@xano/cli 1.2.0 → 1.3.1-beta.0

package/dist/policy-command.js

@@ -0,0 +1,94 @@
+import { Args, Flags } from '@oclif/core';
+import * as fs from 'node:fs';
+import BaseCommand from './base-command.js';
+import { POLICY_ROUTE, policyRequest, policyScope } from './utils/policy/request.js';
+import { policyRunDetail } from './utils/policy/runs.js';
+/** Shared flags, request helper and output for the `policy *` commands and `skills pull`. */
+export default class PolicyCommand extends BaseCommand {
+    static policyFlags = {
+        ...BaseCommand.baseFlags,
+        branch: Flags.string({ char: 'b', description: "Branch label (defaults to profile branch or live; -b '' selects live)" }),
+        output: Flags.string({ char: 'o', default: 'summary', description: 'Output format', options: ['summary', 'json'] }),
+        workspace: Flags.string({ char: 'w', description: 'Workspace ID (defaults to profile workspace)' }),
+    };
+    /** `publish -m`: the message on the Version History entry the save creates. */
+    static publishFlags = {
+        message: Flags.string({ char: 'm', description: 'Message stored on the Version History entry this save creates' }),
+    };
+    /** One positional, as CLAUDE.md requires: the file `--file` would otherwise name. */
+    static sourceArgs = {
+        file: Args.string({ description: 'Policy XanoScript file (same as --file)', ignoreStdin: true, required: false }),
+    };
+    static sourceFlags = {
+        file: Flags.string({ char: 'f', description: 'Policy XanoScript file', exclusive: ['stdin'] }),
+        stdin: Flags.boolean({ default: false, description: 'Read policy XanoScript from stdin', exclusive: ['file'] }),
+    };
+    /** Any failure exits 1; an error that is not the CLI's own names the command it broke. */
+    async catch(error) {
+        if ('oclif' in error)
+            return this.catchAsOperational(error);
+        const action = this.id?.split(':').at(-1) ?? 'command';
+        return this.catchAsOperational(new Error(`Policy ${action} failed: ${error.message}`));
+    }
+    /**
+     * Print each rule's warnings (a name, tag or value that makes the rule check nothing) to stderr,
+     * so piped source stays clean; nothing when there are none.
+     */
+    logRuleWarnings(parsed) {
+        const warned = parsed.rule_warnings ?? [];
+        if (warned.length === 0)
+            return;
+        this.logToStderr('Rule warnings (the rule may check nothing or everything; fix them before relying on it):');
+        for (const rule of warned) {
+            for (const warning of rule.warnings)
+                this.logToStderr(`  ${rule.rule_id || `rule[${rule.rule}]`}: ${warning}`);
+        }
+    }
+    /** Print a run's recorded detail, or say it evaluated no policy. */
+    logRunDetail(run) {
+        const detail = policyRunDetail(run);
+        for (const line of detail)
+            this.log(line);
+        if (detail.length === 0)
+            this.log(run.id ? `Run ${run.id} evaluated no policies.` : 'No policies were evaluated.');
+    }
+    /**
+     * Ask the parse route for the policy, its canonical source and each rule's warnings against the
+     * target branch, from XanoScript (`{source}`) or a policy document (`{data}`); the policy and source
+     * must come back.
+     */
+    async parseSource(request, input) {
+        const answer = (await request('/parse', 'POST', input));
+        if (!answer?.policy?.key || typeof answer.source !== 'string')
+            this.error('The platform did not return a parsed policy and canonical source.');
+        return { ...answer, rule_warnings: Array.isArray(answer.rule_warnings) ? answer.rule_warnings : [] };
+    }
+    /**
+     * The workspace and branch from the flags or the profile, and a request helper bound to them for
+     * a route gated by `workspace:policy`: `/policy` unless another is named.
+     */
+    policyTarget(flags, route = POLICY_ROUTE) {
+        const { profile } = this.resolveProfile(flags);
+        const { branch, workspace } = policyScope(flags, profile);
+        if (!workspace)
+            this.error('Workspace ID required. Use --workspace or set one in your profile.');
+        const request = policyRequest({ error: (message) => this.error(message), logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { ...route, branch, profile, verbose: flags.verbose, workspace });
+        return { branch, request, workspace };
+    }
+    /** Policy source from the positional, `--file` or `--stdin`; a file named twice must be named the same. */
+    readSource(flags, positional) {
+        const named = positional?.trim();
+        if (named && flags.stdin)
+            this.error('Provide policy source once: a file (positional or --file) or --stdin.');
+        if (named && flags.file && flags.file !== named)
+            this.error('Provide the file once: as a positional or as --file.');
+        const file = flags.file ?? named;
+        if (!file && !flags.stdin)
+            this.error('Provide the policy file (as an argument or --file) or --stdin.');
+        return fs.readFileSync(flags.stdin ? 0 : file, 'utf8');
+    }
+    /** `workspace 3 (feature)`, or just `workspace 3` for live. */
+    where({ branch, workspace }) {
+        return `workspace ${workspace}${branch ? ` (${branch})` : ''}`;
+    }
+}

package/dist/update-check.d.ts

@@ -5,4 +5,4 @@ export declare function clearUpdateCache(): void;
  *
  * The check hits npm at most once every 24 hours and caches the result.
  */
-export declare function checkForUpdate(currentVersion: string, forceCheck?: boolean): string | null;
+export declare function checkForUpdate(currentVersion: string, forceCheck?: boolean): null | string;

package/dist/update-check.js

@@ -1,7 +1,7 @@
 import { execSync } from 'node:child_process';
 import * as fs from 'node:fs';
-import * as path from 'node:path';
 import * as os from 'node:os';
+import path from 'node:path';
 const UPDATE_CHECK_FILE = path.join(os.homedir(), '.xano', 'update-check.json');
 const CHECK_INTERVAL_MS = 8 * 60 * 60 * 1000; // 8 hours
 function isBeta(version) {

package/dist/utils/document-parser.d.ts

@@ -1,17 +1,112 @@
 export interface ParsedDocument {
     apiGroup?: string;
     canonical?: string;
+    /** Owning channel path for realtime v2 `message` documents. */
+    channel?: string;
     content: string;
     guid?: string;
     name: string;
+    /** Owning realtime_server name for realtime v2 `channel` documents. */
+    server?: string;
     type: string;
     verb?: string;
 }
+/**
+ * The platform's policy key pattern, kept offline for file names. A command that already holds the
+ * catalogue validates a key against the catalogue's `document.key.pattern` instead.
+ */
+export declare const POLICY_KEY_PATTERN: RegExp;
+/**
+ * The file name, without `.xs`, for a policy key. The pattern is the platform's own key pattern, so a
+ * key from the server can never name a path outside `policies/`.
+ */
+export declare function policyBaseName(key: string): string;
 /**
  * Parse a single XanoScript document to extract its type, name, and optional verb/api_group.
  * Skips leading comment lines (starting with //) to find the first meaningful line.
  */
 export declare function parseDocument(content: string): null | ParsedDocument;
+/**
+ * Map a realtime v2 channel path onto directory segments.
+ *
+ * A channel name IS a path template — "rooms/{room_id}" — so the directory tree
+ * mirrors it rather than flattening it. That is the whole reason messages nest
+ * under channels: the tree should show the structure, and
+ * "channel/rooms/[room_id]/post.xs" says immediately that `post` lives on a
+ * parameterized rooms channel.
+ *
+ *   "rooms"                    -> ["rooms"]
+ *   "rooms/{room_id}"          -> ["rooms", "[room_id]"]
+ *   "org/{org_id}/room/{id}"   -> ["org", "[org_id]", "room", "[id]"]
+ *
+ * Braces become brackets because "{" and "}" are awkward in shells, while "["
+ * and "]" are legal on every filesystem. They are still glob character classes,
+ * so scripting against a checkout needs the path quoted.
+ *
+ * Escaping the braces rather than dropping them is what keeps a parameterized
+ * channel distinct from a literal one: without it, "rooms/{room_id}" and a
+ * literal channel named "rooms/room_id" collide on the same directory.
+ *
+ * Mirrors Vfs::channelSegment() on the server.
+ */
+export declare function channelPathSegments(name: string, snakeCaseFn: (s: string) => string): string[];
+/**
+ * Build a map of realtime v2 channel path -> owning realtime_server name.
+ *
+ * This is the cross-document lookup the on-disk nesting needs: a `message`
+ * document names its channel (`channel = "..."`), while a `channel` document
+ * names its server (`realtime_server = "..."`). To place a message under
+ * `realtime/server/<server>/channel/<path>/...` we resolve the message's channel
+ * to that channel's server — which the channel document carries. (Messages now
+ * also carry `realtime_server` directly, but resolving via the channel keeps a
+ * single source of truth for the channel→server mapping.)
+ *
+ * Because every pull path parses the WHOLE multidoc into memory before writing,
+ * we can build this map from the `channel` docs in the same batch (a two-pass
+ * resolve), keyed by the channel's own name (its path). A channel with no
+ * `realtime_server` (e.g. a pre-server export) simply isn't in the map, and
+ * callers fall back accordingly.
+ */
+export declare function buildChannelServerResolver(documents: ParsedDocument[]): (channelName: string) => string | undefined;
+/**
+ * Sanitize a document name for use as a single on-disk filename segment.
+ * Strips quotes and snake_cases the rest. Mirrors the per-command
+ * `sanitizeFilename` the pull commands used to each define privately.
+ */
+export declare function sanitizeDocumentName(name: string, snakeCaseFn: (s: string) => string): string;
+/**
+ * The directory + base filename (no extension, no duplicate suffix) a document
+ * is written to on disk. `resolveDocumentPath` returns this; callers append the
+ * `.xs` extension and any `_N` duplicate suffix.
+ */
+export interface DocumentPlacement {
+    baseName: string;
+    typeDir: string;
+}
+/**
+ * Resolve where a parsed document lands on disk — the SINGLE source of truth for
+ * the pull layout, shared by every pull command (workspace, tenant, release,
+ * sandbox, ephemeral). Previously each command inlined a ~130-line copy of this
+ * decision; the copies drifted (the realtime v2 realtime_server/channel/message
+ * branches existed only in workspace/tenant), so an ephemeral pull dumped v2
+ * objects into flat top-level channel/, message/ and realtime_server/ folders —
+ * detaching messages from their channels and risking name collisions (message
+ * names are unique only WITHIN a channel).
+ *
+ * @param doc - the parsed document
+ * @param outputDir - the resolved pull output root
+ * @param deps - injected dependencies
+ * @param deps.getApiGroupFolder - resolves an api_group name to its unique folder
+ * @param deps.getChannelServer - resolves a v2 channel path to its owning realtime_server
+ * @param deps.join - the path.join implementation (injectable for testing)
+ * @param deps.snakeCase - the snakeCase implementation the caller uses
+ */
+export declare function resolveDocumentPath(doc: ParsedDocument, outputDir: string, deps: {
+    getApiGroupFolder: (groupName: string) => string;
+    getChannelServer: (channelName: string) => string | undefined;
+    join: (...parts: string[]) => string;
+    snakeCase: (s: string) => string;
+}): DocumentPlacement;
 /**
  * Build a unique key for a document based on its type, name, verb, and api_group.
  * Used to match server GUID map entries back to local files.
@@ -37,3 +132,34 @@ export declare function findFilesWithGuid(entries: Array<{
     content: string;
     filePath: string;
 }>, guid: string): string[];
+/**
+ * Split a multi-document XanoScript blob (documents joined by `\n---\n`) into
+ * parsed documents, skipping empties and any fragment that fails to parse.
+ *
+ * This is the same split the pull commands apply to the server's multidoc
+ * response. A hand-authored bundle is one file of many `---`-separated
+ * documents; this turns it back into the per-document units every downstream
+ * step (placement, GUID writeback, partial-diff matching) assumes.
+ */
+export declare function splitMultidoc(blob: string): ParsedDocument[];
+/** A document's resolved on-disk location relative to the output root, plus its content. */
+export interface PlacedDocument {
+    content: string;
+    /** POSIX-style path relative to the output root, e.g. "api/pdf/documents_GET.xs". */
+    relPath: string;
+}
+/**
+ * Compute where each document lands on disk — a PURE function (no filesystem)
+ * mirroring the split-and-place loop the pull commands run. It resolves each
+ * document via `resolveDocumentPath`, appends `.xs`, and disambiguates
+ * collisions within a directory with a `_N` suffix (the second file named
+ * `say.xs` in a dir becomes `say_2.xs`), exactly as the pull writer does.
+ *
+ * Kept filesystem-free so it can be unit-tested and reused by both the pull
+ * commands and `flatten` without duplicating the placement rules.
+ */
+export declare function placeDocuments(documents: ParsedDocument[], deps: {
+    join: (...parts: string[]) => string;
+    relative: (from: string, to: string) => string;
+    snakeCase: (s: string) => string;
+}): PlacedDocument[];

package/dist/utils/document-parser.js

@@ -1,3 +1,17 @@
+/**
+ * The platform's policy key pattern, kept offline for file names. A command that already holds the
+ * catalogue validates a key against the catalogue's `document.key.pattern` instead.
+ */
+export const POLICY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/**
+ * The file name, without `.xs`, for a policy key. The pattern is the platform's own key pattern, so a
+ * key from the server can never name a path outside `policies/`.
+ */
+export function policyBaseName(key) {
+    if (!POLICY_KEY_PATTERN.test(key))
+        throw new Error(`Invalid policy key: ${key}`);
+    return key;
+}
 /**
  * Parse a single XanoScript document to extract its type, name, and optional verb/api_group.
  * Skips leading comment lines (starting with //) to find the first meaningful line.
@@ -33,6 +47,9 @@ export function parseDocument(content) {
     if (name.startsWith('"') && name.endsWith('"')) {
         name = name.slice(1, -1);
     }
+    // Policy bodies are opaque. Prose/parameters may mention guid or api_group; these are not document identity.
+    if (type === 'policy')
+        return { content, name, type };
     // Extract verb if present (e.g., verb=GET)
     let verb;
     const verbMatch = rest.match(/verb=(\S+)/);
@@ -45,6 +62,25 @@ export function parseDocument(content) {
     if (apiGroupMatch) {
         apiGroup = apiGroupMatch[1];
     }
+    // Extract channel if present (e.g., channel = "rooms/{room_id}").
+    // Realtime v2 messages reference their owning channel by PATH, which is what
+    // nests them under it on disk.
+    let channel;
+    const channelMatch = content.match(/^\s*channel\s*=\s*"([^"]*)"/m);
+    if (channelMatch) {
+        channel = channelMatch[1];
+    }
+    // Extract realtime_server if present (e.g., realtime_server = "chat").
+    // Realtime v2 channels/messages reference their owning realtime_server by NAME
+    // via a top-level `realtime_server = "..."`, which is what nests them under it
+    // on disk (mirrors how a message names its channel via `channel = "..."`).
+    // The keyword is `realtime_server` (renamed from a bare `server` to match the
+    // api_group/mcp_server convention — reference the container by its full type).
+    let server;
+    const serverMatch = content.match(/^\s*realtime_server\s*=\s*"([^"]*)"/m);
+    if (serverMatch) {
+        server = serverMatch[1];
+    }
     // Extract canonical if present (e.g., canonical = "abc123")
     let canonical;
     const canonicalMatch = content.match(/canonical\s*=\s*"([^"]*)"/);
@@ -57,7 +93,241 @@ export function parseDocument(content) {
     if (guidMatch) {
         guid = guidMatch[1];
     }
-    return { apiGroup, canonical, content, guid, name, type, verb };
+    return { apiGroup, canonical, channel, content, guid, name, server, type, verb };
+}
+/**
+ * Map a realtime v2 channel path onto directory segments.
+ *
+ * A channel name IS a path template — "rooms/{room_id}" — so the directory tree
+ * mirrors it rather than flattening it. That is the whole reason messages nest
+ * under channels: the tree should show the structure, and
+ * "channel/rooms/[room_id]/post.xs" says immediately that `post` lives on a
+ * parameterized rooms channel.
+ *
+ *   "rooms"                    -> ["rooms"]
+ *   "rooms/{room_id}"          -> ["rooms", "[room_id]"]
+ *   "org/{org_id}/room/{id}"   -> ["org", "[org_id]", "room", "[id]"]
+ *
+ * Braces become brackets because "{" and "}" are awkward in shells, while "["
+ * and "]" are legal on every filesystem. They are still glob character classes,
+ * so scripting against a checkout needs the path quoted.
+ *
+ * Escaping the braces rather than dropping them is what keeps a parameterized
+ * channel distinct from a literal one: without it, "rooms/{room_id}" and a
+ * literal channel named "rooms/room_id" collide on the same directory.
+ *
+ * Mirrors Vfs::channelSegment() on the server.
+ */
+export function channelPathSegments(name, snakeCaseFn) {
+    // A parameter keeps the author's name verbatim so it matches the `input`
+    // block; only the delimiters are swapped.
+    const isParam = /^\{.*\}$/;
+    return name.split('/').map((segment) => (isParam.test(segment) ? `[${segment.slice(1, -1)}]` : snakeCaseFn(segment)));
+}
+/**
+ * Build a map of realtime v2 channel path -> owning realtime_server name.
+ *
+ * This is the cross-document lookup the on-disk nesting needs: a `message`
+ * document names its channel (`channel = "..."`), while a `channel` document
+ * names its server (`realtime_server = "..."`). To place a message under
+ * `realtime/server/<server>/channel/<path>/...` we resolve the message's channel
+ * to that channel's server — which the channel document carries. (Messages now
+ * also carry `realtime_server` directly, but resolving via the channel keeps a
+ * single source of truth for the channel→server mapping.)
+ *
+ * Because every pull path parses the WHOLE multidoc into memory before writing,
+ * we can build this map from the `channel` docs in the same batch (a two-pass
+ * resolve), keyed by the channel's own name (its path). A channel with no
+ * `realtime_server` (e.g. a pre-server export) simply isn't in the map, and
+ * callers fall back accordingly.
+ */
+export function buildChannelServerResolver(documents) {
+    const channelToServer = new Map();
+    for (const doc of documents) {
+        if (doc.type === 'channel' && doc.server) {
+            channelToServer.set(doc.name, doc.server);
+        }
+    }
+    return (channelName) => channelToServer.get(channelName);
+}
+/**
+ * Sanitize a document name for use as a single on-disk filename segment.
+ * Strips quotes and snake_cases the rest. Mirrors the per-command
+ * `sanitizeFilename` the pull commands used to each define privately.
+ */
+export function sanitizeDocumentName(name, snakeCaseFn) {
+    return snakeCaseFn(name.replaceAll('"', ''));
+}
+/**
+ * Resolve where a parsed document lands on disk — the SINGLE source of truth for
+ * the pull layout, shared by every pull command (workspace, tenant, release,
+ * sandbox, ephemeral). Previously each command inlined a ~130-line copy of this
+ * decision; the copies drifted (the realtime v2 realtime_server/channel/message
+ * branches existed only in workspace/tenant), so an ephemeral pull dumped v2
+ * objects into flat top-level channel/, message/ and realtime_server/ folders —
+ * detaching messages from their channels and risking name collisions (message
+ * names are unique only WITHIN a channel).
+ *
+ * @param doc - the parsed document
+ * @param outputDir - the resolved pull output root
+ * @param deps - injected dependencies
+ * @param deps.getApiGroupFolder - resolves an api_group name to its unique folder
+ * @param deps.getChannelServer - resolves a v2 channel path to its owning realtime_server
+ * @param deps.join - the path.join implementation (injectable for testing)
+ * @param deps.snakeCase - the snakeCase implementation the caller uses
+ */
+export function resolveDocumentPath(doc, outputDir, deps) {
+    const { getApiGroupFolder, getChannelServer, join, snakeCase } = deps;
+    const sanitize = (name) => sanitizeDocumentName(name, snakeCase);
+    if (doc.type === 'policy') {
+        // policy → policies/{key}.xs (the key is validated, never snake_cased)
+        return { baseName: policyBaseName(doc.name), typeDir: join(outputDir, 'policies') };
+    }
+    if (doc.type === 'workspace') {
+        // workspace → workspace/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'workspace') };
+    }
+    if (doc.type === 'workspace_trigger' || doc.type === 'error_trigger') {
+        // workspace_trigger / error_trigger → workspace/trigger/{name}.xs
+        // (error_trigger is a singleton, colocated with workspace triggers)
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'workspace', 'trigger') };
+    }
+    if (doc.type === 'agent') {
+        // agent → ai/agent/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'ai', 'agent') };
+    }
+    if (doc.type === 'mcp_server') {
+        // mcp_server → ai/mcp_server/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'ai', 'mcp_server') };
+    }
+    if (doc.type === 'tool') {
+        // tool → ai/tool/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'ai', 'tool') };
+    }
+    if (doc.type === 'agent_trigger') {
+        // agent_trigger → ai/agent/trigger/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'ai', 'agent', 'trigger') };
+    }
+    if (doc.type === 'mcp_server_trigger') {
+        // mcp_server_trigger → ai/mcp_server/trigger/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'ai', 'mcp_server', 'trigger') };
+    }
+    if (doc.type === 'table_trigger') {
+        // table_trigger → table/trigger/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'table', 'trigger') };
+    }
+    if (doc.type === 'realtime_channel') {
+        // Realtime v1: realtime_channel → realtime/channel/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'realtime', 'channel') };
+    }
+    if (doc.type === 'realtime_trigger') {
+        // Realtime v1: realtime_trigger → realtime/trigger/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'realtime', 'trigger') };
+    }
+    if (doc.type === 'realtime_server_trigger') {
+        // Realtime v2. A realtime_server's connect/disconnect trigger. It references its
+        // owning server by name via `realtime_server = "..."`, so it nests under that
+        // server's folder as `<server>/trigger/`, mirroring how the server's own document
+        // and its channels already nest under realtime/server/<server>/ (DEV-7712). Keeping
+        // it there means every realtime document stays under realtime/ instead of landing at
+        // the output root. A server-less doc (a malformed/legacy export) falls back to a flat
+        // realtime/server_trigger/ under realtime/ rather than the repo root.
+        return {
+            baseName: sanitize(doc.name),
+            typeDir: doc.server
+                ? join(outputDir, 'realtime', 'server', sanitize(doc.server), 'trigger')
+                : join(outputDir, 'realtime', 'server_trigger'),
+        };
+    }
+    if (doc.type === 'channel_trigger') {
+        // Realtime v2. A channel's join/leave/deliver trigger. It references BOTH its owning
+        // server (`realtime_server = "..."`) and its channel (`channel = "..."`), so it nests
+        // beside that channel as `<server>/channel/<channel>/trigger/` — the same path the
+        // channel's own document and messages already use (DEV-7712). Falls back gracefully:
+        // channel but no resolvable server → the legacy flat channel/<path>/trigger/ layout;
+        // neither → realtime/channel_trigger/ under realtime/ (never the output root).
+        if (doc.server && doc.channel) {
+            return {
+                baseName: sanitize(doc.name),
+                typeDir: join(outputDir, 'realtime', 'server', sanitize(doc.server), 'channel', snakeCase(doc.channel), 'trigger'),
+            };
+        }
+        if (doc.channel) {
+            return {
+                baseName: sanitize(doc.name),
+                typeDir: join(outputDir, 'channel', ...channelPathSegments(doc.channel, snakeCase), 'trigger'),
+            };
+        }
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'realtime', 'channel_trigger') };
+    }
+    if (doc.type === 'realtime_server') {
+        // Realtime v2. The realtime_server is the top-level container that owns
+        // channels (which own messages). Its own document is named after itself
+        // inside its name directory, mirroring api_group (api/<group>/<group>.xs).
+        //   realtime_server "chat" → realtime/server/chat/chat.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'realtime', 'server', sanitize(doc.name)) };
+    }
+    if (doc.type === 'channel') {
+        // Realtime v2. The channel owns a directory named after itself (the full
+        // channel name, snake_cased into a single flat segment), and its messages
+        // live in a message/ subfolder inside it. It nests under its owning
+        // realtime_server (from `realtime_server = "..."`):
+        //   channel "rooms/{room_id}" (server "chat")
+        //     → realtime/server/chat/channel/rooms_room_id/rooms_room_id.xs
+        //
+        // A channel with no resolvable server (e.g. a pre-server export) falls back
+        // to the legacy flat channel/<path>/_channel.xs layout.
+        if (doc.server) {
+            return {
+                baseName: snakeCase(doc.name),
+                typeDir: join(outputDir, 'realtime', 'server', sanitize(doc.server), 'channel', snakeCase(doc.name)),
+            };
+        }
+        return { baseName: '_channel', typeDir: join(outputDir, 'channel', ...channelPathSegments(doc.name, snakeCase)) };
+    }
+    if (doc.type === 'message' && doc.channel) {
+        // Realtime v2 message → nests in a message/ subfolder under its channel,
+        // under that channel's server (resolved via the two-pass channel→server map).
+        //   message "post" on channel "rooms/{room_id}" (server "chat")
+        //     → realtime/server/chat/channel/rooms_room_id/message/post.xs
+        //
+        // Nesting matters beyond tidiness: message names are unique only WITHIN a
+        // channel, so a flat message/ directory would collide when two channels
+        // both define e.g. "say". A channel whose server can't be resolved falls
+        // back to the legacy flat channel/ layout.
+        const messageServer = getChannelServer(doc.channel);
+        return {
+            baseName: sanitize(doc.name),
+            typeDir: messageServer
+                ? join(outputDir, 'realtime', 'server', sanitize(messageServer), 'channel', snakeCase(doc.channel), 'message')
+                : join(outputDir, 'channel', ...channelPathSegments(doc.channel, snakeCase)),
+        };
+    }
+    if (doc.type === 'api_group') {
+        // api_group "test" → api/{resolved_folder}/{name}.xs
+        return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'api', getApiGroupFolder(doc.name)) };
+    }
+    if (doc.type === 'query' && doc.apiGroup) {
+        // query in group "test" → api/{resolved_folder}/{folders}/{query_name}[_verb].xs
+        const groupFolder = getApiGroupFolder(doc.apiGroup);
+        const nameParts = doc.name.split('/');
+        const leafName = nameParts.pop();
+        const folderParts = nameParts.map((part) => snakeCase(part));
+        const baseName = sanitize(leafName);
+        return {
+            baseName: doc.verb ? `${baseName}_${doc.verb}` : baseName,
+            typeDir: join(outputDir, 'api', groupFolder, ...folderParts),
+        };
+    }
+    // Default: split folder path from name
+    const nameParts = doc.name.split('/');
+    const leafName = nameParts.pop();
+    const folderParts = nameParts.map((part) => snakeCase(part));
+    const baseName = sanitize(leafName);
+    return {
+        baseName: doc.verb ? `${baseName}_${doc.verb}` : baseName,
+        typeDir: join(outputDir, doc.type, ...folderParts),
+    };
 }
 /**
  * Build a unique key for a document based on its type, name, verb, and api_group.
@@ -101,9 +371,7 @@ export function buildApiGroupFolderResolver(documents, snakeCaseFn) {
             apiGroupFolderMap.set(names[i], `${folder}_${i + 1}`);
         }
     }
-    return (groupName) => {
-        return apiGroupFolderMap.get(groupName) ?? snakeCaseFn(groupName);
-    };
+    return (groupName) => apiGroupFolderMap.get(groupName) ?? snakeCaseFn(groupName);
 }
 /**
  * Find local .xs files that contain a specific GUID.
@@ -112,3 +380,63 @@ export function buildApiGroupFolderResolver(documents, snakeCaseFn) {
 export function findFilesWithGuid(entries, guid) {
     return entries.filter((e) => e.content.includes(guid)).map((e) => e.filePath);
 }
+/**
+ * Split a multi-document XanoScript blob (documents joined by `\n---\n`) into
+ * parsed documents, skipping empties and any fragment that fails to parse.
+ *
+ * This is the same split the pull commands apply to the server's multidoc
+ * response. A hand-authored bundle is one file of many `---`-separated
+ * documents; this turns it back into the per-document units every downstream
+ * step (placement, GUID writeback, partial-diff matching) assumes.
+ */
+export function splitMultidoc(blob) {
+    const documents = [];
+    for (const raw of blob.split('\n---\n')) {
+        const trimmed = raw.trim();
+        if (!trimmed)
+            continue;
+        const parsed = parseDocument(trimmed);
+        if (parsed)
+            documents.push(parsed);
+    }
+    return documents;
+}
+/**
+ * Compute where each document lands on disk — a PURE function (no filesystem)
+ * mirroring the split-and-place loop the pull commands run. It resolves each
+ * document via `resolveDocumentPath`, appends `.xs`, and disambiguates
+ * collisions within a directory with a `_N` suffix (the second file named
+ * `say.xs` in a dir becomes `say_2.xs`), exactly as the pull writer does.
+ *
+ * Kept filesystem-free so it can be unit-tested and reused by both the pull
+ * commands and `flatten` without duplicating the placement rules.
+ */
+export function placeDocuments(documents, deps) {
+    const { join, relative, snakeCase } = deps;
+    const getApiGroupFolder = buildApiGroupFolderResolver(documents, snakeCase);
+    const getChannelServer = buildChannelServerResolver(documents);
+    // Per-directory filename counters, so duplicate leaf names get a _N suffix.
+    const filenameCounters = new Map();
+    const placed = [];
+    for (const doc of documents) {
+        const { baseName, typeDir } = resolveDocumentPath(doc, '', {
+            getApiGroupFolder,
+            getChannelServer,
+            join,
+            snakeCase,
+        });
+        const dirKey = typeDir;
+        if (!filenameCounters.has(dirKey))
+            filenameCounters.set(dirKey, new Map());
+        const typeCounters = filenameCounters.get(dirKey);
+        const count = typeCounters.get(baseName) || 0;
+        typeCounters.set(baseName, count + 1);
+        const filename = count === 0 ? `${baseName}.xs` : `${baseName}_${count + 1}.xs`;
+        const abs = join(typeDir, filename);
+        // typeDir was built off an empty root, so `abs` is already root-relative;
+        // normalize any leading separator via relative() for a clean POSIX path.
+        const relPath = relative('', abs);
+        placed.push({ content: doc.content, relPath });
+    }
+    return placed;
+}

package/dist/utils/flatten.d.ts

@@ -0,0 +1,36 @@
+/** Outcome of flattening one bundle file. */
+export interface FlattenResult {
+    /** True when the original bundle was removed. */
+    removedSource: boolean;
+    /** Why the file was skipped, if it was (empty / single-document). */
+    skipped?: 'empty' | 'single';
+    /** Absolute paths written (or that would be written, in dry-run). */
+    written: string[];
+}
+export interface FlattenOptions {
+    /** Preview only — compute the plan and write nothing, delete nothing. */
+    dryRun?: boolean;
+    /** Overwrite existing destination files instead of throwing on a clash. */
+    force?: boolean;
+    /** Keep the original bundle file (default: delete after a successful split). */
+    keepSource?: boolean;
+    /** Optional line logger (e.g. command.log) for a per-file plan. */
+    log?: (msg: string) => void;
+    /** Output root (default: the bundle file's own directory). */
+    outputDir?: string;
+}
+/**
+ * Split ONE multi-document `.xs` bundle (documents joined by `---`) into the
+ * standard per-document tree — the exact layout `pull` produces — using the
+ * shared `placeDocuments` placement so the two never drift.
+ *
+ * Filesystem-touching, but self-contained: it reads the bundle, resolves every
+ * document's destination, checks for collisions, writes, and (unless
+ * `keepSource`) removes the original. Throws on a destination collision when
+ * `force` is not set, and never deletes the source when a written document
+ * landed on the source's own path.
+ *
+ * Shared by the `flatten` command and the push-time prompt, so a user who
+ * confirms "flatten now?" gets byte-identical output to running `xano flatten`.
+ */
+export declare function flattenBundleFile(bundleFile: string, opts?: FlattenOptions): FlattenResult;