@xano/cli 1.3.1-beta.1 → 1.3.2

package/dist/commands/tenant_deploy_request/set_status/index.d.ts

@@ -1,38 +0,0 @@
-import BaseCommand from '../../../base-command.js';
-export default class TenantDeployRequestSetStatus extends BaseCommand {
-    static args: {
-        id: import("@oclif/core/interfaces").Arg<number, {
-            max?: number;
-            min?: number;
-        }>;
-    };
-    static description: string;
-    static examples: string[];
-    static flags: {
-        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'override-policy': import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        reason: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        status: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    /** Set once the policy gate refuses the deploy an approval triggered, the one failure that exits 2. */
-    private refusedByPolicyGate;
-    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
-    run(): Promise<void>;
-    /** `--override-policy` overrides the deploy an approve can trigger, and its reason is `--reason`. */
-    private checkOverride;
-    /**
-     * The deploy this approval triggered was refused by the policy gate: its verdict, then the refusal,
-     * exiting 2. The vote that completes the approvals is recorded before the deploy, so the request
-     * stays approved, and a later deploy of the pair that overrides the gate completes it.
-     */
-    private refuseByPolicyGate;
-}

package/dist/commands/tenant_deploy_request/set_status/index.js

@@ -1,159 +0,0 @@
-import { Args, Flags } from '@oclif/core';
-import BaseCommand from '../../../base-command.js';
-import { gateOverrideHint, gateRefusal, gateRefusalOutput, quoted } from '../../../utils/policy/gate.js';
-export default class TenantDeployRequestSetStatus extends BaseCommand {
-    static args = {
-        id: Args.integer({
-            description: 'Tenant deploy request ID',
-            required: true,
-        }),
-    };
-    static description = "[CRITICAL] STOP and confirm with the user before running --status approve; if this is the vote that completes the tenant's required reviewer count, it deploys the release to the tenant immediately as part of approving. Change a tenant deploy request's status (draft, submit, approve, request_changes, close, or reopen). That deploy is gated on the release's policy check: a refusal exits 2 and leaves the request approved; --override-policy with --reason proceeds past it.";
-    static examples = [
-        `$ xano tenant_deploy_request set_status 12 --status submit
-Deploy request #12 is now: pending
-`,
-        `$ xano tenant_deploy_request set_status 12 --status approve
-Vote recorded on deploy request #12: 1/2 required reviewers.
-`,
-        `$ xano tenant_deploy_request set_status 12 --status approve
-Deploy request #12 is now: approved (2/2 required reviewers)
-Deployed to tenant as part of this approval.
-`,
-        `$ xano tenant_deploy_request set_status 12 --status approve --override-policy --reason "Finding accepted; fix tracked in JIRA-12"`,
-        `$ xano tenant_deploy_request set_status 12 --status request_changes --reason "Needs a migration note"`,
-        `$ xano tenant_deploy_request set_status 12 --status close --reason "Superseded by #14"`,
-        `$ xano tenant_deploy_request set_status 12 --status reopen`,
-    ];
-    static flags = {
-        ...BaseCommand.baseFlags,
-        output: Flags.string({
-            char: 'o',
-            default: 'summary',
-            description: 'Output format',
-            options: ['summary', 'json'],
-            required: false,
-        }),
-        'override-policy': Flags.boolean({
-            default: false,
-            description: 'With --status approve: if this vote deploys, proceed past a blocking policy gate, recording --reason as the override reason (needs the workspace:policy update permission; audited)',
-        }),
-        reason: Flags.string({
-            description: 'Reason for this status change. Required for request_changes and close, and with --override-policy.',
-            required: false,
-        }),
-        status: Flags.string({
-            description: 'The status transition to apply',
-            options: ['draft', 'submit', 'approve', 'request_changes', 'close', 'reopen'],
-            required: true,
-        }),
-        workspace: Flags.string({
-            char: 'w',
-            description: 'Workspace ID (uses profile workspace if not provided)',
-            required: false,
-        }),
-    };
-    /** Set once the policy gate refuses the deploy an approval triggered, the one failure that exits 2. */
-    refusedByPolicyGate = false;
-    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
-    async catch(error) {
-        if (this.refusedByPolicyGate)
-            return super.catch(error);
-        return this.catchAsOperational(error);
-    }
-    async run() {
-        const { args, flags } = await this.parse(TenantDeployRequestSetStatus);
-        const { profile } = this.resolveProfile(flags);
-        const workspaceId = flags.workspace || profile.workspace;
-        if (!workspaceId) {
-            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
-        }
-        if ((flags.status === 'request_changes' || flags.status === 'close') && !flags.reason) {
-            this.error(`--reason is required when --status is "${flags.status}"`);
-        }
-        if (flags['override-policy'])
-            this.checkOverride(flags);
-        const body = {
-            action: flags.status,
-            reason: flags.reason ?? '',
-            ...(flags['override-policy'] ? { override_policy: true } : {}),
-        };
-        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
-        let refused = null;
-        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}/status`;
-        try {
-            const response = await this.verboseFetch(apiUrl, {
-                body: JSON.stringify(body),
-                headers: {
-                    accept: 'application/json',
-                    Authorization: `Bearer ${profile.access_token}`,
-                    'Content-Type': 'application/json',
-                },
-                method: 'POST',
-            }, flags.verbose, profile.access_token);
-            if (!response.ok) {
-                refused = await gateRefusal(response);
-                if (refused)
-                    this.refuseByPolicyGate(refused, args.id, flags.output === 'json');
-                const message = await this.parseApiError(response, 'Failed to change tenant deploy request status');
-                this.error(message);
-            }
-            const item = (await response.json());
-            if (flags.output === 'json') {
-                this.log(JSON.stringify(item, null, 2));
-            }
-            else if (flags.status === 'approve' && item.fully_approved === false) {
-                // required_reviewers > 1: this vote didn't complete the quorum, so status
-                // stays "pending" and nothing was deployed yet.
-                this.log(`Vote recorded on deploy request #${item.id}: ${item.approvals_count}/${item.required_reviewers} required reviewers.`);
-            }
-            else {
-                const quorum = item.approvals_count !== undefined && item.required_reviewers !== undefined
-                    ? ` (${item.approvals_count}/${item.required_reviewers} required reviewers)`
-                    : '';
-                this.log(`Deploy request #${item.id} is now: ${item.status}${quorum}`);
-                if (flags.status === 'approve') {
-                    if (item.resolution?.deploy_status === 'deployed') {
-                        this.log('Deployed to tenant as part of this approval.');
-                    }
-                    else if (item.resolution?.deploy_status === 'failed') {
-                        this.log(`Approved, but the deploy failed: ${item.resolution.deploy_error ?? 'unknown error'}`);
-                    }
-                }
-            }
-        }
-        catch (error) {
-            if (refused)
-                throw error;
-            if (error instanceof Error) {
-                this.error(`Failed to change tenant deploy request status: ${error.message}`);
-            }
-            else {
-                this.error(`Failed to change tenant deploy request status: ${String(error)}`);
-            }
-        }
-    }
-    /** `--override-policy` overrides the deploy an approve can trigger, and its reason is `--reason`. */
-    checkOverride(flags) {
-        if (flags.status !== 'approve')
-            this.error('--override-policy applies only to --status approve, the vote that can deploy.');
-        if (!flags.reason?.trim())
-            this.error('--override-policy needs --reason: say why this deploy may proceed past the policy gate.');
-    }
-    /**
-     * The deploy this approval triggered was refused by the policy gate: its verdict, then the refusal,
-     * exiting 2. The vote that completes the approvals is recorded before the deploy, so the request
-     * stays approved, and a later deploy of the pair that overrides the gate completes it.
-     */
-    refuseByPolicyGate(refused, id, json) {
-        for (const line of gateRefusalOutput(refused, json))
-            this.log(line);
-        const approved = refused.answer.gate === 'tenant_approve'
-            ? '\nYour approval was recorded and the request is approved, but its release was not deployed.'
-            : '';
-        const release = refused.answer.release?.name?.trim();
-        const override = `xano tenant deploy_release <tenant> --release ${release ? quoted(release) : '<release>'} --override-reason "<why>" (\`xano tenant_deploy_request get ${id}\` names the tenant)`;
-        this.refusedByPolicyGate = true;
-        this.error(`${refused.message}${approved}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
-    }
-}

package/dist/policy-command.d.ts

@@ -1,90 +0,0 @@
-import type { Policy, PolicyRun } from './utils/policy/types.js';
-import BaseCommand from './base-command.js';
-import { type PolicyRequest } from './utils/policy/request.js';
-/** One rule's warnings from the parse route: its 0-based index, id and sentences. */
-export interface RuleWarnings {
-    rule: number;
-    rule_id: string;
-    warnings: string[];
-}
-/** What the parse route answers. */
-export interface ParsedPolicy {
-    policy: Policy;
-    rule_warnings: RuleWarnings[];
-    source: string;
-}
-/** The workspace and branch a policy command acts on, and requests bound to them. */
-export interface PolicyTarget {
-    branch: string;
-    request: PolicyRequest;
-    workspace: string;
-}
-interface TargetFlags {
-    branch?: string;
-    config?: string;
-    profile?: string;
-    verbose: boolean;
-    workspace?: string;
-}
-/** Shared flags, request helper and output for the `policy *` commands and `skills pull`. */
-export default abstract class PolicyCommand extends BaseCommand {
-    static policyFlags: {
-        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    /** `publish -m`: the message on the Version History entry the save creates. */
-    static publishFlags: {
-        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-    };
-    /** One positional, as CLAUDE.md requires: the file `--file` would otherwise name. */
-    static sourceArgs: {
-        file: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
-    };
-    static sourceFlags: {
-        file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    /** Any failure exits 1; an error that is not the CLI's own names the command it broke. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
-    /**
-     * Print each rule's warnings (a name, tag or value that makes the rule check nothing) to stderr,
-     * so piped source stays clean; nothing when there are none.
-     */
-    protected logRuleWarnings(parsed: ParsedPolicy): void;
-    /** Print a run's recorded detail, or say it evaluated no policy. */
-    protected logRunDetail(run: PolicyRun): void;
-    /**
-     * Ask the parse route for the policy, its canonical source and each rule's warnings against the
-     * target branch, from XanoScript (`{source}`) or a policy document (`{data}`); the policy and source
-     * must come back.
-     */
-    protected parseSource(request: PolicyRequest, input: {
-        data: unknown;
-    } | {
-        source: string;
-    }): Promise<ParsedPolicy>;
-    /**
-     * The workspace and branch from the flags or the profile, and a request helper bound to them for
-     * a route gated by `workspace:policy`: `/policy` unless another is named.
-     */
-    protected policyTarget(flags: TargetFlags, route?: Pick<import("./utils/policy/request.js").PolicyRequestRoute, "path" | "label">): PolicyTarget;
-    /** Policy source from the positional, `--file` or `--stdin`; a file named twice must be named the same. */
-    protected readSource(flags: {
-        file?: string;
-        stdin?: boolean;
-    }, positional?: string): string;
-    /** `workspace 3 (feature)`, or just `workspace 3` for live. */
-    protected where({ branch, workspace }: {
-        branch: string;
-        workspace: string;
-    }): string;
-}
-export {};

package/dist/policy-command.js

@@ -1,94 +0,0 @@
-import { Args, Flags } from '@oclif/core';
-import * as fs from 'node:fs';
-import BaseCommand from './base-command.js';
-import { POLICY_ROUTE, policyRequest, policyScope } from './utils/policy/request.js';
-import { policyRunDetail } from './utils/policy/runs.js';
-/** Shared flags, request helper and output for the `policy *` commands and `skills pull`. */
-export default class PolicyCommand extends BaseCommand {
-    static policyFlags = {
-        ...BaseCommand.baseFlags,
-        branch: Flags.string({ char: 'b', description: "Branch label (defaults to profile branch or live; -b '' selects live)" }),
-        output: Flags.string({ char: 'o', default: 'summary', description: 'Output format', options: ['summary', 'json'] }),
-        workspace: Flags.string({ char: 'w', description: 'Workspace ID (defaults to profile workspace)' }),
-    };
-    /** `publish -m`: the message on the Version History entry the save creates. */
-    static publishFlags = {
-        message: Flags.string({ char: 'm', description: 'Message stored on the Version History entry this save creates' }),
-    };
-    /** One positional, as CLAUDE.md requires: the file `--file` would otherwise name. */
-    static sourceArgs = {
-        file: Args.string({ description: 'Policy XanoScript file (same as --file)', ignoreStdin: true, required: false }),
-    };
-    static sourceFlags = {
-        file: Flags.string({ char: 'f', description: 'Policy XanoScript file', exclusive: ['stdin'] }),
-        stdin: Flags.boolean({ default: false, description: 'Read policy XanoScript from stdin', exclusive: ['file'] }),
-    };
-    /** Any failure exits 1; an error that is not the CLI's own names the command it broke. */
-    async catch(error) {
-        if ('oclif' in error)
-            return this.catchAsOperational(error);
-        const action = this.id?.split(':').at(-1) ?? 'command';
-        return this.catchAsOperational(new Error(`Policy ${action} failed: ${error.message}`));
-    }
-    /**
-     * Print each rule's warnings (a name, tag or value that makes the rule check nothing) to stderr,
-     * so piped source stays clean; nothing when there are none.
-     */
-    logRuleWarnings(parsed) {
-        const warned = parsed.rule_warnings ?? [];
-        if (warned.length === 0)
-            return;
-        this.logToStderr('Rule warnings (the rule may check nothing or everything; fix them before relying on it):');
-        for (const rule of warned) {
-            for (const warning of rule.warnings)
-                this.logToStderr(`  ${rule.rule_id || `rule[${rule.rule}]`}: ${warning}`);
-        }
-    }
-    /** Print a run's recorded detail, or say it evaluated no policy. */
-    logRunDetail(run) {
-        const detail = policyRunDetail(run);
-        for (const line of detail)
-            this.log(line);
-        if (detail.length === 0)
-            this.log(run.id ? `Run ${run.id} evaluated no policies.` : 'No policies were evaluated.');
-    }
-    /**
-     * Ask the parse route for the policy, its canonical source and each rule's warnings against the
-     * target branch, from XanoScript (`{source}`) or a policy document (`{data}`); the policy and source
-     * must come back.
-     */
-    async parseSource(request, input) {
-        const answer = (await request('/parse', 'POST', input));
-        if (!answer?.policy?.key || typeof answer.source !== 'string')
-            this.error('The platform did not return a parsed policy and canonical source.');
-        return { ...answer, rule_warnings: Array.isArray(answer.rule_warnings) ? answer.rule_warnings : [] };
-    }
-    /**
-     * The workspace and branch from the flags or the profile, and a request helper bound to them for
-     * a route gated by `workspace:policy`: `/policy` unless another is named.
-     */
-    policyTarget(flags, route = POLICY_ROUTE) {
-        const { profile } = this.resolveProfile(flags);
-        const { branch, workspace } = policyScope(flags, profile);
-        if (!workspace)
-            this.error('Workspace ID required. Use --workspace or set one in your profile.');
-        const request = policyRequest({ error: (message) => this.error(message), logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { ...route, branch, profile, verbose: flags.verbose, workspace });
-        return { branch, request, workspace };
-    }
-    /** Policy source from the positional, `--file` or `--stdin`; a file named twice must be named the same. */
-    readSource(flags, positional) {
-        const named = positional?.trim();
-        if (named && flags.stdin)
-            this.error('Provide policy source once: a file (positional or --file) or --stdin.');
-        if (named && flags.file && flags.file !== named)
-            this.error('Provide the file once: as a positional or as --file.');
-        const file = flags.file ?? named;
-        if (!file && !flags.stdin)
-            this.error('Provide the policy file (as an argument or --file) or --stdin.');
-        return fs.readFileSync(flags.stdin ? 0 : file, 'utf8');
-    }
-    /** `workspace 3 (feature)`, or just `workspace 3` for live. */
-    where({ branch, workspace }) {
-        return `workspace ${workspace}${branch ? ` (${branch})` : ''}`;
-    }
-}

package/dist/utils/policy/catalogue.d.ts

@@ -1,7 +0,0 @@
-import type { PolicyCatalogueEntry } from './types.js';
-/**
- * `--check` narrows the catalogue to one check. An id that is not in it names the closest matches
- * instead of reprinting the whole list: the usual mistake is a typo one character from a real id.
- */
-export declare function selectCatalogueCheck(checks: PolicyCatalogueEntry[], id: string): PolicyCatalogueEntry[];
-export declare function policyCatalogueSummary(checks: PolicyCatalogueEntry[]): string[];

package/dist/utils/policy/catalogue.js

@@ -1,72 +0,0 @@
-/**
- * `--check` narrows the catalogue to one check. An id that is not in it names the closest matches
- * instead of reprinting the whole list: the usual mistake is a typo one character from a real id.
- */
-export function selectCatalogueCheck(checks, id) {
-    const wanted = id.trim().toLowerCase();
-    const exact = checks.filter(check => check.id.toLowerCase() === wanted);
-    if (exact.length > 0)
-        return exact;
-    const near = checks.map(check => check.id).filter(known => {
-        const lower = known.toLowerCase();
-        return lower.includes(wanted) || wanted.includes(lower) || editDistanceWithin(lower, wanted, 2);
-    }).sort();
-    throw new Error(`"${id}" is not a policy check.${near.length > 0
-        ? ` Did you mean ${near.join(', ')}?`
-        : ' Run `xano policy catalogue` for the full list.'}`);
-}
-/** Cheap bounded Levenshtein: true when `a` and `b` are at most `max` edits apart. */
-function editDistanceWithin(a, b, max) {
-    if (Math.abs(a.length - b.length) > max)
-        return false;
-    let previous = Array.from({ length: b.length + 1 }, (_, index) => index);
-    for (let i = 1; i <= a.length; i++) {
-        const current = [i];
-        for (let j = 1; j <= b.length; j++) {
-            current[j] = a[i - 1] === b[j - 1]
-                ? previous[j - 1]
-                : 1 + Math.min(previous[j - 1], previous[j], current[j - 1]);
-        }
-        if (Math.min(...current) > max)
-            return false;
-        previous = current;
-    }
-    return previous[b.length] <= max;
-}
-export function policyCatalogueSummary(checks) {
-    if (checks.length === 0)
-        return ['No policy checks found.'];
-    const rows = [
-        ['Check ID', 'Label / Description', 'Object kinds', 'Required params'],
-        ...checks.map(check => [
-            check.id,
-            [check.label.trim(), check.description, check.fix_hint && `Fix hint: ${check.fix_hint}`].filter(Boolean).join('\n'),
-            (check.object_kinds ?? []).join(', ') || '—',
-            requiredParams(check),
-        ]),
-    ];
-    const widths = rows[0].map((_, column) => Math.min([36, 46, 24, 32][column], Math.max(...rows.map(row => row[column].length))));
-    return rows.flatMap(row => {
-        const cells = row.map((cell, column) => cell.split('\n').flatMap(paragraph => {
-            const lines = [''];
-            for (const word of paragraph.split(/\s+/)) {
-                const last = lines.length - 1;
-                if (lines[last] && lines[last].length + word.length + 1 > widths[column])
-                    lines.push(word);
-                else
-                    lines[last] += `${lines[last] ? ' ' : ''}${word}`;
-            }
-            return lines;
-        }));
-        return Array.from({ length: Math.max(...cells.map(cell => cell.length)) }, (_, line) => cells.map((cell, column) => (cell[line] ?? '').padEnd(widths[column])).join('  ').trimEnd());
-    });
-}
-/** The params a rule must set: each required one, and any "one of" group. */
-function requiredParams(check) {
-    const required = Object.entries(check.params ?? {}).filter(([, schema]) => schema.required)
-        .map(([name, schema]) => `${name}: ${schema.type ?? 'any'}`);
-    const oneOf = check.requires_one_of ?? [];
-    if (oneOf.length > 0)
-        required.push(`one of: ${oneOf.join(' | ')}`);
-    return required.join(', ') || 'none';
-}

package/dist/utils/policy/errors.d.ts

@@ -1,12 +0,0 @@
-/** Guidance appended to a refusal whose `payload.code` the CLI has advice for, or `''`. */
-export declare function policyCodeGuidance(payload: unknown): string;
-/** A failed policy-route response: one message to print, and the refusal's payload. */
-export interface PolicyError {
-    message: string;
-    payload?: unknown;
-}
-/**
- * A failed policy-route response as one message: the platform's code and message, and where a parse
- * error is. Traces are dropped, and an empty 404 names the branch the request selected.
- */
-export declare function describePolicyError(text: string, status: number, requestUrl: string): PolicyError;

package/dist/utils/policy/errors.js

@@ -1,61 +0,0 @@
-/** Keep backend implementation details out of ordinary command errors. */
-function withoutStack(text) {
-    return text.split(/\n\s*(?:Stack trace:|#\d+\s|at\s|file:\s*\/)/i, 1)[0];
-}
-/** Where a parse error is: the payload's 1-based `line` and `col`, printed as served, and the offending text. */
-function positionLine(payload) {
-    const text = [payload.error_line, payload.error_snippet, payload.snippet]
-        .find(value => typeof value === 'string' && value.trim() !== '');
-    const where = typeof payload.line === 'number' && Number.isFinite(payload.line)
-        ? `line ${payload.line}${typeof payload.col === 'number' && Number.isFinite(payload.col) ? `, col ${payload.col}` : ''}`
-        : '';
-    if (!where && text === undefined)
-        return '';
-    return `\n  ${where ? `at ${where}` : 'at'}${text === undefined ? '' : `: ${text}`}`;
-}
-/** An empty 404 from a branch-scoped request means the branch it named does not exist. */
-function missingBranch(requestUrl) {
-    const url = new URL(requestUrl);
-    const workspace = url.pathname.match(/\/workspace\/([^/]+)/)?.[1];
-    const branch = url.searchParams.get('branch');
-    return workspace && branch ? `Branch "${branch}" was not found in workspace ${decodeURIComponent(workspace)}.` : '';
-}
-/**
- * What to do about a refusal of the request itself, keyed on the platform's `payload.code`:
- *
- *   policy_unknown_check   a rule names a check id this instance does not have
- *   policy_stale           the policy changed after the command read it
- *
- * Permission refusals are explained by `policyPermissionGuidance`.
- */
-const CODE_GUIDANCE = {
-    policy_stale: '\nThe policy changed after this command read it, so nothing was changed. Run the command again to act on its current version.',
-    policy_unknown_check: '\nRun `xano policy catalogue` to list every check id this instance has.',
-};
-/** Guidance appended to a refusal whose `payload.code` the CLI has advice for, or `''`. */
-export function policyCodeGuidance(payload) {
-    const code = payload && typeof payload === 'object' && !Array.isArray(payload) ? payload.code : undefined;
-    return typeof code === 'string' && Object.hasOwn(CODE_GUIDANCE, code) ? CODE_GUIDANCE[code] : '';
-}
-/**
- * A failed policy-route response as one message: the platform's code and message, and where a parse
- * error is. Traces are dropped, and an empty 404 names the branch the request selected.
- */
-export function describePolicyError(text, status, requestUrl) {
-    let data;
-    try {
-        data = JSON.parse(text.trim() || '{}');
-    }
-    catch {
-        return { message: withoutStack(text) };
-    }
-    if (!data || typeof data !== 'object' || Array.isArray(data))
-        return { message: withoutStack(text) };
-    const { code, message: raw, payload } = data;
-    let message = typeof raw === 'string' ? withoutStack(raw) : '';
-    if (status === 404 && !message.trim())
-        message = missingBranch(requestUrl);
-    const headline = [typeof code === 'string' ? code : '', message].filter(Boolean).join(': ');
-    const position = payload && typeof payload === 'object' ? positionLine(payload) : '';
-    return { message: `${headline}${position}` || 'The server returned no message.', payload };
-}

package/dist/utils/policy/feedback.d.ts

@@ -1,68 +0,0 @@
-import type { PolicyEvaluation, PolicyFinding, PolicyRuleResult, PolicySnapshotPolicy, PolicyVerdict, PushPolicyCheck } from './types.js';
-/** 2 whenever the platform says a finding blocks, whatever the status; every other outcome is 0. */
-export declare function policyExitCode(check?: PolicyVerdict): number;
-/**
- * The one warning line for feedback without a headline (`disabled`, `forbidden`, `unavailable`,
- * `error`, an unknown status, or a pass or fail that does not say whether it blocks): the server's
- * own status and message, or that none came back. `null` for headlined feedback.
- */
-export declare function policyCheckWarning(check?: PolicyVerdict): null | string;
-/**
- * What happened to the policy documents a push carried. The preview says, per policy, whether it was
- * created, updated or left unchanged. Without a preview only the number sent is known: the import
- * response reports an unchanged policy exactly as it reports a saved one.
- */
-export declare function policyDocumentSummary(preview: null | {
-    operations: Array<{
-        action: string;
-        name: string;
-        type: string;
-    }>;
-}, sentPolicies: number): string[];
-/** What a verdict is about: its findings, which of them block, and the rule results. */
-export interface PolicyEvidence {
-    /** The ids of the findings that block. */
-    blocking: Set<string>;
-    /**
-     * When the answer lists only the first findings: how many there are in all, and how many block.
-     * The stored run (`runId`, 0 when nothing was stored) has them all.
-     */
-    cut?: {
-        blocking: number;
-        findings: number;
-        runId: number;
-    };
-    /** In the platform's order: blocking first, then by severity. */
-    findings: PolicyFinding[];
-    results: PolicyRuleResult[];
-    /** The run's own `policies[]`, which names unnamed rules; a push answers none. */
-    snapshot: PolicySnapshotPolicy[];
-}
-/**
- * A push answers no run, so its `policy_check` carries the findings and results itself: the first
- * 100 of each list, with `counts` and `total` saying what they are out of.
- */
-export declare function pushEvidence(check?: PushPolicyCheck): PolicyEvidence;
-/**
- * An evaluation answers the run, and its verdict names the blocking findings by id. Its summary
- * answer (`--summary`) lists the first findings, and its counts say what they are out of.
- */
-export declare function evaluationEvidence(evaluation: PolicyEvaluation): PolicyEvidence;
-/**
- * The feedback on stdout: a headline with the server's message, then any findings, errors and
- * warnings. Feedback without a headline is reported by `policyCheckWarning` instead.
- */
-export declare function policySummary(check: PolicyVerdict | undefined, evidence: PolicyEvidence): string[];
-/**
- * The platform's one notice that a push or its dry run left policy files out
- * (`policies_skipped.message`): a push to a remote tenant or to a tenant without a policy table, a
- * `release push` by a caller without `workspace:policy` create and update (its release carries the
- * live branch's policies instead), and any push while the Policies feature is off. `null` when it
- * left none out.
- */
-export declare function policiesSkippedNotice(answer: unknown): null | string;
-/**
- * The line for an evaluation that ran but was not recorded (the credential may read, not write), or
- * `null`. A branch with nothing to evaluate stores nothing either, and its headline says so.
- */
-export declare function notStoredLine(evaluation: PolicyEvaluation): null | string;