@xano/cli 1.3.4 → 1.3.5-beta.0

package/dist/commands/tenant_deploy_request/list/index.js

@@ -0,0 +1,122 @@
+import { Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestList extends BaseCommand {
+    static description = 'List tenant deploy requests (deployment approval requests) in a workspace';
+    static examples = [
+        `$ xano tenant_deploy_request list
+Deploy requests in workspace 5:
+  - #12 "Deploy v1.2 to prod" [pending] -> prod / v1.2
+`,
+        `$ xano tenant_deploy_request list --tenant prod --status pending`,
+        `$ xano tenant_deploy_request list --tenant prod --release v1.2`,
+        `$ xano tenant_deploy_request list --to-review -o json`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        mine: Flags.boolean({
+            default: false,
+            description: 'Only requests you authored',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        page: Flags.integer({
+            default: 1,
+            description: 'Page number',
+            required: false,
+        }),
+        'per-page': Flags.integer({
+            default: 25,
+            description: 'Items per page',
+            required: false,
+        }),
+        release: Flags.string({
+            char: 'r',
+            description: 'Filter to requests targeting this release. Applied client-side (the API has no release filter), after --page/--per-page, so a narrow page size can hide matches on other pages.',
+            required: false,
+        }),
+        status: Flags.string({
+            description: 'Filter by status',
+            options: ['draft', 'pending', 'changes_requested', 'approved', 'closed'],
+            required: false,
+        }),
+        tenant: Flags.string({
+            description: 'Filter to requests targeting this tenant',
+            required: false,
+        }),
+        'to-review': Flags.boolean({
+            default: false,
+            description: 'Only requests you are able to review',
+            required: false,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(TenantDeployRequestList);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const params = new URLSearchParams();
+        if (flags.status)
+            params.set('status', flags.status);
+        if (flags.tenant)
+            params.set('tenant_name', flags.tenant);
+        if (flags.mine)
+            params.set('mine', 'true');
+        if (flags['to-review'])
+            params.set('to_review', 'true');
+        params.set('page', String(flags.page));
+        params.set('per_page', String(flags['per-page']));
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request?${params}`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                },
+                method: 'GET',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const message = await this.parseApiError(response, 'Failed to list tenant deploy requests');
+                this.error(message);
+            }
+            const data = (await response.json());
+            const allItems = Array.isArray(data) ? data : (data.items ?? []);
+            const items = flags.release ? allItems.filter((item) => item._release?.name === flags.release) : allItems;
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(items, null, 2));
+            }
+            else if (items.length === 0) {
+                this.log('No tenant deploy requests found');
+            }
+            else {
+                this.log(`Deploy requests in workspace ${workspaceId}:`);
+                for (const item of items) {
+                    const review = item.can_review ? ' (reviewable)' : '';
+                    const tenantName = item._tenant?.name ?? '?';
+                    const releaseName = item._release?.name ?? '?';
+                    this.log(`  - #${item.id} "${item.title}" [${item.status}]${review} -> ${tenantName} / ${releaseName}`);
+                }
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to list tenant deploy requests: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to list tenant deploy requests: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/revision/index.d.ts

@@ -0,0 +1,21 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestRevision extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        note: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        release: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/tenant_deploy_request/revision/index.js

@@ -0,0 +1,83 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestRevision extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = 'Link a newer release candidate to an existing tenant deploy request after changes were requested. The previous candidate is kept in the revision history and the request returns to pending. Author only.';
+    static examples = [
+        `$ xano tenant_deploy_request revision 12 --release v1.2.1 --note "Added the missing migration"
+Deploy request #12 is now: pending
+`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        note: Flags.string({
+            description: 'Note describing what changed in this revision',
+            required: false,
+        }),
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        release: Flags.string({
+            char: 'r',
+            description: 'Name of the new release to review',
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestRevision);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        const body = {
+            note: flags.note ?? '',
+            release_name: flags.release,
+        };
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}/revision`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                const message = await this.parseApiError(response, 'Failed to add revision to tenant deploy request');
+                this.error(message);
+            }
+            const item = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(item, null, 2));
+            }
+            else {
+                this.log(`Deploy request #${item.id} is now: ${item.status}`);
+            }
+        }
+        catch (error) {
+            if (error instanceof Error) {
+                this.error(`Failed to add revision to tenant deploy request: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to add revision to tenant deploy request: ${String(error)}`);
+            }
+        }
+    }
+}

package/dist/commands/tenant_deploy_request/set_status/index.d.ts

@@ -0,0 +1,38 @@
+import BaseCommand from '../../../base-command.js';
+export default class TenantDeployRequestSetStatus extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<number, {
+            max?: number;
+            min?: number;
+        }>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'override-policy': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        reason: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        status: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        config: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    /** Set once the policy gate refuses the deploy an approval triggered, the one failure that exits 2. */
+    private refusedByPolicyGate;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
+    run(): Promise<void>;
+    /** `--override-policy` overrides the deploy an approve can trigger, and its reason is `--reason`. */
+    private checkOverride;
+    /**
+     * The deploy this approval triggered was refused by the policy gate: its verdict, then the refusal,
+     * exiting 2. The vote that completes the approvals is recorded before the deploy, so the request
+     * stays approved, and a later deploy of the pair that overrides the gate completes it.
+     */
+    private refuseByPolicyGate;
+}

package/dist/commands/tenant_deploy_request/set_status/index.js

@@ -0,0 +1,159 @@
+import { Args, Flags } from '@oclif/core';
+import BaseCommand from '../../../base-command.js';
+import { gateOverrideHint, gateRefusal, gateRefusalOutput, quoted } from '../../../utils/policy/gate.js';
+export default class TenantDeployRequestSetStatus extends BaseCommand {
+    static args = {
+        id: Args.integer({
+            description: 'Tenant deploy request ID',
+            required: true,
+        }),
+    };
+    static description = "[CRITICAL] STOP and confirm with the user before running --status approve; if this is the vote that completes the tenant's required reviewer count, it deploys the release to the tenant immediately as part of approving. Change a tenant deploy request's status (draft, submit, approve, request_changes, close, or reopen).";
+    static examples = [
+        `$ xano tenant_deploy_request set_status 12 --status submit
+Deploy request #12 is now: pending
+`,
+        `$ xano tenant_deploy_request set_status 12 --status approve
+Vote recorded on deploy request #12: 1/2 required reviewers.
+`,
+        `$ xano tenant_deploy_request set_status 12 --status approve
+Deploy request #12 is now: approved (2/2 required reviewers)
+Deployed to tenant as part of this approval.
+`,
+        `$ xano tenant_deploy_request set_status 12 --status request_changes --reason "Needs a migration note"`,
+        `$ xano tenant_deploy_request set_status 12 --status close --reason "Superseded by #14"`,
+        `$ xano tenant_deploy_request set_status 12 --status reopen`,
+    ];
+    static flags = {
+        ...BaseCommand.baseFlags,
+        output: Flags.string({
+            char: 'o',
+            default: 'summary',
+            description: 'Output format',
+            options: ['summary', 'json'],
+            required: false,
+        }),
+        'override-policy': Flags.boolean({
+            default: false,
+            description: 'With --status approve: if this vote deploys, proceed past a blocking policy gate, recording --reason as the override reason (needs the workspace:policy update permission; audited)',
+            hidden: true,
+        }),
+        reason: Flags.string({
+            description: 'Reason for this status change. Required for request_changes and close.',
+            required: false,
+        }),
+        status: Flags.string({
+            description: 'The status transition to apply',
+            options: ['draft', 'submit', 'approve', 'request_changes', 'close', 'reopen'],
+            required: true,
+        }),
+        workspace: Flags.string({
+            char: 'w',
+            description: 'Workspace ID (uses profile workspace if not provided)',
+            required: false,
+        }),
+    };
+    /** Set once the policy gate refuses the deploy an approval triggered, the one failure that exits 2. */
+    refusedByPolicyGate = false;
+    /** Exit 2 is the policy gate's refusal; every other failure, flag errors included, exits 1. */
+    async catch(error) {
+        if (this.refusedByPolicyGate)
+            return super.catch(error);
+        return this.catchAsOperational(error);
+    }
+    async run() {
+        const { args, flags } = await this.parse(TenantDeployRequestSetStatus);
+        const { profile } = this.resolveProfile(flags);
+        const workspaceId = flags.workspace || profile.workspace;
+        if (!workspaceId) {
+            this.error('No workspace ID provided. Use --workspace flag or set one in your profile.');
+        }
+        if ((flags.status === 'request_changes' || flags.status === 'close') && !flags.reason) {
+            this.error(`--reason is required when --status is "${flags.status}"`);
+        }
+        if (flags['override-policy'])
+            this.checkOverride(flags);
+        const body = {
+            action: flags.status,
+            reason: flags.reason ?? '',
+            ...(flags['override-policy'] ? { override_policy: true } : {}),
+        };
+        // A refusal by the policy gate exits 2 with its verdict; the catch that rewords other failures keeps it.
+        let refused = null;
+        const apiUrl = `${profile.instance_origin}/api:meta/workspace/${workspaceId}/approval_request/${args.id}/status`;
+        try {
+            const response = await this.verboseFetch(apiUrl, {
+                body: JSON.stringify(body),
+                headers: {
+                    accept: 'application/json',
+                    Authorization: `Bearer ${profile.access_token}`,
+                    'Content-Type': 'application/json',
+                },
+                method: 'POST',
+            }, flags.verbose, profile.access_token);
+            if (!response.ok) {
+                refused = await gateRefusal(response);
+                if (refused)
+                    this.refuseByPolicyGate(refused, args.id, flags.output === 'json');
+                const message = await this.parseApiError(response, 'Failed to change tenant deploy request status');
+                this.error(message);
+            }
+            const item = (await response.json());
+            if (flags.output === 'json') {
+                this.log(JSON.stringify(item, null, 2));
+            }
+            else if (flags.status === 'approve' && item.fully_approved === false) {
+                // required_reviewers > 1: this vote didn't complete the quorum, so status
+                // stays "pending" and nothing was deployed yet.
+                this.log(`Vote recorded on deploy request #${item.id}: ${item.approvals_count}/${item.required_reviewers} required reviewers.`);
+            }
+            else {
+                const quorum = item.approvals_count !== undefined && item.required_reviewers !== undefined
+                    ? ` (${item.approvals_count}/${item.required_reviewers} required reviewers)`
+                    : '';
+                this.log(`Deploy request #${item.id} is now: ${item.status}${quorum}`);
+                if (flags.status === 'approve') {
+                    if (item.resolution?.deploy_status === 'deployed') {
+                        this.log('Deployed to tenant as part of this approval.');
+                    }
+                    else if (item.resolution?.deploy_status === 'failed') {
+                        this.log(`Approved, but the deploy failed: ${item.resolution.deploy_error ?? 'unknown error'}`);
+                    }
+                }
+            }
+        }
+        catch (error) {
+            if (refused)
+                throw error;
+            if (error instanceof Error) {
+                this.error(`Failed to change tenant deploy request status: ${error.message}`);
+            }
+            else {
+                this.error(`Failed to change tenant deploy request status: ${String(error)}`);
+            }
+        }
+    }
+    /** `--override-policy` overrides the deploy an approve can trigger, and its reason is `--reason`. */
+    checkOverride(flags) {
+        if (flags.status !== 'approve')
+            this.error('--override-policy applies only to --status approve, the vote that can deploy.');
+        if (!flags.reason?.trim())
+            this.error('--override-policy needs --reason: say why this deploy may proceed past the policy gate.');
+    }
+    /**
+     * The deploy this approval triggered was refused by the policy gate: its verdict, then the refusal,
+     * exiting 2. The vote that completes the approvals is recorded before the deploy, so the request
+     * stays approved, and a later deploy of the pair that overrides the gate completes it.
+     */
+    refuseByPolicyGate(refused, id, json) {
+        for (const line of gateRefusalOutput(refused, json))
+            this.log(line);
+        const approved = refused.answer.gate === 'tenant_approve'
+            ? '\nYour approval was recorded and the request is approved, but its release was not deployed.'
+            : '';
+        const release = refused.answer.release?.name?.trim();
+        const override = `xano tenant deploy_release <tenant> --release ${release ? quoted(release) : '<release>'} --override-reason "<why>" (\`xano tenant_deploy_request get ${id}\` names the tenant)`;
+        this.refusedByPolicyGate = true;
+        this.error(`${refused.message}${approved}${gateOverrideHint(refused.answer, override)}`, { exit: 2 });
+    }
+}

package/dist/commands/workspace/pull/index.d.ts

@@ -21,4 +21,14 @@ export default class Pull extends BaseCommand {
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
+    /**
+     * Policy keys are unique on the server without regard to case, but an older export or a local file
+     * can still differ only in case, and file names are not case-sensitive on every checkout. The
+     * policies whose file name differs only in case from another exported policy, or from a local file
+     * it would overwrite, are left out with a warning; everything else is written. Local policy files
+     * absent from the export are kept. They are reported as stale only when this credential reads the
+     * branch's policies, because an export leaves out the policies its credential cannot read, and
+     * every policy while the Policies feature is off.
+     */
+    private policyClashes;
 }

package/dist/commands/workspace/pull/index.js

@@ -3,8 +3,9 @@ import snakeCase from 'lodash.snakecase';
 import * as fs from 'node:fs';
 import path from 'node:path';
 import BaseCommand from '../../../base-command.js';
-import { buildApiGroupFolderResolver, buildChannelServerResolver, parseDocument, resolveDocumentPath, } from '../../../utils/document-parser.js';
+import { buildApiGroupFolderResolver, buildChannelServerResolver, parseDocument, policyBaseName, resolveDocumentPath, } from '../../../utils/document-parser.js';
 import { fetchKnowledge, writeKnowledge } from '../../../utils/knowledge-sync.js';
+import { policyListing } from '../../../utils/policy/request.js';
 import { recordEntriesForPaths, resolveTarget, saveSyncState, syncStateExists } from '../../../utils/sync-state.js';
 /**
  * Whether pull should write `.xano/sync_state.json`: only when asked to, or to keep an existing
@@ -41,7 +42,7 @@ Write .xano/sync_state.json after pulling; later pulls keep it current while it
         ...BaseCommand.baseFlags,
         branch: Flags.string({
             char: 'b',
-            description: 'Branch name (optional if set in profile, defaults to live)',
+            description: "Branch name (defaults to profile branch or live; -b '' selects live)",
             required: false,
         }),
         directory: Flags.string({
@@ -92,8 +93,8 @@ Write .xano/sync_state.json after pulling; later pulls keep it current while it
                 `  1. Provide it as a flag: xano workspace pull -w <workspace_id>\n` +
                 `  2. Set it in your profile using: xano profile:edit ${profileName} -w <workspace_id>`);
         }
-        // Determine branch from flag or profile
-        const branch = flags.branch || profile.branch || '';
+        // Determine branch from flag or profile; `-b ''` selects live whatever the profile's branch, as in push.
+        const branch = flags.branch ?? profile.branch ?? '';
         // Build query parameters
         const queryParams = new URLSearchParams({
             branch,
@@ -142,12 +143,13 @@ Write .xano/sync_state.json after pulling; later pulls keep it current while it
                 documents.push(parsed);
             }
         }
+        // Resolve the output directory
+        const outputDir = path.resolve(flags.directory);
+        const clashing = await this.policyClashes(documents, outputDir, () => policyListing({ logToStderr: (message) => this.logToStderr(message), verboseFetch: (...args) => this.verboseFetch(...args) }, { branch, profile, verbose: flags.verbose, workspace: workspaceId }));
         if (documents.length === 0) {
             this.log('No documents found in response');
             return;
         }
-        // Resolve the output directory
-        const outputDir = path.resolve(flags.directory);
         // Create the output directory if it doesn't exist
         fs.mkdirSync(outputDir, { recursive: true });
         // Resolve api_group names to unique folder names, disambiguating collisions
@@ -160,7 +162,7 @@ Write .xano/sync_state.json after pulling; later pulls keep it current while it
         const filenameCounters = new Map();
         let writtenCount = 0;
         const writtenPaths = [];
-        for (const doc of documents) {
+        for (const doc of documents.filter((document) => !clashing.has(document))) {
             const { baseName, typeDir } = resolveDocumentPath(doc, outputDir, {
                 getApiGroupFolder,
                 getChannelServer,
@@ -194,6 +196,12 @@ Write .xano/sync_state.json after pulling; later pulls keep it current while it
         if (knowledgeCount > 0)
             parts.push(`${knowledgeCount} knowledge file${knowledgeCount === 1 ? '' : 's'}`);
         this.log(`Pulled ${parts.join(' + ')} to ${flags.directory}`);
+        // Policy files state the rules; the skill the instance generates tells an agent how to follow them.
+        // Only a pull that carried policy files says so: an instance with the Policies feature off exports
+        // none, and its skill route answers 403.
+        if (documents.some((doc) => doc.type === 'policy')) {
+            this.log('Run `xano skills pull` to install the policies skill for your coding agent.');
+        }
         const syncState = syncStateAction(flags['sync-state'], outputDir, flags.draft);
         if (syncState === 'skip') {
             return;
@@ -228,4 +236,59 @@ Write .xano/sync_state.json after pulling; later pulls keep it current while it
             this.warn(`Skipped writing .xano/sync_state.json: ${error.message}`);
         }
     }
+    /**
+     * Policy keys are unique on the server without regard to case, but an older export or a local file
+     * can still differ only in case, and file names are not case-sensitive on every checkout. The
+     * policies whose file name differs only in case from another exported policy, or from a local file
+     * it would overwrite, are left out with a warning; everything else is written. Local policy files
+     * absent from the export are kept. They are reported as stale only when this credential reads the
+     * branch's policies, because an export leaves out the policies its credential cannot read, and
+     * every policy while the Policies feature is off.
+     */
+    async policyClashes(documents, outputDir, readsPolicies) {
+        const exported = new Map();
+        for (const doc of documents.filter(doc => doc.type === 'policy')) {
+            const filename = `${policyBaseName(doc.name)}.xs`;
+            exported.set(filename.toLowerCase(), [...(exported.get(filename.toLowerCase()) ?? []), filename]);
+        }
+        const clashes = new Map();
+        for (const [normalized, names] of exported) {
+            if (names.length > 1)
+                clashes.set(normalized, names.map(name => `policies/${name}`).join(' and '));
+        }
+        const policyDir = path.join(outputDir, 'policies');
+        const localFiles = fs.existsSync(policyDir)
+            ? fs.readdirSync(policyDir, { withFileTypes: true })
+                .filter(entry => entry.isFile() && entry.name.toLowerCase().endsWith('.xs'))
+                .map(entry => entry.name)
+                .sort()
+            : [];
+        const stale = [];
+        for (const filename of localFiles) {
+            const names = exported.get(filename.toLowerCase());
+            if (!names)
+                stale.push(`policies/${filename}`);
+            else if (!names.includes(filename) && !clashes.has(filename.toLowerCase())) {
+                clashes.set(filename.toLowerCase(), `policies/${names[0]} (local policies/${filename})`);
+            }
+        }
+        if (clashes.size > 0) {
+            this.warn(`Policy files that differ only in case are left out of this pull; everything else is written:\n  ${[...clashes.values()].join('\n  ')}\n` +
+                'Rename one of the policies, or move the local file aside, then pull again.');
+        }
+        if (stale.length > 0) {
+            // An export that carries a policy was made by a credential that reads them.
+            const listing = exported.size > 0 ? 'listed' : await readsPolicies();
+            if (listing === 'listed') {
+                this.warn(`Stale local policy files are absent from this export and were kept:\n  ${stale.join('\n  ')}\nReview them before pushing; a push can publish these policies again.`);
+            }
+            else if (listing === 'feature_off') {
+                this.log('Local policy files were kept: Policies are not enabled on this instance, so the export carries none.');
+            }
+            else {
+                this.log(`Local policy files were kept: this credential cannot list this workspace's policies, and the export carries none.`);
+            }
+        }
+        return new Set(documents.filter(doc => doc.type === 'policy' && clashes.has(`${doc.name}.xs`.toLowerCase())));
+    }
 }

package/dist/commands/workspace/push/index.d.ts

@@ -13,6 +13,9 @@ export default class Push extends BaseCommand {
         force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         guids: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         include: import("@oclif/core/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        message: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        output: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'policy-override': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         records: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         refresh: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         sync: import("@oclif/core/interfaces").BooleanFlag<boolean>;
@@ -25,5 +28,21 @@ export default class Push extends BaseCommand {
         profile: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         verbose: import("@oclif/core/interfaces").BooleanFlag<boolean>;
     };
+    protected catch(error: Error & {
+        oclif?: {
+            exit?: number;
+        };
+    }): Promise<void>;
     run(): Promise<void>;
+    /**
+     * A failure after the import landed. The import stands, so its policy feedback is reported as for
+     * any push and a blocking finding still exits 2; otherwise the failure exits 1. Under `-o json`
+     * stdout holds the import's document with the failure as `error`.
+     */
+    private catchAfterImport;
+    /**
+     * What happened to the policy documents, then the policy check the import answered with. When the
+     * platform left the policy files out, its notice says so instead of a count of what was sent.
+     */
+    private reportPolicyFeedback;
 }