@usegraft/cli 0.1.0

package/dist/harden-HQHONZPH.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+import {
+  loadProjectEnv,
+  requireDatabaseUrl
+} from "./chunk-BUPFXTUG.js";
+
+// src/commands/harden.ts
+async function hardenCommand(options) {
+  loadProjectEnv(options.cwd);
+  const url = requireDatabaseUrl();
+  const [{ createDb, hardenRuntimeRole }, { GraftError }] = await Promise.all([
+    import("@usegraft/db"),
+    import("@usegraft/contracts")
+  ]);
+  const handle = createDb(url);
+  try {
+    const statements = await hardenRuntimeRole(handle.db, options.role);
+    return { role: options.role, statements };
+  } catch (error) {
+    if (error instanceof GraftError) throw error;
+    let code;
+    for (let e = error; e; e = e.cause) {
+      if (typeof e.code === "string") {
+        code = e.code;
+        break;
+      }
+    }
+    if (code === "42704") {
+      throw new GraftError({
+        code: "INPUT_VALIDATION_FAILED",
+        message: `Role "${options.role}" does not exist in this database.`,
+        fix: `Create it first (as the operator): CREATE ROLE ${options.role} LOGIN PASSWORD '\u2026' \u2014 or via your provider's console \u2014 then rerun \`graft harden ${options.role}\`.`,
+        details: { role: options.role }
+      });
+    }
+    throw error;
+  } finally {
+    await handle.close();
+  }
+}
+export {
+  hardenCommand
+};

package/dist/index.js

@@ -0,0 +1,427 @@
+#!/usr/bin/env node
+import {
+  printGraftError
+} from "./chunk-GPA66AP5.js";
+
+// src/cli.ts
+var VERSION = "0.0.0";
+var PLANNED = [];
+function printHelp() {
+  const lines = [
+    "graft \u2014 the agent-native CMS",
+    "",
+    "Usage: graft <command> [options]",
+    "",
+    "Commands:",
+    "  init [dir]   Scaffold a Graft project (graft.config.ts, content/, llms.txt).",
+    "               Static index by default \u2014 no database, no env. --postgres for the",
+    "               Postgres tier (operational data, functions, DB branching)",
+    "  compile      Project the content tree into the content index once",
+    "  dev          Watch content/ + graft.config.ts and recompile on change",
+    "  db migrate   Apply the Postgres schema migrations that ship with @usegraft/db",
+    "               (the first command a Postgres-tier project runs; --dry-run lists them)",
+    "  asset put <file> [key]   Upload a binary to the asset store (S3_* env)",
+    "  approvals    List pending approvals for human-gated (destructive) function calls",
+    "  approve <id> Approve a pending approval (the caller retries with x-graft-approval)",
+    "  deny <id>    Deny a pending approval",
+    "  migrate      Show pending content/data migrations (dry-run); --apply runs them",
+    "  branch                   List branches (name, parent, backend)",
+    "  branch create <name>     Register a preview branch (instant; --from <parent>, default main;",
+    "                           --backend neon forks a physical Neon branch)",
+    "  branch drop <name>       Drop a branch (overlay: purge rows; neon: delete the fork)",
+    "  merge <name>             Merge a branch into --into (default main): replay ledger,",
+    "                           move data rows, recompile. Dry-run; --apply executes",
+    "  add <item>               Copy an owned primitive from the registry into graft/",
+    "                           (+ its deps; regenerates the graft/ barrel \u2014 no config edit)",
+    "  mcp                      Serve the project MCP over stdio (content + function tools;",
+    "                           for .mcp.json / local agents). Requires DATABASE_URL.",
+    "  serve                    Run the headless Graft runtime over HTTP: POST /api/fn/<name>,",
+    "                           POST /api/mcp, GET /healthz (what a self-host container runs)",
+    "  studio                   Opt-in Studio UI (edit content, approve/deny, OpenAPI)",
+    "  content                  List the content tree from the compiled index (Studio parity)",
+    "  compilations             List recent content projection trail rows (Studio parity)",
+    "  harden <role>            Grant an existing Postgres role the runtime privilege set",
+    "                           (can request + consume approvals but never decide them)",
+    ...PLANNED.map((cmd) => `  ${cmd.name.padEnd(12)} ${cmd.summary}  (${cmd.phase})`),
+    "",
+    "Options:",
+    "  --branch <id>    Content branch (compile/dev/migrate/mcp/serve/studio/content/compilations; default: main)",
+    "  --port <n>       Port for `graft serve` / `graft studio` (serve default 3903; studio 4983)",
+    "  --host <h>       Host for `graft serve` / `graft studio` (default: 127.0.0.1, or HOST)",
+    "  --studio         Mount opt-in Studio on `graft serve` at /studio (or GRAFT_STUDIO=1)",
+    "  --from <name>    Parent to fork from (branch create; default: main)",
+    "  --into <name>    Merge target (merge; default: main)",
+    "  --backend <kind> Branch backend: overlay (default) or neon (branch create)",
+    "  --apply          Execute pending migrations / the merge (default is a dry-run report)",
+    "  --postgres       Scaffold `graft init` for the Postgres index (default: static)",
+    "  --static         Scaffold `graft init` for the static index (the default)",
+    "  --dry-run        Preview `graft add` without writing; list pending `graft db migrate`",
+    "  --overwrite      Let `graft add` replace files that differ",
+    "  --prune-unknown  Let `graft compile` remove index rows in collections this schema",
+    "                   doesn't know (default: refuse \u2014 the shared-DATABASE_URL guard)",
+    "  -h, --help       Show this help",
+    "  -v, --version    Show version"
+  ];
+  console.log(lines.join("\n"));
+}
+var UsageError = class extends Error {
+};
+function parseArgs(rest) {
+  const positionals = [];
+  let branchId;
+  let from;
+  let into;
+  let backend;
+  let port;
+  let host;
+  let apply = false;
+  let dryRun = false;
+  let overwrite = false;
+  let pruneUnknown = false;
+  let studio = false;
+  let initDriver;
+  const value = (flag, raw) => {
+    if (!raw || raw.startsWith("-")) {
+      throw new UsageError(`${flag} requires a value, e.g. ${flag} main`);
+    }
+    return raw;
+  };
+  for (let i = 0; i < rest.length; i++) {
+    const arg = rest[i];
+    if (arg === "--branch" || arg === "-b") {
+      branchId = value("--branch", rest[++i]);
+    } else if (arg === "--from") {
+      from = value("--from", rest[++i]);
+    } else if (arg === "--into") {
+      into = value("--into", rest[++i]);
+    } else if (arg === "--backend") {
+      backend = value("--backend", rest[++i]);
+    } else if (arg === "--port") {
+      const raw = rest[++i];
+      if (raw === void 0 || !/^\d+$/.test(raw)) {
+        throw new UsageError("--port requires a number, e.g. --port 3903");
+      }
+      port = Number(raw);
+    } else if (arg === "--host") {
+      host = value("--host", rest[++i]);
+    } else if (arg === "--apply") {
+      apply = true;
+    } else if (arg === "--dry-run") {
+      dryRun = true;
+    } else if (arg === "--overwrite") {
+      overwrite = true;
+    } else if (arg === "--prune-unknown") {
+      pruneUnknown = true;
+    } else if (arg === "--studio") {
+      studio = true;
+    } else if (arg === "--postgres") {
+      initDriver = "postgres";
+    } else if (arg === "--static") {
+      initDriver = "static";
+    } else if (arg.startsWith("-")) {
+      throw new UsageError(`unknown option "${arg}"`);
+    } else {
+      positionals.push(arg);
+    }
+  }
+  return {
+    positionals,
+    branchId,
+    from,
+    into,
+    backend,
+    port,
+    host,
+    apply,
+    dryRun,
+    overwrite,
+    pruneUnknown,
+    studio,
+    initDriver
+  };
+}
+async function run(argv, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const [command, ...rest] = argv;
+  if (command === "-v" || command === "--version") {
+    console.log(VERSION);
+    return 0;
+  }
+  if (!command || command === "-h" || command === "--help") {
+    printHelp();
+    return 0;
+  }
+  try {
+    const args = parseArgs(rest);
+    switch (command) {
+      case "init": {
+        const { initCommand } = await import("./init-3H2IP5US.js");
+        const result = initCommand({
+          targetDir: args.positionals[0] ?? cwd,
+          driver: args.initDriver
+        });
+        console.log(
+          `Initialized a Graft project in ${result.projectDir} (${result.driver} index, ${result.created.length} file(s)):`
+        );
+        for (const file of result.created) console.log(`  created ${file}`);
+        console.log(
+          result.driver === "static" ? [
+            "",
+            "Next steps \u2014 no database, no environment variables:",
+            "  1. Install the runtime: add @usegraft/core and zod (plus @usegraft/cli as a dev dep)",
+            "  2. Run `graft compile` once, or keep `graft dev` running while you edit",
+            "",
+            "The index compiles to .graft/index.db (git-ignored \u2014 it is derived from your",
+            "files). Run `graft compile` before your app builds so it ships with the deploy.",
+            "Need operational data, typed functions, or DB branching? Switch `index` to",
+            '"postgres" in graft.config.ts and set DATABASE_URL.'
+          ].join("\n") : [
+            "",
+            "Next steps:",
+            "  1. Install the runtime: add @usegraft/core and zod (plus @usegraft/cli as a dev dep)",
+            "  2. Put DATABASE_URL=postgres://\u2026 in .env",
+            "  3. Run `graft compile` once, or keep `graft dev` running while you edit"
+          ].join("\n")
+        );
+        return 0;
+      }
+      case "compile": {
+        const { compileCommand } = await import("./compile-AAUC4G7H.js");
+        await compileCommand({ cwd, branchId: args.branchId, pruneUnknown: args.pruneUnknown });
+        return 0;
+      }
+      case "dev": {
+        const { devCommand } = await import("./dev-MX7TQOJ2.js");
+        await devCommand({ cwd, branchId: args.branchId });
+        return 0;
+      }
+      case "db": {
+        const [subcommand] = args.positionals;
+        if (subcommand !== "migrate") {
+          throw new UsageError(
+            subcommand ? `unknown db subcommand "${subcommand}" \u2014 the only one is \`graft db migrate\`` : "usage: graft db migrate [--dry-run]"
+          );
+        }
+        const { dbMigrateCommand, formatMigrateResult } = await import("./db-VGDWG4QA.js");
+        const result = await dbMigrateCommand({ cwd, dryRun: args.dryRun });
+        console.log(formatMigrateResult(result));
+        return 0;
+      }
+      case "asset": {
+        const [subcommand, file, key] = args.positionals;
+        if (subcommand !== "put" || !file) {
+          throw new UsageError("usage: graft asset put <file> [key]");
+        }
+        const { assetPutCommand } = await import("./asset-FPEL463J.js");
+        const result = await assetPutCommand({ cwd, file, key });
+        console.log(`Uploaded ${result.key} (${result.contentType}, ${result.bytes} bytes)`);
+        console.log(
+          [
+            "",
+            "Reference it from an `asset` field in frontmatter:",
+            `  image:`,
+            `    key: ${result.key}`,
+            "    alt: describe the image for screen readers"
+          ].join("\n")
+        );
+        return 0;
+      }
+      case "approvals": {
+        const { approvalsListCommand, formatApproval } = await import("./approvals-Z3EOK5AM.js");
+        const pending = await approvalsListCommand({ cwd });
+        if (pending.length === 0) {
+          console.log("No pending approvals.");
+          return 0;
+        }
+        console.log(`${pending.length} pending approval(s):
+`);
+        for (const row of pending) console.log(`${formatApproval(row)}
+`);
+        console.log("Decide with `graft approve <id>` or `graft deny <id>`.");
+        return 0;
+      }
+      case "approve":
+      case "deny": {
+        const id = args.positionals[0];
+        if (!id) throw new UsageError(`usage: graft ${command} <approval-id>`);
+        const { decideCommand } = await import("./approvals-Z3EOK5AM.js");
+        const decision = command === "approve" ? "approved" : "denied";
+        const row = await decideCommand({ cwd, id, decision });
+        console.log(
+          `${decision}: ${row.functionName} ${JSON.stringify(row.input)} (by ${row.decidedBy})`
+        );
+        if (decision === "approved") {
+          console.log(
+            `The caller can now retry the exact same request with the header \`x-graft-approval: ${row.id}\` (one-shot).`
+          );
+        }
+        return 0;
+      }
+      case "migrate": {
+        const { migrateCommand } = await import("./migrate-RRW4Z6RB.js");
+        await migrateCommand({ cwd, branchId: args.branchId, apply: args.apply });
+        return 0;
+      }
+      case "branch": {
+        const [subcommand, name] = args.positionals;
+        if (subcommand && subcommand !== "create" && subcommand !== "drop") {
+          throw new UsageError(
+            `unknown branch subcommand "${subcommand}" \u2014 use \`graft branch\`, \`graft branch create <name>\`, or \`graft branch drop <name>\``
+          );
+        }
+        if (subcommand && !name) {
+          throw new UsageError(`usage: graft branch ${subcommand} <name>`);
+        }
+        const mod = await import("./branch-HRG46YIL.js");
+        if (!subcommand) {
+          const rows = await mod.branchListCommand({ cwd });
+          if (rows.length === 0) {
+            console.log("No branches registered (main is seeded by migration 0006).");
+            return 0;
+          }
+          for (const row of rows) console.log(mod.formatBranch(row));
+          return 0;
+        }
+        if (subcommand === "create" && name) {
+          const meta = await mod.branchCreateCommand({
+            cwd,
+            name,
+            from: args.from,
+            backend: args.backend
+          });
+          console.log(
+            meta.backend === "neon" ? [
+              `Created neon branch "${meta.name}" from "${meta.parent}" \u2014 a physical fork at ${meta.endpointHost}.`,
+              `Content is inherited; operational data and approvals start empty on the fork.`,
+              `  graft compile --branch ${meta.name}   (routes to the fork automatically)`,
+              `Merge it back with \`graft merge ${meta.name}\` when ready.`
+            ].join("\n") : [
+              `Created branch "${meta.name}" from "${meta.parent}" (${meta.backend} \u2014 zero rows copied).`,
+              `Reads overlay the parent until the branch writes its own rows:`,
+              `  graft compile --branch ${meta.name}`,
+              `Merge it back with \`graft merge ${meta.name}\` when ready.`
+            ].join("\n")
+          );
+          return 0;
+        }
+        const result = await mod.branchDropCommand({ cwd, name });
+        const p = result.purged;
+        console.log(
+          result.backend === "neon" ? `Dropped neon branch "${name}" (the fork and its endpoint were deleted).` : `Dropped branch "${name}"` + (p ? ` (purged ${p.content} content, ${p.data} data, ${p.ledger} ledger row(s)).` : ".")
+        );
+        return 0;
+      }
+      case "merge": {
+        const branch = args.positionals[0];
+        if (!branch)
+          throw new UsageError("usage: graft merge <branch> [--into <target>] [--apply]");
+        const { mergeCommand } = await import("./merge-CZUNMMB5.js");
+        await mergeCommand({ cwd, branch, into: args.into, apply: args.apply });
+        return 0;
+      }
+      case "add": {
+        const { addCommand } = await import("./add-UBAZMSP7.js");
+        await addCommand({
+          cwd,
+          names: args.positionals,
+          dryRun: args.dryRun,
+          overwrite: args.overwrite
+        });
+        return 0;
+      }
+      case "mcp": {
+        const { mcpCommand } = await import("./mcp-US3QFLOR.js");
+        await mcpCommand({ cwd, branchId: args.branchId });
+        return 0;
+      }
+      case "serve": {
+        const { serveCommand } = await import("./serve-Q63UTTER.js");
+        await serveCommand({
+          cwd,
+          branchId: args.branchId,
+          port: args.port,
+          host: args.host,
+          studio: args.studio
+        });
+        return 0;
+      }
+      case "studio": {
+        const { studioCommand } = await import("./studio-TNPOB665.js");
+        await studioCommand({
+          cwd,
+          branchId: args.branchId,
+          port: args.port,
+          host: args.host
+        });
+        return 0;
+      }
+      case "content": {
+        const { contentListCommand, formatContentLine } = await import("./content-DY2YI3LT.js");
+        const { branch, lines } = await contentListCommand({ cwd, branchId: args.branchId });
+        if (lines.length === 0) {
+          console.log(`No content on branch "${branch}" (run graft compile).`);
+          return 0;
+        }
+        console.log(`${lines.length} document(s) on branch "${branch}":
+`);
+        for (const line of lines) console.log(formatContentLine(line));
+        return 0;
+      }
+      case "compilations": {
+        const { compilationsListCommand, formatCompilation } = await import("./compilations-6P45MPAE.js");
+        const rows = await compilationsListCommand({ cwd, branchId: args.branchId });
+        if (rows.length === 0) {
+          console.log("No compilations recorded yet (run graft compile).");
+          return 0;
+        }
+        for (const row of rows) console.log(formatCompilation(row));
+        return 0;
+      }
+      case "harden": {
+        const role = args.positionals[0];
+        if (!role) throw new UsageError("usage: graft harden <role>");
+        const { hardenCommand } = await import("./harden-HQHONZPH.js");
+        const result = await hardenCommand({ cwd, role });
+        console.log(`Hardened runtime role "${result.role}" (${result.statements.length} grants):`);
+        for (const statement of result.statements) console.log(`  ${statement}`);
+        console.log(
+          [
+            "",
+            "This role can request + consume approvals but can NEVER decide them",
+            "(no UPDATE on approvals) or rewrite content projections. Hand its",
+            "connection URL to the deployment as DATABASE_URL; keep the operator",
+            "URL for graft compile/migrate/branch/merge/approve."
+          ].join("\n")
+        );
+        return 0;
+      }
+      default: {
+        const planned = PLANNED.find((cmd) => cmd.name === command);
+        if (planned) {
+          console.error(
+            `graft: "${planned.name}" is planned for ${planned.phase} and is not implemented yet.`
+          );
+          return 1;
+        }
+        console.error(`graft: unknown command "${command}"
+`);
+        printHelp();
+        return 1;
+      }
+    }
+  } catch (error) {
+    if (error instanceof UsageError) {
+      console.error(`graft: ${error.message}`);
+      return 1;
+    }
+    const { GraftError } = await import("@usegraft/contracts");
+    if (error instanceof GraftError) {
+      printGraftError(error);
+      return 1;
+    }
+    throw error;
+  }
+}
+
+// src/index.ts
+process.exit(await run(process.argv.slice(2)));

package/dist/init-3H2IP5US.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+import {
+  CONFIG_FILENAMES
+} from "./chunk-BUPFXTUG.js";
+
+// src/commands/init.ts
+import { existsSync, mkdirSync, writeFileSync } from "fs";
+import { dirname, join, resolve } from "path";
+import { GraftError } from "@usegraft/contracts";
+import { barrelSource } from "@usegraft/registry";
+var configTemplate = (driver) => `/**
+ * The schema for this project \u2014 collections defined as owned code.
+ * Agents: this is the single source of truth for what content exists.
+ * Add fields here, then author documents in content/<collection>/<slug>.mdx.
+ *
+ * Primitives you add with \`graft add\` live under graft/ and are merged in via
+ * the generated graft/index.ts barrel \u2014 you never edit the import below.
+ */
+import { defineCollection, field, mergePrimitives } from "@usegraft/core";
+import * as primitives from "./graft";
+
+${driver === "static" ? `// Where the content index lives. "static" compiles to .graft/index.db \u2014
+// no database, no env vars. Switch to "postgres" (with DATABASE_URL) when you
+// need operational data, typed functions, or database branching.
+export const index = "static";` : `// The content index lives in Postgres (DATABASE_URL). Content-only projects
+// can use \`export const index = "static"\` instead and drop the database.
+export const index = "postgres";`}
+
+export const pages = defineCollection({
+  name: "pages",
+  description: "Pages rendered by your site.",
+  fields: {
+    title: field.string({ description: "Page headline and <title>." }),
+    tagline: field.string({ optional: true, description: "Short line under the headline." }),
+  },
+});
+
+// Your own collections/functions + everything under graft/ (added via \`graft add\`).
+// mergePrimitives throws CONFIG_INVALID on a duplicate key \u2014 never a silent override.
+export const { collections, functions } = mergePrimitives([{ collections: { pages } }, primitives]);
+`;
+var homeTemplate = (driver) => `---
+title: Hello, Graft
+tagline: ${driver === "static" ? "Content lives in git; the index is a file." : "Content lives in git; Postgres is the index."}
+---
+
+Edit this file, then run \`graft compile\` (or keep \`graft dev\` running) to
+project it into the content index.
+`;
+var GITIGNORE_TEMPLATE = `# The compiled content index \u2014 derived from the files in git.
+# Rebuild it any time with \`graft compile\`; build it in CI before your app builds.
+.graft/
+`;
+var llmsTemplate = (driver) => `# Graft project \u2014 agent guide
+
+Everything is code. Content lives in MDX files; git is authoritative; the
+content index is derived. If they disagree, git wins \u2014 recompile.
+
+- Schema: graft.config.ts (defineCollection/field over Zod). The single source of truth.
+- Documents: content/<collection>/<slug>.mdx \u2014 frontmatter must satisfy the collection schema.
+- Slugs are kebab-case; a frontmatter \`slug:\` overrides the filename.
+- Project into the index: \`graft compile\` (one-shot) or \`graft dev\` (watch mode).
+${driver === "static" ? `- This project uses the **static index** (\`index = "static"\` in graft.config):
+  compile writes .graft/index.db \u2014 a SQLite artifact. No database, no env vars.
+- The artifact is derived, so it is git-ignored. Run \`graft compile\` before your
+  app builds (e.g. build command: \`graft compile && next build\`) so it ships with
+  the deploy.
+- Read it from your app with \`openStaticIndex(".graft/index.db")\` from
+  "@usegraft/db", passed to \`createClient({ index, collections })\`.
+- Branches here are just **git branches**: each checkout compiles its own artifact.
+- Operational data (form submissions, orders, comments), typed functions, and
+  database branching need the Postgres tier. Adding one fails with NEEDS_DATABASE,
+  whose \`fix\` is the upgrade: set DATABASE_URL and \`export const index = "postgres"\`.` : `- Both need DATABASE_URL in .env (any parent directory works).
+- One project = one database. Never point DATABASE_URL at another project's
+  index \u2014 compile refuses with INDEX_OWNERSHIP rather than purge its documents.`}
+- Primitives: add owned building blocks with \`graft add <item>\` \u2014 they land under
+  graft/ and wire in automatically (the generated graft/index.ts barrel; no config
+  edit). Run \`graft add\` with no name to list what's available.
+- Every Graft error carries a \`fix\` \u2014 do what it says, then retry.
+- Ship changes as git commits; every projection records the git SHA it compiled from.
+`;
+function scaffoldFor(driver) {
+  const files = {
+    "graft.config.ts": configTemplate(driver),
+    // The generated barrel graft add regenerates; empty until the first `graft add`.
+    [join("graft", "index.ts")]: barrelSource([]),
+    [join("content", "pages", "home.mdx")]: homeTemplate(driver),
+    "llms.txt": llmsTemplate(driver)
+  };
+  if (driver === "static") files[".gitignore"] = GITIGNORE_TEMPLATE;
+  return files;
+}
+function initCommand(options) {
+  const projectDir = resolve(options.targetDir);
+  const driver = options.driver ?? "static";
+  for (const name of CONFIG_FILENAMES) {
+    if (existsSync(join(projectDir, name))) {
+      throw new GraftError({
+        code: "ALREADY_INITIALIZED",
+        message: `${name} already exists in ${projectDir}.`,
+        fix: "This is already a Graft project \u2014 evolve it by editing the existing graft.config.ts, or run `graft init <dir>` against an empty directory."
+      });
+    }
+  }
+  const created = [];
+  for (const [relPath, body] of Object.entries(scaffoldFor(driver))) {
+    const absPath = join(projectDir, relPath);
+    if (existsSync(absPath)) continue;
+    mkdirSync(dirname(absPath), { recursive: true });
+    writeFileSync(absPath, body, "utf8");
+    created.push(relPath);
+  }
+  return { projectDir, driver, created };
+}
+export {
+  initCommand
+};

package/dist/mcp-US3QFLOR.js

@@ -0,0 +1,61 @@
+#!/usr/bin/env node
+import {
+  assertNoStaticBranch
+} from "./chunk-KZ3FDWUK.js";
+import "./chunk-GPA66AP5.js";
+import {
+  findConfig,
+  loadConfig,
+  loadProjectEnv,
+  requireDatabaseUrl
+} from "./chunk-BUPFXTUG.js";
+
+// src/commands/mcp.ts
+import { createActorResolver } from "@usegraft/auth";
+async function mcpCommand(options) {
+  loadProjectEnv(options.cwd);
+  const config = await loadConfig(findConfig(options.cwd));
+  const isStatic = config.index.driver === "static";
+  if (isStatic) assertNoStaticBranch(options.branchId);
+  const url = isStatic ? void 0 : requireDatabaseUrl();
+  const [{ createGraftMcp, serveStdio }, { createDb, resolveBranchHandle, scopeWriteBranch }] = await Promise.all([import("@usegraft/mcp"), import("@usegraft/db")]);
+  const control = url !== void 0 ? createDb(url) : void 0;
+  const branchName = options.branchId ?? "main";
+  const branch = control !== void 0 && url !== void 0 ? await resolveBranchHandle(control.db, branchName, { databaseUrl: url }) : void 0;
+  try {
+    const devToken = process.env.GRAFT_DEV_TOKEN;
+    const scopes = (process.env.GRAFT_DEV_SCOPES ?? "").split(/[,\s]+/).map((s) => s.trim()).filter(Boolean);
+    const resolveActor = createActorResolver({
+      issuers: [],
+      devTokens: devToken ? {
+        [devToken]: {
+          kind: "agent",
+          id: "graft-cli",
+          scopes
+        }
+      } : void 0
+    });
+    const server = createGraftMcp({
+      name: "graft",
+      contentDir: config.contentDir,
+      collections: config.collections,
+      functions: config.functions,
+      ...branch !== void 0 ? {
+        db: branch.db,
+        branchId: scopeWriteBranch(branch.scope),
+        // The handle's resolved scope makes search_content overlay-aware: an
+        // overlay branch searches its full parent chain, not just its own rows.
+        scope: branch.scope
+      } : { staticIndexPath: config.index.path },
+      actor: resolveActor,
+      defaultAuthorization: devToken
+    });
+    await serveStdio(server);
+  } finally {
+    await branch?.close();
+    await control?.close();
+  }
+}
+export {
+  mcpCommand
+};