@xano/cli 1.3.4 → 1.3.5-beta.0

package/dist/commands/release/push/index.js

@@ -2,7 +2,9 @@ import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
 import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { findFilesWithGuid } from '../../../utils/document-parser.js';
+import { findFilesWithGuid, parseDocument } from '../../../utils/document-parser.js';
+import { policiesSkippedNotice } from '../../../utils/policy/feedback.js';
+import { releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleasePush extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS confirm with the user before creating a release from local files. Creates a new release from local XanoScript files via the multidoc endpoint.';
     static examples = [
@@ -110,6 +112,12 @@ Output release details as JSON
         if (documentEntries.length === 0) {
             this.error(`All .xs files in ${flags.directory} are empty`);
         }
+        // A release carries its policy files like its code.
+        const policyKeys = documentEntries
+            .map((entry) => parseDocument(entry.content))
+            .filter((document) => document?.type === 'policy')
+            .map((document) => document.name)
+            .sort();
         const multidoc = documentEntries.map((d) => d.content).join('\n---\n');
         // Construct the API URL with query params
         const queryParams = new URLSearchParams({
@@ -158,6 +166,10 @@ Output release details as JSON
                 this.error(errorMessage);
             }
             const release = (await response.json());
+            // The platform says which policy files it left out: all of them while the Policies feature is
+            // off, and those of a caller who may not author policies, whose release carries the live
+            // branch's policies instead.
+            const skipped = policiesSkippedNotice(release);
             if (flags.output === 'json') {
                 this.log(JSON.stringify(release, null, 2));
             }
@@ -171,8 +183,14 @@ Output release details as JSON
                     this.log(`  Description: ${release.description}`);
                 const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
                 this.log(`  Documents: ${documentEntries.length}`);
+                if (policyKeys.length > 0 && !skipped)
+                    this.log(`  Policy documents: ${policyKeys.length} (${policyKeys.join(', ')})`);
+                for (const line of releasePolicyRunLines(release.policy_run, release.name ?? flags.name))
+                    this.log(line);
                 this.log(`  Time: ${elapsed}s`);
             }
+            if (skipped)
+                this.warn(skipped);
         }
         catch (error) {
             if (error instanceof Error) {

package/dist/commands/sandbox/push/index.js

@@ -5,6 +5,7 @@ import open from 'open';
 import BaseCommand from '../../../base-command.js';
 import { formatWorkspacePushDefaultsBanner, resolvePushDefaults } from '../../../utils/local-config.js';
 import { executePush } from '../../../utils/multidoc-push.js';
+import { policiesSkippedNotice } from '../../../utils/policy/feedback.js';
 export default class SandboxPush extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS run --dry-run first and show the user the output before pushing. Push local documents to your sandbox environment via multidoc import. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only. Include/exclude glob filters are intentionally not supported on sandbox push — partial pushes can hide deletions during review and lead to data loss when promoted to the workspace. Pushing into a sandbox that currently holds a different workspace will prompt for confirmation; run `xano sandbox reset` first to start clean.';
     static examples = [
@@ -173,7 +174,7 @@ Push and open sandbox review in the browser
             writeback: pushDefaults.writeback,
             writebackDiff: flags['writeback-diff'],
         };
-        await executePush({
+        const result = await executePush({
             accessToken: profile.access_token,
             branch: '',
             command: this,
@@ -189,6 +190,10 @@ Push and open sandbox review in the browser
             },
             verboseFetch: this.verboseFetch.bind(this),
         }, target, pushFlags);
+        // When the platform leaves policy files out, it says so once.
+        const skipped = policiesSkippedNotice(result.response ?? result.preview);
+        if (skipped)
+            this.warn(skipped);
         if (flags.review) {
             await this.openReview(profile.instance_origin, profile.access_token, flags.verbose);
         }

package/dist/commands/skills/pull/index.d.ts

@@ -0,0 +1,30 @@
+import PolicyCommand from '../../../policy-command.js';
+/**
+ * The SKILL.md a coding agent reads: the CLI's own frontmatter (`name` and `description`), the
+ * instance's content below it. The CLI always writes the frontmatter itself and drops any block the
+ * served content opens with: frontmatter configures the agent (`allowed-tools`, `hooks`, `model`),
+ * and a workspace knowledge record may replace the platform skill, so its text must never set it.
+ * The description is written as a double-quoted YAML scalar, so a `:` or `#` in it stays a
+ * description instead of becoming syntax.
+ */
+export declare function buildSkillDocument(description: string, content: string): string;
+export default class SkillsPull extends PolicyCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        directory: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** Any failure exits 1 with its own message: this is not a `policy *` command to name. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
+    run(): Promise<void>;
+}

package/dist/commands/skills/pull/index.js

@@ -0,0 +1,118 @@
+import { Flags } from '@oclif/core';
+import * as fs from 'node:fs';
+import path from 'node:path';
+import PolicyCommand from '../../../policy-command.js';
+/** The one skill this command installs. The instance generates it from its check catalogue. */
+const SKILL = 'xano-policies';
+/**
+ * The served content without a leading YAML frontmatter block, if it opens with one: the lines up
+ * to and including the closing `---`, and the blank lines after it.
+ */
+function stripFrontmatter(content) {
+    if (!/^---\r?\n/.test(content))
+        return content;
+    const lines = content.split(/\r?\n/);
+    const close = lines.indexOf('---', 1);
+    if (close === -1)
+        return content;
+    let start = close + 1;
+    while (start < lines.length && lines[start].trim() === '')
+        start++;
+    return lines.slice(start).join('\n');
+}
+/**
+ * The SKILL.md a coding agent reads: the CLI's own frontmatter (`name` and `description`), the
+ * instance's content below it. The CLI always writes the frontmatter itself and drops any block the
+ * served content opens with: frontmatter configures the agent (`allowed-tools`, `hooks`, `model`),
+ * and a workspace knowledge record may replace the platform skill, so its text must never set it.
+ * The description is written as a double-quoted YAML scalar, so a `:` or `#` in it stays a
+ * description instead of becoming syntax.
+ */
+export function buildSkillDocument(description, content) {
+    // Exactly one trailing newline, whatever the instance sent, so a re-pull is byte-identical.
+    const body = `${stripFrontmatter(content).replace(/\n+$/, '')}\n`;
+    return `---\nname: ${SKILL}\ndescription: ${JSON.stringify(description)}\n---\n\n${body}`;
+}
+/** True when the path is a symbolic link; false when it is anything else or does not exist. */
+function isSymbolicLink(filePath) {
+    try {
+        return fs.lstatSync(filePath).isSymbolicLink();
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return false;
+        throw error;
+    }
+}
+/**
+ * Whether the served skill is the workspace's own knowledge record. A stored record has a positive
+ * id; the skill the platform generates has none of its own (the platform serves it under a
+ * negative sentinel id), so an item without a positive id is the platform's.
+ */
+function isWorkspaceRecord(skill) {
+    return typeof skill.id === 'number' && Number.isInteger(skill.id) && skill.id > 0;
+}
+export default class SkillsPull extends PolicyCommand {
+    static description = `Install the ${SKILL} agent skill this instance generates
+
+Writes <directory>/.claude/skills/${SKILL}/SKILL.md, the project skill folder Claude Code reads, and replaces that file without a backup. A copy installed anywhere else, such as a global ~/.claude/skills/${SKILL} or another agent's skills folder, is not touched: remove it, so the agent does not load it instead.`;
+    static examples = [
+        `$ xano skills pull
+Wrote .claude/skills/${SKILL}/SKILL.md (${SKILL} skill for workspace 40, branch live)
+`,
+        '$ xano skills pull -d ./my-project',
+        '$ xano skills pull -b dev -o json',
+    ];
+    static flags = {
+        ...PolicyCommand.policyFlags,
+        directory: Flags.string({
+            char: 'd',
+            default: '.',
+            description: `Project directory whose .claude/skills/${SKILL}/SKILL.md is written (defaults to current directory)`,
+            required: false,
+        }),
+    };
+    /** Any failure exits 1 with its own message: this is not a `policy *` command to name. */
+    async catch(error) {
+        return this.catchAsOperational(error);
+    }
+    async run() {
+        const { flags } = await this.parse(SkillsPull);
+        // The route lives beside /policy under the workspace and is gated by the same
+        // `workspace:policy` permission, so it answers failures the way the policy commands do.
+        const { branch, request, workspace } = this.policyTarget(flags, { label: 'Agent skills', path: '/agent-skills' });
+        // `surface=cli` asks for the terminal wording of the skill, not the Studio one.
+        const payload = (await request('', 'GET', undefined, { surface: 'cli' }));
+        const items = Array.isArray(payload?.knowledge) ? payload.knowledge : [];
+        const skill = items.find((item) => typeof item?.name === 'string' && item.name.trim().toLowerCase() === SKILL);
+        if (!skill) {
+            this.error(`The instance returned no ${SKILL} skill for workspace ${workspace}, branch ${branch || 'live'}.`);
+        }
+        const document = buildSkillDocument(skill.description ?? '', skill.content ?? '');
+        const filePath = path.join(path.resolve(flags.directory), '.claude', 'skills', SKILL, 'SKILL.md');
+        // Writing through a symbolic link would overwrite whatever it points at.
+        if (isSymbolicLink(filePath)) {
+            this.error(`${filePath} is a symbolic link; remove it and run the command again. Nothing was written.`);
+        }
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        // The file is regenerated on every pull and no backup is kept.
+        fs.writeFileSync(filePath, document, 'utf8');
+        const own = isWorkspaceRecord(skill);
+        if (flags.output === 'json') {
+            this.log(JSON.stringify({
+                branch,
+                bytes: Buffer.byteLength(document, 'utf8'),
+                name: SKILL,
+                path: filePath,
+                source: own ? 'workspace' : 'platform',
+                workspace,
+            }, null, 2));
+            return;
+        }
+        const relative = path.relative(process.cwd(), filePath);
+        const shown = relative && !relative.startsWith('..') ? relative : filePath;
+        this.log(`Wrote ${shown} (${SKILL} skill for workspace ${workspace}, branch ${branch || 'live'})`);
+        if (own)
+            this.log(`This is the workspace's own ${SKILL} knowledge record, which replaces the platform skill.`);
+    }
+}

package/dist/commands/tenant/create/index.d.ts

@@ -6,6 +6,8 @@ export default class TenantCreate extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        allow_deploy_bypass: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        allow_quick_deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         cluster_id: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -13,6 +15,7 @@ export default class TenantCreate extends BaseCommand {
         license: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         platform_id: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        required_reviewers: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
         tasks: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         type: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;

package/dist/commands/tenant/create/index.js

@@ -17,9 +17,20 @@ Created tenant: Production (production) - ID: 42
 `,
         `$ xano tenant create "Staging" --description "Staging env" --cluster_id 1 --platform_id 1 --type tier2 -o json`,
         `$ xano tenant create "Staging" --type tier2 --cluster_id 1 --license ./license.yaml`,
+        `$ xano tenant create "Production" --required_reviewers 1 --allow_deploy_bypass`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        allow_deploy_bypass: Flags.boolean({
+            default: false,
+            description: 'Allow authorized users to bypass the deploy approval gate on this tenant (via tenant_deploy_request bypass). Has no effect unless --required_reviewers is also set above 0.',
+            required: false,
+        }),
+        allow_quick_deploy: Flags.boolean({
+            default: false,
+            description: 'Allow this tenant to skip the deploy approval gate entirely for quick deploys, regardless of --required_reviewers.',
+            required: false,
+        }),
         cluster_id: Flags.integer({
             description: 'Cluster ID to deploy to (required for tier2/tier3)',
             required: false,
@@ -54,6 +65,11 @@ Created tenant: Production (production) - ID: 42
             description: 'Platform ID to use',
             required: false,
         }),
+        required_reviewers: Flags.integer({
+            default: 0,
+            description: 'When greater than 0, that many distinct reviewers must approve a tenant_deploy_request before a release may be deployed to this tenant. 0 (default) means not gated.',
+            required: false,
+        }),
         tasks: Flags.boolean({
             allowNo: true,
             default: true,
@@ -79,6 +95,11 @@ Created tenant: Production (production) - ID: 42
             this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
         }
         const body = {
+            deploy_settings: {
+                allow_deploy_bypass: flags.allow_deploy_bypass,
+                allow_quick_deploy: flags.allow_quick_deploy,
+                required_reviewers: flags.required_reviewers,
+            },
             display: args.display,
             ingress: flags.ingress,
             license: flags.type,

package/dist/commands/tenant/deploy_release/index.d.ts

@@ -6,12 +6,52 @@ export default class TenantDeployRelease extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        check: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'override-reason': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         release: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    /** Set once the policy gate refuses the deploy, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
     run(): Promise<void>;
+    /**
+     * `--check`: what the policy gate would decide for this release on this tenant, without deploying.
+     * Exits 2 when the deploy would be refused; a preview the platform cannot answer exits 1.
+     */
+    private checkPolicyGate;
+    /**
+     * Does an approved tenant_deploy_request already exist for this (tenant, release)
+     * pair? The list endpoint has no release filter, so this fetches approved
+     * requests for the tenant and filters client-side by the resolved release name.
+     */
+    private hasApprovedDeployRequest;
+    /** A deploy the policy gate refused: its verdict, then the refusal and how to proceed, exiting 2. */
+    private refuseByPolicyGate;
+    /**
+     * Does this tenant have the deploy approval gate enabled?
+     *
+     * Returns false if the tenant has `allow_quick_deploy` set — that flag lets a
+     * tenant skip the approval gate entirely for quick deploys, regardless of
+     * `required_reviewers`.
+     *
+     * Deliberately uses `tenant list` rather than `tenant get`: the single-tenant
+     * GET route's output whitelist (tenant-detail.yaml) omits `deploy_settings`
+     * (which holds `required_reviewers`, `allow_deploy_bypass`, and
+     * `allow_quick_deploy`) even though the list route's output includes it
+     * — confirmed live against a running instance. Filed as a backend bug; this
+     * is the workaround until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+     */
+    private tenantRequiresApproval;
+    /** A release policy the tenant's import could not land (its key is held by another policy) is never dropped silently. */
+    private warnPoliciesSkipped;
 }

package/dist/commands/tenant/deploy_release/index.js

@@ -1,5 +1,7 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { deployedGateLine, fetchPolicyGate, gateExitCode, gateLines, gateOverrideHint, gateRefusal, gateRefusalOutput, quoted, } from '../../../utils/policy/gate.js';
+import { policyPermissionGuidance } from '../../../utils/policy/permission.js';
 export default class TenantDeployRelease extends BaseCommand {
     static args = {
         tenant_name: Args.string({
@@ -7,7 +9,7 @@ export default class TenantDeployRelease extends BaseCommand {
             required: true,
         }),
     };
-    static description = '[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant.';
+    static description = "[CRITICAL] STOP and confirm with the user before deploying a release to a tenant; this mutates the live tenant. Deploys a release to a tenant.";
     static examples = [
         `$ xano tenant deploy_release t1234-abcd-xyz1 --release v1.0
 Deployed release "v1.0" to tenant: My Tenant (my-tenant)
@@ -16,6 +18,12 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        check: Flags.boolean({
+            default: false,
+            description: "Preview the release's policy gate on this tenant without deploying; exits 2 when the deploy would be refused",
+            exclusive: ['override-reason'],
+            hidden: true,
+        }),
         output: Flags.string({
             char: 'o',
             default: 'summary',
@@ -23,6 +31,11 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             options: ['summary', 'json'],
             required: false,
         }),
+        'override-reason': Flags.string({
+            description: 'Deploy past a blocking policy gate, recording this reason (needs the workspace:policy update permission; audited)',
+            exclusive: ['check'],
+            hidden: true,
+        }),
         release: Flags.string({
             char: 'r',
             description: 'Release name to deploy',
@@ -34,6 +47,14 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             required: false,
         }),
     };
+    /** Set once the policy gate refuses the deploy, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(TenantDeployRelease);
         const { profile } = this.resolveProfile(flags);
@@ -43,12 +64,46 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
         }
         const releaseName = flags.release;
         const tenantName = args.tenant_name;
+        if (flags.check) {
+            await this.checkPolicyGate({ flags, profile, releaseName, tenantName, workspaceId });
+            return;
+        }
+        const overrideReason = flags['override-reason']?.trim();
+        if (flags['override-reason'] !== undefined && !overrideReason) {
+            this.error('--override-reason needs a reason: say why this deploy may proceed past the policy gate.');
+        }
+        // Pre-flight: the "approval required" error must always be shown before any
+        // permission/RBAC error. The backend's own deploy route checks RBAC first
+        // and the approval gate second (inside mvp:tenant_deploy_release), so a
+        // caller who lacks deploy permission would otherwise never learn a request
+        // is what's actually needed. Checking here first, with an endpoint that
+        // only needs read scope, guarantees the right error is shown regardless of
+        // whether the caller can deploy at all.
+        const requiresApproval = await this.tenantRequiresApproval(profile, workspaceId, tenantName, flags.verbose);
+        if (requiresApproval) {
+            const hasApprovedRequest = await this.hasApprovedDeployRequest({
+                profile,
+                releaseName,
+                tenantName,
+                verbose: flags.verbose,
+                workspaceId,
+            });
+            if (!hasApprovedRequest) {
+                this.error(`Tenant "${tenantName}" requires an approved deploy request before "${releaseName}" can be deployed.\n` +
+                    `Run: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`);
+            }
+        }
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant/${tenantName}/deploy`;
         this.warn('This may take a few minutes. Please be patient.');
         const startTime = Date.now();
+        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
+        let refused = null;
         try {
             const response = await this.verboseFetch(apiUrl, {
-                body: JSON.stringify({ release_name: releaseName }),
+                body: JSON.stringify({
+                    release_name: releaseName,
+                    ...(overrideReason ? { override_policy: true, override_reason: overrideReason } : {}),
+                }),
                 headers: {
                     accept: 'application/json',
                     Authorization: `Bearer ${profile.access_token}`,
@@ -57,8 +112,22 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
-                const errorText = await response.text();
-                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+                refused = await gateRefusal(response);
+                if (refused) {
+                    const override = `xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`;
+                    this.refuseByPolicyGate(refused, flags, override);
+                }
+                let message = await this.parseApiError(response, 'API request failed');
+                // Only reached once the pre-flight above has already confirmed the
+                // approval gate is satisfied or not applicable — so a permission error
+                // here is genuinely about RBAC, not about a missing approval. If the
+                // tenant supports deploy requests, mention that path as an alternative
+                // to direct deploy, since opening a request doesn't require deploy
+                // permission.
+                if ((response.status === 401 || response.status === 403) && requiresApproval) {
+                    message += `\n\nYou don't have permission to deploy to this tenant directly, but it supports deploy requests: xano tenant_deploy_request create "Deploy ${releaseName} to ${tenantName}" --tenant ${tenantName} --release ${releaseName} --reviewers <id,id,...>`;
+                }
+                this.error(message);
             }
             const tenant = (await response.json());
             if (flags.output === 'json') {
@@ -71,10 +140,15 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
                     this.log(`  State: ${tenant.state}`);
                 if (tenant.release?.name)
                     this.log(`  Release: ${tenant.release.name}`);
+                if (tenant.policy_gate?.status && tenant.policy_gate.status !== 'disabled')
+                    this.log(`  ${deployedGateLine(tenant.policy_gate)}`);
                 this.log(`  Time: ${elapsed}s`);
             }
+            this.warnPoliciesSkipped(tenant);
         }
         catch (error) {
+            if (refused)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to deploy to tenant: ${error.message}`);
             }
@@ -83,4 +157,108 @@ Deployed release "v1.0" to tenant: My Tenant (my-tenant)
             }
         }
     }
+    /**
+     * `--check`: what the policy gate would decide for this release on this tenant, without deploying.
+     * Exits 2 when the deploy would be refused; a preview the platform cannot answer exits 1.
+     */
+    async checkPolicyGate(opts) {
+        const { flags, profile, releaseName, tenantName, workspaceId } = opts;
+        const result = await fetchPolicyGate({ verboseFetch: (...args) => this.verboseFetch(...args) }, { profile, release: releaseName, tenant: tenantName, verbose: flags.verbose, workspace: workspaceId });
+        if ('unavailable' in result) {
+            const { message, payload, status } = result.unavailable;
+            this.error(`Policy gate preview failed (${status}): ${message}${policyPermissionGuidance(status, payload)}`);
+        }
+        const { answer } = result;
+        const exit = gateExitCode(answer);
+        if (flags.output === 'json') {
+            this.log(JSON.stringify(answer, null, 2));
+        }
+        else {
+            this.log(`Checked release "${releaseName}" for tenant "${tenantName}"; nothing was deployed.`);
+            for (const line of gateLines(answer))
+                this.log(line);
+            if (exit) {
+                this.log(answer.can_override
+                    ? `To deploy past the gate: xano tenant deploy_release ${quoted(tenantName)} --release ${quoted(releaseName)} --override-reason "<why>"`
+                    : 'A deploy is refused unless someone with the workspace:policy update permission overrides the gate.');
+            }
+        }
+        if (exit)
+            process.exitCode = exit;
+    }
+    /**
+     * Does an approved tenant_deploy_request already exist for this (tenant, release)
+     * pair? The list endpoint has no release filter, so this fetches approved
+     * requests for the tenant and filters client-side by the resolved release name.
+     */
+    async hasApprovedDeployRequest(opts) {
+        const { profile, releaseName, tenantName, verbose, workspaceId } = opts;
+        const params = new URLSearchParams({ per_page: '100', status: 'approved', tenant_name: tenantName });
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request?${params}`;
+        const response = await this.verboseFetch(apiUrl, {
+            headers: {
+                accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
+            },
+            method: 'GET',
+        }, verbose, profile.access_token);
+        if (!response.ok) {
+            // A read-scope failure here means something is more broadly wrong (e.g.
+            // no workspace access at all) — surface it rather than silently treating
+            // it as "no approval found", which would misreport as approval-required.
+            const message = await this.parseApiError(response, 'Failed to check for an approved deploy request');
+            this.error(message);
+        }
+        const data = (await response.json());
+        const items = Array.isArray(data) ? data : (data.items ?? []);
+        return items.some((item) => item.status === 'approved' && item._release?.name === releaseName);
+    }
+    /** A deploy the policy gate refused: its verdict, then the refusal and how to proceed, exiting 2. */
+    refuseByPolicyGate(refused, flags, override) {
+        for (const line of gateRefusalOutput(refused, flags.output === 'json'))
+            this.log(line);
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
+    }
+    /**
+     * Does this tenant have the deploy approval gate enabled?
+     *
+     * Returns false if the tenant has `allow_quick_deploy` set — that flag lets a
+     * tenant skip the approval gate entirely for quick deploys, regardless of
+     * `required_reviewers`.
+     *
+     * Deliberately uses `tenant list` rather than `tenant get`: the single-tenant
+     * GET route's output whitelist (tenant-detail.yaml) omits `deploy_settings`
+     * (which holds `required_reviewers`, `allow_deploy_bypass`, and
+     * `allow_quick_deploy`) even though the list route's output includes it
+     * — confirmed live against a running instance. Filed as a backend bug; this
+     * is the workaround until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+     */
+    async tenantRequiresApproval(profile, workspaceId, tenantName, verbose) {
+        const params = new URLSearchParams({ per_page: '100' });
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${params}`;
+        const response = await this.verboseFetch(apiUrl, {
+            headers: {
+                accept: 'application/json',
+                Authorization: `Bearer ${profile.access_token}`,
+            },
+            method: 'GET',
+        }, verbose, profile.access_token);
+        if (!response.ok) {
+            const message = await this.parseApiError(response, 'Failed to look up tenant');
+            this.error(message);
+        }
+        const data = (await response.json());
+        const items = Array.isArray(data) ? data : (data.items ?? []);
+        const tenant = items.find((item) => item.name === tenantName);
+        if (tenant?.deploy_settings?.allow_quick_deploy)
+            return false;
+        return (tenant?.deploy_settings?.required_reviewers ?? 0) > 0;
+    }
+    /** A release policy the tenant's import could not land (its key is held by another policy) is never dropped silently. */
+    warnPoliciesSkipped(tenant) {
+        const message = tenant.policies_skipped?.message;
+        if (message)
+            this.warn(message);
+    }
 }

package/dist/commands/tenant/edit/index.d.ts

@@ -6,6 +6,7 @@ export default class TenantEdit extends BaseCommand {
     static description: string;
     static examples: string[];
     static flags: {
+        allow_quick_deploy: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         display: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         domain: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
@@ -13,6 +14,7 @@ export default class TenantEdit extends BaseCommand {
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         proxy: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         rbac: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        required_reviewers: import("@oclif/core/interfaces").OptionFlag<number | undefined, import("@oclif/core/interfaces").CustomOptions>;
         tasks: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;