@usegraft/cli 0.1.1 → 1.0.0-beta.0

package/README.md

@@ -0,0 +1,64 @@
+# @usegraft/cli
+
+> The `graft` command. Scaffold a project, compile authored content, serve the runtime, split your database credentials.
+
+Part of [Graft](https://github.com/AndersonDesign1/graft), a CMS built so an AI agent is the primary operator.
+
+## Install
+
+```bash
+npm i -D @usegraft/cli
+# or run it without installing
+npx @usegraft/cli init
+```
+
+Once installed, the command is `graft`. Run it without installing under the
+full package name: the bare name `graft` on npm belongs to an unrelated
+package, so `npx graft` fetches the wrong thing.
+
+## Quickstart, with no database
+
+A content project needs no services at all. `graft compile` writes the index to a SQLite artifact your app reads embedded.
+
+```bash
+npx @usegraft/cli init      # scaffolds graft.config.ts, content/, llms.txt
+npx @usegraft/cli compile   # → .graft/index.db
+```
+
+Move to Postgres by setting `DATABASE_URL` and changing one line in `graft.config.ts`:
+
+```ts
+export const index = "postgres";
+```
+
+## Commands
+
+| Command                        | Does                                                                                           |
+| ------------------------------ | ---------------------------------------------------------------------------------------------- |
+| `graft init`                   | Scaffold a project                                                                             |
+| `graft compile`                | Validate authored MDX and project it into the index                                            |
+| `graft dev`                    | Recompile on save                                                                              |
+| `graft serve`                  | Run the headless runtime: typed functions, MCP, authored-content reads, `/healthz`             |
+| `graft studio`                 | Open the optional editing UI                                                                   |
+| `graft mcp`                    | Serve MCP on stdio, for `.mcp.json`                                                            |
+| `graft add <item>`             | Copy a registry primitive into your repo, shadcn-style                                         |
+| `graft approve <id>`           | Decide a pending approval. Operator credential only                                            |
+| `graft harden <role>`          | Grant a Postgres role exactly what a deployment needs, and nothing that can decide an approval |
+| `graft branch` / `graft merge` | Copy-on-write content branches                                                                 |
+| `graft migrate`                | Run content codemods when the schema changes                                                   |
+
+Run `graft <command> --help` for flags.
+
+## Two credentials
+
+`graft harden` splits the operator credential from the runtime one. The runtime can serve, project content, and request approvals. It can never decide one, and Postgres enforces that rather than the application.
+
+```bash
+graft harden graft_runtime
+# deploy with the runtime role's URL as DATABASE_URL
+# keep the operator URL for compile, migrate, merge and approve
+```
+
+---
+
+MIT. [Repository](https://github.com/AndersonDesign1/graft) · [Changelog](https://github.com/AndersonDesign1/graft/blob/main/packages/cli/CHANGELOG.md) · [Security policy](https://github.com/AndersonDesign1/graft/blob/main/SECURITY.md)

package/dist/{add-UBAZMSP7.js → add-TCQY3YAN.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   findConfig
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/add.ts
 import { dirname } from "path";

package/dist/approvals-4PAANLA4.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import {
+  approvalsListCommand,
+  decideCommand,
+  formatApproval,
+  operatorName
+} from "./chunk-NBJ4N4O6.js";
+import "./chunk-2LG6TWYY.js";
+export {
+  approvalsListCommand,
+  decideCommand,
+  formatApproval,
+  operatorName
+};

package/dist/{asset-FPEL463J.js → asset-JWER6AOG.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   loadProjectEnv
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/asset.ts
 import { readFileSync, statSync } from "fs";

package/dist/{branch-HRG46YIL.js → branch-U7FFDTFV.js}

@@ -2,7 +2,7 @@
 import {
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/branch.ts
 import { GraftError } from "@usegraft/contracts";

package/dist/{chunk-BUPFXTUG.js → chunk-2LG6TWYY.js}

@@ -3,7 +3,7 @@
 // src/config.ts
 import { existsSync } from "fs";
 import { dirname, join, resolve } from "path";
-import { GraftError } from "@usegraft/contracts";
+import { GraftError, STATIC_INDEX_DEFAULT_PATH } from "@usegraft/contracts";
 import { createJiti } from "jiti";
 var CONFIG_FILENAMES = [
   "graft.config.ts",
@@ -97,6 +97,8 @@ async function loadConfig(configPath) {
   const projectDir = dirname(configPath);
   const index = parseIndexConfig(mod.index, projectDir, configPath);
   assertStaticSupports(index, collections, functions, configPath);
+  const mdxTrust = parseMdxTrust(mod.mdxTrust, configPath);
+  const approvalPolicy = parseApprovalPolicy(mod.approvalPolicy, configPath);
   const contentDirSetting = typeof mod.contentDir === "string" ? mod.contentDir : "content";
   const migrationsDirSetting = typeof mod.migrationsDir === "string" ? mod.migrationsDir : "migrations";
   return {
@@ -106,9 +108,31 @@ async function loadConfig(configPath) {
     migrationsDir: resolve(projectDir, migrationsDirSetting),
     index,
     collections,
-    functions
+    functions,
+    mdxTrust,
+    approvalPolicy
   };
 }
+function parseMdxTrust(value, configPath) {
+  if (value === void 0) return "restricted";
+  if (value === "restricted" || value === "full") return value;
+  throw new GraftError({
+    code: "CONFIG_INVALID",
+    message: `${configPath} exports \`mdxTrust\` as ${JSON.stringify(value)}, which is not "restricted" or "full".`,
+    fix: 'Export `mdxTrust = "restricted"` (the default: `{\u2026}` expressions and `import` are refused in authored bodies) or `mdxTrust = "full"` (every author has commit access, so code review is the control). Omit the export to keep the default.',
+    details: { mdxTrust: value }
+  });
+}
+function parseApprovalPolicy(value, configPath) {
+  if (value === void 0) return "none";
+  if (value === "none" || value === "human" || value === "unattended") return value;
+  throw new GraftError({
+    code: "CONFIG_INVALID",
+    message: `${configPath} exports \`approvalPolicy\` as ${JSON.stringify(value)}, which is not "none", "human" or "unattended".`,
+    fix: 'Export `approvalPolicy = "none"` (the default: only `destructive` functions are gated), `"human"` (every mutation is gated), or `"unattended"` (nothing is gated, for a caller with no human behind it). Omit the export to keep the default.',
+    details: { approvalPolicy: value }
+  });
+}
 function assertStaticSupports(index, collections, functions, configPath) {
   if (index.driver !== "static") return;
   const dbCollections = Object.values(collections).filter((collection) => collection.authority === "db-authoritative").map((collection) => collection.name);
@@ -125,18 +149,17 @@ function assertStaticSupports(index, collections, functions, configPath) {
     details: { dbCollections, functions: functionNames }
   });
 }
-var STATIC_INDEX_DEFAULT = ".graft/index.db";
 function parseIndexConfig(value, projectDir, configPath) {
   if (value === void 0 || value === "postgres") return { driver: "postgres" };
   if (value === "static") {
-    return { driver: "static", path: resolve(projectDir, STATIC_INDEX_DEFAULT) };
+    return { driver: "static", path: resolve(projectDir, STATIC_INDEX_DEFAULT_PATH) };
   }
   if (typeof value === "object" && value !== null && !Array.isArray(value)) {
     const driver = value.driver;
     const path = value.path;
     if (driver === "postgres") return { driver: "postgres" };
     if (driver === "static" && (path === void 0 || typeof path === "string")) {
-      return { driver: "static", path: resolve(projectDir, path ?? STATIC_INDEX_DEFAULT) };
+      return { driver: "static", path: resolve(projectDir, path ?? STATIC_INDEX_DEFAULT_PATH) };
     }
   }
   throw new GraftError({

package/dist/{chunk-KZ3FDWUK.js → chunk-2N3HXYNN.js}

@@ -7,7 +7,7 @@ import {
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/compile.ts
 import { GraftError } from "@usegraft/contracts";
@@ -29,6 +29,7 @@ async function compileCommand(options) {
     const result = await compileStatic({
       contentDir: config.contentDir,
       collections: config.collections,
+      mdxTrust: config.mdxTrust,
       indexPath: config.index.path
     });
     console.log(formatCompileResult(result));
@@ -52,6 +53,7 @@ async function compileCommand(options) {
         db: branch.db,
         contentDir: config.contentDir,
         collections: config.collections,
+        mdxTrust: config.mdxTrust,
         branchId: scopeWriteBranch(branch.scope),
         pruneUnknown: options.pruneUnknown
       });

package/dist/{chunk-TUWL7WFD.js → chunk-CONTLKSZ.js}

@@ -4,19 +4,23 @@ import {
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/serve.ts
 import { execFileSync } from "child_process";
 import { createServer } from "http";
 import { createActorResolver } from "@usegraft/auth";
 import { GraftError } from "@usegraft/contracts";
+import { setRequestPeer } from "@usegraft/core";
 function createServeRouter(routes) {
   return async (request) => {
     const { pathname } = new URL(request.url);
     if (pathname === "/healthz") return routes.health(request);
     if (pathname === "/api/mcp") return routes.mcp(request);
     if (pathname === "/api/fn" || pathname.startsWith("/api/fn/")) return routes.fn(request);
+    if (pathname === "/api/content/v1" || pathname.startsWith("/api/content/v1/")) {
+      return routes.content(request);
+    }
     if (routes.studio && (pathname === "/studio" || pathname.startsWith("/studio/") || pathname.startsWith("/api/studio/"))) {
       return routes.studio(request);
     }
@@ -24,7 +28,7 @@ function createServeRouter(routes) {
     const error = new GraftError({
       code: "ROUTE_NOT_FOUND",
       message: `Nothing is mounted at ${pathname}.`,
-      fix: `Use POST /api/fn/<name> (typed functions), POST /api/mcp (MCP Streamable HTTP), or GET /healthz${studioHint}.`,
+      fix: `Use POST /api/fn/<name> (typed functions), POST /api/mcp (MCP Streamable HTTP), GET /api/content/v1/documents (authored content), GET /api/content/v1/search, or GET /healthz${studioHint}.`,
       details: { pathname }
     });
     return new Response(JSON.stringify(error.toJSON()), {
@@ -41,9 +45,34 @@ var HOP_BY_HOP = /* @__PURE__ */ new Set([
   "upgrade",
   "proxy-connection"
 ]);
-function createNodeListener(handler) {
+function allowedHostsFor(host) {
+  if (host === "0.0.0.0" || host === "::" || host === "") return void 0;
+  if (host === "127.0.0.1" || host === "localhost" || host === "::1") {
+    return ["127.0.0.1", "localhost", "[::1]"];
+  }
+  return [host];
+}
+function hostname(host) {
+  const trimmed = host.trim().toLowerCase();
+  if (trimmed.startsWith("[")) return trimmed.slice(0, trimmed.indexOf("]") + 1);
+  const colon = trimmed.lastIndexOf(":");
+  return colon === -1 ? trimmed : trimmed.slice(0, colon);
+}
+function createNodeListener(handler, options = {}) {
+  const allowed = options.allowedHosts?.map(hostname);
   return async (req, res) => {
     try {
+      if (allowed && !allowed.includes(hostname(req.headers.host ?? ""))) {
+        res.writeHead(400, { "content-type": "application/json" });
+        res.end(
+          JSON.stringify({
+            error: "INPUT_VALIDATION_FAILED",
+            message: `This server does not answer to Host "${req.headers.host ?? ""}".`,
+            fix: `Reach it at one of: ${allowed.join(", ")}. A mismatched Host is either a misconfigured proxy or a DNS-rebinding attempt.`
+          })
+        );
+        return;
+      }
       const chunks = [];
       for await (const chunk of req) chunks.push(chunk);
       const body = Buffer.concat(chunks);
@@ -59,6 +88,8 @@ function createNodeListener(handler) {
         headers,
         body: method === "GET" || method === "HEAD" || body.length === 0 ? void 0 : body
       });
+      const peer = req.socket.remoteAddress;
+      if (peer) setRequestPeer(request, peer);
       const response = await handler(request);
       const outHeaders = {};
       response.headers.forEach((value, key) => {
@@ -100,11 +131,13 @@ async function startServe(options) {
   const [
     { createFunctionsHandler },
     { createGraftMcpHandler },
-    { createDb, resolveBranchHandle, scopeWriteBranch, sql },
+    { createContentApiHandler },
+    { createDb, createDbIndexReader, resolveBranchHandle, scopeWriteBranch, sql },
     studioMod
   ] = await Promise.all([
     import("@usegraft/core"),
     import("@usegraft/mcp"),
+    import("@usegraft/content-api"),
     import("@usegraft/db"),
     enableStudio ? import("@usegraft/studio") : Promise.resolve(null)
   ]);
@@ -119,8 +152,16 @@ async function startServe(options) {
     issuers,
     devTokens: devToken ? { [devToken]: { kind: "agent", id: "graft-serve", scopes } } : void 0
   });
-  const approvalPolicy = process.env.GRAFT_APPROVAL_POLICY === "human" ? "human" : "none";
-  const requireMcpActor = process.env.GRAFT_MCP_REQUIRE_AUTH === "1";
+  const approvalPolicy = config.approvalPolicy;
+  if (process.env.GRAFT_APPROVAL_POLICY) {
+    console.warn(
+      `[graft serve] GRAFT_APPROVAL_POLICY is set and is now ignored. Approval policy moved to graft.config.ts so that turning off the gate on destructive functions appears in a diff. Export \`approvalPolicy = "${process.env.GRAFT_APPROVAL_POLICY}"\` there instead. Serving with "${approvalPolicy}".`
+    );
+  }
+  const host = options.host ?? process.env.HOST ?? "127.0.0.1";
+  const loopback = host === "127.0.0.1" || host === "localhost" || host === "::1";
+  const anonymousOptIn = process.env.GRAFT_MCP_ALLOW_ANONYMOUS === "1";
+  const allowAnonymousMcp = loopback || anonymousOptIn;
   const functions = config.functions ?? {};
   const gitSha = localGitSha(options.cwd);
   const fnHandler = createFunctionsHandler({
@@ -138,11 +179,31 @@ async function startServe(options) {
     contentDir: config.contentDir,
     collections: config.collections,
     functions,
+    mdxTrust: config.mdxTrust,
     db: branch.db,
     branchId: writeBranch,
     scope: branch.scope,
     actor: resolveActor,
-    requireActor: requireMcpActor
+    allowAnonymous: allowAnonymousMcp,
+    // The same backstop the functions handler gets. Without it a function with
+    // no per-function rateLimit was capped over POST /api/fn and uncapped over
+    // run_function, so the transport decided the limit — and tools/functions.ts
+    // claims the two surfaces apply rate limits identically.
+    rateLimit: { limit: 60, windowSeconds: 60 }
+  });
+  const allowedOriginsRaw = process.env.GRAFT_CONTENT_ALLOWED_ORIGINS?.trim();
+  const allowedOrigins = allowedOriginsRaw === void 0 || allowedOriginsRaw === "" ? void 0 : allowedOriginsRaw === "*" ? "*" : allowedOriginsRaw.split(",").map((entry) => entry.trim()).filter(Boolean);
+  const contentHandler = createContentApiHandler({
+    collections: Object.keys(config.collections),
+    branch: writeBranch,
+    index: createDbIndexReader(branch.db),
+    ...allowedOrigins === void 0 ? {} : { allowedOrigins },
+    // The same backstop the functions handler gets, for the same reason. These
+    // routes authenticate nobody and run database listings and full-text
+    // searches, so without a limit here one anonymous caller can keep the index
+    // busy indefinitely — and `graft serve` is the mount most likely to face
+    // the open internet.
+    rateLimit: { limit: 60, windowSeconds: 60 }
   });
   const health = async () => {
     try {
@@ -167,7 +228,6 @@ async function startServe(options) {
       { status: 200, headers: { "content-type": "application/json" } }
     );
   };
-  const host = options.host ?? process.env.HOST ?? "127.0.0.1";
   const requestedPort = options.port ?? Number(process.env.PORT ?? 3903);
   if (!Number.isInteger(requestedPort) || requestedPort < 0 || requestedPort > 65535) {
     await branch.close();
@@ -178,31 +238,50 @@ async function startServe(options) {
       fix: "Pass --port <0-65535> (0 picks a free port) or set PORT."
     });
   }
-  const loopback = host === "127.0.0.1" || host === "localhost" || host === "::1";
-  if (!loopback && !requireMcpActor && issuers.length === 0 && !devToken) {
+  if (!loopback && anonymousOptIn) {
+    console.warn(
+      "[graft serve] WARNING: GRAFT_MCP_ALLOW_ANONYMOUS=1 while bound beyond loopback \u2014 unauthenticated callers can write content, upload assets and decide approvals. Only do this behind an auth proxy you control."
+    );
+  } else if (!loopback && issuers.length === 0 && !devToken) {
     console.warn(
-      "[graft serve] WARNING: binding beyond loopback with no identity configured \u2014 set GRAFT_MCP_REQUIRE_AUTH=1 and provide GRAFT_DEV_TOKEN or GRAFT_TRUSTED_ISSUERS before exposing this to a network."
+      "[graft serve] WARNING: binding beyond loopback with no identity configured \u2014 MCP will refuse every caller, because there is nothing to authenticate them against. Set GRAFT_DEV_TOKEN or GRAFT_TRUSTED_ISSUERS."
+    );
+  }
+  if (approvalPolicy === "unattended") {
+    console.warn(
+      '[graft serve] WARNING: approvalPolicy = "unattended" in graft.config.ts \u2014 destructive functions run without human approval. Deletes are not recoverable from git: deleteRecord removes rows outright and the asset store keeps no history. Audit rows are still written. This applies to POST /api/fn only; run_function over /api/mcp stays gated, because the policy is not part of the MCP surface.'
     );
   }
   let studioHandler;
   if (studioMod) {
-    const authorize = !loopback && (devToken || issuers.length > 0) ? async (request) => {
+    const authenticate = !loopback && (devToken || issuers.length > 0) ? async (request) => {
       const actor = await resolveActor(request);
-      return actor.kind !== "anonymous";
-    } : !loopback ? () => false : void 0;
+      if (actor.kind === "anonymous" || !actor.id) return null;
+      return { kind: actor.kind, id: actor.id, scopes: actor.scopes ?? [] };
+    } : !loopback ? () => null : void 0;
     studioHandler = studioMod.createStudioHandler({
       db: branch.db,
       collections: config.collections,
       contentDir: config.contentDir,
+      mdxTrust: config.mdxTrust,
       defaultBranch: writeBranch,
-      decidedBy: "studio-serve",
+      // Only reached on a loopback mount, where there is no caller identity to
+      // attribute to. Off loopback the authenticated principal is used instead.
+      decider: { kind: "agent", id: "studio-serve" },
       uiBasePath: "/studio",
-      authorize
+      authenticate
     });
   }
   const server = createServer(
     createNodeListener(
-      createServeRouter({ fn: fnHandler, mcp: mcpHandler, health, studio: studioHandler })
+      createServeRouter({
+        fn: fnHandler,
+        mcp: mcpHandler,
+        content: contentHandler,
+        health,
+        studio: studioHandler
+      }),
+      { allowedHosts: allowedHostsFor(host) }
     )
   );
   await new Promise((resolve, reject) => {
@@ -233,6 +312,8 @@ async function serveCommand(options) {
       `graft serve \u2014 branch "${running.branch}"`,
       `  functions  POST ${base}/api/fn/<name>`,
       `  mcp        POST ${base}/api/mcp`,
+      `  documents  GET  ${base}/api/content/v1/documents`,
+      `  search     GET  ${base}/api/content/v1/search`,
       `  health     GET  ${base}/healthz`,
       ...studioOn ? [
         `  studio     GET  ${base}/studio`,
@@ -250,6 +331,7 @@ async function serveCommand(options) {
 
 export {
   createServeRouter,
+  allowedHostsFor,
   createNodeListener,
   startServe,
   serveCommand

package/dist/{chunk-LTFTDG6Z.js → chunk-DW6WTDRX.js}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/migrate.ts
 import { existsSync, readdirSync, statSync } from "fs";
@@ -99,6 +99,7 @@ Author one as migrations/0001-<name>.ts default-exporting defineContentMigration
             db: branch.db,
             contentDir: config.contentDir,
             collections: config.collections,
+            mdxTrust: config.mdxTrust,
             branchId: writeBranch,
             gitSha
           });

package/dist/{approvals-Z3EOK5AM.js → chunk-NBJ4N4O6.js}

@@ -2,7 +2,7 @@
 import {
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/approvals.ts
 import { userInfo } from "os";
@@ -33,12 +33,10 @@ async function decideCommand(options) {
   ]);
   const handle = createDb(url);
   try {
-    const row = await decideApproval(
-      handle.db,
-      options.id,
-      options.decision,
-      options.decidedBy ?? operatorName()
-    );
+    const row = await decideApproval(handle.db, options.id, options.decision, {
+      kind: "human",
+      id: operatorName()
+    });
     if (!row) {
       throw new GraftError({
         code: "APPROVAL_INVALID",
@@ -61,7 +59,9 @@ function formatApproval(row) {
     `  input:     ${JSON.stringify(row.input)}`
   ].join("\n");
 }
+
 export {
+  operatorName,
   approvalsListCommand,
   decideCommand,
   formatApproval

package/dist/{compilations-6P45MPAE.js → compilations-CH6AIOFG.js}

@@ -2,7 +2,7 @@
 import {
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/compilations.ts
 async function compilationsListCommand(options) {

package/dist/{compile-AAUC4G7H.js → compile-AWPSEA7U.js}

@@ -2,9 +2,9 @@
 import {
   assertNoStaticBranch,
   compileCommand
-} from "./chunk-KZ3FDWUK.js";
+} from "./chunk-2N3HXYNN.js";
 import "./chunk-GPA66AP5.js";
-import "./chunk-BUPFXTUG.js";
+import "./chunk-2LG6TWYY.js";
 export {
   assertNoStaticBranch,
   compileCommand

package/dist/{content-DY2YI3LT.js → content-ZULMTJMD.js}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/content.ts
 async function contentListCommand(options) {

package/dist/{db-VGDWG4QA.js → db-5YMFKHGO.js}

@@ -4,7 +4,7 @@ import {
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/db.ts
 import { GraftError } from "@usegraft/contracts";

package/dist/{dev-MX7TQOJ2.js → dev-WHTIRWMR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   assertNoStaticBranch
-} from "./chunk-KZ3FDWUK.js";
+} from "./chunk-2N3HXYNN.js";
 import {
   formatCompileResult,
   printGraftError
@@ -12,7 +12,7 @@ import {
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/dev.ts
 import { existsSync, watch } from "fs";
@@ -42,6 +42,7 @@ async function devCommand(options) {
   const branch = control !== void 0 && url !== void 0 ? await resolveBranchHandle(control.db, options.branchId ?? "main", { databaseUrl: url }) : void 0;
   const writeBranch = branch !== void 0 ? scopeWriteBranch(branch.scope) : "main";
   let timer;
+  let rewatchContent;
   let compiling = false;
   let dirty = false;
   let configDirty = false;
@@ -54,17 +55,21 @@ async function devCommand(options) {
     try {
       if (configDirty) {
         configDirty = false;
+        const previousContentDir = config.contentDir;
         config = await loadConfig(configPath);
         console.log(`reloaded ${basename(configPath)}`);
+        if (config.contentDir !== previousContentDir) rewatchContent?.(config.contentDir);
       }
       const result = branch !== void 0 ? await compile({
         db: branch.db,
         contentDir: config.contentDir,
         collections: config.collections,
+        mdxTrust: config.mdxTrust,
         branchId: writeBranch
       }) : await compileStatic({
         contentDir: config.contentDir,
         collections: config.collections,
+        mdxTrust: config.mdxTrust,
         indexPath: config.index.path
       });
       console.log(formatCompileResult(result));
@@ -85,12 +90,17 @@ async function devCommand(options) {
     timer = setTimeout(() => void runCompile(), DEBOUNCE_MS);
   };
   await runCompile();
+  let contentWatcher = watch(config.contentDir, { recursive: true }, () => schedule());
   const watchers = [
-    watch(config.contentDir, { recursive: true }, () => schedule()),
     watch(config.projectDir, (_event, filename) => {
       if (filename && CONFIG_FILENAMES.includes(filename)) schedule(true);
     })
   ];
+  rewatchContent = (dir) => {
+    contentWatcher.close();
+    contentWatcher = watch(dir, { recursive: true }, () => schedule());
+    console.log(`now watching ${relative(options.cwd, dir) || "."}`);
+  };
   const watchedContent = relative(options.cwd, config.contentDir) || ".";
   const branchLabel = branch === void 0 ? "static index" : branch.scope.kind === "physical" ? `${branch.name} (neon)` : options.branchId ?? "main";
   console.log(
@@ -99,6 +109,7 @@ async function devCommand(options) {
   await new Promise((resolveStopped) => {
     const stop = () => {
       clearTimeout(timer);
+      contentWatcher.close();
       for (const watcher of watchers) watcher.close();
       resolveStopped();
     };

package/dist/{harden-HQHONZPH.js → harden-QONL2MAO.js}

@@ -2,7 +2,7 @@
 import {
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/harden.ts
 async function hardenCommand(options) {

package/dist/index.js

@@ -50,6 +50,11 @@ function printHelp() {
     "  --port <n>       Port for `graft serve` / `graft studio` (serve default 3903; studio 4983)",
     "  --host <h>       Host for `graft serve` / `graft studio` (default: 127.0.0.1, or HOST)",
     "  --studio         Mount opt-in Studio on `graft serve` at /studio (or GRAFT_STUDIO=1)",
+    "  --elicit-approvals",
+    "                   `graft mcp` asks THIS terminal's operator to decide a destructive call,",
+    "                   instead of failing with an id for `graft approve`. Local only: the human",
+    "                   must be present and the client must support MCP elicitation. Decisions",
+    "                   are recorded as the OS user, exactly as `graft approve` records them.",
     "  --from <name>    Parent to fork from (branch create; default: main)",
     "  --into <name>    Merge target (merge; default: main)",
     "  --backend <kind> Branch backend: overlay (default) or neon (branch create)",
@@ -80,6 +85,7 @@ function parseArgs(rest) {
   let overwrite = false;
   let pruneUnknown = false;
   let studio = false;
+  let elicitApprovals = false;
   let initDriver;
   const value = (flag, raw) => {
     if (!raw || raw.startsWith("-")) {
@@ -115,6 +121,8 @@ function parseArgs(rest) {
       pruneUnknown = true;
     } else if (arg === "--studio") {
       studio = true;
+    } else if (arg === "--elicit-approvals") {
+      elicitApprovals = true;
     } else if (arg === "--postgres") {
       initDriver = "postgres";
     } else if (arg === "--static") {
@@ -138,6 +146,7 @@ function parseArgs(rest) {
     overwrite,
     pruneUnknown,
     studio,
+    elicitApprovals,
     initDriver
   };
 }
@@ -156,7 +165,7 @@ async function run(argv, options = {}) {
     const args = parseArgs(rest);
     switch (command) {
       case "init": {
-        const { initCommand } = await import("./init-3H2IP5US.js");
+        const { initCommand } = await import("./init-FV7Q6VXM.js");
         const result = initCommand({
           targetDir: args.positionals[0] ?? cwd,
           driver: args.initDriver
@@ -187,12 +196,12 @@ async function run(argv, options = {}) {
         return 0;
       }
       case "compile": {
-        const { compileCommand } = await import("./compile-AAUC4G7H.js");
+        const { compileCommand } = await import("./compile-AWPSEA7U.js");
         await compileCommand({ cwd, branchId: args.branchId, pruneUnknown: args.pruneUnknown });
         return 0;
       }
       case "dev": {
-        const { devCommand } = await import("./dev-MX7TQOJ2.js");
+        const { devCommand } = await import("./dev-WHTIRWMR.js");
         await devCommand({ cwd, branchId: args.branchId });
         return 0;
       }
@@ -203,7 +212,7 @@ async function run(argv, options = {}) {
             subcommand ? `unknown db subcommand "${subcommand}" \u2014 the only one is \`graft db migrate\`` : "usage: graft db migrate [--dry-run]"
           );
         }
-        const { dbMigrateCommand, formatMigrateResult } = await import("./db-VGDWG4QA.js");
+        const { dbMigrateCommand, formatMigrateResult } = await import("./db-5YMFKHGO.js");
         const result = await dbMigrateCommand({ cwd, dryRun: args.dryRun });
         console.log(formatMigrateResult(result));
         return 0;
@@ -213,7 +222,7 @@ async function run(argv, options = {}) {
         if (subcommand !== "put" || !file) {
           throw new UsageError("usage: graft asset put <file> [key]");
         }
-        const { assetPutCommand } = await import("./asset-FPEL463J.js");
+        const { assetPutCommand } = await import("./asset-JWER6AOG.js");
         const result = await assetPutCommand({ cwd, file, key });
         console.log(`Uploaded ${result.key} (${result.contentType}, ${result.bytes} bytes)`);
         console.log(
@@ -228,7 +237,7 @@ async function run(argv, options = {}) {
         return 0;
       }
       case "approvals": {
-        const { approvalsListCommand, formatApproval } = await import("./approvals-Z3EOK5AM.js");
+        const { approvalsListCommand, formatApproval } = await import("./approvals-4PAANLA4.js");
         const pending = await approvalsListCommand({ cwd });
         if (pending.length === 0) {
           console.log("No pending approvals.");
@@ -245,7 +254,7 @@ async function run(argv, options = {}) {
       case "deny": {
         const id = args.positionals[0];
         if (!id) throw new UsageError(`usage: graft ${command} <approval-id>`);
-        const { decideCommand } = await import("./approvals-Z3EOK5AM.js");
+        const { decideCommand } = await import("./approvals-4PAANLA4.js");
         const decision = command === "approve" ? "approved" : "denied";
         const row = await decideCommand({ cwd, id, decision });
         console.log(
@@ -259,7 +268,7 @@ async function run(argv, options = {}) {
         return 0;
       }
       case "migrate": {
-        const { migrateCommand } = await import("./migrate-RRW4Z6RB.js");
+        const { migrateCommand } = await import("./migrate-6ZYG2H5C.js");
         await migrateCommand({ cwd, branchId: args.branchId, apply: args.apply });
         return 0;
       }
@@ -273,7 +282,7 @@ async function run(argv, options = {}) {
         if (subcommand && !name) {
           throw new UsageError(`usage: graft branch ${subcommand} <name>`);
         }
-        const mod = await import("./branch-HRG46YIL.js");
+        const mod = await import("./branch-U7FFDTFV.js");
         if (!subcommand) {
           const rows = await mod.branchListCommand({ cwd });
           if (rows.length === 0) {
@@ -316,12 +325,12 @@ async function run(argv, options = {}) {
         const branch = args.positionals[0];
         if (!branch)
           throw new UsageError("usage: graft merge <branch> [--into <target>] [--apply]");
-        const { mergeCommand } = await import("./merge-CZUNMMB5.js");
+        const { mergeCommand } = await import("./merge-ZWYZJVFE.js");
         await mergeCommand({ cwd, branch, into: args.into, apply: args.apply });
         return 0;
       }
       case "add": {
-        const { addCommand } = await import("./add-UBAZMSP7.js");
+        const { addCommand } = await import("./add-TCQY3YAN.js");
         await addCommand({
           cwd,
           names: args.positionals,
@@ -331,12 +340,12 @@ async function run(argv, options = {}) {
         return 0;
       }
       case "mcp": {
-        const { mcpCommand } = await import("./mcp-US3QFLOR.js");
-        await mcpCommand({ cwd, branchId: args.branchId });
+        const { mcpCommand } = await import("./mcp-77QFFJXK.js");
+        await mcpCommand({ cwd, branchId: args.branchId, elicitApprovals: args.elicitApprovals });
         return 0;
       }
       case "serve": {
-        const { serveCommand } = await import("./serve-Q63UTTER.js");
+        const { serveCommand } = await import("./serve-5ADUQG66.js");
         await serveCommand({
           cwd,
           branchId: args.branchId,
@@ -347,7 +356,7 @@ async function run(argv, options = {}) {
         return 0;
       }
       case "studio": {
-        const { studioCommand } = await import("./studio-TNPOB665.js");
+        const { studioCommand } = await import("./studio-7VAYFEWS.js");
         await studioCommand({
           cwd,
           branchId: args.branchId,
@@ -357,7 +366,7 @@ async function run(argv, options = {}) {
         return 0;
       }
       case "content": {
-        const { contentListCommand, formatContentLine } = await import("./content-DY2YI3LT.js");
+        const { contentListCommand, formatContentLine } = await import("./content-ZULMTJMD.js");
         const { branch, lines } = await contentListCommand({ cwd, branchId: args.branchId });
         if (lines.length === 0) {
           console.log(`No content on branch "${branch}" (run graft compile).`);
@@ -369,7 +378,7 @@ async function run(argv, options = {}) {
         return 0;
       }
       case "compilations": {
-        const { compilationsListCommand, formatCompilation } = await import("./compilations-6P45MPAE.js");
+        const { compilationsListCommand, formatCompilation } = await import("./compilations-CH6AIOFG.js");
         const rows = await compilationsListCommand({ cwd, branchId: args.branchId });
         if (rows.length === 0) {
           console.log("No compilations recorded yet (run graft compile).");
@@ -381,7 +390,7 @@ async function run(argv, options = {}) {
       case "harden": {
         const role = args.positionals[0];
         if (!role) throw new UsageError("usage: graft harden <role>");
-        const { hardenCommand } = await import("./harden-HQHONZPH.js");
+        const { hardenCommand } = await import("./harden-QONL2MAO.js");
         const result = await hardenCommand({ cwd, role });
         console.log(`Hardened runtime role "${result.role}" (${result.statements.length} grants):`);
         for (const statement of result.statements) console.log(`  ${statement}`);

package/dist/{init-3H2IP5US.js → init-FV7Q6VXM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CONFIG_FILENAMES
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/init.ts
 import { existsSync, mkdirSync, writeFileSync } from "fs";

package/dist/{mcp-US3QFLOR.js → mcp-77QFFJXK.js}

@@ -1,14 +1,17 @@
 #!/usr/bin/env node
 import {
   assertNoStaticBranch
-} from "./chunk-KZ3FDWUK.js";
+} from "./chunk-2N3HXYNN.js";
 import "./chunk-GPA66AP5.js";
+import {
+  operatorName
+} from "./chunk-NBJ4N4O6.js";
 import {
   findConfig,
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/mcp.ts
 import { createActorResolver } from "@usegraft/auth";
@@ -25,21 +28,26 @@ async function mcpCommand(options) {
   try {
     const devToken = process.env.GRAFT_DEV_TOKEN;
     const scopes = (process.env.GRAFT_DEV_SCOPES ?? "").split(/[,\s]+/).map((s) => s.trim()).filter(Boolean);
+    const cliActor = {
+      kind: "agent",
+      id: "graft-cli",
+      scopes: [.../* @__PURE__ */ new Set(["content:write", ...scopes])]
+    };
     const resolveActor = createActorResolver({
       issuers: [],
-      devTokens: devToken ? {
-        [devToken]: {
-          kind: "agent",
-          id: "graft-cli",
-          scopes
-        }
-      } : void 0
+      devTokens: devToken ? { [devToken]: cliActor } : void 0
     });
+    const resolveStdioActor = async (request) => {
+      const resolved = await resolveActor(request);
+      return resolved.kind === "anonymous" ? cliActor : resolved;
+    };
+    const approvalElicitation = options.elicitApprovals ? { decider: { kind: "human", id: operatorName() } } : void 0;
     const server = createGraftMcp({
       name: "graft",
       contentDir: config.contentDir,
       collections: config.collections,
       functions: config.functions,
+      mdxTrust: config.mdxTrust,
       ...branch !== void 0 ? {
         db: branch.db,
         branchId: scopeWriteBranch(branch.scope),
@@ -47,8 +55,13 @@ async function mcpCommand(options) {
         // overlay branch searches its full parent chain, not just its own rows.
         scope: branch.scope
       } : { staticIndexPath: config.index.path },
-      actor: resolveActor,
-      defaultAuthorization: devToken
+      actor: resolveStdioActor,
+      connectionActor: cliActor,
+      // Local agents may upload a file from the project; remote mounts get no
+      // `path` argument at all.
+      localUploadRoot: config.projectDir,
+      defaultAuthorization: devToken,
+      approvalElicitation
     });
     await serveStdio(server);
   } finally {

package/dist/{merge-CZUNMMB5.js → merge-ZWYZJVFE.js}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
 import {
   discoverMigrations
-} from "./chunk-LTFTDG6Z.js";
+} from "./chunk-DW6WTDRX.js";
 import {
   findConfig,
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/merge.ts
 import { basename } from "path";
@@ -144,6 +144,7 @@ async function mergeCommand(options) {
         db: target.db,
         contentDir: config.contentDir,
         collections: config.collections,
+        mdxTrust: config.mdxTrust,
         branchId: targetWrite,
         gitSha
       });

package/dist/{migrate-RRW4Z6RB.js → migrate-6ZYG2H5C.js}

@@ -2,8 +2,8 @@
 import {
   discoverMigrations,
   migrateCommand
-} from "./chunk-LTFTDG6Z.js";
-import "./chunk-BUPFXTUG.js";
+} from "./chunk-DW6WTDRX.js";
+import "./chunk-2LG6TWYY.js";
 export {
   discoverMigrations,
   migrateCommand

package/dist/{serve-Q63UTTER.js → serve-5ADUQG66.js}

@@ -1,12 +1,14 @@
 #!/usr/bin/env node
 import {
+  allowedHostsFor,
   createNodeListener,
   createServeRouter,
   serveCommand,
   startServe
-} from "./chunk-TUWL7WFD.js";
-import "./chunk-BUPFXTUG.js";
+} from "./chunk-CONTLKSZ.js";
+import "./chunk-2LG6TWYY.js";
 export {
+  allowedHostsFor,
   createNodeListener,
   createServeRouter,
   serveCommand,

package/dist/{studio-TNPOB665.js → studio-7VAYFEWS.js}

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
 import {
+  allowedHostsFor,
   createNodeListener
-} from "./chunk-TUWL7WFD.js";
+} from "./chunk-CONTLKSZ.js";
 import {
   findConfig,
   loadConfig,
   loadProjectEnv,
   requireDatabaseUrl
-} from "./chunk-BUPFXTUG.js";
+} from "./chunk-2LG6TWYY.js";
 
 // src/commands/studio.ts
 import { execFile } from "child_process";
@@ -17,11 +18,11 @@ import { GraftError } from "@usegraft/contracts";
 function isLoopback(host) {
   return host === "127.0.0.1" || host === "localhost" || host === "::1";
 }
-function operatorName() {
+function operatorIdentity() {
   try {
-    return userInfo().username;
+    return { kind: "human", id: userInfo().username };
   } catch {
-    return process.env.USERNAME ?? process.env.USER ?? "operator";
+    return { kind: "human", id: process.env.USERNAME ?? process.env.USER ?? "operator" };
   }
 }
 function openBrowser(url) {
@@ -58,19 +59,24 @@ async function studioCommand(options) {
       "[graft studio] WARNING: binding beyond loopback with no GRAFT_DEV_TOKEN \u2014 set a bearer token before exposing Studio to a network."
     );
   }
-  const authorize = !loopback && devToken ? (request) => {
+  const authenticate = !loopback && devToken ? (request) => {
     const header = request.headers.get("authorization") ?? "";
-    return header === `Bearer ${devToken}`;
-  } : !loopback ? () => false : void 0;
+    if (header !== `Bearer ${devToken}`) return null;
+    return {
+      ...operatorIdentity(),
+      scopes: ["studio:read", "studio:write", "approvals:decide"]
+    };
+  } : !loopback ? () => null : void 0;
   const handler = createStudioHandler({
     db: branch.db,
     collections: config.collections,
     contentDir: config.contentDir,
+    mdxTrust: config.mdxTrust,
     defaultBranch: writeBranch,
-    decidedBy: operatorName,
-    authorize
+    decider: operatorIdentity,
+    authenticate
   });
-  const server = createServer(createNodeListener(handler));
+  const server = createServer(createNodeListener(handler, { allowedHosts: allowedHostsFor(host) }));
   await new Promise((resolve, reject) => {
     server.once("error", reject);
     server.listen(requestedPort, host, () => resolve());

package/package.json

@@ -1,6 +1,22 @@
 {
   "name": "@usegraft/cli",
-  "version": "0.1.1",
+  "version": "1.0.0-beta.0",
+  "description": "The graft CLI: scaffold, compile authored content, serve the runtime, and split your database credentials.",
+  "keywords": [
+    "agent",
+    "ai",
+    "cli",
+    "cms",
+    "content",
+    "graft",
+    "headless-cms",
+    "mcp",
+    "postgres",
+    "scaffolding",
+    "static-site",
+    "typescript"
+  ],
+  "homepage": "https://github.com/AndersonDesign1/graft#readme",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -18,20 +34,22 @@
     "access": "public"
   },
   "dependencies": {
-    "@usegraft/assets": "0.1.1",
-    "@usegraft/auth": "0.1.1",
-    "@usegraft/compiler": "0.1.1",
-    "@usegraft/content-migrations": "0.1.1",
-    "@usegraft/contracts": "0.1.1",
-    "@usegraft/core": "0.1.1",
-    "@usegraft/db": "0.1.1",
-    "@usegraft/mcp": "0.1.1",
-    "@usegraft/registry": "0.1.1",
-    "@usegraft/studio": "0.1.1",
+    "@usegraft/assets": "1.0.0-beta.0",
+    "@usegraft/auth": "1.0.0-beta.0",
+    "@usegraft/compiler": "1.0.0-beta.0",
+    "@usegraft/content-api": "1.0.0-beta.0",
+    "@usegraft/content-migrations": "1.0.0-beta.0",
+    "@usegraft/contracts": "1.0.0-beta.0",
+    "@usegraft/core": "1.0.0-beta.0",
+    "@usegraft/db": "1.0.0-beta.0",
+    "@usegraft/mcp": "1.0.0-beta.0",
+    "@usegraft/mdx-safety": "1.0.0-beta.0",
+    "@usegraft/registry": "1.0.0-beta.0",
+    "@usegraft/studio": "1.0.0-beta.0",
     "jiti": "^2.4.0"
   },
   "devDependencies": {
-    "@usegraft/sdk-core": "0.1.1"
+    "@usegraft/sdk-core": "1.0.0-beta.0"
   },
   "engines": {
     "node": ">=22.16"
@@ -40,7 +58,6 @@
     "build": "tsup",
     "dev": "tsup --watch",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run --passWithNoTests",
-    "lint": "oxlint ."
+    "test": "vitest run --passWithNoTests"
   }
 }