@xano/cli 1.2.0 → 1.3.1-beta.0

package/dist/commands/workspace/pull/index.js

@@ -1,10 +1,11 @@
 import { Flags } from '@oclif/core';
-import * as fs from 'node:fs';
-import * as path from 'node:path';
 import snakeCase from 'lodash.snakecase';
+import * as fs from 'node:fs';
+import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { buildApiGroupFolderResolver, parseDocument } from '../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, parseDocument, policyBaseName, resolveDocumentPath, } from '../../../utils/document-parser.js';
 import { fetchKnowledge, writeKnowledge } from '../../../utils/knowledge-sync.js';
+import { policyListing } from '../../../utils/policy/request.js';
 export default class Pull extends BaseCommand {
     static description = 'Pull a workspace multidoc from the Xano Metadata API and split into individual files';
     static examples = [
@@ -27,7 +28,7 @@ Pulled 58 documents
         ...BaseCommand.baseFlags,
         branch: Flags.string({
             char: 'b',
-            description: 'Branch name (optional if set in profile, defaults to live)',
+            description: "Branch name (defaults to profile branch or live; -b '' selects live)",
             required: false,
         }),
         directory: Flags.string({
@@ -36,14 +37,14 @@ Pulled 58 documents
             description: 'Output directory for pulled documents (defaults to current directory)',
             required: false,
         }),
-        env: Flags.boolean({
+        draft: Flags.boolean({
             default: false,
-            description: 'Include environment variables',
+            description: 'Include draft versions',
             required: false,
         }),
-        draft: Flags.boolean({
+        env: Flags.boolean({
             default: false,
-            description: 'Include draft versions',
+            description: 'Include environment variables',
             required: false,
         }),
         records: Flags.boolean({
@@ -73,8 +74,8 @@ Pulled 58 documents
                 `  1. Provide it as a flag: xano workspace pull -w <workspace_id>\n` +
                 `  2. Set it in your profile using: xano profile:edit ${profileName} -w <workspace_id>`);
         }
-        // Determine branch from flag or profile
-        const branch = flags.branch || profile.branch || '';
+        // Determine branch from flag or profile; `-b ''` selects live whatever the profile's branch, as in push.
+        const branch = flags.branch ?? profile.branch ?? '';
         // Build query parameters
         const queryParams = new URLSearchParams({
             branch,
@@ -123,107 +124,31 @@ Pulled 58 documents
                 documents.push(parsed);
             }
         }
+        // Resolve the output directory
+        const outputDir = path.resolve(flags.directory);
+        const clashing = await this.policyClashes(documents, outputDir, () => policyListing({ logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { branch, profile, verbose: flags.verbose, workspace: workspaceId }));
         if (documents.length === 0) {
             this.log('No documents found in response');
             return;
         }
-        // Resolve the output directory
-        const outputDir = path.resolve(flags.directory);
         // Create the output directory if it doesn't exist
         fs.mkdirSync(outputDir, { recursive: true });
         // Resolve api_group names to unique folder names, disambiguating collisions
         // where different names produce the same snakeCase (e.g., "Authentication" vs "authentication")
         const getApiGroupFolder = buildApiGroupFolderResolver(documents, snakeCase);
+        // Resolve a realtime v2 channel path -> owning realtime_server name, so
+        // messages can nest under their channel's server (see resolver docs).
+        const getChannelServer = buildChannelServerResolver(documents);
         // Track filenames per type to handle duplicates
         const filenameCounters = new Map();
         let writtenCount = 0;
-        for (const doc of documents) {
-            let typeDir;
-            let baseName;
-            if (doc.type === 'workspace') {
-                // workspace → workspace/{name}.xs
-                typeDir = path.join(outputDir, 'workspace');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'workspace_trigger') {
-                // workspace_trigger → workspace/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'workspace', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'error_trigger') {
-                // error_trigger → workspace/trigger/{name}.xs (singleton, colocated with workspace triggers)
-                typeDir = path.join(outputDir, 'workspace', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'agent') {
-                // agent → ai/agent/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'agent');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'mcp_server') {
-                // mcp_server → ai/mcp_server/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'mcp_server');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'tool') {
-                // tool → ai/tool/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'tool');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'agent_trigger') {
-                // agent_trigger → ai/agent/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'agent', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'mcp_server_trigger') {
-                // mcp_server_trigger → ai/mcp_server/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'ai', 'mcp_server', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'table_trigger') {
-                // table_trigger → table/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'table', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'realtime_channel') {
-                // realtime_channel → realtime/channel/{name}.xs
-                typeDir = path.join(outputDir, 'realtime', 'channel');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'realtime_trigger') {
-                // realtime_trigger → realtime/trigger/{name}.xs
-                typeDir = path.join(outputDir, 'realtime', 'trigger');
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'api_group') {
-                // api_group "test" → api/{resolved_folder}/{name}.xs
-                const groupFolder = getApiGroupFolder(doc.name);
-                typeDir = path.join(outputDir, 'api', groupFolder);
-                baseName = this.sanitizeFilename(doc.name);
-            }
-            else if (doc.type === 'query' && doc.apiGroup) {
-                // query in group "test" → api/{resolved_folder}/{query_name}.xs
-                const groupFolder = getApiGroupFolder(doc.apiGroup);
-                const nameParts = doc.name.split('/');
-                const leafName = nameParts.pop();
-                const folderParts = nameParts.map((part) => snakeCase(part));
-                typeDir = path.join(outputDir, 'api', groupFolder, ...folderParts);
-                baseName = this.sanitizeFilename(leafName);
-                if (doc.verb) {
-                    baseName = `${baseName}_${doc.verb}`;
-                }
-            }
-            else {
-                // Default: split folder path from name
-                const nameParts = doc.name.split('/');
-                const leafName = nameParts.pop();
-                const folderParts = nameParts.map((part) => snakeCase(part));
-                typeDir = path.join(outputDir, doc.type, ...folderParts);
-                baseName = this.sanitizeFilename(leafName);
-                if (doc.verb) {
-                    baseName = `${baseName}_${doc.verb}`;
-                }
-            }
+        for (const doc of documents.filter((document) => !clashing.has(document))) {
+            const { baseName, typeDir } = resolveDocumentPath(doc, outputDir, {
+                getApiGroupFolder,
+                getChannelServer,
+                join: path.join,
+                snakeCase,
+            });
             fs.mkdirSync(typeDir, { recursive: true });
             // Track duplicates per directory
             const dirKey = path.relative(outputDir, typeDir);
@@ -234,8 +159,7 @@ Pulled 58 documents
             const count = typeCounters.get(baseName) || 0;
             typeCounters.set(baseName, count + 1);
             // Append numeric suffix for duplicates
-            let filename;
-            filename = count === 0 ? `${baseName}.xs` : `${baseName}_${count + 1}.xs`;
+            const filename = count === 0 ? `${baseName}.xs` : `${baseName}_${count + 1}.xs`;
             const filePath = path.join(typeDir, filename);
             fs.writeFileSync(filePath, doc.content, 'utf8');
             writtenCount++;
@@ -251,13 +175,66 @@ Pulled 58 documents
         if (knowledgeCount > 0)
             parts.push(`${knowledgeCount} knowledge file${knowledgeCount === 1 ? '' : 's'}`);
         this.log(`Pulled ${parts.join(' + ')} to ${flags.directory}`);
+        // Policy files state the rules; the skill the instance generates tells an agent how to follow them.
+        // Only a pull that carried policy files says so: an instance with the Policies feature off exports
+        // none, and its skill route answers 403.
+        if (documents.some((doc) => doc.type === 'policy')) {
+            this.log('Run `xano skills pull` to install the policies skill for your coding agent.');
+        }
     }
     /**
-     * Sanitize a document name for use as a filename.
-     * Strips quotes, replaces spaces with underscores, and removes
-     * characters that are unsafe in filenames.
+     * Policy keys are unique on the server without regard to case, but an older export or a local file
+     * can still differ only in case, and file names are not case-sensitive on every checkout. The
+     * policies whose file name differs only in case from another exported policy, or from a local file
+     * it would overwrite, are left out with a warning; everything else is written. Local policy files
+     * absent from the export are kept. They are reported as stale only when this credential reads the
+     * branch's policies, because an export leaves out the policies its credential cannot read, and
+     * every policy while the Policies feature is off.
      */
-    sanitizeFilename(name) {
-        return snakeCase(name.replaceAll('"', ''));
+    async policyClashes(documents, outputDir, readsPolicies) {
+        const exported = new Map();
+        for (const doc of documents.filter(doc => doc.type === 'policy')) {
+            const filename = `${policyBaseName(doc.name)}.xs`;
+            exported.set(filename.toLowerCase(), [...(exported.get(filename.toLowerCase()) ?? []), filename]);
+        }
+        const clashes = new Map();
+        for (const [normalized, names] of exported) {
+            if (names.length > 1)
+                clashes.set(normalized, names.map(name => `policies/${name}`).join(' and '));
+        }
+        const policyDir = path.join(outputDir, 'policies');
+        const localFiles = fs.existsSync(policyDir)
+            ? fs.readdirSync(policyDir, { withFileTypes: true })
+                .filter(entry => entry.isFile() && entry.name.toLowerCase().endsWith('.xs'))
+                .map(entry => entry.name)
+                .sort()
+            : [];
+        const stale = [];
+        for (const filename of localFiles) {
+            const names = exported.get(filename.toLowerCase());
+            if (!names)
+                stale.push(`policies/${filename}`);
+            else if (!names.includes(filename) && !clashes.has(filename.toLowerCase())) {
+                clashes.set(filename.toLowerCase(), `policies/${names[0]} (local policies/${filename})`);
+            }
+        }
+        if (clashes.size > 0) {
+            this.warn(`Policy files that differ only in case are left out of this pull; everything else is written:\n  ${[...clashes.values()].join('\n  ')}\n` +
+                'Rename one of the policies, or move the local file aside, then pull again.');
+        }
+        if (stale.length > 0) {
+            // An export that carries a policy was made by a credential that reads them.
+            const listing = exported.size > 0 ? 'listed' : await readsPolicies();
+            if (listing === 'listed') {
+                this.warn(`Stale local policy files are absent from this export and were kept:\n  ${stale.join('\n  ')}\nReview them before pushing; a push can publish these policies again.`);
+            }
+            else if (listing === 'feature_off') {
+                this.log('Local policy files were kept: Policies are not enabled on this instance, so the export carries none.');
+            }
+            else {
+                this.log(`Local policy files were kept: this credential cannot list this workspace's policies, and the export carries none.`);
+            }
+        }
+        return new Set(documents.filter(doc => doc.type === 'policy' && clashes.has(`${doc.name}.xs`.toLowerCase())));
     }
 }

package/dist/commands/workspace/push/index.d.ts

@@ -12,6 +12,9 @@ export default class Push extends BaseCommand {
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         guids: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         include: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         records: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         sync: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         transaction: import("@oclif/core/interfaces").BooleanFlag<boolean>;
@@ -21,5 +24,21 @@ export default class Push extends BaseCommand {
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
     run(): Promise<void>;
+    /**
+     * A failure after the import landed. The import stands, so its policy feedback is reported as for
+     * any push and a blocking finding still exits 2; otherwise the failure exits 1. Under `-o json`
+     * stdout holds the import's document with the failure as `error`.
+     */
+    private catchAfterImport;
+    /**
+     * What happened to the policy documents, then the policy check the import answered with. When the
+     * platform left the policy files out, its notice says so instead of a count of what was sent.
+     */
+    private reportPolicyFeedback;
 }

package/dist/commands/workspace/push/index.js

@@ -2,7 +2,28 @@ import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
 import { resolve } from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { executePush } from '../../../utils/multidoc-push.js';
+import { parseDocument } from '../../../utils/document-parser.js';
+import { executePush, FailedAfterImportError, } from '../../../utils/multidoc-push.js';
+import { policyCodeGuidance } from '../../../utils/policy/errors.js';
+import { policiesSkippedNotice, policyCheckWarning, policyDocumentSummary, policyExitCode, policySummary, pushEvidence, } from '../../../utils/policy/feedback.js';
+import { BLANK_POLICY_OVERRIDE, blankPolicyOverride } from '../../../utils/policy/gate.js';
+import { policyFilePushGuidance } from '../../../utils/policy/permission.js';
+import { PushPolicyGateError } from '../../../utils/policy/push-gate.js';
+/** The `-o json` document for a push whose import ran: the import response and what was sent. */
+function importDocument(result) {
+    return { ...result.response, documents: result.sent.length, imported: true, knowledge: result.knowledge };
+}
+/** The policy check the import answered with, if any. */
+function policyCheck(result) {
+    return result.response?.policy_check;
+}
+/**
+ * The platform's one notice that it left the push's policy files out (the Policies feature is off):
+ * the import's, else its preview's, since a partial push may not send the files the preview named.
+ */
+function policiesSkipped(result) {
+    return policiesSkippedNotice(result.response) ?? policiesSkippedNotice(result.preview);
+}
 export default class Push extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS run --dry-run first and show the user the output before pushing. Push local documents to a workspace. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only.';
     static examples = [
@@ -56,6 +77,9 @@ Push functions but exclude test files
 `,
         `$ xano workspace push -i "knowledge/**"
 Push only knowledge files (agents.md / skills / docs)
+`,
+        `$ xano workspace push -m "Tightened the auth policies"
+Label the Version History entry of each policy this push changes; other objects get no message
 `,
         `$ xano workspace push --sync --delete
 Full sync including knowledge files; removes server objects not present locally
@@ -65,7 +89,7 @@ Full sync including knowledge files; removes server objects not present locally
         ...BaseCommand.baseFlags,
         branch: Flags.string({
             char: 'b',
-            description: 'Branch name (optional if set in profile, defaults to live)',
+            description: "Branch name (defaults to profile branch or live; -b '' selects live)",
             required: false,
         }),
         delete: Flags.boolean({
@@ -112,6 +136,19 @@ Full sync including knowledge files; removes server objects not present locally
             multiple: true,
             required: false,
         }),
+        message: Flags.string({
+            char: 'm',
+            description: 'Labels the Version History entry of each policy this push changes; other objects get no message',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format; JSON retains the complete import and policy feedback',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        'policy-override': Flags.string({ description: 'Override a blocking live-branch policy gate with an audited reason (requires workspace:policy update)' }),
         records: Flags.boolean({
             default: false,
             description: '[CRITICAL] STOP and ALWAYS run --dry-run first to show the user a preview before pushing live table records. Includes table records in import.',
@@ -139,8 +176,20 @@ Full sync including knowledge files; removes server objects not present locally
             required: false,
         }),
     };
+    async catch(error) {
+        if (error instanceof PushPolicyGateError) {
+            if (this.isJsonOutput())
+                this.log(JSON.stringify({ imported: false, refused: error.payload }, null, 2));
+            this.error(error.message, { exit: 2 });
+        }
+        if (error instanceof FailedAfterImportError)
+            return this.catchAfterImport(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { flags } = await this.parse(Push);
+        if (blankPolicyOverride(flags['policy-override']))
+            this.error(BLANK_POLICY_OVERRIDE);
         const { profile, profileName } = this.resolveProfile(flags);
         // Determine workspace_id from flag or profile
         let workspaceId;
@@ -162,12 +211,23 @@ Full sync including knowledge files; removes server objects not present locally
         if (!fs.statSync(inputDir).isDirectory()) {
             this.error(`Not a directory: ${inputDir}`);
         }
-        const branch = flags.branch || profile.branch || '';
+        const branch = flags.branch ?? profile.branch ?? '';
         const baseUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}`;
+        const json = flags.output === 'json';
+        // Only the import writes Version History entries, so only the import carries the message.
+        const message = flags.message?.trim();
         const target = {
             buildDryRunUrl: (params) => `${baseUrl}/multidoc/dry-run?${params.toString()}`,
-            buildPushUrl: (params) => `${baseUrl}/multidoc?${params.toString()}`,
+            buildPushUrl(params) {
+                const query = new URLSearchParams(params);
+                if (message)
+                    query.set('message', message);
+                if (flags['policy-override']?.trim())
+                    query.set('override_reason', flags['policy-override'].trim());
+                return `${baseUrl}/multidoc?${query.toString()}`;
+            },
             cliVersion: this.config.version,
+            explainRefusal: (status, payload) => (status === 403 ? policyFilePushGuidance(payload) : policyCodeGuidance(payload) || undefined),
             instanceOrigin: profile.instance_origin,
             label: `workspace ${workspaceId}`,
             supportsBranches: true,
@@ -187,7 +247,7 @@ Full sync including knowledge files; removes server objects not present locally
             truncate: flags.truncate,
             verbose: flags.verbose,
         };
-        await executePush({
+        const result = await executePush({
             accessToken: profile.access_token,
             branch,
             command: this,
@@ -196,7 +256,66 @@ Full sync including knowledge files; removes server objects not present locally
                 listUrl: () => `${baseUrl}/knowledge/sync`,
                 rootDir: inputDir,
             },
+            // Under `-o json` stdout carries one JSON document, so progress goes to stderr.
+            log: json ? this.logToStderr.bind(this) : undefined,
             verboseFetch: this.verboseFetch.bind(this),
         }, target, pushFlags);
+        if (json) {
+            this.log(JSON.stringify(result.stopped
+                ? { imported: false, preview: result.preview, reason: result.stopped }
+                : importDocument(result), null, 2));
+        }
+        // Policy feedback describes the multidoc import, so a push that imported none has none. Its
+        // preview may still say that the policy files are left out.
+        if (result.response) {
+            this.reportPolicyFeedback(result, json);
+        }
+        else {
+            const skipped = policiesSkipped(result);
+            if (skipped)
+                this.warn(skipped);
+        }
+    }
+    /**
+     * A failure after the import landed. The import stands, so its policy feedback is reported as for
+     * any push and a blocking finding still exits 2; otherwise the failure exits 1. Under `-o json`
+     * stdout holds the import's document with the failure as `error`.
+     */
+    catchAfterImport(error) {
+        const json = this.isJsonOutput();
+        const exit = policyExitCode(policyCheck(error.imported)) || 1;
+        if (json)
+            this.log(JSON.stringify({ ...importDocument(error.imported), error: { exit, message: error.message } }, null, 2));
+        this.reportPolicyFeedback(error.imported, json);
+        this.error(error, { exit });
+    }
+    /**
+     * What happened to the policy documents, then the policy check the import answered with. When the
+     * platform left the policy files out, its notice says so instead of a count of what was sent.
+     */
+    reportPolicyFeedback(result, json) {
+        const check = policyCheck(result);
+        const skipped = policiesSkipped(result);
+        if (skipped)
+            this.warn(skipped);
+        if (!json) {
+            if (!skipped) {
+                const sentPolicies = result.sent.filter((entry) => parseDocument(entry.content)?.type === 'policy').length;
+                for (const line of policyDocumentSummary(result.preview, sentPolicies))
+                    this.log(line);
+            }
+            for (const line of policySummary(check, pushEvidence(check)))
+                this.log(line);
+        }
+        const warning = policyCheckWarning(check);
+        if (warning)
+            this.warn(warning);
+        const code = policyExitCode(check);
+        if (code) {
+            process.exitCode = code;
+            if (!json)
+                this.log('Next: `xano policy status --run-detail` for the current standing, or `xano policy runs` for this run.');
+            this.warn('Workspace import completed with blocking policy findings; the imported changes were not rolled back.');
+        }
     }
 }

package/dist/help.js

@@ -45,7 +45,9 @@ export default class Help extends BaseHelp {
             if (this.config.topicSeparator !== ':')
                 c.id = c.id.replaceAll(':', this.config.topicSeparator);
             const summary = this.summary(c);
-            return [c.id, summary ? summary.replace(/\u001B\[\d+m/g, '') : ''];
+            // Strip ANSI colour codes from the summary so the help table aligns.
+            // eslint-disable-next-line no-control-regex -- matching the escape char is the point
+            return [c.id, summary ? summary.replaceAll(/\u001B\[\d+m/g, '') : ''];
         });
         // Only add promoted commands at the root level, not within a specific topic
         if (isRootHelp) {
@@ -59,6 +61,6 @@ export default class Help extends BaseHelp {
             spacer: '\n',
             stripAnsi: this.opts.stripAnsi,
         });
-        return this.section('COMMANDS', body + `\n\n\x1b[2mSee xano <topic> --help for all commands in a topic.\x1b[0m`);
+        return this.section('COMMANDS', body + `\n\n\u001B[2mSee xano <topic> --help for all commands in a topic.\u001B[0m`);
     }
 }

package/dist/policy-command.d.ts

@@ -0,0 +1,90 @@
+import type { Policy, PolicyRun } from './utils/policy/types.js';
+import BaseCommand from './base-command.js';
+import { type PolicyRequest } from './utils/policy/request.js';
+/** One rule's warnings from the parse route: its 0-based index, id and sentences. */
+export interface RuleWarnings {
+    rule: number;
+    rule_id: string;
+    warnings: string[];
+}
+/** What the parse route answers. */
+export interface ParsedPolicy {
+    policy: Policy;
+    rule_warnings: RuleWarnings[];
+    source: string;
+}
+/** The workspace and branch a policy command acts on, and requests bound to them. */
+export interface PolicyTarget {
+    branch: string;
+    request: PolicyRequest;
+    workspace: string;
+}
+interface TargetFlags {
+    branch?: string;
+    config?: string;
+    profile?: string;
+    verbose: boolean;
+    workspace?: string;
+}
+/** Shared flags, request helper and output for the `policy *` commands and `skills pull`. */
+export default abstract class PolicyCommand extends BaseCommand {
+    static policyFlags: {
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** `publish -m`: the message on the Version History entry the save creates. */
+    static publishFlags: {
+        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    /** One positional, as CLAUDE.md requires: the file `--file` would otherwise name. */
+    static sourceArgs: {
+        file: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static sourceFlags: {
+        file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** Any failure exits 1; an error that is not the CLI's own names the command it broke. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
+    /**
+     * Print each rule's warnings (a name, tag or value that makes the rule check nothing) to stderr,
+     * so piped source stays clean; nothing when there are none.
+     */
+    protected logRuleWarnings(parsed: ParsedPolicy): void;
+    /** Print a run's recorded detail, or say it evaluated no policy. */
+    protected logRunDetail(run: PolicyRun): void;
+    /**
+     * Ask the parse route for the policy, its canonical source and each rule's warnings against the
+     * target branch, from XanoScript (`{source}`) or a policy document (`{data}`); the policy and source
+     * must come back.
+     */
+    protected parseSource(request: PolicyRequest, input: {
+        data: unknown;
+    } | {
+        source: string;
+    }): Promise<ParsedPolicy>;
+    /**
+     * The workspace and branch from the flags or the profile, and a request helper bound to them for
+     * a route gated by `workspace:policy`: `/policy` unless another is named.
+     */
+    protected policyTarget(flags: TargetFlags, route?: Pick<import("./utils/policy/request.js").PolicyRequestRoute, "path" | "label">): PolicyTarget;
+    /** Policy source from the positional, `--file` or `--stdin`; a file named twice must be named the same. */
+    protected readSource(flags: {
+        file?: string;
+        stdin?: boolean;
+    }, positional?: string): string;
+    /** `workspace 3 (feature)`, or just `workspace 3` for live. */
+    protected where({ branch, workspace }: {
+        branch: string;
+        workspace: string;
+    }): string;
+}
+export {};