@xano/cli 1.3.3 → 1.3.5-beta.0

package/dist/commands/workspace/push/index.js

@@ -1,8 +1,30 @@
 import { Flags } from '@oclif/core';
 import * as fs from 'node:fs';
-import { resolve } from 'node:path';
+import { basename, relative, resolve } from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { executePush } from '../../../utils/multidoc-push.js';
+import { parseDocument } from '../../../utils/document-parser.js';
+import { formatWorkspacePushDefaultsBanner, resolvePushDefaults } from '../../../utils/local-config.js';
+import { executePush, FailedAfterImportError, } from '../../../utils/multidoc-push.js';
+import { policyCodeGuidance } from '../../../utils/policy/errors.js';
+import { isCoverageCheck, policiesSkippedNotice, policyCheckWarning, policyDocumentSummary, policyExitCode, policySummary, pushEvidence, } from '../../../utils/policy/feedback.js';
+import { BLANK_POLICY_OVERRIDE, blankPolicyOverride } from '../../../utils/policy/gate.js';
+import { policyFilePushGuidance } from '../../../utils/policy/permission.js';
+import { PushPolicyGateError } from '../../../utils/policy/push-gate.js';
+/** The `-o json` document for a push whose import ran: the import response and what was sent. */
+function importDocument(result) {
+    return { ...result.response, documents: result.sent.length, imported: true, knowledge: result.knowledge };
+}
+/** The policy check the import answered with, if any. */
+function policyCheck(result) {
+    return result.response?.policy_check;
+}
+/**
+ * The platform's one notice that it left the push's policy files out (the Policies feature is off):
+ * the import's, else its preview's, since a partial push may not send the files the preview named.
+ */
+function policiesSkipped(result) {
+    return policiesSkippedNotice(result.response) ?? policiesSkippedNotice(result.preview);
+}
 export default class Push extends BaseCommand {
     static description = '[IMPORTANT] ALWAYS run --dry-run first and show the user the output before pushing. Push local documents to a workspace. By default, only changed files are pushed (partial mode). Use --sync to push all files. Shows a preview of changes before pushing unless --force is specified. Use --dry-run to preview only.';
     static examples = [
@@ -23,6 +45,18 @@ Preview changes without pushing
 `,
         `$ xano workspace push --force
 Skip preview and push immediately (for CI/CD)
+`,
+        `$ xano workspace push --fast
+Push only files that changed since the last sync, and write .xano/sync_state.json
+`,
+        `$ xano workspace push --fast --refresh
+Re-compare local files against the server export, then push changes
+`,
+        `$ xano workspace push --no-fast
+Push without --fast even when profile.yaml sets fast: true
+`,
+        `$ xano workspace push --writeback
+Push and write server-formatted XanoScript back to local files
 `,
         `$ xano workspace push -d ./output -w 40
 Pushed 15 documents from ./output
@@ -65,7 +99,7 @@ Full sync including knowledge files; removes server objects not present locally
         ...BaseCommand.baseFlags,
         branch: Flags.string({
             char: 'b',
-            description: 'Branch name (optional if set in profile, defaults to live)',
+            description: "Branch name (defaults to profile branch or live; -b '' selects live)",
             required: false,
         }),
         delete: Flags.boolean({
@@ -95,6 +129,11 @@ Full sync including knowledge files; removes server objects not present locally
             multiple: true,
             required: false,
         }),
+        fast: Flags.boolean({
+            allowNo: true,
+            description: 'Skip files whose contents match .xano/sync_state.json, and write or update that record. Without a record, compares against the server export once. Can be set as `fast: true` in profile.yaml.',
+            required: false,
+        }),
         force: Flags.boolean({
             default: false,
             description: '[CRITICAL] NEVER run without explicit user confirmation. Skips preview and confirmation prompt (for CI/CD pipelines).',
@@ -112,11 +151,30 @@ Full sync including knowledge files; removes server objects not present locally
             multiple: true,
             required: false,
         }),
+        message: Flags.string({
+            char: 'm',
+            description: 'Labels the Version History entry of each policy this push changes; other objects get no message',
+            hidden: true,
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format; JSON retains the complete import feedback',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        'policy-override': Flags.string({ description: 'Override a blocking live-branch policy gate with an audited reason (requires workspace:policy update)', hidden: true }),
         records: Flags.boolean({
             default: false,
             description: '[CRITICAL] STOP and ALWAYS run --dry-run first to show the user a preview before pushing live table records. Includes table records in import.',
             required: false,
         }),
+        refresh: Flags.boolean({
+            default: false,
+            description: 'With --fast, re-compare local files against the server export even when a sync record exists',
+            required: false,
+        }),
         sync: Flags.boolean({
             default: false,
             description: 'Full push — send all files, not just changed ones. Required for --delete.',
@@ -138,9 +196,30 @@ Full sync including knowledge files; removes server objects not present locally
             description: 'Workspace ID (optional if set in profile)',
             required: false,
         }),
+        writeback: Flags.boolean({
+            allowNo: true,
+            description: 'After a successful push, write server-formatted XanoScript back to the files that were pushed. Can be set as `writeback: true` in profile.yaml.',
+            required: false,
+        }),
+        'writeback-diff': Flags.string({
+            description: 'With --writeback, save local vs server copies of rewritten files under this directory',
+            required: false,
+        }),
     };
+    async catch(error) {
+        if (error instanceof PushPolicyGateError) {
+            if (this.isJsonOutput())
+                this.log(JSON.stringify({ imported: false, refused: error.payload }, null, 2));
+            this.error(error.message, { exit: 2 });
+        }
+        if (error instanceof FailedAfterImportError)
+            return this.catchAfterImport(error);
+        return this.catchAsOperational(error);
+    }
     async run() {
         const { flags } = await this.parse(Push);
+        if (blankPolicyOverride(flags['policy-override']))
+            this.error(BLANK_POLICY_OVERRIDE);
         const { profile, profileName } = this.resolveProfile(flags);
         // Determine workspace_id from flag or profile
         let workspaceId;
@@ -162,12 +241,39 @@ Full sync including knowledge files; removes server objects not present locally
         if (!fs.statSync(inputDir).isDirectory()) {
             this.error(`Not a directory: ${inputDir}`);
         }
-        const branch = flags.branch || profile.branch || '';
+        const branch = flags.branch ?? profile.branch ?? '';
         const baseUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}`;
+        const json = flags.output === 'json';
+        // Only the import writes Version History entries, so only the import carries the message.
+        const message = flags.message?.trim();
+        const pushDefaults = resolvePushDefaults({
+            flagFast: flags.fast,
+            flagWriteback: flags.writeback,
+            localFast: this.localProfile?.config.fast,
+            localWriteback: this.localProfile?.config.writeback,
+            sync: flags.sync,
+        });
+        if (pushDefaults.fromLocal.length > 0 && this.localProfile) {
+            const relativePath = relative(process.cwd(), this.localProfile.path) || basename(this.localProfile.path);
+            // Under `-o json` stdout carries one JSON document, so the banner goes to stderr.
+            const banner = formatWorkspacePushDefaultsBanner(pushDefaults.fromLocal, relativePath);
+            if (json)
+                this.logToStderr(banner);
+            else
+                this.log(banner);
+        }
         const target = {
             buildDryRunUrl: (params) => `${baseUrl}/multidoc/dry-run?${params.toString()}`,
-            buildPushUrl: (params) => `${baseUrl}/multidoc?${params.toString()}`,
+            buildPushUrl(params) {
+                const query = new URLSearchParams(params);
+                if (message)
+                    query.set('message', message);
+                if (flags['policy-override']?.trim())
+                    query.set('override_reason', flags['policy-override'].trim());
+                return `${baseUrl}/multidoc?${query.toString()}`;
+            },
             cliVersion: this.config.version,
+            explainRefusal: (status, payload) => (status === 403 ? policyFilePushGuidance(payload) : policyCodeGuidance(payload) || undefined),
             instanceOrigin: profile.instance_origin,
             label: `workspace ${workspaceId}`,
             supportsBranches: true,
@@ -178,16 +284,21 @@ Full sync including knowledge files; removes server objects not present locally
             'dry-run': flags['dry-run'],
             env: flags.env,
             exclude: flags.exclude,
+            fast: pushDefaults.fast,
             force: flags.force,
             guids: flags.guids,
             include: flags.include,
             records: flags.records,
+            refresh: flags.refresh,
             sync: flags.sync,
             transaction: flags.transaction,
             truncate: flags.truncate,
             verbose: flags.verbose,
+            writeback: pushDefaults.writeback,
+            writebackDiff: flags['writeback-diff'],
+            writebackObjectLimit: this.localProfile?.config.writeback_object_limit,
         };
-        await executePush({
+        const result = await executePush({
             accessToken: profile.access_token,
             branch,
             command: this,
@@ -196,7 +307,78 @@ Full sync including knowledge files; removes server objects not present locally
                 listUrl: () => `${baseUrl}/knowledge/sync`,
                 rootDir: inputDir,
             },
+            // Under `-o json` stdout carries one JSON document, so progress goes to stderr.
+            log: json ? this.logToStderr.bind(this) : undefined,
+            syncTarget: {
+                instanceOrigin: profile.instance_origin,
+                kind: 'workspace',
+                workspace: workspaceId,
+            },
             verboseFetch: this.verboseFetch.bind(this),
         }, target, pushFlags);
+        if (json) {
+            this.log(JSON.stringify(result.stopped
+                ? { imported: false, preview: result.preview, reason: result.stopped }
+                : importDocument(result), null, 2));
+        }
+        // Policy feedback describes the multidoc import, so a push that imported none has none. Its
+        // preview may still say that the policy files are left out.
+        if (result.response) {
+            this.reportPolicyFeedback(result, json);
+        }
+        else {
+            const skipped = policiesSkipped(result);
+            if (skipped)
+                this.warn(skipped);
+        }
+    }
+    /**
+     * A failure after the import landed. The import stands, so its policy feedback is reported as for
+     * any push and a blocking finding still exits 2; otherwise the failure exits 1. Under `-o json`
+     * stdout holds the import's document with the failure as `error`.
+     */
+    catchAfterImport(error) {
+        const json = this.isJsonOutput();
+        const exit = policyExitCode(policyCheck(error.imported)) || 1;
+        if (json)
+            this.log(JSON.stringify({ ...importDocument(error.imported), error: { exit, message: error.message } }, null, 2));
+        this.reportPolicyFeedback(error.imported, json);
+        this.error(error, { exit });
+    }
+    /**
+     * What happened to the policy documents, then the policy check the import answered with. When the
+     * platform left the policy files out, its notice says so instead of a count of what was sent.
+     */
+    reportPolicyFeedback(result, json) {
+        const check = policyCheck(result);
+        const skipped = policiesSkipped(result);
+        if (skipped)
+            this.warn(skipped);
+        if (!json) {
+            if (!skipped) {
+                const sentPolicies = result.sent.filter((entry) => parseDocument(entry.content)?.type === 'policy').length;
+                for (const line of policyDocumentSummary(result.preview, sentPolicies))
+                    this.log(line);
+            }
+            for (const line of policySummary(check, pushEvidence(check)))
+                this.log(line);
+        }
+        const warning = policyCheckWarning(check);
+        if (warning && check && check.status !== 'disabled')
+            this.warn(warning);
+        const code = policyExitCode(check);
+        if (code) {
+            process.exitCode = code;
+            // A caller without workspace:policy read is told its own findings and no run, so the run reads would be refused.
+            if (!json) {
+                this.log(isCoverageCheck(check)
+                    ? ((check?.blocking_findings ?? []).length > 0
+                        ? 'Next: fix the blocking findings above, or `xano policy coverage <type>:<id>` for the policies that apply to one object.'
+                        // Blocking as a reader's push would, on objects this credential is not told about.
+                        : 'Next: the blocking findings are on objects this push did not list, which someone with workspace:policy read can see; `xano policy coverage <type>:<id>` shows the policies that apply to an object you may read.')
+                    : 'Next: `xano policy status --run-detail` for the current standing, or `xano policy runs` for this run.');
+            }
+            this.warn('Workspace import completed with blocking policy findings; the imported changes were not rolled back.');
+        }
     }
 }

package/dist/policy-command.d.ts

@@ -0,0 +1,91 @@
+import type { Policy, PolicyRun } from './utils/policy/types.js';
+import BaseCommand from './base-command.js';
+import { type PolicyRequest } from './utils/policy/request.js';
+/** One rule's warnings from the parse route: its 0-based index, id and sentences. */
+export interface RuleWarnings {
+    rule: number;
+    rule_id: string;
+    warnings: string[];
+}
+/** What the parse route answers. */
+export interface ParsedPolicy {
+    policy: Policy;
+    rule_warnings: RuleWarnings[];
+    source: string;
+}
+/** The workspace and branch a policy command acts on, and requests bound to them. */
+export interface PolicyTarget {
+    branch: string;
+    request: PolicyRequest;
+    workspace: string;
+}
+interface TargetFlags {
+    branch?: string;
+    config?: string;
+    profile?: string;
+    verbose: boolean;
+    workspace?: string;
+}
+/** Shared flags, request helper and output for the `policy *` commands and `skills pull`. */
+export default abstract class PolicyCommand extends BaseCommand {
+    static hidden: boolean;
+    static policyFlags: {
+        branch: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** `publish -m`: the message on the Version History entry the save creates. */
+    static publishFlags: {
+        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
+    /** One positional, as CLAUDE.md requires: the file `--file` would otherwise name. */
+    static sourceArgs: {
+        file: import("@oclif/core/interfaces").Arg<string | undefined, Record<string, unknown>>;
+    };
+    static sourceFlags: {
+        file: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        stdin: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** Any failure exits 1; an error that is not the CLI's own names the command it broke. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
+    /**
+     * Print each rule's warnings (a name, tag or value that makes the rule check nothing) to stderr,
+     * so piped source stays clean; nothing when there are none.
+     */
+    protected logRuleWarnings(parsed: ParsedPolicy): void;
+    /** Print a run's recorded detail, or say it evaluated no policy. */
+    protected logRunDetail(run: PolicyRun): void;
+    /**
+     * Ask the parse route for the policy, its canonical source and each rule's warnings against the
+     * target branch, from XanoScript (`{source}`) or a policy document (`{data}`); the policy and source
+     * must come back.
+     */
+    protected parseSource(request: PolicyRequest, input: {
+        data: unknown;
+    } | {
+        source: string;
+    }): Promise<ParsedPolicy>;
+    /**
+     * The workspace and branch from the flags or the profile, and a request helper bound to them for
+     * a route gated by `workspace:policy`: `/policy` unless another is named.
+     */
+    protected policyTarget(flags: TargetFlags, route?: Pick<import("./utils/policy/request.js").PolicyRequestRoute, "path" | "label">): PolicyTarget;
+    /** Policy source from the positional, `--file` or `--stdin`; a file named twice must be named the same. */
+    protected readSource(flags: {
+        file?: string;
+        stdin?: boolean;
+    }, positional?: string): string;
+    /** `workspace 3 (feature)`, or just `workspace 3` for live. */
+    protected where({ branch, workspace }: {
+        branch: string;
+        workspace: string;
+    }): string;
+}
+export {};

package/dist/policy-command.js

@@ -0,0 +1,95 @@
+import { Args, Flags } from '@oclif/core';
+import * as fs from 'node:fs';
+import BaseCommand from './base-command.js';
+import { POLICY_ROUTE, policyRequest, policyScope } from './utils/policy/request.js';
+import { policyRunDetail } from './utils/policy/runs.js';
+/** Shared flags, request helper and output for the `policy *` commands and `skills pull`. */
+export default class PolicyCommand extends BaseCommand {
+    static hidden = true;
+    static policyFlags = {
+        ...BaseCommand.baseFlags,
+        branch: Flags.string({ char: 'b', description: "Branch label (defaults to profile branch or live; -b '' selects live)" }),
+        output: Flags.string({ char: 'o', default: 'summary', description: 'Output format', options: ['summary', 'json'] }),
+        workspace: Flags.string({ char: 'w', description: 'Workspace ID (defaults to profile workspace)' }),
+    };
+    /** `publish -m`: the message on the Version History entry the save creates. */
+    static publishFlags = {
+        message: Flags.string({ char: 'm', description: 'Message stored on the Version History entry this save creates' }),
+    };
+    /** One positional, as CLAUDE.md requires: the file `--file` would otherwise name. */
+    static sourceArgs = {
+        file: Args.string({ description: 'Policy XanoScript file (same as --file)', ignoreStdin: true, required: false }),
+    };
+    static sourceFlags = {
+        file: Flags.string({ char: 'f', description: 'Policy XanoScript file', exclusive: ['stdin'] }),
+        stdin: Flags.boolean({ default: false, description: 'Read policy XanoScript from stdin', exclusive: ['file'] }),
+    };
+    /** Any failure exits 1; an error that is not the CLI's own names the command it broke. */
+    async catch(error) {
+        if ('oclif' in error)
+            return this.catchAsOperational(error);
+        const action = this.id?.split(':').at(-1) ?? 'command';
+        return this.catchAsOperational(new Error(`Policy ${action} failed: ${error.message}`));
+    }
+    /**
+     * Print each rule's warnings (a name, tag or value that makes the rule check nothing) to stderr,
+     * so piped source stays clean; nothing when there are none.
+     */
+    logRuleWarnings(parsed) {
+        const warned = parsed.rule_warnings ?? [];
+        if (warned.length === 0)
+            return;
+        this.logToStderr('Rule warnings (the rule may check nothing or everything; fix them before relying on it):');
+        for (const rule of warned) {
+            for (const warning of rule.warnings)
+                this.logToStderr(`  ${rule.rule_id || `rule[${rule.rule}]`}: ${warning}`);
+        }
+    }
+    /** Print a run's recorded detail, or say it evaluated no policy. */
+    logRunDetail(run) {
+        const detail = policyRunDetail(run);
+        for (const line of detail)
+            this.log(line);
+        if (detail.length === 0)
+            this.log(run.id ? `Run ${run.id} evaluated no policies.` : 'No policies were evaluated.');
+    }
+    /**
+     * Ask the parse route for the policy, its canonical source and each rule's warnings against the
+     * target branch, from XanoScript (`{source}`) or a policy document (`{data}`); the policy and source
+     * must come back.
+     */
+    async parseSource(request, input) {
+        const answer = (await request('/parse', 'POST', input));
+        if (!answer?.policy?.key || typeof answer.source !== 'string')
+            this.error('The platform did not return a parsed policy and canonical source.');
+        return { ...answer, rule_warnings: Array.isArray(answer.rule_warnings) ? answer.rule_warnings : [] };
+    }
+    /**
+     * The workspace and branch from the flags or the profile, and a request helper bound to them for
+     * a route gated by `workspace:policy`: `/policy` unless another is named.
+     */
+    policyTarget(flags, route = POLICY_ROUTE) {
+        const { profile } = this.resolveProfile(flags);
+        const { branch, workspace } = policyScope(flags, profile);
+        if (!workspace)
+            this.error('Workspace ID required. Use --workspace or set one in your profile.');
+        const request = policyRequest({ error: (message) => this.error(message), logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { ...route, branch, profile, verbose: flags.verbose, workspace });
+        return { branch, request, workspace };
+    }
+    /** Policy source from the positional, `--file` or `--stdin`; a file named twice must be named the same. */
+    readSource(flags, positional) {
+        const named = positional?.trim();
+        if (named && flags.stdin)
+            this.error('Provide policy source once: a file (positional or --file) or --stdin.');
+        if (named && flags.file && flags.file !== named)
+            this.error('Provide the file once: as a positional or as --file.');
+        const file = flags.file ?? named;
+        if (!file && !flags.stdin)
+            this.error('Provide the policy file (as an argument or --file) or --stdin.');
+        return fs.readFileSync(flags.stdin ? 0 : file, 'utf8');
+    }
+    /** `workspace 3 (feature)`, or just `workspace 3` for live. */
+    where({ branch, workspace }) {
+        return `workspace ${workspace}${branch ? ` (${branch})` : ''}`;
+    }
+}

package/dist/utils/document-parser.d.ts

@@ -11,6 +11,16 @@ export interface ParsedDocument {
     type: string;
     verb?: string;
 }
+/**
+ * The platform's policy key pattern, kept offline for file names. A command that already holds the
+ * catalogue validates a key against the catalogue's `document.key.pattern` instead.
+ */
+export declare const POLICY_KEY_PATTERN: RegExp;
+/**
+ * The file name, without `.xs`, for a policy key. The pattern is the platform's own key pattern, so a
+ * key from the server can never name a path outside `policies/`.
+ */
+export declare function policyBaseName(key: string): string;
 /**
  * Parse a single XanoScript document to extract its type, name, and optional verb/api_group.
  * Skips leading comment lines (starting with //) to find the first meaningful line.

package/dist/utils/document-parser.js

@@ -1,3 +1,17 @@
+/**
+ * The platform's policy key pattern, kept offline for file names. A command that already holds the
+ * catalogue validates a key against the catalogue's `document.key.pattern` instead.
+ */
+export const POLICY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+/**
+ * The file name, without `.xs`, for a policy key. The pattern is the platform's own key pattern, so a
+ * key from the server can never name a path outside `policies/`.
+ */
+export function policyBaseName(key) {
+    if (!POLICY_KEY_PATTERN.test(key))
+        throw new Error(`Invalid policy key: ${key}`);
+    return key;
+}
 /**
  * Parse a single XanoScript document to extract its type, name, and optional verb/api_group.
  * Skips leading comment lines (starting with //) to find the first meaningful line.
@@ -33,6 +47,9 @@ export function parseDocument(content) {
     if (name.startsWith('"') && name.endsWith('"')) {
         name = name.slice(1, -1);
     }
+    // Policy bodies are opaque. Prose/parameters may mention guid or api_group; these are not document identity.
+    if (type === 'policy')
+        return { content, name, type };
     // Extract verb if present (e.g., verb=GET)
     let verb;
     const verbMatch = rest.match(/verb=(\S+)/);
@@ -162,6 +179,10 @@ export function sanitizeDocumentName(name, snakeCaseFn) {
 export function resolveDocumentPath(doc, outputDir, deps) {
     const { getApiGroupFolder, getChannelServer, join, snakeCase } = deps;
     const sanitize = (name) => sanitizeDocumentName(name, snakeCase);
+    if (doc.type === 'policy') {
+        // policy → policies/{key}.xs (the key is validated, never snake_cased)
+        return { baseName: policyBaseName(doc.name), typeDir: join(outputDir, 'policies') };
+    }
     if (doc.type === 'workspace') {
         // workspace → workspace/{name}.xs
         return { baseName: sanitize(doc.name), typeDir: join(outputDir, 'workspace') };

package/dist/utils/export-compare.d.ts

@@ -0,0 +1,52 @@
+import { type ParsedDocument } from './document-parser.js';
+export declare const ITEMS_BLOCK_REGEX: RegExp;
+/**
+ * Split a GET /multidoc response into parsed documents, skipping empty or invalid segments.
+ */
+export declare function parseExportDocuments(multidoc: string): ParsedDocument[];
+/**
+ * Reinsert a local table `items = [...]` block when the server export omitted records.
+ * If the export already has an items block, the server copy wins.
+ */
+export declare function preserveLocalTableRecords(localContent: string, serverContent: string): string;
+export interface DocumentIndex {
+    byGuid: Map<string, string>;
+    byKey: Map<string, string>;
+    byKeyLower: Map<string, string>;
+}
+/**
+ * Index local files by document key (and GUID) so an export document can be paired
+ * with the file it belongs to. Ambiguous case-insensitive keys are marked empty
+ * rather than guessed.
+ */
+export declare function indexLocalDocuments(files: Map<string, string>, localContents: Map<string, string>): DocumentIndex;
+export declare function resolveMatchedPath(doc: ParsedDocument, index: DocumentIndex): string | undefined;
+export declare function selectWritebacks(exported: ParsedDocument[], pushedFiles: Map<string, string>, localContents: Map<string, string>, options: {
+    includeRecords: boolean;
+}): Array<{
+    content: string;
+    filePath: string;
+}>;
+export interface ExportCompareResult {
+    candidates: Array<{
+        content: string;
+        filePath: string;
+        relPath: string;
+    }>;
+    identical: Array<{
+        content: string;
+        filePath: string;
+        relPath: string;
+    }>;
+    serverOnly: ParsedDocument[];
+    unmatchedLocal: Array<{
+        content: string;
+        filePath: string;
+        relPath: string;
+    }>;
+}
+export declare function compareLocalToExport(localEntries: Array<{
+    content: string;
+    filePath: string;
+    relPath: string;
+}>, exported: ParsedDocument[]): ExportCompareResult;