@xano/cli 1.3.3 → 1.3.5-beta.0

package/dist/commands/tenant/deploy_release/index.d.ts

@@ -6,12 +6,52 @@ export default class TenantDeployRelease extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        check: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'override-reason': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         release: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    /** Set once the policy gate refuses the deploy, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
     run(): Promise<void>;
+    /**
+     * `--check`: what the policy gate would decide for this release on this tenant, without deploying.
+     * Exits 2 when the deploy would be refused; a preview the platform cannot answer exits 1.
+     */
+    private checkPolicyGate;
+    /**
+     * Does an approved tenant_deploy_request already exist for this (tenant, release)
+     * pair? The list endpoint has no release filter, so this fetches approved
+     * requests for the tenant and filters client-side by the resolved release name.
+     */
+    private hasApprovedDeployRequest;
+    /** A deploy the policy gate refused: its verdict, then the refusal and how to proceed, exiting 2. */
+    private refuseByPolicyGate;
+    /**
+     * Does this tenant have the deploy approval gate enabled?
+     *
+     * Returns false if the tenant has `allow_quick_deploy` set — that flag lets a
+     * tenant skip the approval gate entirely for quick deploys, regardless of
+     * `required_reviewers`.
+     *
+     * Deliberately uses `tenant list` rather than `tenant get`: the single-tenant
+     * GET route's output whitelist (tenant-detail.yaml) omits `deploy_settings`
+     * (which holds `required_reviewers`, `allow_deploy_bypass`, and
+     * `allow_quick_deploy`) even though the list route's output includes it
+     * — confirmed live against a running instance. Filed as a backend bug; this
+     * is the workaround until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+     */
+    private tenantRequiresApproval;
+    /** A release policy the tenant's import could not land (its key is held by another policy) is never dropped silently. */
+    private warnPoliciesSkipped;
 }

package/dist/commands/tenant/deploy_release/index.js

@@ -1,5 +1,7 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { deployedGateLine, fetchPolicyGate, gateExitCode, gateLines, gateOverrideHint, gateRefusal, gateRefusalOutput, quoted, } from '../../../utils/policy/gate.js';
+import { policyPermissionGuidance } from '../../../utils/policy/permission.js';
 export default class TenantDeployRelease extends BaseCommand {
     static args = {
         tenant_name: Args.string({
@@ -7,7 +9,7 @@ export default class TenantDeployRelease extends BaseCommand {
             required: true,
         }),
     };
-    static description = '[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant.';
+    static description = "[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant.";
     static examples = [
         `$ xano tenant deploy_release t1234-abcd-xyz1 --release v1.0
 Deployed release "v1.0" to tenant: My Tenant (my-tenant)
@@ -16,6 +18,12 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        check: Flags.boolean({
+            default: false,
+            description: "Preview the release's policy gate on this tenant without deploying; exits 2 when the deploy would be refused",
+            exclusive: ['override-reason'],
+            hidden: true,
+        }),
         output: Flags.string({
             char: 'o',
             default: 'summary',
@@ -23,6 +31,11 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             options: ['summary', 'json'],
             required: false,
         }),
+        'override-reason': Flags.string({
+            description: 'Deploy past a blocking policy gate, recording this reason (needs the workspace:policy update permission; audited)',
+            exclusive: ['check'],
+            hidden: true,
+        }),
         release: Flags.string({
             char: 'r',
             description: 'Release name to deploy',
@@ -34,6 +47,14 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             required: false,
         }),
     };
+    /** Set once the policy gate refuses the deploy, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(TenantDeployRelease);
         const { profile } = this.resolveProfile(flags);
@@ -43,12 +64,46 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
         }
         const releaseName = flags.release;
         const tenantName = args.tenant_name;
+        if (flags.check) {
+            await this.checkPolicyGate({ flags, profile, releaseName, tenantName, workspaceId });
+            return;
+        }
+        const overrideReason = flags['override-reason']?.trim();
+        if (flags['override-reason'] !== undefined && !overrideReason) {
+            this.error('--override-reason needs a reason: say why this deploy may proceed past the policy gate.');
+        }
+        // Pre-flight: the "approval required" error must always be shown before any
+        // permission/RBAC error. The backend's own deploy route checks RBAC first
+        // and the approval gate second (inside mvp:tenant_deploy_release), so a
+        // caller who lacks deploy permission would otherwise never learn a request
+        // is what's actually needed. Checking here first, with an endpoint that
+        // only needs read scope, guarantees the right error is shown regardless of
+        // whether the caller can deploy at all.
+        const requiresApproval = await this.tenantRequiresApproval(profile, workspaceId, tenantName, flags.verbose);
+        if (requiresApproval) {
+            const hasApprovedRequest = await this.hasApprovedDeployRequest({
+                profile,
+                releaseName,
+                tenantName,
+                verbose: flags.verbose,
+                workspaceId,
+            });
+            if (!hasApprovedRequest) {
+                this.error(`Tenant "${tenantName}" requires an approved deploy request before "${releaseName}" can be deployed.\n` +
+                    `Run: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`);
+            }
+        }
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${tenantName}/deploy`;
         this.warn('This may take a few minutes. Please be patient.');
         const startTime = Date.now();
+        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
+        let refused = null;
         try {
             const response = await this.verboseFetch(apiUrl, {
-                body: JSON.stringify({ release_name: releaseName }),
+                body: JSON.stringify({
+                    release_name: releaseName,
+                    ...(overrideReason ? { override_policy: true, override_reason: overrideReason } : {}),
+                }),
                 headers: {
                     accept: 'application/json',
                     Authorization: `Bearer ${profile.access_token}`,
@@ -57,8 +112,22 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                const errorText = await response.text();
-                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+                refused = await gateRefusal(response);
+                if (refused) {
+                    const override = `xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`;
+                    this.refuseByPolicyGate(refused, flags, override);
+                }
+                let message = await this.parseApiError(response, 'API request failed');
+                // Only reached once the pre-flight above has already confirmed the
+                // approval gate is satisfied or not applicable — so a permission error
+                // here is genuinely about RBAC, not about a missing approval. If the
+                // tenant supports deploy requests, mention that path as an alternative
+                // to direct deploy, since opening a request doesn't require deploy
+                // permission.
+                if ((response.status === 401 || response.status === 403) && requiresApproval) {
+                    message += `\n\nYou don't have permission to deploy to this tenant directly, but it supports deploy requests: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`;
+                }
+                this.error(message);
             }
             const tenant = (await response.json());
             if (flags.output === 'json') {
@@ -71,10 +140,15 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
                     this.log(`  State: ${tenant.state}`);
                 if (tenant.release?.name)
                     this.log(`  Release: ${tenant.release.name}`);
+                if (tenant.policy_gate?.status && tenant.policy_gate.status !== 'disabled')
+                    this.log(`  ${deployedGateLine(tenant.policy_gate)}`);
                 this.log(`  Time: ${elapsed}s`);
             }
+            this.warnPoliciesSkipped(tenant);
         }
         catch (error) {
+            if (refused)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to deploy to tenant: ${error.message}`);
             }
@@ -83,4 +157,108 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             }
         }
     }
+    /**
+     * `--check`: what the policy gate would decide for this release on this tenant, without deploying.
+     * Exits 2 when the deploy would be refused; a preview the platform cannot answer exits 1.
+     */
+    async checkPolicyGate(opts) {
+        const { flags, profile, releaseName, tenantName, workspaceId } = opts;
+        const result = await fetchPolicyGate({ verboseFetch: (...args) => this.verboseFetch(...args) }, { profile, release: releaseName, tenant: tenantName, verbose: flags.verbose, workspace: workspaceId });
+        if ('unavailable' in result) {
+            const { message, payload, status } = result.unavailable;
+            this.error(`Policy gate preview failed (${status}): ${message}${policyPermissionGuidance(status, payload)}`);
+        }
+        const { answer } = result;
+        const exit = gateExitCode(answer);
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(answer, null, 2));
+        }
+        else {
+            this.log(`Checked release "${releaseName}" for tenant "${tenantName}"; nothing was deployed.`);
+            for (const line of gateLines(answer))
+                this.log(line);
+            if (exit) {
+                this.log(answer.can_override
+                    ? `To deploy past the gate: xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`
+                    : 'A deploy is refused unless someone with the workspace:policy update permission overrides the gate.');
+            }
+        }
+        if (exit)
+            process.exitCode = exit;
+    }
+    /**
+     * Does an approved tenant_deploy_request already exist for this (tenant, release)
+     * pair? The list endpoint has no release filter, so this fetches approved
+     * requests for the tenant and filters client-side by the resolved release name.
+     */
+    async hasApprovedDeployRequest(opts) {
+        const { profile, releaseName, tenantName, verbose, workspaceId } = opts;
+        const params = new URLSearchParams({ per_page: '100', status: 'approved', tenant_name: tenantName });
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request?${params}`;
+        const response = await this.verboseFetch(apiUrl, {
+            headers: {
+                accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
+            },
+            method: 'GET',
+        }, verbose, profile.access_token);
+        if (!response.ok) {
+            // A read-scope failure here means something is more broadly wrong (e.g.
+            // no workspace access at all) — surface it rather than silently treating
+            // it as "no approval found", which would misreport as approval-required.
+            const message = await this.parseApiError(response, 'Failed to check for an approved deploy request');
+            this.error(message);
+        }
+        const data = (await response.json());
+        const items = Array.isArray(data) ? data : (data.items ?? []);
+        return items.some((item) => item.status === 'approved' && item._release?.name === releaseName);
+    }
+    /** A deploy the policy gate refused: its verdict, then the refusal and how to proceed, exiting 2. */
+    refuseByPolicyGate(refused, flags, override) {
+        for (const line of gateRefusalOutput(refused, flags.output === 'json'))
+            this.log(line);
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
+    }
+    /**
+     * Does this tenant have the deploy approval gate enabled?
+     *
+     * Returns false if the tenant has `allow_quick_deploy` set — that flag lets a
+     * tenant skip the approval gate entirely for quick deploys, regardless of
+     * `required_reviewers`.
+     *
+     * Deliberately uses `tenant list` rather than `tenant get`: the single-tenant
+     * GET route's output whitelist (tenant-detail.yaml) omits `deploy_settings`
+     * (which holds `required_reviewers`, `allow_deploy_bypass`, and
+     * `allow_quick_deploy`) even though the list route's output includes it
+     * — confirmed live against a running instance. Filed as a backend bug; this
+     * is the workaround until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+     */
+    async tenantRequiresApproval(profile, workspaceId, tenantName, verbose) {
+        const params = new URLSearchParams({ per_page: '100' });
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${params}`;
+        const response = await this.verboseFetch(apiUrl, {
+            headers: {
+                accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
+            },
+            method: 'GET',
+        }, verbose, profile.access_token);
+        if (!response.ok) {
+            const message = await this.parseApiError(response, 'Failed to look up tenant');
+            this.error(message);
+        }
+        const data = (await response.json());
+        const items = Array.isArray(data) ? data : (data.items ?? []);
+        const tenant = items.find((item) => item.name === tenantName);
+        if (tenant?.deploy_settings?.allow_quick_deploy)
+            return false;
+        return (tenant?.deploy_settings?.required_reviewers ?? 0) > 0;
+    }
+    /** A release policy the tenant's import could not land (its key is held by another policy) is never dropped silently. */
+    warnPoliciesSkipped(tenant) {
+        const message = tenant.policies_skipped?.message;
+        if (message)
+            this.warn(message);
+    }
 }

package/dist/commands/tenant/edit/index.d.ts

@@ -6,6 +6,7 @@ export default class TenantEdit extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        allow_quick_deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         display: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -13,6 +14,7 @@ export default class TenantEdit extends BaseCommand {
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         proxy: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         rbac: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        required_reviewers: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         tasks: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/tenant/edit/index.js

@@ -13,9 +13,15 @@ export default class TenantEdit extends BaseCommand {
 Updated tenant: New Name (my-tenant) - ID: 42
 `,
         `$ xano tenant edit t1234-abcd-xyz1 --no-tasks --no-ingress -o json`,
+        `$ xano tenant edit t1234-abcd-xyz1 --required_reviewers 1`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        allow_quick_deploy: Flags.boolean({
+            allowNo: true,
+            description: 'Allow this tenant to skip the deploy approval gate entirely for quick deploys, regardless of --required_reviewers.',
+            required: false,
+        }),
         description: Flags.string({
             char: 'd',
             description: 'New description',
@@ -50,6 +56,10 @@ Updated tenant: New Name (my-tenant) - ID: 42
             description: '[CRITICAL] NEVER disable RBAC without explicit user confirmation; this removes role-based access controls on the tenant. Enables/disables RBAC.',
             required: false,
         }),
+        required_reviewers: Flags.integer({
+            description: 'When greater than 0, that many distinct reviewers must approve a tenant_deploy_request before a release may be deployed to this tenant. 0 means not gated.',
+            required: false,
+        }),
         tasks: Flags.boolean({
             allowNo: true,
             description: '[IMPORTANT] ALWAYS confirm with the user before disabling background tasks; this stops scheduled jobs on the tenant. Enables/disables background tasks.',
@@ -76,8 +86,17 @@ Updated tenant: New Name (my-tenant) - ID: 42
             'Content-Type': 'application/json',
         };
         try {
-            // Fetch current tenant state (PUT requires all fields)
-            const getResponse = await this.verboseFetch(baseUrl, {
+            // Fetch current tenant state (PUT requires all fields). Deliberately uses
+            // `tenant list` rather than `tenant get`: the single-tenant GET route's
+            // output whitelist (tenant-detail.yaml) omits `deploy_settings` (which
+            // holds `required_reviewers`, `allow_deploy_bypass`, and
+            // `allow_quick_deploy`) even though the list route's output includes it
+            // — confirmed live against a running instance. Using GET here would
+            // silently reset those fields to their defaults on every edit that doesn't
+            // explicitly pass them. Filed as a backend bug; this is the workaround
+            // until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+            const listParams = new URLSearchParams({ per_page: '100' });
+            const getResponse = await this.verboseFetch(`${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${listParams}`, {
                 headers: {
                     'accept': 'application/json',
                     'Authorization': `Bearer ${profile.access_token}`,
@@ -88,9 +107,25 @@ Updated tenant: New Name (my-tenant) - ID: 42
                 const errorText = await getResponse.text();
                 this.error(`Failed to fetch tenant: ${getResponse.status} ${getResponse.statusText}\n${errorText}`);
             }
-            const current = await getResponse.json();
-            // Merge in user-provided values
+            const listData = (await getResponse.json());
+            const listItems = Array.isArray(listData) ? listData : (listData.items ?? []);
+            const current = listItems.find((item) => item.name === tenantName);
+            if (!current) {
+                this.error(`Tenant "${tenantName}" not found`);
+            }
+            // Merge in user-provided values. allow_deploy_bypass has no edit flag (it's
+            // fixed at `tenant create` time), but the PUT still requires the full body,
+            // so its current value is preserved here rather than reset.
             const body = {
+                deploy_settings: {
+                    allow_deploy_bypass: current.deploy_settings?.allow_deploy_bypass ?? false,
+                    allow_quick_deploy: flags.allow_quick_deploy === undefined
+                        ? (current.deploy_settings?.allow_quick_deploy ?? false)
+                        : flags.allow_quick_deploy,
+                    required_reviewers: flags.required_reviewers === undefined
+                        ? (current.deploy_settings?.required_reviewers ?? 0)
+                        : flags.required_reviewers,
+                },
                 description: flags.description === undefined ? (current.description ?? '') : flags.description,
                 display: flags.display === undefined ? (current.display ?? current.name) : flags.display,
                 domain: flags.domain === undefined ? (current.domain ?? '') : flags.domain,

package/dist/commands/tenant_deploy_request/bypass/index.d.ts

@@ -0,0 +1,31 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestBypass extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'override-policy': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        reason: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
+    run(): Promise<void>;
+    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
+    private refuseByPolicyGate;
+}

package/dist/commands/tenant_deploy_request/bypass/index.js

@@ -0,0 +1,109 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+import { gateOverrideHint, gateRefusal, gateRefusalOutput } from '../../../utils/policy/gate.js';
+export default class TenantDeployRequestBypass extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = "[CRITICAL] STOP and confirm with the user before running this; it deploys the release immediately, past the review workflow. Deploy the request's release past the approval gate under the tenant_center:deploy:bypass_approval permission. Only available if the tenant has enabled bypass (allow_deploy_bypass), and every use is logged with the given reason. The approval request's own status is left untouched.";
+    static examples = [
+        `$ xano tenant_deploy_request bypass 12 --reason "Prod incident, reviewer unavailable"
+Deployed tenant release, bypassing deploy request #12's approval gate.
+`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        'override-policy': Flags.boolean({
+            default: false,
+            description: 'Also proceed past a blocking policy gate, recording --reason as the override reason (needs the workspace:policy update permission; audited)',
+            hidden: true,
+        }),
+        reason: Flags.string({
+            description: 'Reason for bypassing the approval gate (required, audited)',
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestBypass);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const body = {
+            reason: flags.reason,
+            ...(flags['override-policy'] ? { override_policy: true } : {}),
+        };
+        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
+        let refused = null;
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}/override`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                refused = await gateRefusal(response);
+                if (refused)
+                    this.refuseByPolicyGate(refused, args.id, flags.output === 'json');
+                const message = await this.parseApiError(response, 'Failed to bypass tenant deploy request approval gate');
+                this.error(message);
+            }
+            const deploy = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(deploy, null, 2));
+            }
+            else {
+                this.log(`Deployed tenant release, bypassing deploy request #${args.id}'s approval gate.`);
+                if (deploy.duration_ms !== undefined)
+                    this.log(`  Time: ${(deploy.duration_ms / 1000).toFixed(1)}s`);
+            }
+        }
+        catch (error) {
+            if (refused)
+                throw error;
+            if (error instanceof Error) {
+                this.error(`Failed to bypass tenant deploy request approval gate: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to bypass tenant deploy request approval gate: ${String(error)}`);
+            }
+        }
+    }
+    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
+    refuseByPolicyGate(refused, id, json) {
+        for (const line of gateRefusalOutput(refused, json))
+            this.log(line);
+        const override = `xano tenant_deploy_request bypass ${id} --reason "<why>" --override-policy`;
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
+    }
+}

package/dist/commands/tenant_deploy_request/create/index.d.ts

@@ -0,0 +1,21 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestCreate extends BaseCommand {
+    static args: {
+        title: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        draft: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        release: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        reviewers: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        tenant: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}