@xano/cli 1.2.0 → 1.3.1-beta.0

package/dist/commands/tenant/deploy_release/index.js

@@ -1,5 +1,7 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { deployedGateLine, fetchPolicyGate, gateExitCode, gateLines, gateOverrideHint, gateRefusal, gateRefusalOutput, quoted, } from '../../../utils/policy/gate.js';
+import { policyPermissionGuidance } from '../../../utils/policy/permission.js';
 export default class TenantDeployRelease extends BaseCommand {
     static args = {
         tenant_name: Args.string({
@@ -7,15 +9,26 @@ export default class TenantDeployRelease extends BaseCommand {
             required: true,
         }),
     };
-    static description = '[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant.';
+    static description = "[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant. A deploy is gated on the release's own policy check: any blocking finding in the release refuses it (exit 2) unless --override-reason is given, whatever the tenant runs today, so the release gets the same verdict on every tenant. --check previews that verdict without deploying.";
     static examples = [
         `$ xano tenant deploy_release t1234-abcd-xyz1 --release v1.0
 Deployed release "v1.0" to tenant: My Tenant (my-tenant)
 `,
         `$ xano tenant deploy_release t1234-abcd-xyz1 --release v1.0 -o json`,
+        `$ xano tenant deploy_release prod --release v1.2 --check
+Checked release "v1.2" for tenant "prod"; nothing was deployed.
+Policy gate: blocked
+  Deploy blocked: this release has 1 blocking policy finding.
+`,
+        `$ xano tenant deploy_release prod --release v1.2 --override-reason "Hotfix; AUTH-001 finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        check: Flags.boolean({
+            default: false,
+            description: "Preview the release's policy gate on this tenant without deploying; exits 2 when the deploy would be refused",
+            exclusive: ['override-reason'],
+        }),
         output: Flags.string({
             char: 'o',
             default: 'summary',
@@ -23,6 +36,10 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             options: ['summary', 'json'],
             required: false,
         }),
+        'override-reason': Flags.string({
+            description: 'Deploy past a blocking policy gate, recording this reason (needs the workspace:policy update permission; audited)',
+            exclusive: ['check'],
+        }),
         release: Flags.string({
             char: 'r',
             description: 'Release name to deploy',
@@ -34,6 +51,14 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             required: false,
         }),
     };
+    /** Set once the policy gate refuses the deploy, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(TenantDeployRelease);
         const { profile } = this.resolveProfile(flags);
@@ -43,12 +68,46 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
         }
         const releaseName = flags.release;
         const tenantName = args.tenant_name;
+        if (flags.check) {
+            await this.checkPolicyGate({ flags, profile, releaseName, tenantName, workspaceId });
+            return;
+        }
+        const overrideReason = flags['override-reason']?.trim();
+        if (flags['override-reason'] !== undefined && !overrideReason) {
+            this.error('--override-reason needs a reason: say why this deploy may proceed past the policy gate.');
+        }
+        // Pre-flight: the "approval required" error must always be shown before any
+        // permission/RBAC error. The backend's own deploy route checks RBAC first
+        // and the approval gate second (inside mvp:tenant_deploy_release), so a
+        // caller who lacks deploy permission would otherwise never learn a request
+        // is what's actually needed. Checking here first, with an endpoint that
+        // only needs read scope, guarantees the right error is shown regardless of
+        // whether the caller can deploy at all.
+        const requiresApproval = await this.tenantRequiresApproval(profile, workspaceId, tenantName, flags.verbose);
+        if (requiresApproval) {
+            const hasApprovedRequest = await this.hasApprovedDeployRequest({
+                profile,
+                releaseName,
+                tenantName,
+                verbose: flags.verbose,
+                workspaceId,
+            });
+            if (!hasApprovedRequest) {
+                this.error(`Tenant "${tenantName}" requires an approved deploy request before "${releaseName}" can be deployed.\n` +
+                    `Run: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`);
+            }
+        }
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${tenantName}/deploy`;
         this.warn('This may take a few minutes. Please be patient.');
         const startTime = Date.now();
+        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
+        let refused = null;
         try {
             const response = await this.verboseFetch(apiUrl, {
-                body: JSON.stringify({ release_name: releaseName }),
+                body: JSON.stringify({
+                    release_name: releaseName,
+                    ...(overrideReason ? { override_policy: true, override_reason: overrideReason } : {}),
+                }),
                 headers: {
                     accept: 'application/json',
                     Authorization: `Bearer ${profile.access_token}`,
@@ -57,8 +116,22 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                const errorText = await response.text();
-                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+                refused = await gateRefusal(response);
+                if (refused) {
+                    const override = `xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`;
+                    this.refuseByPolicyGate(refused, flags, override);
+                }
+                let message = await this.parseApiError(response, 'API request failed');
+                // Only reached once the pre-flight above has already confirmed the
+                // approval gate is satisfied or not applicable — so a permission error
+                // here is genuinely about RBAC, not about a missing approval. If the
+                // tenant supports deploy requests, mention that path as an alternative
+                // to direct deploy, since opening a request doesn't require deploy
+                // permission.
+                if ((response.status === 401 || response.status === 403) && requiresApproval) {
+                    message += `\n\nYou don't have permission to deploy to this tenant directly, but it supports deploy requests: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`;
+                }
+                this.error(message);
             }
             const tenant = (await response.json());
             if (flags.output === 'json') {
@@ -71,10 +144,15 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
                     this.log(`  State: ${tenant.state}`);
                 if (tenant.release?.name)
                     this.log(`  Release: ${tenant.release.name}`);
+                if (tenant.policy_gate?.status)
+                    this.log(`  ${deployedGateLine(tenant.policy_gate)}`);
                 this.log(`  Time: ${elapsed}s`);
             }
+            this.warnPoliciesSkipped(tenant);
         }
         catch (error) {
+            if (refused)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to deploy to tenant: ${error.message}`);
             }
@@ -83,4 +161,108 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             }
         }
     }
+    /**
+     * `--check`: what the policy gate would decide for this release on this tenant, without deploying.
+     * Exits 2 when the deploy would be refused; a preview the platform cannot answer exits 1.
+     */
+    async checkPolicyGate(opts) {
+        const { flags, profile, releaseName, tenantName, workspaceId } = opts;
+        const result = await fetchPolicyGate({ verboseFetch: (...args) => this.verboseFetch(...args) }, { profile, release: releaseName, tenant: tenantName, verbose: flags.verbose, workspace: workspaceId });
+        if ('unavailable' in result) {
+            const { message, payload, status } = result.unavailable;
+            this.error(`Policy gate preview failed (${status}): ${message}${policyPermissionGuidance(status, payload)}`);
+        }
+        const { answer } = result;
+        const exit = gateExitCode(answer);
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(answer, null, 2));
+        }
+        else {
+            this.log(`Checked release "${releaseName}" for tenant "${tenantName}"; nothing was deployed.`);
+            for (const line of gateLines(answer))
+                this.log(line);
+            if (exit) {
+                this.log(answer.can_override
+                    ? `To deploy past the gate: xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`
+                    : 'A deploy is refused unless someone with the workspace:policy update permission overrides the gate.');
+            }
+        }
+        if (exit)
+            process.exitCode = exit;
+    }
+    /**
+     * Does an approved tenant_deploy_request already exist for this (tenant, release)
+     * pair? The list endpoint has no release filter, so this fetches approved
+     * requests for the tenant and filters client-side by the resolved release name.
+     */
+    async hasApprovedDeployRequest(opts) {
+        const { profile, releaseName, tenantName, verbose, workspaceId } = opts;
+        const params = new URLSearchParams({ per_page: '100', status: 'approved', tenant_name: tenantName });
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request?${params}`;
+        const response = await this.verboseFetch(apiUrl, {
+            headers: {
+                accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
+            },
+            method: 'GET',
+        }, verbose, profile.access_token);
+        if (!response.ok) {
+            // A read-scope failure here means something is more broadly wrong (e.g.
+            // no workspace access at all) — surface it rather than silently treating
+            // it as "no approval found", which would misreport as approval-required.
+            const message = await this.parseApiError(response, 'Failed to check for an approved deploy request');
+            this.error(message);
+        }
+        const data = (await response.json());
+        const items = Array.isArray(data) ? data : (data.items ?? []);
+        return items.some((item) => item.status === 'approved' && item._release?.name === releaseName);
+    }
+    /** A deploy the policy gate refused: its verdict, then the refusal and how to proceed, exiting 2. */
+    refuseByPolicyGate(refused, flags, override) {
+        for (const line of gateRefusalOutput(refused, flags.output === 'json'))
+            this.log(line);
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
+    }
+    /**
+     * Does this tenant have the deploy approval gate enabled?
+     *
+     * Returns false if the tenant has `allow_quick_deploy` set — that flag lets a
+     * tenant skip the approval gate entirely for quick deploys, regardless of
+     * `required_reviewers`.
+     *
+     * Deliberately uses `tenant list` rather than `tenant get`: the single-tenant
+     * GET route's output whitelist (tenant-detail.yaml) omits `deploy_settings`
+     * (which holds `required_reviewers`, `allow_deploy_bypass`, and
+     * `allow_quick_deploy`) even though the list route's output includes it
+     * — confirmed live against a running instance. Filed as a backend bug; this
+     * is the workaround until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+     */
+    async tenantRequiresApproval(profile, workspaceId, tenantName, verbose) {
+        const params = new URLSearchParams({ per_page: '100' });
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${params}`;
+        const response = await this.verboseFetch(apiUrl, {
+            headers: {
+                accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
+            },
+            method: 'GET',
+        }, verbose, profile.access_token);
+        if (!response.ok) {
+            const message = await this.parseApiError(response, 'Failed to look up tenant');
+            this.error(message);
+        }
+        const data = (await response.json());
+        const items = Array.isArray(data) ? data : (data.items ?? []);
+        const tenant = items.find((item) => item.name === tenantName);
+        if (tenant?.deploy_settings?.allow_quick_deploy)
+            return false;
+        return (tenant?.deploy_settings?.required_reviewers ?? 0) > 0;
+    }
+    /** A release policy the tenant's import could not land (its key is held by another policy) is never dropped silently. */
+    warnPoliciesSkipped(tenant) {
+        const message = tenant.policies_skipped?.message;
+        if (message)
+            this.warn(message);
+    }
 }

package/dist/commands/tenant/edit/index.d.ts

@@ -6,6 +6,7 @@ export default class TenantEdit extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        allow_quick_deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         display: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -13,6 +14,7 @@ export default class TenantEdit extends BaseCommand {
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         proxy: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         rbac: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        required_reviewers: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         tasks: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/tenant/edit/index.js

@@ -13,9 +13,15 @@ export default class TenantEdit extends BaseCommand {
 Updated tenant: New Name (my-tenant) - ID: 42
 `,
         `$ xano tenant edit t1234-abcd-xyz1 --no-tasks --no-ingress -o json`,
+        `$ xano tenant edit t1234-abcd-xyz1 --required_reviewers 1`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        allow_quick_deploy: Flags.boolean({
+            allowNo: true,
+            description: 'Allow this tenant to skip the deploy approval gate entirely for quick deploys, regardless of --required_reviewers.',
+            required: false,
+        }),
         description: Flags.string({
             char: 'd',
             description: 'New description',
@@ -50,6 +56,10 @@ Updated tenant: New Name (my-tenant) - ID: 42
             description: '[CRITICAL] NEVER disable RBAC without explicit user confirmation; this removes role-based access controls on the tenant. Enables/disables RBAC.',
             required: false,
         }),
+        required_reviewers: Flags.integer({
+            description: 'When greater than 0, that many distinct reviewers must approve a tenant_deploy_request before a release may be deployed to this tenant. 0 means not gated.',
+            required: false,
+        }),
         tasks: Flags.boolean({
             allowNo: true,
             description: '[IMPORTANT] ALWAYS confirm with the user before disabling background tasks; this stops scheduled jobs on the tenant. Enables/disables background tasks.',
@@ -76,8 +86,17 @@ Updated tenant: New Name (my-tenant) - ID: 42
             'Content-Type': 'application/json',
         };
         try {
-            // Fetch current tenant state (PUT requires all fields)
-            const getResponse = await this.verboseFetch(baseUrl, {
+            // Fetch current tenant state (PUT requires all fields). Deliberately uses
+            // `tenant list` rather than `tenant get`: the single-tenant GET route's
+            // output whitelist (tenant-detail.yaml) omits `deploy_settings` (which
+            // holds `required_reviewers`, `allow_deploy_bypass`, and
+            // `allow_quick_deploy`) even though the list route's output includes it
+            // — confirmed live against a running instance. Using GET here would
+            // silently reset those fields to their defaults on every edit that doesn't
+            // explicitly pass them. Filed as a backend bug; this is the workaround
+            // until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+            const listParams = new URLSearchParams({ per_page: '100' });
+            const getResponse = await this.verboseFetch(`${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${listParams}`, {
                 headers: {
                     'accept': 'application/json',
                     'Authorization': `Bearer ${profile.access_token}`,
@@ -88,19 +107,35 @@ Updated tenant: New Name (my-tenant) - ID: 42
                 const errorText = await getResponse.text();
                 this.error(`Failed to fetch tenant: ${getResponse.status} ${getResponse.statusText}\n${errorText}`);
             }
-            const current = await getResponse.json();
-            // Merge in user-provided values
+            const listData = (await getResponse.json());
+            const listItems = Array.isArray(listData) ? listData : (listData.items ?? []);
+            const current = listItems.find((item) => item.name === tenantName);
+            if (!current) {
+                this.error(`Tenant "${tenantName}" not found`);
+            }
+            // Merge in user-provided values. allow_deploy_bypass has no edit flag (it's
+            // fixed at `tenant create` time), but the PUT still requires the full body,
+            // so its current value is preserved here rather than reset.
             const body = {
-                description: flags.description !== undefined ? flags.description : (current.description ?? ''),
-                display: flags.display !== undefined ? flags.display : (current.display ?? current.name),
-                domain: flags.domain !== undefined ? flags.domain : (current.domain ?? ''),
-                ingress: flags.ingress !== undefined ? flags.ingress : (current.ingress ?? true),
-                proxy: flags.proxy !== undefined ? flags.proxy : (current.proxy ?? ''),
+                deploy_settings: {
+                    allow_deploy_bypass: current.deploy_settings?.allow_deploy_bypass ?? false,
+                    allow_quick_deploy: flags.allow_quick_deploy === undefined
+                        ? (current.deploy_settings?.allow_quick_deploy ?? false)
+                        : flags.allow_quick_deploy,
+                    required_reviewers: flags.required_reviewers === undefined
+                        ? (current.deploy_settings?.required_reviewers ?? 0)
+                        : flags.required_reviewers,
+                },
+                description: flags.description === undefined ? (current.description ?? '') : flags.description,
+                display: flags.display === undefined ? (current.display ?? current.name) : flags.display,
+                domain: flags.domain === undefined ? (current.domain ?? '') : flags.domain,
+                ingress: flags.ingress === undefined ? (current.ingress ?? true) : flags.ingress,
+                proxy: flags.proxy === undefined ? (current.proxy ?? '') : flags.proxy,
                 rbac: {
-                    enabled: flags.rbac !== undefined ? flags.rbac : (current.rbac?.enabled ?? false),
+                    enabled: flags.rbac === undefined ? (current.rbac?.enabled ?? false) : flags.rbac,
                 },
                 tag: current.tag ?? [],
-                tasks: flags.tasks !== undefined ? flags.tasks : (current.tasks ?? true),
+                tasks: flags.tasks === undefined ? (current.tasks ?? true) : flags.tasks,
             };
             // Update tenant
             const putResponse = await this.verboseFetch(baseUrl, {

package/dist/commands/tenant/env/get_all/index.js

@@ -1,7 +1,7 @@
 import { Args, Flags } from '@oclif/core';
 import * as yaml from 'js-yaml';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class TenantEnvGetAll extends BaseCommand {
     static args = {

package/dist/commands/tenant/env/set_all/index.js

@@ -1,7 +1,7 @@
 import { Args, Flags } from '@oclif/core';
 import * as yaml from 'js-yaml';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class TenantEnvSetAll extends BaseCommand {
     static args = {

package/dist/commands/tenant/impersonate/index.d.ts

@@ -14,6 +14,6 @@ export default class TenantImpersonate extends BaseCommand {
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
-    private getImpersonateResponse;
     private getFrontendUrl;
+    private getImpersonateResponse;
 }

package/dist/commands/tenant/impersonate/index.js

@@ -76,13 +76,26 @@ Impersonation successful!
             }
         }
     }
+    getFrontendUrl(instanceOrigin) {
+        try {
+            const url = new URL(instanceOrigin);
+            if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
+                url.port = '4200';
+                return url.origin;
+            }
+        }
+        catch {
+            // fall through
+        }
+        return instanceOrigin;
+    }
     async getImpersonateResponse(profile, workspaceId, tenantName) {
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${encodeURIComponent(tenantName)}/impersonate`;
         const { verbose } = await this.parse(TenantImpersonate).then((r) => r.flags);
         const response = await this.verboseFetch(apiUrl, {
             headers: {
-                Authorization: `Bearer ${profile.access_token}`,
                 accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
             },
             method: 'GET',
         }, verbose, profile.access_token);
@@ -96,17 +109,4 @@ Impersonation successful!
         }
         return result;
     }
-    getFrontendUrl(instanceOrigin) {
-        try {
-            const url = new URL(instanceOrigin);
-            if (url.hostname === 'localhost' || url.hostname === '127.0.0.1') {
-                url.port = '4200';
-                return url.origin;
-            }
-        }
-        catch {
-            // fall through
-        }
-        return instanceOrigin;
-    }
 }

package/dist/commands/tenant/license/get/index.js

@@ -1,6 +1,6 @@
 import { Args, Flags } from '@oclif/core';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class TenantLicenseGet extends BaseCommand {
     static args = {

package/dist/commands/tenant/license/set/index.js

@@ -1,6 +1,6 @@
 import { Args, Flags } from '@oclif/core';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class TenantLicenseSet extends BaseCommand {
     static args = {

package/dist/commands/tenant/pull/index.d.ts

@@ -14,10 +14,4 @@ export default class Pull extends BaseCommand {
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
-    /**
-     * Sanitize a document name for use as a filename.
-     * Strips quotes, replaces spaces with underscores, and removes
-     * characters that are unsafe in filenames.
-     */
-    private sanitizeFilename;
 }

package/dist/commands/tenant/pull/index.js

@@ -1,9 +1,9 @@
 import { Flags } from '@oclif/core';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
 import snakeCase from 'lodash.snakecase';
+import * as fs from 'node:fs';
+import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { buildApiGroupFolderResolver, parseDocument } from '../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, parseDocument, resolveDocumentPath, } from '../../../utils/document-parser.js';
 export default class Pull extends BaseCommand {
     static description = 'Pull a tenant multidoc from the Xano Metadata API and split into individual files';
     static examples = [
@@ -57,7 +57,7 @@ Pulled 58 documents from tenant my-tenant
     };
     async run() {
         const { flags } = await this.parse(Pull);
-        const { profileName, profile } = this.resolveProfile(flags);
+        const { profile, profileName } = this.resolveProfile(flags);
         // Determine workspace_id from flag or profile
         let workspaceId;
         if (flags.workspace) {
@@ -129,96 +129,19 @@ Pulled 58 documents from tenant my-tenant
         fs.mkdirSync(outputDir, { recursive: true });
         // Resolve api_group names to unique folder names, disambiguating collisions
         const getApiGroupFolder = buildApiGroupFolderResolver(documents, snakeCase);
+        // Resolve a realtime v2 channel path -> owning realtime_server name, so
+        // messages can nest under their channel's server (see resolver docs).
+        const getChannelServer = buildChannelServerResolver(documents);
         // Track filenames per type to handle duplicates
         const filenameCounters = new Map();
         let writtenCount = 0;
         for (const doc of documents) {
-            let typeDir;
-            let baseName;
-            if (doc.type === 'workspace') {
-                // workspace → workspace/{name}.xs
-                typeDir = path.join(outputDir, 'workspace');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'workspace_trigger') {
-                // workspace_trigger → workspace/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'workspace', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'error_trigger') {
-                // error_trigger → workspace/trigger/{name}.xs (singleton, colocated with workspace triggers)
-                typeDir = path.join(outputDir, 'workspace', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'agent') {
-                // agent → ai/agent/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'agent');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'mcp_server') {
-                // mcp_server → ai/mcp_server/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'mcp_server');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'tool') {
-                // tool → ai/tool/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'tool');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'agent_trigger') {
-                // agent_trigger → ai/agent/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'agent', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'mcp_server_trigger') {
-                // mcp_server_trigger → ai/mcp_server/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'mcp_server', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'table_trigger') {
-                // table_trigger → table/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'table', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'realtime_channel') {
-                // realtime_channel → realtime/channel/{name}.xs
-                typeDir = path.join(outputDir, 'realtime', 'channel');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'realtime_trigger') {
-                // realtime_trigger → realtime/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'realtime', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'api_group') {
-                // api_group "test" → api/{resolved_folder}/{name}.xs
-                const groupFolder = getApiGroupFolder(doc.name);
-                typeDir = path.join(outputDir, 'api', groupFolder);
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'query' && doc.apiGroup) {
-                // query in group "test" → api/{resolved_folder}/{query_name}.xs
-                const groupFolder = getApiGroupFolder(doc.apiGroup);
-                const nameParts = doc.name.split('/');
-                const leafName = nameParts.pop();
-                const folderParts = nameParts.map((part) => snakeCase(part));
-                typeDir = path.join(outputDir, 'api', groupFolder, ...folderParts);
-                baseName = this.sanitizeFilename(leafName);
-                if (doc.verb) {
-                    baseName = `${baseName}_${doc.verb}`;
-                }
-            }
-            else {
-                // Default: split folder path from name
-                const nameParts = doc.name.split('/');
-                const leafName = nameParts.pop();
-                const folderParts = nameParts.map((part) => snakeCase(part));
-                typeDir = path.join(outputDir, doc.type, ...folderParts);
-                baseName = this.sanitizeFilename(leafName);
-                if (doc.verb) {
-                    baseName = `${baseName}_${doc.verb}`;
-                }
-            }
+            const { baseName, typeDir } = resolveDocumentPath(doc, outputDir, {
+                getApiGroupFolder,
+                getChannelServer,
+                join: path.join,
+                snakeCase,
+            });
             fs.mkdirSync(typeDir, { recursive: true });
             // Track duplicates per directory
             const dirKey = path.relative(outputDir, typeDir);
@@ -229,20 +152,11 @@ Pulled 58 documents from tenant my-tenant
             const count = typeCounters.get(baseName) || 0;
             typeCounters.set(baseName, count + 1);
             // Append numeric suffix for duplicates
-            let filename;
-            filename = count === 0 ? `${baseName}.xs` : `${baseName}_${count + 1}.xs`;
+            const filename = count === 0 ? `${baseName}.xs` : `${baseName}_${count + 1}.xs`;
             const filePath = path.join(typeDir, filename);
             fs.writeFileSync(filePath, doc.content, 'utf8');
             writtenCount++;
         }
         this.log(`Pulled ${writtenCount} documents from tenant ${tenantName} to ${flags.directory}`);
     }
-    /**
-     * Sanitize a document name for use as a filename.
-     * Strips quotes, replaces spaces with underscores, and removes
-     * characters that are unsafe in filenames.
-     */
-    sanitizeFilename(name) {
-        return snakeCase(name.replaceAll('"', ''));
-    }
 }

package/dist/commands/tenant_deploy_request/bypass/index.d.ts

@@ -0,0 +1,31 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestBypass extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'override-policy': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        reason: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
+    run(): Promise<void>;
+    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
+    private refuseByPolicyGate;
+}