@xano/cli 1.3.1-beta.0 → 1.3.1

package/dist/commands/workspace/push/index.js

@@ -2,28 +2,7 @@ import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
 import { resolve } from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { parseDocument } from '../../../utils/document-parser.js';
-import { executePush, FailedAfterImportError, } from '../../../utils/multidoc-push.js';
-import { policyCodeGuidance } from '../../../utils/policy/errors.js';
-import { policiesSkippedNotice, policyCheckWarning, policyDocumentSummary, policyExitCode, policySummary, pushEvidence, } from '../../../utils/policy/feedback.js';
-import { BLANK_POLICY_OVERRIDE, blankPolicyOverride } from '../../../utils/policy/gate.js';
-import { policyFilePushGuidance } from '../../../utils/policy/permission.js';
-import { PushPolicyGateError } from '../../../utils/policy/push-gate.js';
-/** The `-o json` document for a push whose import ran: the import response and what was sent. */
-function importDocument(result) {
-    return { ...result.response, documents: result.sent.length, imported: true, knowledge: result.knowledge };
-}
-/** The policy check the import answered with, if any. */
-function policyCheck(result) {
-    return result.response?.policy_check;
-}
-/**
- * The platform's one notice that it left the push's policy files out (the Policies feature is off):
- * the import's, else its preview's, since a partial push may not send the files the preview named.
- */
-function policiesSkipped(result) {
-    return policiesSkippedNotice(result.response) ?? policiesSkippedNotice(result.preview);
-}
+import { executePush } from '../../../utils/multidoc-push.js';
 export default class Push extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS run --dry-run first and show the user the output before pushing. Push local documents to a workspace. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only.';
     static examples = [
@@ -77,9 +56,6 @@ Push functions but exclude test files
 `,
         `$ xano workspace push -i "knowledge/**"
 Push only knowledge files (agents.md / skills / docs)
-`,
-        `$ xano workspace push -m "Tightened the auth policies"
-Label the Version History entry of each policy this push changes; other objects get no message
 `,
         `$ xano workspace push --sync --delete
 Full sync including knowledge files; removes server objects not present locally
@@ -89,7 +65,7 @@ Full sync including knowledge files; removes server objects not present locally
         ...BaseCommand.baseFlags,
         branch: Flags.string({
             char: 'b',
-            description: "Branch name (defaults to profile branch or live; -b '' selects live)",
+            description: 'Branch name (optional if set in profile, defaults to live)',
             required: false,
         }),
         delete: Flags.boolean({
@@ -136,19 +112,6 @@ Full sync including knowledge files; removes server objects not present locally
             multiple: true,
             required: false,
         }),
-        message: Flags.string({
-            char: 'm',
-            description: 'Labels the Version History entry of each policy this push changes; other objects get no message',
-            required: false,
-        }),
-        output: Flags.string({
-            char: 'o',
-            default: 'summary',
-            description: 'Output format; JSON retains the complete import and policy feedback',
-            options: ['summary', 'json'],
-            required: false,
-        }),
-        'policy-override': Flags.string({ description: 'Override a blocking live-branch policy gate with an audited reason (requires workspace:policy update)' }),
         records: Flags.boolean({
             default: false,
             description: '[CRITICAL] STOP and ALWAYS run --dry-run first to show the user a preview before pushing live table records. Includes table records in import.',
@@ -176,20 +139,8 @@ Full sync including knowledge files; removes server objects not present locally
             required: false,
         }),
     };
-    async catch(error) {
-        if (error instanceof PushPolicyGateError) {
-            if (this.isJsonOutput())
-                this.log(JSON.stringify({ imported: false, refused: error.payload }, null, 2));
-            this.error(error.message, { exit: 2 });
-        }
-        if (error instanceof FailedAfterImportError)
-            return this.catchAfterImport(error);
-        return this.catchAsOperational(error);
-    }
     async run() {
         const { flags } = await this.parse(Push);
-        if (blankPolicyOverride(flags['policy-override']))
-            this.error(BLANK_POLICY_OVERRIDE);
         const { profile, profileName } = this.resolveProfile(flags);
         // Determine workspace_id from flag or profile
         let workspaceId;
@@ -211,23 +162,12 @@ Full sync including knowledge files; removes server objects not present locally
         if (!fs.statSync(inputDir).isDirectory()) {
             this.error(`Not a directory: ${inputDir}`);
         }
-        const branch = flags.branch ?? profile.branch ?? '';
+        const branch = flags.branch || profile.branch || '';
         const baseUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}`;
-        const json = flags.output === 'json';
-        // Only the import writes Version History entries, so only the import carries the message.
-        const message = flags.message?.trim();
         const target = {
             buildDryRunUrl: (params) => `${baseUrl}/multidoc/dry-run?${params.toString()}`,
-            buildPushUrl(params) {
-                const query = new URLSearchParams(params);
-                if (message)
-                    query.set('message', message);
-                if (flags['policy-override']?.trim())
-                    query.set('override_reason', flags['policy-override'].trim());
-                return `${baseUrl}/multidoc?${query.toString()}`;
-            },
+            buildPushUrl: (params) => `${baseUrl}/multidoc?${params.toString()}`,
             cliVersion: this.config.version,
-            explainRefusal: (status, payload) => (status === 403 ? policyFilePushGuidance(payload) : policyCodeGuidance(payload) || undefined),
             instanceOrigin: profile.instance_origin,
             label: `workspace ${workspaceId}`,
             supportsBranches: true,
@@ -247,7 +187,7 @@ Full sync including knowledge files; removes server objects not present locally
             truncate: flags.truncate,
             verbose: flags.verbose,
         };
-        const result = await executePush({
+        await executePush({
             accessToken: profile.access_token,
             branch,
             command: this,
@@ -256,66 +196,7 @@ Full sync including knowledge files; removes server objects not present locally
                 listUrl: () => `${baseUrl}/knowledge/sync`,
                 rootDir: inputDir,
             },
-            // Under `-o json` stdout carries one JSON document, so progress goes to stderr.
-            log: json ? this.logToStderr.bind(this) : undefined,
             verboseFetch: this.verboseFetch.bind(this),
         }, target, pushFlags);
-        if (json) {
-            this.log(JSON.stringify(result.stopped
-                ? { imported: false, preview: result.preview, reason: result.stopped }
-                : importDocument(result), null, 2));
-        }
-        // Policy feedback describes the multidoc import, so a push that imported none has none. Its
-        // preview may still say that the policy files are left out.
-        if (result.response) {
-            this.reportPolicyFeedback(result, json);
-        }
-        else {
-            const skipped = policiesSkipped(result);
-            if (skipped)
-                this.warn(skipped);
-        }
-    }
-    /**
-     * A failure after the import landed. The import stands, so its policy feedback is reported as for
-     * any push and a blocking finding still exits 2; otherwise the failure exits 1. Under `-o json`
-     * stdout holds the import's document with the failure as `error`.
-     */
-    catchAfterImport(error) {
-        const json = this.isJsonOutput();
-        const exit = policyExitCode(policyCheck(error.imported)) || 1;
-        if (json)
-            this.log(JSON.stringify({ ...importDocument(error.imported), error: { exit, message: error.message } }, null, 2));
-        this.reportPolicyFeedback(error.imported, json);
-        this.error(error, { exit });
-    }
-    /**
-     * What happened to the policy documents, then the policy check the import answered with. When the
-     * platform left the policy files out, its notice says so instead of a count of what was sent.
-     */
-    reportPolicyFeedback(result, json) {
-        const check = policyCheck(result);
-        const skipped = policiesSkipped(result);
-        if (skipped)
-            this.warn(skipped);
-        if (!json) {
-            if (!skipped) {
-                const sentPolicies = result.sent.filter((entry) => parseDocument(entry.content)?.type === 'policy').length;
-                for (const line of policyDocumentSummary(result.preview, sentPolicies))
-                    this.log(line);
-            }
-            for (const line of policySummary(check, pushEvidence(check)))
-                this.log(line);
-        }
-        const warning = policyCheckWarning(check);
-        if (warning)
-            this.warn(warning);
-        const code = policyExitCode(check);
-        if (code) {
-            process.exitCode = code;
-            if (!json)
-                this.log('Next: `xano policy status --run-detail` for the current standing, or `xano policy runs` for this run.');
-            this.warn('Workspace import completed with blocking policy findings; the imported changes were not rolled back.');
-        }
     }
 }

package/dist/utils/document-parser.d.ts

@@ -11,16 +11,6 @@ export interface ParsedDocument {
     type: string;
     verb?: string;
 }
-/**
- * The platform's policy key pattern, kept offline for file names. A command that already holds the
- * catalogue validates a key against the catalogue's `document.key.pattern` instead.
- */
-export declare const POLICY_KEY_PATTERN: RegExp;
-/**
- * The file name, without `.xs`, for a policy key. The pattern is the platform's own key pattern, so a
- * key from the server can never name a path outside `policies/`.
- */
-export declare function policyBaseName(key: string): string;
 /**
  * Parse a single XanoScript document to extract its type, name, and optional verb/api_group.
  * Skips leading comment lines (starting with //) to find the first meaningful line.

package/dist/utils/document-parser.js

@@ -1,17 +1,3 @@
-/**
- * The platform's policy key pattern, kept offline for file names. A command that already holds the
- * catalogue validates a key against the catalogue's `document.key.pattern` instead.
- */
-export const POLICY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
-/**
- * The file name, without `.xs`, for a policy key. The pattern is the platform's own key pattern, so a
- * key from the server can never name a path outside `policies/`.
- */
-export function policyBaseName(key) {
-    if (!POLICY_KEY_PATTERN.test(key))
-        throw new Error(`Invalid policy key: ${key}`);
-    return key;
-}
 /**
  * Parse a single XanoScript document to extract its type, name, and optional verb/api_group.
  * Skips leading comment lines (starting with //) to find the first meaningful line.
@@ -47,9 +33,6 @@ export function parseDocument(content) {
     if (name.startsWith('"') && name.endsWith('"')) {
         name = name.slice(1, -1);
     }
-    // Policy bodies are opaque. Prose/parameters may mention guid or api_group; these are not document identity.
-    if (type === 'policy')
-        return { content, name, type };
     // Extract verb if present (e.g., verb=GET)
     let verb;
     const verbMatch = rest.match(/verb=(\S+)/);
@@ -179,10 +162,6 @@ export function sanitizeDocumentName(name, snakeCaseFn) {
 export function resolveDocumentPath(doc, outputDir, deps) {
     const { getApiGroupFolder, getChannelServer, join, snakeCase } = deps;
     const sanitize = (name) => sanitizeDocumentName(name, snakeCase);
-    if (doc.type === 'policy') {
-        // policy → policies/{key}.xs (the key is validated, never snake_cased)
-        return { baseName: policyBaseName(doc.name), typeDir: join(outputDir, 'policies') };
-    }
     if (doc.type === 'workspace') {
         // workspace → workspace/{name}.xs
         return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'workspace') };

package/dist/utils/multidoc-push.d.ts

@@ -1,4 +1,4 @@
-import { Command, Errors } from '@oclif/core';
+import { Command } from '@oclif/core';
 import { type BadIndex, type BadReference } from './reference-checker.js';
 export interface PushFlags {
     delete: boolean;
@@ -21,11 +21,6 @@ export interface PushTarget {
     buildPushUrl: (queryParams: URLSearchParams) => string;
     /** CLI version string */
     cliVersion: string;
-    /**
-     * Guidance for a refusal this target recognises, given the HTTP status and the server's payload.
-     * A preview or import refused that way stops with the message and this guidance appended.
-     */
-    explainRefusal?: (status: number, payload: unknown) => string | undefined;
     /** Instance origin URL (e.g., "https://x123-abcd-1234.xano.io") */
     instanceOrigin: string;
     /** Human-readable label for log messages (e.g., "sandbox environment", "workspace 40") */
@@ -59,56 +54,8 @@ export interface PushContext {
     inputDir: string;
     /** Optional knowledge sync config. Only workspace push sets this. */
     knowledge?: KnowledgeConfig;
-    /** Where progress and diagnostics go; defaults to the command's stdout. */
-    log?: (message: string) => void;
     verboseFetch: (url: string, options: RequestInit, verbose: boolean, authToken?: string) => Promise<Response>;
 }
-export interface DryRunSummary {
-    created: number;
-    deleted: number;
-    truncated: number;
-    unchanged: number;
-    updated: number;
-}
-export interface DryRunOperation {
-    action: string;
-    details: string;
-    name: string;
-    reason?: string;
-    type: string;
-}
-export interface DryRunResult {
-    operations: DryRunOperation[];
-    /** True when the sandbox currently holds a different source workspace than the one being pushed. */
-    source_workspace_mismatch?: boolean;
-    summary: Record<string, DryRunSummary>;
-    workspace_name?: string;
-}
-/** What a push did, for the calling command to report. */
-export interface PushResult {
-    knowledge: {
-        deleted: number;
-        imported: number;
-    };
-    preview: DryRunResult | null;
-    /** The multidoc import's response body; absent when no multidoc was imported. */
-    response?: Record<string, unknown>;
-    /** The documents the multidoc import carried. */
-    sent: Array<{
-        content: string;
-        filePath: string;
-    }>;
-    /** Why the push stopped before writing anything, when it did. */
-    stopped?: 'blocked' | 'cancelled' | 'dry-run' | 'no-changes';
-}
-/**
- * A push that failed after its multidoc import landed. The import is not rolled back, so the error
- * carries what it did for the calling command to report beside the failure.
- */
-export declare class FailedAfterImportError extends Errors.CLIError {
-    readonly imported: PushResult;
-    constructor(message: string, imported: PushResult);
-}
 /**
  * Filter document entries down to the ones the dry-run preview reports as changed,
  * used to send only the changed documents during a partial (non-`--sync`) push.
@@ -245,7 +192,7 @@ export declare function confirm(message: string): Promise<boolean>;
  * Execute a multidoc push with preview, validation, partial mode, and GUID sync.
  * Shared by both sandbox:push and workspace:push commands.
  */
-export declare function executePush(ctx: PushContext, target: PushTarget, flags: PushFlags): Promise<PushResult>;
+export declare function executePush(ctx: PushContext, target: PushTarget, flags: PushFlags): Promise<void>;
 /**
  * Turn a thrown fetch/network error into an actionable message.
  *

package/dist/utils/multidoc-push.js

@@ -1,24 +1,11 @@
-import { Errors, ux } from '@oclif/core';
+import { ux } from '@oclif/core';
 import { minimatch } from 'minimatch';
 import * as fs from 'node:fs';
 import { join, relative } from 'node:path';
 import { buildDocumentKey, findFilesWithGuid, parseDocument } from './document-parser.js';
 import { flattenBundleFile } from './flatten.js';
 import { collectKnowledgeObjects, fetchKnowledge, knowledgePreview, pushKnowledge, syncGuidToFrontmatter, toPushItems, } from './knowledge-sync.js';
-import { policyWeakeningGuidance, WEAKENING_REFUSAL } from './policy/permission.js';
-import { PushPolicyGateError } from './policy/push-gate.js';
 import { checkReferences, checkTableIndexes } from './reference-checker.js';
-/**
- * A push that failed after its multidoc import landed. The import is not rolled back, so the error
- * carries what it did for the calling command to report beside the failure.
- */
-export class FailedAfterImportError extends Errors.CLIError {
-    imported;
-    constructor(message, imported) {
-        super(message);
-        this.imported = imported;
-    }
-}
 /**
  * Filter document entries down to the ones the dry-run preview reports as changed,
  * used to send only the changed documents during a partial (non-`--sync`) push.
@@ -592,9 +579,7 @@ function mergeKnowledgePreview(preview, knowledge) {
  */
 export async function executePush(ctx, target, flags) {
     const { accessToken, command, inputDir, verboseFetch } = ctx;
-    const log = ctx.log ?? command.log.bind(command);
-    let dryRunPreview = null;
-    const stop = (stopped) => ({ knowledge: { deleted: 0, imported: 0 }, preview: dryRunPreview, sent: [], stopped });
+    const log = command.log.bind(command);
     // ── Collect knowledge entries (before file check so knowledge-only push works) ─
     let knowledgeObjects = [];
     if (ctx.knowledge) {
@@ -653,7 +638,7 @@ export async function executePush(ctx, target, flags) {
                 const doFlatten = await confirm('Flatten these file(s) in place and continue the push?');
                 if (!doFlatten) {
                     log('Push cancelled. Run `xano flatten <file>` yourself, or re-run to be prompted again.');
-                    return stop('cancelled');
+                    return;
                 }
             }
             else {
@@ -756,6 +741,7 @@ export async function executePush(ctx, target, flags) {
         'Content-Type': 'text/x-xanoscript',
     };
     // ── Dry-run / Preview ─────────────────────────────────────────────────
+    let dryRunPreview = null;
     const dryRunUrl = knowledgeOnly ? null : target.buildDryRunUrl(queryParams);
     if (dryRunUrl && (flags['dry-run'] || !flags.force)) {
         const dryRunParams = new URLSearchParams(queryParams);
@@ -847,7 +833,7 @@ export async function executePush(ctx, target, flags) {
                         log('');
                         log(ux.colorize('red', `Push blocked: ${criticalOps.length} critical error(s) found.`));
                         if (!flags.force) {
-                            return stop('blocked');
+                            return;
                         }
                         log(ux.colorize('yellow', 'Proceeding anyway due to --force flag.'));
                     }
@@ -877,10 +863,10 @@ export async function executePush(ctx, target, flags) {
                     if (!hasChanges && !hasLocalRecords) {
                         log('');
                         log('No changes to push.');
-                        return stop('no-changes');
+                        return;
                     }
                     if (flags['dry-run']) {
-                        return stop('dry-run');
+                        return;
                     }
                     // Warn when the sandbox currently holds a different source workspace than the one being
                     // pushed. The backend compares the source workspace id we sent against the id stored on
@@ -898,7 +884,7 @@ export async function executePush(ctx, target, flags) {
                             const proceed = await confirm('Continue with push anyway?');
                             if (!proceed) {
                                 log('Push cancelled. Run `xano sandbox reset` then retry.');
-                                return stop('cancelled');
+                                return;
                             }
                             mismatchConfirmed = true;
                         }
@@ -919,7 +905,7 @@ export async function executePush(ctx, target, flags) {
                             const confirmed = await confirm(message);
                             if (!confirmed) {
                                 log('Push cancelled.');
-                                return stop('cancelled');
+                                return;
                             }
                         }
                         else {
@@ -936,17 +922,15 @@ export async function executePush(ctx, target, flags) {
                 }
             }
             else {
-                await handleDryRunError(dryRunResponse, command, target, { log, verbose: flags.verbose });
+                await handleDryRunError(dryRunResponse, command, flags, target);
                 // If we get here, the user confirmed to proceed without preview
             }
         }
         catch (error) {
             // Ctrl+C or SIGINT
-            if (error instanceof PushPolicyGateError)
-                throw error;
             if (error.name === 'AbortError' || error.code === 'ERR_USE_AFTER_CLOSE') {
                 log('\nPush cancelled.');
-                return stop('cancelled');
+                return;
             }
             // Re-throw oclif errors
             if (error instanceof Error && 'oclif' in error) {
@@ -977,16 +961,16 @@ export async function executePush(ctx, target, flags) {
         if (!hasChanges) {
             log('');
             log('No changes to push.');
-            return stop('no-changes');
+            return;
         }
         if (flags['dry-run']) {
-            return stop('dry-run');
+            return;
         }
         if (process.stdin.isTTY) {
             const confirmed = await confirm('Proceed with push?');
             if (!confirmed) {
                 log('Push cancelled.');
-                return stop('cancelled');
+                return;
             }
         }
         else {
@@ -1002,19 +986,17 @@ export async function executePush(ctx, target, flags) {
         }
     }
     // ── Partial push: filter to changed documents only ────────────────────
-    let sent = documentEntries;
     if (!knowledgeOnly && isPartial && dryRunPreview) {
-        sent = filterChangedEntries(documentEntries, dryRunPreview.operations, flags.records);
-        if (sent.length === 0 && knowledgeObjects.length === 0) {
+        const filteredEntries = filterChangedEntries(documentEntries, dryRunPreview.operations, flags.records);
+        if (filteredEntries.length === 0 && knowledgeObjects.length === 0) {
             log('No changes to push.');
-            return stop('no-changes');
+            return;
         }
-        multidoc = sent.map((d) => d.content).join('\n---\n');
+        multidoc = filteredEntries.length > 0 ? filteredEntries.map((d) => d.content).join('\n---\n') : '';
     }
     // ── Execute the actual push ───────────────────────────────────────────
     const startTime = Date.now();
     let pushedDocCount = 0;
-    let pushResponse;
     if (!knowledgeOnly && multidoc) {
         const apiUrl = target.buildPushUrl(queryParams);
         try {
@@ -1024,19 +1006,14 @@ export async function executePush(ctx, target, flags) {
                 method: 'POST',
             }, flags.verbose, accessToken);
             if (!response.ok) {
-                const errorText = await response.text();
-                refuseIfExplained(command, target, response.status, errorText);
-                handlePushError(response, errorText, documentEntries, inputDir, command);
+                handlePushError(response, await response.text(), documentEntries, inputDir, command);
             }
             // Parse response for GUID map
             const responseText = await response.text();
             let guidMap = [];
-            pushResponse = {};
             if (responseText && responseText !== 'null') {
                 try {
                     const responseJson = JSON.parse(responseText);
-                    if (responseJson && typeof responseJson === 'object')
-                        pushResponse = responseJson;
                     if (responseJson?.guid_map && Array.isArray(responseJson.guid_map)) {
                         guidMap = responseJson.guid_map;
                     }
@@ -1062,7 +1039,7 @@ export async function executePush(ctx, target, flags) {
                 let updatedCount = 0;
                 let canonicalCount = 0;
                 for (const entry of guidMap) {
-                    if (!entry.guid || entry.type === 'policy')
+                    if (!entry.guid)
                         continue;
                     const key = buildDocumentKey(entry.type, entry.name, entry.verb, entry.api_group);
                     let filePath = documentFileMap.get(key);
@@ -1108,8 +1085,6 @@ export async function executePush(ctx, target, flags) {
             pushedDocCount = multidoc.split('\n---\n').length;
         }
         catch (error) {
-            if (error instanceof PushPolicyGateError)
-                throw error;
             if (error instanceof Error && 'oclif' in error)
                 throw error;
             const elapsedMs = Date.now() - startTime;
@@ -1119,12 +1094,6 @@ export async function executePush(ctx, target, flags) {
     // ── Push knowledge ────────────────────────────────────────────────────
     let knowledgeImported = 0;
     let knowledgeDeleted = 0;
-    const pushed = () => ({
-        knowledge: { deleted: knowledgeDeleted, imported: knowledgeImported },
-        preview: dryRunPreview,
-        response: pushResponse,
-        sent: pushResponse ? sent : [],
-    });
     if (ctx.knowledge && (knowledgeObjects.length > 0 || shouldDelete)) {
         const listUrl = ctx.knowledge.listUrl();
         try {
@@ -1162,10 +1131,7 @@ export async function executePush(ctx, target, flags) {
             if (error instanceof Error && 'oclif' in error)
                 throw error;
             const elapsedMs = Date.now() - startTime;
-            const message = `Failed to push knowledge: ${describeNetworkError(error, listUrl, elapsedMs)}`;
-            if (pushResponse)
-                throw new FailedAfterImportError(message, pushed());
-            command.error(message);
+            command.error(`Failed to push knowledge: ${describeNetworkError(error, listUrl, elapsedMs)}`);
         }
     }
     const elapsed = ((Date.now() - startTime) / 1000).toFixed(1);
@@ -1179,7 +1145,6 @@ export async function executePush(ctx, target, flags) {
         parts.push(kParts.join(', '));
     }
     log(`Pushed ${parts.join(' + ')} to ${target.label} from ${relative(process.cwd(), inputDir) || inputDir} in ${elapsed}s`);
-    return pushed();
 }
 // ── Error Handlers ──────────────────────────────────────────────────────────
 /**
@@ -1258,43 +1223,10 @@ function formatFailureDuration(elapsedMs) {
         ? ` (failed after ~${human}, near a common ${boundaries.find((b) => Math.abs(totalSeconds - b) <= b * 0.05)}s timeout — likely a server or proxy cutoff)`
         : ` (failed after ${human})`;
 }
-/** Stop with the target's own guidance when it recognises this refusal. */
-function refuseIfExplained(command, target, status, body) {
-    let message = body;
-    let payload;
-    try {
-        const parsed = JSON.parse(body);
-        if (typeof parsed?.message === 'string')
-            message = parsed.message;
-        payload = parsed?.payload;
-    }
-    catch {
-        // Not JSON
-    }
-    const refusal = payload;
-    if (status === 403 && refusal?.code === 'policy_gate')
-        throw new PushPolicyGateError(refusal);
-    // Policy files that weaken a mandatory policy of the live branch, from a credential without
-    // workspace:policy update: a permission refusal (exit 1), not a blocking finding. The platform's
-    // sentence already reads "Push refused: … Nothing was imported.", so it is printed as it is.
-    if (status === 403 && refusal?.code === WEAKENING_REFUSAL) {
-        command.error(`${message}${target.explainRefusal?.(status, payload) ?? policyWeakeningGuidance(payload, [], true)}`);
-    }
-    // The plan's policy cap: the platform's message names the plan, its cap and the remedy, and the
-    // push itself would be refused the same way, so the preview stops here rather than skipping.
-    if (status === 403 && refusal?.code === 'policy_plan_limit')
-        command.error(`Push refused (${status}): ${message}`);
-    if (refusal?.code === 'policy_gate_transaction_required') {
-        command.error('Push refused: the live branch policy gate requires a transaction. Remove --no-transaction and retry. Nothing was imported.');
-    }
-    const guidance = target.explainRefusal?.(status, payload);
-    if (guidance)
-        command.error(`Push refused (${status}): ${message}${guidance}`);
-}
-async function handleDryRunError(response, command, target, { log, verbose }) {
-    const errorText = await response.text();
-    refuseIfExplained(command, target, response.status, errorText);
+async function handleDryRunError(response, command, flags, target) {
+    const log = command.log.bind(command);
     if (response.status === 404) {
+        const errorText = await response.text();
         try {
             const errorJson = JSON.parse(errorText);
             if (errorJson.message) {
@@ -1312,6 +1244,7 @@ async function handleDryRunError(response, command, target, { log, verbose }) {
         log('');
     }
     else {
+        const errorText = await response.text();
         // Check if push is disabled
         try {
             const errorJson = JSON.parse(errorText);
@@ -1334,17 +1267,8 @@ async function handleDryRunError(response, command, target, { log, verbose }) {
         catch {
             // Not JSON, fall through
         }
-        let reason = '';
-        try {
-            const errorJson = JSON.parse(errorText);
-            if (typeof errorJson?.message === 'string' && errorJson.message.trim())
-                reason = `: ${errorJson.message.trim().replace(/\.$/, '')}`;
-        }
-        catch {
-            // Not JSON
-        }
-        command.warn(`Push preview failed (${response.status})${reason}. Skipping preview.`);
-        if (verbose) {
+        command.warn(`Push preview failed (${response.status}). Skipping preview.`);
+        if (flags.verbose) {
             log(ux.colorize('dim', errorText));
         }
     }