@xano/cli 1.3.3 → 1.3.5-beta.0

package/dist/commands/function/edit/index.js

@@ -5,6 +5,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import path from 'node:path';
 import BaseCommand, { buildUserAgent } from '../../../base-command.js';
+import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateRefusal, publishRefusal, quoted } from '../../../utils/policy/gate.js';
 export default class FunctionEdit extends BaseCommand {
     static args = {
         function_id: Args.string({
@@ -81,6 +82,7 @@ Name: my_function
             options: ['summary', 'json'],
             required: false,
         }),
+        'policy-override': Flags.string({ description: 'Publish past a blocking live-branch publish policy gate with an audited reason (requires workspace:policy update)', hidden: true }),
         publish: Flags.boolean({
             default: true,
             description: 'Publish the function after editing',
@@ -99,8 +101,18 @@ Name: my_function
             required: false,
         }),
     };
+    /** Set once the publish policy gate refuses, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the publish gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(FunctionEdit);
+        if (blankPolicyOverride(flags['policy-override']))
+            this.error(BLANK_POLICY_OVERRIDE);
         const { profile, profileName } = this.resolveProfile(flags);
         // Validate flag combinations
         if (flags.edit && !flags.file) {
@@ -175,6 +187,10 @@ Name: my_function
             include_xanoscript: 'false',
             publish: flags.publish ? 'true' : 'false',
         });
+        // A reason from someone with workspace:policy update publishes past a blocking publish gate.
+        const overrideReason = flags['policy-override']?.trim();
+        if (overrideReason)
+            queryParams.set('override_reason', overrideReason);
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function/${functionId}?${queryParams.toString()}`;
         // Update function via API
         try {
@@ -188,6 +204,9 @@ Name: my_function
                 method: 'PUT',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
+                const refused = await gateRefusal(response);
+                if (refused)
+                    this.refusePublish(refused, flags, functionId);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -208,6 +227,8 @@ Name: my_function
             }
         }
         catch (error) {
+            if (this.refusedByPolicyGate)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to update function: ${error.message}`);
             }
@@ -428,4 +449,22 @@ Name: my_function
             process.stdin.resume();
         });
     }
+    /**
+     * The live-branch publish gate refused the update: the verdict on stdout (under `-o json`,
+     * `{updated: false, message, policy_gate}`), then the platform's message and how to proceed,
+     * exiting 2.
+     */
+    refusePublish(refused, flags, functionId) {
+        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
+        const source = flags.file ? ` -f ${quoted(flags.file)}` : flags.stdin ? ' --stdin' : '';
+        const { lines, message } = publishRefusal(refused, {
+            json: flags.output === 'json',
+            outcome: 'updated',
+            rerun: `xano function edit ${quoted(functionId)}${workspace}${source} --policy-override "<why>"`,
+        });
+        for (const line of lines)
+            this.log(line);
+        this.refusedByPolicyGate = true;
+        this.error(message, { exit: 2 });
+    }
 }

package/dist/commands/function/run/index.js

@@ -103,7 +103,6 @@ export default class FunctionRun extends BaseCommand {
                 branch,
                 name: functionName,
                 profile,
-                tenant: flags.tenant,
                 verbose: flags.verbose,
                 workspaceId,
             });
@@ -115,8 +114,9 @@ export default class FunctionRun extends BaseCommand {
                 input = await this.promptForMissing(input, missingRequired);
             }
         }
-        // 3) Execute via the meta run endpoint.
-        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function/run`;
+        // 3) Execute via the meta run endpoint, scoped to the tenant when one is given.
+        const tenantPath = flags.tenant ? `/tenant/${encodeURIComponent(flags.tenant)}` : '';
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}${tenantPath}/function/run`;
         const body = { input, name: functionName };
         if (branch)
             body.branch = branch;
@@ -132,9 +132,6 @@ export default class FunctionRun extends BaseCommand {
         const dataSource = flags.datasource?.trim();
         if (dataSource)
             headers['X-Data-Source'] = dataSource;
-        // X-Tenant runs the function on that tenant instead of the workspace.
-        if (flags.tenant)
-            headers['X-Tenant'] = flags.tenant;
         const response = await this.verboseFetch(apiUrl, {
             body: JSON.stringify(body),
             headers,
@@ -177,16 +174,13 @@ export default class FunctionRun extends BaseCommand {
      * transient introspection problem never blocks an otherwise-valid run.
      */
     async fetchFunctionByName(opts) {
-        const { branch, name, profile, tenant, verbose, workspaceId } = opts;
+        const { branch, name, profile, verbose, workspaceId } = opts;
         const params = new URLSearchParams({ per_page: '100', search: name });
         if (branch)
             params.set('branch', branch);
         const url = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/function?${params.toString()}`;
-        const headers = { accept: 'application/json', Authorization: `Bearer ${profile.access_token}` };
-        if (tenant)
-            headers['X-Tenant'] = tenant;
         try {
-            const response = await this.verboseFetch(url, { headers, method: 'GET' }, verbose, profile.access_token);
+            const response = await this.verboseFetch(url, { headers: { accept: 'application/json', Authorization: `Bearer ${profile.access_token}` }, method: 'GET' }, verbose, profile.access_token);
             if (!response.ok)
                 return undefined;
             const page = (await response.json());

package/dist/commands/policy/catalogue/index.d.ts

@@ -0,0 +1,16 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyCatalogue extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        check: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        recipe: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/catalogue/index.js

@@ -0,0 +1,60 @@
+import { Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { policyCatalogueSummary, policyNotCheckableSummary, policyRecipeSummary, policyTemplateSummary, selectCatalogueCheck, selectCatalogueRecipe, } from '../../../utils/policy/catalogue.js';
+import { listItems } from '../../../utils/policy/request.js';
+/** A served list, or none when the instance serves something else (an older one serves no recipes). */
+const array = (value) => Array.isArray(value) ? value : [];
+export default class PolicyCatalogue extends PolicyCommand {
+    static description = 'List built-in policy checks with their uses and parameter schemas, the templates a policy can start from, the recipes that combine them and what no check can see';
+    static examples = [
+        '$ xano policy catalogue -o json',
+        '$ xano policy catalogue --check object.auth_required',
+        '$ xano policy catalogue --recipe protect_card_data',
+    ];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        check: Flags.string({ description: 'Show only this check id (an unknown id names the closest matches)', exclusive: ['recipe'] }),
+        recipe: Flags.string({ description: 'Show only this recipe id and what it cannot see (an unknown id names the closest matches)', exclusive: ['check'] }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyCatalogue);
+        const { request } = this.policyTarget(flags);
+        const result = await request('/check');
+        const sections = (result && typeof result === 'object' ? result : {});
+        const recipeContext = {
+            frameworks: array(sections.template_frameworks),
+            frameworksNote: sections.template_frameworks_note ?? '',
+            notCheckable: array(sections.not_checkable),
+            templates: array(sections.templates),
+        };
+        if (flags.check) {
+            // `--check` narrows both output modes, so `-o json` stays pipeable for one check too.
+            const selected = selectCatalogueCheck(listItems(result), flags.check);
+            this.log(flags.output === 'json' ? JSON.stringify(selected, null, 2) : policyCatalogueSummary(selected).join('\n'));
+        }
+        else if (flags.recipe) {
+            // `--recipe` narrows both output modes too; the summary adds the topics the recipe cannot see.
+            const selected = selectCatalogueRecipe(array(sections.recipes), flags.recipe);
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(selected, null, 2));
+                return;
+            }
+            const cited = new Set(selected.flatMap(recipe => array(recipe.limits)));
+            const limits = recipeContext.notCheckable.filter(entry => cited.has(entry.id));
+            this.log([...policyRecipeSummary(selected, recipeContext), ...(limits.length > 0 ? ['', ...policyNotCheckableSummary(limits)] : [])].join('\n'));
+        }
+        else if (flags.output === 'json') {
+            this.log(JSON.stringify(result, null, 2));
+        }
+        else {
+            for (const line of policyCatalogueSummary(listItems(result)))
+                this.log(line);
+            const templates = policyTemplateSummary(recipeContext.templates, array(sections.template_categories), recipeContext.frameworks, recipeContext.frameworksNote);
+            const recipes = policyRecipeSummary(array(sections.recipes), recipeContext);
+            const notCheckable = policyNotCheckableSummary(recipeContext.notCheckable);
+            for (const section of [templates, recipes, notCheckable])
+                if (section.length > 0)
+                    this.log(['', ...section].join('\n'));
+        }
+    }
+}

package/dist/commands/policy/coverage/index.d.ts

@@ -0,0 +1,17 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyCoverage extends PolicyCommand {
+    static args: {
+        object: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/coverage/index.js

@@ -0,0 +1,33 @@
+import { Args } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { coverageLines, parseObjectRef } from '../../../utils/policy/coverage.js';
+export default class PolicyCoverage extends PolicyCommand {
+    static args = {
+        object: Args.string({
+            description: 'The object, written type:id as findings name it (query:42, function:12, table:7); for workspace, the workspace\'s own id (workspace:17)',
+            required: true,
+        }),
+    };
+    static description = "Show which active policies apply to one object, why, and the object's findings in the branch's latest run, "
+        + 'with each fix hint. Needs only the read permission for that object kind (workspace:api for an endpoint, '
+        + 'workspace:function for a function, …), not workspace:policy; the answer leaves out policy details that need it.';
+    static examples = [
+        '$ xano policy coverage query:42',
+        '$ xano policy coverage function:12 -b dev -o json',
+    ];
+    static flags = { ...PolicyCommand.policyFlags };
+    async run() {
+        const { args, flags } = await this.parse(PolicyCoverage);
+        const object = parseObjectRef(args.object);
+        if (!object)
+            this.error(`Name the object as type:id, as findings name it (for example query:42); got "${args.object}".`);
+        const { request } = this.policyTarget(flags);
+        const answer = (await request('/object/coverage', 'GET', undefined, { id: String(object.id), type: object.type }));
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(answer, null, 2));
+            return;
+        }
+        for (const line of coverageLines(answer))
+            this.log(line);
+    }
+}

package/dist/commands/policy/create/index.d.ts

@@ -0,0 +1,18 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyCreate extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        key: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        param: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        template: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/create/index.js

@@ -0,0 +1,44 @@
+import { Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { listAllPolicies } from '../../../utils/policy/request.js';
+import { policyFromTemplate, recipeRefusal } from '../../../utils/policy/template.js';
+export default class PolicyCreate extends PolicyCommand {
+    static description = 'Create an independent policy from a platform template';
+    static examples = [
+        '$ xano policy create --template endpoints_need_login -b dev',
+        `$ xano policy create --template no_pii_in_responses --key DATA-020 --param 'fields=["email","ssn"]'`,
+    ];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        ...PolicyCommand.publishFlags,
+        key: Flags.string({ description: 'New policy key (default: the template key with a free numeric suffix if taken)' }),
+        param: Flags.string({ description: 'Parameter override: N.path=JSON, 1-based rule number; path=JSON for a single-rule template', multiple: true }),
+        template: Flags.string({ description: 'Template id from policy catalogue', required: true }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyCreate);
+        const target = this.policyTarget(flags);
+        const { request } = target;
+        const catalogue = await request('/check');
+        const template = catalogue.templates?.find(item => item.id === flags.template);
+        // A recipe is data with no create action: name the templates it points at instead.
+        const recipe = template || !Array.isArray(catalogue.recipes) ? undefined : catalogue.recipes.find(item => item.id === flags.template);
+        if (recipe)
+            this.error(recipeRefusal(recipe));
+        if (!template)
+            this.error(`Unknown template "${flags.template}". Run xano policy catalogue to see this instance's templates.`);
+        const keys = (await listAllPolicies(request)).map(policy => policy.key);
+        // The key is checked against the pattern this instance's catalogue serves, and an unfilled need's
+        // example falls back to its check's own.
+        const document = policyFromTemplate(template, keys, { checks: catalogue.items, key: flags.key, keyRule: catalogue.document?.key, overrides: flags.param });
+        const parsed = await this.parseSource(request, { data: document });
+        const saved = await request('', 'POST', { data: { source: parsed.source }, ...(flags.message ? { message: flags.message } : {}) });
+        if (typeof saved?.id !== 'number')
+            this.error('The platform did not return the saved policy. Check xano policy list before retrying.');
+        this.logRuleWarnings(parsed);
+        if (flags.output === 'json')
+            this.log(JSON.stringify(saved, null, 2));
+        else
+            this.log(`Created ${parsed.policy.key} (Version ${saved.version}) in ${this.where(target)}.`);
+    }
+}

package/dist/commands/policy/delete/index.d.ts

@@ -0,0 +1,19 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyDelete extends PolicyCommand {
+    static args: {
+        policy: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** `workspace push` is additive, so deleting a policy file leaves the policy in place; this removes it. */
+    run(): Promise<void>;
+}

package/dist/commands/policy/delete/index.js

@@ -0,0 +1,61 @@
+import { Args, Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { confirm } from '../../../utils/multidoc-push.js';
+import { listAllPolicies, sameKey } from '../../../utils/policy/request.js';
+export default class PolicyDelete extends PolicyCommand {
+    static args = {
+        policy: Args.string({
+            description: 'Policy key (AUTH-001) or ID to delete',
+            required: true,
+        }),
+    };
+    static description = 'Delete a policy from a branch; its Version History is kept. It needs the workspace:policy delete permission only, an active, blocking policy included.';
+    static examples = [
+        `$ xano policy delete TMP-DX-001
+Delete policy TMP-DX-001 (ID: 922, Version 2) from workspace 3? Its Version History is kept. (y/N) y
+Deleted policy TMP-DX-001 (ID: 922) from workspace 3.
+`,
+        '$ xano policy delete 922 --force',
+        '$ xano policy delete TMP-DX-001 -w 3 --force -o json',
+    ];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        force: Flags.boolean({
+            char: 'f',
+            default: false,
+            description: '[IMPORTANT] NEVER run without explicit user confirmation. Skips the confirmation prompt.',
+        }),
+    };
+    /** `workspace push` is additive, so deleting a policy file leaves the policy in place; this removes it. */
+    async run() {
+        const { args, flags } = await this.parse(PolicyDelete);
+        const target = this.policyTarget(flags);
+        const wanted = args.policy.trim();
+        if (!wanted)
+            this.error('Provide the policy key or ID to delete.');
+        const policies = await listAllPolicies(target.request);
+        const matched = policies.find((policy) => sameKey(policy.key, wanted))
+            ?? (/^\d+$/.test(wanted) ? policies.find((policy) => policy.id === Number(wanted)) : undefined);
+        if (!matched) {
+            const known = policies.map((policy) => policy.key).sort();
+            this.error(`No policy "${wanted}" on ${this.where(target)}.${known.length > 0 ? ` This branch has: ${known.join(', ')}.` : ' This branch has no policies.'}`);
+        }
+        if (!flags.force) {
+            // Nobody can answer the prompt: refuse rather than report a cancel as success.
+            if (!process.stdin.isTTY)
+                this.error('Non-interactive environment detected. Use --force to skip confirmation.');
+            const confirmed = await confirm(`Delete policy ${matched.key} (ID: ${matched.id}, Version ${matched.version}) from ${this.where(target)}? Its Version History is kept.`);
+            if (!confirmed) {
+                this.log('Deletion cancelled.');
+                return;
+            }
+        }
+        // The policy as listed is what the prompt named: a delete of a policy changed since is refused (`policy_stale`).
+        const staleCheck = matched.updated_at ? { last_updated_at: String(matched.updated_at) } : {};
+        await target.request(`/${matched.id}`, 'DELETE', undefined, staleCheck);
+        if (flags.output === 'json')
+            this.log(JSON.stringify({ deleted: true, id: matched.id, key: matched.key }, null, 2));
+        else
+            this.log(`Deleted policy ${matched.key} (ID: ${matched.id}) from ${this.where(target)}.`);
+    }
+}

package/dist/commands/policy/evaluate/index.d.ts

@@ -0,0 +1,32 @@
+import PolicyCommand from '../../../policy-command.js';
+/** One rule's clear objects in a trial's answer: the first ones and how many there are. */
+type TrialClear = {
+    items?: Array<{
+        name?: string;
+    }>;
+    policy_key?: string;
+    rule_id?: string;
+    total?: number;
+};
+/**
+ * What a trial says it is, then each rule's clear objects: the objects it examined and found
+ * nothing on. A trial is never stored, so its answer is all there is to show.
+ */
+export declare function trialLines(key: string, clear: TrialClear[] | undefined): string[];
+export default class PolicyEvaluate extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        policy: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'run-detail': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        summary: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+export {};

package/dist/commands/policy/evaluate/index.js

@@ -0,0 +1,71 @@
+import { Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { evaluationEvidence, notStoredLine, policyCheckWarning, policyExitCode, policySummary, } from '../../../utils/policy/feedback.js';
+/** How many clear objects a trial names per rule; the rest are counted. */
+const TRIAL_CLEAR_NAMES = 5;
+/**
+ * What a trial says it is, then each rule's clear objects: the objects it examined and found
+ * nothing on. A trial is never stored, so its answer is all there is to show.
+ */
+export function trialLines(key, clear) {
+    const lines = [`Trial of ${key}: this policy alone, evaluated without storing a run. It is not a report and gates nothing.`];
+    if (!clear?.length)
+        return lines;
+    lines.push('Clear objects (examined, nothing found):');
+    for (const rule of clear) {
+        const names = (rule.items ?? []).map((item) => item.name ?? '').filter(Boolean).slice(0, TRIAL_CLEAR_NAMES);
+        const total = rule.total ?? 0;
+        const more = total > names.length ? `${names.length > 0 ? ', ' : ''}${total - names.length} more` : '';
+        lines.push(`  ${rule.rule_id ?? ''}  ${total}${names.length > 0 || more ? `  ${names.join(', ')}${more}` : ''}`);
+    }
+    return lines;
+}
+export default class PolicyEvaluate extends PolicyCommand {
+    static description = 'Evaluate active branch policies and report their findings; blocking findings exit 2. With --policy, try one policy alone, whatever its state, without storing a run';
+    static examples = ['$ xano policy evaluate -o json', '$ xano policy evaluate --run-detail', '$ xano policy evaluate --summary -o json', '$ xano policy evaluate --policy AUTH-001'];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        policy: Flags.string({
+            description: 'Try this one policy (its key) alone, whatever its state: nothing is stored, and the answer lists each rule\'s clear objects',
+        }),
+        'run-detail': Flags.boolean({
+            default: false,
+            description: 'Also print what this run recorded: each policy description and the settings each rule ran with',
+        }),
+        summary: Flags.boolean({
+            default: false,
+            description: 'Answer the run summary and its first 50 findings instead of the whole run; `xano policy runs <id>` pages through the rest',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyEvaluate);
+        if (flags.policy !== undefined && !flags.policy.trim())
+            this.error('--policy must name a policy key.');
+        const { request } = this.policyTarget(flags);
+        // The evaluation answers with its run, so the run's own snapshot names any unnamed rule. The
+        // summary answer carries the same snapshot and results, and only the first findings.
+        const body = { ...(flags.summary ? { answer: 'summary' } : {}), ...(flags.policy ? { policy: flags.policy } : {}) };
+        const result = (await request('/evaluate', 'POST', Object.keys(body).length > 0 ? body : undefined));
+        if (flags.output === 'json')
+            this.log(JSON.stringify(result, null, 2));
+        else {
+            for (const line of policySummary(result.policy_check, evaluationEvidence(result)))
+                this.log(line);
+            // A trial is never stored by design; the "cannot record runs" note is about credentials.
+            const notStored = flags.policy ? null : notStoredLine(result);
+            if (notStored)
+                this.log(notStored);
+            if (flags.policy)
+                for (const line of trialLines(flags.policy, result.clear))
+                    this.log(line);
+            if (flags['run-detail'])
+                this.logRunDetail(result);
+        }
+        const warning = policyCheckWarning(result.policy_check);
+        if (warning)
+            this.warn(warning);
+        const code = policyExitCode(result.policy_check);
+        if (code)
+            process.exitCode = code;
+    }
+}

package/dist/commands/policy/list/index.d.ts

@@ -0,0 +1,14 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyList extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/list/index.js

@@ -0,0 +1,21 @@
+import PolicyCommand from '../../../policy-command.js';
+import { listItems } from '../../../utils/policy/request.js';
+export default class PolicyList extends PolicyCommand {
+    static description = 'List workspace policies and their descriptions';
+    static examples = ['$ xano policy list -o json'];
+    static flags = { ...PolicyCommand.policyFlags };
+    async run() {
+        const { flags } = await this.parse(PolicyList);
+        const { request } = this.policyTarget(flags);
+        const result = await request();
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const policies = listItems(result);
+        if (policies.length === 0)
+            this.log('No policies found.');
+        for (const policy of policies)
+            this.log(`${policy.key}  ${policy.active ? `Active, ${policy.enforcement === 'blocking' ? 'Blocking' : 'Advisory'}` : 'Inactive'}  ${policy.title ?? ''} (ID: ${policy.id}, Version ${policy.version})`);
+    }
+}

package/dist/commands/policy/parse/index.d.ts

@@ -0,0 +1,19 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyParse extends PolicyCommand {
+    static args: {
+        file: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/policy/parse/index.js

@@ -0,0 +1,18 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyParse extends PolicyCommand {
+    static args = { ...PolicyCommand.sourceArgs };
+    static description = 'Validate and format policy XanoScript using the platform parser, with rule warnings against the branch';
+    static examples = [
+        '$ xano policy parse policies/AUTH-001.xs',
+        '$ xano policy parse --file policies/AUTH-001.xs',
+    ];
+    static flags = { ...PolicyCommand.policyFlags, ...PolicyCommand.sourceFlags };
+    async run() {
+        const { args, flags } = await this.parse(PolicyParse);
+        const { request } = this.policyTarget(flags);
+        const parsed = await this.parseSource(request, { source: this.readSource(flags, args.file) });
+        this.log(flags.output === 'json' ? JSON.stringify(parsed, null, 2) : parsed.source);
+        if (flags.output !== 'json')
+            this.logRuleWarnings(parsed);
+    }
+}

package/dist/commands/policy/publish/index.d.ts

@@ -0,0 +1,20 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyPublish extends PolicyCommand {
+    static args: {
+        file: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}