@xano/cli 1.3.1-beta.1 → 1.3.2

package/dist/commands/policy/runs/index.js

@@ -1,273 +0,0 @@
-import { Args, Flags } from '@oclif/core';
-import PolicyCommand from '../../../policy-command.js';
-import { quoted } from '../../../utils/policy/gate.js';
-import { releasePolicyRunLines, releaseRunLines } from '../../../utils/policy/release.js';
-import { listItems } from '../../../utils/policy/request.js';
-import { policyRunSummary, policyRunTable } from '../../../utils/policy/runs.js';
-/** A branch retains this many runs, and the run list serves at most this many. */
-const RUNS_RETAINED = 20;
-/** How many findings a run read prints unless `--limit` says otherwise, and the most a page holds. */
-const FINDINGS_LIMIT = 100;
-const FINDINGS_MAX = 500;
-/** The findings route's list filters, each a repeatable flag of the same name. */
-const LIST_FILTERS = ['policy', 'rule', 'severity', 'kind', 'object', 'tag'];
-/** The flags that page or filter one run's findings, so a run list refuses them. */
-const FINDING_FLAGS = ['offset', 'all', 'advisory', 'blocking', ...LIST_FILTERS, 'search'];
-/** How many releases a lookup by name reads a request, and the most requests it makes. */
-const RELEASES_PAGE = 100;
-const RELEASE_PAGES = 50;
-export default class PolicyRuns extends PolicyCommand {
-    static args = {
-        run_id: Args.string({
-            description: 'Run ID to read; omit to list the retained runs, newest first',
-            required: false,
-        }),
-    };
-    static description = "List the stored policy check runs, or read one of them a page of findings at a time. --release reads a release's check instead: the run stored when the release was cut, evaluated on what it ships against the policies it ships";
-    static examples = [
-        '$ xano policy runs',
-        '$ xano policy runs --limit 5',
-        '$ xano policy runs 1674 --run-detail',
-        '$ xano policy runs 1674 --offset 100 --limit 100',
-        '$ xano policy runs 1674 --all -o json',
-        '$ xano policy runs 1674 --blocking --policy AUTH-001 --severity critical --severity high',
-        '$ xano policy runs 1674 -o json',
-        '$ xano policy runs --release v1.2',
-        '$ xano policy runs --release v1.2 --blocking --all -o json',
-        '$ xano policy runs --release v1.2 --recheck',
-        '$ xano policy runs --release-id 12',
-    ];
-    static flags = {
-        ...PolicyCommand.policyFlags,
-        advisory: Flags.boolean({
-            default: false,
-            description: 'With a run ID, only the advisory findings',
-            exclusive: ['blocking'],
-        }),
-        all: Flags.boolean({
-            default: false,
-            description: 'With a run ID, read every page and print every finding that matches, instead of one page',
-            exclusive: ['offset', 'limit'],
-        }),
-        blocking: Flags.boolean({
-            default: false,
-            description: "With a run ID, only the blocking findings (an active mandatory policy's)",
-            exclusive: ['advisory'],
-        }),
-        kind: Flags.string({
-            description: 'With a run ID, only findings on this object kind (query, function, table, ...); repeatable',
-            multiple: true,
-        }),
-        limit: Flags.integer({
-            description: `How many runs to list, newest first (1-${RUNS_RETAINED}, default ${RUNS_RETAINED}: a branch retains at most ${RUNS_RETAINED}); with a run ID, how many findings to print (1-${FINDINGS_MAX}, default ${FINDINGS_LIMIT})`,
-            min: 1,
-        }),
-        object: Flags.string({
-            description: 'With a run ID, only findings on this object, written type:id as a finding names it (query:18); repeatable',
-            multiple: true,
-        }),
-        offset: Flags.integer({
-            description: "With a run ID, how many findings to skip, in the platform's order (blocking first)",
-            min: 0,
-        }),
-        policy: Flags.string({
-            description: 'With a run ID, only findings of this policy key; repeatable',
-            multiple: true,
-        }),
-        recheck: Flags.boolean({
-            default: false,
-            description: "With --release, check the release again from its archive and store the new run, then read it (a read-only credential is refused)",
-        }),
-        release: Flags.string({
-            description: "Read this release's policy check (by release name) instead of a branch's run; the finding flags page and filter it as they do a run's",
-            exclusive: ['branch', 'release-id'],
-        }),
-        'release-id': Flags.integer({
-            description: 'Read a release policy check by release ID, without looking up its name',
-            exclusive: ['branch', 'release'],
-            min: 1,
-        }),
-        rule: Flags.string({
-            description: 'With a run ID, only findings of this rule ID (AUTH-001.R1); repeatable',
-            multiple: true,
-        }),
-        'run-detail': Flags.boolean({
-            default: false,
-            description: 'With a run ID, also print the policy descriptions and rule settings that run recorded',
-        }),
-        search: Flags.string({
-            description: 'With a run ID, only findings whose policy key or title, rule title, object name or message contains this text',
-        }),
-        severity: Flags.string({
-            description: 'With a run ID, only findings of this severity (critical, high, medium, low); repeatable',
-            multiple: true,
-        }),
-        tag: Flags.string({
-            description: 'With a run ID, only findings whose policy or object carries this tag; repeatable',
-            multiple: true,
-        }),
-    };
-    async run() {
-        const { args, flags } = await this.parse(PolicyRuns);
-        if (flags.release !== undefined || flags['release-id'] !== undefined)
-            return this.readRelease(flags, args.run_id);
-        if (flags.recheck)
-            this.error('--recheck checks a release again: `xano policy runs --release <name> --recheck`.');
-        const { request } = this.policyTarget(flags);
-        const wanted = args.run_id?.trim() ?? '';
-        if (wanted === '')
-            return this.listRuns(request, flags);
-        // Runs older than the one `policy status` reads are reachable here by id.
-        if (!/^\d+$/.test(wanted))
-            this.error(`"${wanted}" is not a run ID. Run \`xano policy runs\` for the retained runs.`);
-        const limit = findingsLimit(this, flags);
-        // The run's summary and its findings a page at a time: neither reads the whole run, which can hold tens of thousands.
-        const head = (await request(`/run/${wanted}/summary`));
-        await this.reportRun({ flags, head, limit, path: `/run/${wanted}/findings`, reading: `run ${wanted}`, request });
-    }
-    /**
-     * `--all`: every finding that matches, read a page of 500 at a time in the platform's order, as
-     * one page. A run of many pages says on stderr what it is reading.
-     */
-    async everyFinding(request, path, reading, query) {
-        const items = [];
-        let total = Number.POSITIVE_INFINITY;
-        while (items.length < total) {
-            // eslint-disable-next-line no-await-in-loop -- one page at a time, each starting where the last ended
-            const page = (await request(path, 'GET', undefined, { ...query, limit: String(FINDINGS_MAX), offset: String(items.length) }));
-            if (items.length === 0 && page.total > FINDINGS_MAX)
-                this.logToStderr(`Reading ${page.total} findings of ${reading}, ${FINDINGS_MAX} a request (${Math.ceil(page.total / FINDINGS_MAX)} requests)...`);
-            total = page.total ?? 0;
-            if ((page.items ?? []).length === 0)
-                break;
-            items.push(...page.items);
-        }
-        return { items, limit: items.length, offset: 0, total: Number.isFinite(total) ? total : items.length };
-    }
-    /** The retained runs, newest first; the flags that read one run's findings are refused. */
-    async listRuns(request, flags) {
-        if (flags['run-detail'])
-            this.error('--run-detail reads one run: `xano policy runs <id> --run-detail`.');
-        const paging = FINDING_FLAGS.find(name => flags[name] !== undefined && flags[name] !== false);
-        if (paging)
-            this.error(`--${paging} pages one run's findings: \`xano policy runs <id> --${paging} ...\`.`);
-        const limit = flags.limit ?? RUNS_RETAINED;
-        if (limit > RUNS_RETAINED)
-            this.error(`--limit lists at most ${RUNS_RETAINED} runs: a branch retains only its newest ${RUNS_RETAINED}.`);
-        const result = await request('/run', 'GET', undefined, { limit: String(limit) });
-        if (flags.output === 'json') {
-            this.log(JSON.stringify(result, null, 2));
-            return;
-        }
-        const runs = listItems(result);
-        if (runs.length === 0) {
-            this.log('No policy runs retained on this branch.');
-            return;
-        }
-        for (const line of policyRunTable(runs))
-            this.log(line);
-        this.log('Only the most recent runs are retained per branch. Read one with `xano policy runs <id> --run-detail`.');
-    }
-    /**
-     * `--release <name>`: the release's stored check (`GET release/{id}/policy_run`) and a page of its
-     * findings, as a run is read. `--recheck` checks the release again from its archive first. A
-     * release with no check says so; under `-o json` it is `{run: null}`.
-     */
-    async readRelease(flags, runId) {
-        if (runId?.trim())
-            this.error('Read one run by its ID, or a release\'s check with --release, not both.');
-        const name = flags.release?.trim() ?? String(flags['release-id'] ?? '');
-        if (!name)
-            this.error('--release needs a release name.');
-        const limit = findingsLimit(this, flags);
-        const { request } = this.policyTarget(flags, { label: 'Release policy check', path: '' });
-        const releaseId = flags['release-id'] ?? await this.releaseId(request, name);
-        const route = `/release/${releaseId}/policy_run`;
-        const answer = (flags.recheck ? await request(route, 'POST', {}) : await request(route));
-        const check = flags.recheck ? { check: answer.check ?? null } : {};
-        // The recheck's outcome in a line: recorded with its verdict, or why nothing was recorded.
-        const rechecked = flags.recheck ? releasePolicyRunLines(answer.check, name).slice(0, 1).map(line => `Rechecked. ${line.trim()}`) : [];
-        const head = answer.run ?? null;
-        if (!head) {
-            if (flags.output === 'json') {
-                this.log(JSON.stringify({ ...check, run: null }, null, 2));
-                return;
-            }
-            for (const line of rechecked)
-                this.log(line);
-            this.log(`Release ${name} has no policy check.${flags.recheck ? '' : ' `--recheck` checks it now from its archive.'}`);
-            return;
-        }
-        await this.reportRun({
-            check,
-            flags,
-            head,
-            limit,
-            next: flags['release-id'] ? `xano policy runs --release-id ${releaseId}` : `xano policy runs --release ${quoted(name)}`,
-            path: `${route}/findings`,
-            preface: [...rechecked, ...releaseRunLines(name, releaseId, head)],
-            reading: `release ${name}`,
-            request,
-        });
-    }
-    /** The release's ID from its name, reading the workspace's releases a page at a time until it is found. */
-    async releaseId(request, name) {
-        for (let page = 1; page <= RELEASE_PAGES; page++) {
-            // eslint-disable-next-line no-await-in-loop -- pages in order, stopping at the release
-            const data = await request('/release', 'GET', undefined, { page: String(page), per_page: String(RELEASES_PAGE) });
-            const releases = Array.isArray(data) ? data : listItems(data);
-            const match = releases.find(release => release.name === name);
-            if (match)
-                return match.id;
-            if (releases.length < RELEASES_PAGE)
-                break;
-        }
-        return this.error(`Release '${name}' not found. \`xano release list\` lists the workspace's releases.`);
-    }
-    /**
-     * One run's summary and a page of its findings (`path`), or under `-o json` the summary with
-     * `findings` and `findings_page`, plus what `extra` adds to it.
-     */
-    async reportRun(opts) {
-        const { flags, head, limit, path, request } = opts;
-        const query = findingsQuery(flags, limit);
-        const page = flags.all
-            ? await this.everyFinding(request, path, opts.reading, query)
-            : (await request(path, 'GET', undefined, query));
-        const items = page.items ?? [];
-        const offset = page.offset ?? 0;
-        const total = page.total ?? items.length;
-        if (flags.output === 'json') {
-            const next = offset + items.length < total && items.length > 0 ? offset + items.length : null;
-            const findingsPage = { limit: page.limit ?? limit, next_offset: next, offset, total };
-            this.log(JSON.stringify({ ...head, ...opts.check, findings: items, findings_page: findingsPage }, null, 2));
-            return;
-        }
-        for (const line of opts.preface ?? [])
-            this.log(line);
-        const filtered = Object.keys(query).some(name => !['limit', 'offset'].includes(name));
-        for (const line of policyRunSummary({ ...head, findings: items }, { filtered, next: opts.next, offset, total }))
-            this.log(line);
-        if (flags['run-detail'])
-            this.logRunDetail(head);
-    }
-}
-/** How many findings a page prints: `--limit`, at most 500. */
-function findingsLimit(command, flags) {
-    const limit = flags.limit ?? FINDINGS_LIMIT;
-    if (limit > FINDINGS_MAX)
-        command.error(`--limit prints at most ${FINDINGS_MAX} findings a page; page on with --offset.`);
-    return limit;
-}
-/** The findings route's query for one page: `blocking` true or false, and each list filter given. */
-function findingsQuery(flags, limit) {
-    const query = { limit: String(limit), offset: String(flags.offset ?? 0) };
-    if (flags.blocking || flags.advisory)
-        query.blocking = String(flags.blocking);
-    for (const name of LIST_FILTERS)
-        if (flags[name]?.length)
-            query[name] = flags[name];
-    if (flags.search?.trim())
-        query.q = flags.search;
-    return query;
-}

package/dist/commands/policy/status/index.d.ts

@@ -1,21 +0,0 @@
-import PolicyCommand from '../../../policy-command.js';
-export default class PolicyStatus extends PolicyCommand {
-    static description: string;
-    static examples: string[];
-    static flags: {
-        'fail-on-findings': import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        'run-detail': import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    run(): Promise<void>;
-    /**
-     * The run every policy's `latest_run` answer was decided against, or none when the branch has no
-     * run: its summary, which counts each policy's findings without listing them.
-     */
-    private latestRun;
-}

package/dist/commands/policy/status/index.js

@@ -1,54 +0,0 @@
-import { Flags } from '@oclif/core';
-import PolicyCommand from '../../../policy-command.js';
-import { policyResultSummary } from '../../../utils/policy/findings.js';
-import { listAllPolicies } from '../../../utils/policy/request.js';
-import { computeStatusRows, enforcementLabel, findingsLabel, statusExitCode, statusExitReason, statusLabel, } from '../../../utils/policy/status.js';
-export default class PolicyStatus extends PolicyCommand {
-    static description = 'Show the latest policy check results without evaluating';
-    static examples = ['$ xano policy status -o json', '$ xano policy status --fail-on-findings -o json', '$ xano policy status --run-detail'];
-    static flags = {
-        ...PolicyCommand.policyFlags,
-        'fail-on-findings': Flags.boolean({
-            default: false,
-            description: 'Exit 2 for current blocking findings, whatever else is true; otherwise exit 1 for stale, missing or errored evaluation evidence',
-        }),
-        'run-detail': Flags.boolean({
-            default: false,
-            description: 'Also print what the latest run recorded: each policy description and the settings each rule ran with',
-        }),
-    };
-    async run() {
-        const { flags } = await this.parse(PolicyStatus);
-        const { request } = this.policyTarget(flags);
-        const policies = await listAllPolicies(request);
-        const run = await this.latestRun(request, policies);
-        const rows = computeStatusRows(policies, run);
-        const failOnFindings = flags['fail-on-findings'] ? { exit: statusExitCode(rows), reason: statusExitReason(rows) } : undefined;
-        if (flags.output === 'json') {
-            this.log(JSON.stringify({ policies, run: run ?? null, status: rows, ...(failOnFindings ? { fail_on_findings: failOnFindings } : {}) }, null, 2));
-        }
-        else if (rows.length === 0)
-            this.log('No policies found.');
-        else {
-            for (const row of rows)
-                this.log(`${row.key}  ${statusLabel(row)}  ${enforcementLabel(row.enforcement)}  ${findingsLabel(row)}  ${row.title ?? ''}`);
-            const counted = new Set(rows.filter((row) => row.counted).map((row) => row.key));
-            for (const line of policyResultSummary(run?.results?.filter((result) => counted.has(result.policy_key ?? ''))))
-                this.log(line);
-            if (flags['run-detail'] && run)
-                this.logRunDetail(run);
-            if (failOnFindings?.reason)
-                this.log(failOnFindings.reason);
-        }
-        if (failOnFindings?.exit)
-            process.exitCode = failOnFindings.exit;
-    }
-    /**
-     * The run every policy's `latest_run` answer was decided against, or none when the branch has no
-     * run: its summary, which counts each policy's findings without listing them.
-     */
-    async latestRun(request, policies) {
-        const runId = policies.map((policy) => policy.latest_run?.run_id).find(Boolean);
-        return runId ? (await request(`/run/${runId}/summary`)) : undefined;
-    }
-}

package/dist/commands/skills/pull/index.d.ts

@@ -1,30 +0,0 @@
-import PolicyCommand from '../../../policy-command.js';
-/**
- * The SKILL.md a coding agent reads: the CLI's own frontmatter (`name` and `description`), the
- * instance's content below it. The CLI always writes the frontmatter itself and drops any block the
- * served content opens with: frontmatter configures the agent (`allowed-tools`, `hooks`, `model`),
- * and a workspace knowledge record may replace the platform skill, so its text must never set it.
- * The description is written as a double-quoted YAML scalar, so a `:` or `#` in it stays a
- * description instead of becoming syntax.
- */
-export declare function buildSkillDocument(description: string, content: string): string;
-export default class SkillsPull extends PolicyCommand {
-    static description: string;
-    static examples: string[];
-    static flags: {
-        directory: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    /** Any failure exits 1 with its own message: this is not a `policy *` command to name. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
-    run(): Promise<void>;
-}

package/dist/commands/skills/pull/index.js

@@ -1,118 +0,0 @@
-import { Flags } from '@oclif/core';
-import * as fs from 'node:fs';
-import path from 'node:path';
-import PolicyCommand from '../../../policy-command.js';
-/** The one skill this command installs. The instance generates it from its check catalogue. */
-const SKILL = 'xano-policies';
-/**
- * The served content without a leading YAML frontmatter block, if it opens with one: the lines up
- * to and including the closing `---`, and the blank lines after it.
- */
-function stripFrontmatter(content) {
-    if (!/^---\r?\n/.test(content))
-        return content;
-    const lines = content.split(/\r?\n/);
-    const close = lines.indexOf('---', 1);
-    if (close === -1)
-        return content;
-    let start = close + 1;
-    while (start < lines.length && lines[start].trim() === '')
-        start++;
-    return lines.slice(start).join('\n');
-}
-/**
- * The SKILL.md a coding agent reads: the CLI's own frontmatter (`name` and `description`), the
- * instance's content below it. The CLI always writes the frontmatter itself and drops any block the
- * served content opens with: frontmatter configures the agent (`allowed-tools`, `hooks`, `model`),
- * and a workspace knowledge record may replace the platform skill, so its text must never set it.
- * The description is written as a double-quoted YAML scalar, so a `:` or `#` in it stays a
- * description instead of becoming syntax.
- */
-export function buildSkillDocument(description, content) {
-    // Exactly one trailing newline, whatever the instance sent, so a re-pull is byte-identical.
-    const body = `${stripFrontmatter(content).replace(/\n+$/, '')}\n`;
-    return `---\nname: ${SKILL}\ndescription: ${JSON.stringify(description)}\n---\n\n${body}`;
-}
-/** True when the path is a symbolic link; false when it is anything else or does not exist. */
-function isSymbolicLink(filePath) {
-    try {
-        return fs.lstatSync(filePath).isSymbolicLink();
-    }
-    catch (error) {
-        if (error.code === 'ENOENT')
-            return false;
-        throw error;
-    }
-}
-/**
- * Whether the served skill is the workspace's own knowledge record. A stored record has a positive
- * id; the skill the platform generates has none of its own (the platform serves it under a
- * negative sentinel id), so an item without a positive id is the platform's.
- */
-function isWorkspaceRecord(skill) {
-    return typeof skill.id === 'number' && Number.isInteger(skill.id) && skill.id > 0;
-}
-export default class SkillsPull extends PolicyCommand {
-    static description = `Install the ${SKILL} agent skill this instance generates
-
-Writes <directory>/.claude/skills/${SKILL}/SKILL.md, the project skill folder Claude Code reads, and replaces that file without a backup. A copy installed anywhere else, such as a global ~/.claude/skills/${SKILL} or another agent's skills folder, is not touched: remove it, so the agent does not load it instead.`;
-    static examples = [
-        `$ xano skills pull
-Wrote .claude/skills/${SKILL}/SKILL.md (${SKILL} skill for workspace 40, branch live)
-`,
-        '$ xano skills pull -d ./my-project',
-        '$ xano skills pull -b dev -o json',
-    ];
-    static flags = {
-        ...PolicyCommand.policyFlags,
-        directory: Flags.string({
-            char: 'd',
-            default: '.',
-            description: `Project directory whose .claude/skills/${SKILL}/SKILL.md is written (defaults to current directory)`,
-            required: false,
-        }),
-    };
-    /** Any failure exits 1 with its own message: this is not a `policy *` command to name. */
-    async catch(error) {
-        return this.catchAsOperational(error);
-    }
-    async run() {
-        const { flags } = await this.parse(SkillsPull);
-        // The route lives beside /policy under the workspace and is gated by the same
-        // `workspace:policy` permission, so it answers failures the way the policy commands do.
-        const { branch, request, workspace } = this.policyTarget(flags, { label: 'Agent skills', path: '/agent-skills' });
-        // `surface=cli` asks for the terminal wording of the skill, not the Studio one.
-        const payload = (await request('', 'GET', undefined, { surface: 'cli' }));
-        const items = Array.isArray(payload?.knowledge) ? payload.knowledge : [];
-        const skill = items.find((item) => typeof item?.name === 'string' && item.name.trim().toLowerCase() === SKILL);
-        if (!skill) {
-            this.error(`The instance returned no ${SKILL} skill for workspace ${workspace}, branch ${branch || 'live'}.`);
-        }
-        const document = buildSkillDocument(skill.description ?? '', skill.content ?? '');
-        const filePath = path.join(path.resolve(flags.directory), '.claude', 'skills', SKILL, 'SKILL.md');
-        // Writing through a symbolic link would overwrite whatever it points at.
-        if (isSymbolicLink(filePath)) {
-            this.error(`${filePath} is a symbolic link; remove it and run the command again. Nothing was written.`);
-        }
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        // The file is regenerated on every pull and no backup is kept.
-        fs.writeFileSync(filePath, document, 'utf8');
-        const own = isWorkspaceRecord(skill);
-        if (flags.output === 'json') {
-            this.log(JSON.stringify({
-                branch,
-                bytes: Buffer.byteLength(document, 'utf8'),
-                name: SKILL,
-                path: filePath,
-                source: own ? 'workspace' : 'platform',
-                workspace,
-            }, null, 2));
-            return;
-        }
-        const relative = path.relative(process.cwd(), filePath);
-        const shown = relative && !relative.startsWith('..') ? relative : filePath;
-        this.log(`Wrote ${shown} (${SKILL} skill for workspace ${workspace}, branch ${branch || 'live'})`);
-        if (own)
-            this.log(`This is the workspace's own ${SKILL} knowledge record, which replaces the platform skill.`);
-    }
-}

package/dist/commands/tenant_deploy_request/bypass/index.d.ts

@@ -1,31 +0,0 @@
-import BaseCommand from '../../../base-command.js';
-export default class TenantDeployRequestBypass extends BaseCommand {
-    static args: {
-        id: import("@oclif/core/interfaces").Arg<number, {
-            max?: number;
-            min?: number;
-        }>;
-    };
-    static description: string;
-    static examples: string[];
-    static flags: {
-        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        'override-policy': import("@oclif/core/interfaces").BooleanFlag<boolean>;
-        reason: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
-        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
-        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
-    };
-    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
-    private refusedByPolicyGate;
-    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
-    protected catch(error: Error & {
-        oclif?: {
-            exit?: number;
-        };
-    }): Promise<void>;
-    run(): Promise<void>;
-    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
-    private refuseByPolicyGate;
-}

package/dist/commands/tenant_deploy_request/bypass/index.js

@@ -1,109 +0,0 @@
-import { Args, Flags } from '@oclif/core';
-import BaseCommand from '../../../base-command.js';
-import { gateOverrideHint, gateRefusal, gateRefusalOutput } from '../../../utils/policy/gate.js';
-export default class TenantDeployRequestBypass extends BaseCommand {
-    static args = {
-        id: Args.integer({
-            description: 'Tenant deploy request ID',
-            required: true,
-        }),
-    };
-    static description = "[CRITICAL] STOP and confirm with the user before running this; it deploys the release immediately, past the review workflow. Deploy the request's release past the approval gate under the tenant_center:deploy:bypass_approval permission. Only available if the tenant has enabled bypass (allow_deploy_bypass), and every use is logged with the given reason. The approval request's own status is left untouched. The deploy is still gated on the release's policy check: a refusal exits 2, and --override-policy proceeds past it with the same --reason (needs the workspace:policy update permission).";
-    static examples = [
-        `$ xano tenant_deploy_request bypass 12 --reason "Prod incident, reviewer unavailable"
-Deployed tenant release, bypassing deploy request #12's approval gate.
-`,
-        `$ xano tenant_deploy_request bypass 12 --reason "Prod incident; AUTH-001 finding accepted" --override-policy`,
-    ];
-    static flags = {
-        ...BaseCommand.baseFlags,
-        output: Flags.string({
-            char: 'o',
-            default: 'summary',
-            description: 'Output format',
-            options: ['summary', 'json'],
-            required: false,
-        }),
-        'override-policy': Flags.boolean({
-            default: false,
-            description: 'Also proceed past a blocking policy gate, recording --reason as the override reason (needs the workspace:policy update permission; audited)',
-        }),
-        reason: Flags.string({
-            description: 'Reason for bypassing the approval gate (required, audited)',
-            required: true,
-        }),
-        workspace: Flags.string({
-            char: 'w',
-            description: 'Workspace ID (uses profile workspace if not provided)',
-            required: false,
-        }),
-    };
-    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
-    refusedByPolicyGate = false;
-    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
-    async catch(error) {
-        if (this.refusedByPolicyGate)
-            return super.catch(error);
-        return this.catchAsOperational(error);
-    }
-    async run() {
-        const { args, flags } = await this.parse(TenantDeployRequestBypass);
-        const { profile } = this.resolveProfile(flags);
-        const workspaceId = flags.workspace || profile.workspace;
-        if (!workspaceId) {
-            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
-        }
-        const body = {
-            reason: flags.reason,
-            ...(flags['override-policy'] ? { override_policy: true } : {}),
-        };
-        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
-        let refused = null;
-        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}/override`;
-        try {
-            const response = await this.verboseFetch(apiUrl, {
-                body: JSON.stringify(body),
-                headers: {
-                    accept: 'application/json',
-                    Authorization: `Bearer ${profile.access_token}`,
-                    'Content-Type': 'application/json',
-                },
-                method: 'POST',
-            }, flags.verbose, profile.access_token);
-            if (!response.ok) {
-                refused = await gateRefusal(response);
-                if (refused)
-                    this.refuseByPolicyGate(refused, args.id, flags.output === 'json');
-                const message = await this.parseApiError(response, 'Failed to bypass tenant deploy request approval gate');
-                this.error(message);
-            }
-            const deploy = (await response.json());
-            if (flags.output === 'json') {
-                this.log(JSON.stringify(deploy, null, 2));
-            }
-            else {
-                this.log(`Deployed tenant release, bypassing deploy request #${args.id}'s approval gate.`);
-                if (deploy.duration_ms !== undefined)
-                    this.log(`  Time: ${(deploy.duration_ms / 1000).toFixed(1)}s`);
-            }
-        }
-        catch (error) {
-            if (refused)
-                throw error;
-            if (error instanceof Error) {
-                this.error(`Failed to bypass tenant deploy request approval gate: ${error.message}`);
-            }
-            else {
-                this.error(`Failed to bypass tenant deploy request approval gate: ${String(error)}`);
-            }
-        }
-    }
-    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
-    refuseByPolicyGate(refused, id, json) {
-        for (const line of gateRefusalOutput(refused, json))
-            this.log(line);
-        const override = `xano tenant_deploy_request bypass ${id} --reason "<why>" --override-policy`;
-        this.refusedByPolicyGate = true;
-        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
-    }
-}