@transcend-io/cli 12.0.0 → 12.1.1

package/README.md

@@ -333,6 +333,8 @@ Upload a set of requests from a CSV.
 
 This command prompts you to map the shape of the CSV to the shape of the Transcend API. There is no requirement for the shape of the incoming CSV, as the script will handle the mapping process.
 
+You can optionally map a `workflowConfigId` column (UUID of a published workflow config). When present on a row, that ID is sent to `POST /v1/data-subject-request` so the request targets that workflow explicitly on orgs with Workflows V2.
+
 The script will also produce a JSON cache file that allows for the mappings to be preserved between runs.
 
 FLAGS
@@ -4142,20 +4144,20 @@ transcend migration sync-ot --source=file --file=./oneTrustAssessments.json --tr
 
 ```txt
 USAGE
-  transcend policy activate (--bundle-name value) [--version value] (--auth value) [--transcend-url value] [--dry-run] [--json] [--debug]
+  transcend policy activate (--remote-bundle-name value) [--version value] (--auth value) [--transcend-url value] [--dry-run] [--json] [--debug]
   transcend policy activate --help
 
 Calls the Policy Engine activate endpoint to make an uploaded version live. Addressed by bundle name (resolved to the parent bundle UUID internally). When --version is omitted, activates the latest uploaded version by createdAt. Requires a Transcend API key with Activate Policy scope.
 
 FLAGS
-      --bundle-name       Tenant-unique policy bundle name
-     [--version]          Caller-supplied version label to activate; defaults to the latest uploaded version by createdAt
-      --auth              The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "Activate Policy"
-     [--transcend-url]    URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
-     [--dry-run]          Validate activation without flipping the active version                                                                                                                                             [default = false]
-     [--json]             Print the raw JSON API response                                                                                                                                                                     [default = false]
-     [--debug/--noDebug]  Include technical error details (underlying API message and stack trace) when a command fails
-  -h  --help              Print help information and exit
+      --remote-bundle-name  Remote Policy Engine bundle name (not the local folder or --name root)
+     [--version]            Caller-supplied version label to activate; defaults to the latest uploaded version by createdAt
+      --auth                The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "Activate Policy"
+     [--transcend-url]      URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
+     [--dry-run]            Validate activation without flipping the active version                                                                                                                                             [default = false]
+     [--json]               Print the raw JSON API response                                                                                                                                                                     [default = false]
+     [--debug/--noDebug]    Include technical error details (underlying API message and stack trace) when a command fails
+  -h  --help                Print help information and exit
 ```
 
 #### Examples
@@ -4163,25 +4165,25 @@ FLAGS
 **Activate the latest uploaded version for a bundle**
 
 ```sh
-transcend policy activate --bundle-name=main --auth="$TRANSCEND_API_KEY"
+transcend policy activate --remote-bundle-name=main --auth="$TRANSCEND_API_KEY"
 ```
 
 **Activate a specific version label by bundle name**
 
 ```sh
-transcend policy activate --version=abc123 --bundle-name=main --auth="$TRANSCEND_API_KEY"
+transcend policy activate --version=abc123 --remote-bundle-name=main --auth="$TRANSCEND_API_KEY"
 ```
 
 **Validate activation without flipping the active version**
 
 ```sh
-transcend policy activate --version=abc123 --bundle-name=main --auth="$TRANSCEND_API_KEY" --dry-run
+transcend policy activate --version=abc123 --remote-bundle-name=main --auth="$TRANSCEND_API_KEY" --dry-run
 ```
 
 **Omit --auth by exporting TRANSCEND_API_KEY in the environment**
 
 ```sh
-transcend policy activate --bundle-name=main
+transcend policy activate --remote-bundle-name=main
 ```
 
 Requires the **Activate Policy** scope on your API key.
@@ -4190,18 +4192,18 @@ Requires the **Activate Policy** scope on your API key.
 
 ```txt
 USAGE
-  transcend policy deactivate (--bundle-name value) (--auth value) [--transcend-url value] [--json] [--debug]
+  transcend policy deactivate (--remote-bundle-name value) (--auth value) [--transcend-url value] [--json] [--debug]
   transcend policy deactivate --help
 
 Calls the Policy Engine deactivate endpoint to take the currently active version of a bundle offline, clearing its active version pointer. Addressed by bundle name (resolved to the parent bundle UUID internally). Requires a Transcend API key with Activate Policy scope.
 
 FLAGS
-      --bundle-name       Tenant-unique policy bundle name
-      --auth              The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "Activate Policy"
-     [--transcend-url]    URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
-     [--json]             Print the raw JSON API response                                                                                                                                                                     [default = false]
-     [--debug/--noDebug]  Include technical error details (underlying API message and stack trace) when a command fails
-  -h  --help              Print help information and exit
+      --remote-bundle-name  Remote Policy Engine bundle name (not the local folder or --name root)
+      --auth                The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "Activate Policy"
+     [--transcend-url]      URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
+     [--json]               Print the raw JSON API response                                                                                                                                                                     [default = false]
+     [--debug/--noDebug]    Include technical error details (underlying API message and stack trace) when a command fails
+  -h  --help                Print help information and exit
 ```
 
 #### Examples
@@ -4209,19 +4211,19 @@ FLAGS
 **Deactivate the active version of a bundle by name**
 
 ```sh
-transcend policy deactivate --bundle-name=main --auth="$TRANSCEND_API_KEY"
+transcend policy deactivate --remote-bundle-name=main --auth="$TRANSCEND_API_KEY"
 ```
 
 **Print the raw JSON response**
 
 ```sh
-transcend policy deactivate --bundle-name=main --auth="$TRANSCEND_API_KEY" --json
+transcend policy deactivate --remote-bundle-name=main --auth="$TRANSCEND_API_KEY" --json
 ```
 
 **Omit --auth by exporting TRANSCEND_API_KEY in the environment**
 
 ```sh
-transcend policy deactivate --bundle-name=main
+transcend policy deactivate --remote-bundle-name=main
 ```
 
 Requires the **Activate Policy** scope on your API key.
@@ -4230,20 +4232,20 @@ Requires the **Activate Policy** scope on your API key.
 
 ```txt
 USAGE
-  transcend policy download (--bundle-name value) [--version value] [--output value] (--auth value) [--transcend-url value] [--json] [--debug]
+  transcend policy download (--remote-bundle-name value) [--version value] [--output value] (--auth value) [--transcend-url value] [--json] [--debug]
   transcend policy download --help
 
 Resolves a bundle name and optional version label, fetches a short-lived presigned URL from the Policy Engine API, and downloads the compiled OPA bundle tarball (.tar.gz) to disk. When --version is omitted, downloads the currently active version (errors if none is active). With --json, prints metadata and the presigned URL without writing a file. Requires a Transcend API key with View Policy scope.
 
 FLAGS
-      --bundle-name       Tenant-unique policy bundle name
-     [--version]          Caller-supplied version label to download; defaults to the bundle's currently active version
-     [--output]           Destination file path for the compiled .tar.gz bundle (defaults to {bundleName}-{version}.tar.gz)
-      --auth              The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "View Policy"
-     [--transcend-url]    URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
-     [--json]             Print version metadata and the presigned download URL as JSON without writing a file                                                                                                                [default = false]
-     [--debug/--noDebug]  Include technical error details (underlying API message and stack trace) when a command fails
-  -h  --help              Print help information and exit
+      --remote-bundle-name  Remote Policy Engine bundle name (not the local folder or --name root)
+     [--version]            Caller-supplied version label to download; defaults to the bundle's currently active version
+     [--output]             Destination file path for the compiled .tar.gz bundle (defaults to {bundleName}-{version}.tar.gz)
+      --auth                The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "View Policy"
+     [--transcend-url]      URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
+     [--json]               Print version metadata and the presigned download URL as JSON without writing a file                                                                                                                [default = false]
+     [--debug/--noDebug]    Include technical error details (underlying API message and stack trace) when a command fails
+  -h  --help                Print help information and exit
 ```
 
 #### Examples
@@ -4251,20 +4253,20 @@ FLAGS
 **Download the currently active version of a policy bundle**
 
 ```sh
-transcend policy download --bundle-name=main --auth="$TRANSCEND_API_KEY"
+transcend policy download --remote-bundle-name=main --auth="$TRANSCEND_API_KEY"
 ```
 
 **Download a specific compiled policy bundle version to the default path**
 
 ```sh
-transcend policy download --bundle-name=main --version=2026-06-25 --auth="$TRANSCEND_API_KEY"
+transcend policy download --remote-bundle-name=main --version=2026-06-25 --auth="$TRANSCEND_API_KEY"
 ```
 
 **Download to an explicit output path**
 
 ```sh
 transcend policy download \
-  --bundle-name=main \
+  --remote-bundle-name=main \
   --version=2026-06-25 \
   --auth="$TRANSCEND_API_KEY" \
   --output=./bundles/main-2026-06-25.tar.gz
@@ -4273,13 +4275,13 @@ transcend policy download \
 **Print version metadata and the presigned URL as JSON without writing a file**
 
 ```sh
-transcend policy download --bundle-name=main --version=2026-06-25 --auth="$TRANSCEND_API_KEY" --json
+transcend policy download --remote-bundle-name=main --version=2026-06-25 --auth="$TRANSCEND_API_KEY" --json
 ```
 
 **Omit --auth by exporting TRANSCEND_API_KEY in the environment**
 
 ```sh
-transcend policy download --bundle-name=main
+transcend policy download --remote-bundle-name=main
 ```
 
 Requires the **View Policy** scope on your API key.
@@ -4290,75 +4292,64 @@ The downloaded artifact is a compiled OPA bundle tarball (`.tar.gz`), not a `.zi
 
 ```txt
 USAGE
-  transcend policy eval (--package value) [--input value] [--stdin-input] [--format pretty|json|values|bindings|source|raw|discard] [--schema value] [--explain off|full|notes|fails|debug] [--metrics] [--instrument] [--profile] [--timeout value] [--var-values] [--show-builtin-errors] <directory>
+  transcend policy eval (--package value) [--input value] [--stdin-input] [--format pretty|json|values|bindings|source|raw|discard] [--schema value] [--explain off|full|notes|fails|debug] [--metrics] [--instrument] [--profile] [--timeout value] [--var-values] [--show-builtin-errors] <bundle>
   transcend policy eval --help
 
-Wraps `opa eval` for local policy debugging against one bundle directory. Always loads the directory as a bundle (`-b`). Provide input via `--input` or `--stdin-input` (exactly one). Pass-through flags cover format, schema, explain, metrics, instrument, profile, timeout, var-values, and show-builtin-errors. Exit-on-result flags like OPA `--fail` are omitted: production Evaluate uses the Data API (policy deny is a successful evaluation; missing result is an engine failure), so process exit-on-result is not Evaluate parity. Requires an explicit directory containing a `.manifest`, and the `opa` CLI on PATH. No Transcend API key is needed.
+Wraps `opa eval` for local policy debugging against one bundle directory. Always loads the directory as a bundle (`-b`) and ignores local `*_test.rego` files (same as lint/publish — tests are not shipped to Evaluate). Provide input via `--input` or `--stdin-input` (exactly one). Pass-through flags cover format, schema, explain, metrics, instrument, profile, timeout, var-values, and show-builtin-errors. `-b` and `--ignore` stay owned by the CLI. Exit-on-result flags like OPA `--fail` are omitted: production Evaluate uses the Data API (policy deny is a successful evaluation; missing result is an engine failure), so process exit-on-result is not Evaluate parity. Requires an explicit directory containing a `.manifest`, and the `opa` CLI on PATH. No Transcend API key is needed.
 
 FLAGS
-      --package               OPA query to evaluate (e.g. data.example.result)
+      --package               OPA query path to evaluate (e.g. data.example.result)
      [--input]                Path to a JSON envelope input file (mutually exclusive with --stdin-input)
-     [--stdin-input]          opa eval --stdin-input (read input document from stdin)                    [default = false]
-     [--format]               opa eval --format                                                          [pretty|json|values|bindings|source|raw|discard, default = pretty]
-     [--schema]               opa eval --schema (file or directory)
-     [--explain]              opa eval --explain                                                         [off|full|notes|fails|debug]
-     [--metrics]              opa eval --metrics                                                         [default = false]
-     [--instrument]           opa eval --instrument (implies --metrics)                                  [default = false]
-     [--profile]              opa eval --profile                                                         [default = false]
-     [--timeout]              opa eval --timeout (e.g. 5s)
-     [--var-values]           opa eval --var-values (with --explain)                                     [default = false]
-     [--show-builtin-errors]  opa eval --show-builtin-errors                                             [default = false]
+     [--stdin-input]          Read the input document from stdin (opa eval --stdin-input)                [default = false]
+     [--format]               Output format (opa eval --format)                                          [pretty|json|values|bindings|source|raw|discard, default = pretty]
+     [--schema]               JSON Schema file or directory for input type-checking (opa eval --schema)
+     [--explain]              Explanation mode (opa eval --explain)                                      [off|full|notes|fails|debug]
+     [--metrics]              Report evaluation metrics (opa eval --metrics)                             [default = false]
+     [--instrument]           Enable instrumentation; implies --metrics (opa eval --instrument)          [default = false]
+     [--profile]              Enable performance profiling (opa eval --profile)                          [default = false]
+     [--timeout]              Evaluation timeout duration, e.g. 5s (opa eval --timeout)
+     [--var-values]           Show variable values with --explain (opa eval --var-values)                [default = false]
+     [--show-builtin-errors]  Collect and report built-in errors (opa eval --show-builtin-errors)        [default = false]
   -h  --help                  Print help information and exit
 
 ARGUMENTS
-  directory  Policy bundle directory containing a .manifest
+  bundle  Local policy bundle directory containing a .manifest
 ```
 
 #### Examples
 
-**Evaluate a decision query with a local envelope**
+**Evaluate a generic decision query with a local envelope**
 
 ```sh
-transcend policy eval --package=data.example.result --input=./fixtures/envelope.json
+transcend policy eval transcend/policy/example-bundle \
+  --package=data.example.result \
+  --input=transcend/policy/example-bundle/input.json
 ```
 
-**Emit JSON and attach workspace schemas**
+**Simulate the Permissions API (query + envelope + input schema)**
 
 ```sh
-transcend policy eval \
-  --package=data.example.result \
-  --input=./fixtures/envelope.json \
-  --format=json \
-  --schema=transcend/policy/schemas
+transcend policy eval transcend/policy/permissions-bundle \
+  --package=data.permissions.purposes \
+  --input=transcend/policy/permissions-bundle/input.json \
+  --schema=transcend/policy/permissions-bundle/input.schema.json
 ```
 
 **Pipe an envelope on stdin**
 
 ```sh
-transcend policy eval --package=data.example.result --stdin-input
+cat transcend/policy/example-bundle/input.json | transcend policy eval transcend/policy/example-bundle --package=data.example.result --stdin-input
 ```
 
-Pass the bundle directory positionally (required — one bundle per invocation):
-
-```sh
-transcend policy eval transcend/policy/example-bundle \
-  --package=data.example.result \
-  --input=./fixtures/envelope.json
-```
-
-Or pipe the envelope:
-
-```sh
-cat ./fixtures/envelope.json | transcend policy eval transcend/policy/example-bundle \
-  --package=data.example.result \
-  --stdin-input
-```
+The `<bundle>` positional is required (one local publish directory with a `.manifest` per
+invocation). Pass `--schema` with the bundle's `input.schema.json` when you want OPA to
+type-check `input` (e.g. `transcend/policy/permissions-bundle/input.schema.json`).
 
 ### `transcend policy init`
 
 ```txt
 USAGE
-  transcend policy init [--editor] [--skill] [--ci] [--noInteractive] [--dryRun] [--yes] [--json] [<directory>]
+  transcend policy init [--editor] [--skill] [--ci] [--noInteractive] [--dryRun] [--yes] [--json] [<workspace>]
   transcend policy init --help
 
 Probes OPA and Regal, previews one safe transactional plan, and creates an empty multi-bundle workspace with shared Regal config and README. Add bundles with `transcend policy new`. Optional editor, Agent Skill, and validation-only CI setup preserve repository customization. No Transcend credentials are needed.
@@ -4374,7 +4365,7 @@ FLAGS
   -h  --help                Print help information and exit
 
 ARGUMENTS
-  [directory]  Policy workspace directory [default = transcend/policy]
+  [workspace]  Policy workspace directory [default = transcend/policy]
 ```
 
 #### Create an empty multi-bundle workspace
@@ -4385,7 +4376,7 @@ transcend policy init
 
 This creates a multi-bundle Policy Engine workspace under `transcend/policy` with shared Regal config (`project.roots: []`) and a README. No bundles or Rego are created — add them with `transcend policy new`.
 
-The interactive checklist selects repository-level VS Code setup, the `transcend-policy-engine` Agent Skill, and credential-free validation-only GitHub Actions by default. VS Code setup recommends the official OPA extension, configures strict Rego v1 formatting, and sets `opa.schema` to the workspace schemas directory.
+The interactive checklist selects repository-level VS Code setup, the `transcend-policy-engine` Agent Skill, and credential-free validation-only GitHub Actions by default. VS Code setup recommends the official OPA extension and configures strict Rego v1 formatting.
 
 To give an agent the same policy guidance before initialization, install the standalone skill directly from this repository:
 
@@ -4408,7 +4399,7 @@ Generated CI pins OPA 1.18.2, Regal 0.42.0, immutable setup action commits, and
 
 ```txt
 USAGE
-  transcend policy lint [--fix] [--noInteractive] [--json] [<directory>]
+  transcend policy lint [--fix] [--noInteractive] [--json] [<workspace|bundle>]
   transcend policy lint --help
 
 Defaults to the policy workspace (`transcend/policy`) and verifies every publishable child directory that contains a `.manifest`. Pass one bundle path to verify a single unit. Validates manifest roots and package coverage, verifies OPA 1.x and Regal, checks or repairs OPA formatting, runs a production-only strict OPA check, treats Regal warnings as failures, and requires non-empty OPA tests. No Transcend API key is needed.
@@ -4420,18 +4411,18 @@ FLAGS
   -h  --help            Print help information and exit
 
 ARGUMENTS
-  [directory]  Policy workspace or bundle directory (workspace runs every .manifest child) [default = transcend/policy]
+  [workspace|bundle]  Policy workspace or bundle directory (workspace runs every .manifest child) [default = transcend/policy]
 ```
 
 #### Examples
 
-**Verify the default local policy project**
+**Verify every bundle under the default workspace**
 
 ```sh
 transcend policy lint
 ```
 
-**Verify and format the default policy project**
+**Verify and format every bundle under the default workspace**
 
 ```sh
 transcend policy lint --fix
@@ -4443,53 +4434,72 @@ transcend policy lint --fix
 transcend policy lint --noInteractive --json
 ```
 
-With no directory argument, `policy lint` verifies every immediate child under the default workspace (`transcend/policy`) that contains a `.manifest`. Pass one bundle path to verify a single unit:
+**Verify a single local publish directory**
 
 ```sh
-transcend policy lint ./policies/example-bundle --fix
+transcend policy lint transcend/policy/example-bundle --fix
 ```
 
+With no directory argument, `policy lint` verifies every immediate child under the default
+workspace (`transcend/policy`) that contains a `.manifest`. Pass one bundle path to verify a
+single unit.
+
 ### `transcend policy new`
 
 ```txt
 USAGE
-  transcend policy new [--name value] [--template generic|permissions] [--noInteractive] [--dryRun] [--yes] [--json] [<directory>]
+  transcend policy new [--name value] [--bundle-dir value] [--template generic|permissions] [--noInteractive] [--dryRun] [--yes] [--json] [<workspace>]
   transcend policy new --help
 
-Adds a publishable `{name}-bundle/` directory to an initialized policy workspace. Requires `.regal/config.yaml` (run `transcend policy init` first). Creates bundle files, merges the root into Regal config, and updates editor setup when present.
+Adds a publishable bundle directory to an initialized policy workspace. `--name` is the Rego package root; `--bundle-dir` is the local folder basename under the workspace (defaults to `{name}-bundle`). This is not the remote Policy Engine `--remote-bundle-name` used at publish time. Requires `.regal/config.yaml` (run `transcend policy init` first). Creates bundle files, merges the root into Regal config, and updates editor setup when present.
 
 FLAGS
-     [--name]           Package root name (used as {name}-bundle/ directory)
-     [--template]       Bundle template                                            [generic|permissions]
-     [--noInteractive]  Disable prompts and require explicit --name and --template [default = false]
-     [--dryRun]         Preview changes without applying them                      [default = false]
-     [--yes]            Skip only the final plan confirmation                      [default = false]
-     [--json]           Emit stable JSON output and disable prompts                [default = false]
+     [--name]           Rego / .manifest package root (not the remote --remote-bundle-name); default folder is {name}-bundle/
+     [--bundle-dir]     Local publish folder basename under the workspace (default: {name}-bundle; not --remote-bundle-name)
+     [--template]       Bundle template                                                                                       [generic|permissions]
+     [--noInteractive]  Disable prompts and require explicit --name and --template                                            [default = false]
+     [--dryRun]         Preview changes without applying them                                                                 [default = false]
+     [--yes]            Skip only the final plan confirmation                                                                 [default = false]
+     [--json]           Emit stable JSON output and disable prompts                                                           [default = false]
   -h  --help            Print help information and exit
 
 ARGUMENTS
-  [directory]  Policy workspace directory [default = transcend/policy]
+  [workspace]  Policy workspace directory [default = transcend/policy]
 ```
 
-#### Add a generic example bundle
+#### Examples
+
+**Add a generic example bundle**
+
+```sh
+transcend policy new --template=generic --name=example --yes
+```
+
+**Add a permissions bundle**
 
 ```sh
-transcend policy new --template generic --name example --yes
+transcend policy new --template=permissions --name=permissions --yes
 ```
 
-#### Add a permissions bundle
+**Custom local folder, same package root**
 
 ```sh
-transcend policy new --template permissions --name permissions --yes
+transcend policy new --template=permissions --name=permissions --bundle-dir=my-bundle --yes
 ```
 
-#### Preview without writing
+**Preview without writing**
 
 ```sh
-transcend policy new --template generic --name myapp --dryRun --json
+transcend policy new --template=generic --name=myapp --dryRun --json
 ```
 
-Requires an initialized workspace (`transcend policy init` first).
+Requires an initialized workspace (`transcend policy init` first). Naming triad:
+
+- `--name` — Rego / `.manifest` package root (default local folder: `{name}-bundle/`)
+- `--bundle-dir` — local publish directory basename under the workspace only
+- `--remote-bundle-name` (on `policy publish`) — remote Policy Engine name; unrelated to the local folder
+
+The positional argument is the **workspace** (default `transcend/policy`).
 
 ### `transcend policy bundles`
 
@@ -4536,24 +4546,24 @@ Requires the **View Policy** scope on your API key.
 
 ```txt
 USAGE
-  transcend policy publish (--bundle-name value) (--auth value) [--transcend-url value] [--version value] [--description value] [--json] [--yes] [--debug] <directory>
+  transcend policy publish (--remote-bundle-name value) (--auth value) [--transcend-url value] [--version value] [--description value] [--json] [--yes] [--debug] <bundle>
   transcend policy publish --help
 
 Packages `.manifest` and `.rego` policy files from one local bundle directory into a tarball and uploads it to Transcend. Requires an explicit directory containing a `.manifest`. Creates the bundle on first upload, then appends immutable versions. Requires the `opa` CLI on PATH (for `opa check` and `opa build` validation) and a Transcend API key with Manage Policy scope.
 
 FLAGS
-      --bundle-name       Tenant-unique policy bundle name
-      --auth              The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "Manage Policy"
-     [--transcend-url]    URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
-     [--version]          Version label (defaults to {bundleName}-yyyy-mm-dd-hh-mm-ss)
-     [--description]      Optional description for the uploaded version
-     [--json]             Print the raw JSON API response                                                                                                                                                                     [default = false]
-     [--yes]              Skip the "create new bundle" confirmation (for CI/non-interactive use)                                                                                                                              [default = false]
-     [--debug/--noDebug]  Include technical error details (underlying API message and stack trace) when a command fails
-  -h  --help              Print help information and exit
+      --remote-bundle-name  Remote Policy Engine bundle name (not the local folder or --name root)
+      --auth                The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "Manage Policy"
+     [--transcend-url]      URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
+     [--version]            Version label (defaults to {bundleName}-yyyy-mm-dd-hh-mm-ss)
+     [--description]        Optional description for the uploaded version
+     [--json]               Print the raw JSON API response                                                                                                                                                                     [default = false]
+     [--yes]                Skip the "create new bundle" confirmation (for CI/non-interactive use)                                                                                                                              [default = false]
+     [--debug/--noDebug]    Include technical error details (underlying API message and stack trace) when a command fails
+  -h  --help                Print help information and exit
 
 ARGUMENTS
-  directory  Policy bundle directory containing a .manifest
+  bundle  Local policy bundle directory containing a .manifest
 ```
 
 #### Examples
@@ -4561,14 +4571,14 @@ ARGUMENTS
 **Publish a local policy bundle as the main bundle**
 
 ```sh
-transcend policy publish --bundle-name=main --auth="$TRANSCEND_API_KEY"
+transcend policy publish transcend/policy/example-bundle --remote-bundle-name=main --auth="$TRANSCEND_API_KEY"
 ```
 
 **Publish with an explicit version label and description**
 
 ```sh
-transcend policy publish \
-  --bundle-name=main \
+transcend policy publish transcend/policy/example-bundle \
+  --remote-bundle-name=main \
   --auth="$TRANSCEND_API_KEY" \
   --version=2026-06-25 \
   --description="Quarterly policy update"
@@ -4577,28 +4587,28 @@ transcend policy publish \
 **Publish to the US-hosted Transcend API**
 
 ```sh
-transcend policy publish --bundle-name=common --auth="$TRANSCEND_API_KEY" --transcend-url=https://api.us.transcend.io
+transcend policy publish transcend/policy/example-bundle \
+  --remote-bundle-name=common \
+  --auth="$TRANSCEND_API_KEY" \
+  --transcend-url=https://api.us.transcend.io
 ```
 
 **Publish the Permissions API bundle (fixed remote name)**
 
 ```sh
-transcend policy publish --bundle-name=permissions --auth="$TRANSCEND_API_KEY"
+transcend policy publish transcend/policy/permissions-bundle \
+  --remote-bundle-name=permissions \
+  --auth="$TRANSCEND_API_KEY"
 ```
 
 **Omit --auth by exporting TRANSCEND_API_KEY in the environment**
 
 ```sh
-transcend policy publish --bundle-name=main
+transcend policy publish transcend/policy/example-bundle --remote-bundle-name=main
 ```
 
-Pass the bundle directory positionally (required — one bundle per invocation):
-
-```sh
-transcend policy publish transcend/policy/example-bundle \
-  --bundle-name=main \
-  --auth="$TRANSCEND_API_KEY"
-```
+`--remote-bundle-name` is the remote Policy Engine name (not the local folder). The `<bundle>`
+positional is the local publish directory containing a `.manifest`.
 
 Requires the **Manage Policy** scope on your API key.
 
@@ -4606,26 +4616,26 @@ Requires the **Manage Policy** scope on your API key.
 
 ```txt
 USAGE
-  transcend policy test [--format pretty|json|gobench] [--verbose] [--run value] [--coverage] [--threshold value] [--timeout value] [--var-values] [--explain fails|full|notes|debug] [--schema value] [--exit-zero-on-skipped] [<directory>]
+  transcend policy test [--format pretty|json|gobench] [--verbose] [--run value] [--coverage] [--threshold value] [--timeout value] [--var-values] [--explain fails|full|notes|debug] [--schema value] [--exit-zero-on-skipped] [<workspace|bundle>]
   transcend policy test --help
 
 Defaults to the policy workspace (`transcend/policy`) and runs `opa test -b --fail-on-empty` for every child directory that contains a `.manifest`. Pass one bundle path to test a single unit. Pass-through flags cover format, verbose, run, coverage, threshold, timeout, var-values, explain, schema, and exit-zero-on-skipped; `-b` and `--fail-on-empty` stay owned by the CLI. Requires the `opa` CLI on PATH. No Transcend API key is needed.
 
 FLAGS
-     [--format]                opa test --format                                      [pretty|json|gobench, default = pretty]
-     [--verbose]               opa test --verbose                                     [default = false]
-     [--run]                   opa test --run (regex filter)
-     [--coverage]              opa test --coverage                                    [default = false]
-     [--threshold]             opa test --threshold (coverage %, requires --coverage)
-     [--timeout]               opa test --timeout (e.g. 5s)
-     [--var-values]            opa test --var-values                                  [default = false]
-     [--explain]               opa test --explain                                     [fails|full|notes|debug]
-     [--schema]                opa test --schema (file or directory)
-     [--exit-zero-on-skipped]  opa test --exit-zero-on-skipped                        [default = false]
+     [--format]                Output format (opa test --format)                                            [pretty|json|gobench, default = pretty]
+     [--verbose]               Show detailed test results (opa test --verbose)                              [default = false]
+     [--run]                   Regex filter for test names (opa test --run)
+     [--coverage]              Report coverage (opa test --coverage)                                        [default = false]
+     [--threshold]             Fail when coverage is below this % (requires --coverage)
+     [--timeout]               Test timeout duration, e.g. 5s (opa test --timeout)
+     [--var-values]            Show variable values in failures (opa test --var-values)                     [default = false]
+     [--explain]               Explanation mode (opa test --explain)                                        [fails|full|notes|debug]
+     [--schema]                JSON Schema file or directory for input type-checking (opa test --schema)
+     [--exit-zero-on-skipped]  Exit 0 when all matching tests are skipped (opa test --exit-zero-on-skipped) [default = false]
   -h  --help                   Print help information and exit
 
 ARGUMENTS
-  [directory]  Policy workspace or bundle directory (workspace runs every .manifest child) [default = transcend/policy]
+  [workspace|bundle]  Policy workspace or bundle directory (workspace runs every .manifest child) [default = transcend/policy]
 ```
 
 #### Examples
@@ -4648,30 +4658,33 @@ transcend policy test --format=json --run=test_allows --verbose
 transcend policy test --coverage --threshold=80
 ```
 
-Pass one bundle directory to test a single unit:
+**Test a single local publish directory**
 
 ```sh
 transcend policy test transcend/policy/example-bundle
 ```
 
+With no directory argument, `policy test` runs every immediate child under the default workspace
+(`transcend/policy`) that contains a `.manifest`. Pass one bundle path to test a single unit.
+
 ### `transcend policy versions`
 
 ```txt
 USAGE
-  transcend policy versions (--bundle-name value) (--auth value) [--transcend-url value] [--limit value] [--after value] [--json] [--debug]
+  transcend policy versions (--remote-bundle-name value) (--auth value) [--transcend-url value] [--limit value] [--after value] [--json] [--debug]
   transcend policy versions --help
 
 Resolves a bundle name to its UUID and lists uploaded versions. Requires a Transcend API key with View Policy scope.
 
 FLAGS
-      --bundle-name       Tenant-unique policy bundle name
-      --auth              The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "View Policy"
-     [--transcend-url]    URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
-     [--limit]            Maximum number of versions to return (1-100)                                                                                                                                                        [default = 50]
-     [--after]            Opaque cursor from a previous response pageInfo.endCursor
-     [--json]             Print the raw JSON API response                                                                                                                                                                     [default = false]
-     [--debug/--noDebug]  Include technical error details (underlying API message and stack trace) when a command fails
-  -h  --help              Print help information and exit
+      --remote-bundle-name  Remote Policy Engine bundle name (not the local folder or --name root)
+      --auth                The Transcend API key. Defaults to the TRANSCEND_API_KEY environment variable when set, so --auth may be omitted if it is exported. Requires scopes: "View Policy"
+     [--transcend-url]      URL of the Transcend backend. Use https://api.us.transcend.io for US hosting. Defaults to the TRANSCEND_API_URL environment variable when set, so --transcend-url may be omitted if it is exported. [default = https://api.transcend.io]
+     [--limit]              Maximum number of versions to return (1-100)                                                                                                                                                        [default = 50]
+     [--after]              Opaque cursor from a previous response pageInfo.endCursor
+     [--json]               Print the raw JSON API response                                                                                                                                                                     [default = false]
+     [--debug/--noDebug]    Include technical error details (underlying API message and stack trace) when a command fails
+  -h  --help                Print help information and exit
 ```
 
 #### Examples
@@ -4679,19 +4692,19 @@ FLAGS
 **List versions for a policy bundle**
 
 ```sh
-transcend policy versions --bundle-name=main --auth="$TRANSCEND_API_KEY"
+transcend policy versions --remote-bundle-name=main --auth="$TRANSCEND_API_KEY"
 ```
 
 **Fetch the next page of versions using an after cursor**
 
 ```sh
-transcend policy versions --bundle-name=main --auth="$TRANSCEND_API_KEY" --after="$POLICY_VERSION_CURSOR"
+transcend policy versions --remote-bundle-name=main --auth="$TRANSCEND_API_KEY" --after="$POLICY_VERSION_CURSOR"
 ```
 
 **Omit --auth by exporting TRANSCEND_API_KEY in the environment**
 
 ```sh
-transcend policy versions --bundle-name=main
+transcend policy versions --remote-bundle-name=main
 ```
 
 Requires the **View Policy** scope on your API key.