A project-scoped, definition-bound MCP server approval.
Membership in a McpServerTrustLists.approvals set is the trust decision
(is_enabled reconstructs an approval and tests approval in approvals), so
value equality must line up between the write side
(add_enabled_project_mcp_servers) and the read side (is_enabled). Build new
approvals through create and persisted ones through from_toml, never the raw
constructor. Legacy unmarked entries intentionally retain their exact-worktree
scope, while new entries reconstruct the same transport-aware scope on both
sides. order=True exists only so sorted() yields deterministic TOML output.
The raw constructor only enforces non-emptiness (__post_init__), not that
project_root is normalized or that fingerprint is a real digest. A
hand-built instance is therefore safe but useless: with a mismatched root
or fingerprint it simply never equals a create/from_toml peer, so it
fails closed (nothing is trusted) rather than granting stray access ā but it
also won't authorize anything. Always go through the factories.
Shared fixed-URL identity or exact worktree-scoped identity.
MCP server name within the project config.
Fingerprint of the approved MCP server definition.
Whether project_root is a persisted Git common-directory identity.
Build an approval, normalizing the root and fingerprinting server.
Remote servers with fixed URLs use the validated Git common directory so their approvals can be shared across linked worktrees. Local commands and remote definitions with interpolated URLs use the exact resolved worktree because their behavior can differ between checkouts.
Deserialize a persisted approval table, normalizing the root.
Legacy entries without git_common_dir remain scoped to their exact
stored worktree. Marked entries retain their exact Git identity, so stale
metadata cannot redirect them to an enclosing repository.
Return a TOML-serializable representation.
