@sanity/cli 7.15.0 → 7.16.0

package/dist/services/projects.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/services/projects.ts"],"sourcesContent":["import {debug, getGlobalCliClient, getProjectCliClient} from '@sanity/cli-core'\nimport {SanityProject} from '@sanity/client'\n\nimport {type Invite, type Role} from '../actions/users/types.js'\n\nexport const PROJECTS_API_VERSION = '2025-09-22'\n\nexport const CREATE_PROJECT_API_VERSION = 'v2025-05-14'\n\ninterface CreateProjectOptions {\n  displayName: string\n\n  metadata?: {\n    coupon?: string\n    integration?: string\n  }\n  organizationId?: string\n  subscription?: {planId: string}\n}\n\nexport interface CreateProjectResult {\n  displayName: string\n  projectId: string\n}\n\n/**\n * Create a new Sanity project\n */\nexport async function createProject(options: CreateProjectOptions): Promise<CreateProjectResult> {\n  const client = await getGlobalCliClient({\n    apiVersion: CREATE_PROJECT_API_VERSION,\n    requireUser: true,\n  })\n\n  try {\n    const response = await client.request({\n      body: {\n        ...options,\n        metadata: {\n          ...options?.metadata,\n          integration: 'cli',\n        },\n      },\n      method: 'POST',\n      uri: '/projects',\n    })\n\n    return {\n      displayName: options.displayName || '',\n      projectId: response.projectId || response.id,\n    }\n  } catch (err) {\n    debug('Error creating project', err)\n    throw err\n  }\n}\n\nexport async function getProjectById(projectId: string) {\n  const client = await getProjectCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    projectId,\n    requireUser: true,\n  })\n\n  return client.projects.getById(projectId)\n}\n\nexport async function getProjectRoles(projectId: string) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.request<Role[]>({uri: `/projects/${projectId}/roles`})\n}\n\ninterface InviteUserOptions {\n  email: string\n  projectId: string\n  role: string\n}\n\nexport async function inviteUser({email, projectId, role}: InviteUserOptions) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.request({\n    body: {email, role},\n    maxRedirects: 0,\n    method: 'POST',\n    uri: `/invitations/project/${projectId}`,\n    useGlobalApi: true,\n  })\n}\n\nexport async function listProjects({\n  onlyExplicitMembership = true,\n}: {\n  onlyExplicitMembership?: boolean\n} = {}) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.projects.list({onlyExplicitMembership})\n}\n\nexport async function getProjectInvites(projectId: string) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.request<Invite[]>({uri: `/invitations/project/${projectId}`})\n}\n\nexport async function updateProjectInitializedAt(projectId: string) {\n  const client = await getProjectCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    projectId,\n    requireUser: true,\n  })\n\n  const project = await client.request<SanityProject>({uri: `/projects/${projectId}`})\n\n  if (!project?.metadata?.cliInitializedAt) {\n    await client.request({\n      body: {metadata: {cliInitializedAt: new Date().toISOString()}},\n      method: 'PATCH',\n      uri: `/projects/${projectId}`,\n    })\n  }\n}\n\nexport async function updateProjectInitalTemplate(projectId: string, templateName: string) {\n  const client = await getProjectCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    projectId,\n    requireUser: true,\n  })\n\n  await client.request({\n    body: {metadata: {initialTemplate: templateName}},\n    method: 'PATCH',\n    uri: `/projects/${projectId}`,\n  })\n}\n"],"names":["debug","getGlobalCliClient","getProjectCliClient","PROJECTS_API_VERSION","CREATE_PROJECT_API_VERSION","createProject","options","client","apiVersion","requireUser","response","request","body","metadata","integration","method","uri","displayName","projectId","id","err","getProjectById","projects","getById","getProjectRoles","inviteUser","email","role","maxRedirects","useGlobalApi","listProjects","onlyExplicitMembership","list","getProjectInvites","updateProjectInitializedAt","project","cliInitializedAt","Date","toISOString","updateProjectInitalTemplate","templateName","initialTemplate"],"mappings":"AAAA,SAAQA,KAAK,EAAEC,kBAAkB,EAAEC,mBAAmB,QAAO,mBAAkB;AAK/E,OAAO,MAAMC,uBAAuB,aAAY;AAEhD,OAAO,MAAMC,6BAA6B,cAAa;AAkBvD;;CAEC,GACD,OAAO,eAAeC,cAAcC,OAA6B;IAC/D,MAAMC,SAAS,MAAMN,mBAAmB;QACtCO,YAAYJ;QACZK,aAAa;IACf;IAEA,IAAI;QACF,MAAMC,WAAW,MAAMH,OAAOI,OAAO,CAAC;YACpCC,MAAM;gBACJ,GAAGN,OAAO;gBACVO,UAAU;oBACR,GAAGP,SAASO,QAAQ;oBACpBC,aAAa;gBACf;YACF;YACAC,QAAQ;YACRC,KAAK;QACP;QAEA,OAAO;YACLC,aAAaX,QAAQW,WAAW,IAAI;YACpCC,WAAWR,SAASQ,SAAS,IAAIR,SAASS,EAAE;QAC9C;IACF,EAAE,OAAOC,KAAK;QACZpB,MAAM,0BAA0BoB;QAChC,MAAMA;IACR;AACF;AAEA,OAAO,eAAeC,eAAeH,SAAiB;IACpD,MAAMX,SAAS,MAAML,oBAAoB;QACvCM,YAAYL;QACZe;QACAT,aAAa;IACf;IAEA,OAAOF,OAAOe,QAAQ,CAACC,OAAO,CAACL;AACjC;AAEA,OAAO,eAAeM,gBAAgBN,SAAiB;IACrD,MAAMX,SAAS,MAAMN,mBAAmB;QACtCO,YAAYL;QACZM,aAAa;IACf;IAEA,OAAOF,OAAOI,OAAO,CAAS;QAACK,KAAK,CAAC,UAAU,EAAEE,UAAU,MAAM,CAAC;IAAA;AACpE;AAQA,OAAO,eAAeO,WAAW,EAACC,KAAK,EAAER,SAAS,EAAES,IAAI,EAAoB;IAC1E,MAAMpB,SAAS,MAAMN,mBAAmB;QACtCO,YAAYL;QACZM,aAAa;IACf;IAEA,OAAOF,OAAOI,OAAO,CAAC;QACpBC,MAAM;YAACc;YAAOC;QAAI;QAClBC,cAAc;QACdb,QAAQ;QACRC,KAAK,CAAC,qBAAqB,EAAEE,WAAW;QACxCW,cAAc;IAChB;AACF;AAEA,OAAO,eAAeC,aAAa,EACjCC,yBAAyB,IAAI,EAG9B,GAAG,CAAC,CAAC;IACJ,MAAMxB,SAAS,MAAMN,mBAAmB;QACtCO,YAAYL;QACZM,aAAa;IACf;IAEA,OAAOF,OAAOe,QAAQ,CAACU,IAAI,CAAC;QAACD;IAAsB;AACrD;AAEA,OAAO,eAAeE,kBAAkBf,SAAiB;IACvD,MAAMX,SAAS,MAAMN,mBAAmB;QACtCO,YAAYL;QACZM,aAAa;IACf;IAEA,OAAOF,OAAOI,OAAO,CAAW;QAACK,KAAK,CAAC,qBAAqB,EAAEE,WAAW;IAAA;AAC3E;AAEA,OAAO,eAAegB,2BAA2BhB,SAAiB;IAChE,MAAMX,SAAS,MAAML,oBAAoB;QACvCM,YAAYL;QACZe;QACAT,aAAa;IACf;IAEA,MAAM0B,UAAU,MAAM5B,OAAOI,OAAO,CAAgB;QAACK,KAAK,CAAC,UAAU,EAAEE,WAAW;IAAA;IAElF,IAAI,CAACiB,SAAStB,UAAUuB,kBAAkB;QACxC,MAAM7B,OAAOI,OAAO,CAAC;YACnBC,MAAM;gBAACC,UAAU;oBAACuB,kBAAkB,IAAIC,OAAOC,WAAW;gBAAE;YAAC;YAC7DvB,QAAQ;YACRC,KAAK,CAAC,UAAU,EAAEE,WAAW;QAC/B;IACF;AACF;AAEA,OAAO,eAAeqB,4BAA4BrB,SAAiB,EAAEsB,YAAoB;IACvF,MAAMjC,SAAS,MAAML,oBAAoB;QACvCM,YAAYL;QACZe;QACAT,aAAa;IACf;IAEA,MAAMF,OAAOI,OAAO,CAAC;QACnBC,MAAM;YAACC,UAAU;gBAAC4B,iBAAiBD;YAAY;QAAC;QAChDzB,QAAQ;QACRC,KAAK,CAAC,UAAU,EAAEE,WAAW;IAC/B;AACF"}
+{"version":3,"sources":["../../src/services/projects.ts"],"sourcesContent":["import {debug, getGlobalCliClient, getProjectCliClient} from '@sanity/cli-core'\nimport {SanityProject} from '@sanity/client'\n\nimport {type Invite, type Role} from '../actions/users/types.js'\n\nexport const PROJECTS_API_VERSION = '2025-09-22'\n\nexport const CREATE_PROJECT_API_VERSION = 'v2025-05-14'\n\nconst UNCLAIMED_PROJECT_ORGANIZATION_ID = 'oSystemUnclaimed'\n\nexport type ProjectClaimStatus = 'claimed' | 'unclaimed' | 'unknown'\n\ninterface CreateProjectOptions {\n  displayName: string\n\n  metadata?: {\n    coupon?: string\n    integration?: string\n  }\n  organizationId?: string\n  subscription?: {planId: string}\n}\n\nexport interface CreateProjectResult {\n  displayName: string\n  projectId: string\n}\n\n/**\n * Create a new Sanity project\n */\nexport async function createProject(options: CreateProjectOptions): Promise<CreateProjectResult> {\n  const client = await getGlobalCliClient({\n    apiVersion: CREATE_PROJECT_API_VERSION,\n    requireUser: true,\n  })\n\n  try {\n    const response = await client.request({\n      body: {\n        ...options,\n        metadata: {\n          ...options?.metadata,\n          integration: 'cli',\n        },\n      },\n      method: 'POST',\n      uri: '/projects',\n    })\n\n    return {\n      displayName: options.displayName || '',\n      projectId: response.projectId || response.id,\n    }\n  } catch (err) {\n    debug('Error creating project', err)\n    throw err\n  }\n}\n\nexport async function getProjectById(projectId: string) {\n  const client = await getProjectCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    projectId,\n    requireUser: true,\n  })\n\n  return client.projects.getById(projectId)\n}\n\nexport async function getProjectClaimStatus(\n  projectId: string,\n  token: string,\n): Promise<ProjectClaimStatus> {\n  try {\n    const client = await getProjectCliClient({\n      apiVersion: PROJECTS_API_VERSION,\n      projectId,\n      requireUser: true,\n      token,\n    })\n    const project = await client.projects.getById(projectId)\n\n    if (typeof project.organizationId !== 'string' || project.organizationId.length === 0) {\n      return 'unknown'\n    }\n\n    return project.organizationId === UNCLAIMED_PROJECT_ORGANIZATION_ID ? 'unclaimed' : 'claimed'\n  } catch (error) {\n    debug(\n      'failed to check claim status for project %s: %s',\n      projectId,\n      error instanceof Error ? error.message : `${error}`,\n    )\n    return 'unknown'\n  }\n}\n\nexport async function getProjectRoles(projectId: string) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.request<Role[]>({uri: `/projects/${projectId}/roles`})\n}\n\ninterface InviteUserOptions {\n  email: string\n  projectId: string\n  role: string\n}\n\nexport async function inviteUser({email, projectId, role}: InviteUserOptions) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.request({\n    body: {email, role},\n    maxRedirects: 0,\n    method: 'POST',\n    uri: `/invitations/project/${projectId}`,\n    useGlobalApi: true,\n  })\n}\n\nexport async function listProjects({\n  onlyExplicitMembership = true,\n}: {\n  onlyExplicitMembership?: boolean\n} = {}) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.projects.list({onlyExplicitMembership})\n}\n\nexport async function getProjectInvites(projectId: string) {\n  const client = await getGlobalCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    requireUser: true,\n  })\n\n  return client.request<Invite[]>({uri: `/invitations/project/${projectId}`})\n}\n\nexport async function updateProjectInitializedAt(projectId: string) {\n  const client = await getProjectCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    projectId,\n    requireUser: true,\n  })\n\n  const project = await client.request<SanityProject>({uri: `/projects/${projectId}`})\n\n  if (!project?.metadata?.cliInitializedAt) {\n    await client.request({\n      body: {metadata: {cliInitializedAt: new Date().toISOString()}},\n      method: 'PATCH',\n      uri: `/projects/${projectId}`,\n    })\n  }\n}\n\nexport async function updateProjectInitalTemplate(projectId: string, templateName: string) {\n  const client = await getProjectCliClient({\n    apiVersion: PROJECTS_API_VERSION,\n    projectId,\n    requireUser: true,\n  })\n\n  await client.request({\n    body: {metadata: {initialTemplate: templateName}},\n    method: 'PATCH',\n    uri: `/projects/${projectId}`,\n  })\n}\n"],"names":["debug","getGlobalCliClient","getProjectCliClient","PROJECTS_API_VERSION","CREATE_PROJECT_API_VERSION","UNCLAIMED_PROJECT_ORGANIZATION_ID","createProject","options","client","apiVersion","requireUser","response","request","body","metadata","integration","method","uri","displayName","projectId","id","err","getProjectById","projects","getById","getProjectClaimStatus","token","project","organizationId","length","error","Error","message","getProjectRoles","inviteUser","email","role","maxRedirects","useGlobalApi","listProjects","onlyExplicitMembership","list","getProjectInvites","updateProjectInitializedAt","cliInitializedAt","Date","toISOString","updateProjectInitalTemplate","templateName","initialTemplate"],"mappings":"AAAA,SAAQA,KAAK,EAAEC,kBAAkB,EAAEC,mBAAmB,QAAO,mBAAkB;AAK/E,OAAO,MAAMC,uBAAuB,aAAY;AAEhD,OAAO,MAAMC,6BAA6B,cAAa;AAEvD,MAAMC,oCAAoC;AAoB1C;;CAEC,GACD,OAAO,eAAeC,cAAcC,OAA6B;IAC/D,MAAMC,SAAS,MAAMP,mBAAmB;QACtCQ,YAAYL;QACZM,aAAa;IACf;IAEA,IAAI;QACF,MAAMC,WAAW,MAAMH,OAAOI,OAAO,CAAC;YACpCC,MAAM;gBACJ,GAAGN,OAAO;gBACVO,UAAU;oBACR,GAAGP,SAASO,QAAQ;oBACpBC,aAAa;gBACf;YACF;YACAC,QAAQ;YACRC,KAAK;QACP;QAEA,OAAO;YACLC,aAAaX,QAAQW,WAAW,IAAI;YACpCC,WAAWR,SAASQ,SAAS,IAAIR,SAASS,EAAE;QAC9C;IACF,EAAE,OAAOC,KAAK;QACZrB,MAAM,0BAA0BqB;QAChC,MAAMA;IACR;AACF;AAEA,OAAO,eAAeC,eAAeH,SAAiB;IACpD,MAAMX,SAAS,MAAMN,oBAAoB;QACvCO,YAAYN;QACZgB;QACAT,aAAa;IACf;IAEA,OAAOF,OAAOe,QAAQ,CAACC,OAAO,CAACL;AACjC;AAEA,OAAO,eAAeM,sBACpBN,SAAiB,EACjBO,KAAa;IAEb,IAAI;QACF,MAAMlB,SAAS,MAAMN,oBAAoB;YACvCO,YAAYN;YACZgB;YACAT,aAAa;YACbgB;QACF;QACA,MAAMC,UAAU,MAAMnB,OAAOe,QAAQ,CAACC,OAAO,CAACL;QAE9C,IAAI,OAAOQ,QAAQC,cAAc,KAAK,YAAYD,QAAQC,cAAc,CAACC,MAAM,KAAK,GAAG;YACrF,OAAO;QACT;QAEA,OAAOF,QAAQC,cAAc,KAAKvB,oCAAoC,cAAc;IACtF,EAAE,OAAOyB,OAAO;QACd9B,MACE,mDACAmB,WACAW,iBAAiBC,QAAQD,MAAME,OAAO,GAAG,GAAGF,OAAO;QAErD,OAAO;IACT;AACF;AAEA,OAAO,eAAeG,gBAAgBd,SAAiB;IACrD,MAAMX,SAAS,MAAMP,mBAAmB;QACtCQ,YAAYN;QACZO,aAAa;IACf;IAEA,OAAOF,OAAOI,OAAO,CAAS;QAACK,KAAK,CAAC,UAAU,EAAEE,UAAU,MAAM,CAAC;IAAA;AACpE;AAQA,OAAO,eAAee,WAAW,EAACC,KAAK,EAAEhB,SAAS,EAAEiB,IAAI,EAAoB;IAC1E,MAAM5B,SAAS,MAAMP,mBAAmB;QACtCQ,YAAYN;QACZO,aAAa;IACf;IAEA,OAAOF,OAAOI,OAAO,CAAC;QACpBC,MAAM;YAACsB;YAAOC;QAAI;QAClBC,cAAc;QACdrB,QAAQ;QACRC,KAAK,CAAC,qBAAqB,EAAEE,WAAW;QACxCmB,cAAc;IAChB;AACF;AAEA,OAAO,eAAeC,aAAa,EACjCC,yBAAyB,IAAI,EAG9B,GAAG,CAAC,CAAC;IACJ,MAAMhC,SAAS,MAAMP,mBAAmB;QACtCQ,YAAYN;QACZO,aAAa;IACf;IAEA,OAAOF,OAAOe,QAAQ,CAACkB,IAAI,CAAC;QAACD;IAAsB;AACrD;AAEA,OAAO,eAAeE,kBAAkBvB,SAAiB;IACvD,MAAMX,SAAS,MAAMP,mBAAmB;QACtCQ,YAAYN;QACZO,aAAa;IACf;IAEA,OAAOF,OAAOI,OAAO,CAAW;QAACK,KAAK,CAAC,qBAAqB,EAAEE,WAAW;IAAA;AAC3E;AAEA,OAAO,eAAewB,2BAA2BxB,SAAiB;IAChE,MAAMX,SAAS,MAAMN,oBAAoB;QACvCO,YAAYN;QACZgB;QACAT,aAAa;IACf;IAEA,MAAMiB,UAAU,MAAMnB,OAAOI,OAAO,CAAgB;QAACK,KAAK,CAAC,UAAU,EAAEE,WAAW;IAAA;IAElF,IAAI,CAACQ,SAASb,UAAU8B,kBAAkB;QACxC,MAAMpC,OAAOI,OAAO,CAAC;YACnBC,MAAM;gBAACC,UAAU;oBAAC8B,kBAAkB,IAAIC,OAAOC,WAAW;gBAAE;YAAC;YAC7D9B,QAAQ;YACRC,KAAK,CAAC,UAAU,EAAEE,WAAW;QAC/B;IACF;AACF;AAEA,OAAO,eAAe4B,4BAA4B5B,SAAiB,EAAE6B,YAAoB;IACvF,MAAMxC,SAAS,MAAMN,oBAAoB;QACvCO,YAAYN;QACZgB;QACAT,aAAa;IACf;IAEA,MAAMF,OAAOI,OAAO,CAAC;QACnBC,MAAM;YAACC,UAAU;gBAACmC,iBAAiBD;YAAY;QAAC;QAChDhC,QAAQ;QACRC,KAAK,CAAC,UAAU,EAAEE,WAAW;IAC/B;AACF"}

package/dist/services/telemetry.js

@@ -1,5 +1,6 @@
 import { createHash } from 'node:crypto';
 import { getCliToken, getGlobalCliClient, getUserConfig } from '@sanity/cli-core';
+import { getCliExecutionContext } from '@sanity/cli-core/executionContext';
 import { telemetryDebug } from '../actions/telemetry/telemetryDebug.js';
 import { createExpiringConfig } from '../util/createExpiringConfig.js';
 export const TELEMETRY_API_VERSION = 'v2026-01-22';
@@ -74,6 +75,9 @@ const FIVE_MINUTES = 1000 * 60 * 5;
  *
  * @internal
  */ export async function fetchTelemetryConsent() {
+    // Programmatic invocations must not use the host user's disk-backed consent
+    // cache. The request is already authenticated with the invocation token.
+    if (getCliExecutionContext()) return getTelemetryConsent();
     const token = await getCliToken();
     const cacheKey = getTelemetryConsentCacheKey(token);
     // NOTE: createExpiringConfig is instantiated on every call, so in-flight request

package/dist/services/telemetry.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/services/telemetry.ts"],"sourcesContent":["import {createHash} from 'node:crypto'\n\nimport {getCliToken, getGlobalCliClient, getUserConfig} from '@sanity/cli-core'\nimport {type TelemetryEvent} from '@sanity/telemetry'\n\nimport {telemetryDebug} from '../actions/telemetry/telemetryDebug.js'\nimport {createExpiringConfig} from '../util/createExpiringConfig.js'\n\nexport const TELEMETRY_API_VERSION = 'v2026-01-22'\n\nexport const VALID_API_STATUSES = ['granted', 'denied', 'unset'] as const\nexport type ValidApiConsentStatus = (typeof VALID_API_STATUSES)[number]\n\nexport async function sendEvents(batch: TelemetryEvent[]) {\n  const client = await getGlobalCliClient({\n    apiVersion: TELEMETRY_API_VERSION,\n    requireUser: true,\n  })\n\n  const projectId = process.env.SANITY_TELEMETRY_PROJECT_ID\n\n  return client.request({\n    body: {batch, projectId},\n    json: true,\n    method: 'POST',\n    uri: '/intake/batch',\n  })\n}\n\nasync function getTelemetryConsent(): Promise<{\n  status: ValidApiConsentStatus\n}> {\n  const client = await getGlobalCliClient({\n    apiVersion: TELEMETRY_API_VERSION,\n    requireUser: false,\n  })\n\n  return client.request({tag: 'telemetry-consent', uri: '/intake/telemetry-status'})\n}\n\n/**\n * Check if the given status is a valid consent status\n *\n * @param status - The status to check\n * @returns True if the status is valid, false otherwise\n * @internal\n */\nexport function isValidApiConsentStatus(status: string): status is ValidApiConsentStatus {\n  return VALID_API_STATUSES.includes(status as ValidApiConsentStatus)\n}\n\n/**\n * Check if the given response is a valid API consent response\n *\n * @param response - The response to check\n * @returns True if the response is valid, false otherwise\n * @internal\n */\nfunction isValidApiConsentResponse(response: unknown): response is {status: ValidApiConsentStatus} {\n  return (\n    typeof response === 'object' &&\n    response !== null &&\n    'status' in response &&\n    typeof response.status === 'string' &&\n    isValidApiConsentStatus(response.status)\n  )\n}\n\nexport const TELEMETRY_CONSENT_CONFIG_KEY = 'telemetryConsent'\nconst FIVE_MINUTES = 1000 * 60 * 5\n\n/**\n * Get a token-scoped cache key for telemetry consent. This ensures that switching\n * users (via login/logout) always results in a cache miss, preventing one user\n * from inheriting another user's cached consent status.\n *\n * @param token - The current auth token, or undefined if not logged in\n * @returns A cache key scoped to the token\n */\nexport function getTelemetryConsentCacheKey(token: string | undefined): string {\n  if (!token) {\n    return TELEMETRY_CONSENT_CONFIG_KEY\n  }\n\n  const hash = createHash('sha256').update(token).digest('hex').slice(0, 12)\n  return `${TELEMETRY_CONSENT_CONFIG_KEY}:${hash}`\n}\n\n/**\n * Fetch the telemetry consent status for the current user\n * @returns The telemetry consent status\n *\n * @internal\n */\nexport async function fetchTelemetryConsent(): Promise<{\n  status: ValidApiConsentStatus\n}> {\n  const token = await getCliToken()\n  const cacheKey = getTelemetryConsentCacheKey(token)\n\n  // NOTE: createExpiringConfig is instantiated on every call, so in-flight request\n  // deduplication (via currentFetch) does not work across concurrent calls to\n  // fetchTelemetryConsent(). Two concurrent callers will make two HTTP requests.\n  // Consider moving to module-level instance if this becomes a bottleneck.\n  const telemetryConsentConfig = createExpiringConfig<{\n    status: ValidApiConsentStatus\n  }>({\n    fetchValue: () => getTelemetryConsent(),\n    key: cacheKey,\n    onCacheHit() {\n      telemetryDebug('Retrieved telemetry consent status from cache')\n    },\n    onFetch() {\n      telemetryDebug('Fetching telemetry consent status...')\n    },\n    onRevalidate() {\n      telemetryDebug('Revalidating cached telemetry consent status...')\n    },\n    store: getUserConfig(),\n    ttl: FIVE_MINUTES,\n    validateValue: isValidApiConsentResponse,\n  })\n\n  return telemetryConsentConfig.get()\n}\n"],"names":["createHash","getCliToken","getGlobalCliClient","getUserConfig","telemetryDebug","createExpiringConfig","TELEMETRY_API_VERSION","VALID_API_STATUSES","sendEvents","batch","client","apiVersion","requireUser","projectId","process","env","SANITY_TELEMETRY_PROJECT_ID","request","body","json","method","uri","getTelemetryConsent","tag","isValidApiConsentStatus","status","includes","isValidApiConsentResponse","response","TELEMETRY_CONSENT_CONFIG_KEY","FIVE_MINUTES","getTelemetryConsentCacheKey","token","hash","update","digest","slice","fetchTelemetryConsent","cacheKey","telemetryConsentConfig","fetchValue","key","onCacheHit","onFetch","onRevalidate","store","ttl","validateValue","get"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAa;AAEtC,SAAQC,WAAW,EAAEC,kBAAkB,EAAEC,aAAa,QAAO,mBAAkB;AAG/E,SAAQC,cAAc,QAAO,yCAAwC;AACrE,SAAQC,oBAAoB,QAAO,kCAAiC;AAEpE,OAAO,MAAMC,wBAAwB,cAAa;AAElD,OAAO,MAAMC,qBAAqB;IAAC;IAAW;IAAU;CAAQ,CAAS;AAGzE,OAAO,eAAeC,WAAWC,KAAuB;IACtD,MAAMC,SAAS,MAAMR,mBAAmB;QACtCS,YAAYL;QACZM,aAAa;IACf;IAEA,MAAMC,YAAYC,QAAQC,GAAG,CAACC,2BAA2B;IAEzD,OAAON,OAAOO,OAAO,CAAC;QACpBC,MAAM;YAACT;YAAOI;QAAS;QACvBM,MAAM;QACNC,QAAQ;QACRC,KAAK;IACP;AACF;AAEA,eAAeC;IAGb,MAAMZ,SAAS,MAAMR,mBAAmB;QACtCS,YAAYL;QACZM,aAAa;IACf;IAEA,OAAOF,OAAOO,OAAO,CAAC;QAACM,KAAK;QAAqBF,KAAK;IAA0B;AAClF;AAEA;;;;;;CAMC,GACD,OAAO,SAASG,wBAAwBC,MAAc;IACpD,OAAOlB,mBAAmBmB,QAAQ,CAACD;AACrC;AAEA;;;;;;CAMC,GACD,SAASE,0BAA0BC,QAAiB;IAClD,OACE,OAAOA,aAAa,YACpBA,aAAa,QACb,YAAYA,YACZ,OAAOA,SAASH,MAAM,KAAK,YAC3BD,wBAAwBI,SAASH,MAAM;AAE3C;AAEA,OAAO,MAAMI,+BAA+B,mBAAkB;AAC9D,MAAMC,eAAe,OAAO,KAAK;AAEjC;;;;;;;CAOC,GACD,OAAO,SAASC,4BAA4BC,KAAyB;IACnE,IAAI,CAACA,OAAO;QACV,OAAOH;IACT;IAEA,MAAMI,OAAOjC,WAAW,UAAUkC,MAAM,CAACF,OAAOG,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG;IACvE,OAAO,GAAGP,6BAA6B,CAAC,EAAEI,MAAM;AAClD;AAEA;;;;;CAKC,GACD,OAAO,eAAeI;IAGpB,MAAML,QAAQ,MAAM/B;IACpB,MAAMqC,WAAWP,4BAA4BC;IAE7C,iFAAiF;IACjF,4EAA4E;IAC5E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAMO,yBAAyBlC,qBAE5B;QACDmC,YAAY,IAAMlB;QAClBmB,KAAKH;QACLI;YACEtC,eAAe;QACjB;QACAuC;YACEvC,eAAe;QACjB;QACAwC;YACExC,eAAe;QACjB;QACAyC,OAAO1C;QACP2C,KAAKhB;QACLiB,eAAepB;IACjB;IAEA,OAAOY,uBAAuBS,GAAG;AACnC"}
+{"version":3,"sources":["../../src/services/telemetry.ts"],"sourcesContent":["import {createHash} from 'node:crypto'\n\nimport {getCliToken, getGlobalCliClient, getUserConfig} from '@sanity/cli-core'\nimport {getCliExecutionContext} from '@sanity/cli-core/executionContext'\nimport {type TelemetryEvent} from '@sanity/telemetry'\n\nimport {telemetryDebug} from '../actions/telemetry/telemetryDebug.js'\nimport {createExpiringConfig} from '../util/createExpiringConfig.js'\n\nexport const TELEMETRY_API_VERSION = 'v2026-01-22'\n\nexport const VALID_API_STATUSES = ['granted', 'denied', 'unset'] as const\nexport type ValidApiConsentStatus = (typeof VALID_API_STATUSES)[number]\n\nexport async function sendEvents(batch: TelemetryEvent[]) {\n  const client = await getGlobalCliClient({\n    apiVersion: TELEMETRY_API_VERSION,\n    requireUser: true,\n  })\n\n  const projectId = process.env.SANITY_TELEMETRY_PROJECT_ID\n\n  return client.request({\n    body: {batch, projectId},\n    json: true,\n    method: 'POST',\n    uri: '/intake/batch',\n  })\n}\n\nasync function getTelemetryConsent(): Promise<{\n  status: ValidApiConsentStatus\n}> {\n  const client = await getGlobalCliClient({\n    apiVersion: TELEMETRY_API_VERSION,\n    requireUser: false,\n  })\n\n  return client.request({tag: 'telemetry-consent', uri: '/intake/telemetry-status'})\n}\n\n/**\n * Check if the given status is a valid consent status\n *\n * @param status - The status to check\n * @returns True if the status is valid, false otherwise\n * @internal\n */\nexport function isValidApiConsentStatus(status: string): status is ValidApiConsentStatus {\n  return VALID_API_STATUSES.includes(status as ValidApiConsentStatus)\n}\n\n/**\n * Check if the given response is a valid API consent response\n *\n * @param response - The response to check\n * @returns True if the response is valid, false otherwise\n * @internal\n */\nfunction isValidApiConsentResponse(response: unknown): response is {status: ValidApiConsentStatus} {\n  return (\n    typeof response === 'object' &&\n    response !== null &&\n    'status' in response &&\n    typeof response.status === 'string' &&\n    isValidApiConsentStatus(response.status)\n  )\n}\n\nexport const TELEMETRY_CONSENT_CONFIG_KEY = 'telemetryConsent'\nconst FIVE_MINUTES = 1000 * 60 * 5\n\n/**\n * Get a token-scoped cache key for telemetry consent. This ensures that switching\n * users (via login/logout) always results in a cache miss, preventing one user\n * from inheriting another user's cached consent status.\n *\n * @param token - The current auth token, or undefined if not logged in\n * @returns A cache key scoped to the token\n */\nexport function getTelemetryConsentCacheKey(token: string | undefined): string {\n  if (!token) {\n    return TELEMETRY_CONSENT_CONFIG_KEY\n  }\n\n  const hash = createHash('sha256').update(token).digest('hex').slice(0, 12)\n  return `${TELEMETRY_CONSENT_CONFIG_KEY}:${hash}`\n}\n\n/**\n * Fetch the telemetry consent status for the current user\n * @returns The telemetry consent status\n *\n * @internal\n */\nexport async function fetchTelemetryConsent(): Promise<{\n  status: ValidApiConsentStatus\n}> {\n  // Programmatic invocations must not use the host user's disk-backed consent\n  // cache. The request is already authenticated with the invocation token.\n  if (getCliExecutionContext()) return getTelemetryConsent()\n\n  const token = await getCliToken()\n  const cacheKey = getTelemetryConsentCacheKey(token)\n\n  // NOTE: createExpiringConfig is instantiated on every call, so in-flight request\n  // deduplication (via currentFetch) does not work across concurrent calls to\n  // fetchTelemetryConsent(). Two concurrent callers will make two HTTP requests.\n  // Consider moving to module-level instance if this becomes a bottleneck.\n  const telemetryConsentConfig = createExpiringConfig<{\n    status: ValidApiConsentStatus\n  }>({\n    fetchValue: () => getTelemetryConsent(),\n    key: cacheKey,\n    onCacheHit() {\n      telemetryDebug('Retrieved telemetry consent status from cache')\n    },\n    onFetch() {\n      telemetryDebug('Fetching telemetry consent status...')\n    },\n    onRevalidate() {\n      telemetryDebug('Revalidating cached telemetry consent status...')\n    },\n    store: getUserConfig(),\n    ttl: FIVE_MINUTES,\n    validateValue: isValidApiConsentResponse,\n  })\n\n  return telemetryConsentConfig.get()\n}\n"],"names":["createHash","getCliToken","getGlobalCliClient","getUserConfig","getCliExecutionContext","telemetryDebug","createExpiringConfig","TELEMETRY_API_VERSION","VALID_API_STATUSES","sendEvents","batch","client","apiVersion","requireUser","projectId","process","env","SANITY_TELEMETRY_PROJECT_ID","request","body","json","method","uri","getTelemetryConsent","tag","isValidApiConsentStatus","status","includes","isValidApiConsentResponse","response","TELEMETRY_CONSENT_CONFIG_KEY","FIVE_MINUTES","getTelemetryConsentCacheKey","token","hash","update","digest","slice","fetchTelemetryConsent","cacheKey","telemetryConsentConfig","fetchValue","key","onCacheHit","onFetch","onRevalidate","store","ttl","validateValue","get"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAa;AAEtC,SAAQC,WAAW,EAAEC,kBAAkB,EAAEC,aAAa,QAAO,mBAAkB;AAC/E,SAAQC,sBAAsB,QAAO,oCAAmC;AAGxE,SAAQC,cAAc,QAAO,yCAAwC;AACrE,SAAQC,oBAAoB,QAAO,kCAAiC;AAEpE,OAAO,MAAMC,wBAAwB,cAAa;AAElD,OAAO,MAAMC,qBAAqB;IAAC;IAAW;IAAU;CAAQ,CAAS;AAGzE,OAAO,eAAeC,WAAWC,KAAuB;IACtD,MAAMC,SAAS,MAAMT,mBAAmB;QACtCU,YAAYL;QACZM,aAAa;IACf;IAEA,MAAMC,YAAYC,QAAQC,GAAG,CAACC,2BAA2B;IAEzD,OAAON,OAAOO,OAAO,CAAC;QACpBC,MAAM;YAACT;YAAOI;QAAS;QACvBM,MAAM;QACNC,QAAQ;QACRC,KAAK;IACP;AACF;AAEA,eAAeC;IAGb,MAAMZ,SAAS,MAAMT,mBAAmB;QACtCU,YAAYL;QACZM,aAAa;IACf;IAEA,OAAOF,OAAOO,OAAO,CAAC;QAACM,KAAK;QAAqBF,KAAK;IAA0B;AAClF;AAEA;;;;;;CAMC,GACD,OAAO,SAASG,wBAAwBC,MAAc;IACpD,OAAOlB,mBAAmBmB,QAAQ,CAACD;AACrC;AAEA;;;;;;CAMC,GACD,SAASE,0BAA0BC,QAAiB;IAClD,OACE,OAAOA,aAAa,YACpBA,aAAa,QACb,YAAYA,YACZ,OAAOA,SAASH,MAAM,KAAK,YAC3BD,wBAAwBI,SAASH,MAAM;AAE3C;AAEA,OAAO,MAAMI,+BAA+B,mBAAkB;AAC9D,MAAMC,eAAe,OAAO,KAAK;AAEjC;;;;;;;CAOC,GACD,OAAO,SAASC,4BAA4BC,KAAyB;IACnE,IAAI,CAACA,OAAO;QACV,OAAOH;IACT;IAEA,MAAMI,OAAOlC,WAAW,UAAUmC,MAAM,CAACF,OAAOG,MAAM,CAAC,OAAOC,KAAK,CAAC,GAAG;IACvE,OAAO,GAAGP,6BAA6B,CAAC,EAAEI,MAAM;AAClD;AAEA;;;;;CAKC,GACD,OAAO,eAAeI;IAGpB,4EAA4E;IAC5E,yEAAyE;IACzE,IAAIlC,0BAA0B,OAAOmB;IAErC,MAAMU,QAAQ,MAAMhC;IACpB,MAAMsC,WAAWP,4BAA4BC;IAE7C,iFAAiF;IACjF,4EAA4E;IAC5E,+EAA+E;IAC/E,yEAAyE;IACzE,MAAMO,yBAAyBlC,qBAE5B;QACDmC,YAAY,IAAMlB;QAClBmB,KAAKH;QACLI;YACEtC,eAAe;QACjB;QACAuC;YACEvC,eAAe;QACjB;QACAwC;YACExC,eAAe;QACjB;QACAyC,OAAO3C;QACP4C,KAAKhB;QACLiB,eAAepB;IACjB;IAEA,OAAOY,uBAAuBS,GAAG;AACnC"}

package/dist/util/formatClaimDeadline.js

@@ -0,0 +1,15 @@
+export function formatClaimDeadline(expiresAt) {
+    const deadline = new Date(expiresAt);
+    if (!Number.isFinite(deadline.getTime())) return expiresAt;
+    return new Intl.DateTimeFormat('en-GB', {
+        day: 'numeric',
+        hour: '2-digit',
+        hour12: false,
+        minute: '2-digit',
+        month: 'long',
+        timeZone: 'UTC',
+        year: 'numeric'
+    }).format(deadline).replace(' at ', ', ') + ' UTC';
+}
+
+//# sourceMappingURL=formatClaimDeadline.js.map

package/dist/util/formatClaimDeadline.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/util/formatClaimDeadline.ts"],"sourcesContent":["export function formatClaimDeadline(expiresAt: string): string {\n  const deadline = new Date(expiresAt)\n  if (!Number.isFinite(deadline.getTime())) return expiresAt\n  return (\n    new Intl.DateTimeFormat('en-GB', {\n      day: 'numeric',\n      hour: '2-digit',\n      hour12: false,\n      minute: '2-digit',\n      month: 'long',\n      timeZone: 'UTC',\n      year: 'numeric',\n    })\n      .format(deadline)\n      .replace(' at ', ', ') + ' UTC'\n  )\n}\n"],"names":["formatClaimDeadline","expiresAt","deadline","Date","Number","isFinite","getTime","Intl","DateTimeFormat","day","hour","hour12","minute","month","timeZone","year","format","replace"],"mappings":"AAAA,OAAO,SAASA,oBAAoBC,SAAiB;IACnD,MAAMC,WAAW,IAAIC,KAAKF;IAC1B,IAAI,CAACG,OAAOC,QAAQ,CAACH,SAASI,OAAO,KAAK,OAAOL;IACjD,OACE,IAAIM,KAAKC,cAAc,CAAC,SAAS;QAC/BC,KAAK;QACLC,MAAM;QACNC,QAAQ;QACRC,QAAQ;QACRC,OAAO;QACPC,UAAU;QACVC,MAAM;IACR,GACGC,MAAM,CAACd,UACPe,OAAO,CAAC,QAAQ,QAAQ;AAE/B"}

package/dist/util/mintProjectConstants.js

@@ -0,0 +1,6 @@
+/** Product window in which an unclaimed project must be claimed. */ export const CLAIM_WINDOW_HOURS = 72;
+export const SANITY_NEW_URL = 'https://sanity.new';
+export const TERMS_OF_SERVICE_FALLBACK_URL = 'https://www.sanity.io/legal/tos';
+export const TERMS_OF_SERVICE_FALLBACK_NOTICE = 'By continuing to use this project you accept the Sanity Terms of Service.';
+
+//# sourceMappingURL=mintProjectConstants.js.map

package/dist/util/mintProjectConstants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/util/mintProjectConstants.ts"],"sourcesContent":["/** Product window in which an unclaimed project must be claimed. */\nexport const CLAIM_WINDOW_HOURS = 72\n\nexport const SANITY_NEW_URL = 'https://sanity.new'\n\nexport const TERMS_OF_SERVICE_FALLBACK_URL = 'https://www.sanity.io/legal/tos'\n\nexport const TERMS_OF_SERVICE_FALLBACK_NOTICE =\n  'By continuing to use this project you accept the Sanity Terms of Service.'\n"],"names":["CLAIM_WINDOW_HOURS","SANITY_NEW_URL","TERMS_OF_SERVICE_FALLBACK_URL","TERMS_OF_SERVICE_FALLBACK_NOTICE"],"mappings":"AAAA,kEAAkE,GAClE,OAAO,MAAMA,qBAAqB,GAAE;AAEpC,OAAO,MAAMC,iBAAiB,qBAAoB;AAElD,OAAO,MAAMC,gCAAgC,kCAAiC;AAE9E,OAAO,MAAMC,mCACX,4EAA2E"}

package/dist/util/newCommandSplash.js

@@ -0,0 +1,27 @@
+import { styleText } from 'node:util';
+const ART = [
+    '          -          #:      @@@@',
+    '         @@@      @@@@@    -@@@=   @@@',
+    '       @@@@   %@@@@@@.    @@@@ %@@@@@@',
+    '      @@@% @@@@@@@#     %@@@@@@@@@-',
+    '    @@@@@@@@@@@@@      @@@@@@@@.',
+    '   @@@@@@@= @@@#     @@@@@@@        @@@@@',
+    '   @@@@   @@@@    @@@@@@         @@@@@@@',
+    '         @@@@ @@@@@@@@        @@@@@@@@',
+    '       +@@@@@@@@@@@@@      @@@@@@@@@@',
+    '      @@@@@@@@ @@@@     @@@@@@ @@@@',
+    '     @@@@@%  *@@@%  .@@@@@%  .@@@@ .@@@@',
+    '      .-    @@@@ .@@@@@%    #@@@.@@@@@@@@',
+    '          *@@@@@@@@@%      @@@@@@@@#@@@@',
+    '         @@@@@@@@        #@@@@@@#  @@@@',
+    '       @@@@@@@           @@@@#    @@@@',
+    '      #@@@@               *      @@@+',
+    '                                  ='
+];
+export function renderNewCommandSplash(log) {
+    log('');
+    for (const line of ART)log(styleText('cyan', line));
+    log('');
+}
+
+//# sourceMappingURL=newCommandSplash.js.map

package/dist/util/newCommandSplash.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/util/newCommandSplash.ts"],"sourcesContent":["import {styleText} from 'node:util'\n\ntype LogFn = (message?: string) => void\n\nconst ART = [\n  '          -          #:      @@@@',\n  '         @@@      @@@@@    -@@@=   @@@',\n  '       @@@@   %@@@@@@.    @@@@ %@@@@@@',\n  '      @@@% @@@@@@@#     %@@@@@@@@@-',\n  '    @@@@@@@@@@@@@      @@@@@@@@.',\n  '   @@@@@@@= @@@#     @@@@@@@        @@@@@',\n  '   @@@@   @@@@    @@@@@@         @@@@@@@',\n  '         @@@@ @@@@@@@@        @@@@@@@@',\n  '       +@@@@@@@@@@@@@      @@@@@@@@@@',\n  '      @@@@@@@@ @@@@     @@@@@@ @@@@',\n  '     @@@@@%  *@@@%  .@@@@@%  .@@@@ .@@@@',\n  '      .-    @@@@ .@@@@@%    #@@@.@@@@@@@@',\n  '          *@@@@@@@@@%      @@@@@@@@#@@@@',\n  '         @@@@@@@@        #@@@@@@#  @@@@',\n  '       @@@@@@@           @@@@#    @@@@',\n  '      #@@@@               *      @@@+',\n  '                                  =',\n]\n\nexport function renderNewCommandSplash(log: LogFn): void {\n  log('')\n  for (const line of ART) log(styleText('cyan', line))\n  log('')\n}\n"],"names":["styleText","ART","renderNewCommandSplash","log","line"],"mappings":"AAAA,SAAQA,SAAS,QAAO,YAAW;AAInC,MAAMC,MAAM;IACV;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAED,OAAO,SAASC,uBAAuBC,GAAU;IAC/CA,IAAI;IACJ,KAAK,MAAMC,QAAQH,IAAKE,IAAIH,UAAU,QAAQI;IAC9CD,IAAI;AACN"}

package/dist/util/packageManager/installPackages.js

@@ -1,3 +1,5 @@
+import { CLIError } from '@oclif/core/errors';
+import { exitCodes } from '@sanity/cli-core';
 import { spinner } from '@sanity/cli-core/ux';
 import { execa } from 'execa';
 import { getPartialEnvWithNpmPath } from './packageManagerChoice.js';
@@ -58,34 +60,59 @@ function isEsbuild(ignoredEntry) {
     return ignoredEntry.replace(/@[^@]+$/, '') === 'esbuild';
 }
 async function executePackageManagerCommand(packageManager, args, execOptions, output, errorMessage) {
-    const progress = spinner(`Running ${packageManager} ${args.join(' ')}\n`).start();
-    const result = await execa(packageManager, args, execOptions);
-    if (result?.exitCode || result?.failed) {
-        // pnpm exits non-zero if dependency build scripts were skipped, even though
-        // the install itself succeeded. Treat it as a success, but point to
-        // `pnpm approve-builds` if anything other than esbuild was skipped
-        // (esbuild works without its build script through a JS fallback).
-        const commandOutput = [
-            result.stdout,
-            result.stderr
-        ].filter((chunk)=>typeof chunk === 'string').join('\n');
-        const ignoredBuilds = packageManager === 'pnpm' ? getIgnoredBuildScripts(commandOutput) : undefined;
-        if (ignoredBuilds) {
-            progress.succeed();
-            if (ignoredBuilds.some((entry)=>!isEsbuild(entry))) {
-                output.warn(IGNORED_BUILDS_NOTICE);
-            }
-            return;
-        }
+    const progress = spinner({
+        discardStdin: !execOptions.cancelSignal,
+        text: `Running ${packageManager} ${args.join(' ')}\n`
+    }).start();
+    let progressSettled = false;
+    const fail = ()=>{
+        progressSettled = true;
         progress.fail();
-        // Log both streams - package managers often print the actionable error
-        // details to stderr, so logging stdout alone can hide the failure reason.
-        output.log(commandOutput);
-        output.error(errorMessage, {
-            exit: 1
-        });
-    } else {
+    };
+    const succeed = ()=>{
+        progressSettled = true;
         progress.succeed();
+    };
+    try {
+        const result = await execa(packageManager, args, execOptions);
+        if (execOptions.cancelSignal?.aborted) {
+            fail();
+            execOptions.cancelSignal.throwIfAborted();
+        }
+        if (result?.exitCode || result?.failed) {
+            // pnpm exits non-zero if dependency build scripts were skipped, even though
+            // the install itself succeeded. Treat it as a success, but point to
+            // `pnpm approve-builds` if anything other than esbuild was skipped
+            // (esbuild works without its build script through a JS fallback).
+            const commandOutput = [
+                result.stdout,
+                result.stderr
+            ].filter((chunk)=>typeof chunk === 'string').join('\n');
+            const ignoredBuilds = packageManager === 'pnpm' ? getIgnoredBuildScripts(commandOutput) : undefined;
+            if (ignoredBuilds) {
+                succeed();
+                if (ignoredBuilds.some((entry)=>!isEsbuild(entry))) {
+                    output.warn(IGNORED_BUILDS_NOTICE);
+                }
+                return;
+            }
+            fail();
+            // Log both streams - package managers often print the actionable error
+            // details to stderr, so logging stdout alone can hide the failure reason.
+            output.log(commandOutput);
+            throw new CLIError(errorMessage, {
+                exit: exitCodes.RUNTIME_ERROR
+            });
+        } else {
+            succeed();
+        }
+    } catch (err) {
+        if (!progressSettled) {
+            fail();
+        }
+        throw err;
+    } finally{
+        progress.stop();
     }
 }
 export async function installDeclaredPackages(cwd, packageManager, context) {
@@ -107,13 +134,15 @@ export async function installDeclaredPackages(cwd, packageManager, context) {
 }
 export async function installNewPackages(options, context) {
     const { packageManager, packages } = options;
-    const { output, workDir } = context;
+    const { cancelSignal, output, timeout, workDir } = context;
     const execOptions = {
+        cancelSignal,
         cwd: workDir,
         encoding: 'utf8',
         env: getPartialEnvWithNpmPath(workDir),
         reject: false,
-        stdio: 'pipe'
+        stdio: 'pipe',
+        timeout
     };
     if (packageManager === 'manual') {
         const npmCommand = PACKAGE_MANAGER_COMMANDS.add.npm(packages);

package/dist/util/packageManager/installPackages.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/util/packageManager/installPackages.ts"],"sourcesContent":["import {type Output} from '@sanity/cli-core'\nimport {spinner} from '@sanity/cli-core/ux'\nimport {execa, type Options} from 'execa'\n\nimport {getPartialEnvWithNpmPath, type PackageManager} from './packageManagerChoice.js'\n\ntype PackageManagerLibs = Exclude<PackageManager, 'manual'>\n\n/**\n * @internal\n */\ninterface InstallOptions {\n  packageManager: PackageManager\n  packages: string[]\n}\n\ninterface PackageManagerCommands {\n  add: {[key in PackageManagerLibs]: (packages: string[]) => string[]}\n  install: {[key in PackageManagerLibs]: string[]}\n}\n\nconst PACKAGE_MANAGER_COMMANDS: PackageManagerCommands = {\n  add: {\n    bun: (packages) => ['add', ...packages],\n    npm: (packages) => ['install', '--save', ...packages],\n    pnpm: (packages) => ['add', '--save-prod', ...packages],\n    yarn: (packages) => ['add', ...packages],\n  },\n  install: {\n    bun: ['install'],\n    npm: ['install'],\n    pnpm: ['install'],\n    yarn: ['install'],\n  },\n}\n\nconst IGNORED_BUILDS_NOTICE =\n  'pnpm skipped build scripts for some dependencies. Run \"pnpm approve-builds\" in the project directory to pick which dependencies should be allowed to run scripts.'\n\n// Matches pnpm's `ERR_PNPM_IGNORED_BUILDS` error against whitespace-normalized\n// output (pnpm may wrap the message), capturing the list of skipped packages,\n// eg `esbuild@0.25.0, sharp@0.34.0.` - the `<pkg>@<version>` token sequence\n// ends the capture where the trailing `Run \"pnpm approve-builds\"…` hint starts\nconst IGNORED_BUILDS_PATTERN =\n  /ERR_PNPM_IGNORED_BUILDS.*?Ignored build scripts: ?((?:[^\\s,]+@[^\\s,]+[, ]*)+)/\n\nfunction getIgnoredBuildScripts(commandOutput: string): string[] | undefined {\n  const match = commandOutput.replaceAll(/\\s+/g, ' ').match(IGNORED_BUILDS_PATTERN)\n  if (!match) {\n    return undefined\n  }\n\n  // The capture allows both comma and whitespace separators (pnpm may print\n  // either, and wrapping can drop the comma), so split on both.\n  return match[1]\n    .split(/[\\s,]+/)\n    .map((entry) => entry.replace(/\\.$/, ''))\n    .filter(Boolean)\n}\n\nfunction isEsbuild(ignoredEntry: string): boolean {\n  // Entries are on the form `<pkg-name>@<version>` - strip the version,\n  // keeping in mind that scoped package names also start with `@`\n  return ignoredEntry.replace(/@[^@]+$/, '') === 'esbuild'\n}\n\nasync function executePackageManagerCommand(\n  packageManager: PackageManagerLibs,\n  args: string[],\n  execOptions: Options,\n  output: Output,\n  errorMessage: string,\n): Promise<void> {\n  const progress = spinner(`Running ${packageManager} ${args.join(' ')}\\n`).start()\n\n  const result = await execa(packageManager, args, execOptions)\n\n  if (result?.exitCode || result?.failed) {\n    // pnpm exits non-zero if dependency build scripts were skipped, even though\n    // the install itself succeeded. Treat it as a success, but point to\n    // `pnpm approve-builds` if anything other than esbuild was skipped\n    // (esbuild works without its build script through a JS fallback).\n    const commandOutput = [result.stdout, result.stderr]\n      .filter((chunk): chunk is string => typeof chunk === 'string')\n      .join('\\n')\n    const ignoredBuilds =\n      packageManager === 'pnpm' ? getIgnoredBuildScripts(commandOutput) : undefined\n\n    if (ignoredBuilds) {\n      progress.succeed()\n      if (ignoredBuilds.some((entry) => !isEsbuild(entry))) {\n        output.warn(IGNORED_BUILDS_NOTICE)\n      }\n      return\n    }\n\n    progress.fail()\n    // Log both streams - package managers often print the actionable error\n    // details to stderr, so logging stdout alone can hide the failure reason.\n    output.log(commandOutput)\n    output.error(errorMessage, {exit: 1})\n  } else {\n    progress.succeed()\n  }\n}\n\nexport async function installDeclaredPackages(\n  cwd: string,\n  packageManager: PackageManager,\n  context: {output: Output; workDir: string},\n): Promise<void> {\n  const {output} = context\n  const execOptions: Options = {\n    cwd,\n    encoding: 'utf8',\n    env: getPartialEnvWithNpmPath(cwd),\n    reject: false,\n    stdio: 'pipe',\n  }\n\n  if (packageManager === 'manual') {\n    const npmCommand = PACKAGE_MANAGER_COMMANDS.install.npm\n    output.log(`Manual installation selected — run 'npm ${npmCommand.join(' ')}' or equivalent`)\n  } else {\n    const args = PACKAGE_MANAGER_COMMANDS.install[packageManager]\n    await executePackageManagerCommand(\n      packageManager,\n      args,\n      execOptions,\n      output,\n      'Dependency installation failed',\n    )\n  }\n}\n\nexport async function installNewPackages(\n  options: InstallOptions,\n  context: {output: Output; workDir: string},\n): Promise<void> {\n  const {packageManager, packages} = options\n  const {output, workDir} = context\n  const execOptions: Options = {\n    cwd: workDir,\n    encoding: 'utf8',\n    env: getPartialEnvWithNpmPath(workDir),\n    reject: false,\n    stdio: 'pipe',\n  }\n\n  if (packageManager === 'manual') {\n    const npmCommand = PACKAGE_MANAGER_COMMANDS.add.npm(packages)\n    output.log(`Manual installation selected - run 'npm ${npmCommand.join(' ')}' or equivalent`)\n  } else {\n    const args = PACKAGE_MANAGER_COMMANDS.add[packageManager](packages)\n    await executePackageManagerCommand(\n      packageManager,\n      args,\n      execOptions,\n      output,\n      'Package installation failed',\n    )\n  }\n}\n"],"names":["spinner","execa","getPartialEnvWithNpmPath","PACKAGE_MANAGER_COMMANDS","add","bun","packages","npm","pnpm","yarn","install","IGNORED_BUILDS_NOTICE","IGNORED_BUILDS_PATTERN","getIgnoredBuildScripts","commandOutput","match","replaceAll","undefined","split","map","entry","replace","filter","Boolean","isEsbuild","ignoredEntry","executePackageManagerCommand","packageManager","args","execOptions","output","errorMessage","progress","join","start","result","exitCode","failed","stdout","stderr","chunk","ignoredBuilds","succeed","some","warn","fail","log","error","exit","installDeclaredPackages","cwd","context","encoding","env","reject","stdio","npmCommand","installNewPackages","options","workDir"],"mappings":"AACA,SAAQA,OAAO,QAAO,sBAAqB;AAC3C,SAAQC,KAAK,QAAqB,QAAO;AAEzC,SAAQC,wBAAwB,QAA4B,4BAA2B;AAiBvF,MAAMC,2BAAmD;IACvDC,KAAK;QACHC,KAAK,CAACC,WAAa;gBAAC;mBAAUA;aAAS;QACvCC,KAAK,CAACD,WAAa;gBAAC;gBAAW;mBAAaA;aAAS;QACrDE,MAAM,CAACF,WAAa;gBAAC;gBAAO;mBAAkBA;aAAS;QACvDG,MAAM,CAACH,WAAa;gBAAC;mBAAUA;aAAS;IAC1C;IACAI,SAAS;QACPL,KAAK;YAAC;SAAU;QAChBE,KAAK;YAAC;SAAU;QAChBC,MAAM;YAAC;SAAU;QACjBC,MAAM;YAAC;SAAU;IACnB;AACF;AAEA,MAAME,wBACJ;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAMC,yBACJ;AAEF,SAASC,uBAAuBC,aAAqB;IACnD,MAAMC,QAAQD,cAAcE,UAAU,CAAC,QAAQ,KAAKD,KAAK,CAACH;IAC1D,IAAI,CAACG,OAAO;QACV,OAAOE;IACT;IAEA,0EAA0E;IAC1E,8DAA8D;IAC9D,OAAOF,KAAK,CAAC,EAAE,CACZG,KAAK,CAAC,UACNC,GAAG,CAAC,CAACC,QAAUA,MAAMC,OAAO,CAAC,OAAO,KACpCC,MAAM,CAACC;AACZ;AAEA,SAASC,UAAUC,YAAoB;IACrC,sEAAsE;IACtE,gEAAgE;IAChE,OAAOA,aAAaJ,OAAO,CAAC,WAAW,QAAQ;AACjD;AAEA,eAAeK,6BACbC,cAAkC,EAClCC,IAAc,EACdC,WAAoB,EACpBC,MAAc,EACdC,YAAoB;IAEpB,MAAMC,WAAWhC,QAAQ,CAAC,QAAQ,EAAE2B,eAAe,CAAC,EAAEC,KAAKK,IAAI,CAAC,KAAK,EAAE,CAAC,EAAEC,KAAK;IAE/E,MAAMC,SAAS,MAAMlC,MAAM0B,gBAAgBC,MAAMC;IAEjD,IAAIM,QAAQC,YAAYD,QAAQE,QAAQ;QACtC,4EAA4E;QAC5E,oEAAoE;QACpE,mEAAmE;QACnE,kEAAkE;QAClE,MAAMvB,gBAAgB;YAACqB,OAAOG,MAAM;YAAEH,OAAOI,MAAM;SAAC,CACjDjB,MAAM,CAAC,CAACkB,QAA2B,OAAOA,UAAU,UACpDP,IAAI,CAAC;QACR,MAAMQ,gBACJd,mBAAmB,SAASd,uBAAuBC,iBAAiBG;QAEtE,IAAIwB,eAAe;YACjBT,SAASU,OAAO;YAChB,IAAID,cAAcE,IAAI,CAAC,CAACvB,QAAU,CAACI,UAAUJ,SAAS;gBACpDU,OAAOc,IAAI,CAACjC;YACd;YACA;QACF;QAEAqB,SAASa,IAAI;QACb,uEAAuE;QACvE,0EAA0E;QAC1Ef,OAAOgB,GAAG,CAAChC;QACXgB,OAAOiB,KAAK,CAAChB,cAAc;YAACiB,MAAM;QAAC;IACrC,OAAO;QACLhB,SAASU,OAAO;IAClB;AACF;AAEA,OAAO,eAAeO,wBACpBC,GAAW,EACXvB,cAA8B,EAC9BwB,OAA0C;IAE1C,MAAM,EAACrB,MAAM,EAAC,GAAGqB;IACjB,MAAMtB,cAAuB;QAC3BqB;QACAE,UAAU;QACVC,KAAKnD,yBAAyBgD;QAC9BI,QAAQ;QACRC,OAAO;IACT;IAEA,IAAI5B,mBAAmB,UAAU;QAC/B,MAAM6B,aAAarD,yBAAyBO,OAAO,CAACH,GAAG;QACvDuB,OAAOgB,GAAG,CAAC,CAAC,wCAAwC,EAAEU,WAAWvB,IAAI,CAAC,KAAK,eAAe,CAAC;IAC7F,OAAO;QACL,MAAML,OAAOzB,yBAAyBO,OAAO,CAACiB,eAAe;QAC7D,MAAMD,6BACJC,gBACAC,MACAC,aACAC,QACA;IAEJ;AACF;AAEA,OAAO,eAAe2B,mBACpBC,OAAuB,EACvBP,OAA0C;IAE1C,MAAM,EAACxB,cAAc,EAAErB,QAAQ,EAAC,GAAGoD;IACnC,MAAM,EAAC5B,MAAM,EAAE6B,OAAO,EAAC,GAAGR;IAC1B,MAAMtB,cAAuB;QAC3BqB,KAAKS;QACLP,UAAU;QACVC,KAAKnD,yBAAyByD;QAC9BL,QAAQ;QACRC,OAAO;IACT;IAEA,IAAI5B,mBAAmB,UAAU;QAC/B,MAAM6B,aAAarD,yBAAyBC,GAAG,CAACG,GAAG,CAACD;QACpDwB,OAAOgB,GAAG,CAAC,CAAC,wCAAwC,EAAEU,WAAWvB,IAAI,CAAC,KAAK,eAAe,CAAC;IAC7F,OAAO;QACL,MAAML,OAAOzB,yBAAyBC,GAAG,CAACuB,eAAe,CAACrB;QAC1D,MAAMoB,6BACJC,gBACAC,MACAC,aACAC,QACA;IAEJ;AACF"}
+{"version":3,"sources":["../../../src/util/packageManager/installPackages.ts"],"sourcesContent":["import {CLIError} from '@oclif/core/errors'\nimport {exitCodes, type Output} from '@sanity/cli-core'\nimport {spinner} from '@sanity/cli-core/ux'\nimport {execa, type Options} from 'execa'\n\nimport {getPartialEnvWithNpmPath, type PackageManager} from './packageManagerChoice.js'\n\ntype PackageManagerLibs = Exclude<PackageManager, 'manual'>\n\n/**\n * @internal\n */\ninterface InstallOptions {\n  packageManager: PackageManager\n  packages: string[]\n}\n\ninterface PackageManagerCommands {\n  add: {[key in PackageManagerLibs]: (packages: string[]) => string[]}\n  install: {[key in PackageManagerLibs]: string[]}\n}\n\nconst PACKAGE_MANAGER_COMMANDS: PackageManagerCommands = {\n  add: {\n    bun: (packages) => ['add', ...packages],\n    npm: (packages) => ['install', '--save', ...packages],\n    pnpm: (packages) => ['add', '--save-prod', ...packages],\n    yarn: (packages) => ['add', ...packages],\n  },\n  install: {\n    bun: ['install'],\n    npm: ['install'],\n    pnpm: ['install'],\n    yarn: ['install'],\n  },\n}\n\nconst IGNORED_BUILDS_NOTICE =\n  'pnpm skipped build scripts for some dependencies. Run \"pnpm approve-builds\" in the project directory to pick which dependencies should be allowed to run scripts.'\n\n// Matches pnpm's `ERR_PNPM_IGNORED_BUILDS` error against whitespace-normalized\n// output (pnpm may wrap the message), capturing the list of skipped packages,\n// eg `esbuild@0.25.0, sharp@0.34.0.` - the `<pkg>@<version>` token sequence\n// ends the capture where the trailing `Run \"pnpm approve-builds\"…` hint starts\nconst IGNORED_BUILDS_PATTERN =\n  /ERR_PNPM_IGNORED_BUILDS.*?Ignored build scripts: ?((?:[^\\s,]+@[^\\s,]+[, ]*)+)/\n\nfunction getIgnoredBuildScripts(commandOutput: string): string[] | undefined {\n  const match = commandOutput.replaceAll(/\\s+/g, ' ').match(IGNORED_BUILDS_PATTERN)\n  if (!match) {\n    return undefined\n  }\n\n  // The capture allows both comma and whitespace separators (pnpm may print\n  // either, and wrapping can drop the comma), so split on both.\n  return match[1]\n    .split(/[\\s,]+/)\n    .map((entry) => entry.replace(/\\.$/, ''))\n    .filter(Boolean)\n}\n\nfunction isEsbuild(ignoredEntry: string): boolean {\n  // Entries are on the form `<pkg-name>@<version>` - strip the version,\n  // keeping in mind that scoped package names also start with `@`\n  return ignoredEntry.replace(/@[^@]+$/, '') === 'esbuild'\n}\n\nasync function executePackageManagerCommand(\n  packageManager: PackageManagerLibs,\n  args: string[],\n  execOptions: Options,\n  output: Output,\n  errorMessage: string,\n): Promise<void> {\n  const progress = spinner({\n    discardStdin: !execOptions.cancelSignal,\n    text: `Running ${packageManager} ${args.join(' ')}\\n`,\n  }).start()\n  let progressSettled = false\n  const fail = () => {\n    progressSettled = true\n    progress.fail()\n  }\n  const succeed = () => {\n    progressSettled = true\n    progress.succeed()\n  }\n\n  try {\n    const result = await execa(packageManager, args, execOptions)\n\n    if (execOptions.cancelSignal?.aborted) {\n      fail()\n      execOptions.cancelSignal.throwIfAborted()\n    }\n\n    if (result?.exitCode || result?.failed) {\n      // pnpm exits non-zero if dependency build scripts were skipped, even though\n      // the install itself succeeded. Treat it as a success, but point to\n      // `pnpm approve-builds` if anything other than esbuild was skipped\n      // (esbuild works without its build script through a JS fallback).\n      const commandOutput = [result.stdout, result.stderr]\n        .filter((chunk): chunk is string => typeof chunk === 'string')\n        .join('\\n')\n      const ignoredBuilds =\n        packageManager === 'pnpm' ? getIgnoredBuildScripts(commandOutput) : undefined\n\n      if (ignoredBuilds) {\n        succeed()\n        if (ignoredBuilds.some((entry) => !isEsbuild(entry))) {\n          output.warn(IGNORED_BUILDS_NOTICE)\n        }\n        return\n      }\n\n      fail()\n      // Log both streams - package managers often print the actionable error\n      // details to stderr, so logging stdout alone can hide the failure reason.\n      output.log(commandOutput)\n      throw new CLIError(errorMessage, {exit: exitCodes.RUNTIME_ERROR})\n    } else {\n      succeed()\n    }\n  } catch (err) {\n    if (!progressSettled) {\n      fail()\n    }\n    throw err\n  } finally {\n    progress.stop()\n  }\n}\n\nexport async function installDeclaredPackages(\n  cwd: string,\n  packageManager: PackageManager,\n  context: {output: Output; workDir: string},\n): Promise<void> {\n  const {output} = context\n  const execOptions: Options = {\n    cwd,\n    encoding: 'utf8',\n    env: getPartialEnvWithNpmPath(cwd),\n    reject: false,\n    stdio: 'pipe',\n  }\n\n  if (packageManager === 'manual') {\n    const npmCommand = PACKAGE_MANAGER_COMMANDS.install.npm\n    output.log(`Manual installation selected — run 'npm ${npmCommand.join(' ')}' or equivalent`)\n  } else {\n    const args = PACKAGE_MANAGER_COMMANDS.install[packageManager]\n    await executePackageManagerCommand(\n      packageManager,\n      args,\n      execOptions,\n      output,\n      'Dependency installation failed',\n    )\n  }\n}\n\nexport async function installNewPackages(\n  options: InstallOptions,\n  context: {cancelSignal?: AbortSignal; output: Output; timeout?: number; workDir: string},\n): Promise<void> {\n  const {packageManager, packages} = options\n  const {cancelSignal, output, timeout, workDir} = context\n  const execOptions: Options = {\n    cancelSignal,\n    cwd: workDir,\n    encoding: 'utf8',\n    env: getPartialEnvWithNpmPath(workDir),\n    reject: false,\n    stdio: 'pipe',\n    timeout,\n  }\n\n  if (packageManager === 'manual') {\n    const npmCommand = PACKAGE_MANAGER_COMMANDS.add.npm(packages)\n    output.log(`Manual installation selected - run 'npm ${npmCommand.join(' ')}' or equivalent`)\n  } else {\n    const args = PACKAGE_MANAGER_COMMANDS.add[packageManager](packages)\n    await executePackageManagerCommand(\n      packageManager,\n      args,\n      execOptions,\n      output,\n      'Package installation failed',\n    )\n  }\n}\n"],"names":["CLIError","exitCodes","spinner","execa","getPartialEnvWithNpmPath","PACKAGE_MANAGER_COMMANDS","add","bun","packages","npm","pnpm","yarn","install","IGNORED_BUILDS_NOTICE","IGNORED_BUILDS_PATTERN","getIgnoredBuildScripts","commandOutput","match","replaceAll","undefined","split","map","entry","replace","filter","Boolean","isEsbuild","ignoredEntry","executePackageManagerCommand","packageManager","args","execOptions","output","errorMessage","progress","discardStdin","cancelSignal","text","join","start","progressSettled","fail","succeed","result","aborted","throwIfAborted","exitCode","failed","stdout","stderr","chunk","ignoredBuilds","some","warn","log","exit","RUNTIME_ERROR","err","stop","installDeclaredPackages","cwd","context","encoding","env","reject","stdio","npmCommand","installNewPackages","options","timeout","workDir"],"mappings":"AAAA,SAAQA,QAAQ,QAAO,qBAAoB;AAC3C,SAAQC,SAAS,QAAoB,mBAAkB;AACvD,SAAQC,OAAO,QAAO,sBAAqB;AAC3C,SAAQC,KAAK,QAAqB,QAAO;AAEzC,SAAQC,wBAAwB,QAA4B,4BAA2B;AAiBvF,MAAMC,2BAAmD;IACvDC,KAAK;QACHC,KAAK,CAACC,WAAa;gBAAC;mBAAUA;aAAS;QACvCC,KAAK,CAACD,WAAa;gBAAC;gBAAW;mBAAaA;aAAS;QACrDE,MAAM,CAACF,WAAa;gBAAC;gBAAO;mBAAkBA;aAAS;QACvDG,MAAM,CAACH,WAAa;gBAAC;mBAAUA;aAAS;IAC1C;IACAI,SAAS;QACPL,KAAK;YAAC;SAAU;QAChBE,KAAK;YAAC;SAAU;QAChBC,MAAM;YAAC;SAAU;QACjBC,MAAM;YAAC;SAAU;IACnB;AACF;AAEA,MAAME,wBACJ;AAEF,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,+EAA+E;AAC/E,MAAMC,yBACJ;AAEF,SAASC,uBAAuBC,aAAqB;IACnD,MAAMC,QAAQD,cAAcE,UAAU,CAAC,QAAQ,KAAKD,KAAK,CAACH;IAC1D,IAAI,CAACG,OAAO;QACV,OAAOE;IACT;IAEA,0EAA0E;IAC1E,8DAA8D;IAC9D,OAAOF,KAAK,CAAC,EAAE,CACZG,KAAK,CAAC,UACNC,GAAG,CAAC,CAACC,QAAUA,MAAMC,OAAO,CAAC,OAAO,KACpCC,MAAM,CAACC;AACZ;AAEA,SAASC,UAAUC,YAAoB;IACrC,sEAAsE;IACtE,gEAAgE;IAChE,OAAOA,aAAaJ,OAAO,CAAC,WAAW,QAAQ;AACjD;AAEA,eAAeK,6BACbC,cAAkC,EAClCC,IAAc,EACdC,WAAoB,EACpBC,MAAc,EACdC,YAAoB;IAEpB,MAAMC,WAAWhC,QAAQ;QACvBiC,cAAc,CAACJ,YAAYK,YAAY;QACvCC,MAAM,CAAC,QAAQ,EAAER,eAAe,CAAC,EAAEC,KAAKQ,IAAI,CAAC,KAAK,EAAE,CAAC;IACvD,GAAGC,KAAK;IACR,IAAIC,kBAAkB;IACtB,MAAMC,OAAO;QACXD,kBAAkB;QAClBN,SAASO,IAAI;IACf;IACA,MAAMC,UAAU;QACdF,kBAAkB;QAClBN,SAASQ,OAAO;IAClB;IAEA,IAAI;QACF,MAAMC,SAAS,MAAMxC,MAAM0B,gBAAgBC,MAAMC;QAEjD,IAAIA,YAAYK,YAAY,EAAEQ,SAAS;YACrCH;YACAV,YAAYK,YAAY,CAACS,cAAc;QACzC;QAEA,IAAIF,QAAQG,YAAYH,QAAQI,QAAQ;YACtC,4EAA4E;YAC5E,oEAAoE;YACpE,mEAAmE;YACnE,kEAAkE;YAClE,MAAM/B,gBAAgB;gBAAC2B,OAAOK,MAAM;gBAAEL,OAAOM,MAAM;aAAC,CACjDzB,MAAM,CAAC,CAAC0B,QAA2B,OAAOA,UAAU,UACpDZ,IAAI,CAAC;YACR,MAAMa,gBACJtB,mBAAmB,SAASd,uBAAuBC,iBAAiBG;YAEtE,IAAIgC,eAAe;gBACjBT;gBACA,IAAIS,cAAcC,IAAI,CAAC,CAAC9B,QAAU,CAACI,UAAUJ,SAAS;oBACpDU,OAAOqB,IAAI,CAACxC;gBACd;gBACA;YACF;YAEA4B;YACA,uEAAuE;YACvE,0EAA0E;YAC1ET,OAAOsB,GAAG,CAACtC;YACX,MAAM,IAAIhB,SAASiC,cAAc;gBAACsB,MAAMtD,UAAUuD,aAAa;YAAA;QACjE,OAAO;YACLd;QACF;IACF,EAAE,OAAOe,KAAK;QACZ,IAAI,CAACjB,iBAAiB;YACpBC;QACF;QACA,MAAMgB;IACR,SAAU;QACRvB,SAASwB,IAAI;IACf;AACF;AAEA,OAAO,eAAeC,wBACpBC,GAAW,EACX/B,cAA8B,EAC9BgC,OAA0C;IAE1C,MAAM,EAAC7B,MAAM,EAAC,GAAG6B;IACjB,MAAM9B,cAAuB;QAC3B6B;QACAE,UAAU;QACVC,KAAK3D,yBAAyBwD;QAC9BI,QAAQ;QACRC,OAAO;IACT;IAEA,IAAIpC,mBAAmB,UAAU;QAC/B,MAAMqC,aAAa7D,yBAAyBO,OAAO,CAACH,GAAG;QACvDuB,OAAOsB,GAAG,CAAC,CAAC,wCAAwC,EAAEY,WAAW5B,IAAI,CAAC,KAAK,eAAe,CAAC;IAC7F,OAAO;QACL,MAAMR,OAAOzB,yBAAyBO,OAAO,CAACiB,eAAe;QAC7D,MAAMD,6BACJC,gBACAC,MACAC,aACAC,QACA;IAEJ;AACF;AAEA,OAAO,eAAemC,mBACpBC,OAAuB,EACvBP,OAAwF;IAExF,MAAM,EAAChC,cAAc,EAAErB,QAAQ,EAAC,GAAG4D;IACnC,MAAM,EAAChC,YAAY,EAAEJ,MAAM,EAAEqC,OAAO,EAAEC,OAAO,EAAC,GAAGT;IACjD,MAAM9B,cAAuB;QAC3BK;QACAwB,KAAKU;QACLR,UAAU;QACVC,KAAK3D,yBAAyBkE;QAC9BN,QAAQ;QACRC,OAAO;QACPI;IACF;IAEA,IAAIxC,mBAAmB,UAAU;QAC/B,MAAMqC,aAAa7D,yBAAyBC,GAAG,CAACG,GAAG,CAACD;QACpDwB,OAAOsB,GAAG,CAAC,CAAC,wCAAwC,EAAEY,WAAW5B,IAAI,CAAC,KAAK,eAAe,CAAC;IAC7F,OAAO;QACL,MAAMR,OAAOzB,yBAAyBC,GAAG,CAACuB,eAAe,CAACrB;QAC1D,MAAMoB,6BACJC,gBACAC,MACAC,aACAC,QACA;IAEJ;AACF"}

package/dist/util/unclaimedProjects.js

@@ -0,0 +1,105 @@
+import { getUserConfig } from '@sanity/cli-core/config';
+import { subdebug } from '@sanity/cli-core/debug';
+const debug = subdebug('projects:unclaimed:registry');
+export const UNCLAIMED_PROJECTS_CONFIG_KEY = 'unclaimedProjects';
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+/**
+ * Record a mint response in the passive, project-ID-keyed user-config registry.
+ *
+ * This storage is deliberately not connected to CLI credential resolution.
+ */ export function recordUnclaimedProject(minted, mintedAt = new Date().toISOString()) {
+    try {
+        const config = getUserConfig();
+        const records = asRecord(config.get(UNCLAIMED_PROJECTS_CONFIG_KEY));
+        const record = {
+            claimToken: minted.claimToken,
+            claimUrl: minted.claimUrl,
+            dataset: minted.datasetName,
+            expiresAt: minted.expiresAt,
+            mintedAt,
+            projectId: minted.resourceId,
+            token: minted.token
+        };
+        config.set(UNCLAIMED_PROJECTS_CONFIG_KEY, {
+            ...records,
+            [minted.resourceId]: record
+        });
+        return true;
+    } catch (error) {
+        debug('failed to record unclaimed project: %s', error instanceof Error ? error.message : `${error}`);
+        return false;
+    }
+}
+function requireString(value, key, projectId) {
+    const field = value[key];
+    if (typeof field !== 'string' || field.length === 0) {
+        throw new Error(`Local recovery record for project "${projectId}" is malformed: "${key}" is missing or invalid.`);
+    }
+    return field;
+}
+function parseRecord(projectId, value) {
+    const record = asRecord(value);
+    const parsed = {
+        claimToken: requireString(record, 'claimToken', projectId),
+        claimUrl: requireString(record, 'claimUrl', projectId),
+        dataset: requireString(record, 'dataset', projectId),
+        expiresAt: requireString(record, 'expiresAt', projectId),
+        mintedAt: requireString(record, 'mintedAt', projectId),
+        projectId: requireString(record, 'projectId', projectId),
+        token: requireString(record, 'token', projectId)
+    };
+    if (parsed.projectId !== projectId) {
+        throw new Error(`Local recovery record for project "${projectId}" is malformed: its project ID does not match.`);
+    }
+    let claimUrlValid = false;
+    try {
+        const protocol = new URL(parsed.claimUrl).protocol;
+        claimUrlValid = protocol === 'https:' || protocol === 'http:';
+    } catch  {
+    // The actionable error is reported below.
+    }
+    if (!claimUrlValid) {
+        throw new TypeError(`Local recovery record for project "${projectId}" is malformed: "claimUrl" is not a valid URL.`);
+    }
+    if (!Number.isFinite(Date.parse(parsed.mintedAt))) {
+        throw new TypeError(`Local recovery record for project "${projectId}" is malformed: "mintedAt" is not a valid date.`);
+    }
+    if (!Number.isFinite(Date.parse(parsed.expiresAt))) {
+        throw new TypeError(`Local recovery record for project "${projectId}" is malformed: "expiresAt" is not a valid date.`);
+    }
+    return parsed;
+}
+/**
+ * Read and validate the passive local recovery registry without changing it.
+ */ export function readUnclaimedProjects() {
+    const stored = getUserConfig().get(UNCLAIMED_PROJECTS_CONFIG_KEY);
+    if (stored === undefined) return [];
+    if (!stored || typeof stored !== 'object' || Array.isArray(stored)) {
+        throw new Error('The local unclaimed-project registry is malformed.');
+    }
+    return Object.entries(stored).map(([projectId, record])=>parseRecord(projectId, record)).toSorted((left, right)=>Date.parse(left.expiresAt) - Date.parse(right.expiresAt));
+}
+/**
+ * Remove a record only when its claim token still matches the record that was checked.
+ */ export function removeUnclaimedProject(projectId, expectedClaimToken) {
+    try {
+        const config = getUserConfig();
+        const records = asRecord(config.get(UNCLAIMED_PROJECTS_CONFIG_KEY));
+        const current = asRecord(records[projectId]);
+        if (current.claimToken !== expectedClaimToken) return false;
+        const { [projectId]: _, ...remaining } = records;
+        if (Object.keys(remaining).length === 0) {
+            config.delete(UNCLAIMED_PROJECTS_CONFIG_KEY);
+        } else {
+            config.set(UNCLAIMED_PROJECTS_CONFIG_KEY, remaining);
+        }
+        return true;
+    } catch (error) {
+        debug('failed to remove unclaimed project: %s', error instanceof Error ? error.message : `${error}`);
+        return false;
+    }
+}
+
+//# sourceMappingURL=unclaimedProjects.js.map

package/dist/util/unclaimedProjects.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/util/unclaimedProjects.ts"],"sourcesContent":["import {getUserConfig} from '@sanity/cli-core/config'\nimport {subdebug} from '@sanity/cli-core/debug'\n\nimport {type MintedProject} from '../services/mintProject.js'\n\nconst debug = subdebug('projects:unclaimed:registry')\n\nexport const UNCLAIMED_PROJECTS_CONFIG_KEY = 'unclaimedProjects'\n\nexport interface UnclaimedProjectRecord {\n  claimToken: string\n  claimUrl: string\n  dataset: string\n  expiresAt: string\n  mintedAt: string\n  projectId: string\n  token: string\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : {}\n}\n\n/**\n * Record a mint response in the passive, project-ID-keyed user-config registry.\n *\n * This storage is deliberately not connected to CLI credential resolution.\n */\nexport function recordUnclaimedProject(\n  minted: MintedProject,\n  mintedAt: string = new Date().toISOString(),\n): boolean {\n  try {\n    const config = getUserConfig()\n    const records = asRecord(config.get(UNCLAIMED_PROJECTS_CONFIG_KEY))\n    const record: UnclaimedProjectRecord = {\n      claimToken: minted.claimToken,\n      claimUrl: minted.claimUrl,\n      dataset: minted.datasetName,\n      expiresAt: minted.expiresAt,\n      mintedAt,\n      projectId: minted.resourceId,\n      token: minted.token,\n    }\n\n    config.set(UNCLAIMED_PROJECTS_CONFIG_KEY, {\n      ...records,\n      [minted.resourceId]: record,\n    })\n    return true\n  } catch (error) {\n    debug(\n      'failed to record unclaimed project: %s',\n      error instanceof Error ? error.message : `${error}`,\n    )\n    return false\n  }\n}\n\nfunction requireString(\n  value: Record<string, unknown>,\n  key: keyof UnclaimedProjectRecord,\n  projectId: string,\n): string {\n  const field = value[key]\n  if (typeof field !== 'string' || field.length === 0) {\n    throw new Error(\n      `Local recovery record for project \"${projectId}\" is malformed: \"${key}\" is missing or invalid.`,\n    )\n  }\n  return field\n}\n\nfunction parseRecord(projectId: string, value: unknown): UnclaimedProjectRecord {\n  const record = asRecord(value)\n  const parsed: UnclaimedProjectRecord = {\n    claimToken: requireString(record, 'claimToken', projectId),\n    claimUrl: requireString(record, 'claimUrl', projectId),\n    dataset: requireString(record, 'dataset', projectId),\n    expiresAt: requireString(record, 'expiresAt', projectId),\n    mintedAt: requireString(record, 'mintedAt', projectId),\n    projectId: requireString(record, 'projectId', projectId),\n    token: requireString(record, 'token', projectId),\n  }\n\n  if (parsed.projectId !== projectId) {\n    throw new Error(\n      `Local recovery record for project \"${projectId}\" is malformed: its project ID does not match.`,\n    )\n  }\n  let claimUrlValid = false\n  try {\n    const protocol = new URL(parsed.claimUrl).protocol\n    claimUrlValid = protocol === 'https:' || protocol === 'http:'\n  } catch {\n    // The actionable error is reported below.\n  }\n  if (!claimUrlValid) {\n    throw new TypeError(\n      `Local recovery record for project \"${projectId}\" is malformed: \"claimUrl\" is not a valid URL.`,\n    )\n  }\n  if (!Number.isFinite(Date.parse(parsed.mintedAt))) {\n    throw new TypeError(\n      `Local recovery record for project \"${projectId}\" is malformed: \"mintedAt\" is not a valid date.`,\n    )\n  }\n  if (!Number.isFinite(Date.parse(parsed.expiresAt))) {\n    throw new TypeError(\n      `Local recovery record for project \"${projectId}\" is malformed: \"expiresAt\" is not a valid date.`,\n    )\n  }\n\n  return parsed\n}\n\n/**\n * Read and validate the passive local recovery registry without changing it.\n */\nexport function readUnclaimedProjects(): UnclaimedProjectRecord[] {\n  const stored = getUserConfig().get(UNCLAIMED_PROJECTS_CONFIG_KEY)\n  if (stored === undefined) return []\n  if (!stored || typeof stored !== 'object' || Array.isArray(stored)) {\n    throw new Error('The local unclaimed-project registry is malformed.')\n  }\n\n  return Object.entries(stored)\n    .map(([projectId, record]) => parseRecord(projectId, record))\n    .toSorted((left, right) => Date.parse(left.expiresAt) - Date.parse(right.expiresAt))\n}\n\n/**\n * Remove a record only when its claim token still matches the record that was checked.\n */\nexport function removeUnclaimedProject(projectId: string, expectedClaimToken: string): boolean {\n  try {\n    const config = getUserConfig()\n    const records = asRecord(config.get(UNCLAIMED_PROJECTS_CONFIG_KEY))\n    const current = asRecord(records[projectId])\n    if (current.claimToken !== expectedClaimToken) return false\n\n    const {[projectId]: _, ...remaining} = records\n    if (Object.keys(remaining).length === 0) {\n      config.delete(UNCLAIMED_PROJECTS_CONFIG_KEY)\n    } else {\n      config.set(UNCLAIMED_PROJECTS_CONFIG_KEY, remaining)\n    }\n    return true\n  } catch (error) {\n    debug(\n      'failed to remove unclaimed project: %s',\n      error instanceof Error ? error.message : `${error}`,\n    )\n    return false\n  }\n}\n"],"names":["getUserConfig","subdebug","debug","UNCLAIMED_PROJECTS_CONFIG_KEY","asRecord","value","Array","isArray","recordUnclaimedProject","minted","mintedAt","Date","toISOString","config","records","get","record","claimToken","claimUrl","dataset","datasetName","expiresAt","projectId","resourceId","token","set","error","Error","message","requireString","key","field","length","parseRecord","parsed","claimUrlValid","protocol","URL","TypeError","Number","isFinite","parse","readUnclaimedProjects","stored","undefined","Object","entries","map","toSorted","left","right","removeUnclaimedProject","expectedClaimToken","current","_","remaining","keys","delete"],"mappings":"AAAA,SAAQA,aAAa,QAAO,0BAAyB;AACrD,SAAQC,QAAQ,QAAO,yBAAwB;AAI/C,MAAMC,QAAQD,SAAS;AAEvB,OAAO,MAAME,gCAAgC,oBAAmB;AAYhE,SAASC,SAASC,KAAc;IAC9B,OAAOA,SAAS,OAAOA,UAAU,YAAY,CAACC,MAAMC,OAAO,CAACF,SACvDA,QACD,CAAC;AACP;AAEA;;;;CAIC,GACD,OAAO,SAASG,uBACdC,MAAqB,EACrBC,WAAmB,IAAIC,OAAOC,WAAW,EAAE;IAE3C,IAAI;QACF,MAAMC,SAASb;QACf,MAAMc,UAAUV,SAASS,OAAOE,GAAG,CAACZ;QACpC,MAAMa,SAAiC;YACrCC,YAAYR,OAAOQ,UAAU;YAC7BC,UAAUT,OAAOS,QAAQ;YACzBC,SAASV,OAAOW,WAAW;YAC3BC,WAAWZ,OAAOY,SAAS;YAC3BX;YACAY,WAAWb,OAAOc,UAAU;YAC5BC,OAAOf,OAAOe,KAAK;QACrB;QAEAX,OAAOY,GAAG,CAACtB,+BAA+B;YACxC,GAAGW,OAAO;YACV,CAACL,OAAOc,UAAU,CAAC,EAAEP;QACvB;QACA,OAAO;IACT,EAAE,OAAOU,OAAO;QACdxB,MACE,0CACAwB,iBAAiBC,QAAQD,MAAME,OAAO,GAAG,GAAGF,OAAO;QAErD,OAAO;IACT;AACF;AAEA,SAASG,cACPxB,KAA8B,EAC9ByB,GAAiC,EACjCR,SAAiB;IAEjB,MAAMS,QAAQ1B,KAAK,CAACyB,IAAI;IACxB,IAAI,OAAOC,UAAU,YAAYA,MAAMC,MAAM,KAAK,GAAG;QACnD,MAAM,IAAIL,MACR,CAAC,mCAAmC,EAAEL,UAAU,iBAAiB,EAAEQ,IAAI,wBAAwB,CAAC;IAEpG;IACA,OAAOC;AACT;AAEA,SAASE,YAAYX,SAAiB,EAAEjB,KAAc;IACpD,MAAMW,SAASZ,SAASC;IACxB,MAAM6B,SAAiC;QACrCjB,YAAYY,cAAcb,QAAQ,cAAcM;QAChDJ,UAAUW,cAAcb,QAAQ,YAAYM;QAC5CH,SAASU,cAAcb,QAAQ,WAAWM;QAC1CD,WAAWQ,cAAcb,QAAQ,aAAaM;QAC9CZ,UAAUmB,cAAcb,QAAQ,YAAYM;QAC5CA,WAAWO,cAAcb,QAAQ,aAAaM;QAC9CE,OAAOK,cAAcb,QAAQ,SAASM;IACxC;IAEA,IAAIY,OAAOZ,SAAS,KAAKA,WAAW;QAClC,MAAM,IAAIK,MACR,CAAC,mCAAmC,EAAEL,UAAU,8CAA8C,CAAC;IAEnG;IACA,IAAIa,gBAAgB;IACpB,IAAI;QACF,MAAMC,WAAW,IAAIC,IAAIH,OAAOhB,QAAQ,EAAEkB,QAAQ;QAClDD,gBAAgBC,aAAa,YAAYA,aAAa;IACxD,EAAE,OAAM;IACN,0CAA0C;IAC5C;IACA,IAAI,CAACD,eAAe;QAClB,MAAM,IAAIG,UACR,CAAC,mCAAmC,EAAEhB,UAAU,8CAA8C,CAAC;IAEnG;IACA,IAAI,CAACiB,OAAOC,QAAQ,CAAC7B,KAAK8B,KAAK,CAACP,OAAOxB,QAAQ,IAAI;QACjD,MAAM,IAAI4B,UACR,CAAC,mCAAmC,EAAEhB,UAAU,+CAA+C,CAAC;IAEpG;IACA,IAAI,CAACiB,OAAOC,QAAQ,CAAC7B,KAAK8B,KAAK,CAACP,OAAOb,SAAS,IAAI;QAClD,MAAM,IAAIiB,UACR,CAAC,mCAAmC,EAAEhB,UAAU,gDAAgD,CAAC;IAErG;IAEA,OAAOY;AACT;AAEA;;CAEC,GACD,OAAO,SAASQ;IACd,MAAMC,SAAS3C,gBAAgBe,GAAG,CAACZ;IACnC,IAAIwC,WAAWC,WAAW,OAAO,EAAE;IACnC,IAAI,CAACD,UAAU,OAAOA,WAAW,YAAYrC,MAAMC,OAAO,CAACoC,SAAS;QAClE,MAAM,IAAIhB,MAAM;IAClB;IAEA,OAAOkB,OAAOC,OAAO,CAACH,QACnBI,GAAG,CAAC,CAAC,CAACzB,WAAWN,OAAO,GAAKiB,YAAYX,WAAWN,SACpDgC,QAAQ,CAAC,CAACC,MAAMC,QAAUvC,KAAK8B,KAAK,CAACQ,KAAK5B,SAAS,IAAIV,KAAK8B,KAAK,CAACS,MAAM7B,SAAS;AACtF;AAEA;;CAEC,GACD,OAAO,SAAS8B,uBAAuB7B,SAAiB,EAAE8B,kBAA0B;IAClF,IAAI;QACF,MAAMvC,SAASb;QACf,MAAMc,UAAUV,SAASS,OAAOE,GAAG,CAACZ;QACpC,MAAMkD,UAAUjD,SAASU,OAAO,CAACQ,UAAU;QAC3C,IAAI+B,QAAQpC,UAAU,KAAKmC,oBAAoB,OAAO;QAEtD,MAAM,EAAC,CAAC9B,UAAU,EAAEgC,CAAC,EAAE,GAAGC,WAAU,GAAGzC;QACvC,IAAI+B,OAAOW,IAAI,CAACD,WAAWvB,MAAM,KAAK,GAAG;YACvCnB,OAAO4C,MAAM,CAACtD;QAChB,OAAO;YACLU,OAAOY,GAAG,CAACtB,+BAA+BoD;QAC5C;QACA,OAAO;IACT,EAAE,OAAO7B,OAAO;QACdxB,MACE,0CACAwB,iBAAiBC,QAAQD,MAAME,OAAO,GAAG,GAAGF,OAAO;QAErD,OAAO;IACT;AACF"}