devlift-cli 0.1.4__tar.gz → 0.1.6__tar.gz

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devlift-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: DevLift command-line tool: create, change, review and deploy DevLift resources from the terminal.
 License: Proprietary
 Keywords: devlift,devops,deployment,infrastructure,cli

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/MANUAL.md

@@ -136,17 +136,33 @@ error: s3 is not offered in 'canada' for core/stage.
 Available there: Mumbai.
 ```
 
-`applications list`, `environments list` and `regions list` are filtered by
-it too, so what you are offered is what you can actually create in. They say
-how many rows they hid, and `--all` shows everything the backend reports:
+**Every list is filtered by it**, so what you are shown is what you can
+actually work with: `applications list`, `environments list`, `regions list`,
+`resource-groups list`, `clusters list`, `services list`, and the resource
+lists `s3 list`, `sqs list` and `dynamodb list`. Each says how many rows it
+withheld:
 
 ```
-devlift applications list            core          (falcon has no placement)
+devlift applications list            core
 devlift environments list            core/stage: Mumbai
 devlift regions list --for s3        Mumbai
-devlift regions list --all           Canada, London, Mumbai
+devlift s3 list                      63 of 212 hidden: not a placement your allowlist defines.
 ```
 
+There is no flag to see past it. A resource in a placement the allowlist does
+not define cannot be created there, so listing it only invites someone to
+pick it. Looking one up by name is refused for the same reason, naming the
+placement rather than claiming the resource does not exist:
+
+```
+error: 'email-platform' is in prod/region-aspora-london, which your placement
+allowlist does not define.
+```
+
+`services list` is the one partial case. A service row carries an application
+but no environment or region, because a service is not placed anywhere until
+it has a configuration, so only the product can be matched there.
+
 Service keys are `s3`, `sqs`, `dynamo`, `eks`, `gateway` and `database`.
 Matching is on names, not codes: product `core`, environment `stage`, region
 `ap-south-1` resolved to its city label. A tenant with no file is not
@@ -185,11 +201,10 @@ login waits up to five minutes for the redirect.
 ### applications, environments, regions, resource-types, resource-groups, repositories, languages
 
 ```
-devlift applications list [--active] [--all]
-devlift environments list [--app NAME] [--all]  Environments and their regions per application.
+devlift applications list [--active]
+devlift environments list [--app NAME]          Environments and their regions per application.
 devlift regions list [--app NAME] [--env ENV]   Regions you can place resources in (the --region values).
 devlift regions list --for s3                   Only the regions that really offer that service.
-devlift regions list --all                      Skip the placement allowlist (section 5).
 devlift regions list --vendor aws               The cloud vendor's raw region list.
 devlift resource-types list [--family FAMILY]   Infrastructure types (storage, compute, network, …).
 devlift resource-groups list [--app NAME]       Resource groups; services are created inside one.
@@ -223,7 +238,7 @@ devlift languages list        Languages and versions a service can use (--langua
 ### clusters
 
 ```
-devlift clusters list [--app NAME] [--env ENV] [--region REGION] [--type eks|ecs] [--search TEXT] [--all]
+devlift clusters list [--app NAME] [--env ENV] [--region REGION] [--type eks|ecs] [--search TEXT]
 ```
 
 The clusters services run on, and the `--cluster` values for `eks create`.
@@ -231,16 +246,14 @@ Narrowed by three filters, the same ones a create goes through: the backend
 reports only the environments this deployment serves, the placement allowlist
 (section 5) says which of those offer EKS or ECS, and only a **registered**
 cluster may take a new service. Anything outside those is real but can never
-be chosen, so it is hidden and counted. `--all` drops all three and shows
-everything the backend reports, for checking what exists rather than for
-choosing.
+be chosen, so it is hidden and counted. There is no flag to see past it.
 
 ```
 devlift clusters list --type eks --app core --env stage
 ```
 
 ```
-22 of 25 hidden: not a placement this deployment offers; --all shows everything.
+22 of 25 hidden: not a placement your allowlist defines.
 2 more hidden: not registered, so no service can be created on them.
 
 Cluster                                        Type  Environment  Region  Application  Registered
@@ -509,7 +522,7 @@ devlift eks create --name NAME --app APP --env ENV --region REGION --type api|wo
                    [--set key=value ...] [--public] [-y]
 devlift eks settings                  Every key --set accepts, and when each applies.
 devlift eks settings <service>        Only the keys that apply to it, with its current values.
-devlift eks show <service> --env ENV  The configuration as it stands, with pending values marked.
+devlift eks show <service> --env ENV  The configuration, with any pending draft over it; pending rows name the deployed value too.
 devlift eks diff <service> --env ENV  Preview the pending change: Field | Deployed | Requested.
 devlift eks diff <service> --deployed The live configuration versus the last deployment.
 devlift eks edit <service> --env ENV [--set key=value ...]
@@ -752,7 +765,15 @@ last deployed. That one ignores drafts entirely, so on a service whose
 change is still a draft it shows the live row and its defaults, not what the
 draft proposes.
 
-`eks show` marks each value that a pending request would change.
+**`eks show` is not "what is deployed" while a request is open.** Its
+Configuration table is the live configuration with the open draft laid over
+it, so a pending row shows the value the draft *proposes*. Each such row is
+marked `pending (<status>) — deployed <value>`, so both numbers are visible.
+
+In `-o json` the same thing is spelled out: `settings` is the merged view,
+`deployed_settings` is what is actually running, and `pending` gives
+`{deployed, requested}` for each changed key. When `pending_request` is null
+there is no draft and `settings` is simply the deployed configuration.
 
 ### kong
 

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/__init__.py

@@ -1,3 +1,3 @@
 """DevLift command-line tool."""
 
-__version__ = "0.1.4"
+__version__ = "0.1.6"

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/commands/catalog.py

@@ -20,7 +20,6 @@ resource_groups_app = typer.Typer(help="Resource groups (the permission boundary
 services_app = typer.Typer(help="Services in your tenant.", no_args_is_help=True)
 
 _NO_CACHE = typer.Option(False, "--no-cache", help="Refetch instead of using the short-lived local cache.")
-_ALL = typer.Option(False, "--all", help="Everything the backend reports, without the placement allowlist.")
 
 
 def _resolver(inv: Invocation, no_cache: bool) -> Resolver:
@@ -30,21 +29,20 @@ def _resolver(inv: Invocation, no_cache: bool) -> Resolver:
 def _hidden(before: int, after: int) -> None:
     """Say when the allowlist removed rows, so the absence is never a mystery."""
     if after < before:
-        output.info(f"{before - after} of {before} hidden by the placement allowlist; --all shows everything.")
+        output.info(f"{before - after} of {before} hidden: not a placement your allowlist defines.")
 
 
 @applications_app.command("list")
-def applications_list(ctx: typer.Context, active_only: bool = typer.Option(False, "--active", help="Only active applications."), show_all: bool = _ALL, no_cache: bool = _NO_CACHE):
+def applications_list(ctx: typer.Context, active_only: bool = typer.Option(False, "--active", help="Only active applications."), no_cache: bool = _NO_CACHE):
     """List applications that have a real placement (see section 5)."""
     inv: Invocation = ctx.obj
     res = _resolver(inv, no_cache)
     apps = res.applications()
     if active_only:
         apps = [a for a in apps if a.get("is_active")]
-    if not show_all:
-        before = len(apps)
-        apps = allowlist.filter_applications(apps, res.placements(), res.tenant_code())
-        _hidden(before, len(apps))
+    before = len(apps)
+    apps = allowlist.filter_applications(apps, res.placements(), res.tenant_code())
+    _hidden(before, len(apps))
     inv.emit(apps, lambda d: rows_table(
         ["Name", "Code", "Services", "Groups", "Status"],
         [(a.get("application_name"), a.get("application_code"), a.get("services_count"), a.get("resource_groups_count"), a.get("status")) for a in d],
@@ -52,16 +50,15 @@ def applications_list(ctx: typer.Context, active_only: bool = typer.Option(False
 
 
 @environments_app.command("list")
-def environments_list(ctx: typer.Context, app: str | None = typer.Option(None, "--app", "--product", help="Only this application."), show_all: bool = _ALL, no_cache: bool = _NO_CACHE):
+def environments_list(ctx: typer.Context, app: str | None = typer.Option(None, "--app", "--product", help="Only this application."), no_cache: bool = _NO_CACHE):
     """List environments, and for each application the regions it can use."""
     inv: Invocation = ctx.obj
     res = _resolver(inv, no_cache)
     app_code = res.application(app)["application_code"] if app else None
     rows = res.regions_for(app_code)
-    if not show_all:
-        before = len(rows)
-        rows = allowlist.filter_placements(rows, res.tenant_code())
-        _hidden(before, len(rows))
+    before = len(rows)
+    rows = allowlist.filter_placements(rows, res.tenant_code())
+    _hidden(before, len(rows))
     grouped: dict[tuple[str, str], list[str]] = {}
     for r in rows:
         grouped.setdefault((r["product"], r["environment"]), []).append(r["region"])
@@ -79,14 +76,13 @@ def regions_list(
     env: str | None = typer.Option(None, "--env", help="Only this environment."),
     vendor: str | None = typer.Option(None, "--vendor", help="Show the cloud vendor's raw region list instead (e.g. aws)."),
     for_service: str | None = typer.Option(None, "--for", help="Only regions that offer this: s3 | sqs | dynamo | eks | gateway | database."),
-    show_all: bool = _ALL,
     no_cache: bool = _NO_CACHE,
 ):
     """List the regions (placements) available to you. These are the --region values.
 
     Filtered by the placement allowlist (section 5), which is narrower than
     what the backend reports. `--for s3` narrows further to one service, the
-    same check a create command makes. `--all` skips the filter.
+    same check a create command makes.
     """
     inv: Invocation = ctx.obj
     if vendor:
@@ -97,10 +93,9 @@ def regions_list(
     app_code = res.application(app)["application_code"] if app else None
     environment = res.environment(env) if env else None
     rows = res.regions_for(app_code, environment)
-    if not show_all:
-        before = len(rows)
-        rows = allowlist.filter_placements(rows, res.tenant_code(), for_service.strip().lower() if for_service else None)
-        _hidden(before, len(rows))
+    before = len(rows)
+    rows = allowlist.filter_placements(rows, res.tenant_code(), for_service.strip().lower() if for_service else None)
+    _hidden(before, len(rows))
     seen = {}
     for r in rows:
         seen.setdefault(r["geo_loc_mst_code"], {"region": r["region"], "geo_loc_mst_code": r["geo_loc_mst_code"], "placements": []})
@@ -120,7 +115,7 @@ def resource_types_list(ctx: typer.Context, family: str | None = typer.Option(No
 
 
 @resource_groups_app.command("list")
-def resource_groups_list(ctx: typer.Context, app: str | None = typer.Option(None, "--app", "--product", help="Only groups of this application."), show_all: bool = _ALL, no_cache: bool = _NO_CACHE):
+def resource_groups_list(ctx: typer.Context, app: str | None = typer.Option(None, "--app", "--product", help="Only groups of this application."), no_cache: bool = _NO_CACHE):
     """List resource groups. Services are created inside one.
 
     Only groups of applications you can actually place something in, so the
@@ -134,7 +129,7 @@ def resource_groups_list(ctx: typer.Context, app: str | None = typer.Option(None
     if app:
         code = res.application(app)["application_code"]
         groups = [g for g in groups if g.get("applications_mst_code") == code]
-    elif not show_all:
+    else:
         before = len(groups)
         allowed = {r["application_code"] for r in allowlist.filter_placements(res.placements(), res.tenant_code())}
         if allowed:
@@ -150,13 +145,25 @@ def services_list(
     search: str | None = typer.Option(None, "--search", help="Name contains this text."),
     no_cache: bool = _NO_CACHE,
 ):
-    """List services."""
+    """List services of applications your placement allowlist defines (section 5)."""
     inv: Invocation = ctx.obj
     res = _resolver(inv, no_cache)
     services = res.services()
     if app:
         code = res.application(app)["application_code"]
         services = [s for s in services if s.get("application_code") == code]
+    else:
+        # Application is the only placement dimension a service row carries: a
+        # service is not placed anywhere until it has a configuration per
+        # environment, so there is no environment or region here to match on.
+        # Filtering on the product alone is still worth doing — otherwise
+        # `applications list` says a product does not exist while this command
+        # lists its services.
+        before = len(services)
+        allowed = {r["application_code"] for r in allowlist.filter_placements(res.placements(), res.tenant_code())}
+        if allowed:
+            services = [s for s in services if s.get("application_code") in allowed]
+        _hidden(before, len(services))
     if search:
         services = [s for s in services if search.lower() in (s.get("service_name") or "").lower()]
     inv.emit(services, lambda d: rows_table(

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/commands/clusters.py

@@ -62,7 +62,6 @@ def clusters_list(
     region: str | None = typer.Option(None, "--region", help="Only this region."),
     kind: str | None = typer.Option(None, "--type", help="eks | ecs. Both when omitted."),
     search: str | None = typer.Option(None, "--search", help="Match on the cluster name."),
-    show_all: bool = typer.Option(False, "--all", help="Every cluster the backend reports, without the placement filter."),
 ):
     """List the clusters a service can run on.
 
@@ -70,10 +69,7 @@ def clusters_list(
     deployment serves, placements the allowlist permits, and registration.
     Only a registered cluster may take a new service, so an unregistered one
     is never a candidate and is not listed. Everything shown here is a cluster
-    `eks create` would actually accept.
-
-    `--all` drops all three and shows everything the backend reports, which is
-    for checking what exists rather than for choosing.
+    `eks create` would actually accept, and there is no flag to see past it.
 
     A cluster with no application is tenant-level and is the fallback for
     every product that has none of its own.
@@ -95,23 +91,21 @@ def clusters_list(
         rows = [r for r in rows if wanted in (str(r.get("geo_loc_name", "")).lower(), str(r.get("geo_loc_mst_code", "")).lower())]
     if app_code:
         rows = [r for r in rows if r.get("applications_mst_code") in (app_code, None)]
-    if not show_all:
-        before = len(rows)
-        rows = _placeable(res, rows)
-        placement_hidden = before - len(rows)
-
-        # Unregistered clusters are not offerable, so listing them is worse than
-        # useless: a service cannot be created on one, and naming it invites a
-        # comparison against the registered cluster that reads as a discrepancy.
-        # `--all` still shows them, for someone checking what exists.
-        registered = [r for r in rows if r.get("is_registered")]
-        unregistered_hidden = len(rows) - len(registered)
-        rows = registered
-
-        if placement_hidden:
-            output.info(f"{placement_hidden} of {before} hidden: not a placement this deployment offers; --all shows everything.")
-        if unregistered_hidden:
-            output.info(f"{unregistered_hidden} more hidden: not registered, so no service can be created on them.")
+    before = len(rows)
+    rows = _placeable(res, rows)
+    placement_hidden = before - len(rows)
+
+    # Unregistered clusters are not offerable, so listing them is worse than
+    # useless: a service cannot be created on one, and naming it invites a
+    # comparison against the registered cluster that reads as a discrepancy.
+    registered = [r for r in rows if r.get("is_registered")]
+    unregistered_hidden = len(rows) - len(registered)
+    rows = registered
+
+    if placement_hidden:
+        output.info(f"{placement_hidden} of {before} hidden: not a placement your allowlist defines.")
+    if unregistered_hidden:
+        output.info(f"{unregistered_hidden} more hidden: not registered, so no service can be created on them.")
     inv.emit(rows, lambda d: rows_table(
         ["Cluster", "Type", "Environment", "Region", "Application", "Registered", "Status", "Code"],
         [(r.get("cluster_name") or r.get("name"), r.get("cluster_type"), r.get("environment"),

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/commands/eks.py

@@ -110,13 +110,19 @@ def eks_show(
     region: str | None = typer.Option(None, "--region", help="Region, when the service runs in several."),
 ):
     """Show a service's configuration as it stands, marking values pending in an open request."""
-    from devlift_cli.ops.eks import LABELS, load_effective, _show
+    from devlift_cli.ops.eks import LABELS, load_effective, settings_from_config, _show
     from devlift_cli.render import output
 
     inv: Invocation = ctx.obj
     eff = load_effective(inv, Resolver(inv.api, inv.profile.name), service, env, region, for_edit=False)
     live = eff.live
     request = eff.draft
+    # `eff.settings` is the live config with the open draft laid OVER it, so for
+    # any pending key its value is what the draft proposes, not what is running.
+    # Reading it as "the current configuration" is the obvious mistake, and one
+    # that has been made, so the deployed values are published beside it rather
+    # than left to be inferred from pending_keys.
+    deployed_settings = settings_from_config(dict(live.get("config") or {}))
     data = {
         "service": eff.target.service_name, "service_config_code": eff.target.config_code,
         "environment": live.get("environment"), "region": eff.target.region_name,
@@ -129,8 +135,19 @@ def eks_show(
         "type": eff.service.get("service_type"), "repository": eff.config.get("repository"),
         "branches": eff.config.get("branches") or eff.config.get("selected_branches"),
         "language": f"{eff.language_label or ''} {eff.language_version or ''}".strip() or None,
-        "settings": eff.settings, "pending_request": {"code": request["code"], "status": request["status"]} if request else None,
+        # effective = deployed, with the pending draft laid over it.
+        "settings": eff.settings,
+        # what is actually running right now, whatever is pending.
+        "deployed_settings": deployed_settings,
+        "pending_request": {"code": request["code"], "status": request["status"]} if request else None,
         "pending_keys": sorted(eff.pending_keys),
+        # Both sides per changed setting, so "what is deployed" needs no
+        # cross-referencing of two dicts against a list of keys.
+        "pending": {
+            k: {"deployed": deployed_settings.get(k), "requested": eff.settings.get(k)}
+            for k in sorted(eff.settings)
+            if k in eff.pending_keys or (k in ("hpa_enabled", "min_replicas", "max_replicas") and "hpa" in eff.pending_keys)
+        } if request else {},
     }
 
     def table(d):
@@ -145,8 +162,15 @@ def eks_show(
         pend = set(d["pending_keys"])
         def mark(k):
             hit = k in pend or (k in ("hpa_enabled", "min_replicas", "max_replicas") and "hpa" in pend)
-            return f"pending ({d['pending_request']['status']})" if hit and d["pending_request"] else ""
-        return rows_table(["Setting", "Value", ""], [(LABELS.get(k, k), _show(v), mark(k)) for k, v in d["settings"].items()], title="Configuration")
+            if not (hit and d["pending_request"]):
+                return ""
+            # Name the value that is actually running. Marking the row "pending"
+            # while showing only the draft's number tells the reader the setting
+            # is changing but not what it is changing FROM, which is the half
+            # they need to judge it.
+            return f"pending ({d['pending_request']['status']}) — deployed {_show(d['deployed_settings'].get(k))}"
+        header = "Value (deployed)" if not d["pending_request"] else "Value (with pending draft)"
+        return rows_table(["Setting", header, ""], [(LABELS.get(k, k), _show(v), mark(k)) for k, v in d["settings"].items()], title="Configuration")
     inv.emit(data, table)
 
 

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/ops/resources.py

@@ -373,7 +373,40 @@ def update_resource(
     return UpdateResult(resource_code=resource_code, name=shown, changed=True, diff=diff, result=result)
 
 
-def list_resources(inv: Invocation, res: Resolver, kind: ResourceKind, *, app: str | None, env: str | None, region: str | None) -> list[dict]:
+def placeable(res: Resolver, rows: list[dict], service: str | None) -> list[dict]:
+    """Keep only rows in a placement the allowlist actually defines.
+
+    Infrastructure rows carry the same placement triple as the placement
+    options (`applications_mst_code`, `environment`, `geo_loc_mst_code`), so
+    the allowlist applies to them unchanged. A row with no application is
+    tenant-level and matches on environment and region alone.
+
+    This is narrower than the backend's ALLOWED_ENVIRONMENTS, and deliberately
+    so: that setting is a flat list of environment names and cannot say that
+    stage exists only in ap-south-1, or that one product is in scope and
+    another is not. The environment gate is the backend's job; deciding which
+    product, region and service each environment really offers is this file's.
+
+    Fails closed, like every other use of the allowlist: a tenant WITH a
+    config sees only what it lists. A tenant with no config is unfiltered.
+    """
+    if not allowlist.load(res.tenant_code()):
+        return rows
+    allowed = {
+        (p["application_code"], p["environment"], p["geo_loc_mst_code"])
+        for p in allowlist.filter_placements(res.placements(), res.tenant_code(), service)
+    }
+    kept = []
+    for row in rows:
+        here = (row.get("environment"), row.get("geo_loc_mst_code"))
+        app_code = row.get("applications_mst_code")
+        if (app_code, *here) in allowed if app_code else any((e, g) == here for _, e, g in allowed):
+            kept.append(row)
+    return kept
+
+
+def list_resources(inv: Invocation, res: Resolver, kind: ResourceKind, *, app: str | None, env: str | None,
+                   region: str | None) -> list[dict]:
     application_code = res.application(app)["application_code"] if app else None
     environment = res.environment(env) if env else None
     geo = None
@@ -383,15 +416,44 @@ def list_resources(inv: Invocation, res: Resolver, kind: ResourceKind, *, app: s
         if not match:
             raise InputError(f"Unknown region '{region}'. See `devlift regions list`.")
         geo = match[0]["geo_loc_mst_code"]
-    return infra_list.list_infrastructures(inv.api, infra_type=kind.infra_type, environment=environment, geo_loc_mst_code=geo, application_code=application_code)
+    rows = infra_list.list_infrastructures(inv.api, infra_type=kind.infra_type, environment=environment, geo_loc_mst_code=geo, application_code=application_code)
+    # Always. There is deliberately no flag to see past this: a resource in a
+    # placement the allowlist does not define cannot be created, and listing it
+    # only invites someone to pick it. An escape hatch would be used — most
+    # likely by an agent reading the help text and passing it to be thorough —
+    # which is exactly how the unusable rows got in front of a user before.
+    before = len(rows)
+    rows = placeable(res, rows, kind.service or None)
+    if before > len(rows):
+        output.info(f"{before - len(rows)} of {before} hidden: not a placement your allowlist defines.")
+    return rows
 
 
 def find_resource(inv: Invocation, res: Resolver, kind: ResourceKind, name: str, *, env: str | None = None) -> dict:
-    """One row by user-typed name (or code); env narrows when the name repeats."""
+    """One row by user-typed name (or code); env narrows when the name repeats.
+
+    Scoped to the allowlist, exactly like the listings. Without this a name
+    typed directly reached a resource the lists no longer show, so `describe`
+    and `update` were the one way back to a placement nothing can be created
+    in — and `update` would have queued a deployment there.
+    """
     environment = res.environment(env) if env else None
     rows = infra_list.list_infrastructures(inv.api, infra_type=kind.infra_type, environment=environment)
     needle = name.strip().lower()
     hits = [r for r in rows if needle in (infra_list.display_name(r).lower(), str(r.get("code") or "").lower(), str(r.get("name") or "").lower())]
+    if hits:
+        # Narrow AFTER matching, so a name that exists but sits outside the
+        # allowlist says so, instead of the bare "no such bucket" that sends
+        # someone hunting for a typo.
+        allowed = placeable(res, hits, kind.service or None)
+        if not allowed:
+            where = ", ".join(sorted({f"{r.get('environment')}/{r.get('geo_loc_mst_code')}" for r in hits}))
+            raise CliError(
+                f"'{name}' is in {where}, which your placement allowlist does not define.",
+                EXIT_NOT_FOUND,
+                hint="`devlift regions list` shows the placements you can work in.",
+            )
+        hits = allowed
     if not hits:
         raise CliError(f"No {kind.noun} named '{name}'" + (f" in {environment}" if environment else "") + ".", EXIT_NOT_FOUND)
     if len(hits) > 1:

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/skill/SKILL.md

@@ -31,6 +31,13 @@ Full reference: `devlift manual` (or `reference/commands.md` in this skill).
    application, environment or region survives, a create resolves it without
    being told — do not pass `--app/--env/--region` unless the user named one
    or a command asks for it.
+   **Every list is the complete answer.** Applications, environments, regions,
+   resource groups, clusters, services, and the s3/sqs/dynamodb lists are all
+   filtered to the tenant's placement allowlist, and there is no flag to widen
+   them. A line such as `63 of 212 hidden: not a placement your allowlist
+   defines` is normal and correct, not a problem to route around. Do not go
+   looking for a resource the lists withheld: naming one directly is refused
+   too, because nothing can be created or changed there.
 6. **Exit codes decide the next step** (see `reference/exit-codes.md`):
    0 ok · 1 error · 2 not signed in → tell the user to run `devlift login`
    (needs a browser; do not run it unattended) · 3 bad or missing input ·
@@ -239,6 +246,16 @@ the approved rows. The summary is printed on every dry run, in json mode too.
   finished, and `eks status <service> --env <env>` also asks ArgoCD whether the
   pod is actually serving, which is the real "is it up" question. A finished
   pipeline is not a running application.
+- **`eks show` is not "what is deployed" when a request is open.** Its
+  `settings` are the live configuration with the open draft laid OVER it, so
+  for any pending key the value shown is what the draft PROPOSES. Quoting one
+  as the running value is wrong and has misled a user.
+  Check `pending_request` first. If it is null, `settings` is the deployed
+  configuration and you can quote it freely. If it is set, use
+  `deployed_settings` for what is running, or `pending` which gives
+  `{deployed, requested}` per changed key, or run `devlift eks diff <service>
+  --env <env>`. Never describe a value as current, running or deployed on the
+  strength of `settings` alone while something is pending.
 - **Never compare a cluster code with a cluster name.** `eks show` returns both
   `cluster` (the name, e.g. `acme-core-stage-mumbai-01-application-cluster`)
   and `cluster_code` (e.g. `infra-acme-eks-staging-mumbai-app-01`). They are

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/skill/reference/commands.md

@@ -63,11 +63,11 @@ devlift eks create --name NAME --app APP --env ENV --region REGION --type api|wo
                    --repository owner/name --branch main [--branch ...]
                    --language Go|Python|Node.js|"Java Maven"|"Java Gradle" --version 1.24
                    [--set key=value ...] [--public] [-y]
-devlift eks show <service> --env ENV            configuration as it stands; pending values marked
+devlift eks show <service> --env ENV            live config WITH any open draft over it; deployed_settings + pending{} give the real deployed values
 devlift eks diff <service> --env ENV            preview the pending request: Field | Deployed | Requested
 devlift eks diff <service> --deployed           instead: live config vs the last deployment
 devlift eks settings <service> --env ENV        the --set keys that apply to it, with current values
-devlift clusters list [--type eks] [--app] [--env]   the --cluster values (Registered = may take a service)
+devlift clusters list [--type eks] [--app] [--env]   the --cluster values; every row listed can take a service
 devlift eks edit <service> --env ENV [--set key=value ...] [--repository owner/name] [--branch ...] [--language L --version V] [-y]
 devlift eks deploy <service> --env ENV [--region R] [--confirm-name NAME] [--wait] [-y]
 devlift eks status <service> --env ENV [--wait] [--no-argo]

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli/skill/reference/workflows.md

@@ -59,7 +59,9 @@ the user it is a draft, nothing is deployed, and continue with workflow 6.
 ## 4. Change a running service's settings
 
 ```
-devlift eks show orders --env stage --no-input -o json           # current values; pending_request + pending_keys if a draft exists
+devlift eks show orders --env stage --no-input -o json           # settings = live WITH the open draft over it.
+#   pending_request null  -> settings IS the deployed config
+#   pending_request set   -> use deployed_settings, or pending{key:{deployed,requested}}, or `eks diff`
 devlift eks edit orders --env stage --set memory_limit=1 --no-input     # Current | New, exit 5
 devlift eks edit orders --env stage --set memory_limit=1 --no-input -y -o json
 # → {changed, changes{field:{from,to}}, queue_code, queue_status}

{devlift_cli-0.1.4 → devlift_cli-0.1.6}/devlift_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devlift-cli
-Version: 0.1.4
+Version: 0.1.6
 Summary: DevLift command-line tool: create, change, review and deploy DevLift resources from the terminal.
 License: Proprietary
 Keywords: devlift,devops,deployment,infrastructure,cli