@xano/cli 1.2.0 → 1.3.1-beta.0

package/dist/commands/function/edit/index.js

@@ -3,8 +3,9 @@ import inquirer from 'inquirer';
 import { execSync } from 'node:child_process';
 import * as fs from 'node:fs';
 import * as os from 'node:os';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand, { buildUserAgent } from '../../../base-command.js';
+import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateRefusal, publishRefusal, quoted } from '../../../utils/policy/gate.js';
 export default class FunctionEdit extends BaseCommand {
     static args = {
         function_id: Args.string({
@@ -59,6 +60,7 @@ Name: my_function
   ...
 }
 `,
+        `$ xano function:edit 163 -f function.xs --policy-override "Exception approved; finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -81,6 +83,7 @@ Name: my_function
             options: ['summary', 'json'],
             required: false,
         }),
+        'policy-override': Flags.string({ description: 'Publish past a blocking live-branch publish policy gate with an audited reason (requires workspace:policy update)' }),
         publish: Flags.boolean({
             default: true,
             description: 'Publish the function after editing',
@@ -99,8 +102,18 @@ Name: my_function
             required: false,
         }),
     };
+    /** Set once the publish policy gate refuses, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the publish gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(FunctionEdit);
+        if (blankPolicyOverride(flags['policy-override']))
+            this.error(BLANK_POLICY_OVERRIDE);
         const { profile, profileName } = this.resolveProfile(flags);
         // Validate flag combinations
         if (flags.edit && !flags.file) {
@@ -120,8 +133,7 @@ Name: my_function
                 `  2. Set it in your profile using: xano profile:edit ${profileName} -w <workspace_id>`);
         }
         // If function_id is not provided, prompt user to select from list
-        let functionId;
-        functionId = args.function_id ? args.function_id : await this.promptForFunctionId(profile, workspaceId);
+        const functionId = args.function_id || (await this.promptForFunctionId(profile, workspaceId));
         // Read XanoScript content
         let xanoscript;
         if (flags.file) {
@@ -176,6 +188,10 @@ Name: my_function
             include_xanoscript: 'false',
             publish: flags.publish ? 'true' : 'false',
         });
+        // A reason from someone with workspace:policy update publishes past a blocking publish gate.
+        const overrideReason = flags['policy-override']?.trim();
+        if (overrideReason)
+            queryParams.set('override_reason', overrideReason);
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function/${functionId}?${queryParams.toString()}`;
         // Update function via API
         try {
@@ -189,6 +205,9 @@ Name: my_function
                 method: 'PUT',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
+                const refused = await gateRefusal(response);
+                if (refused)
+                    this.refusePublish(refused, flags, functionId);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -209,6 +228,8 @@ Name: my_function
             }
         }
         catch (error) {
+            if (this.refusedByPolicyGate)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to update function: ${error.message}`);
             }
@@ -221,14 +242,14 @@ Name: my_function
         // Get the EDITOR environment variable
         const editor = process.env.EDITOR || process.env.VISUAL;
         if (!editor) {
-            this.error('No editor configured. Please set the EDITOR or VISUAL environment variable.\n' + 'Example: export EDITOR=vim');
+            this.error('No editor configured. Please set the EDITOR or VISUAL environment variable.\nExample: export EDITOR=vim');
         }
         // Validate editor executable exists
         try {
             execSync(`which ${editor.split(' ')[0]}`, { stdio: 'ignore' });
         }
         catch {
-            this.error(`Editor '${editor}' not found. Please set EDITOR to a valid editor.\n` + 'Example: export EDITOR=vim');
+            this.error(`Editor '${editor}' not found. Please set EDITOR to a valid editor.\nExample: export EDITOR=vim`);
         }
         // Read the original file
         let originalContent;
@@ -321,35 +342,30 @@ Name: my_function
             include_xanoscript: 'true',
         });
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function/${functionId}?${queryParams.toString()}`;
-        try {
-            const response = await fetch(apiUrl, {
-                headers: {
-                    'User-Agent': buildUserAgent(this.config.version),
-                    accept: 'application/json',
-                    Authorization: `Bearer ${profile.access_token}`,
-                },
-                method: 'GET',
-            });
-            if (!response.ok) {
-                const errorText = await response.text();
-                throw new Error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+        const response = await fetch(apiUrl, {
+            headers: {
+                accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
+                'User-Agent': buildUserAgent(this.config.version),
+            },
+            method: 'GET',
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+        }
+        const result = (await response.json());
+        // Handle xanoscript as an object with status and value
+        if (result.xanoscript) {
+            if (result.xanoscript.status === 'ok' && result.xanoscript.value !== undefined) {
+                return result.xanoscript.value;
             }
-            const result = (await response.json());
-            // Handle xanoscript as an object with status and value
-            if (result.xanoscript) {
-                if (result.xanoscript.status === 'ok' && result.xanoscript.value !== undefined) {
-                    return result.xanoscript.value;
-                }
-                if (typeof result.xanoscript === 'string') {
-                    return result.xanoscript;
-                }
-                throw new Error(`Invalid xanoscript format: ${JSON.stringify(result.xanoscript)}`);
+            if (typeof result.xanoscript === 'string') {
+                return result.xanoscript;
             }
-            return '';
-        }
-        catch (error) {
-            throw error;
+            throw new Error(`Invalid xanoscript format: ${JSON.stringify(result.xanoscript)}`);
         }
+        return '';
     }
     async promptForFunctionId(profile, workspaceId) {
         try {
@@ -365,9 +381,9 @@ Name: my_function
             const listUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function?${queryParams.toString()}`;
             const response = await fetch(listUrl, {
                 headers: {
-                    'User-Agent': buildUserAgent(this.config.version),
                     accept: 'application/json',
                     Authorization: `Bearer ${profile.access_token}`,
+                    'User-Agent': buildUserAgent(this.config.version),
                 },
                 method: 'GET',
             });
@@ -434,4 +450,22 @@ Name: my_function
             process.stdin.resume();
         });
     }
+    /**
+     * The live-branch publish gate refused the update: the verdict on stdout (under `-o json`,
+     * `{updated: false, message, policy_gate}`), then the platform's message and how to proceed,
+     * exiting 2.
+     */
+    refusePublish(refused, flags, functionId) {
+        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
+        const source = flags.file ? ` -f ${quoted(flags.file)}` : flags.stdin ? ' --stdin' : '';
+        const { lines, message } = publishRefusal(refused, {
+            json: flags.output === 'json',
+            outcome: 'updated',
+            rerun: `xano function edit ${quoted(functionId)}${workspace}${source} --policy-override "<why>"`,
+        });
+        for (const line of lines)
+            this.log(line);
+        this.refusedByPolicyGate = true;
+        this.error(message, { exit: 2 });
+    }
 }

package/dist/commands/function/get/index.js

@@ -89,8 +89,7 @@ function yo {
                 `  2. Set it in your profile using: xano profile:edit ${profileName} -w <workspace_id>`);
         }
         // If function_id is not provided, prompt user to select from list
-        let functionId;
-        functionId = args.function_id ? args.function_id : await this.promptForFunctionId(profile, workspaceId);
+        const functionId = args.function_id || (await this.promptForFunctionId(profile, workspaceId));
         // Build query parameters
         // Automatically set include_xanoscript to true if output format is xs
         const includeXanoscript = flags.output === 'xs' ? true : flags.include_xanoscript;
@@ -178,9 +177,9 @@ function yo {
             const listUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function?${queryParams.toString()}`;
             const response = await fetch(listUrl, {
                 headers: {
-                    'User-Agent': buildUserAgent(this.config.version),
                     accept: 'application/json',
                     Authorization: `Bearer ${profile.access_token}`,
+                    'User-Agent': buildUserAgent(this.config.version),
                 },
                 method: 'GET',
             });

package/dist/commands/function/run/index.d.ts

@@ -8,6 +8,7 @@ export default class FunctionRun extends BaseCommand {
     static flags: {
         branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         data: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        datasource: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         json: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         logs: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         name: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/function/run/index.js

@@ -17,6 +17,8 @@ export default class FunctionRun extends BaseCommand {
         `$ xano function:run calcScore --json @payload.json --data env=staging`,
         `$ echo '{"email":"jo@x.com"}' | xano function:run calcScore --stdin -o json | jq .result`,
         `$ xano function:run calcScore --branch dev --logs`,
+        `$ xano function:run calcScore --datasource test
+# Runs against the 'test' data source instead of 'live'`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -30,6 +32,10 @@ export default class FunctionRun extends BaseCommand {
             multiple: true,
             required: false,
         }),
+        datasource: Flags.string({
+            description: 'Data source to run against, e.g. test (defaults to live)',
+            required: false,
+        }),
         json: Flags.string({
             description: "Input as a JSON object: inline, @file.json, or '-' for stdin",
             exclusive: ['stdin'],
@@ -106,13 +112,21 @@ export default class FunctionRun extends BaseCommand {
         const body = { input, name: functionName };
         if (branch)
             body.branch = branch;
+        const headers = {
+            'accept': 'application/json',
+            'Authorization': `Bearer ${profile.access_token}`,
+            'Content-Type': 'application/json',
+        };
+        // The Metadata API resolves the workspace's tables against the data source
+        // named by X-Data-Source (defaulting to `live`), so the run reads and writes
+        // the same tables a request carrying that header would. An unknown label is
+        // rejected server-side with "Invalid data source."
+        const dataSource = flags.datasource?.trim();
+        if (dataSource)
+            headers['X-Data-Source'] = dataSource;
         const response = await this.verboseFetch(apiUrl, {
             body: JSON.stringify(body),
-            headers: {
-                'accept': 'application/json',
-                'Authorization': `Bearer ${profile.access_token}`,
-                'Content-Type': 'application/json',
-            },
+            headers,
             method: 'POST',
         }, flags.verbose, profile.access_token);
         if (!response.ok) {
@@ -153,7 +167,6 @@ export default class FunctionRun extends BaseCommand {
      */
     async fetchFunctionByName(opts) {
         const { branch, name, profile, verbose, workspaceId } = opts;
-        // eslint-disable-next-line camelcase -- external Metadata API query param
         const params = new URLSearchParams({ per_page: '100', search: name });
         if (branch)
             params.set('branch', branch);

package/dist/commands/policy/catalogue/index.d.ts

@@ -0,0 +1,15 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyCatalogue extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        check: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/catalogue/index.js

@@ -0,0 +1,29 @@
+import { Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { policyCatalogueSummary, selectCatalogueCheck } from '../../../utils/policy/catalogue.js';
+import { listItems } from '../../../utils/policy/request.js';
+export default class PolicyCatalogue extends PolicyCommand {
+    static description = 'List built-in policy checks and their parameter schemas';
+    static examples = ['$ xano policy catalogue -o json', '$ xano policy catalogue --check object.auth_required'];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        check: Flags.string({ description: 'Show only this check id (an unknown id names the closest matches)' }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyCatalogue);
+        const { request } = this.policyTarget(flags);
+        const result = await request('/check');
+        if (flags.check) {
+            // `--check` narrows both output modes, so `-o json` stays pipeable for one check too.
+            const selected = selectCatalogueCheck(listItems(result), flags.check);
+            this.log(flags.output === 'json' ? JSON.stringify(selected, null, 2) : policyCatalogueSummary(selected).join('\n'));
+        }
+        else if (flags.output === 'json') {
+            this.log(JSON.stringify(result, null, 2));
+        }
+        else {
+            for (const line of policyCatalogueSummary(listItems(result)))
+                this.log(line);
+        }
+    }
+}

package/dist/commands/policy/create/index.d.ts

@@ -0,0 +1,18 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyCreate extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        goal: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        key: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        param: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/create/index.js

@@ -0,0 +1,39 @@
+import { Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { policyFromGoal } from '../../../utils/policy/goal.js';
+import { listAllPolicies } from '../../../utils/policy/request.js';
+export default class PolicyCreate extends PolicyCommand {
+    static description = 'Create an independent policy from a platform goal';
+    static examples = [
+        '$ xano policy create --goal endpoints_need_login -b dev',
+        `$ xano policy create --goal no_pii_in_responses --key DATA-020 --param 'fields=["email","ssn"]'`,
+    ];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        ...PolicyCommand.publishFlags,
+        goal: Flags.string({ description: 'Goal id from policy catalogue -o json', required: true }),
+        key: Flags.string({ description: 'New policy key (default: the goal key with a free numeric suffix if taken)' }),
+        param: Flags.string({ description: 'Parameter override: N.path=JSON, 1-based rule number; path=JSON for a single-rule goal', multiple: true }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyCreate);
+        const target = this.policyTarget(flags);
+        const { request } = target;
+        const catalogue = await request('/check');
+        const goal = catalogue.goals?.find(item => item.id === flags.goal);
+        if (!goal)
+            this.error(`Unknown goal "${flags.goal}". Run xano policy catalogue -o json to see this instance's goals.`);
+        const keys = (await listAllPolicies(request)).map(policy => policy.key);
+        // The key is checked against the pattern this instance's catalogue serves.
+        const document = policyFromGoal(goal, keys, { key: flags.key, keyRule: catalogue.document?.key, overrides: flags.param });
+        const parsed = await this.parseSource(request, { data: document });
+        const saved = await request('', 'POST', { data: { source: parsed.source }, ...(flags.message ? { message: flags.message } : {}) });
+        if (typeof saved?.id !== 'number')
+            this.error('The platform did not return the saved policy. Check xano policy list before retrying.');
+        this.logRuleWarnings(parsed);
+        if (flags.output === 'json')
+            this.log(JSON.stringify(saved, null, 2));
+        else
+            this.log(`Created ${parsed.policy.key} (Version ${saved.version}) in ${this.where(target)}.`);
+    }
+}

package/dist/commands/policy/delete/index.d.ts

@@ -0,0 +1,19 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyDelete extends PolicyCommand {
+    static args: {
+        policy: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** `workspace push` is additive, so deleting a policy file leaves the policy in place; this removes it. */
+    run(): Promise<void>;
+}

package/dist/commands/policy/delete/index.js

@@ -0,0 +1,61 @@
+import { Args, Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { confirm } from '../../../utils/multidoc-push.js';
+import { listAllPolicies, sameKey } from '../../../utils/policy/request.js';
+export default class PolicyDelete extends PolicyCommand {
+    static args = {
+        policy: Args.string({
+            description: 'Policy key (AUTH-001) or ID to delete',
+            required: true,
+        }),
+    };
+    static description = 'Delete a policy from a branch; its Version History is kept. Deleting an active, mandatory policy also needs the workspace:policy update permission.';
+    static examples = [
+        `$ xano policy delete TMP-DX-001
+Delete policy TMP-DX-001 (ID: 922, Version 2) from workspace 3? Its Version History is kept. (y/N) y
+Deleted policy TMP-DX-001 (ID: 922) from workspace 3.
+`,
+        '$ xano policy delete 922 --force',
+        '$ xano policy delete TMP-DX-001 -w 3 --force -o json',
+    ];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        force: Flags.boolean({
+            char: 'f',
+            default: false,
+            description: '[IMPORTANT] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
+        }),
+    };
+    /** `workspace push` is additive, so deleting a policy file leaves the policy in place; this removes it. */
+    async run() {
+        const { args, flags } = await this.parse(PolicyDelete);
+        const target = this.policyTarget(flags);
+        const wanted = args.policy.trim();
+        if (!wanted)
+            this.error('Provide the policy key or ID to delete.');
+        const policies = await listAllPolicies(target.request);
+        const matched = policies.find((policy) => sameKey(policy.key, wanted))
+            ?? (/^\d+$/.test(wanted) ? policies.find((policy) => policy.id === Number(wanted)) : undefined);
+        if (!matched) {
+            const known = policies.map((policy) => policy.key).sort();
+            this.error(`No policy "${wanted}" on ${this.where(target)}.${known.length > 0 ? ` This branch has: ${known.join(', ')}.` : ' This branch has no policies.'}`);
+        }
+        if (!flags.force) {
+            // Nobody can answer the prompt: refuse rather than report a cancel as success.
+            if (!process.stdin.isTTY)
+                this.error('Non-interactive environment detected. Use --force to skip confirmation.');
+            const confirmed = await confirm(`Delete policy ${matched.key} (ID: ${matched.id}, Version ${matched.version}) from ${this.where(target)}? Its Version History is kept.`);
+            if (!confirmed) {
+                this.log('Deletion cancelled.');
+                return;
+            }
+        }
+        // The policy as listed is what the prompt named: a delete of a policy changed since is refused (`policy_stale`).
+        const staleCheck = matched.updated_at ? { last_updated_at: String(matched.updated_at) } : {};
+        await target.request(`/${matched.id}`, 'DELETE', undefined, staleCheck);
+        if (flags.output === 'json')
+            this.log(JSON.stringify({ deleted: true, id: matched.id, key: matched.key }, null, 2));
+        else
+            this.log(`Deleted policy ${matched.key} (ID: ${matched.id}) from ${this.where(target)}.`);
+    }
+}

package/dist/commands/policy/evaluate/index.d.ts

@@ -0,0 +1,32 @@
+import PolicyCommand from '../../../policy-command.js';
+/** One rule's clear objects in a trial's answer: the first ones and how many there are. */
+type TrialClear = {
+    items?: Array<{
+        name?: string;
+    }>;
+    policy_key?: string;
+    rule_id?: string;
+    total?: number;
+};
+/**
+ * What a trial says it is, then each rule's clear objects: the objects it examined and found
+ * nothing on. A trial is never stored, so its answer is all there is to show.
+ */
+export declare function trialLines(key: string, clear: TrialClear[] | undefined): string[];
+export default class PolicyEvaluate extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        policy: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'run-detail': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        summary: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+export {};

package/dist/commands/policy/evaluate/index.js

@@ -0,0 +1,71 @@
+import { Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { evaluationEvidence, notStoredLine, policyCheckWarning, policyExitCode, policySummary, } from '../../../utils/policy/feedback.js';
+/** How many clear objects a trial names per rule; the rest are counted. */
+const TRIAL_CLEAR_NAMES = 5;
+/**
+ * What a trial says it is, then each rule's clear objects: the objects it examined and found
+ * nothing on. A trial is never stored, so its answer is all there is to show.
+ */
+export function trialLines(key, clear) {
+    const lines = [`Trial of ${key}: this policy alone, evaluated without storing a run. It is not a report and gates nothing.`];
+    if (!clear?.length)
+        return lines;
+    lines.push('Clear objects (examined, nothing found):');
+    for (const rule of clear) {
+        const names = (rule.items ?? []).map((item) => item.name ?? '').filter(Boolean).slice(0, TRIAL_CLEAR_NAMES);
+        const total = rule.total ?? 0;
+        const more = total > names.length ? `${names.length > 0 ? ', ' : ''}${total - names.length} more` : '';
+        lines.push(`  ${rule.rule_id ?? ''}  ${total}${names.length > 0 || more ? `  ${names.join(', ')}${more}` : ''}`);
+    }
+    return lines;
+}
+export default class PolicyEvaluate extends PolicyCommand {
+    static description = 'Evaluate active branch policies and report their findings; blocking findings exit 2. With --policy, try one policy alone, whatever its state, without storing a run';
+    static examples = ['$ xano policy evaluate -o json', '$ xano policy evaluate --run-detail', '$ xano policy evaluate --summary -o json', '$ xano policy evaluate --policy AUTH-001'];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        policy: Flags.string({
+            description: 'Try this one policy (its key) alone, whatever its state: nothing is stored, and the answer lists each rule\'s clear objects',
+        }),
+        'run-detail': Flags.boolean({
+            default: false,
+            description: 'Also print what this run recorded: each policy description and the settings each rule ran with',
+        }),
+        summary: Flags.boolean({
+            default: false,
+            description: 'Answer the run summary and its first 50 findings instead of the whole run; `xano policy runs <id>` pages through the rest',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyEvaluate);
+        if (flags.policy !== undefined && !flags.policy.trim())
+            this.error('--policy must name a policy key.');
+        const { request } = this.policyTarget(flags);
+        // The evaluation answers with its run, so the run's own snapshot names any unnamed rule. The
+        // summary answer carries the same snapshot and results, and only the first findings.
+        const body = { ...(flags.summary ? { answer: 'summary' } : {}), ...(flags.policy ? { policy: flags.policy } : {}) };
+        const result = (await request('/evaluate', 'POST', Object.keys(body).length > 0 ? body : undefined));
+        if (flags.output === 'json')
+            this.log(JSON.stringify(result, null, 2));
+        else {
+            for (const line of policySummary(result.policy_check, evaluationEvidence(result)))
+                this.log(line);
+            // A trial is never stored by design; the "cannot record runs" note is about credentials.
+            const notStored = flags.policy ? null : notStoredLine(result);
+            if (notStored)
+                this.log(notStored);
+            if (flags.policy)
+                for (const line of trialLines(flags.policy, result.clear))
+                    this.log(line);
+            if (flags['run-detail'])
+                this.logRunDetail(result);
+        }
+        const warning = policyCheckWarning(result.policy_check);
+        if (warning)
+            this.warn(warning);
+        const code = policyExitCode(result.policy_check);
+        if (code)
+            process.exitCode = code;
+    }
+}

package/dist/commands/policy/list/index.d.ts

@@ -0,0 +1,14 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyList extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/list/index.js

@@ -0,0 +1,21 @@
+import PolicyCommand from '../../../policy-command.js';
+import { listItems } from '../../../utils/policy/request.js';
+export default class PolicyList extends PolicyCommand {
+    static description = 'List workspace policies and their descriptions';
+    static examples = ['$ xano policy list -o json'];
+    static flags = { ...PolicyCommand.policyFlags };
+    async run() {
+        const { flags } = await this.parse(PolicyList);
+        const { request } = this.policyTarget(flags);
+        const result = await request();
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const policies = listItems(result);
+        if (policies.length === 0)
+            this.log('No policies found.');
+        for (const policy of policies)
+            this.log(`${policy.key}  ${policy.active ? `Active, ${policy.enforcement === 'mandatory' ? 'Mandatory' : 'Advisory'}` : 'Inactive'}  ${policy.title ?? ''} (ID: ${policy.id}, Version ${policy.version})`);
+    }
+}

package/dist/commands/policy/parse/index.d.ts

@@ -0,0 +1,19 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyParse extends PolicyCommand {
+    static args: {
+        file: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}