getHelpFlagAdditions","normalizeArgv","CLI_TELEMETRY_SYMBOL","exitCodes","noopLogger","setCliTelemetry","runWithCliExecutionContext","parseArgsStringToArgv","commandPolicies","deny","isConditionalInvocationPolicy","isHelpRequest","renderInvokableHelp","prettyPrintError","loadCliCommandConfig","load","url","unknownCommandResult","argv","policySet","available","Object","entries","filter","policy","kind","map","id","replaceAll","toSorted","exitCode","USAGE_ERROR","output","slice","join","cachedConfig","stripFlagQuotes","rawToken","match","exec","invokeSanityCli","args","config","sanityEnv","source","token","resolvedConfig","globalThis","t","helpArgv","result","SUCCESS","helpFlags","includes","err","RUNTIME_ERROR","Error","message","String","commandId","commandArgv","commandDefinition","undefined","findCommand","CommandClass","invocation","parsed","parse","baseFlags","enableJsonFlag","flags","strict","validate","displayId","usedDeniedFlags","deniedFlags","name","length","sink","line","push","stderr","stdout","run","exit","oclif"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAAQA,MAAM,EAAEC,MAAM,QAAO,cAAa;AAC1C,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,mBAAkB;AACpE,SAAQC,oBAAoB,EAAEC,SAAS,EAAEC,UAAU,EAAEC,eAAe,QAAO,mBAAkB;AAC7F,SAAQC,0BAA0B,QAA+B,oCAAmC;AACpG,SAAQC,qBAAqB,QAAO,cAAa;AAEjD,SAAQC,eAAe,QAAO,6BAA4B;AAC1D,SAEEC,IAAI,EAEJC,6BAA6B,QACxB,8BAA6B;AACpC,SAAQC,aAAa,EAAEC,mBAAmB,QAAO,YAAW;AAC5D,SAAQC,gBAAgB,QAAO,wBAAuB;AAEtD;;;;CAIC,GACD,SAASC;IACP,OAAOhB,OAAOiB,IAAI,CAAC,YAAYC,GAAG;AACpC;AAEA,SAASC,qBAAqBC,IAAc,EAAEC,SAA2B;IACvE,MAAMC,YAAYC,OAAOC,OAAO,CAACH,WAC9BI,MAAM,CAAC,CAAC,GAAGC,OAAO,GAAKA,OAAOC,IAAI,KAAK,QACvCC,GAAG,CAAC,CAAC,CAACC,GAAG,GAAKA,GAAGC,UAAU,CAAC,KAAK,MACjCC,QAAQ;IACX,OAAO;QACLC,UAAU3B,UAAU4B,WAAW;QAC/BC,QAAQ;YACN,CAAC,gCAAgC,EAAEd,KAAKe,KAAK,CAAC,GAAG,GAAGC,IAAI,CAAC,QAAQ,UAAU;YAC3E,CAAC,oBAAoB,EAAEd,UAAUc,IAAI,CAAC,OAAO;SAC9C,CAACA,IAAI,CAAC;IACT;AACF;AAyDA,IAAIC;AAEJ;;;;;CAKC,GACD,SAASC,gBAAgBC,QAAgB;IACvC,MAAMC,QAAQ,sCAAsCC,IAAI,CAACF;IACzD,OAAOC,QAAQA,KAAK,CAAC,EAAE,GAAGA,KAAK,CAAC,EAAE,GAAGD;AACvC;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeG,gBAAgB,EACpCC,IAAI,EACJC,MAAM,EACNC,SAAS,EACTC,MAAM,EACNC,KAAK,EACkB;IACvB,MAAMC,iBAAiBJ,UAAW,MAAOP,CAAAA,iBAAiBrB,sBAAqB;IAC/E,MAAMK,YAAYX,eAAe,CAACoC,OAAO;IAEzC,wEAAwE;IACxE,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,CAAC,AAACG,UAAsC,CAAC7C,qBAAqB,EAAE;QAClEG,gBAAgBD;IAClB;IAEA,2EAA2E;IAC3E,oDAAoD;IACpD,IAAIc,OACF,OAAOuB,SAAS,WACZlC,sBAAsBkC,MAAMf,GAAG,CAAC,CAACsB,IAAMZ,gBAAgBY,MACvD;WAAIP;KAAK;IACf,IAAIvB,IAAI,CAAC,EAAE,KAAK,UAAUA,OAAOA,KAAKe,KAAK,CAAC;IAE5C,sEAAsE;IACtE,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,WAAW;IACX,IAAItB,cAAcO,MAAM4B,iBAAiB;QACvC,IAAI;YACF,kEAAkE;YAClE,wEAAwE;YACxE,MAAMG,WAAW/B,IAAI,CAAC,EAAE,KAAK,SAASA,KAAKe,KAAK,CAAC,KAAKf;YACtD,MAAMgC,SAAS,MAAMtC,oBAAoBkC,gBAAgBG,UAAU9B;YACnE,IAAI+B,QAAQ,OAAO;gBAAC,GAAGA,MAAM;gBAAEpB,UAAU3B,UAAUgD,OAAO;YAAA;YAC1D,MAAMC,YAAYpD,qBAAqB8C;YACvC,OAAO7B,qBACLgC,SAAS1B,MAAM,CAAC,CAACsB,QAAU,CAACO,UAAUC,QAAQ,CAACR,SAC/C1B;QAEJ,EAAE,OAAOmC,KAAK;YACZ,OAAO;gBACLxB,UAAU3B,UAAUoD,aAAa;gBACjCvB,QAAQsB,eAAeE,QAAQF,IAAIG,OAAO,GAAGC,OAAOJ;YACtD;QACF;IACF;IAEA,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,kCAAkC;IAClC,MAAM,CAACK,YAAY,EAAE,EAAE,GAAGC,YAAY,GAAG3D,cAAc6C,gBAAgB5B;IACvE,MAAMM,SAASL,SAAS,CAACwC,UAAU,IAAIlD;IACvC,MAAMoD,oBACJrC,OAAOC,IAAI,KAAK,SAASqC,YAAYhB,eAAeiB,WAAW,CAACJ;IAClE,IAAI,CAACE,mBAAmB,OAAO5C,qBAAqBC,MAAMC;IAE1D,MAAM6C,eAAe,MAAMH,kBAAkB9C,IAAI;IAEjD,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAIkD;IACJ,IAAI;QACF,MAAMC,SAAS,MAAMnE,OAAOoE,KAAK,CAACP,aAAa;YAC7CnB,MAAMuB,aAAavB,IAAI;YACvB2B,WAAWJ,aAAaI,SAAS;YACjCC,gBAAgBL,aAAaK,cAAc;YAC3CC,OAAON,aAAaM,KAAK;YACzBC,QAAQP,aAAaO,MAAM;QAC7B;QACAN,aAAa;YACXxB,MAAMyB,OAAOzB,IAAI;YACjB6B,OAAOJ,OAAOI,KAAK;QACrB;IACF,EAAE,OAAOhB,KAAK;QACZ,OAAO;YACLK;YACA7B,UAAU3B,UAAU4B,WAAW;YAC/BC,QAAQsB,eAAeE,QAAQF,IAAIG,OAAO,GAAGC,OAAOJ;QACtD;IACF;IAEA,IAAI,CAAC9B,OAAOgD,QAAQ,CAACP,aAAa;QAChC,MAAMQ,YAAYd,UAAU/B,UAAU,CAAC,KAAK;QAC5C,IAAII,SAAS,CAAC,qBAAqB,EAAEyC,UAAU,wBAAwB,CAAC;QAExE,IAAI/D,8BAA8Bc,SAAS;YACzC,MAAMkD,kBAAkBlD,OAAOmD,WAAW,CAACpD,MAAM,CAC/C,CAACqD,OAASX,WAAWK,KAAK,CAACM,KAAK,KAAKd,aAAaG,WAAWK,KAAK,CAACM,KAAK,KAAK;YAE/E,IAAIF,gBAAgBG,MAAM,GAAG,GAAG;gBAC9B7C,SAAS,CAAC,MAAM,EAAE0C,gBAAgBhD,GAAG,CAAC,CAACkD,OAAS,CAAC,EAAE,EAAEA,MAAM,EAAE1C,IAAI,CAAC,MAAM,kCAAkC,EAAEuC,UAAU,EAAE,CAAC;YAC3H;QACF;QAEA,OAAO;YACLd;YACA7B,UAAU3B,UAAU4B,WAAW;YAC/BC;QACF;IACF;IAEA,MAAMA,SAAmB,EAAE;IAC3B,MAAM8C,OAAO,CAACC,OAAiB/C,OAAOgD,IAAI,CAACD;IAE3C,IAAI;QACF,MAAMzE,2BAA2B;YAACqC;YAAWsC,QAAQH;YAAMI,QAAQJ;YAAMjC;QAAK,GAAG,IAC/EmB,aAAamB,GAAG,CAACvB,aAAad;QAEhC,OAAO;YAACa;YAAW7B,UAAU3B,UAAUgD,OAAO;YAAEnB,QAAQA,OAAOE,IAAI,CAAC;QAAK;IAC3E,EAAE,OAAOoB,KAAK;QACZ,MAAM8B,OAAO9B,IAAI+B,KAAK,EAAED;QAExB,iEAAiE;QACjE,IAAIA,SAASjF,UAAUgD,OAAO,EAAE;YAC9B,OAAO;gBAACQ;gBAAW7B,UAAU3B,UAAUgD,OAAO;gBAAEnB,QAAQA,OAAOE,IAAI,CAAC;YAAK;QAC3E;QAEA,MAAMuB,UAAU5C,iBAAiByC,QAAQI,OAAOJ;QAChD,IAAIG,SAASzB,OAAOgD,IAAI,CAACvB;QACzB,OAAO;YACLE;YACA7B,UAAU,OAAOsD,SAAS,WAAWA,OAAOjF,UAAUoD,aAAa;YACnEvB,QAAQA,OAAOE,IAAI,CAAC;QACtB;IACF;AACF"}
+{"version":3,"sources":["../../../src/exports/invokeSanityCli/index.ts"],"sourcesContent":["/**\n * Programmatic (in-process) invocation of CLI commands, e.g. from an MCP\n * server. The invokable surface is governed by a per-source command policy\n * (see ./commandPolicies): every CLI command is explicitly allowed, denied,\n * or allowed conditionally on the parsed invocation.\n *\n * {@link invokeSanityCli} handles arg parsing, policy enforcement, command\n * dispatch, per-invocation auth, and output capture.\n * ```ts\n * import {invokeSanityCli} from '@sanity/cli/invokeSanityCli'\n *\n * const {exitCode, output} = await invokeSanityCli({\n *   args: 'cors list --project-id abc123',\n *   source: 'mcp',\n *   token: extra.authInfo.token,\n * })\n * ```\n *\n * Help works like the regular CLI, scoped to the source's policy: `--help`\n * (or `help`) renders root help listing the invokable topics, and a subject\n * (`cors --help`, `cors list --help`) renders topic or command help.\n */\nimport {Command, Config, Parser, settings} from '@oclif/core'\nimport {getHelpFlagAdditions, normalizeArgv} from '@oclif/core/help'\nimport {exitCodes} from '@sanity/cli-core'\nimport {runWithCliExecutionContext, type SanityEnvironment} from '@sanity/cli-core/executionContext'\nimport {type SanityCommand} from '@sanity/cli-core/SanityCommand'\nimport {parseArgsStringToArgv} from 'string-argv'\n\nimport {commandPolicies} from './commandPolicies/index.js'\nimport {\n  type CommandPolicySet,\n  deny,\n  type InvocationSource,\n  isConditionalInvocationPolicy,\n} from './commandPolicies/policy.js'\nimport {isHelpRequest, renderInvokableHelp} from './help.js'\nimport {prettyPrintError} from './prettyPrintError.js'\n\ntype InvokableCommand = Pick<SanityCommand<typeof Command>, 'runInExecutionContext'>\n\n/**\n * Instantiate a policy-approved command for isolated execution.\n *\n * Every invokable command extends `SanityCommand`, whose\n * `runInExecutionContext()` runs the instance without oclif's static\n * `Command.run()` — the static runner re-enters `Config.load()` (filesystem\n * reads and a process-global config cache write) on every call. The manifest\n * types command classes as the abstract oclif `Command`, hence the\n * constructor cast. The method is probed rather than checked with\n * `instanceof`, because command modules may load from the compiled build\n * while this module runs from source, giving `SanityCommand` two identities.\n */\nfunction instantiateCommand(\n  CommandClass: Command.Class,\n  argv: string[],\n  config: Config,\n): InvokableCommand {\n  const ConcreteCommand = CommandClass as unknown as new (argv: string[], config: Config) => Command\n  const command = new ConcreteCommand(argv, config) as Command & Partial<InvokableCommand>\n  if (typeof command.runInExecutionContext !== 'function') {\n    throw new TypeError(`Command \"${CommandClass.id}\" does not support isolated execution`)\n  }\n  return command as InvokableCommand\n}\n\n/**\n * Load the oclif `Config` for this package, needed to resolve, load, and run\n * commands. Loading it once and reusing it across invocations avoids\n * re-reading the command manifest per call. It only reads this package's own\n * installed files — process-lifetime initialization, not per-invocation host\n * state — so it happens outside any execution context.\n */\nfunction loadCliCommandConfig(): Promise<Config> {\n  return Config.load(import.meta.url)\n}\n\nlet cachedConfig: Promise<Config> | undefined\n\nfunction unknownCommandResult(argv: string[], policySet: CommandPolicySet): InvokeSanityCliResult {\n  const available = Object.entries(policySet)\n    .filter(([, policy]) => policy.kind !== 'deny')\n    .map(([id]) => id.replaceAll(':', ' '))\n    .toSorted()\n  return {\n    exitCode: exitCodes.USAGE_ERROR,\n    output: [\n      `Unknown or unsupported command: ${argv.slice(0, 2).join(' ') || '(none)'}`,\n      `Available commands: ${available.join(', ')}`,\n    ].join('\\n'),\n  }\n}\n\n/**\n * @internal\n */\nexport interface InvokeSanityCliOptions {\n  /**\n   * Arguments after `sanity` (a leading `sanity` token is tolerated), either\n   * as a single string — shell-style quoting is supported, but no shell is\n   * ever executed — or as a pre-split argv array.\n   */\n  args: string | string[]\n\n  /**\n   * Where this invocation originates. Selects the command policy to enforce:\n   * which commands are invokable and which invocations of them are permitted.\n   */\n  source: InvocationSource\n\n  /**\n   * Auth token for this invocation. Scoped to this call via the CLI execution\n   * context: it never touches process env or the process-wide token cache, so\n   * concurrent invocations with different tokens are fully isolated.\n   */\n  token: string\n\n  /**\n   * Optional oclif config override (mainly for tests). Defaults to this\n   * package's config, loaded once and cached across invocations.\n   */\n  config?: Config\n\n  /**\n   * Sanity deployment environment for this invocation. Scoped to this call\n   * via the CLI execution context and defaults to production. The embedding\n   * process's `SANITY_INTERNAL_ENV` is never consulted.\n   */\n  sanityEnv?: SanityEnvironment\n}\n\n/**\n * @internal\n */\nexport interface InvokeSanityCliResult {\n  /** `0` on success, the command's exit code otherwise. */\n  exitCode: number\n\n  /** Combined stdout and stderr output, in emission order. */\n  output: string\n\n  /**\n   * Canonical oclif command id when the invocation resolved to a command\n   * exposed by the selected policy (for example, `datasets:create`).\n   */\n  commandId?: string\n}\n\n/**\n * Unlike a shell, string-argv keeps quotes that are glued to unquoted text:\n * `--name=\"my project\"` tokenizes with the quotes intact. Strip a matching\n * wrapping quote pair from the value side of `--flag=`-shaped tokens so the\n * common shell-style form yields the value the caller intended.\n */\nfunction stripFlagQuotes(rawToken: string): string {\n  const match = /^(-{1,2}[^\\s=]+=)(['\"])([\\s\\S]*)\\2$/.exec(rawToken)\n  return match ? match[1] + match[3] : rawToken\n}\n\n/**\n * Run a policy-permitted CLI command in-process and capture its result.\n *\n * Command-level failures (unknown command, bad flags, API errors) are\n * reported through `exitCode`/`output` rather than thrown, so callers can\n * relay them verbatim.\n *\n * @internal\n */\nexport async function invokeSanityCli(\n  options: InvokeSanityCliOptions,\n): Promise<InvokeSanityCliResult> {\n  // Always load compiled command modules. Oclif's dev-mode source resolution\n  // otherwise probes tsconfigs (reading the filesystem and process.cwd) on\n  // every command load, and may register ts-node process-wide.\n  settings.enableAutoTranspile = false\n\n  const resolvedConfig = options.config ?? (await (cachedConfig ??= loadCliCommandConfig()))\n  const output: string[] = []\n  const sink = (line: string) => output.push(line)\n  const {sanityEnv, token} = options\n\n  // Establish the isolation boundary before rendering help, loading command\n  // modules, parsing, or executing. Any code reached by an external\n  // invocation can therefore fail closed on context.\n  return runWithCliExecutionContext({sanityEnv, stderr: sink, stdout: sink, token}, () =>\n    invokeSanityCliInContext(options, resolvedConfig, output),\n  )\n}\n\nasync function invokeSanityCliInContext(\n  {args, source}: InvokeSanityCliOptions,\n  resolvedConfig: Config,\n  output: string[],\n): Promise<InvokeSanityCliResult> {\n  const policySet = commandPolicies[source]\n\n  // Pre-split argv arrays are taken verbatim; only string input goes through\n  // shell-style tokenization and quote normalization.\n  let argv =\n    typeof args === 'string'\n      ? parseArgsStringToArgv(args).map((t) => stripFlagQuotes(t))\n      : [...args]\n  if (argv[0] === 'sanity') argv = argv.slice(1)\n\n  // Help requests are routed through oclif's help system, scoped to the\n  // source's policy: root help for a bare request, topic/command help when a\n  // subject is given. Denied subjects get the standard unknown-command\n  // response (identical to a truly unknown command, so hosts can't probe the\n  // full CLI surface through help), and a help request never executes a\n  // command.\n  if (isHelpRequest(argv, resolvedConfig)) {\n    try {\n      // Drop a leading `help` so the rest is the subject, mirroring how\n      // oclif's dispatch consumes the token before the help command sees argv\n      const helpArgv = argv[0] === 'help' ? argv.slice(1) : argv\n      const result = await renderInvokableHelp(resolvedConfig, helpArgv, policySet)\n      if (result) return {...result, exitCode: exitCodes.SUCCESS}\n      const helpFlags = getHelpFlagAdditions(resolvedConfig)\n      return unknownCommandResult(\n        helpArgv.filter((token) => !helpFlags.includes(token)),\n        policySet,\n      )\n    } catch (err) {\n      return {\n        exitCode: exitCodes.RUNTIME_ERROR,\n        output: err instanceof Error ? err.message : String(err),\n      }\n    }\n  }\n\n  // Resolve the command id the same way oclif's dispatch would (collating\n  // space-separated topics, accepting colon-separated ids as-is), then apply\n  // the policy. Denied and uncategorized ids fail closed, indistinguishable\n  // from commands that don't exist.\n  const [commandId = '', ...commandArgv] = normalizeArgv(resolvedConfig, argv)\n  const policy = policySet[commandId] ?? deny\n  const commandDefinition =\n    policy.kind === 'deny' ? undefined : resolvedConfig.findCommand(commandId)\n  if (!commandDefinition) return unknownCommandResult(argv, policySet)\n\n  const CommandClass = await commandDefinition.load()\n\n  // Parse with the command's real definitions (without executing anything) so\n  // conditional policies are evaluated against typed args/flags, not tokens.\n  let invocation: {args: Record<string, unknown>; flags: Record<string, unknown>}\n  try {\n    const parsed = await Parser.parse(commandArgv, {\n      args: CommandClass.args,\n      baseFlags: CommandClass.baseFlags,\n      enableJsonFlag: CommandClass.enableJsonFlag,\n      flags: CommandClass.flags,\n      strict: CommandClass.strict,\n    })\n    invocation = {\n      args: parsed.args as Record<string, unknown>,\n      flags: parsed.flags as Record<string, unknown>,\n    }\n  } catch (err) {\n    return {\n      commandId,\n      exitCode: exitCodes.USAGE_ERROR,\n      output: err instanceof Error ? err.message : String(err),\n    }\n  }\n\n  if (!policy.validate(invocation)) {\n    const displayId = commandId.replaceAll(':', ' ')\n    let output = `This invocation of \\`${displayId}\\` is not supported here`\n\n    if (isConditionalInvocationPolicy(policy)) {\n      const usedDeniedFlags = policy.deniedFlags.filter(\n        (name) => invocation.flags[name] !== undefined && invocation.flags[name] !== false,\n      )\n      if (usedDeniedFlags.length > 0) {\n        output = `\\nThe ${usedDeniedFlags.map((name) => `--${name}`).join(', ')} flag is not supported here for \\`${displayId}\\``\n      }\n    }\n\n    return {\n      commandId,\n      exitCode: exitCodes.USAGE_ERROR,\n      output,\n    }\n  }\n\n  try {\n    const command = instantiateCommand(CommandClass, commandArgv, resolvedConfig)\n    await command.runInExecutionContext()\n    return {commandId, exitCode: exitCodes.SUCCESS, output: output.join('\\n')}\n  } catch (err) {\n    const exit = err.oclif?.exit\n\n    // `this.exit(0)` throws an ExitError but is a successful outcome\n    if (exit === exitCodes.SUCCESS) {\n      return {commandId, exitCode: exitCodes.SUCCESS, output: output.join('\\n')}\n    }\n\n    const message = prettyPrintError(err) || String(err)\n    if (message) output.push(message)\n    return {\n      commandId,\n      exitCode: typeof exit === 'number' ? exit : exitCodes.RUNTIME_ERROR,\n      output: output.join('\\n'),\n    }\n  }\n}\n"],"names":["Config","Parser","settings","getHelpFlagAdditions","normalizeArgv","exitCodes","runWithCliExecutionContext","parseArgsStringToArgv","commandPolicies","deny","isConditionalInvocationPolicy","isHelpRequest","renderInvokableHelp","prettyPrintError","instantiateCommand","CommandClass","argv","config","ConcreteCommand","command","runInExecutionContext","TypeError","id","loadCliCommandConfig","load","url","cachedConfig","unknownCommandResult","policySet","available","Object","entries","filter","policy","kind","map","replaceAll","toSorted","exitCode","USAGE_ERROR","output","slice","join","stripFlagQuotes","rawToken","match","exec","invokeSanityCli","options","enableAutoTranspile","resolvedConfig","sink","line","push","sanityEnv","token","stderr","stdout","invokeSanityCliInContext","args","source","t","helpArgv","result","SUCCESS","helpFlags","includes","err","RUNTIME_ERROR","Error","message","String","commandId","commandArgv","commandDefinition","undefined","findCommand","invocation","parsed","parse","baseFlags","enableJsonFlag","flags","strict","validate","displayId","usedDeniedFlags","deniedFlags","name","length","exit","oclif"],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,SAAiBA,MAAM,EAAEC,MAAM,EAAEC,QAAQ,QAAO,cAAa;AAC7D,SAAQC,oBAAoB,EAAEC,aAAa,QAAO,mBAAkB;AACpE,SAAQC,SAAS,QAAO,mBAAkB;AAC1C,SAAQC,0BAA0B,QAA+B,oCAAmC;AAEpG,SAAQC,qBAAqB,QAAO,cAAa;AAEjD,SAAQC,eAAe,QAAO,6BAA4B;AAC1D,SAEEC,IAAI,EAEJC,6BAA6B,QACxB,8BAA6B;AACpC,SAAQC,aAAa,EAAEC,mBAAmB,QAAO,YAAW;AAC5D,SAAQC,gBAAgB,QAAO,wBAAuB;AAItD;;;;;;;;;;;CAWC,GACD,SAASC,mBACPC,YAA2B,EAC3BC,IAAc,EACdC,MAAc;IAEd,MAAMC,kBAAkBH;IACxB,MAAMI,UAAU,IAAID,gBAAgBF,MAAMC;IAC1C,IAAI,OAAOE,QAAQC,qBAAqB,KAAK,YAAY;QACvD,MAAM,IAAIC,UAAU,CAAC,SAAS,EAAEN,aAAaO,EAAE,CAAC,qCAAqC,CAAC;IACxF;IACA,OAAOH;AACT;AAEA;;;;;;CAMC,GACD,SAASI;IACP,OAAOvB,OAAOwB,IAAI,CAAC,YAAYC,GAAG;AACpC;AAEA,IAAIC;AAEJ,SAASC,qBAAqBX,IAAc,EAAEY,SAA2B;IACvE,MAAMC,YAAYC,OAAOC,OAAO,CAACH,WAC9BI,MAAM,CAAC,CAAC,GAAGC,OAAO,GAAKA,OAAOC,IAAI,KAAK,QACvCC,GAAG,CAAC,CAAC,CAACb,GAAG,GAAKA,GAAGc,UAAU,CAAC,KAAK,MACjCC,QAAQ;IACX,OAAO;QACLC,UAAUjC,UAAUkC,WAAW;QAC/BC,QAAQ;YACN,CAAC,gCAAgC,EAAExB,KAAKyB,KAAK,CAAC,GAAG,GAAGC,IAAI,CAAC,QAAQ,UAAU;YAC3E,CAAC,oBAAoB,EAAEb,UAAUa,IAAI,CAAC,OAAO;SAC9C,CAACA,IAAI,CAAC;IACT;AACF;AAyDA;;;;;CAKC,GACD,SAASC,gBAAgBC,QAAgB;IACvC,MAAMC,QAAQ,sCAAsCC,IAAI,CAACF;IACzD,OAAOC,QAAQA,KAAK,CAAC,EAAE,GAAGA,KAAK,CAAC,EAAE,GAAGD;AACvC;AAEA;;;;;;;;CAQC,GACD,OAAO,eAAeG,gBACpBC,OAA+B;IAE/B,2EAA2E;IAC3E,yEAAyE;IACzE,6DAA6D;IAC7D9C,SAAS+C,mBAAmB,GAAG;IAE/B,MAAMC,iBAAiBF,QAAQ/B,MAAM,IAAK,MAAOS,CAAAA,iBAAiBH,sBAAqB;IACvF,MAAMiB,SAAmB,EAAE;IAC3B,MAAMW,OAAO,CAACC,OAAiBZ,OAAOa,IAAI,CAACD;IAC3C,MAAM,EAACE,SAAS,EAAEC,KAAK,EAAC,GAAGP;IAE3B,0EAA0E;IAC1E,kEAAkE;IAClE,mDAAmD;IACnD,OAAO1C,2BAA2B;QAACgD;QAAWE,QAAQL;QAAMM,QAAQN;QAAMI;IAAK,GAAG,IAChFG,yBAAyBV,SAASE,gBAAgBV;AAEtD;AAEA,eAAekB,yBACb,EAACC,IAAI,EAAEC,MAAM,EAAyB,EACtCV,cAAsB,EACtBV,MAAgB;IAEhB,MAAMZ,YAAYpB,eAAe,CAACoD,OAAO;IAEzC,2EAA2E;IAC3E,oDAAoD;IACpD,IAAI5C,OACF,OAAO2C,SAAS,WACZpD,sBAAsBoD,MAAMxB,GAAG,CAAC,CAAC0B,IAAMlB,gBAAgBkB,MACvD;WAAIF;KAAK;IACf,IAAI3C,IAAI,CAAC,EAAE,KAAK,UAAUA,OAAOA,KAAKyB,KAAK,CAAC;IAE5C,sEAAsE;IACtE,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,sEAAsE;IACtE,WAAW;IACX,IAAI9B,cAAcK,MAAMkC,iBAAiB;QACvC,IAAI;YACF,kEAAkE;YAClE,wEAAwE;YACxE,MAAMY,WAAW9C,IAAI,CAAC,EAAE,KAAK,SAASA,KAAKyB,KAAK,CAAC,KAAKzB;YACtD,MAAM+C,SAAS,MAAMnD,oBAAoBsC,gBAAgBY,UAAUlC;YACnE,IAAImC,QAAQ,OAAO;gBAAC,GAAGA,MAAM;gBAAEzB,UAAUjC,UAAU2D,OAAO;YAAA;YAC1D,MAAMC,YAAY9D,qBAAqB+C;YACvC,OAAOvB,qBACLmC,SAAS9B,MAAM,CAAC,CAACuB,QAAU,CAACU,UAAUC,QAAQ,CAACX,SAC/C3B;QAEJ,EAAE,OAAOuC,KAAK;YACZ,OAAO;gBACL7B,UAAUjC,UAAU+D,aAAa;gBACjC5B,QAAQ2B,eAAeE,QAAQF,IAAIG,OAAO,GAAGC,OAAOJ;YACtD;QACF;IACF;IAEA,wEAAwE;IACxE,2EAA2E;IAC3E,0EAA0E;IAC1E,kCAAkC;IAClC,MAAM,CAACK,YAAY,EAAE,EAAE,GAAGC,YAAY,GAAGrE,cAAc8C,gBAAgBlC;IACvE,MAAMiB,SAASL,SAAS,CAAC4C,UAAU,IAAI/D;IACvC,MAAMiE,oBACJzC,OAAOC,IAAI,KAAK,SAASyC,YAAYzB,eAAe0B,WAAW,CAACJ;IAClE,IAAI,CAACE,mBAAmB,OAAO/C,qBAAqBX,MAAMY;IAE1D,MAAMb,eAAe,MAAM2D,kBAAkBlD,IAAI;IAEjD,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAIqD;IACJ,IAAI;QACF,MAAMC,SAAS,MAAM7E,OAAO8E,KAAK,CAACN,aAAa;YAC7Cd,MAAM5C,aAAa4C,IAAI;YACvBqB,WAAWjE,aAAaiE,SAAS;YACjCC,gBAAgBlE,aAAakE,cAAc;YAC3CC,OAAOnE,aAAamE,KAAK;YACzBC,QAAQpE,aAAaoE,MAAM;QAC7B;QACAN,aAAa;YACXlB,MAAMmB,OAAOnB,IAAI;YACjBuB,OAAOJ,OAAOI,KAAK;QACrB;IACF,EAAE,OAAOf,KAAK;QACZ,OAAO;YACLK;YACAlC,UAAUjC,UAAUkC,WAAW;YAC/BC,QAAQ2B,eAAeE,QAAQF,IAAIG,OAAO,GAAGC,OAAOJ;QACtD;IACF;IAEA,IAAI,CAAClC,OAAOmD,QAAQ,CAACP,aAAa;QAChC,MAAMQ,YAAYb,UAAUpC,UAAU,CAAC,KAAK;QAC5C,IAAII,SAAS,CAAC,qBAAqB,EAAE6C,UAAU,wBAAwB,CAAC;QAExE,IAAI3E,8BAA8BuB,SAAS;YACzC,MAAMqD,kBAAkBrD,OAAOsD,WAAW,CAACvD,MAAM,CAC/C,CAACwD,OAASX,WAAWK,KAAK,CAACM,KAAK,KAAKb,aAAaE,WAAWK,KAAK,CAACM,KAAK,KAAK;YAE/E,IAAIF,gBAAgBG,MAAM,GAAG,GAAG;gBAC9BjD,SAAS,CAAC,MAAM,EAAE8C,gBAAgBnD,GAAG,CAAC,CAACqD,OAAS,CAAC,EAAE,EAAEA,MAAM,EAAE9C,IAAI,CAAC,MAAM,kCAAkC,EAAE2C,UAAU,EAAE,CAAC;YAC3H;QACF;QAEA,OAAO;YACLb;YACAlC,UAAUjC,UAAUkC,WAAW;YAC/BC;QACF;IACF;IAEA,IAAI;QACF,MAAMrB,UAAUL,mBAAmBC,cAAc0D,aAAavB;QAC9D,MAAM/B,QAAQC,qBAAqB;QACnC,OAAO;YAACoD;YAAWlC,UAAUjC,UAAU2D,OAAO;YAAExB,QAAQA,OAAOE,IAAI,CAAC;QAAK;IAC3E,EAAE,OAAOyB,KAAK;QACZ,MAAMuB,OAAOvB,IAAIwB,KAAK,EAAED;QAExB,iEAAiE;QACjE,IAAIA,SAASrF,UAAU2D,OAAO,EAAE;YAC9B,OAAO;gBAACQ;gBAAWlC,UAAUjC,UAAU2D,OAAO;gBAAExB,QAAQA,OAAOE,IAAI,CAAC;YAAK;QAC3E;QAEA,MAAM4B,UAAUzD,iBAAiBsD,QAAQI,OAAOJ;QAChD,IAAIG,SAAS9B,OAAOa,IAAI,CAACiB;QACzB,OAAO;YACLE;YACAlC,UAAU,OAAOoD,SAAS,WAAWA,OAAOrF,UAAU+D,aAAa;YACnE5B,QAAQA,OAAOE,IAAI,CAAC;QACtB;IACF;AACF"}

package/dist/exports/runtime.d.ts

@@ -1,3 +1,7 @@
+import { AssetSource } from "@sanity/types";
+import { AssetSourceComponent } from "@sanity/workbench-cli";
+import { AssetSourceComponentProps } from "@sanity/types";
+import { AssetSourceViewComponents } from "@sanity/workbench-cli";
 import { DefinedService } from "@sanity/workbench-cli";
 import { DefinedView } from "@sanity/workbench-cli";
 import { InterfaceType } from "@sanity/workbench-cli";
@@ -12,6 +16,14 @@ import { unstable_defineService } from "@sanity/workbench-cli";
 import { unstable_defineView } from "@sanity/workbench-cli";
 import { ViewComponentsByType } from "@sanity/workbench-cli";
 
+export { AssetSource };
+
+export { AssetSourceComponent };
+
+export { AssetSourceComponentProps };
+
+export { AssetSourceViewComponents };
+
 export { DefinedService };
 
 export { DefinedView };

package/dist/exports/runtime.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/exports/runtime.ts"],"sourcesContent":["// Browser-safe runtime authoring helpers for the module-federation extension API.\n//\n// View/service src files bundle to the browser, so this entry re-exports ONLY\n// from dependency-light, browser-safe modules — it must never import\n// `@sanity/cli-core` or anything Node-only, or it would drag the CLI into the\n// frontend bundle. The `sanity` runtime package re-exports from here, so the\n// same constraint protects it.\n//\n// `unstable_defineApp` is config-time (Node) and stays on the main `@sanity/cli`\n// entry; only the runtime helpers live here.\nexport type {\n  DefinedService,\n  DefinedView,\n  InterfaceType,\n  PanelComponent,\n  PanelViewComponents,\n  PanelViewProps,\n  ServiceCallback,\n  ServiceContext,\n  ServiceInfo,\n  ServiceType,\n  ViewComponentsByType,\n} from '@sanity/workbench-cli'\nexport {unstable_defineService, unstable_defineView} from '@sanity/workbench-cli'\n"],"names":["unstable_defineService","unstable_defineView"],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAC9E,6EAA6E;AAC7E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,6CAA6C;AAc7C,SAAQA,sBAAsB,EAAEC,mBAAmB,QAAO,wBAAuB"}
+{"version":3,"sources":["../../src/exports/runtime.ts"],"sourcesContent":["// Browser-safe runtime authoring helpers for the module-federation extension API.\n//\n// View/service src files bundle to the browser, so this entry re-exports ONLY\n// from dependency-light, browser-safe modules — it must never import\n// `@sanity/cli-core` or anything Node-only, or it would drag the CLI into the\n// frontend bundle. The `sanity` runtime package re-exports from here, so the\n// same constraint protects it.\n//\n// `unstable_defineApp` is config-time (Node) and stays on the main `@sanity/cli`\n// entry; only the runtime helpers live here.\nexport type {AssetSource, AssetSourceComponentProps} from '@sanity/types'\nexport type {\n  AssetSourceComponent,\n  AssetSourceViewComponents,\n  DefinedService,\n  DefinedView,\n  InterfaceType,\n  PanelComponent,\n  PanelViewComponents,\n  PanelViewProps,\n  ServiceCallback,\n  ServiceContext,\n  ServiceInfo,\n  ServiceType,\n  ViewComponentsByType,\n} from '@sanity/workbench-cli'\nexport {unstable_defineService, unstable_defineView} from '@sanity/workbench-cli'\n"],"names":["unstable_defineService","unstable_defineView"],"mappings":"AAAA,kFAAkF;AAClF,EAAE;AACF,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAC9E,6EAA6E;AAC7E,+BAA+B;AAC/B,EAAE;AACF,iFAAiF;AACjF,6CAA6C;AAiB7C,SAAQA,sBAAsB,EAAEC,mBAAmB,QAAO,wBAAuB"}

package/dist/services/mintProject.js

@@ -0,0 +1,91 @@
+import { subdebug } from '@sanity/cli-core/debug';
+import { createRequester } from '@sanity/cli-core/request';
+import { isStaging } from '@sanity/cli-core/util';
+import { TERMS_OF_SERVICE_FALLBACK_NOTICE, TERMS_OF_SERVICE_FALLBACK_URL } from '../util/mintProjectConstants.js';
+const debug = subdebug('new:provision');
+/** Provision API version for minting unclaimed projects. */ export const PROVISION_API_VERSION = 'v2026-06-23';
+const request = createRequester({
+    middleware: {
+        httpErrors: false,
+        promise: {
+            onlyBody: false
+        }
+    }
+});
+function getProvisionApiBase() {
+    const override = process.env.SANITY_API_HOST;
+    if (override) return override.replace(/\/$/u, '');
+    return isStaging() ? 'https://api.sanity.work' : 'https://api.sanity.io';
+}
+function parseJsonBody(body) {
+    if (typeof body !== 'string') return body;
+    try {
+        return JSON.parse(body);
+    } catch  {
+        return undefined;
+    }
+}
+function getString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function parseProvisionResponse(body) {
+    const data = parseJsonBody(body);
+    const response = data && typeof data === 'object' && !Array.isArray(data) ? data : {};
+    const links = response.links && typeof response.links === 'object' && !Array.isArray(response.links) ? response.links : {};
+    const terms = response.terms && typeof response.terms === 'object' && !Array.isArray(response.terms) ? response.terms : {};
+    const minted = {
+        apiHost: getString(response.apiHost),
+        claimApiUrl: getString(links.claimApiUrl),
+        claimToken: getString(response.claimToken),
+        claimUrl: getString(links.claimUrl),
+        datasetName: getString(response.datasetName),
+        expiresAt: getString(response.expiresAt),
+        resourceId: getString(response.resourceId),
+        token: getString(response.token)
+    };
+    const missing = Object.entries(minted).filter(([, value])=>value === undefined).map(([key])=>key);
+    if (response.resourceType !== 'project') {
+        missing.push('resourceType');
+    }
+    if (missing.length > 0) {
+        throw new Error(`Project creation response is missing or invalid: ${missing.join(', ')}`);
+    }
+    return {
+        ...minted,
+        termsNotice: getString(terms.notice) ?? TERMS_OF_SERVICE_FALLBACK_NOTICE,
+        termsUrl: getString(terms.url) ?? TERMS_OF_SERVICE_FALLBACK_URL
+    };
+}
+/**
+ * Mint an unclaimed Sanity project through the public provision endpoint.
+ */ export async function mintUnclaimedProject(options) {
+    const displayName = options.displayName.trim();
+    if (!displayName || displayName.length > 80) {
+        throw new Error('Project name must be 1-80 characters.');
+    }
+    const url = `${getProvisionApiBase()}/${PROVISION_API_VERSION}/provision`;
+    debug('minting unclaimed project at %s', url);
+    const response = await request({
+        body: JSON.stringify({
+            displayName,
+            resourceType: 'project'
+        }),
+        headers: {
+            'Content-Type': 'application/json'
+        },
+        method: 'POST',
+        url
+    });
+    if (response.statusCode === 404) {
+        throw new Error('Creating projects without an account is currently unavailable. Try again later, or run `sanity login` and `sanity init`.');
+    }
+    if (response.statusCode === 429) {
+        throw new Error('Project creation rate limit reached for this machine. Try again later.');
+    }
+    if (response.statusCode < 200 || response.statusCode >= 300) {
+        throw new Error(`Project creation failed (HTTP ${response.statusCode}). Try again later.`);
+    }
+    return parseProvisionResponse(response.body);
+}
+
+//# sourceMappingURL=mintProject.js.map

package/dist/services/mintProject.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/services/mintProject.ts"],"sourcesContent":["import {subdebug} from '@sanity/cli-core/debug'\nimport {createRequester} from '@sanity/cli-core/request'\nimport {isStaging} from '@sanity/cli-core/util'\n\nimport {\n  TERMS_OF_SERVICE_FALLBACK_NOTICE,\n  TERMS_OF_SERVICE_FALLBACK_URL,\n} from '../util/mintProjectConstants.js'\n\nconst debug = subdebug('new:provision')\n\n/** Provision API version for minting unclaimed projects. */\nexport const PROVISION_API_VERSION = 'v2026-06-23'\n\nconst request = createRequester({middleware: {httpErrors: false, promise: {onlyBody: false}}})\n\nexport interface MintedProject {\n  apiHost: string\n  claimApiUrl: string\n  claimToken: string\n  claimUrl: string\n  datasetName: string\n  expiresAt: string\n  resourceId: string\n  /** Terms of Service accepted by using the project. Falls back to the bundled constants. */\n  termsNotice: string\n  termsUrl: string\n  token: string\n}\n\nfunction getProvisionApiBase(): string {\n  const override = process.env.SANITY_API_HOST\n  if (override) return override.replace(/\\/$/u, '')\n  return isStaging() ? 'https://api.sanity.work' : 'https://api.sanity.io'\n}\n\nfunction parseJsonBody(body: unknown): unknown {\n  if (typeof body !== 'string') return body\n\n  try {\n    return JSON.parse(body)\n  } catch {\n    return undefined\n  }\n}\n\nfunction getString(value: unknown): string | undefined {\n  return typeof value === 'string' && value.length > 0 ? value : undefined\n}\n\nfunction parseProvisionResponse(body: unknown): MintedProject {\n  const data = parseJsonBody(body)\n  const response =\n    data && typeof data === 'object' && !Array.isArray(data)\n      ? (data as Record<string, unknown>)\n      : {}\n  const links =\n    response.links && typeof response.links === 'object' && !Array.isArray(response.links)\n      ? (response.links as Record<string, unknown>)\n      : {}\n  const terms =\n    response.terms && typeof response.terms === 'object' && !Array.isArray(response.terms)\n      ? (response.terms as Record<string, unknown>)\n      : {}\n\n  const minted = {\n    apiHost: getString(response.apiHost),\n    claimApiUrl: getString(links.claimApiUrl),\n    claimToken: getString(response.claimToken),\n    claimUrl: getString(links.claimUrl),\n    datasetName: getString(response.datasetName),\n    expiresAt: getString(response.expiresAt),\n    resourceId: getString(response.resourceId),\n    token: getString(response.token),\n  }\n  const missing = Object.entries(minted)\n    .filter(([, value]) => value === undefined)\n    .map(([key]) => key)\n\n  if (response.resourceType !== 'project') {\n    missing.push('resourceType')\n  }\n  if (missing.length > 0) {\n    throw new Error(`Project creation response is missing or invalid: ${missing.join(', ')}`)\n  }\n\n  return {\n    ...(minted as Omit<MintedProject, 'termsNotice' | 'termsUrl'>),\n    termsNotice: getString(terms.notice) ?? TERMS_OF_SERVICE_FALLBACK_NOTICE,\n    termsUrl: getString(terms.url) ?? TERMS_OF_SERVICE_FALLBACK_URL,\n  }\n}\n\n/**\n * Mint an unclaimed Sanity project through the public provision endpoint.\n */\nexport async function mintUnclaimedProject(options: {displayName: string}): Promise<MintedProject> {\n  const displayName = options.displayName.trim()\n  if (!displayName || displayName.length > 80) {\n    throw new Error('Project name must be 1-80 characters.')\n  }\n\n  const url = `${getProvisionApiBase()}/${PROVISION_API_VERSION}/provision`\n  debug('minting unclaimed project at %s', url)\n\n  const response = await request({\n    body: JSON.stringify({displayName, resourceType: 'project'}),\n    headers: {'Content-Type': 'application/json'},\n    method: 'POST',\n    url,\n  })\n\n  if (response.statusCode === 404) {\n    throw new Error(\n      'Creating projects without an account is currently unavailable. Try again later, or run `sanity login` and `sanity init`.',\n    )\n  }\n  if (response.statusCode === 429) {\n    throw new Error('Project creation rate limit reached for this machine. Try again later.')\n  }\n  if (response.statusCode < 200 || response.statusCode >= 300) {\n    throw new Error(`Project creation failed (HTTP ${response.statusCode}). Try again later.`)\n  }\n\n  return parseProvisionResponse(response.body)\n}\n"],"names":["subdebug","createRequester","isStaging","TERMS_OF_SERVICE_FALLBACK_NOTICE","TERMS_OF_SERVICE_FALLBACK_URL","debug","PROVISION_API_VERSION","request","middleware","httpErrors","promise","onlyBody","getProvisionApiBase","override","process","env","SANITY_API_HOST","replace","parseJsonBody","body","JSON","parse","undefined","getString","value","length","parseProvisionResponse","data","response","Array","isArray","links","terms","minted","apiHost","claimApiUrl","claimToken","claimUrl","datasetName","expiresAt","resourceId","token","missing","Object","entries","filter","map","key","resourceType","push","Error","join","termsNotice","notice","termsUrl","url","mintUnclaimedProject","options","displayName","trim","stringify","headers","method","statusCode"],"mappings":"AAAA,SAAQA,QAAQ,QAAO,yBAAwB;AAC/C,SAAQC,eAAe,QAAO,2BAA0B;AACxD,SAAQC,SAAS,QAAO,wBAAuB;AAE/C,SACEC,gCAAgC,EAChCC,6BAA6B,QACxB,kCAAiC;AAExC,MAAMC,QAAQL,SAAS;AAEvB,0DAA0D,GAC1D,OAAO,MAAMM,wBAAwB,cAAa;AAElD,MAAMC,UAAUN,gBAAgB;IAACO,YAAY;QAACC,YAAY;QAAOC,SAAS;YAACC,UAAU;QAAK;IAAC;AAAC;AAgB5F,SAASC;IACP,MAAMC,WAAWC,QAAQC,GAAG,CAACC,eAAe;IAC5C,IAAIH,UAAU,OAAOA,SAASI,OAAO,CAAC,QAAQ;IAC9C,OAAOf,cAAc,4BAA4B;AACnD;AAEA,SAASgB,cAAcC,IAAa;IAClC,IAAI,OAAOA,SAAS,UAAU,OAAOA;IAErC,IAAI;QACF,OAAOC,KAAKC,KAAK,CAACF;IACpB,EAAE,OAAM;QACN,OAAOG;IACT;AACF;AAEA,SAASC,UAAUC,KAAc;IAC/B,OAAO,OAAOA,UAAU,YAAYA,MAAMC,MAAM,GAAG,IAAID,QAAQF;AACjE;AAEA,SAASI,uBAAuBP,IAAa;IAC3C,MAAMQ,OAAOT,cAAcC;IAC3B,MAAMS,WACJD,QAAQ,OAAOA,SAAS,YAAY,CAACE,MAAMC,OAAO,CAACH,QAC9CA,OACD,CAAC;IACP,MAAMI,QACJH,SAASG,KAAK,IAAI,OAAOH,SAASG,KAAK,KAAK,YAAY,CAACF,MAAMC,OAAO,CAACF,SAASG,KAAK,IAChFH,SAASG,KAAK,GACf,CAAC;IACP,MAAMC,QACJJ,SAASI,KAAK,IAAI,OAAOJ,SAASI,KAAK,KAAK,YAAY,CAACH,MAAMC,OAAO,CAACF,SAASI,KAAK,IAChFJ,SAASI,KAAK,GACf,CAAC;IAEP,MAAMC,SAAS;QACbC,SAASX,UAAUK,SAASM,OAAO;QACnCC,aAAaZ,UAAUQ,MAAMI,WAAW;QACxCC,YAAYb,UAAUK,SAASQ,UAAU;QACzCC,UAAUd,UAAUQ,MAAMM,QAAQ;QAClCC,aAAaf,UAAUK,SAASU,WAAW;QAC3CC,WAAWhB,UAAUK,SAASW,SAAS;QACvCC,YAAYjB,UAAUK,SAASY,UAAU;QACzCC,OAAOlB,UAAUK,SAASa,KAAK;IACjC;IACA,MAAMC,UAAUC,OAAOC,OAAO,CAACX,QAC5BY,MAAM,CAAC,CAAC,GAAGrB,MAAM,GAAKA,UAAUF,WAChCwB,GAAG,CAAC,CAAC,CAACC,IAAI,GAAKA;IAElB,IAAInB,SAASoB,YAAY,KAAK,WAAW;QACvCN,QAAQO,IAAI,CAAC;IACf;IACA,IAAIP,QAAQjB,MAAM,GAAG,GAAG;QACtB,MAAM,IAAIyB,MAAM,CAAC,iDAAiD,EAAER,QAAQS,IAAI,CAAC,OAAO;IAC1F;IAEA,OAAO;QACL,GAAIlB,MAAM;QACVmB,aAAa7B,UAAUS,MAAMqB,MAAM,KAAKlD;QACxCmD,UAAU/B,UAAUS,MAAMuB,GAAG,KAAKnD;IACpC;AACF;AAEA;;CAEC,GACD,OAAO,eAAeoD,qBAAqBC,OAA8B;IACvE,MAAMC,cAAcD,QAAQC,WAAW,CAACC,IAAI;IAC5C,IAAI,CAACD,eAAeA,YAAYjC,MAAM,GAAG,IAAI;QAC3C,MAAM,IAAIyB,MAAM;IAClB;IAEA,MAAMK,MAAM,GAAG3C,sBAAsB,CAAC,EAAEN,sBAAsB,UAAU,CAAC;IACzED,MAAM,mCAAmCkD;IAEzC,MAAM3B,WAAW,MAAMrB,QAAQ;QAC7BY,MAAMC,KAAKwC,SAAS,CAAC;YAACF;YAAaV,cAAc;QAAS;QAC1Da,SAAS;YAAC,gBAAgB;QAAkB;QAC5CC,QAAQ;QACRP;IACF;IAEA,IAAI3B,SAASmC,UAAU,KAAK,KAAK;QAC/B,MAAM,IAAIb,MACR;IAEJ;IACA,IAAItB,SAASmC,UAAU,KAAK,KAAK;QAC/B,MAAM,IAAIb,MAAM;IAClB;IACA,IAAItB,SAASmC,UAAU,GAAG,OAAOnC,SAASmC,UAAU,IAAI,KAAK;QAC3D,MAAM,IAAIb,MAAM,CAAC,8BAA8B,EAAEtB,SAASmC,UAAU,CAAC,mBAAmB,CAAC;IAC3F;IAEA,OAAOrC,uBAAuBE,SAAST,IAAI;AAC7C"}

package/dist/services/projects.js

@@ -1,6 +1,7 @@
 import { debug, getGlobalCliClient, getProjectCliClient } from '@sanity/cli-core';
 export const PROJECTS_API_VERSION = '2025-09-22';
 export const CREATE_PROJECT_API_VERSION = 'v2025-05-14';
+const UNCLAIMED_PROJECT_ORGANIZATION_ID = 'oSystemUnclaimed';
 /**
  * Create a new Sanity project
  */ export async function createProject(options) {
@@ -37,6 +38,24 @@ export async function getProjectById(projectId) {
     });
     return client.projects.getById(projectId);
 }
+export async function getProjectClaimStatus(projectId, token) {
+    try {
+        const client = await getProjectCliClient({
+            apiVersion: PROJECTS_API_VERSION,
+            projectId,
+            requireUser: true,
+            token
+        });
+        const project = await client.projects.getById(projectId);
+        if (typeof project.organizationId !== 'string' || project.organizationId.length === 0) {
+            return 'unknown';
+        }
+        return project.organizationId === UNCLAIMED_PROJECT_ORGANIZATION_ID ? 'unclaimed' : 'claimed';
+    } catch (error) {
+        debug('failed to check claim status for project %s: %s', projectId, error instanceof Error ? error.message : `${error}`);
+        return 'unknown';
+    }
+}
 export async function getProjectRoles(projectId) {
     const client = await getGlobalCliClient({
         apiVersion: PROJECTS_API_VERSION,