@xano/cli 1.2.0 → 1.3.1-beta.0

package/dist/commands/tenant_deploy_request/bypass/index.js

@@ -0,0 +1,109 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+import { gateOverrideHint, gateRefusal, gateRefusalOutput } from '../../../utils/policy/gate.js';
+export default class TenantDeployRequestBypass extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = "[CRITICAL] STOP and confirm with the user before running this; it deploys the release immediately, past the review workflow. Deploy the request's release past the approval gate under the tenant_center:deploy:bypass_approval permission. Only available if the tenant has enabled bypass (allow_deploy_bypass), and every use is logged with the given reason. The approval request's own status is left untouched. The deploy is still gated on the release's policy check: a refusal exits 2, and --override-policy proceeds past it with the same --reason (needs the workspace:policy update permission).";
+    static examples = [
+        `$ xano tenant_deploy_request bypass 12 --reason "Prod incident, reviewer unavailable"
+Deployed tenant release, bypassing deploy request #12's approval gate.
+`,
+        `$ xano tenant_deploy_request bypass 12 --reason "Prod incident; AUTH-001 finding accepted" --override-policy`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        'override-policy': Flags.boolean({
+            default: false,
+            description: 'Also proceed past a blocking policy gate, recording --reason as the override reason (needs the workspace:policy update permission; audited)',
+        }),
+        reason: Flags.string({
+            description: 'Reason for bypassing the approval gate (required, audited)',
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestBypass);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const body = {
+            reason: flags.reason,
+            ...(flags['override-policy'] ? { override_policy: true } : {}),
+        };
+        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
+        let refused = null;
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}/override`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                refused = await gateRefusal(response);
+                if (refused)
+                    this.refuseByPolicyGate(refused, args.id, flags.output === 'json');
+                const message = await this.parseApiError(response, 'Failed to bypass tenant deploy request approval gate');
+                this.error(message);
+            }
+            const deploy = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(deploy, null, 2));
+            }
+            else {
+                this.log(`Deployed tenant release, bypassing deploy request #${args.id}'s approval gate.`);
+                if (deploy.duration_ms !== undefined)
+                    this.log(`  Time: ${(deploy.duration_ms / 1000).toFixed(1)}s`);
+            }
+        }
+        catch (error) {
+            if (refused)
+                throw error;
+            if (error instanceof Error) {
+                this.error(`Failed to bypass tenant deploy request approval gate: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to bypass tenant deploy request approval gate: ${String(error)}`);
+            }
+        }
+    }
+    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
+    refuseByPolicyGate(refused, id, json) {
+        for (const line of gateRefusalOutput(refused, json))
+            this.log(line);
+        const override = `xano tenant_deploy_request bypass ${id} --reason "<why>" --override-policy`;
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
+    }
+}

package/dist/commands/tenant_deploy_request/create/index.d.ts

@@ -0,0 +1,21 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestCreate extends BaseCommand {
+    static args: {
+        title: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        draft: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        release: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        reviewers: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        tenant: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tenant_deploy_request/create/index.js

@@ -0,0 +1,108 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestCreate extends BaseCommand {
+    static args = {
+        title: Args.string({
+            description: 'Short title for the deploy request',
+            required: true,
+        }),
+    };
+    static description = 'Open a tenant deploy request asking named reviewers to approve deploying a release to a tenant. Submits for review immediately unless --draft is passed.';
+    static examples = [
+        `$ xano tenant_deploy_request create "Deploy v1.2 to prod" --tenant prod --release v1.2 --reviewers 12,45
+Created deploy request #12: "Deploy v1.2 to prod" [pending]
+`,
+        `$ xano tenant_deploy_request create "Deploy v1.2 to prod" --tenant prod --release v1.2 --draft`,
+        `$ xano tenant_deploy_request create "$PR_TITLE" --tenant prod --release v1.2 --description "$PR_BODY" --reviewers 12,45 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        description: Flags.string({
+            char: 'd',
+            description: 'Longer description of what is being deployed and why',
+            required: false,
+        }),
+        draft: Flags.boolean({
+            default: false,
+            description: 'Save as a draft instead of submitting immediately (reviewers are not notified until submitted)',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        release: Flags.string({
+            char: 'r',
+            description: 'Name of the release to deploy',
+            required: true,
+        }),
+        reviewers: Flags.string({
+            description: 'Comma-separated user IDs to request review from',
+            required: false,
+        }),
+        tenant: Flags.string({
+            char: 't',
+            description: 'Name of the target tenant',
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestCreate);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const reviewerIds = flags.reviewers
+            ? flags.reviewers.split(',').map((id) => Number.parseInt(id.trim(), 10))
+            : [];
+        const body = {
+            release_name: flags.release,
+            reviewer_ids: reviewerIds,
+            status: flags.draft ? 'draft' : 'pending',
+            tenant_name: flags.tenant,
+            title: args.title,
+        };
+        if (flags.description)
+            body.description = flags.description;
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const message = await this.parseApiError(response, 'Failed to create tenant deploy request');
+                this.error(message);
+            }
+            const item = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(item, null, 2));
+            }
+            else {
+                this.log(`Created deploy request #${item.id}: "${item.title}" [${item.status}]`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to create tenant deploy request: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to create tenant deploy request: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/edit/index.d.ts

@@ -0,0 +1,22 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestEdit extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        reviewers: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        title: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tenant_deploy_request/edit/index.js

@@ -0,0 +1,103 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestEdit extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = "Edit a tenant deploy request's title, description or reviewers. The author or an existing reviewer may do this.";
+    static examples = [
+        `$ xano tenant_deploy_request edit 12 --title "Deploy v1.2.1 to prod"
+Updated deploy request #12: "Deploy v1.2.1 to prod" [pending]
+`,
+        `$ xano tenant_deploy_request edit 12 --reviewers 12,45,67 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        description: Flags.string({
+            char: 'd',
+            description: 'New description',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        reviewers: Flags.string({
+            description: 'Replacement comma-separated user IDs to request review from',
+            required: false,
+        }),
+        title: Flags.string({
+            description: 'New title',
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestEdit);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const baseUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}`;
+        try {
+            const getResponse = await this.verboseFetch(baseUrl, {
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                },
+                method: 'GET',
+            }, flags.verbose, profile.access_token);
+            if (!getResponse.ok) {
+                const message = await this.parseApiError(getResponse, 'Failed to fetch tenant deploy request');
+                this.error(message);
+            }
+            const current = (await getResponse.json());
+            const body = {
+                description: flags.description === undefined ? (current.description ?? '') : flags.description,
+                reviewer_ids: flags.reviewers
+                    ? flags.reviewers.split(',').map((id) => Number.parseInt(id.trim(), 10))
+                    : (current.reviewers ?? []).map((r) => r.id),
+                title: flags.title === undefined ? current.title : flags.title,
+            };
+            const putResponse = await this.verboseFetch(baseUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'PUT',
+            }, flags.verbose, profile.access_token);
+            if (!putResponse.ok) {
+                const message = await this.parseApiError(putResponse, 'Failed to edit tenant deploy request');
+                this.error(message);
+            }
+            const item = (await putResponse.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(item, null, 2));
+            }
+            else {
+                this.log(`Updated deploy request #${item.id}: "${item.title}" [${item.status}]`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to edit tenant deploy request: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to edit tenant deploy request: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/get/index.d.ts

@@ -0,0 +1,25 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestGet extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * The policy gate's verdict on the request's release for its tenant, as a deploy now would meet it.
+     * Only a policy reader gets one; any refusal or failure is a reason it is not available, never an
+     * error of this command.
+     */
+    private policyCheck;
+}

package/dist/commands/tenant_deploy_request/get/index.js

@@ -0,0 +1,116 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+import { fetchPolicyGate, gateLines, unavailableReason } from '../../../utils/policy/gate.js';
+export default class TenantDeployRequestGet extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = "Get details of a specific tenant deploy request, with the policy check of its release on its tenant (what the deploy's policy gate would decide now), for a credential that reads policies";
+    static examples = [
+        `$ xano tenant_deploy_request get 12
+Deploy request #12: "Deploy v1.2 to prod" [pending]
+  Tenant: prod
+  Release: v1.2
+Policy check of release "v1.2" on tenant "prod":
+Policy gate: pass
+  This release has no blocking policy findings.
+  Release: v1.2 (policy run 301, pass)
+  Blocking findings in this release: 0
+`,
+        `$ xano tenant_deploy_request get 12 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestGet);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                },
+                method: 'GET',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const message = await this.parseApiError(response, 'Failed to get tenant deploy request');
+                this.error(message);
+            }
+            const item = (await response.json());
+            const policyCheck = await this.policyCheck(item, { profile, verbose: flags.verbose, workspaceId });
+            if (flags.output === 'json') {
+                this.log(JSON.stringify({ ...item, policy_gate: policyCheck.answer ?? null,
+                    ...(policyCheck.unavailable ? { policy_gate_unavailable: policyCheck.unavailable } : {}) }, null, 2));
+            }
+            else {
+                this.log(`Deploy request #${item.id}: "${item.title}" [${item.status}]`);
+                this.log(`  Tenant: ${item._tenant?.name || (item.deployment?.tenant?.id ? `#${item.deployment.tenant.id}` : 'unavailable')}`);
+                this.log(`  Release: ${item._release?.name || (item.deployment?.release?.id ? `#${item.deployment.release.id}` : 'unavailable')}`);
+                if (item.description)
+                    this.log(`  Description: ${item.description}`);
+                if (item.reviewers?.length)
+                    this.log(`  Reviewers: ${item.reviewers.map((r) => r.id).join(', ')}`);
+                if (item.can_review !== undefined)
+                    this.log(`  Can review: ${item.can_review}`);
+                if (policyCheck.answer) {
+                    this.log(`Policy check of release "${item._release?.name}" on tenant "${item._tenant?.name}":`);
+                    for (const line of gateLines(policyCheck.answer))
+                        this.log(line);
+                }
+                else if (policyCheck.unavailable) {
+                    this.log(`Policy checks: not available (${policyCheck.unavailable})`);
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to get tenant deploy request: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to get tenant deploy request: ${String(error)}`);
+            }
+        }
+    }
+    /**
+     * The policy gate's verdict on the request's release for its tenant, as a deploy now would meet it.
+     * Only a policy reader gets one; any refusal or failure is a reason it is not available, never an
+     * error of this command.
+     */
+    async policyCheck(item, target) {
+        // Terminal requests are historical records: previewing now can check a different base release.
+        if (['approved', 'closed'].includes(item.status))
+            return {};
+        const tenant = item._tenant?.name?.trim();
+        const release = item._release?.name?.trim();
+        if (!tenant || !release)
+            return { unavailable: 'the request does not name its tenant and release' };
+        try {
+            const result = await fetchPolicyGate({ verboseFetch: (...args) => this.verboseFetch(...args) }, { profile: target.profile, release, tenant, verbose: target.verbose, workspace: String(target.workspaceId) });
+            return 'answer' in result ? { answer: result.answer } : { unavailable: unavailableReason(result.unavailable) };
+        }
+        catch (error) {
+            return { unavailable: error instanceof Error ? error.message : String(error) };
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/list/index.d.ts

@@ -0,0 +1,20 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        mine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        page: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        'per-page': import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        release: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        status: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        tenant: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'to-review': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tenant_deploy_request/list/index.js

@@ -0,0 +1,122 @@
+import { Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestList extends BaseCommand {
+    static description = 'List tenant deploy requests (deployment approval requests) in a workspace';
+    static examples = [
+        `$ xano tenant_deploy_request list
+Deploy requests in workspace 5:
+  - #12 "Deploy v1.2 to prod" [pending] -> prod / v1.2
+`,
+        `$ xano tenant_deploy_request list --tenant prod --status pending`,
+        `$ xano tenant_deploy_request list --tenant prod --release v1.2`,
+        `$ xano tenant_deploy_request list --to-review -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        mine: Flags.boolean({
+            default: false,
+            description: 'Only requests you authored',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        page: Flags.integer({
+            default: 1,
+            description: 'Page number',
+            required: false,
+        }),
+        'per-page': Flags.integer({
+            default: 25,
+            description: 'Items per page',
+            required: false,
+        }),
+        release: Flags.string({
+            char: 'r',
+            description: 'Filter to requests targeting this release. Applied client-side (the API has no release filter), after --page/--per-page, so a narrow page size can hide matches on other pages.',
+            required: false,
+        }),
+        status: Flags.string({
+            description: 'Filter by status',
+            options: ['draft', 'pending', 'changes_requested', 'approved', 'closed'],
+            required: false,
+        }),
+        tenant: Flags.string({
+            description: 'Filter to requests targeting this tenant',
+            required: false,
+        }),
+        'to-review': Flags.boolean({
+            default: false,
+            description: 'Only requests you are able to review',
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(TenantDeployRequestList);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const params = new URLSearchParams();
+        if (flags.status)
+            params.set('status', flags.status);
+        if (flags.tenant)
+            params.set('tenant_name', flags.tenant);
+        if (flags.mine)
+            params.set('mine', 'true');
+        if (flags['to-review'])
+            params.set('to_review', 'true');
+        params.set('page', String(flags.page));
+        params.set('per_page', String(flags['per-page']));
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request?${params}`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                },
+                method: 'GET',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const message = await this.parseApiError(response, 'Failed to list tenant deploy requests');
+                this.error(message);
+            }
+            const data = (await response.json());
+            const allItems = Array.isArray(data) ? data : (data.items ?? []);
+            const items = flags.release ? allItems.filter((item) => item._release?.name === flags.release) : allItems;
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(items, null, 2));
+            }
+            else if (items.length === 0) {
+                this.log('No tenant deploy requests found');
+            }
+            else {
+                this.log(`Deploy requests in workspace ${workspaceId}:`);
+                for (const item of items) {
+                    const review = item.can_review ? ' (reviewable)' : '';
+                    const tenantName = item._tenant?.name ?? '?';
+                    const releaseName = item._release?.name ?? '?';
+                    this.log(`  - #${item.id} "${item.title}" [${item.status}]${review} -> ${tenantName} / ${releaseName}`);
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to list tenant deploy requests: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to list tenant deploy requests: ${String(error)}`);
+            }
+        }
+    }
+}