@xano/cli 1.3.1-beta.1 → 1.3.1

package/dist/utils/policy/runs.js

@@ -1,101 +0,0 @@
-import { findingLine, hasNoObjects, policyResultSummary, policyRuleName, ruleKey, snapshotRules } from './findings.js';
-const RUN_COLUMNS = [6, 8, 14, 12, 9, 0];
-const runRow = (cells) => cells.map((cell, index) => cell.padEnd(RUN_COLUMNS[index])).join('').trimEnd();
-/** The retained runs, as the run list summarises them, in a table, header first. */
-export function policyRunTable(runs) {
-    return [
-        runRow(['Run', 'Status', 'Findings', 'Checked', 'Trigger', 'Started']),
-        ...runs.map((run) => runRow([
-            String(run.id),
-            run.status,
-            `${run.counts.findings} findings`,
-            `${run.objects_checked} objects`,
-            run.trigger ?? '',
-            run.started_at ?? '',
-        ])),
-    ];
-}
-/**
- * One stored run. A run records its findings, results and the enforcement each policy had;
- * `policy_check.blocking` is the gate's verdict at the time and is not stored. With `page`, the
- * run's findings are one page of them (`GET run/{id}/findings`) and its counts are the summary's.
- */
-export function policyRunSummary(run, page) {
-    const when = [run.started_at, run.finished_at].filter(Boolean).join(' → ');
-    const checked = typeof run.objects_checked === 'number' ? `  ${run.objects_checked} objects checked` : '';
-    const lines = [`Run ${run.id ?? '?'}  ${run.status ?? 'unknown'}${run.trigger ? `  ${run.trigger}` : ''}${when ? `  ${when}` : ''}${checked}`];
-    const rules = snapshotRules(run.policies ?? []);
-    const findings = run.findings ?? [];
-    if (page)
-        lines.push(...pageLines(run, page));
-    else if (findings.length > 0)
-        lines.push(`Findings (${findings.length}):`, ...findings.map(finding => findingLine(finding, rules)));
-    else
-        lines.push('No findings.');
-    lines.push(...policyResultSummary(run.results));
-    return lines;
-}
-/** The run's counts, then one page of its findings and how to read the next. */
-function pageLines(run, page) {
-    const rules = snapshotRules(run.policies ?? []);
-    const findings = run.findings ?? [];
-    const { counts } = run;
-    const lines = counts && counts.findings > 0
-        ? [`Findings: ${counts.findings} (${counts.blocking} blocking, ${counts.advisory ?? counts.findings - counts.blocking} advisory)`]
-        : [];
-    if (findings.length === 0) {
-        lines.push(page.total > 0 ? `No findings from offset ${page.offset}: ${page.total} ${page.filtered ? 'match' : 'in all'}.`
-            : (page.filtered ? 'No findings match.' : 'No findings.'));
-        return lines;
-    }
-    const next = page.offset + findings.length;
-    // A page that is not every finding says so, and how to read the rest.
-    const partial = page.offset > 0 || next < page.total;
-    lines.push(`Findings ${page.offset + 1}-${next} of ${page.total}${page.filtered ? ' matching' : ''}${partial ? ' (one page)' : ''}:`, ...findings.map(finding => findingLine(finding, rules)));
-    if (next < page.total) {
-        lines.push(`Next page: \`${page.next ?? `xano policy runs ${run.id}`} --offset ${next}\`, or --all for all ${page.total}${page.filtered ? ', with the same filters' : ''}.`);
-    }
-    return lines;
-}
-function settingValue(value) {
-    if (Array.isArray(value))
-        return `[${value.map(item => settingValue(item)).join(', ')}]`;
-    if (value !== null && typeof value === 'object')
-        return JSON.stringify(value);
-    return String(value);
-}
-/**
- * The resolved settings a check ran with, as `settings: name=value, …`, sorted by name so output
- * is stable. Values that resolved to nothing are already omitted by the platform.
- */
-export function policySettings(params) {
-    if (!params || typeof params !== 'object' || Array.isArray(params))
-        return '';
-    const entries = Object.entries(params).sort(([a], [b]) => a.localeCompare(b));
-    return entries.length === 0 ? '' : `settings: ${entries.map(([name, value]) => `${name}=${settingValue(value)}`).join(', ')}`;
-}
-/**
- * What a stored run recorded about the policies it evaluated: each policy's description as written
- * then, and each rule's name, settings and how many objects it inspected. Empty for a run that
- * evaluated no policy.
- */
-export function policyRunDetail(run) {
-    const results = new Map((run?.results ?? []).map(result => [ruleKey(result.policy_key, result.check_id), result]));
-    const body = (run?.policies ?? []).flatMap(policy => {
-        const statement = policy.statement?.trim();
-        const rules = (policy.rules ?? []).map(rule => {
-            // The name falls back to the id, which the line already carries.
-            const name = policyRuleName(rule);
-            const result = results.get(ruleKey(policy.key, rule.id));
-            const inspected = result?.checked === undefined ? '' : (hasNoObjects(result) ? 'no objects checked' : `checked ${result.checked}`);
-            return `    ${[rule.id, name === rule.id ? '' : name, policySettings(rule.params) || 'settings: none', inspected]
-                .filter(Boolean).join('  ')}`;
-        });
-        return [`  ${policy.key ?? 'policy'}${statement ? `  ${statement}` : ''}`, ...rules];
-    });
-    if (body.length === 0)
-        return [];
-    const provenance = [run?.trigger, run?.started_at].filter(Boolean).join(', ');
-    const heading = run?.id ? `Run ${run.id} as recorded` : 'This evaluation, which was not stored';
-    return [`${heading}${provenance ? ` (${provenance})` : ''}:`, ...body];
-}

package/dist/utils/policy/status.d.ts

@@ -1,47 +0,0 @@
-import type { Policy, PolicyRunHead } from './types.js';
-/**
- * Where a policy stands against the latest run. `stale` means the run evaluated a different
- * version; `not_evaluated` that it has no result for every rule.
- */
-export type PolicyStatus = 'error' | 'fail' | 'inactive' | 'no_checks' | 'no_objects_checked' | 'not_evaluated' | 'pass' | 'stale';
-export interface PolicyStatusRow {
-    /** Whether the policy is active. */
-    active: boolean;
-    /**
-     * Whether the latest run's findings on this policy block a merge: the run evaluated it, in its
-     * current version, as active and mandatory (the platform's `latest_run.enforcement`), and found something.
-     */
-    blocking: boolean;
-    checked: number;
-    /** Whether `findings` and `checked` come from the latest run: only for an active policy it evaluated in its current version. */
-    counted: boolean;
-    /** The policy's own enforcement (`mandatory` / `advisory`). */
-    enforcement: string;
-    findings: number;
-    key: string;
-    /** Completed rules that inspected no objects. */
-    rules_unchecked: number;
-    /** The platform's answer: the latest run evaluated a different version of this policy. */
-    stale: boolean;
-    status: PolicyStatus;
-    title?: string;
-}
-/** How a row's status reads in the summary table. */
-export declare function statusLabel(row: PolicyStatusRow): string;
-/** The policy's own enforcement, in Studio's words. Whether its findings block is `findingsLabel`'s to say. */
-export declare function enforcementLabel(enforcement: string): string;
-/** `3 findings`, marked blocking when they block; a dash where the row carries no current count. */
-export declare function findingsLabel(row: PolicyStatusRow): string;
-/**
- * Combine the branch's policies with the latest stored run. Whether the run is still evidence for a
- * policy is the platform's `latest_run` answer; only an active policy the run evaluated in its
- * current version carries counts.
- */
-export declare function computeStatusRows(policies: Policy[], run?: PolicyRunHead): PolicyStatusRow[];
-/**
- * `--fail-on-findings`: 2 for a current blocking finding, whatever else is true, as push and evaluate
- * exit; otherwise 1 for stale, missing or errored evidence.
- */
-export declare function statusExitCode(rows: PolicyStatusRow[]): number;
-/** Why `--fail-on-findings` failed, in one line naming the policies, or `null` when it did not. */
-export declare function statusExitReason(rows: PolicyStatusRow[]): null | string;

package/dist/utils/policy/status.js

@@ -1,117 +0,0 @@
-import { hasNoObjects } from './findings.js';
-/** How a row's status reads in the summary table. */
-export function statusLabel(row) {
-    switch (row.status) {
-        case 'inactive': {
-            return 'inactive; not evaluated';
-        }
-        case 'pass': {
-            return row.rules_unchecked > 0
-                ? `pass; ${row.rules_unchecked} rule${row.rules_unchecked === 1 ? '' : 's'} no objects checked`
-                : 'pass';
-        }
-        case 'stale': {
-            return 'outdated; evaluate again';
-        }
-        default: {
-            return row.status.replaceAll('_', ' ');
-        }
-    }
-}
-/** The policy's own enforcement, in Studio's words. Whether its findings block is `findingsLabel`'s to say. */
-export function enforcementLabel(enforcement) {
-    if (enforcement === 'mandatory')
-        return 'Mandatory';
-    if (enforcement === 'advisory')
-        return 'Advisory';
-    return enforcement.trim() || '—';
-}
-/** `3 findings`, marked blocking when they block; a dash where the row carries no current count. */
-export function findingsLabel(row) {
-    if (!row.counted)
-        return '— findings';
-    return `${row.findings} findings${row.blocking ? ' (blocking)' : ''}`;
-}
-/** Where an active policy stands, given its rule results in a run that is still evidence for it. */
-function ruleStatus(results, ruleCount, checked) {
-    if (ruleCount === 0)
-        return 'no_checks';
-    if (results.length === 0)
-        return 'not_evaluated';
-    if (results.some((result) => !['fail', 'no_objects', 'pass'].includes(result.status ?? '')))
-        return 'error';
-    if (results.some((result) => result.status === 'fail'))
-        return 'fail';
-    if (results.length < ruleCount)
-        return 'not_evaluated';
-    return checked === 0 ? 'no_objects_checked' : 'pass';
-}
-/**
- * A policy's finding count in a run: its verdict in the run summary, which counts them all without
- * listing them, or, from a whole run, its findings counted.
- */
-function findingCount(run, key) {
-    const verdict = (run?.policies ?? []).find((policy) => policy.key === key);
-    if (typeof verdict?.findings === 'number')
-        return verdict.findings;
-    return (run?.findings ?? []).filter((finding) => finding.policy_key === key).length;
-}
-/**
- * Combine the branch's policies with the latest stored run. Whether the run is still evidence for a
- * policy is the platform's `latest_run` answer; only an active policy the run evaluated in its
- * current version carries counts.
- */
-export function computeStatusRows(policies, run) {
-    return policies.map((policy) => {
-        const ids = new Set((policy.rules ?? []).map((rule) => rule.id));
-        const active = policy.active !== false;
-        const stale = policy.latest_run?.stale === true;
-        const counted = active && policy.latest_run?.included === true && !stale;
-        const results = counted
-            ? (run?.results ?? []).filter((result) => result.policy_key === policy.key && ids.has(result.check_id ?? ''))
-            : [];
-        const checked = results.reduce((sum, result) => sum + (result.checked ?? 0), 0);
-        const findings = counted ? findingCount(run, policy.key) : 0;
-        let status = 'inactive';
-        if (active)
-            status = stale ? 'stale' : ruleStatus(results, ids.size, checked);
-        return {
-            active: policy.active,
-            blocking: counted && policy.latest_run?.enforcement === 'mandatory' && findings > 0,
-            checked,
-            counted,
-            enforcement: policy.enforcement,
-            findings,
-            key: policy.key,
-            rules_unchecked: status === 'pass' ? results.filter((result) => hasNoObjects(result)).length : 0,
-            stale,
-            status,
-            title: policy.title,
-        };
-    });
-}
-/** The rows whose evidence cannot be relied on: stale, missing or errored. An inactive policy is never evaluated. */
-function unreliableRows(rows) {
-    return rows.filter((row) => ['error', 'not_evaluated', 'stale'].includes(row.status));
-}
-/**
- * `--fail-on-findings`: 2 for a current blocking finding, whatever else is true, as push and evaluate
- * exit; otherwise 1 for stale, missing or errored evidence.
- */
-export function statusExitCode(rows) {
-    if (rows.some((row) => row.blocking))
-        return 2;
-    return unreliableRows(rows).length > 0 ? 1 : 0;
-}
-/** Why `--fail-on-findings` failed, in one line naming the policies, or `null` when it did not. */
-export function statusExitReason(rows) {
-    const unreliable = unreliableRows(rows);
-    const evidence = unreliable.map((row) => `${row.key} ${statusLabel(row)}`).join(', ');
-    const blocking = rows.filter((row) => row.blocking);
-    if (blocking.length === 0) {
-        return unreliable.length > 0 ? `Evaluation evidence is stale, missing or errored (${evidence}); exit 1.` : null;
-    }
-    const findings = blocking.reduce((sum, row) => sum + row.findings, 0);
-    // A prediction, not a verdict: the merge gate evaluates the branch again.
-    return `The latest run has ${findings} blocking finding${findings === 1 ? '' : 's'} (${blocking.map((row) => row.key).join(', ')}); the merge gate evaluates the branch again before a merge.${unreliable.length > 0 ? ` Evidence is also stale, missing or errored (${evidence}).` : ''}`;
-}

package/dist/utils/policy/types.d.ts

@@ -1,185 +0,0 @@
-/** The shapes the policy routes answer with. Policy grammar belongs to the platform. */
-export interface PolicyCatalogueEntry {
-    description?: string;
-    fix_hint?: string;
-    id: string;
-    /** The check's human name. */
-    label: string;
-    object_kinds?: string[];
-    params?: Record<string, {
-        required?: boolean;
-        type?: string;
-    }>;
-    /** Params of which a rule must set at least one. */
-    requires_one_of?: string[];
-}
-/** One rule as a run snapshot records it: the settings the check ran with, plus the check's label. */
-export interface PolicySnapshotRule {
-    check?: string;
-    id?: string;
-    label?: string;
-    /** The resolved settings; PHP sends an empty map as `[]`. */
-    params?: unknown;
-    title?: string;
-}
-/** One policy as a run snapshot records it, including the description it carried at run time. */
-export interface PolicySnapshotPolicy {
-    key?: string;
-    rules?: PolicySnapshotRule[];
-    /** The policy description as written at run time. */
-    statement?: string;
-    title?: string;
-    /** The Version History index this run evaluated. */
-    version?: number;
-}
-export interface PolicyRuleResult {
-    check_id?: string;
-    checked?: number;
-    message?: string;
-    policy_key?: string;
-    status?: string;
-    warnings?: string[];
-}
-export interface PolicyFinding {
-    /** Stable finding id, used to tell a blocking finding from an advisory one. */
-    id?: string;
-    message?: string;
-    object?: {
-        name?: string;
-        type?: string;
-    };
-    policy_key?: string;
-    policy_title?: string;
-    rule_id?: string;
-    rule_title?: string;
-    severity?: string;
-}
-/** The verdict every `policy_check` carries. */
-export interface PolicyVerdict {
-    /** True when an active, mandatory policy failed; it decides the exit code whatever the status. */
-    blocking?: boolean;
-    /** The platform's verdict, including the names of rules that checked no objects. */
-    message?: string;
-    run_id?: number;
-    /**
-     * `pass`, `fail` or `error` (a check could not run) for an evaluation; `disabled`,
-     * `not_applicable`, `forbidden` or `unavailable` when nothing was evaluated.
-     */
-    status?: string;
-}
-/** A run's finding counts: every finding, the blocking ones, and the rules that could not run. */
-export interface PolicyCounts {
-    /** The findings that do not block; the run summary serves it, a push's feedback does not. */
-    advisory?: number;
-    blocking: number;
-    errors: number;
-    findings: number;
-}
-/**
- * A push's `policy_check`: the verdict with its findings and results, since a push answers no run.
- * The lists hold the first 100 each, in the platform's order; the stored run (`run_id`) has them all.
- */
-export interface PushPolicyCheck extends PolicyVerdict {
-    /** The first blocking findings. */
-    blocking_findings?: PolicyFinding[];
-    /** What the lists are out of. */
-    counts?: PolicyCounts;
-    /** The first findings, blocking first. */
-    findings?: PolicyFinding[];
-    results?: PolicyRuleResult[];
-    /** Every finding, listed or not. */
-    total?: number;
-    /** Whether either list was cut. */
-    truncated?: boolean;
-}
-/** A policy's place in its branch's newest run, as the platform serves it on every policy. */
-export interface PolicyCoverage {
-    enforcement: null | string;
-    /** Whether the newest run evaluated this policy at all. */
-    included: boolean;
-    /** 0 when the branch has no run. */
-    run_id: number;
-    /** True only when the newest run evaluated a different version of this policy. */
-    stale: boolean;
-    version: null | number;
-}
-export interface Policy {
-    active: boolean;
-    enforcement: string;
-    id: number;
-    key: string;
-    latest_run?: PolicyCoverage;
-    rules?: Array<{
-        id: string;
-    }>;
-    title?: string;
-    /** When the policy was last written, as served; sent back as `last_updated_at` to refuse acting on a stale read. */
-    updated_at?: number | string;
-    /** The index of the policy's newest Version History entry; it moves only when the definition changes. */
-    version: number;
-}
-/** One stored run as the run list serves it: the verdict and counts, without findings or results. */
-export interface PolicyRunSummary {
-    counts: {
-        blocking: number;
-        errors: number;
-        findings: number;
-    };
-    finished_at?: string;
-    id: number;
-    objects_checked: number;
-    started_at?: string;
-    status: string;
-    trigger?: string;
-}
-/** One run in full, as `GET run/{id}` serves it. */
-export interface PolicyRun {
-    findings?: PolicyFinding[];
-    finished_at?: number | string;
-    /** 0 for an evaluation that was not stored. */
-    id?: number;
-    /** How many workspace objects the run inspected. */
-    objects_checked?: number;
-    /** The snapshot of the policies as they were when the run went out. */
-    policies?: PolicySnapshotPolicy[];
-    results?: PolicyRuleResult[];
-    started_at?: number | string;
-    status?: string;
-    trigger?: string;
-}
-/**
- * What `policy evaluate` answers: the run as `GET run/{id}` serves it, whether it was stored, and the verdict.
- * With no active policy on the branch it is no run at all: `id` 0, `status` `not_applicable`, nothing evaluated.
- */
-export interface PolicyEvaluation extends PolicyRun {
-    /** The summary answer's counts (`--summary`). */
-    counts?: PolicyCounts;
-    /** `blocking_total`: every blocking finding, beside the summary answer's listed ones. */
-    policy_check?: PolicyVerdict & {
-        blocking_finding_ids?: string[];
-        blocking_total?: number;
-    };
-    stored?: boolean;
-    /** The summary answer: every finding, and whether `findings` lists only the first. */
-    total?: number;
-    truncated?: boolean;
-}
-/** One run without its findings, as `GET run/{id}/summary` serves it. */
-export interface PolicyRunHead extends PolicyRun {
-    counts?: PolicyCounts;
-    /** The snapshot, each policy with its verdict in this run. */
-    policies?: Array<PolicySnapshotPolicy & {
-        blocking?: boolean;
-        findings?: number;
-        objects_checked?: number;
-        status?: string;
-    }>;
-}
-/** One page of a run's findings, as `GET run/{id}/findings` serves it. */
-export interface PolicyFindingsPage {
-    items: PolicyFinding[];
-    limit: number;
-    offset: number;
-    /** The findings that match the filters, listed or not. */
-    total: number;
-}

package/dist/utils/policy/types.js

@@ -1 +0,0 @@
-export {};