@xano/cli 1.2.0 → 1.3.1-beta.0

package/dist/commands/auth/index.js

@@ -212,13 +212,6 @@ To authenticate, open the following URL in any browser:
         }
         return noBrowser ? this.promptForToken(origin) : this.startAuthServer(origin);
     }
-    getHeaders(accessToken) {
-        return {
-            'User-Agent': buildUserAgent(this.config.version),
-            accept: 'application/json',
-            ...(accessToken && { Authorization: `Bearer ${accessToken}` }),
-        };
-    }
     async fetchBranches(accessToken, origin, workspaceId) {
         try {
             const response = await fetch(`${origin}/api:meta/workspace/${workspaceId}/branch`, {
@@ -288,6 +281,13 @@ To authenticate, open the following URL in any browser:
             return [];
         }
     }
+    getHeaders(accessToken) {
+        return {
+            accept: 'application/json',
+            'User-Agent': buildUserAgent(this.config.version),
+            ...(accessToken && { Authorization: `Bearer ${accessToken}` }),
+        };
+    }
     async promptForToken(origin) {
         // Headless flow: no local callback server. The login page, when opened
         // without a `callback` param, renders the access token on screen for the

package/dist/commands/branch/create/index.d.ts

@@ -1,9 +1,9 @@
 import BaseCommand from '../../../base-command.js';
 export default class BranchCreate extends BaseCommand {
-    static description: string;
     static args: {
         label: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
     };
+    static description: string;
     static examples: string[];
     static flags: {
         color: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/branch/create/index.js

@@ -1,13 +1,13 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
 export default class BranchCreate extends BaseCommand {
-    static description = 'Create a new branch by cloning from an existing branch';
     static args = {
         label: Args.string({
             description: 'Label for the new branch',
             required: true,
         }),
     };
+    static description = 'Create a new branch by cloning from an existing branch';
     static examples = [
         `$ xano branch create dev
 Created branch: dev

package/dist/commands/branch/set_live/index.d.ts

@@ -8,11 +8,33 @@ export default class BranchSetLive extends BaseCommand {
     static flags: {
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    /** Set once the platform refuses for a weakened mandatory policy: already explained, it exits 1 as it is. */
+    private refusedByPermission;
+    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
     run(): Promise<void>;
     private confirm;
+    /**
+     * The set-live gate refused: the verdict on stdout (under `-o json`, `{set_live: false, message,
+     * policy_gate}`), then the platform's message and how to proceed, exiting 2.
+     */
+    private refuseSetLive;
+    /**
+     * The branch weakens a mandatory policy of the live branch (or lacks one), and the credential lacks
+     * `workspace:policy` update. That is a permission refusal, not a blocking finding: it exits 1 (under
+     * `-o json` as `{error}`) with the platform's sentence and how to go on. The live branch is unchanged.
+     */
+    private refuseWeakening;
 }

package/dist/commands/branch/set_live/index.js

@@ -1,5 +1,7 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateOverrideHint, gateRefusal, liveGateLines, quoted, weakeningRefusal, } from '../../../utils/policy/gate.js';
+import { policyWeakeningGuidance } from '../../../utils/policy/permission.js';
 export default class BranchSetLive extends BaseCommand {
     static args = {
         branch_label: Args.string({
@@ -7,7 +9,7 @@ export default class BranchSetLive extends BaseCommand {
             required: true,
         }),
     };
-    static description = '[IMPORTANT] ALWAYS confirm with the user before changing the live branch. Sets a branch as the live (active) branch for API requests.';
+    static description = '[IMPORTANT] ALWAYS confirm with the user before changing the live branch. Sets a branch as the live (active) branch for API requests. The set-live policy gate checks the branch against its own policies, which live will have once it is set live: when blocking findings refuse it, the command exits 2 unless --policy-override gives a reason. A branch that weakens a mandatory policy of the live branch needs workspace:policy update; without it the command exits 1.';
     static examples = [
         `$ xano branch set-live staging
 Are you sure you want to set 'staging' as the live branch? (y/N) y
@@ -24,6 +26,7 @@ Branch 'v1' is now live
   "live": true
 }
 `,
+        `$ xano branch set_live rollback --force --policy-override "Rollback approved; finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -40,14 +43,27 @@ Branch 'v1' is now live
             options: ['summary', 'json'],
             required: false,
         }),
+        'policy-override': Flags.string({ description: 'Set the branch live past a blocking set-live policy gate with an audited reason (requires workspace:policy update)' }),
         workspace: Flags.integer({
             char: 'w',
             description: 'Workspace ID (uses profile workspace if not provided)',
             required: false,
         }),
     };
+    /** Set once the platform refuses for a weakened mandatory policy: already explained, it exits 1 as it is. */
+    refusedByPermission = false;
+    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(BranchSetLive);
+        if (blankPolicyOverride(flags['policy-override']))
+            this.error(BLANK_POLICY_OVERRIDE);
         const { profile } = this.resolveProfile(flags);
         // Get workspace ID from flag or profile
         const workspaceId = flags.workspace || profile.workspace;
@@ -66,16 +82,26 @@ Branch 'v1' is now live
         }
         // Construct the API URL
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/branch/${encodeURIComponent(branchLabel)}/live`;
+        // A reason from someone with workspace:policy update sets the branch live past a blocking gate.
+        const overrideReason = flags['policy-override']?.trim();
         // Set branch as live via the API
         try {
             const response = await this.verboseFetch(apiUrl, {
+                ...(overrideReason ? { body: JSON.stringify({ override_reason: overrideReason }) } : {}),
                 headers: {
                     'accept': 'application/json',
                     'Authorization': `Bearer ${profile.access_token}`,
+                    ...(overrideReason ? { 'Content-Type': 'application/json' } : {}),
                 },
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
+                const refused = await gateRefusal(response);
+                if (refused)
+                    this.refuseSetLive(refused, flags, branchLabel);
+                const weakening = await weakeningRefusal(response);
+                if (weakening)
+                    this.refuseWeakening(weakening, flags, branchLabel);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -89,6 +115,8 @@ Branch 'v1' is now live
             }
         }
         catch (error) {
+            if (this.refusedByPolicyGate || this.refusedByPermission)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to set branch as live: ${error.message}`);
             }
@@ -111,4 +139,35 @@ Branch 'v1' is now live
             });
         });
     }
+    /**
+     * The set-live gate refused: the verdict on stdout (under `-o json`, `{set_live: false, message,
+     * policy_gate}`), then the platform's message and how to proceed, exiting 2.
+     */
+    refuseSetLive(refused, flags, branchLabel) {
+        if (flags.output === 'json') {
+            this.log(JSON.stringify({ message: refused.message, policy_gate: refused.answer, set_live: false }, null, 2));
+        }
+        else {
+            for (const line of liveGateLines(refused.answer, 'branch'))
+                this.log(line);
+        }
+        const workspace = flags.workspace ? ` -w ${flags.workspace}` : '';
+        const hint = gateOverrideHint(refused.answer, `xano branch set_live ${quoted(branchLabel)}${workspace} --policy-override "<why>"`);
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${hint}`, { exit: 2 });
+    }
+    /**
+     * The branch weakens a mandatory policy of the live branch (or lacks one), and the credential lacks
+     * `workspace:policy` update. That is a permission refusal, not a blocking finding: it exits 1 (under
+     * `-o json` as `{error}`) with the platform's sentence and how to go on. The live branch is unchanged.
+     */
+    refuseWeakening(refused, flags, branchLabel) {
+        const workspace = flags.workspace ? ` -w ${flags.workspace}` : '';
+        this.refusedByPermission = true;
+        const again = `xano branch set_live ${quoted(branchLabel)}${workspace}`;
+        const way = refused.payload.unavailable === true
+            ? `The check may read them next time: ${again}`
+            : `To set it live yourself, give ${quoted(branchLabel)} the live branch's version of those policies, then run: ${again}`;
+        this.error(`${refused.message}${policyWeakeningGuidance(refused.payload, [way], true)}`);
+    }
 }

package/dist/commands/ephemeral/create/index.d.ts

@@ -0,0 +1,18 @@
+import BaseCommand from '../../../base-command.js';
+export default class EphemeralCreate extends BaseCommand {
+    static args: {
+        display: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'expires-hours': import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/ephemeral/create/index.js

@@ -0,0 +1,103 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class EphemeralCreate extends BaseCommand {
+    static args = {
+        display: Args.string({
+            description: 'Display name for the ephemeral tenant',
+            required: true,
+        }),
+    };
+    static description = 'Create a new ephemeral (short-lived, auto-expiring) tenant in a workspace';
+    static examples = [
+        `$ xano ephemeral create "PR preview"
+Created ephemeral tenant: PR preview (e4f2-9ab1-...) - ID: 42
+  Expires: in 1 hour
+`,
+        `$ xano ephemeral create "Demo" --expires-hours 24 -w 114`,
+        `$ xano ephemeral create "Load test" --description "overnight soak" --expires-hours 24 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        description: Flags.string({
+            char: 'd',
+            description: 'Ephemeral tenant description',
+            required: false,
+        }),
+        'expires-hours': Flags.integer({
+            default: 1,
+            description: 'Hours until the tenant auto-expires (1-24)',
+            max: 24,
+            min: 1,
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(EphemeralCreate);
+        const { profile } = this.resolveProfile(flags);
+        // Ephemeral tenants REQUIRE a workspace (unlike sandbox, which is workspace-agnostic).
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Ephemeral tenants require a workspace — use --workspace or set one in your profile.');
+        }
+        const body = {
+            display: args.display,
+            expires_hours: flags['expires-hours'],
+            tag: [],
+        };
+        if (flags.description)
+            body.description = flags.description;
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/ephemeral`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const errorText = await response.text();
+                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+            }
+            const tenant = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(tenant, null, 2));
+            }
+            else {
+                this.log(`Created ephemeral tenant: ${tenant.display || tenant.name} (${tenant.name}) - ID: ${tenant.id}`);
+                if (tenant.state) {
+                    this.log(`  State: ${tenant.state}`);
+                }
+                if (tenant.ephemeral_expires_at) {
+                    // The API serializes the timestamp field as a date string
+                    // ("2026-07-24 19:49:15+0000"); tolerate a raw unix-epoch number too.
+                    const raw = tenant.ephemeral_expires_at;
+                    const expiresMs = typeof raw === 'number' ? raw * 1000 : Date.parse(String(raw).replace(' ', 'T'));
+                    this.log(`  Expires: ${Number.isNaN(expiresMs) ? String(raw) : new Date(expiresMs).toISOString()}`);
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to create ephemeral tenant: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to create ephemeral tenant: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/ephemeral/delete/index.d.ts

@@ -0,0 +1,18 @@
+import BaseCommand from '../../../base-command.js';
+export default class EphemeralDelete extends BaseCommand {
+    static args: {
+        tenant_name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private confirm;
+}

package/dist/commands/ephemeral/delete/index.js

@@ -0,0 +1,99 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class EphemeralDelete extends BaseCommand {
+    static args = {
+        tenant_name: Args.string({
+            description: 'Ephemeral tenant name to delete',
+            required: true,
+        }),
+    };
+    static description = 'Delete an ephemeral tenant permanently. This destroys all associated infrastructure and cannot be undone.';
+    static examples = [
+        `$ xano ephemeral delete e4f2-9ab1-xyz1
+Are you sure you want to delete tenant e4f2-9ab1-xyz1? This action cannot be undone. (y/N) y
+Deleted tenant e4f2-9ab1-xyz1
+`,
+        `$ xano ephemeral delete e4f2-9ab1-xyz1 --force
+Deleted tenant e4f2-9ab1-xyz1
+`,
+        `$ xano ephemeral delete e4f2-9ab1-xyz1 -f -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        force: Flags.boolean({
+            char: 'f',
+            default: false,
+            description: '[CRITICAL] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(EphemeralDelete);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const tenantName = args.tenant_name;
+        if (!flags.force) {
+            const confirmed = await this.confirm(`Are you sure you want to delete tenant ${tenantName}? This action cannot be undone.`);
+            if (!confirmed) {
+                this.log('Deletion cancelled.');
+                return;
+            }
+        }
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${tenantName}`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                headers: {
+                    'accept': 'application/json',
+                    'Authorization': `Bearer ${profile.access_token}`,
+                },
+                method: 'DELETE',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const errorText = await response.text();
+                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+            }
+            if (flags.output === 'json') {
+                this.log(JSON.stringify({ deleted: true, tenant_name: tenantName }, null, 2));
+            }
+            else {
+                this.log(`Deleted tenant ${tenantName}`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to delete ephemeral tenant: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to delete ephemeral tenant: ${String(error)}`);
+            }
+        }
+    }
+    async confirm(message) {
+        const readline = await import('node:readline');
+        const rl = readline.createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        return new Promise((resolve) => {
+            rl.question(`${message} (y/N) `, (answer) => {
+                rl.close();
+                resolve(answer.toLowerCase() === 'y' || answer.toLowerCase() === 'yes');
+            });
+        });
+    }
+}

package/dist/commands/ephemeral/edit/index.d.ts

@@ -0,0 +1,18 @@
+import BaseCommand from '../../../base-command.js';
+export default class EphemeralEdit extends BaseCommand {
+    static args: {
+        tenant_name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        display: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/ephemeral/edit/index.js

@@ -0,0 +1,109 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class EphemeralEdit extends BaseCommand {
+    static args = {
+        tenant_name: Args.string({
+            description: 'Ephemeral tenant name to edit',
+            required: true,
+        }),
+    };
+    static description = 'Edit an existing ephemeral tenant';
+    static examples = [
+        `$ xano ephemeral edit e4f2-9ab1-xyz1 --display "New Name" --description "Updated description"
+Updated tenant: New Name (e4f2-9ab1-xyz1) - ID: 42
+`,
+        `$ xano ephemeral edit e4f2-9ab1-xyz1 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        description: Flags.string({
+            char: 'd',
+            description: 'New description',
+            required: false,
+        }),
+        display: Flags.string({
+            description: 'New display name',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(EphemeralEdit);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const tenantName = args.tenant_name;
+        const baseUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${tenantName}`;
+        const headers = {
+            'accept': 'application/json',
+            'Authorization': `Bearer ${profile.access_token}`,
+            'Content-Type': 'application/json',
+        };
+        try {
+            // Fetch current tenant state (PUT requires all fields)
+            const getResponse = await this.verboseFetch(baseUrl, {
+                headers: {
+                    'accept': 'application/json',
+                    'Authorization': `Bearer ${profile.access_token}`,
+                },
+                method: 'GET',
+            }, flags.verbose, profile.access_token);
+            if (!getResponse.ok) {
+                const errorText = await getResponse.text();
+                this.error(`Failed to fetch tenant: ${getResponse.status} ${getResponse.statusText}\n${errorText}`);
+            }
+            const current = await getResponse.json();
+            // Merge in user-provided values
+            const body = {
+                description: flags.description === undefined ? (current.description ?? '') : flags.description,
+                display: flags.display === undefined ? (current.display ?? current.name) : flags.display,
+                domain: current.domain ?? '',
+                ingress: current.ingress ?? false,
+                proxy: current.proxy ?? '',
+                rbac: {
+                    enabled: current.rbac?.enabled ?? false,
+                },
+                tag: current.tag ?? [],
+                tasks: current.tasks ?? false,
+            };
+            // Update tenant
+            const putResponse = await this.verboseFetch(baseUrl, {
+                body: JSON.stringify(body),
+                headers,
+                method: 'PUT',
+            }, flags.verbose, profile.access_token);
+            if (!putResponse.ok) {
+                const errorText = await putResponse.text();
+                this.error(`API request failed with status ${putResponse.status}: ${putResponse.statusText}\n${errorText}`);
+            }
+            const tenant = await putResponse.json();
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(tenant, null, 2));
+            }
+            else {
+                this.log(`Updated tenant: ${tenant.display || tenant.name} (${tenant.name}) - ID: ${tenant.id}`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to edit ephemeral tenant: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to edit ephemeral tenant: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/ephemeral/get/index.d.ts

@@ -0,0 +1,21 @@
+import BaseCommand from '../../../base-command.js';
+export default class EphemeralGet extends BaseCommand {
+    static args: {
+        tenant_name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * Render a unix-epoch-seconds expiration as a human-readable "in Xh Ym" string,
+     * falling back to an ISO timestamp if the value has already passed or is absent.
+     */
+    private formatExpiration;
+}