@xano/cli 1.3.1-beta.0 → 1.3.1

package/dist/commands/tenant/deploy_release/index.js

@@ -1,7 +1,5 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
-import { deployedGateLine, fetchPolicyGate, gateExitCode, gateLines, gateOverrideHint, gateRefusal, gateRefusalOutput, quoted, } from '../../../utils/policy/gate.js';
-import { policyPermissionGuidance } from '../../../utils/policy/permission.js';
 export default class TenantDeployRelease extends BaseCommand {
     static args = {
         tenant_name: Args.string({
@@ -9,26 +7,15 @@ export default class TenantDeployRelease extends BaseCommand {
             required: true,
         }),
     };
-    static description = "[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant. A deploy is gated on the release's own policy check: any blocking finding in the release refuses it (exit 2) unless --override-reason is given, whatever the tenant runs today, so the release gets the same verdict on every tenant. --check previews that verdict without deploying.";
+    static description = '[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant.';
     static examples = [
         `$ xano tenant deploy_release t1234-abcd-xyz1 --release v1.0
 Deployed release "v1.0" to tenant: My Tenant (my-tenant)
 `,
         `$ xano tenant deploy_release t1234-abcd-xyz1 --release v1.0 -o json`,
-        `$ xano tenant deploy_release prod --release v1.2 --check
-Checked release "v1.2" for tenant "prod"; nothing was deployed.
-Policy gate: blocked
-  Deploy blocked: this release has 1 blocking policy finding.
-`,
-        `$ xano tenant deploy_release prod --release v1.2 --override-reason "Hotfix; AUTH-001 finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
-        check: Flags.boolean({
-            default: false,
-            description: "Preview the release's policy gate on this tenant without deploying; exits 2 when the deploy would be refused",
-            exclusive: ['override-reason'],
-        }),
         output: Flags.string({
             char: 'o',
             default: 'summary',
@@ -36,10 +23,6 @@ Policy gate: blocked
             options: ['summary', 'json'],
             required: false,
         }),
-        'override-reason': Flags.string({
-            description: 'Deploy past a blocking policy gate, recording this reason (needs the workspace:policy update permission; audited)',
-            exclusive: ['check'],
-        }),
         release: Flags.string({
             char: 'r',
             description: 'Release name to deploy',
@@ -51,14 +34,6 @@ Policy gate: blocked
             required: false,
         }),
     };
-    /** Set once the policy gate refuses the deploy, the one failure that exits 2. */
-    refusedByPolicyGate = false;
-    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
-    async catch(error) {
-        if (this.refusedByPolicyGate)
-            return super.catch(error);
-        return this.catchAsOperational(error);
-    }
     async run() {
         const { args, flags } = await this.parse(TenantDeployRelease);
         const { profile } = this.resolveProfile(flags);
@@ -68,46 +43,12 @@ Policy gate: blocked
         }
         const releaseName = flags.release;
         const tenantName = args.tenant_name;
-        if (flags.check) {
-            await this.checkPolicyGate({ flags, profile, releaseName, tenantName, workspaceId });
-            return;
-        }
-        const overrideReason = flags['override-reason']?.trim();
-        if (flags['override-reason'] !== undefined && !overrideReason) {
-            this.error('--override-reason needs a reason: say why this deploy may proceed past the policy gate.');
-        }
-        // Pre-flight: the "approval required" error must always be shown before any
-        // permission/RBAC error. The backend's own deploy route checks RBAC first
-        // and the approval gate second (inside mvp:tenant_deploy_release), so a
-        // caller who lacks deploy permission would otherwise never learn a request
-        // is what's actually needed. Checking here first, with an endpoint that
-        // only needs read scope, guarantees the right error is shown regardless of
-        // whether the caller can deploy at all.
-        const requiresApproval = await this.tenantRequiresApproval(profile, workspaceId, tenantName, flags.verbose);
-        if (requiresApproval) {
-            const hasApprovedRequest = await this.hasApprovedDeployRequest({
-                profile,
-                releaseName,
-                tenantName,
-                verbose: flags.verbose,
-                workspaceId,
-            });
-            if (!hasApprovedRequest) {
-                this.error(`Tenant "${tenantName}" requires an approved deploy request before "${releaseName}" can be deployed.\n` +
-                    `Run: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`);
-            }
-        }
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${tenantName}/deploy`;
         this.warn('This may take a few minutes. Please be patient.');
         const startTime = Date.now();
-        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
-        let refused = null;
         try {
             const response = await this.verboseFetch(apiUrl, {
-                body: JSON.stringify({
-                    release_name: releaseName,
-                    ...(overrideReason ? { override_policy: true, override_reason: overrideReason } : {}),
-                }),
+                body: JSON.stringify({ release_name: releaseName }),
                 headers: {
                     accept: 'application/json',
                     Authorization: `Bearer ${profile.access_token}`,
@@ -116,22 +57,8 @@ Policy gate: blocked
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                refused = await gateRefusal(response);
-                if (refused) {
-                    const override = `xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`;
-                    this.refuseByPolicyGate(refused, flags, override);
-                }
-                let message = await this.parseApiError(response, 'API request failed');
-                // Only reached once the pre-flight above has already confirmed the
-                // approval gate is satisfied or not applicable — so a permission error
-                // here is genuinely about RBAC, not about a missing approval. If the
-                // tenant supports deploy requests, mention that path as an alternative
-                // to direct deploy, since opening a request doesn't require deploy
-                // permission.
-                if ((response.status === 401 || response.status === 403) && requiresApproval) {
-                    message += `\n\nYou don't have permission to deploy to this tenant directly, but it supports deploy requests: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`;
-                }
-                this.error(message);
+                const errorText = await response.text();
+                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
             const tenant = (await response.json());
             if (flags.output === 'json') {
@@ -144,15 +71,10 @@ Policy gate: blocked
                     this.log(`  State: ${tenant.state}`);
                 if (tenant.release?.name)
                     this.log(`  Release: ${tenant.release.name}`);
-                if (tenant.policy_gate?.status)
-                    this.log(`  ${deployedGateLine(tenant.policy_gate)}`);
                 this.log(`  Time: ${elapsed}s`);
             }
-            this.warnPoliciesSkipped(tenant);
         }
         catch (error) {
-            if (refused)
-                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to deploy to tenant: ${error.message}`);
             }
@@ -161,108 +83,4 @@ Policy gate: blocked
             }
         }
     }
-    /**
-     * `--check`: what the policy gate would decide for this release on this tenant, without deploying.
-     * Exits 2 when the deploy would be refused; a preview the platform cannot answer exits 1.
-     */
-    async checkPolicyGate(opts) {
-        const { flags, profile, releaseName, tenantName, workspaceId } = opts;
-        const result = await fetchPolicyGate({ verboseFetch: (...args) => this.verboseFetch(...args) }, { profile, release: releaseName, tenant: tenantName, verbose: flags.verbose, workspace: workspaceId });
-        if ('unavailable' in result) {
-            const { message, payload, status } = result.unavailable;
-            this.error(`Policy gate preview failed (${status}): ${message}${policyPermissionGuidance(status, payload)}`);
-        }
-        const { answer } = result;
-        const exit = gateExitCode(answer);
-        if (flags.output === 'json') {
-            this.log(JSON.stringify(answer, null, 2));
-        }
-        else {
-            this.log(`Checked release "${releaseName}" for tenant "${tenantName}"; nothing was deployed.`);
-            for (const line of gateLines(answer))
-                this.log(line);
-            if (exit) {
-                this.log(answer.can_override
-                    ? `To deploy past the gate: xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`
-                    : 'A deploy is refused unless someone with the workspace:policy update permission overrides the gate.');
-            }
-        }
-        if (exit)
-            process.exitCode = exit;
-    }
-    /**
-     * Does an approved tenant_deploy_request already exist for this (tenant, release)
-     * pair? The list endpoint has no release filter, so this fetches approved
-     * requests for the tenant and filters client-side by the resolved release name.
-     */
-    async hasApprovedDeployRequest(opts) {
-        const { profile, releaseName, tenantName, verbose, workspaceId } = opts;
-        const params = new URLSearchParams({ per_page: '100', status: 'approved', tenant_name: tenantName });
-        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request?${params}`;
-        const response = await this.verboseFetch(apiUrl, {
-            headers: {
-                accept: 'application/json',
-                Authorization: `Bearer ${profile.access_token}`,
-            },
-            method: 'GET',
-        }, verbose, profile.access_token);
-        if (!response.ok) {
-            // A read-scope failure here means something is more broadly wrong (e.g.
-            // no workspace access at all) — surface it rather than silently treating
-            // it as "no approval found", which would misreport as approval-required.
-            const message = await this.parseApiError(response, 'Failed to check for an approved deploy request');
-            this.error(message);
-        }
-        const data = (await response.json());
-        const items = Array.isArray(data) ? data : (data.items ?? []);
-        return items.some((item) => item.status === 'approved' && item._release?.name === releaseName);
-    }
-    /** A deploy the policy gate refused: its verdict, then the refusal and how to proceed, exiting 2. */
-    refuseByPolicyGate(refused, flags, override) {
-        for (const line of gateRefusalOutput(refused, flags.output === 'json'))
-            this.log(line);
-        this.refusedByPolicyGate = true;
-        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
-    }
-    /**
-     * Does this tenant have the deploy approval gate enabled?
-     *
-     * Returns false if the tenant has `allow_quick_deploy` set — that flag lets a
-     * tenant skip the approval gate entirely for quick deploys, regardless of
-     * `required_reviewers`.
-     *
-     * Deliberately uses `tenant list` rather than `tenant get`: the single-tenant
-     * GET route's output whitelist (tenant-detail.yaml) omits `deploy_settings`
-     * (which holds `required_reviewers`, `allow_deploy_bypass`, and
-     * `allow_quick_deploy`) even though the list route's output includes it
-     * — confirmed live against a running instance. Filed as a backend bug; this
-     * is the workaround until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
-     */
-    async tenantRequiresApproval(profile, workspaceId, tenantName, verbose) {
-        const params = new URLSearchParams({ per_page: '100' });
-        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${params}`;
-        const response = await this.verboseFetch(apiUrl, {
-            headers: {
-                accept: 'application/json',
-                Authorization: `Bearer ${profile.access_token}`,
-            },
-            method: 'GET',
-        }, verbose, profile.access_token);
-        if (!response.ok) {
-            const message = await this.parseApiError(response, 'Failed to look up tenant');
-            this.error(message);
-        }
-        const data = (await response.json());
-        const items = Array.isArray(data) ? data : (data.items ?? []);
-        const tenant = items.find((item) => item.name === tenantName);
-        if (tenant?.deploy_settings?.allow_quick_deploy)
-            return false;
-        return (tenant?.deploy_settings?.required_reviewers ?? 0) > 0;
-    }
-    /** A release policy the tenant's import could not land (its key is held by another policy) is never dropped silently. */
-    warnPoliciesSkipped(tenant) {
-        const message = tenant.policies_skipped?.message;
-        if (message)
-            this.warn(message);
-    }
 }

package/dist/commands/tenant/edit/index.d.ts

@@ -6,7 +6,6 @@ export default class TenantEdit extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
-        allow_quick_deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         display: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -14,7 +13,6 @@ export default class TenantEdit extends BaseCommand {
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         proxy: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         rbac: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        required_reviewers: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         tasks: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/tenant/edit/index.js

@@ -13,15 +13,9 @@ export default class TenantEdit extends BaseCommand {
 Updated tenant: New Name (my-tenant) - ID: 42
 `,
         `$ xano tenant edit t1234-abcd-xyz1 --no-tasks --no-ingress -o json`,
-        `$ xano tenant edit t1234-abcd-xyz1 --required_reviewers 1`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
-        allow_quick_deploy: Flags.boolean({
-            allowNo: true,
-            description: 'Allow this tenant to skip the deploy approval gate entirely for quick deploys, regardless of --required_reviewers.',
-            required: false,
-        }),
         description: Flags.string({
             char: 'd',
             description: 'New description',
@@ -56,10 +50,6 @@ Updated tenant: New Name (my-tenant) - ID: 42
             description: '[CRITICAL] NEVER disable RBAC without explicit user confirmation; this removes role-based access controls on the tenant. Enables/disables RBAC.',
             required: false,
         }),
-        required_reviewers: Flags.integer({
-            description: 'When greater than 0, that many distinct reviewers must approve a tenant_deploy_request before a release may be deployed to this tenant. 0 means not gated.',
-            required: false,
-        }),
         tasks: Flags.boolean({
             allowNo: true,
             description: '[IMPORTANT] ALWAYS confirm with the user before disabling background tasks; this stops scheduled jobs on the tenant. Enables/disables background tasks.',
@@ -86,17 +76,8 @@ Updated tenant: New Name (my-tenant) - ID: 42
             'Content-Type': 'application/json',
         };
         try {
-            // Fetch current tenant state (PUT requires all fields). Deliberately uses
-            // `tenant list` rather than `tenant get`: the single-tenant GET route's
-            // output whitelist (tenant-detail.yaml) omits `deploy_settings` (which
-            // holds `required_reviewers`, `allow_deploy_bypass`, and
-            // `allow_quick_deploy`) even though the list route's output includes it
-            // — confirmed live against a running instance. Using GET here would
-            // silently reset those fields to their defaults on every edit that doesn't
-            // explicitly pass them. Filed as a backend bug; this is the workaround
-            // until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
-            const listParams = new URLSearchParams({ per_page: '100' });
-            const getResponse = await this.verboseFetch(`${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${listParams}`, {
+            // Fetch current tenant state (PUT requires all fields)
+            const getResponse = await this.verboseFetch(baseUrl, {
                 headers: {
                     'accept': 'application/json',
                     'Authorization': `Bearer ${profile.access_token}`,
@@ -107,25 +88,9 @@ Updated tenant: New Name (my-tenant) - ID: 42
                 const errorText = await getResponse.text();
                 this.error(`Failed to fetch tenant: ${getResponse.status} ${getResponse.statusText}\n${errorText}`);
             }
-            const listData = (await getResponse.json());
-            const listItems = Array.isArray(listData) ? listData : (listData.items ?? []);
-            const current = listItems.find((item) => item.name === tenantName);
-            if (!current) {
-                this.error(`Tenant "${tenantName}" not found`);
-            }
-            // Merge in user-provided values. allow_deploy_bypass has no edit flag (it's
-            // fixed at `tenant create` time), but the PUT still requires the full body,
-            // so its current value is preserved here rather than reset.
+            const current = await getResponse.json();
+            // Merge in user-provided values
             const body = {
-                deploy_settings: {
-                    allow_deploy_bypass: current.deploy_settings?.allow_deploy_bypass ?? false,
-                    allow_quick_deploy: flags.allow_quick_deploy === undefined
-                        ? (current.deploy_settings?.allow_quick_deploy ?? false)
-                        : flags.allow_quick_deploy,
-                    required_reviewers: flags.required_reviewers === undefined
-                        ? (current.deploy_settings?.required_reviewers ?? 0)
-                        : flags.required_reviewers,
-                },
                 description: flags.description === undefined ? (current.description ?? '') : flags.description,
                 display: flags.display === undefined ? (current.display ?? current.name) : flags.display,
                 domain: flags.domain === undefined ? (current.domain ?? '') : flags.domain,

package/dist/commands/workspace/pull/index.d.ts

@@ -14,14 +14,4 @@ export default class Pull extends BaseCommand {
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
-    /**
-     * Policy keys are unique on the server without regard to case, but an older export or a local file
-     * can still differ only in case, and file names are not case-sensitive on every checkout. The
-     * policies whose file name differs only in case from another exported policy, or from a local file
-     * it would overwrite, are left out with a warning; everything else is written. Local policy files
-     * absent from the export are kept. They are reported as stale only when this credential reads the
-     * branch's policies, because an export leaves out the policies its credential cannot read, and
-     * every policy while the Policies feature is off.
-     */
-    private policyClashes;
 }

package/dist/commands/workspace/pull/index.js

@@ -3,9 +3,8 @@ import snakeCase from 'lodash.snakecase';
 import * as fs from 'node:fs';
 import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { buildApiGroupFolderResolver, buildChannelServerResolver, parseDocument, policyBaseName, resolveDocumentPath, } from '../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, parseDocument, resolveDocumentPath, } from '../../../utils/document-parser.js';
 import { fetchKnowledge, writeKnowledge } from '../../../utils/knowledge-sync.js';
-import { policyListing } from '../../../utils/policy/request.js';
 export default class Pull extends BaseCommand {
     static description = 'Pull a workspace multidoc from the Xano Metadata API and split into individual files';
     static examples = [
@@ -28,7 +27,7 @@ Pulled 58 documents
         ...BaseCommand.baseFlags,
         branch: Flags.string({
             char: 'b',
-            description: "Branch name (defaults to profile branch or live; -b '' selects live)",
+            description: 'Branch name (optional if set in profile, defaults to live)',
             required: false,
         }),
         directory: Flags.string({
@@ -74,8 +73,8 @@ Pulled 58 documents
                 `  1. Provide it as a flag: xano workspace pull -w <workspace_id>\n` +
                 `  2. Set it in your profile using: xano profile:edit ${profileName} -w <workspace_id>`);
         }
-        // Determine branch from flag or profile; `-b ''` selects live whatever the profile's branch, as in push.
-        const branch = flags.branch ?? profile.branch ?? '';
+        // Determine branch from flag or profile
+        const branch = flags.branch || profile.branch || '';
         // Build query parameters
         const queryParams = new URLSearchParams({
             branch,
@@ -124,13 +123,12 @@ Pulled 58 documents
                 documents.push(parsed);
             }
         }
-        // Resolve the output directory
-        const outputDir = path.resolve(flags.directory);
-        const clashing = await this.policyClashes(documents, outputDir, () => policyListing({ logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { branch, profile, verbose: flags.verbose, workspace: workspaceId }));
         if (documents.length === 0) {
             this.log('No documents found in response');
             return;
         }
+        // Resolve the output directory
+        const outputDir = path.resolve(flags.directory);
         // Create the output directory if it doesn't exist
         fs.mkdirSync(outputDir, { recursive: true });
         // Resolve api_group names to unique folder names, disambiguating collisions
@@ -142,7 +140,7 @@ Pulled 58 documents
         // Track filenames per type to handle duplicates
         const filenameCounters = new Map();
         let writtenCount = 0;
-        for (const doc of documents.filter((document) => !clashing.has(document))) {
+        for (const doc of documents) {
             const { baseName, typeDir } = resolveDocumentPath(doc, outputDir, {
                 getApiGroupFolder,
                 getChannelServer,
@@ -175,66 +173,5 @@ Pulled 58 documents
         if (knowledgeCount > 0)
             parts.push(`${knowledgeCount} knowledge file${knowledgeCount === 1 ? '' : 's'}`);
         this.log(`Pulled ${parts.join(' + ')} to ${flags.directory}`);
-        // Policy files state the rules; the skill the instance generates tells an agent how to follow them.
-        // Only a pull that carried policy files says so: an instance with the Policies feature off exports
-        // none, and its skill route answers 403.
-        if (documents.some((doc) => doc.type === 'policy')) {
-            this.log('Run `xano skills pull` to install the policies skill for your coding agent.');
-        }
-    }
-    /**
-     * Policy keys are unique on the server without regard to case, but an older export or a local file
-     * can still differ only in case, and file names are not case-sensitive on every checkout. The
-     * policies whose file name differs only in case from another exported policy, or from a local file
-     * it would overwrite, are left out with a warning; everything else is written. Local policy files
-     * absent from the export are kept. They are reported as stale only when this credential reads the
-     * branch's policies, because an export leaves out the policies its credential cannot read, and
-     * every policy while the Policies feature is off.
-     */
-    async policyClashes(documents, outputDir, readsPolicies) {
-        const exported = new Map();
-        for (const doc of documents.filter(doc => doc.type === 'policy')) {
-            const filename = `${policyBaseName(doc.name)}.xs`;
-            exported.set(filename.toLowerCase(), [...(exported.get(filename.toLowerCase()) ?? []), filename]);
-        }
-        const clashes = new Map();
-        for (const [normalized, names] of exported) {
-            if (names.length > 1)
-                clashes.set(normalized, names.map(name => `policies/${name}`).join(' and '));
-        }
-        const policyDir = path.join(outputDir, 'policies');
-        const localFiles = fs.existsSync(policyDir)
-            ? fs.readdirSync(policyDir, { withFileTypes: true })
-                .filter(entry => entry.isFile() && entry.name.toLowerCase().endsWith('.xs'))
-                .map(entry => entry.name)
-                .sort()
-            : [];
-        const stale = [];
-        for (const filename of localFiles) {
-            const names = exported.get(filename.toLowerCase());
-            if (!names)
-                stale.push(`policies/${filename}`);
-            else if (!names.includes(filename) && !clashes.has(filename.toLowerCase())) {
-                clashes.set(filename.toLowerCase(), `policies/${names[0]} (local policies/${filename})`);
-            }
-        }
-        if (clashes.size > 0) {
-            this.warn(`Policy files that differ only in case are left out of this pull; everything else is written:\n  ${[...clashes.values()].join('\n  ')}\n` +
-                'Rename one of the policies, or move the local file aside, then pull again.');
-        }
-        if (stale.length > 0) {
-            // An export that carries a policy was made by a credential that reads them.
-            const listing = exported.size > 0 ? 'listed' : await readsPolicies();
-            if (listing === 'listed') {
-                this.warn(`Stale local policy files are absent from this export and were kept:\n  ${stale.join('\n  ')}\nReview them before pushing; a push can publish these policies again.`);
-            }
-            else if (listing === 'feature_off') {
-                this.log('Local policy files were kept: Policies are not enabled on this instance, so the export carries none.');
-            }
-            else {
-                this.log(`Local policy files were kept: this credential cannot list this workspace's policies, and the export carries none.`);
-            }
-        }
-        return new Set(documents.filter(doc => doc.type === 'policy' && clashes.has(`${doc.name}.xs`.toLowerCase())));
     }
 }

package/dist/commands/workspace/push/index.d.ts

@@ -12,9 +12,6 @@ export default class Push extends BaseCommand {
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         guids: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         include: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         records: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         sync: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         transaction: import("@oclif/core/interfaces").BooleanFlag<boolean>;
@@ -24,21 +21,5 @@ export default class Push extends BaseCommand {
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
     run(): Promise<void>;
-    /**
-     * A failure after the import landed. The import stands, so its policy feedback is reported as for
-     * any push and a blocking finding still exits 2; otherwise the failure exits 1. Under `-o json`
-     * stdout holds the import's document with the failure as `error`.
-     */
-    private catchAfterImport;
-    /**
-     * What happened to the policy documents, then the policy check the import answered with. When the
-     * platform left the policy files out, its notice says so instead of a count of what was sent.
-     */
-    private reportPolicyFeedback;
 }