@xano/cli 1.3.1-beta.0 → 1.3.1

package/dist/commands/branch/set_live/index.js

@@ -1,7 +1,5 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
-import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateOverrideHint, gateRefusal, liveGateLines, quoted, weakeningRefusal, } from '../../../utils/policy/gate.js';
-import { policyWeakeningGuidance } from '../../../utils/policy/permission.js';
 export default class BranchSetLive extends BaseCommand {
     static args = {
         branch_label: Args.string({
@@ -9,7 +7,7 @@ export default class BranchSetLive extends BaseCommand {
             required: true,
         }),
     };
-    static description = '[IMPORTANT] ALWAYS confirm with the user before changing the live branch. Sets a branch as the live (active) branch for API requests. The set-live policy gate checks the branch against its own policies, which live will have once it is set live: when blocking findings refuse it, the command exits 2 unless --policy-override gives a reason. A branch that weakens a mandatory policy of the live branch needs workspace:policy update; without it the command exits 1.';
+    static description = '[IMPORTANT] ALWAYS confirm with the user before changing the live branch. Sets a branch as the live (active) branch for API requests.';
     static examples = [
         `$ xano branch set-live staging
 Are you sure you want to set 'staging' as the live branch? (y/N) y
@@ -26,7 +24,6 @@ Branch 'v1' is now live
   "live": true
 }
 `,
-        `$ xano branch set_live rollback --force --policy-override "Rollback approved; finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -43,27 +40,14 @@ Branch 'v1' is now live
             options: ['summary', 'json'],
             required: false,
         }),
-        'policy-override': Flags.string({ description: 'Set the branch live past a blocking set-live policy gate with an audited reason (requires workspace:policy update)' }),
         workspace: Flags.integer({
             char: 'w',
             description: 'Workspace ID (uses profile workspace if not provided)',
             required: false,
         }),
     };
-    /** Set once the platform refuses for a weakened mandatory policy: already explained, it exits 1 as it is. */
-    refusedByPermission = false;
-    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
-    refusedByPolicyGate = false;
-    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
-    async catch(error) {
-        if (this.refusedByPolicyGate)
-            return super.catch(error);
-        return this.catchAsOperational(error);
-    }
     async run() {
         const { args, flags } = await this.parse(BranchSetLive);
-        if (blankPolicyOverride(flags['policy-override']))
-            this.error(BLANK_POLICY_OVERRIDE);
         const { profile } = this.resolveProfile(flags);
         // Get workspace ID from flag or profile
         const workspaceId = flags.workspace || profile.workspace;
@@ -82,26 +66,16 @@ Branch 'v1' is now live
         }
         // Construct the API URL
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/branch/${encodeURIComponent(branchLabel)}/live`;
-        // A reason from someone with workspace:policy update sets the branch live past a blocking gate.
-        const overrideReason = flags['policy-override']?.trim();
         // Set branch as live via the API
         try {
             const response = await this.verboseFetch(apiUrl, {
-                ...(overrideReason ? { body: JSON.stringify({ override_reason: overrideReason }) } : {}),
                 headers: {
                     'accept': 'application/json',
                     'Authorization': `Bearer ${profile.access_token}`,
-                    ...(overrideReason ? { 'Content-Type': 'application/json' } : {}),
                 },
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                const refused = await gateRefusal(response);
-                if (refused)
-                    this.refuseSetLive(refused, flags, branchLabel);
-                const weakening = await weakeningRefusal(response);
-                if (weakening)
-                    this.refuseWeakening(weakening, flags, branchLabel);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -115,8 +89,6 @@ Branch 'v1' is now live
             }
         }
         catch (error) {
-            if (this.refusedByPolicyGate || this.refusedByPermission)
-                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to set branch as live: ${error.message}`);
             }
@@ -139,35 +111,4 @@ Branch 'v1' is now live
             });
         });
     }
-    /**
-     * The set-live gate refused: the verdict on stdout (under `-o json`, `{set_live: false, message,
-     * policy_gate}`), then the platform's message and how to proceed, exiting 2.
-     */
-    refuseSetLive(refused, flags, branchLabel) {
-        if (flags.output === 'json') {
-            this.log(JSON.stringify({ message: refused.message, policy_gate: refused.answer, set_live: false }, null, 2));
-        }
-        else {
-            for (const line of liveGateLines(refused.answer, 'branch'))
-                this.log(line);
-        }
-        const workspace = flags.workspace ? ` -w ${flags.workspace}` : '';
-        const hint = gateOverrideHint(refused.answer, `xano branch set_live ${quoted(branchLabel)}${workspace} --policy-override "<why>"`);
-        this.refusedByPolicyGate = true;
-        this.error(`${refused.message}${hint}`, { exit: 2 });
-    }
-    /**
-     * The branch weakens a mandatory policy of the live branch (or lacks one), and the credential lacks
-     * `workspace:policy` update. That is a permission refusal, not a blocking finding: it exits 1 (under
-     * `-o json` as `{error}`) with the platform's sentence and how to go on. The live branch is unchanged.
-     */
-    refuseWeakening(refused, flags, branchLabel) {
-        const workspace = flags.workspace ? ` -w ${flags.workspace}` : '';
-        this.refusedByPermission = true;
-        const again = `xano branch set_live ${quoted(branchLabel)}${workspace}`;
-        const way = refused.payload.unavailable === true
-            ? `The check may read them next time: ${again}`
-            : `To set it live yourself, give ${quoted(branchLabel)} the live branch's version of those policies, then run: ${again}`;
-        this.error(`${refused.message}${policyWeakeningGuidance(refused.payload, [way], true)}`);
-    }
 }

package/dist/commands/ephemeral/push/index.js

@@ -4,7 +4,6 @@ import { resolve } from 'node:path';
 import BaseCommand from '../../../base-command.js';
 import { isAwaited, waitForMicroservices, } from '../../../utils/microservice-wait.js';
 import { executePush } from '../../../utils/multidoc-push.js';
-import { policiesSkippedNotice } from '../../../utils/policy/feedback.js';
 /** Status glyph for one microservice row in the `--wait` progress block. */
 const icon = (e) => {
     if (!isAwaited(e))
@@ -169,17 +168,13 @@ Skip preview and push immediately
             truncate: flags.truncate,
             verbose: flags.verbose,
         };
-        const result = await executePush({
+        await executePush({
             accessToken: profile.access_token,
             branch: '',
             command: this,
             inputDir,
             verboseFetch: this.verboseFetch.bind(this),
         }, target, pushFlags);
-        // When the platform leaves policy files out, it says so once.
-        const skipped = policiesSkippedNotice(result.response ?? result.preview);
-        if (skipped)
-            this.warn(skipped);
         // --wait: after a real push, poll the tenant's live microservice status until
         // every auto-deployed microservice (tenant_deploy="auto") is ready or the
         // wait times out. Skipped on --dry-run (nothing was deployed).

package/dist/commands/function/create/index.d.ts

@@ -7,28 +7,13 @@ export default class FunctionCreate extends BaseCommand {
         edit: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
-    /** Set once the publish policy gate refuses, the one failure that exits 2. */
-    private refusedByPolicyGate;
-    /** Exit 2 is the publish gate's refusal; every other failure, flag errors included, exits 1. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
     run(): Promise<void>;
     private editFile;
     private readStdin;
-    /**
-     * The live-branch publish gate refused the new function: the verdict on stdout (under `-o json`,
-     * `{created: false, message, policy_gate}`), then the platform's message and how to proceed,
-     * exiting 2.
-     */
-    private refusePublish;
 }

package/dist/commands/function/create/index.js

@@ -4,7 +4,6 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateRefusal, publishRefusal, quoted } from '../../../utils/policy/gate.js';
 export default class FunctionCreate extends BaseCommand {
     static args = {};
     static description = 'Create a new function in a workspace';
@@ -37,7 +36,6 @@ Name: my_function
   ...
 }
 `,
-        `$ xano function:create -f function.xs --policy-override "Exception approved; finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -61,7 +59,6 @@ Name: my_function
             options: ['summary', 'json'],
             required: false,
         }),
-        'policy-override': Flags.string({ description: 'Create the function past a blocking live-branch publish policy gate with an audited reason (requires workspace:policy update)' }),
         stdin: Flags.boolean({
             char: 's',
             default: false,
@@ -75,18 +72,8 @@ Name: my_function
             required: false,
         }),
     };
-    /** Set once the publish policy gate refuses, the one failure that exits 2. */
-    refusedByPolicyGate = false;
-    /** Exit 2 is the publish gate's refusal; every other failure, flag errors included, exits 1. */
-    async catch(error) {
-        if (this.refusedByPolicyGate)
-            return super.catch(error);
-        return this.catchAsOperational(error);
-    }
     async run() {
         const { flags } = await this.parse(FunctionCreate);
-        if (blankPolicyOverride(flags['policy-override']))
-            this.error(BLANK_POLICY_OVERRIDE);
         const { profile, profileName } = this.resolveProfile(flags);
         // Determine workspace_id from flag or profile
         let workspaceId;
@@ -146,10 +133,6 @@ Name: my_function
         const queryParams = new URLSearchParams({
             include_xanoscript: 'false',
         });
-        // A reason from someone with workspace:policy update saves past a blocking publish gate.
-        const overrideReason = flags['policy-override']?.trim();
-        if (overrideReason)
-            queryParams.set('override_reason', overrideReason);
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function?${queryParams.toString()}`;
         // Create function via API
         try {
@@ -163,9 +146,6 @@ Name: my_function
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                const refused = await gateRefusal(response);
-                if (refused)
-                    this.refusePublish(refused, flags);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -186,8 +166,6 @@ Name: my_function
             }
         }
         catch (error) {
-            if (this.refusedByPolicyGate)
-                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to create function: ${error.message}`);
             }
@@ -261,22 +239,4 @@ Name: my_function
             process.stdin.resume();
         });
     }
-    /**
-     * The live-branch publish gate refused the new function: the verdict on stdout (under `-o json`,
-     * `{created: false, message, policy_gate}`), then the platform's message and how to proceed,
-     * exiting 2.
-     */
-    refusePublish(refused, flags) {
-        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
-        const source = flags.file ? ` -f ${quoted(flags.file)}` : ' --stdin';
-        const { lines, message } = publishRefusal(refused, {
-            json: flags.output === 'json',
-            outcome: 'created',
-            rerun: `xano function create${workspace}${source} --policy-override "<why>"`,
-        });
-        for (const line of lines)
-            this.log(line);
-        this.refusedByPolicyGate = true;
-        this.error(message, { exit: 2 });
-    }
 }

package/dist/commands/function/edit/index.d.ts

@@ -9,7 +9,6 @@ export default class FunctionEdit extends BaseCommand {
         edit: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         publish: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -17,24 +16,10 @@ export default class FunctionEdit extends BaseCommand {
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
-    /** Set once the publish policy gate refuses, the one failure that exits 2. */
-    private refusedByPolicyGate;
-    /** Exit 2 is the publish gate's refusal; every other failure, flag errors included, exits 1. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
     run(): Promise<void>;
     private editFile;
     private editFunctionContent;
     private fetchFunctionCode;
     private promptForFunctionId;
     private readStdin;
-    /**
-     * The live-branch publish gate refused the update: the verdict on stdout (under `-o json`,
-     * `{updated: false, message, policy_gate}`), then the platform's message and how to proceed,
-     * exiting 2.
-     */
-    private refusePublish;
 }

package/dist/commands/function/edit/index.js

@@ -5,7 +5,6 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import path from 'node:path';
 import BaseCommand, { buildUserAgent } from '../../../base-command.js';
-import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateRefusal, publishRefusal, quoted } from '../../../utils/policy/gate.js';
 export default class FunctionEdit extends BaseCommand {
     static args = {
         function_id: Args.string({
@@ -60,7 +59,6 @@ Name: my_function
   ...
 }
 `,
-        `$ xano function:edit 163 -f function.xs --policy-override "Exception approved; finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -83,7 +81,6 @@ Name: my_function
             options: ['summary', 'json'],
             required: false,
         }),
-        'policy-override': Flags.string({ description: 'Publish past a blocking live-branch publish policy gate with an audited reason (requires workspace:policy update)' }),
         publish: Flags.boolean({
             default: true,
             description: 'Publish the function after editing',
@@ -102,18 +99,8 @@ Name: my_function
             required: false,
         }),
     };
-    /** Set once the publish policy gate refuses, the one failure that exits 2. */
-    refusedByPolicyGate = false;
-    /** Exit 2 is the publish gate's refusal; every other failure, flag errors included, exits 1. */
-    async catch(error) {
-        if (this.refusedByPolicyGate)
-            return super.catch(error);
-        return this.catchAsOperational(error);
-    }
     async run() {
         const { args, flags } = await this.parse(FunctionEdit);
-        if (blankPolicyOverride(flags['policy-override']))
-            this.error(BLANK_POLICY_OVERRIDE);
         const { profile, profileName } = this.resolveProfile(flags);
         // Validate flag combinations
         if (flags.edit && !flags.file) {
@@ -188,10 +175,6 @@ Name: my_function
             include_xanoscript: 'false',
             publish: flags.publish ? 'true' : 'false',
         });
-        // A reason from someone with workspace:policy update publishes past a blocking publish gate.
-        const overrideReason = flags['policy-override']?.trim();
-        if (overrideReason)
-            queryParams.set('override_reason', overrideReason);
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function/${functionId}?${queryParams.toString()}`;
         // Update function via API
         try {
@@ -205,9 +188,6 @@ Name: my_function
                 method: 'PUT',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                const refused = await gateRefusal(response);
-                if (refused)
-                    this.refusePublish(refused, flags, functionId);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -228,8 +208,6 @@ Name: my_function
             }
         }
         catch (error) {
-            if (this.refusedByPolicyGate)
-                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to update function: ${error.message}`);
             }
@@ -450,22 +428,4 @@ Name: my_function
             process.stdin.resume();
         });
     }
-    /**
-     * The live-branch publish gate refused the update: the verdict on stdout (under `-o json`,
-     * `{updated: false, message, policy_gate}`), then the platform's message and how to proceed,
-     * exiting 2.
-     */
-    refusePublish(refused, flags, functionId) {
-        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
-        const source = flags.file ? ` -f ${quoted(flags.file)}` : flags.stdin ? ' --stdin' : '';
-        const { lines, message } = publishRefusal(refused, {
-            json: flags.output === 'json',
-            outcome: 'updated',
-            rerun: `xano function edit ${quoted(functionId)}${workspace}${source} --policy-override "<why>"`,
-        });
-        for (const line of lines)
-            this.log(line);
-        this.refusedByPolicyGate = true;
-        this.error(message, { exit: 2 });
-    }
 }

package/dist/commands/function/run/index.d.ts

@@ -15,6 +15,7 @@ export default class FunctionRun extends BaseCommand {
         'no-input-check': import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        tenant: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/function/run/index.js

@@ -19,6 +19,8 @@ export default class FunctionRun extends BaseCommand {
         `$ xano function:run calcScore --branch dev --logs`,
         `$ xano function:run calcScore --datasource test
 # Runs against the 'test' data source instead of 'live'`,
+        `$ xano function:run calcScore --tenant my-tenant
+# Runs the function on the tenant instead of the workspace`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -70,6 +72,11 @@ export default class FunctionRun extends BaseCommand {
             exclusive: ['json'],
             required: false,
         }),
+        tenant: Flags.string({
+            char: 't',
+            description: 'Tenant name to run the function on (defaults to the workspace)',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'Workspace ID (optional if set in profile)',
@@ -107,8 +114,9 @@ export default class FunctionRun extends BaseCommand {
                 input = await this.promptForMissing(input, missingRequired);
             }
         }
-        // 3) Execute via the meta run endpoint.
-        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function/run`;
+        // 3) Execute via the meta run endpoint, scoped to the tenant when one is given.
+        const tenantPath = flags.tenant ? `/tenant/${encodeURIComponent(flags.tenant)}` : '';
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}${tenantPath}/function/run`;
         const body = { input, name: functionName };
         if (branch)
             body.branch = branch;

package/dist/commands/release/create/index.js

@@ -1,6 +1,5 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
-import { releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleaseCreate extends BaseCommand {
     static args = {
         name: Args.string({
@@ -12,10 +11,6 @@ export default class ReleaseCreate extends BaseCommand {
     static examples = [
         `$ xano release create "v1.0" --branch main
 Created release: v1.0 - ID: 10
-  Branch: main
-  Policy check: fail (run 1712), 2 blocking, 1 advisory findings
-    Findings: xano policy runs --release v1.0
-    Its blocking findings block a deploy to a standard or run tenant: xano tenant deploy_release <tenant> --release v1.0 --check
 `,
         `$ xano release create "v1.1-hotfix" --branch main --hotfix --description "Critical fix" -o json`,
     ];
@@ -95,8 +90,6 @@ Created release: v1.0 - ID: 10
                     this.log(`  Branch: ${release.branch}`);
                 if (release.hotfix)
                     this.log(`  Hotfix: true`);
-                for (const line of releasePolicyRunLines(release.policy_run, release.name ?? args.name))
-                    this.log(line);
             }
         }
         catch (error) {

package/dist/commands/release/deploy/index.d.ts

@@ -9,40 +9,12 @@ export default class ReleaseDeploy extends BaseCommand {
         branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         set_live: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
-    /** Set once the platform refuses set live for a weakened mandatory policy: already explained, it exits 1 as it is. */
-    private refusedByPermission;
-    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
-    private refusedByPolicyGate;
-    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
     run(): Promise<void>;
     private confirm;
-    /** The set-live verdict a successful deploy answered with --set_live (`pass`, `overridden`, ...). */
-    private logPolicyOutcome;
-    /** Stops the command when set live was refused after the branch was created: by the gate (exit 2) or for a weakened mandatory policy (exit 1). */
-    private refuseIfSetLiveRefused;
-    /**
-     * The set-live gate refused after the branch was created: the verdict, the refusal, and how to
-     * proceed, exiting 2. Under `-o json` the refusal is `{branch_created, set_live, branch, message,
-     * policy_gate}`.
-     */
-    private refuseSetLive;
-    /**
-     * Set live was refused after the branch was created because the release weakens (or lacks) a
-     * mandatory policy of the live branch, and the credential lacks `workspace:policy` update. That is a
-     * permission refusal, not a blocking finding: it exits 1 (under `-o json` as `{error}`) with the
-     * platform's sentence, which names the branch, and how to go on.
-     */
-    private refuseWeakening;
 }