@xano/cli 1.2.0 → 1.3.1-beta.0

package/dist/commands/release/create/index.js

@@ -1,5 +1,6 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleaseCreate extends BaseCommand {
     static args = {
         name: Args.string({
@@ -11,6 +12,10 @@ export default class ReleaseCreate extends BaseCommand {
     static examples = [
         `$ xano release create "v1.0" --branch main
 Created release: v1.0 - ID: 10
+  Branch: main
+  Policy check: fail (run 1712), 2 blocking, 1 advisory findings
+    Findings: xano policy runs --release v1.0
+    Its blocking findings block a deploy to a standard or run tenant: xano tenant deploy_release <tenant> --release v1.0 --check
 `,
         `$ xano release create "v1.1-hotfix" --branch main --hotfix --description "Critical fix" -o json`,
     ];
@@ -90,6 +95,8 @@ Created release: v1.0 - ID: 10
                     this.log(`  Branch: ${release.branch}`);
                 if (release.hotfix)
                     this.log(`  Hotfix: true`);
+                for (const line of releasePolicyRunLines(release.policy_run, release.name ?? args.name))
+                    this.log(line);
             }
         }
         catch (error) {

package/dist/commands/release/deploy/index.d.ts

@@ -9,12 +9,40 @@ export default class ReleaseDeploy extends BaseCommand {
         branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         set_live: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    /** Set once the platform refuses set live for a weakened mandatory policy: already explained, it exits 1 as it is. */
+    private refusedByPermission;
+    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
     run(): Promise<void>;
     private confirm;
+    /** The set-live verdict a successful deploy answered with --set_live (`pass`, `overridden`, ...). */
+    private logPolicyOutcome;
+    /** Stops the command when set live was refused after the branch was created: by the gate (exit 2) or for a weakened mandatory policy (exit 1). */
+    private refuseIfSetLiveRefused;
+    /**
+     * The set-live gate refused after the branch was created: the verdict, the refusal, and how to
+     * proceed, exiting 2. Under `-o json` the refusal is `{branch_created, set_live, branch, message,
+     * policy_gate}`.
+     */
+    private refuseSetLive;
+    /**
+     * Set live was refused after the branch was created because the release weakens (or lacks) a
+     * mandatory policy of the live branch, and the credential lacks `workspace:policy` update. That is a
+     * permission refusal, not a blocking finding: it exits 1 (under `-o json` as `{error}`) with the
+     * platform's sentence, which names the branch, and how to go on.
+     */
+    private refuseWeakening;
 }

package/dist/commands/release/deploy/index.js

@@ -1,5 +1,7 @@
 import { Args, Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
+import { BLANK_POLICY_OVERRIDE, blankPolicyOverride, gateOverrideHint, gateRefusal, liveGateLines, quoted, weakeningRefusal, } from '../../../utils/policy/gate.js';
+import { policyWeakeningGuidance } from '../../../utils/policy/permission.js';
 export default class ReleaseDeploy extends BaseCommand {
     static args = {
         release_name: Args.string({
@@ -7,7 +9,7 @@ export default class ReleaseDeploy extends BaseCommand {
             required: true,
         }),
     };
-    static description = '[IMPORTANT] ALWAYS confirm with the user before deploying a release. Deploys a release to its workspace as a new branch.';
+    static description = "[IMPORTANT] ALWAYS confirm with the user before deploying a release. Deploys a release to its workspace as a new branch. With --set_live the branch is then set live through the set-live policy gate: when blocking findings refuse it, the branch stays, set live is refused, and the command exits 2 unless --policy-override gives a reason. A release that weakens a mandatory policy of the live branch needs workspace:policy update to be set live; without it the branch stays and the command exits 1.";
     static examples = [
         `$ xano release deploy "v1.0"
 Are you sure you want to deploy release "v1.0"? (y/N) y
@@ -18,6 +20,7 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
 `,
         `$ xano release deploy "v1.0" --branch "restore-v1" --no-set_live`,
         `$ xano release deploy "v1.0" -w 40 -o json --force`,
+        `$ xano release deploy "v1.0" --branch "rollback-v1" --set_live --policy-override "Rollback approved; finding tracked in JIRA-12"`,
     ];
     static flags = {
         ...BaseCommand.baseFlags,
@@ -39,6 +42,7 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             options: ['summary', 'json'],
             required: false,
         }),
+        'policy-override': Flags.string({ description: 'With --set_live, set the branch live past a blocking set-live policy gate with an audited reason (requires workspace:policy update)' }),
         set_live: Flags.boolean({
             default: false,
             description: '[CRITICAL] STOP and confirm with the user before setting the deployed branch as live.',
@@ -50,8 +54,20 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             required: false,
         }),
     };
+    /** Set once the platform refuses set live for a weakened mandatory policy: already explained, it exits 1 as it is. */
+    refusedByPermission = false;
+    /** Set once the set-live policy gate refuses, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the set-live gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { args, flags } = await this.parse(ReleaseDeploy);
+        if (blankPolicyOverride(flags['policy-override']))
+            this.error(BLANK_POLICY_OVERRIDE);
         const { profile } = this.resolveProfile(flags);
         const workspaceId = flags.workspace || profile.workspace;
         if (!workspaceId) {
@@ -59,11 +75,10 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
         }
         const releaseName = encodeURIComponent(args.release_name);
         const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/release/${releaseName}/deploy`;
-        const body = {
-            set_live: flags.set_live,
-        };
-        if (flags.branch)
-            body.branch = flags.branch;
+        const body = deployBody(flags);
+        if (body.override_reason && !flags.set_live) {
+            this.error('--policy-override only applies with --set_live: a branch that is not set live is not gated.');
+        }
         if (!flags.force) {
             const confirmed = await this.confirm(`Are you sure you want to deploy release "${args.release_name}" to workspace ${workspaceId}?`);
             if (!confirmed) {
@@ -84,6 +99,7 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
                 method: 'POST',
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
+                await this.refuseIfSetLiveRefused(response, flags, args.release_name);
                 const errorText = await response.text();
                 this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
@@ -98,10 +114,17 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
                 this.log(`Deployed release "${release.name}" to workspace ${workspaceId} (branch: ${branchLabel}${liveStatus})`);
                 if (release.description)
                     this.log(`  Description: ${release.description}`);
+                this.logPolicyOutcome(release);
                 this.log(`  Time: ${elapsed}s`);
             }
+            // A policy of the release the new branch could not take is never dropped silently.
+            const skipped = release.policies_skipped?.message;
+            if (skipped)
+                this.warn(skipped);
         }
         catch (error) {
+            if (this.refusedByPolicyGate || this.refusedByPermission)
+                throw error;
             if (error instanceof Error) {
                 this.error(`Failed to deploy release: ${error.message}`);
             }
@@ -123,4 +146,65 @@ Deployed release "v1.0" to workspace 40 (branch: v1.0)
             });
         });
     }
+    /** The set-live verdict a successful deploy answered with --set_live (`pass`, `overridden`, ...). */
+    logPolicyOutcome(release) {
+        const status = release.policy_gate?.status;
+        if (status)
+            this.log(`  Policy gate: ${status}`);
+    }
+    /** Stops the command when set live was refused after the branch was created: by the gate (exit 2) or for a weakened mandatory policy (exit 1). */
+    async refuseIfSetLiveRefused(response, flags, releaseName) {
+        const refused = await gateRefusal(response);
+        if (refused)
+            this.refuseSetLive(refused, flags, releaseName);
+        const weakening = await weakeningRefusal(response);
+        if (weakening)
+            this.refuseWeakening(weakening, flags);
+    }
+    /**
+     * The set-live gate refused after the branch was created: the verdict, the refusal, and how to
+     * proceed, exiting 2. Under `-o json` the refusal is `{branch_created, set_live, branch, message,
+     * policy_gate}`.
+     */
+    refuseSetLive(refused, flags, releaseName) {
+        const answer = refused.answer;
+        const label = answer.branch?.label || flags.branch || 'the release branch';
+        if (flags.output === 'json') {
+            this.log(JSON.stringify({ branch: answer.branch ?? null, branch_created: true, message: refused.message, policy_gate: answer, set_live: false }, null, 2));
+        }
+        else {
+            for (const line of liveGateLines(answer, 'release'))
+                this.log(line);
+        }
+        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
+        const rerun = `xano branch delete ${quoted(label)}${workspace} && xano release deploy ${quoted(releaseName)}${workspace}${flags.branch ? ` --branch ${quoted(flags.branch)}` : ''} --set_live --policy-override "<why>"`;
+        const hint = gateOverrideHint(answer, rerun);
+        this.refusedByPolicyGate = true;
+        this.error(`The branch was created; set live was refused. ${refused.message}${hint}${answer.can_override && !answer.override_denied ? `\nOr set "${label}" live from Studio's Branches panel, which asks for the reason.` : ''}`, { exit: 2 });
+    }
+    /**
+     * Set live was refused after the branch was created because the release weakens (or lacks) a
+     * mandatory policy of the live branch, and the credential lacks `workspace:policy` update. That is a
+     * permission refusal, not a blocking finding: it exits 1 (under `-o json` as `{error}`) with the
+     * platform's sentence, which names the branch, and how to go on.
+     */
+    refuseWeakening(refused, flags) {
+        const label = refused.payload.branch?.label || flags.branch;
+        const workspace = flags.workspace ? ` -w ${quoted(flags.workspace)}` : '';
+        const ways = label
+            ? [`The branch stays. To remove it:  xano branch delete ${quoted(label)}${workspace}`, `Someone with that permission can set it live:  xano branch set_live ${quoted(label)}${workspace}`]
+            : [];
+        this.refusedByPermission = true;
+        this.error(`${refused.message}${policyWeakeningGuidance(refused.payload, ways, true)}`);
+    }
+}
+/** The deploy request's body: the new branch's label, set_live, and the override reason when one is given. */
+function deployBody(flags) {
+    const body = { set_live: flags.set_live };
+    if (flags.branch)
+        body.branch = flags.branch;
+    const overrideReason = flags['policy-override']?.trim();
+    if (overrideReason)
+        body.override_reason = overrideReason;
+    return body;
 }

package/dist/commands/release/edit/index.js

@@ -69,8 +69,8 @@ Updated release: v1.0-final - ID: 10
             const current = await getResponse.json();
             // Merge in user-provided values
             const body = {
-                description: flags.description !== undefined ? flags.description : (current.description ?? ''),
-                name: flags.name !== undefined ? flags.name : current.name,
+                description: flags.description === undefined ? (current.description ?? '') : flags.description,
+                name: flags.name === undefined ? current.name : flags.name,
             };
             // Update release
             const putResponse = await this.verboseFetch(baseUrl, {

package/dist/commands/release/export/index.js

@@ -1,6 +1,6 @@
 import { Args, Flags } from '@oclif/core';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand, { buildUserAgent } from '../../../base-command.js';
 export default class ReleaseExport extends BaseCommand {
     static args = {
@@ -79,7 +79,6 @@ Downloaded release 'v1.0' to ./release-v1.0.tar.gz
             const fileStream = fs.createWriteStream(resolvedPath);
             const reader = downloadResponse.body.getReader();
             let totalBytes = 0;
-            // eslint-disable-next-line no-constant-condition
             while (true) {
                 // eslint-disable-next-line no-await-in-loop
                 const { done, value } = await reader.read();

package/dist/commands/release/import/index.js

@@ -1,7 +1,8 @@
 import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
+import { releaseImportRefusal, releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleaseImport extends BaseCommand {
     static args = {};
     static description = '[IMPORTANT] ALWAYS confirm with the user before importing a release. Imports a release file into a workspace.';
@@ -58,7 +59,8 @@ Imported release as #15
             }, flags.verbose, profile.access_token);
             if (!response.ok) {
                 const errorText = await response.text();
-                this.error(`API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
+                this.error(releaseImportRefusal(errorText, response.status, apiUrl) ??
+                    `API request failed with status ${response.status}: ${response.statusText}\n${errorText}`);
             }
             const result = await response.json();
             if (flags.output === 'json') {
@@ -67,6 +69,8 @@ Imported release as #15
             else {
                 const sizeMb = (fileBuffer.length / 1024 / 1024).toFixed(2);
                 this.log(`Imported release as #${result.id} (${sizeMb} MB)`);
+                for (const line of releasePolicyRunLines(result.policy_run, result.name, result.id))
+                    this.log(line);
             }
         }
         catch (error) {

package/dist/commands/release/list/index.d.ts

@@ -10,4 +10,11 @@ export default class ReleaseList extends BaseCommand {
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * The releases' stored policy checks, read once for the whole list. The list never fails or
+     * changes because of this read: it answers `null` when the checks cannot be read (the Policies
+     * feature is off, the credential lacks `workspace:policy` read, or the request failed), and the
+     * list then prints as it would without policies.
+     */
+    private policyChecks;
 }

package/dist/commands/release/list/index.js

@@ -1,13 +1,21 @@
 import { Flags } from '@oclif/core';
 import BaseCommand from '../../../base-command.js';
 import { buildPagingJson } from '../../../utils/paging.js';
+import { readReleasePolicyChecks, releasePolicyCheckTag } from '../../../utils/policy/release.js';
 export default class ReleaseList extends BaseCommand {
-    static description = 'List all releases in a workspace';
+    static description = "List all releases in a workspace, each with its stored policy check when the credential can read policies (the release's own check, as Studio's Policies column shows it)";
     static examples = [
         `$ xano release list
 Releases in workspace 5:
   - v1.0 (ID: 10) - main
   - v1.1-hotfix (ID: 11) - main [hotfix]
+`,
+        `$ xano release list
+Releases in workspace 5:
+  - v1.2 (ID: 12) - main (9/28/2026, 4:12:03 PM PDT) [policies: 2 blocking, 1 advisory]
+  - v1.1-hotfix (ID: 11) - main [hotfix] (9/27/2026, 9:40:15 AM PDT) [policies: passed]
+  - v1.0 (ID: 10) - main (9/20/2026, 1:05:44 PM PDT) [policies: not checked]
+Policy check details: xano policy runs --release <name>
 `,
         `$ xano release list -w 5 --output json`,
     ];
@@ -57,22 +65,19 @@ Releases in workspace 5:
             else {
                 this.error('Unexpected API response format');
             }
+            const checks = await this.policyChecks(profile, String(workspaceId), releases, flags.verbose);
             if (flags.output === 'json') {
-                this.log(JSON.stringify(buildPagingJson({ items: releases }, { tier: 'none' }), null, 2));
+                this.log(JSON.stringify(buildPagingJson({ items: withPolicyChecks(releases, checks) }, { tier: 'none' }), null, 2));
             }
             else if (releases.length === 0) {
                 this.log('No releases found');
             }
             else {
                 this.log(`Releases in workspace ${workspaceId}:`);
-                for (const release of releases) {
-                    const branch = release.branch ? ` - ${release.branch}` : '';
-                    const hotfix = release.hotfix ? ' [hotfix]' : '';
-                    const createdAt = release.created_at
-                        ? ` (${new Date(release.created_at).toLocaleString(undefined, { timeZoneName: 'short' })})`
-                        : '';
-                    this.log(`  - ${release.name} (ID: ${release.id})${branch}${hotfix}${createdAt}`);
-                }
+                for (const release of releases)
+                    this.log(releaseLine(release, checks));
+                if (checks)
+                    this.log('Policy check details: xano policy runs --release <name>');
             }
         }
         catch (error) {
@@ -84,4 +89,43 @@ Releases in workspace 5:
             }
         }
     }
+    /**
+     * The releases' stored policy checks, read once for the whole list. The list never fails or
+     * changes because of this read: it answers `null` when the checks cannot be read (the Policies
+     * feature is off, the credential lacks `workspace:policy` read, or the request failed), and the
+     * list then prints as it would without policies.
+     */
+    async policyChecks(profile, workspace, releases, verbose) {
+        if (releases.length === 0)
+            return null;
+        return readReleasePolicyChecks({ logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { branch: '', profile, verbose, workspace }, releases.map(release => release.id));
+    }
+}
+/** A release's summary line, tagged with its stored check when the checks were read. */
+function releaseLine(release, checks) {
+    const branch = release.branch ? ` - ${release.branch}` : '';
+    const hotfix = release.hotfix ? ' [hotfix]' : '';
+    const createdAt = release.created_at
+        ? ` (${new Date(release.created_at).toLocaleString(undefined, { timeZoneName: 'short' })})`
+        : '';
+    const policies = checks ? ` ${releasePolicyCheckTag(checks.get(release.id))}` : '';
+    return `  - ${release.name} (ID: ${release.id})${branch}${hotfix}${createdAt}${policies}`;
+}
+/**
+ * The releases for `-o json`: each gains `policy_check` (its stored check as the platform lists
+ * it, without the release id it is keyed by, or `null` for a release with no stored check) when
+ * the checks were read, and stays as served when they could not be, so a reader can tell an
+ * unchecked release (`null`) from checks the CLI could not read (absent).
+ */
+function withPolicyChecks(releases, checks) {
+    if (!checks)
+        return releases;
+    return releases.map(release => {
+        const check = checks.get(release.id);
+        if (!check)
+            return { ...release, policy_check: null };
+        const stored = { ...check };
+        delete stored.release_id;
+        return { ...release, policy_check: stored };
+    });
 }

package/dist/commands/release/pull/index.d.ts

@@ -14,10 +14,4 @@ export default class ReleasePull extends BaseCommand {
     };
     run(): Promise<void>;
     private resolveReleaseName;
-    /**
-     * Sanitize a document name for use as a filename.
-     * Strips quotes, replaces spaces with underscores, and removes
-     * characters that are unsafe in filenames.
-     */
-    private sanitizeFilename;
 }

package/dist/commands/release/pull/index.js

@@ -1,9 +1,9 @@
 import { Flags } from '@oclif/core';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
 import snakeCase from 'lodash.snakecase';
+import * as fs from 'node:fs';
+import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { buildApiGroupFolderResolver, parseDocument } from '../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, parseDocument, resolveDocumentPath, } from '../../../utils/document-parser.js';
 export default class ReleasePull extends BaseCommand {
     static description = 'Pull a release multidoc from the Xano Metadata API and split into individual files';
     static examples = [
@@ -123,96 +123,19 @@ Pulled 58 documents from release 'v1.0'
         fs.mkdirSync(outputDir, { recursive: true });
         // Resolve api_group names to unique folder names, disambiguating collisions
         const getApiGroupFolder = buildApiGroupFolderResolver(documents, snakeCase);
+        // Resolve a realtime v2 channel path -> owning realtime_server name, so
+        // messages can nest under their channel's server (see resolver docs).
+        const getChannelServer = buildChannelServerResolver(documents);
         // Track filenames per type to handle duplicates
         const filenameCounters = new Map();
         let writtenCount = 0;
         for (const doc of documents) {
-            let typeDir;
-            let baseName;
-            if (doc.type === 'workspace') {
-                // workspace → workspace/{name}.xs
-                typeDir = path.join(outputDir, 'workspace');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'workspace_trigger') {
-                // workspace_trigger → workspace/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'workspace', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'error_trigger') {
-                // error_trigger → workspace/trigger/{name}.xs (singleton, colocated with workspace triggers)
-                typeDir = path.join(outputDir, 'workspace', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'agent') {
-                // agent → ai/agent/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'agent');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'mcp_server') {
-                // mcp_server → ai/mcp_server/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'mcp_server');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'tool') {
-                // tool → ai/tool/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'tool');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'agent_trigger') {
-                // agent_trigger → ai/agent/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'agent', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'mcp_server_trigger') {
-                // mcp_server_trigger → ai/mcp_server/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'mcp_server', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'table_trigger') {
-                // table_trigger → table/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'table', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'realtime_channel') {
-                // realtime_channel → realtime/channel/{name}.xs
-                typeDir = path.join(outputDir, 'realtime', 'channel');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'realtime_trigger') {
-                // realtime_trigger → realtime/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'realtime', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'api_group') {
-                // api_group "test" → api/{resolved_folder}/{name}.xs
-                const groupFolder = getApiGroupFolder(doc.name);
-                typeDir = path.join(outputDir, 'api', groupFolder);
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'query' && doc.apiGroup) {
-                // query in group "test" → api/{resolved_folder}/{query_name}.xs
-                const groupFolder = getApiGroupFolder(doc.apiGroup);
-                const nameParts = doc.name.split('/');
-                const leafName = nameParts.pop();
-                const folderParts = nameParts.map((part) => snakeCase(part));
-                typeDir = path.join(outputDir, 'api', groupFolder, ...folderParts);
-                baseName = this.sanitizeFilename(leafName);
-                if (doc.verb) {
-                    baseName = `${baseName}_${doc.verb}`;
-                }
-            }
-            else {
-                // Default: split folder path from name
-                const nameParts = doc.name.split('/');
-                const leafName = nameParts.pop();
-                const folderParts = nameParts.map((part) => snakeCase(part));
-                typeDir = path.join(outputDir, doc.type, ...folderParts);
-                baseName = this.sanitizeFilename(leafName);
-                if (doc.verb) {
-                    baseName = `${baseName}_${doc.verb}`;
-                }
-            }
+            const { baseName, typeDir } = resolveDocumentPath(doc, outputDir, {
+                getApiGroupFolder,
+                getChannelServer,
+                join: path.join,
+                snakeCase,
+            });
             fs.mkdirSync(typeDir, { recursive: true });
             // Track duplicates per directory
             const dirKey = path.relative(outputDir, typeDir);
@@ -223,8 +146,7 @@ Pulled 58 documents from release 'v1.0'
             const count = typeCounters.get(baseName) || 0;
             typeCounters.set(baseName, count + 1);
             // Append numeric suffix for duplicates
-            let filename;
-            filename = count === 0 ? `${baseName}.xs` : `${baseName}_${count + 1}.xs`;
+            const filename = count === 0 ? `${baseName}.xs` : `${baseName}_${count + 1}.xs`;
             const filePath = path.join(typeDir, filename);
             fs.writeFileSync(filePath, doc.content, 'utf8');
             writtenCount++;
@@ -257,12 +179,4 @@ Pulled 58 documents from release 'v1.0'
         }
         return match.id;
     }
-    /**
-     * Sanitize a document name for use as a filename.
-     * Strips quotes, replaces spaces with underscores, and removes
-     * characters that are unsafe in filenames.
-     */
-    sanitizeFilename(name) {
-        return snakeCase(name.replaceAll('"', ''));
-    }
 }

package/dist/commands/release/push/index.js

@@ -1,8 +1,10 @@
 import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { findFilesWithGuid } from '../../../utils/document-parser.js';
+import { findFilesWithGuid, parseDocument } from '../../../utils/document-parser.js';
+import { policiesSkippedNotice } from '../../../utils/policy/feedback.js';
+import { releasePolicyRunLines } from '../../../utils/policy/release.js';
 export default class ReleasePush extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS confirm with the user before creating a release from local files. Creates a new release from local XanoScript files via the multidoc endpoint.';
     static examples = [
@@ -72,7 +74,7 @@ Output release details as JSON
     };
     async run() {
         const { flags } = await this.parse(ReleasePush);
-        const { profileName, profile } = this.resolveProfile(flags);
+        const { profile, profileName } = this.resolveProfile(flags);
         // Determine workspace_id from flag or profile
         let workspaceId;
         if (flags.workspace) {
@@ -110,6 +112,12 @@ Output release details as JSON
         if (documentEntries.length === 0) {
             this.error(`All .xs files in ${flags.directory} are empty`);
         }
+        // A release carries its policy files like its code.
+        const policyKeys = documentEntries
+            .map((entry) => parseDocument(entry.content))
+            .filter((document) => document?.type === 'policy')
+            .map((document) => document.name)
+            .sort();
         const multidoc = documentEntries.map((d) => d.content).join('\n---\n');
         // Construct the API URL with query params
         const queryParams = new URLSearchParams({
@@ -158,6 +166,10 @@ Output release details as JSON
                 this.error(errorMessage);
             }
             const release = (await response.json());
+            // The platform says which policy files it left out: all of them while the Policies feature is
+            // off, and those of a caller who may not author policies, whose release carries the live
+            // branch's policies instead.
+            const skipped = policiesSkippedNotice(release);
             if (flags.output === 'json') {
                 this.log(JSON.stringify(release, null, 2));
             }
@@ -171,8 +183,14 @@ Output release details as JSON
                     this.log(`  Description: ${release.description}`);
                 const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
                 this.log(`  Documents: ${documentEntries.length}`);
+                if (policyKeys.length > 0 && !skipped)
+                    this.log(`  Policy documents: ${policyKeys.length} (${policyKeys.join(', ')})`);
+                for (const line of releasePolicyRunLines(release.policy_run, release.name ?? flags.name))
+                    this.log(line);
                 this.log(`  Time: ${elapsed}s`);
             }
+            if (skipped)
+                this.warn(skipped);
         }
         catch (error) {
             if (error instanceof Error) {

package/dist/commands/sandbox/env/get_all/index.js

@@ -1,7 +1,7 @@
 import { Flags } from '@oclif/core';
 import * as yaml from 'js-yaml';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class SandboxEnvGetAll extends BaseCommand {
     static description = 'Get all environment variables for a sandbox environment and save to a YAML file';

package/dist/commands/sandbox/env/set_all/index.js

@@ -1,7 +1,7 @@
 import { Flags } from '@oclif/core';
 import * as yaml from 'js-yaml';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class SandboxEnvSetAll extends BaseCommand {
     static description = '[CRITICAL] STOP and confirm with the user; this replaces all environment variables with the imported file. Sets all environment variables for a sandbox environment from a YAML file.';

package/dist/commands/sandbox/get/index.js

@@ -36,7 +36,7 @@ Sandbox Environment: (tc24-abcd-x1y2)
                     this.log(`  Domain: ${tenant.xano_domain}`);
                 if (tenant.sandbox_expires_at) {
                     const expiresAt = new Date(tenant.sandbox_expires_at);
-                    if (!isNaN(expiresAt.getTime())) {
+                    if (!Number.isNaN(expiresAt.getTime())) {
                         const msLeft = expiresAt.getTime() - Date.now();
                         if (msLeft > 0) {
                             const minsLeft = Math.ceil(msLeft / 60_000);

package/dist/commands/sandbox/license/get/index.js

@@ -1,6 +1,6 @@
 import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
+import path from 'node:path';
 import BaseCommand from '../../../../base-command.js';
 export default class SandboxLicenseGet extends BaseCommand {
     static description = 'Get the license for a sandbox environment';