@xano/cli 1.3.4 → 1.3.5-beta.0

package/dist/commands/tenant/edit/index.js

@@ -13,9 +13,15 @@ export default class TenantEdit extends BaseCommand {
 Updated tenant: New Name (my-tenant) - ID: 42
 `,
         `$ xano tenant edit t1234-abcd-xyz1 --no-tasks --no-ingress -o json`,
+        `$ xano tenant edit t1234-abcd-xyz1 --required_reviewers 1`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
+        allow_quick_deploy: Flags.boolean({
+            allowNo: true,
+            description: 'Allow this tenant to skip the deploy approval gate entirely for quick deploys, regardless of --required_reviewers.',
+            required: false,
+        }),
         description: Flags.string({
             char: 'd',
             description: 'New description',
@@ -50,6 +56,10 @@ Updated tenant: New Name (my-tenant) - ID: 42
             description: '[CRITICAL] NEVER disable RBAC without explicit user confirmation; this removes role-based access controls on the tenant. Enables/disables RBAC.',
             required: false,
         }),
+        required_reviewers: Flags.integer({
+            description: 'When greater than 0, that many distinct reviewers must approve a tenant_deploy_request before a release may be deployed to this tenant. 0 means not gated.',
+            required: false,
+        }),
         tasks: Flags.boolean({
             allowNo: true,
             description: '[IMPORTANT] ALWAYS confirm with the user before disabling background tasks; this stops scheduled jobs on the tenant. Enables/disables background tasks.',
@@ -76,8 +86,17 @@ Updated tenant: New Name (my-tenant) - ID: 42
             'Content-Type': 'application/json',
         };
         try {
-            // Fetch current tenant state (PUT requires all fields)
-            const getResponse = await this.verboseFetch(baseUrl, {
+            // Fetch current tenant state (PUT requires all fields). Deliberately uses
+            // `tenant list` rather than `tenant get`: the single-tenant GET route's
+            // output whitelist (tenant-detail.yaml) omits `deploy_settings` (which
+            // holds `required_reviewers`, `allow_deploy_bypass`, and
+            // `allow_quick_deploy`) even though the list route's output includes it
+            // — confirmed live against a running instance. Using GET here would
+            // silently reset those fields to their defaults on every edit that doesn't
+            // explicitly pass them. Filed as a backend bug; this is the workaround
+            // until it's fixed. See TENANT_DEPLOY_REQUEST_TEST.md.
+            const listParams = new URLSearchParams({ per_page: '100' });
+            const getResponse = await this.verboseFetch(`${profile.instance_origin}/api:meta/workspace/${workspaceId}/tenant?${listParams}`, {
                 headers: {
                     'accept': 'application/json',
                     'Authorization': `Bearer ${profile.access_token}`,
@@ -88,9 +107,25 @@ Updated tenant: New Name (my-tenant) - ID: 42
                 const errorText = await getResponse.text();
                 this.error(`Failed to fetch tenant: ${getResponse.status} ${getResponse.statusText}\n${errorText}`);
             }
-            const current = await getResponse.json();
-            // Merge in user-provided values
+            const listData = (await getResponse.json());
+            const listItems = Array.isArray(listData) ? listData : (listData.items ?? []);
+            const current = listItems.find((item) => item.name === tenantName);
+            if (!current) {
+                this.error(`Tenant "${tenantName}" not found`);
+            }
+            // Merge in user-provided values. allow_deploy_bypass has no edit flag (it's
+            // fixed at `tenant create` time), but the PUT still requires the full body,
+            // so its current value is preserved here rather than reset.
             const body = {
+                deploy_settings: {
+                    allow_deploy_bypass: current.deploy_settings?.allow_deploy_bypass ?? false,
+                    allow_quick_deploy: flags.allow_quick_deploy === undefined
+                        ? (current.deploy_settings?.allow_quick_deploy ?? false)
+                        : flags.allow_quick_deploy,
+                    required_reviewers: flags.required_reviewers === undefined
+                        ? (current.deploy_settings?.required_reviewers ?? 0)
+                        : flags.required_reviewers,
+                },
                 description: flags.description === undefined ? (current.description ?? '') : flags.description,
                 display: flags.display === undefined ? (current.display ?? current.name) : flags.display,
                 domain: flags.domain === undefined ? (current.domain ?? '') : flags.domain,

package/dist/commands/tenant_deploy_request/bypass/index.d.ts

@@ -0,0 +1,31 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestBypass extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'override-policy': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        reason: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
+    run(): Promise<void>;
+    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
+    private refuseByPolicyGate;
+}

package/dist/commands/tenant_deploy_request/bypass/index.js

@@ -0,0 +1,109 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+import { gateOverrideHint, gateRefusal, gateRefusalOutput } from '../../../utils/policy/gate.js';
+export default class TenantDeployRequestBypass extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = "[CRITICAL] STOP and confirm with the user before running this; it deploys the release immediately, past the review workflow. Deploy the request's release past the approval gate under the tenant_center:deploy:bypass_approval permission. Only available if the tenant has enabled bypass (allow_deploy_bypass), and every use is logged with the given reason. The approval request's own status is left untouched.";
+    static examples = [
+        `$ xano tenant_deploy_request bypass 12 --reason "Prod incident, reviewer unavailable"
+Deployed tenant release, bypassing deploy request #12's approval gate.
+`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        'override-policy': Flags.boolean({
+            default: false,
+            description: 'Also proceed past a blocking policy gate, recording --reason as the override reason (needs the workspace:policy update permission; audited)',
+            hidden: true,
+        }),
+        reason: Flags.string({
+            description: 'Reason for bypassing the approval gate (required, audited)',
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    /** Set once the policy gate refuses the bypass deploy, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestBypass);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const body = {
+            reason: flags.reason,
+            ...(flags['override-policy'] ? { override_policy: true } : {}),
+        };
+        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
+        let refused = null;
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}/override`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                refused = await gateRefusal(response);
+                if (refused)
+                    this.refuseByPolicyGate(refused, args.id, flags.output === 'json');
+                const message = await this.parseApiError(response, 'Failed to bypass tenant deploy request approval gate');
+                this.error(message);
+            }
+            const deploy = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(deploy, null, 2));
+            }
+            else {
+                this.log(`Deployed tenant release, bypassing deploy request #${args.id}'s approval gate.`);
+                if (deploy.duration_ms !== undefined)
+                    this.log(`  Time: ${(deploy.duration_ms / 1000).toFixed(1)}s`);
+            }
+        }
+        catch (error) {
+            if (refused)
+                throw error;
+            if (error instanceof Error) {
+                this.error(`Failed to bypass tenant deploy request approval gate: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to bypass tenant deploy request approval gate: ${String(error)}`);
+            }
+        }
+    }
+    /** The bypass deploy was refused by the policy gate: its verdict, then the refusal, exiting 2. */
+    refuseByPolicyGate(refused, id, json) {
+        for (const line of gateRefusalOutput(refused, json))
+            this.log(line);
+        const override = `xano tenant_deploy_request bypass ${id} --reason "<why>" --override-policy`;
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
+    }
+}

package/dist/commands/tenant_deploy_request/create/index.d.ts

@@ -0,0 +1,21 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestCreate extends BaseCommand {
+    static args: {
+        title: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        draft: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        release: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        reviewers: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        tenant: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tenant_deploy_request/create/index.js

@@ -0,0 +1,108 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestCreate extends BaseCommand {
+    static args = {
+        title: Args.string({
+            description: 'Short title for the deploy request',
+            required: true,
+        }),
+    };
+    static description = 'Open a tenant deploy request asking named reviewers to approve deploying a release to a tenant. Submits for review immediately unless --draft is passed.';
+    static examples = [
+        `$ xano tenant_deploy_request create "Deploy v1.2 to prod" --tenant prod --release v1.2 --reviewers 12,45
+Created deploy request #12: "Deploy v1.2 to prod" [pending]
+`,
+        `$ xano tenant_deploy_request create "Deploy v1.2 to prod" --tenant prod --release v1.2 --draft`,
+        `$ xano tenant_deploy_request create "$PR_TITLE" --tenant prod --release v1.2 --description "$PR_BODY" --reviewers 12,45 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        description: Flags.string({
+            char: 'd',
+            description: 'Longer description of what is being deployed and why',
+            required: false,
+        }),
+        draft: Flags.boolean({
+            default: false,
+            description: 'Save as a draft instead of submitting immediately (reviewers are not notified until submitted)',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        release: Flags.string({
+            char: 'r',
+            description: 'Name of the release to deploy',
+            required: true,
+        }),
+        reviewers: Flags.string({
+            description: 'Comma-separated user IDs to request review from',
+            required: false,
+        }),
+        tenant: Flags.string({
+            char: 't',
+            description: 'Name of the target tenant',
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestCreate);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const reviewerIds = flags.reviewers
+            ? flags.reviewers.split(',').map((id) => Number.parseInt(id.trim(), 10))
+            : [];
+        const body = {
+            release_name: flags.release,
+            reviewer_ids: reviewerIds,
+            status: flags.draft ? 'draft' : 'pending',
+            tenant_name: flags.tenant,
+            title: args.title,
+        };
+        if (flags.description)
+            body.description = flags.description;
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const message = await this.parseApiError(response, 'Failed to create tenant deploy request');
+                this.error(message);
+            }
+            const item = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(item, null, 2));
+            }
+            else {
+                this.log(`Created deploy request #${item.id}: "${item.title}" [${item.status}]`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to create tenant deploy request: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to create tenant deploy request: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/edit/index.d.ts

@@ -0,0 +1,22 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestEdit extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        description: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        reviewers: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        title: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tenant_deploy_request/edit/index.js

@@ -0,0 +1,103 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestEdit extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = "Edit a tenant deploy request's title, description or reviewers. The author or an existing reviewer may do this.";
+    static examples = [
+        `$ xano tenant_deploy_request edit 12 --title "Deploy v1.2.1 to prod"
+Updated deploy request #12: "Deploy v1.2.1 to prod" [pending]
+`,
+        `$ xano tenant_deploy_request edit 12 --reviewers 12,45,67 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        description: Flags.string({
+            char: 'd',
+            description: 'New description',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        reviewers: Flags.string({
+            description: 'Replacement comma-separated user IDs to request review from',
+            required: false,
+        }),
+        title: Flags.string({
+            description: 'New title',
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestEdit);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const baseUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}`;
+        try {
+            const getResponse = await this.verboseFetch(baseUrl, {
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                },
+                method: 'GET',
+            }, flags.verbose, profile.access_token);
+            if (!getResponse.ok) {
+                const message = await this.parseApiError(getResponse, 'Failed to fetch tenant deploy request');
+                this.error(message);
+            }
+            const current = (await getResponse.json());
+            const body = {
+                description: flags.description === undefined ? (current.description ?? '') : flags.description,
+                reviewer_ids: flags.reviewers
+                    ? flags.reviewers.split(',').map((id) => Number.parseInt(id.trim(), 10))
+                    : (current.reviewers ?? []).map((r) => r.id),
+                title: flags.title === undefined ? current.title : flags.title,
+            };
+            const putResponse = await this.verboseFetch(baseUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'PUT',
+            }, flags.verbose, profile.access_token);
+            if (!putResponse.ok) {
+                const message = await this.parseApiError(putResponse, 'Failed to edit tenant deploy request');
+                this.error(message);
+            }
+            const item = (await putResponse.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(item, null, 2));
+            }
+            else {
+                this.log(`Updated deploy request #${item.id}: "${item.title}" [${item.status}]`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to edit tenant deploy request: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to edit tenant deploy request: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/get/index.d.ts

@@ -0,0 +1,25 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestGet extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    /**
+     * The policy gate's verdict on the request's release for its tenant, as a deploy now would meet it.
+     * Only a policy reader gets one; any refusal or failure is a reason it is not available, never an
+     * error of this command.
+     */
+    private policyCheck;
+}

package/dist/commands/tenant_deploy_request/get/index.js

@@ -0,0 +1,113 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+import { fetchPolicyGate, gateLines, unavailableReason } from '../../../utils/policy/gate.js';
+export default class TenantDeployRequestGet extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = 'Get details of a specific tenant deploy request';
+    static examples = [
+        `$ xano tenant_deploy_request get 12
+Deploy request #12: "Deploy v1.2 to prod" [pending]
+  Tenant: prod
+  Release: v1.2
+`,
+        `$ xano tenant_deploy_request get 12 -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestGet);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                },
+                method: 'GET',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const message = await this.parseApiError(response, 'Failed to get tenant deploy request');
+                this.error(message);
+            }
+            const item = (await response.json());
+            const policyCheck = await this.policyCheck(item, { profile, verbose: flags.verbose, workspaceId });
+            if (flags.output === 'json') {
+                this.log(JSON.stringify({ ...item, policy_gate: policyCheck.answer ?? null,
+                    ...(policyCheck.unavailable ? { policy_gate_unavailable: policyCheck.unavailable } : {}) }, null, 2));
+            }
+            else {
+                this.log(`Deploy request #${item.id}: "${item.title}" [${item.status}]`);
+                this.log(`  Tenant: ${item._tenant?.name || (item.deployment?.tenant?.id ? `#${item.deployment.tenant.id}` : 'unavailable')}`);
+                this.log(`  Release: ${item._release?.name || (item.deployment?.release?.id ? `#${item.deployment.release.id}` : 'unavailable')}`);
+                if (item.description)
+                    this.log(`  Description: ${item.description}`);
+                if (item.reviewers?.length)
+                    this.log(`  Reviewers: ${item.reviewers.map((r) => r.id).join(', ')}`);
+                if (item.can_review !== undefined)
+                    this.log(`  Can review: ${item.can_review}`);
+                if (policyCheck.answer) {
+                    this.log(`Policy check of release "${item._release?.name}" on tenant "${item._tenant?.name}":`);
+                    for (const line of gateLines(policyCheck.answer))
+                        this.log(line);
+                }
+                else if (policyCheck.unavailable) {
+                    this.log(`Policy checks: not available (${policyCheck.unavailable})`);
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to get tenant deploy request: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to get tenant deploy request: ${String(error)}`);
+            }
+        }
+    }
+    /**
+     * The policy gate's verdict on the request's release for its tenant, as a deploy now would meet it.
+     * Only a policy reader gets one; any refusal or failure is a reason it is not available, never an
+     * error of this command.
+     */
+    async policyCheck(item, target) {
+        // Terminal requests are historical records: previewing now can check a different base release.
+        if (['approved', 'closed'].includes(item.status))
+            return {};
+        const tenant = item._tenant?.name?.trim();
+        const release = item._release?.name?.trim();
+        if (!tenant || !release)
+            return { unavailable: 'the request does not name its tenant and release' };
+        try {
+            const result = await fetchPolicyGate({ verboseFetch: (...args) => this.verboseFetch(...args) }, { profile: target.profile, release, tenant, verbose: target.verbose, workspace: String(target.workspaceId) });
+            if ('answer' in result)
+                return result.answer.status === 'disabled' ? {} : { answer: result.answer };
+            return result.unavailable.payload?.code === 'policy_feature_disabled' ? {} : { unavailable: unavailableReason(result.unavailable) };
+        }
+        catch (error) {
+            return { unavailable: error instanceof Error ? error.message : String(error) };
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/list/index.d.ts

@@ -0,0 +1,20 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        mine: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        page: import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        'per-page': import("@oclif/core/interfaces").OptionFlag<number, import("@oclif/core/interfaces").CustomOptions>;
+        release: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        status: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        tenant: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        'to-review': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}