@xano/cli 1.3.4 → 1.3.5-beta.0

package/dist/commands/policy/runs/index.js

@@ -0,0 +1,273 @@
+import { Args, Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { quoted } from '../../../utils/policy/gate.js';
+import { releasePolicyRunLines, releaseRunLines } from '../../../utils/policy/release.js';
+import { listItems } from '../../../utils/policy/request.js';
+import { policyRunSummary, policyRunTable } from '../../../utils/policy/runs.js';
+/** A branch retains this many runs, and the run list serves at most this many. */
+const RUNS_RETAINED = 20;
+/** How many findings a run read prints unless `--limit` says otherwise, and the most a page holds. */
+const FINDINGS_LIMIT = 100;
+const FINDINGS_MAX = 500;
+/** The findings route's list filters, each a repeatable flag of the same name. */
+const LIST_FILTERS = ['policy', 'rule', 'severity', 'kind', 'object', 'tag'];
+/** The flags that page or filter one run's findings, so a run list refuses them. */
+const FINDING_FLAGS = ['offset', 'all', 'advisory', 'blocking', ...LIST_FILTERS, 'search'];
+/** How many releases a lookup by name reads a request, and the most requests it makes. */
+const RELEASES_PAGE = 100;
+const RELEASE_PAGES = 50;
+export default class PolicyRuns extends PolicyCommand {
+    static args = {
+        run_id: Args.string({
+            description: 'Run ID to read; omit to list the retained runs, newest first',
+            required: false,
+        }),
+    };
+    static description = "List the stored policy check runs, or read one of them a page of findings at a time. --release reads a release's check instead: the run stored when the release was cut, evaluated on what it ships against the policies it ships";
+    static examples = [
+        '$ xano policy runs',
+        '$ xano policy runs --limit 5',
+        '$ xano policy runs 1674 --run-detail',
+        '$ xano policy runs 1674 --offset 100 --limit 100',
+        '$ xano policy runs 1674 --all -o json',
+        '$ xano policy runs 1674 --blocking --policy AUTH-001 --severity critical --severity high',
+        '$ xano policy runs 1674 -o json',
+        '$ xano policy runs --release v1.2',
+        '$ xano policy runs --release v1.2 --blocking --all -o json',
+        '$ xano policy runs --release v1.2 --recheck',
+        '$ xano policy runs --release-id 12',
+    ];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        advisory: Flags.boolean({
+            default: false,
+            description: 'With a run ID, only the advisory findings',
+            exclusive: ['blocking'],
+        }),
+        all: Flags.boolean({
+            default: false,
+            description: 'With a run ID, read every page and print every finding that matches, instead of one page',
+            exclusive: ['offset', 'limit'],
+        }),
+        blocking: Flags.boolean({
+            default: false,
+            description: "With a run ID, only the blocking findings (an active blocking policy's)",
+            exclusive: ['advisory'],
+        }),
+        kind: Flags.string({
+            description: 'With a run ID, only findings on this object kind (query, function, table, ...); repeatable',
+            multiple: true,
+        }),
+        limit: Flags.integer({
+            description: `How many runs to list, newest first (1-${RUNS_RETAINED}, default ${RUNS_RETAINED}: a branch retains at most ${RUNS_RETAINED}); with a run ID, how many findings to print (1-${FINDINGS_MAX}, default ${FINDINGS_LIMIT})`,
+            min: 1,
+        }),
+        object: Flags.string({
+            description: 'With a run ID, only findings on this object, written type:id as a finding names it (query:18); repeatable',
+            multiple: true,
+        }),
+        offset: Flags.integer({
+            description: "With a run ID, how many findings to skip, in the platform's order (blocking first)",
+            min: 0,
+        }),
+        policy: Flags.string({
+            description: 'With a run ID, only findings of this policy key; repeatable',
+            multiple: true,
+        }),
+        recheck: Flags.boolean({
+            default: false,
+            description: "With --release, check the release again from its archive and store the new run, then read it (a read-only credential is refused)",
+        }),
+        release: Flags.string({
+            description: "Read this release's policy check (by release name) instead of a branch's run; the finding flags page and filter it as they do a run's",
+            exclusive: ['branch', 'release-id'],
+        }),
+        'release-id': Flags.integer({
+            description: 'Read a release policy check by release ID, without looking up its name',
+            exclusive: ['branch', 'release'],
+            min: 1,
+        }),
+        rule: Flags.string({
+            description: 'With a run ID, only findings of this rule ID (AUTH-001.R1); repeatable',
+            multiple: true,
+        }),
+        'run-detail': Flags.boolean({
+            default: false,
+            description: 'With a run ID, also print the policy descriptions and rule settings that run recorded',
+        }),
+        search: Flags.string({
+            description: 'With a run ID, only findings whose policy key or title, rule title, object name or message contains this text',
+        }),
+        severity: Flags.string({
+            description: 'With a run ID, only findings of this severity (critical, high, medium, low); repeatable',
+            multiple: true,
+        }),
+        tag: Flags.string({
+            description: 'With a run ID, only findings whose policy or object carries this tag; repeatable',
+            multiple: true,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(PolicyRuns);
+        if (flags.release !== undefined || flags['release-id'] !== undefined)
+            return this.readRelease(flags, args.run_id);
+        if (flags.recheck)
+            this.error('--recheck checks a release again: `xano policy runs --release <name> --recheck`.');
+        const { request } = this.policyTarget(flags);
+        const wanted = args.run_id?.trim() ?? '';
+        if (wanted === '')
+            return this.listRuns(request, flags);
+        // Runs older than the one `policy status` reads are reachable here by id.
+        if (!/^\d+$/.test(wanted))
+            this.error(`"${wanted}" is not a run ID. Run \`xano policy runs\` for the retained runs.`);
+        const limit = findingsLimit(this, flags);
+        // The run's summary and its findings a page at a time: neither reads the whole run, which can hold tens of thousands.
+        const head = (await request(`/run/${wanted}/summary`));
+        await this.reportRun({ flags, head, limit, path: `/run/${wanted}/findings`, reading: `run ${wanted}`, request });
+    }
+    /**
+     * `--all`: every finding that matches, read a page of 500 at a time in the platform's order, as
+     * one page. A run of many pages says on stderr what it is reading.
+     */
+    async everyFinding(request, path, reading, query) {
+        const items = [];
+        let total = Number.POSITIVE_INFINITY;
+        while (items.length < total) {
+            // eslint-disable-next-line no-await-in-loop -- one page at a time, each starting where the last ended
+            const page = (await request(path, 'GET', undefined, { ...query, limit: String(FINDINGS_MAX), offset: String(items.length) }));
+            if (items.length === 0 && page.total > FINDINGS_MAX)
+                this.logToStderr(`Reading ${page.total} findings of ${reading}, ${FINDINGS_MAX} a request (${Math.ceil(page.total / FINDINGS_MAX)} requests)...`);
+            total = page.total ?? 0;
+            if ((page.items ?? []).length === 0)
+                break;
+            items.push(...page.items);
+        }
+        return { items, limit: items.length, offset: 0, total: Number.isFinite(total) ? total : items.length };
+    }
+    /** The retained runs, newest first; the flags that read one run's findings are refused. */
+    async listRuns(request, flags) {
+        if (flags['run-detail'])
+            this.error('--run-detail reads one run: `xano policy runs <id> --run-detail`.');
+        const paging = FINDING_FLAGS.find(name => flags[name] !== undefined && flags[name] !== false);
+        if (paging)
+            this.error(`--${paging} pages one run's findings: \`xano policy runs <id> --${paging} ...\`.`);
+        const limit = flags.limit ?? RUNS_RETAINED;
+        if (limit > RUNS_RETAINED)
+            this.error(`--limit lists at most ${RUNS_RETAINED} runs: a branch retains only its newest ${RUNS_RETAINED}.`);
+        const result = await request('/run', 'GET', undefined, { limit: String(limit) });
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        const runs = listItems(result);
+        if (runs.length === 0) {
+            this.log('No policy runs retained on this branch.');
+            return;
+        }
+        for (const line of policyRunTable(runs))
+            this.log(line);
+        this.log('Only the most recent runs are retained per branch. Read one with `xano policy runs <id> --run-detail`.');
+    }
+    /**
+     * `--release <name>`: the release's stored check (`GET release/{id}/policy_run`) and a page of its
+     * findings, as a run is read. `--recheck` checks the release again from its archive first. A
+     * release with no check says so; under `-o json` it is `{run: null}`.
+     */
+    async readRelease(flags, runId) {
+        if (runId?.trim())
+            this.error('Read one run by its ID, or a release\'s check with --release, not both.');
+        const name = flags.release?.trim() ?? String(flags['release-id'] ?? '');
+        if (!name)
+            this.error('--release needs a release name.');
+        const limit = findingsLimit(this, flags);
+        const { request } = this.policyTarget(flags, { label: 'Release policy check', path: '' });
+        const releaseId = flags['release-id'] ?? await this.releaseId(request, name);
+        const route = `/release/${releaseId}/policy_run`;
+        const answer = (flags.recheck ? await request(route, 'POST', {}) : await request(route));
+        const check = flags.recheck ? { check: answer.check ?? null } : {};
+        // The recheck's outcome in a line: recorded with its verdict, or why nothing was recorded.
+        const rechecked = flags.recheck ? releasePolicyRunLines(answer.check, name).slice(0, 1).map(line => `Rechecked. ${line.trim()}`) : [];
+        const head = answer.run ?? null;
+        if (!head) {
+            if (flags.output === 'json') {
+                this.log(JSON.stringify({ ...check, run: null }, null, 2));
+                return;
+            }
+            for (const line of rechecked)
+                this.log(line);
+            this.log(`Release ${name} has no policy check.${flags.recheck ? '' : ' `--recheck` checks it now from its archive.'}`);
+            return;
+        }
+        await this.reportRun({
+            check,
+            flags,
+            head,
+            limit,
+            next: flags['release-id'] ? `xano policy runs --release-id ${releaseId}` : `xano policy runs --release ${quoted(name)}`,
+            path: `${route}/findings`,
+            preface: [...rechecked, ...releaseRunLines(name, releaseId, head)],
+            reading: `release ${name}`,
+            request,
+        });
+    }
+    /** The release's ID from its name, reading the workspace's releases a page at a time until it is found. */
+    async releaseId(request, name) {
+        for (let page = 1; page <= RELEASE_PAGES; page++) {
+            // eslint-disable-next-line no-await-in-loop -- pages in order, stopping at the release
+            const data = await request('/release', 'GET', undefined, { page: String(page), per_page: String(RELEASES_PAGE) });
+            const releases = Array.isArray(data) ? data : listItems(data);
+            const match = releases.find(release => release.name === name);
+            if (match)
+                return match.id;
+            if (releases.length < RELEASES_PAGE)
+                break;
+        }
+        return this.error(`Release '${name}' not found. \`xano release list\` lists the workspace's releases.`);
+    }
+    /**
+     * One run's summary and a page of its findings (`path`), or under `-o json` the summary with
+     * `findings` and `findings_page`, plus what `extra` adds to it.
+     */
+    async reportRun(opts) {
+        const { flags, head, limit, path, request } = opts;
+        const query = findingsQuery(flags, limit);
+        const page = flags.all
+            ? await this.everyFinding(request, path, opts.reading, query)
+            : (await request(path, 'GET', undefined, query));
+        const items = page.items ?? [];
+        const offset = page.offset ?? 0;
+        const total = page.total ?? items.length;
+        if (flags.output === 'json') {
+            const next = offset + items.length < total && items.length > 0 ? offset + items.length : null;
+            const findingsPage = { limit: page.limit ?? limit, next_offset: next, offset, total };
+            this.log(JSON.stringify({ ...head, ...opts.check, findings: items, findings_page: findingsPage }, null, 2));
+            return;
+        }
+        for (const line of opts.preface ?? [])
+            this.log(line);
+        const filtered = Object.keys(query).some(name => !['limit', 'offset'].includes(name));
+        for (const line of policyRunSummary({ ...head, findings: items }, { filtered, next: opts.next, offset, total }))
+            this.log(line);
+        if (flags['run-detail'])
+            this.logRunDetail(head);
+    }
+}
+/** How many findings a page prints: `--limit`, at most 500. */
+function findingsLimit(command, flags) {
+    const limit = flags.limit ?? FINDINGS_LIMIT;
+    if (limit > FINDINGS_MAX)
+        command.error(`--limit prints at most ${FINDINGS_MAX} findings a page; page on with --offset.`);
+    return limit;
+}
+/** The findings route's query for one page: `blocking` true or false, and each list filter given. */
+function findingsQuery(flags, limit) {
+    const query = { limit: String(limit), offset: String(flags.offset ?? 0) };
+    if (flags.blocking || flags.advisory)
+        query.blocking = String(flags.blocking);
+    for (const name of LIST_FILTERS)
+        if (flags[name]?.length)
+            query[name] = flags[name];
+    if (flags.search?.trim())
+        query.q = flags.search;
+    return query;
+}

package/dist/commands/policy/status/index.d.ts

@@ -0,0 +1,21 @@
+import PolicyCommand from '../../../policy-command.js';
+export default class PolicyStatus extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'fail-on-findings': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        'run-detail': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * The run every policy's `latest_run` answer was decided against, or none when the branch has no
+     * run: its summary, which counts each policy's findings without listing them.
+     */
+    private latestRun;
+}

package/dist/commands/policy/status/index.js

@@ -0,0 +1,54 @@
+import { Flags } from '@oclif/core';
+import PolicyCommand from '../../../policy-command.js';
+import { policyResultSummary } from '../../../utils/policy/findings.js';
+import { listAllPolicies } from '../../../utils/policy/request.js';
+import { computeStatusRows, enforcementColumn, findingsLabel, statusExitCode, statusExitReason, statusLabel, } from '../../../utils/policy/status.js';
+export default class PolicyStatus extends PolicyCommand {
+    static description = 'Show the latest policy check results without evaluating';
+    static examples = ['$ xano policy status -o json', '$ xano policy status --fail-on-findings -o json', '$ xano policy status --run-detail'];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        'fail-on-findings': Flags.boolean({
+            default: false,
+            description: 'Exit 2 for current blocking findings, whatever else is true; otherwise exit 1 for stale, missing or errored evaluation evidence',
+        }),
+        'run-detail': Flags.boolean({
+            default: false,
+            description: 'Also print what the latest run recorded: each policy description and the settings each rule ran with',
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(PolicyStatus);
+        const { request } = this.policyTarget(flags);
+        const policies = await listAllPolicies(request);
+        const run = await this.latestRun(request, policies);
+        const rows = computeStatusRows(policies, run);
+        const failOnFindings = flags['fail-on-findings'] ? { exit: statusExitCode(rows), reason: statusExitReason(rows) } : undefined;
+        if (flags.output === 'json') {
+            this.log(JSON.stringify({ policies, run: run ?? null, status: rows, ...(failOnFindings ? { fail_on_findings: failOnFindings } : {}) }, null, 2));
+        }
+        else if (rows.length === 0)
+            this.log('No policies found.');
+        else {
+            for (const row of rows)
+                this.log(`${row.key}  ${statusLabel(row)}  ${enforcementColumn(row)}  ${findingsLabel(row)}  ${row.title ?? ''}`);
+            const counted = new Set(rows.filter((row) => row.counted).map((row) => row.key));
+            for (const line of policyResultSummary(run?.results?.filter((result) => counted.has(result.policy_key ?? ''))))
+                this.log(line);
+            if (flags['run-detail'] && run)
+                this.logRunDetail(run);
+            if (failOnFindings?.reason)
+                this.log(failOnFindings.reason);
+        }
+        if (failOnFindings?.exit)
+            process.exitCode = failOnFindings.exit;
+    }
+    /**
+     * The run every policy's `latest_run` answer was decided against, or none when the branch has no
+     * run: its summary, which counts each policy's findings without listing them.
+     */
+    async latestRun(request, policies) {
+        const runId = policies.map((policy) => policy.latest_run?.run_id).find(Boolean);
+        return runId ? (await request(`/run/${runId}/summary`)) : undefined;
+    }
+}

package/dist/commands/release/create/index.js

@@ -1,5 +1,6 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleaseCreate extends BaseCommand {
     static args = {
         name: Args.string({
@@ -11,6 +12,7 @@ export default class ReleaseCreate extends BaseCommand {
     static examples = [
         `$ xano release create "v1.0" --branch main
 Created release: v1.0 - ID: 10
+  Branch: main
 `,
         `$ xano release create "v1.1-hotfix" --branch main --hotfix --description "Critical fix" -o json`,
     ];
@@ -90,6 +92,8 @@ Created release: v1.0 - ID: 10
                     this.log(`  Branch: ${release.branch}`);
                 if (release.hotfix)
                     this.log(`  Hotfix: true`);
+                for (const line of releasePolicyRunLines(release.policy_run, release.name ?? args.name))
+                    this.log(line);
             }
         }
         catch (error) {

package/dist/commands/release/deploy/index.d.ts

@@ -9,12 +9,31 @@ export default class ReleaseDeploy extends BaseCommand {
         branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         set_live: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
     run(): Promise<void>;
     private confirm;
+    /** The set-live verdict a successful deploy answered with --set_live (`pass`, `overridden`, ...). */
+    private logPolicyOutcome;
+    /** Stops the command when the set-live gate refused after the branch was created (exit 2). */
+    private refuseIfSetLiveRefused;
+    /**
+     * The set-live gate refused after the branch was created: the verdict, the refusal, and how to
+     * proceed, exiting 2. Under `-o json` the refusal is `{branch_created, set_live, branch, message,
+     * policy_gate}`.
+     */
+    private refuseSetLive;
 }

package/dist/commands/release/deploy/index.js

@@ -1,5 +1,6 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateOverrideHint, gateRefusal, liveGateLines, quoted, } from '../../../utils/policy/gate.js';
 export default class ReleaseDeploy extends BaseCommand {
     static args = {
         release_name: Args.string({
@@ -7,7 +8,7 @@ export default class ReleaseDeploy extends BaseCommand {
             required: true,
         }),
     };
-    static description = '[IMPORTANT] ALWAYS confirm with the user before deploying a release. Deploys a release to its workspace as a new branch.';
+    static description = "[IMPORTANT] ALWAYS confirm with the user before deploying a release. Deploys a release to its workspace as a new branch.";
     static examples = [
         `$ xano release deploy "v1.0"
 Are you sure you want to deploy release "v1.0"? (y/N) y
@@ -39,6 +40,7 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             options: ['summary', 'json'],
             required: false,
         }),
+        'policy-override': Flags.string({ description: 'With --set_live, set the branch live past a blocking set-live policy gate with an audited reason (requires workspace:policy update)', hidden: true }),
         set_live: Flags.boolean({
             default: false,
             description: '[CRITICAL] STOP and confirm with the user before setting the deployed branch as live.',
@@ -50,8 +52,18 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             required: false,
         }),
     };
+    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(ReleaseDeploy);
+        if (blankPolicyOverride(flags['policy-override']))
+            this.error(BLANK_POLICY_OVERRIDE);
         const { profile } = this.resolveProfile(flags);
         const workspaceId = flags.workspace || profile.workspace;
         if (!workspaceId) {
@@ -59,11 +71,10 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
         }
         const releaseName = encodeURIComponent(args.release_name);
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/release/${releaseName}/deploy`;
-        const body = {
-            set_live: flags.set_live,
-        };
-        if (flags.branch)
-            body.branch = flags.branch;
+        const body = deployBody(flags);
+        if (body.override_reason && !flags.set_live) {
+            this.error('--policy-override only applies with --set_live: a branch that is not set live is not gated.');
+        }
         if (!flags.force) {
             const confirmed = await this.confirm(`Are you sure you want to deploy release "${args.release_name}" to workspace ${workspaceId}?`);
             if (!confirmed) {
@@ -84,6 +95,7 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
+                await this.refuseIfSetLiveRefused(response, flags, args.release_name);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -98,10 +110,17 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
                 this.log(`Deployed release "${release.name}" to workspace ${workspaceId} (branch: ${branchLabel}${liveStatus})`);
                 if (release.description)
                     this.log(`  Description: ${release.description}`);
+                this.logPolicyOutcome(release);
                 this.log(`  Time: ${elapsed}s`);
             }
+            // A policy of the release the new branch could not take is never dropped silently.
+            const skipped = release.policies_skipped?.message;
+            if (skipped)
+                this.warn(skipped);
         }
         catch (error) {
+            if (this.refusedByPolicyGate)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to deploy release: ${error.message}`);
             }
@@ -123,4 +142,47 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             });
         });
     }
+    /** The set-live verdict a successful deploy answered with --set_live (`pass`, `overridden`, ...). */
+    logPolicyOutcome(release) {
+        const status = release.policy_gate?.status;
+        if (status && status !== 'disabled')
+            this.log(`  Policy gate: ${status}`);
+    }
+    /** Stops the command when the set-live gate refused after the branch was created (exit 2). */
+    async refuseIfSetLiveRefused(response, flags, releaseName) {
+        const refused = await gateRefusal(response);
+        if (refused)
+            this.refuseSetLive(refused, flags, releaseName);
+    }
+    /**
+     * The set-live gate refused after the branch was created: the verdict, the refusal, and how to
+     * proceed, exiting 2. Under `-o json` the refusal is `{branch_created, set_live, branch, message,
+     * policy_gate}`.
+     */
+    refuseSetLive(refused, flags, releaseName) {
+        const answer = refused.answer;
+        const label = answer.branch?.label || flags.branch || 'the release branch';
+        if (flags.output === 'json') {
+            this.log(JSON.stringify({ branch: answer.branch ?? null, branch_created: true, message: refused.message, policy_gate: answer, set_live: false }, null, 2));
+        }
+        else {
+            for (const line of liveGateLines(answer, 'release'))
+                this.log(line);
+        }
+        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
+        const rerun = `xano branch delete ${quoted(label)}${workspace} && xano release deploy ${quoted(releaseName)}${workspace}${flags.branch ? ` --branch ${quoted(flags.branch)}` : ''} --set_live --policy-override "<why>"`;
+        const hint = gateOverrideHint(answer, rerun);
+        this.refusedByPolicyGate = true;
+        this.error(`The branch was created; set live was refused. ${refused.message}${hint}${answer.can_override && !answer.override_denied ? `\nOr set "${label}" live from Studio's Branches panel, which asks for the reason.` : ''}`, { exit: 2 });
+    }
+}
+/** The deploy request's body: the new branch's label, set_live, and the override reason when one is given. */
+function deployBody(flags) {
+    const body = { set_live: flags.set_live };
+    if (flags.branch)
+        body.branch = flags.branch;
+    const overrideReason = flags['policy-override']?.trim();
+    if (overrideReason)
+        body.override_reason = overrideReason;
+    return body;
 }

package/dist/commands/release/import/index.js

@@ -2,6 +2,7 @@ import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
 import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
+import { releaseImportRefusal, releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleaseImport extends BaseCommand {
     static args = {};
     static description = '[IMPORTANT] ALWAYS confirm with the user before importing a release. Imports a release file into a workspace.';
@@ -58,7 +59,8 @@ Imported release as #15
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
                 const errorText = await response.text();
-                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+                this.error(releaseImportRefusal(errorText, response.status, apiUrl) ??
+                    `API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
             const result = await response.json();
             if (flags.output === 'json') {
@@ -67,6 +69,8 @@ Imported release as #15
             else {
                 const sizeMb = (fileBuffer.length / 1024 / 1024).toFixed(2);
                 this.log(`Imported release as #${result.id} (${sizeMb} MB)`);
+                for (const line of releasePolicyRunLines(result.policy_run, result.name, result.id))
+                    this.log(line);
             }
         }
         catch (error) {

package/dist/commands/release/list/index.d.ts

@@ -10,4 +10,11 @@ export default class ReleaseList extends BaseCommand {
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * The releases' stored policy checks, read once for the whole list. The list never fails or
+     * changes because of this read: it answers `null` when the checks cannot be read (the Policies
+     * feature is off, the credential lacks `workspace:policy` read, or the request failed), and the
+     * list then prints as it would without policies.
+     */
+    private policyChecks;
 }

package/dist/commands/release/list/index.js

@@ -1,6 +1,7 @@
 import { Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
 import { buildPagingJson } from '../../../utils/paging.js';
+import { readReleasePolicyChecks, releasePolicyCheckTag } from '../../../utils/policy/release.js';
 export default class ReleaseList extends BaseCommand {
     static description = 'List all releases in a workspace';
     static examples = [
@@ -57,22 +58,19 @@ Releases in workspace 5:
             else {
                 this.error('Unexpected API response format');
             }
+            const checks = await this.policyChecks(profile, String(workspaceId), releases, flags.verbose);
             if (flags.output === 'json') {
-                this.log(JSON.stringify(buildPagingJson({ items: releases }, { tier: 'none' }), null, 2));
+                this.log(JSON.stringify(buildPagingJson({ items: withPolicyChecks(releases, checks) }, { tier: 'none' }), null, 2));
             }
             else if (releases.length === 0) {
                 this.log('No releases found');
             }
             else {
                 this.log(`Releases in workspace ${workspaceId}:`);
-                for (const release of releases) {
-                    const branch = release.branch ? ` - ${release.branch}` : '';
-                    const hotfix = release.hotfix ? ' [hotfix]' : '';
-                    const createdAt = release.created_at
-                        ? ` (${new Date(release.created_at).toLocaleString(undefined, { timeZoneName: 'short' })})`
-                        : '';
-                    this.log(`  - ${release.name} (ID: ${release.id})${branch}${hotfix}${createdAt}`);
-                }
+                for (const release of releases)
+                    this.log(releaseLine(release, checks));
+                if (checks)
+                    this.log('Policy check details: xano policy runs --release <name>');
             }
         }
         catch (error) {
@@ -84,4 +82,43 @@ Releases in workspace 5:
             }
         }
     }
+    /**
+     * The releases' stored policy checks, read once for the whole list. The list never fails or
+     * changes because of this read: it answers `null` when the checks cannot be read (the Policies
+     * feature is off, the credential lacks `workspace:policy` read, or the request failed), and the
+     * list then prints as it would without policies.
+     */
+    async policyChecks(profile, workspace, releases, verbose) {
+        if (releases.length === 0)
+            return null;
+        return readReleasePolicyChecks({ logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { branch: '', profile, verbose, workspace }, releases.map(release => release.id));
+    }
+}
+/** A release's summary line, tagged with its stored check when the checks were read. */
+function releaseLine(release, checks) {
+    const branch = release.branch ? ` - ${release.branch}` : '';
+    const hotfix = release.hotfix ? ' [hotfix]' : '';
+    const createdAt = release.created_at
+        ? ` (${new Date(release.created_at).toLocaleString(undefined, { timeZoneName: 'short' })})`
+        : '';
+    const policies = checks ? ` ${releasePolicyCheckTag(checks.get(release.id))}` : '';
+    return `  - ${release.name} (ID: ${release.id})${branch}${hotfix}${createdAt}${policies}`;
+}
+/**
+ * The releases for `-o json`: each gains `policy_check` (its stored check as the platform lists
+ * it, without the release id it is keyed by, or `null` for a release with no stored check) when
+ * the checks were read, and stays as served when they could not be, so a reader can tell an
+ * unchecked release (`null`) from checks the CLI could not read (absent).
+ */
+function withPolicyChecks(releases, checks) {
+    if (!checks)
+        return releases;
+    return releases.map(release => {
+        const check = checks.get(release.id);
+        if (!check)
+            return { ...release, policy_check: null };
+        const stored = { ...check };
+        delete stored.release_id;
+        return { ...release, policy_check: stored };
+    });
 }