@xano/cli 1.3.1-beta.1 → 1.3.2

package/dist/commands/release/deploy/index.js

@@ -1,7 +1,5 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
-import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateOverrideHint, gateRefusal, liveGateLines, quoted, weakeningRefusal, } from '../../../utils/policy/gate.js';
-import { policyWeakeningGuidance } from '../../../utils/policy/permission.js';
 export default class ReleaseDeploy extends BaseCommand {
     static args = {
         release_name: Args.string({
@@ -9,7 +7,7 @@ export default class ReleaseDeploy extends BaseCommand {
             required: true,
         }),
     };
-    static description = "[IMPORTANT] ALWAYS confirm with the user before deploying a release. Deploys a release to its workspace as a new branch. With --set_live the branch is then set live through the set-live policy gate: when blocking findings refuse it, the branch stays, set live is refused, and the command exits 2 unless --policy-override gives a reason. A release that weakens a mandatory policy of the live branch needs workspace:policy update to be set live; without it the branch stays and the command exits 1.";
+    static description = '[IMPORTANT] ALWAYS confirm with the user before deploying a release. Deploys a release to its workspace as a new branch.';
     static examples = [
         `$ xano release deploy "v1.0"
 Are you sure you want to deploy release "v1.0"? (y/N) y
@@ -20,7 +18,6 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
 `,
         `$ xano release deploy "v1.0" --branch "restore-v1" --no-set_live`,
         `$ xano release deploy "v1.0" -w 40 -o json --force`,
-        `$ xano release deploy "v1.0" --branch "rollback-v1" --set_live --policy-override "Rollback approved; finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -42,7 +39,6 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             options: ['summary', 'json'],
             required: false,
         }),
-        'policy-override': Flags.string({ description: 'With --set_live, set the branch live past a blocking set-live policy gate with an audited reason (requires workspace:policy update)' }),
         set_live: Flags.boolean({
             default: false,
             description: '[CRITICAL] STOP and confirm with the user before setting the deployed branch as live.',
@@ -54,20 +50,8 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             required: false,
         }),
     };
-    /** Set once the platform refuses set live for a weakened mandatory policy: already explained, it exits 1 as it is. */
-    refusedByPermission = false;
-    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
-    refusedByPolicyGate = false;
-    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
-    async catch(error) {
-        if (this.refusedByPolicyGate)
-            return super.catch(error);
-        return this.catchAsOperational(error);
-    }
     async run() {
         const { args, flags } = await this.parse(ReleaseDeploy);
-        if (blankPolicyOverride(flags['policy-override']))
-            this.error(BLANK_POLICY_OVERRIDE);
         const { profile } = this.resolveProfile(flags);
         const workspaceId = flags.workspace || profile.workspace;
         if (!workspaceId) {
@@ -75,10 +59,11 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
         }
         const releaseName = encodeURIComponent(args.release_name);
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/release/${releaseName}/deploy`;
-        const body = deployBody(flags);
-        if (body.override_reason && !flags.set_live) {
-            this.error('--policy-override only applies with --set_live: a branch that is not set live is not gated.');
-        }
+        const body = {
+            set_live: flags.set_live,
+        };
+        if (flags.branch)
+            body.branch = flags.branch;
         if (!flags.force) {
             const confirmed = await this.confirm(`Are you sure you want to deploy release "${args.release_name}" to workspace ${workspaceId}?`);
             if (!confirmed) {
@@ -99,7 +84,6 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                await this.refuseIfSetLiveRefused(response, flags, args.release_name);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -114,17 +98,10 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
                 this.log(`Deployed release "${release.name}" to workspace ${workspaceId} (branch: ${branchLabel}${liveStatus})`);
                 if (release.description)
                     this.log(`  Description: ${release.description}`);
-                this.logPolicyOutcome(release);
                 this.log(`  Time: ${elapsed}s`);
             }
-            // A policy of the release the new branch could not take is never dropped silently.
-            const skipped = release.policies_skipped?.message;
-            if (skipped)
-                this.warn(skipped);
         }
         catch (error) {
-            if (this.refusedByPolicyGate || this.refusedByPermission)
-                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to deploy release: ${error.message}`);
             }
@@ -146,65 +123,4 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             });
         });
     }
-    /** The set-live verdict a successful deploy answered with --set_live (`pass`, `overridden`, ...). */
-    logPolicyOutcome(release) {
-        const status = release.policy_gate?.status;
-        if (status)
-            this.log(`  Policy gate: ${status}`);
-    }
-    /** Stops the command when set live was refused after the branch was created: by the gate (exit 2) or for a weakened mandatory policy (exit 1). */
-    async refuseIfSetLiveRefused(response, flags, releaseName) {
-        const refused = await gateRefusal(response);
-        if (refused)
-            this.refuseSetLive(refused, flags, releaseName);
-        const weakening = await weakeningRefusal(response);
-        if (weakening)
-            this.refuseWeakening(weakening, flags);
-    }
-    /**
-     * The set-live gate refused after the branch was created: the verdict, the refusal, and how to
-     * proceed, exiting 2. Under `-o json` the refusal is `{branch_created, set_live, branch, message,
-     * policy_gate}`.
-     */
-    refuseSetLive(refused, flags, releaseName) {
-        const answer = refused.answer;
-        const label = answer.branch?.label || flags.branch || 'the release branch';
-        if (flags.output === 'json') {
-            this.log(JSON.stringify({ branch: answer.branch ?? null, branch_created: true, message: refused.message, policy_gate: answer, set_live: false }, null, 2));
-        }
-        else {
-            for (const line of liveGateLines(answer, 'release'))
-                this.log(line);
-        }
-        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
-        const rerun = `xano branch delete ${quoted(label)}${workspace} && xano release deploy ${quoted(releaseName)}${workspace}${flags.branch ? ` --branch ${quoted(flags.branch)}` : ''} --set_live --policy-override "<why>"`;
-        const hint = gateOverrideHint(answer, rerun);
-        this.refusedByPolicyGate = true;
-        this.error(`The branch was created; set live was refused. ${refused.message}${hint}${answer.can_override && !answer.override_denied ? `\nOr set "${label}" live from Studio's Branches panel, which asks for the reason.` : ''}`, { exit: 2 });
-    }
-    /**
-     * Set live was refused after the branch was created because the release weakens (or lacks) a
-     * mandatory policy of the live branch, and the credential lacks `workspace:policy` update. That is a
-     * permission refusal, not a blocking finding: it exits 1 (under `-o json` as `{error}`) with the
-     * platform's sentence, which names the branch, and how to go on.
-     */
-    refuseWeakening(refused, flags) {
-        const label = refused.payload.branch?.label || flags.branch;
-        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
-        const ways = label
-            ? [`The branch stays. To remove it:  xano branch delete ${quoted(label)}${workspace}`, `Someone with that permission can set it live:  xano branch set_live ${quoted(label)}${workspace}`]
-            : [];
-        this.refusedByPermission = true;
-        this.error(`${refused.message}${policyWeakeningGuidance(refused.payload, ways, true)}`);
-    }
-}
-/** The deploy request's body: the new branch's label, set_live, and the override reason when one is given. */
-function deployBody(flags) {
-    const body = { set_live: flags.set_live };
-    if (flags.branch)
-        body.branch = flags.branch;
-    const overrideReason = flags['policy-override']?.trim();
-    if (overrideReason)
-        body.override_reason = overrideReason;
-    return body;
 }

package/dist/commands/release/import/index.js

@@ -2,7 +2,6 @@ import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
 import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { releaseImportRefusal, releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleaseImport extends BaseCommand {
     static args = {};
     static description = '[IMPORTANT] ALWAYS confirm with the user before importing a release. Imports a release file into a workspace.';
@@ -59,8 +58,7 @@ Imported release as #15
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
                 const errorText = await response.text();
-                this.error(releaseImportRefusal(errorText, response.status, apiUrl) ??
-                    `API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
             const result = await response.json();
             if (flags.output === 'json') {
@@ -69,8 +67,6 @@ Imported release as #15
             else {
                 const sizeMb = (fileBuffer.length / 1024 / 1024).toFixed(2);
                 this.log(`Imported release as #${result.id} (${sizeMb} MB)`);
-                for (const line of releasePolicyRunLines(result.policy_run, result.name, result.id))
-                    this.log(line);
             }
         }
         catch (error) {

package/dist/commands/release/list/index.d.ts

@@ -10,11 +10,4 @@ export default class ReleaseList extends BaseCommand {
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
-    /**
-     * The releases' stored policy checks, read once for the whole list. The list never fails or
-     * changes because of this read: it answers `null` when the checks cannot be read (the Policies
-     * feature is off, the credential lacks `workspace:policy` read, or the request failed), and the
-     * list then prints as it would without policies.
-     */
-    private policyChecks;
 }

package/dist/commands/release/list/index.js

@@ -1,21 +1,13 @@
 import { Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
 import { buildPagingJson } from '../../../utils/paging.js';
-import { readReleasePolicyChecks, releasePolicyCheckTag } from '../../../utils/policy/release.js';
 export default class ReleaseList extends BaseCommand {
-    static description = "List all releases in a workspace, each with its stored policy check when the credential can read policies (the release's own check, as Studio's Policies column shows it)";
+    static description = 'List all releases in a workspace';
     static examples = [
         `$ xano release list
 Releases in workspace 5:
   - v1.0 (ID: 10) - main
   - v1.1-hotfix (ID: 11) - main [hotfix]
-`,
-        `$ xano release list
-Releases in workspace 5:
-  - v1.2 (ID: 12) - main (9/28/2026, 4:12:03 PM PDT) [policies: 2 blocking, 1 advisory]
-  - v1.1-hotfix (ID: 11) - main [hotfix] (9/27/2026, 9:40:15 AM PDT) [policies: passed]
-  - v1.0 (ID: 10) - main (9/20/2026, 1:05:44 PM PDT) [policies: not checked]
-Policy check details: xano policy runs --release <name>
 `,
         `$ xano release list -w 5 --output json`,
     ];
@@ -65,19 +57,22 @@ Policy check details: xano policy runs --release <name>
             else {
                 this.error('Unexpected API response format');
             }
-            const checks = await this.policyChecks(profile, String(workspaceId), releases, flags.verbose);
             if (flags.output === 'json') {
-                this.log(JSON.stringify(buildPagingJson({ items: withPolicyChecks(releases, checks) }, { tier: 'none' }), null, 2));
+                this.log(JSON.stringify(buildPagingJson({ items: releases }, { tier: 'none' }), null, 2));
             }
             else if (releases.length === 0) {
                 this.log('No releases found');
             }
             else {
                 this.log(`Releases in workspace ${workspaceId}:`);
-                for (const release of releases)
-                    this.log(releaseLine(release, checks));
-                if (checks)
-                    this.log('Policy check details: xano policy runs --release <name>');
+                for (const release of releases) {
+                    const branch = release.branch ? ` - ${release.branch}` : '';
+                    const hotfix = release.hotfix ? ' [hotfix]' : '';
+                    const createdAt = release.created_at
+                        ? ` (${new Date(release.created_at).toLocaleString(undefined, { timeZoneName: 'short' })})`
+                        : '';
+                    this.log(`  - ${release.name} (ID: ${release.id})${branch}${hotfix}${createdAt}`);
+                }
             }
         }
         catch (error) {
@@ -89,43 +84,4 @@ Policy check details: xano policy runs --release <name>
             }
         }
     }
-    /**
-     * The releases' stored policy checks, read once for the whole list. The list never fails or
-     * changes because of this read: it answers `null` when the checks cannot be read (the Policies
-     * feature is off, the credential lacks `workspace:policy` read, or the request failed), and the
-     * list then prints as it would without policies.
-     */
-    async policyChecks(profile, workspace, releases, verbose) {
-        if (releases.length === 0)
-            return null;
-        return readReleasePolicyChecks({ logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { branch: '', profile, verbose, workspace }, releases.map(release => release.id));
-    }
-}
-/** A release's summary line, tagged with its stored check when the checks were read. */
-function releaseLine(release, checks) {
-    const branch = release.branch ? ` - ${release.branch}` : '';
-    const hotfix = release.hotfix ? ' [hotfix]' : '';
-    const createdAt = release.created_at
-        ? ` (${new Date(release.created_at).toLocaleString(undefined, { timeZoneName: 'short' })})`
-        : '';
-    const policies = checks ? ` ${releasePolicyCheckTag(checks.get(release.id))}` : '';
-    return `  - ${release.name} (ID: ${release.id})${branch}${hotfix}${createdAt}${policies}`;
-}
-/**
- * The releases for `-o json`: each gains `policy_check` (its stored check as the platform lists
- * it, without the release id it is keyed by, or `null` for a release with no stored check) when
- * the checks were read, and stays as served when they could not be, so a reader can tell an
- * unchecked release (`null`) from checks the CLI could not read (absent).
- */
-function withPolicyChecks(releases, checks) {
-    if (!checks)
-        return releases;
-    return releases.map(release => {
-        const check = checks.get(release.id);
-        if (!check)
-            return { ...release, policy_check: null };
-        const stored = { ...check };
-        delete stored.release_id;
-        return { ...release, policy_check: stored };
-    });
 }

package/dist/commands/release/push/index.js

@@ -2,9 +2,7 @@ import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
 import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { findFilesWithGuid, parseDocument } from '../../../utils/document-parser.js';
-import { policiesSkippedNotice } from '../../../utils/policy/feedback.js';
-import { releasePolicyRunLines } from '../../../utils/policy/release.js';
+import { findFilesWithGuid } from '../../../utils/document-parser.js';
 export default class ReleasePush extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS confirm with the user before creating a release from local files. Creates a new release from local XanoScript files via the multidoc endpoint.';
     static examples = [
@@ -112,12 +110,6 @@ Output release details as JSON
         if (documentEntries.length === 0) {
             this.error(`All .xs files in ${flags.directory} are empty`);
         }
-        // A release carries its policy files like its code.
-        const policyKeys = documentEntries
-            .map((entry) => parseDocument(entry.content))
-            .filter((document) => document?.type === 'policy')
-            .map((document) => document.name)
-            .sort();
         const multidoc = documentEntries.map((d) => d.content).join('\n---\n');
         // Construct the API URL with query params
         const queryParams = new URLSearchParams({
@@ -166,10 +158,6 @@ Output release details as JSON
                 this.error(errorMessage);
             }
             const release = (await response.json());
-            // The platform says which policy files it left out: all of them while the Policies feature is
-            // off, and those of a caller who may not author policies, whose release carries the live
-            // branch's policies instead.
-            const skipped = policiesSkippedNotice(release);
             if (flags.output === 'json') {
                 this.log(JSON.stringify(release, null, 2));
             }
@@ -183,14 +171,8 @@ Output release details as JSON
                     this.log(`  Description: ${release.description}`);
                 const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
                 this.log(`  Documents: ${documentEntries.length}`);
-                if (policyKeys.length > 0 && !skipped)
-                    this.log(`  Policy documents: ${policyKeys.length} (${policyKeys.join(', ')})`);
-                for (const line of releasePolicyRunLines(release.policy_run, release.name ?? flags.name))
-                    this.log(line);
                 this.log(`  Time: ${elapsed}s`);
             }
-            if (skipped)
-                this.warn(skipped);
         }
         catch (error) {
             if (error instanceof Error) {

package/dist/commands/sandbox/push/index.js

@@ -4,7 +4,6 @@ import { resolve } from 'node:path';
 import open from 'open';
 import BaseCommand from '../../../base-command.js';
 import { executePush } from '../../../utils/multidoc-push.js';
-import { policiesSkippedNotice } from '../../../utils/policy/feedback.js';
 export default class SandboxPush extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS run --dry-run first and show the user the output before pushing. Push local documents to your sandbox environment via multidoc import. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only. Include/exclude glob filters are intentionally not supported on sandbox push — partial pushes can hide deletions during review and lead to data loss when promoted to the workspace. Pushing into a sandbox that currently holds a different workspace will prompt for confirmation; run `xano sandbox reset` first to start clean.';
     static examples = [
@@ -127,7 +126,7 @@ Push and open sandbox review in the browser
             truncate: flags.truncate,
             verbose: flags.verbose,
         };
-        const result = await executePush({
+        await executePush({
             accessToken: profile.access_token,
             branch: '',
             command: this,
@@ -138,10 +137,6 @@ Push and open sandbox review in the browser
             },
             verboseFetch: this.verboseFetch.bind(this),
         }, target, pushFlags);
-        // When the platform leaves policy files out, it says so once.
-        const skipped = policiesSkippedNotice(result.response ?? result.preview);
-        if (skipped)
-            this.warn(skipped);
         if (flags.review) {
             await this.openReview(profile.instance_origin, profile.access_token, flags.verbose);
         }

package/dist/commands/tenant/create/index.d.ts

@@ -6,8 +6,6 @@ export default class TenantCreate extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
-        allow_deploy_bypass: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        allow_quick_deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         cluster_id: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -15,7 +13,6 @@ export default class TenantCreate extends BaseCommand {
         license: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         platform_id: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        required_reviewers: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
         tasks: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         type: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/tenant/create/index.js

@@ -17,20 +17,9 @@ Created tenant: Production (production) - ID: 42
 `,
         `$ xano tenant create "Staging" --description "Staging env" --cluster_id 1 --platform_id 1 --type tier2 -o json`,
         `$ xano tenant create "Staging" --type tier2 --cluster_id 1 --license ./license.yaml`,
-        `$ xano tenant create "Production" --required_reviewers 1 --allow_deploy_bypass`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
-        allow_deploy_bypass: Flags.boolean({
-            default: false,
-            description: 'Allow authorized users to bypass the deploy approval gate on this tenant (via tenant_deploy_request bypass). Has no effect unless --required_reviewers is also set above 0.',
-            required: false,
-        }),
-        allow_quick_deploy: Flags.boolean({
-            default: false,
-            description: 'Allow this tenant to skip the deploy approval gate entirely for quick deploys, regardless of --required_reviewers.',
-            required: false,
-        }),
         cluster_id: Flags.integer({
             description: 'Cluster ID to deploy to (required for tier2/tier3)',
             required: false,
@@ -65,11 +54,6 @@ Created tenant: Production (production) - ID: 42
             description: 'Platform ID to use',
             required: false,
         }),
-        required_reviewers: Flags.integer({
-            default: 0,
-            description: 'When greater than 0, that many distinct reviewers must approve a tenant_deploy_request before a release may be deployed to this tenant. 0 (default) means not gated.',
-            required: false,
-        }),
         tasks: Flags.boolean({
             allowNo: true,
             default: true,
@@ -95,11 +79,6 @@ Created tenant: Production (production) - ID: 42
             this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
         }
         const body = {
-            deploy_settings: {
-                allow_deploy_bypass: flags.allow_deploy_bypass,
-                allow_quick_deploy: flags.allow_quick_deploy,
-                required_reviewers: flags.required_reviewers,
-            },
             display: args.display,
             ingress: flags.ingress,
             license: flags.type,

package/dist/commands/tenant/deploy_release/index.d.ts

@@ -6,52 +6,12 @@ export default class TenantDeployRelease extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
-        check: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'override-reason': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         release: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
-    /** Set once the policy gate refuses the deploy, the one failure that exits 2. */
-    private refusedByPolicyGate;
-    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
     run(): Promise<void>;
-    /**
-     * `--check`: what the policy gate would decide for this release on this tenant, without deploying.
-     * Exits 2 when the deploy would be refused; a preview the platform cannot answer exits 1.
-     */
-    private checkPolicyGate;
-    /**
-     * Does an approved tenant_deploy_request already exist for this (tenant, release)
-     * pair? The list endpoint has no release filter, so this fetches approved
-     * requests for the tenant and filters client-side by the resolved release name.
-     */
-    private hasApprovedDeployRequest;
-    /** A deploy the policy gate refused: its verdict, then the refusal and how to proceed, exiting 2. */
-    private refuseByPolicyGate;
-    /**
-     * Does this tenant have the deploy approval gate enabled?
-     *
-     * Returns false if the tenant has `allow_quick_deploy` set — that flag lets a
-     * tenant skip the approval gate entirely for quick deploys, regardless of
-     * `required_reviewers`.
-     *
-     * Deliberately uses `tenant list` rather than `tenant get`: the single-tenant
-     * GET route's output whitelist (tenant-detail.yaml) omits `deploy_settings`
-     * (which holds `required_reviewers`, `allow_deploy_bypass`, and
-     * `allow_quick_deploy`) even though the list route's output includes it
-     * — confirmed live against a running instance. Filed as a backend bug; this
-     * is the workaround until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
-     */
-    private tenantRequiresApproval;
-    /** A release policy the tenant's import could not land (its key is held by another policy) is never dropped silently. */
-    private warnPoliciesSkipped;
 }