@xano/xanoscript-language-server 12.17.0 → 12.19.0

package/onHover/PolicyMessageProvider.js

@@ -0,0 +1,142 @@
+import { CommentToken } from "../lexer/comment.js";
+import {
+  ColonToken,
+  EqualToken,
+  LCurly,
+  LSquare,
+  RCurly,
+  RSquare,
+} from "../lexer/control.js";
+import { SingleQuotedStringLiteral, StringLiteral } from "../lexer/literal.js";
+import { PolicyToken } from "../lexer/policy.js";
+import { Identifier, NewlineToken } from "../lexer/tokens.js";
+import { getPolicyCatalogue } from "../parser/policy/catalogue.js";
+import { checkMarkdown, paramMarkdown } from "../parser/policy/policyDocs.js";
+import { isA, own, policyStringValue } from "../parser/policy/policyLiteral.js";
+import { HoverMessageProvider } from "./HoverMessageProvider.js";
+
+const isString = (token) => isA(token, StringLiteral) || isA(token, SingleQuotedStringLiteral);
+
+const unquote = policyStringValue;
+
+/** The key a value at `k` belongs to: the word before the `=` or `:` just before it. */
+function keyBefore(tokens, k) {
+  const sep = tokens[k - 1];
+  if ((isA(sep, EqualToken) || isA(sep, ColonToken)) && isA(tokens[k - 2], Identifier)) {
+    return tokens[k - 2].image;
+  }
+  return null;
+}
+
+/** The first word on the line holding token `k`. */
+function lineHead(tokens, k) {
+  if (tokens[k - 1]?.image === "rule" && tokens[k - 2]?.image !== "policy") return "rule";
+  let j = k;
+  while (j > 0 && !isA(tokens[j - 1], NewlineToken)) j--;
+  return isA(tokens[j], Identifier) ? tokens[j].image : null;
+}
+
+/**
+ * The blocks open at `index`, outermost first, each with the check its rule names (read from the
+ * whole rule, so a `check` written after `params` still counts).
+ */
+function framesAt(tokens, index) {
+  const stack = [];
+  let at = null;
+  for (let k = 0; k < tokens.length; k++) {
+    if (k === index) at = [...stack];
+    const token = tokens[k];
+    if (isA(token, LCurly) || isA(token, LSquare)) {
+      stack.push({
+        owner: keyBefore(tokens, k) ?? (isA(token, LCurly) ? lineHead(tokens, k) : null),
+        check: null,
+      });
+    } else if (isA(token, RCurly) || isA(token, RSquare)) {
+      stack.pop();
+      // Past the block that holds `index`: nothing later can change what it names.
+      if (at && stack.length < 2) break;
+    } else if (isString(token) && keyBefore(tokens, k) === "check" && stack.length) {
+      stack[stack.length - 1].check = unquote(token.image).trim();
+    }
+  }
+  return at ?? [];
+}
+
+/** Markdown for a policy or rule field, from the catalogue's `document`. */
+function fieldMarkdown(name, spec) {
+  const lines = [`**${name}** (${spec.type ?? "string"}${spec.required ? ", required" : ""})`];
+  if (spec.description) lines.push("", spec.description);
+  if (spec.values?.length) lines.push("", `One of: ${spec.values.map((v) => "`" + v + "`").join(", ")}.`);
+  if (spec.default !== undefined) lines.push("", `Default: \`${spec.default}\``);
+  return lines.join("\n");
+}
+
+/**
+ * Hover inside a `policy` document: a policy or rule field shows what it is for; a rule's check id
+ * shows what the check does and its params; a param (or an object param's field) shows its type,
+ * values, default and description. All of it is rendered from the check catalogue the host loaded.
+ */
+export class PolicyMessageProvider extends HoverMessageProvider {
+  /**
+   * @returns {{kind: "field", name: string, spec: Object} | {kind: "check", check: Object}
+   *   | {kind: "param", check: Object, path: string, spec: Object} | null}
+   */
+  resolve(index, tokens) {
+    const head = tokens.find((t) => !isA(t, NewlineToken) && !isA(t, CommentToken));
+    if (!isA(head, PolicyToken)) return null;
+    const catalogue = getPolicyCatalogue();
+    if (!catalogue.source) return null;
+
+    const token = tokens[index];
+    const frames = framesAt(tokens, index);
+    const [policy, rule, params, nested] = frames;
+    if (policy?.owner !== "policy") return null;
+
+    // A field name: `name =` in the policy or in a rule.
+    if (isA(token, Identifier) && isA(tokens[index + 1], EqualToken)) {
+      const fields =
+        frames.length === 1
+          ? catalogue.document?.fields
+          : frames.length === 2 && rule?.owner === "rule"
+            ? catalogue.document?.rule
+            : null;
+      const spec = own(fields, token.image);
+      return spec ? { kind: "field", name: token.image, spec } : null;
+    }
+    if (rule?.owner !== "rule") return null;
+
+    if (frames.length === 2 && isString(token) && keyBefore(tokens, index) === "check") {
+      const check = catalogue.checks.get(unquote(token.image).trim());
+      return check ? { kind: "check", check } : null;
+    }
+
+    const check = catalogue.checks.get(rule.check ?? "");
+    if (!check || params?.owner !== "params" || !isA(token, Identifier) || !isA(tokens[index + 1], ColonToken)) {
+      return null;
+    }
+    if (frames.length === 3) {
+      const spec = own(check.params, token.image);
+      return spec ? { kind: "param", check, path: token.image, spec } : null;
+    }
+    if (frames.length === 4) {
+      const spec = own(own(check.params, nested.owner)?.properties, token.image);
+      return spec
+        ? { kind: "param", check, path: `${nested.owner}.${token.image}`, spec }
+        : null;
+    }
+    return null;
+  }
+
+  isMatch(index, tokens) {
+    return this.resolve(index, tokens) !== null;
+  }
+
+  render(index, tokens) {
+    const found = this.resolve(index, tokens);
+    if (!found) return "";
+    if (found.kind === "field") return fieldMarkdown(found.name, found.spec);
+    return found.kind === "check"
+      ? checkMarkdown(found.check, getPolicyCatalogue())
+      : paramMarkdown(found.check.id, found.path, found.spec);
+  }
+}

package/onHover/functions.md

@@ -512,6 +512,49 @@ Sends an MCP `notifications/progress` update to the client while a tool, prompt
 - `total`: optional. The expected final value.
 - `message`: optional. A short status line.
 
+# mcp.oauth.complete
+
+```xs
+mcp.oauth.complete {
+  request = $input.mcp_request
+  decision = $input.decision
+} as $continue_url
+```
+
+Finishes a hosted-mode MCP sign-in from your login endpoint and returns the single-use URL your login page sends the browser to. Your login page is the consent screen: it shows the request (see `mcp.oauth.request`) and passes the user's answer here.
+
+- `request`: required. The `mcp_request` value your login page received.
+- `decision`: required. `approve` signs the user in; `deny` refuses the sign-in.
+- `unsafe_user_id`: optional and DANGEROUS. Signs in that auth-table row directly, skipping the `$auth` and session-age checks. Use it only in a login flow whose own stack has already proven who the user is.
+
+By default the user is the endpoint's `$auth`: a row of the server's auth table whose session token was issued moments ago, so mint a fresh token at login.
+
+# mcp.oauth.request
+
+```xs
+mcp.oauth.request {
+  request = $input.mcp_request
+} as $sign_in
+```
+
+Returns the verified details of a pending hosted-mode MCP sign-in request (`client_name`, `client_logo`, `callback_host`, `client_verified`, `server_name`) for the consent screen on your login page. It reads the request without consuming it.
+
+- `request`: required. The `mcp_request` value your login page received.
+
+# mcp.oauth.revoke
+
+```xs
+mcp.oauth.revoke {
+  mcp_server = "my_server"
+  user_id = $input.user_id
+} as $revoked
+```
+
+Ends hosted-mode MCP sign-ins on an MCP server of this workspace and branch. Returns `{revoked: <count>}`.
+
+- `mcp_server`: required. The MCP server's name.
+- Then exactly one of `user_id` (every grant of that auth-table row), `grant_id` (one grant) or `all = true` (every grant of the server).
+
 # api.lambda
 
 ```xs

package/onHover/onHover.js

@@ -7,10 +7,12 @@ import { InputFilterMessageProvider } from "./InputFilterMessageProvider.js";
 import inputFiltersMd from "./inputFilters.md";
 import { InputVariableMessageProvider } from "./InputVariableMessageProvider.js";
 import { onHoverDocument } from "./onHoverDocument.js";
+import { PolicyMessageProvider } from "./PolicyMessageProvider.js";
 import { QueryFilterMessageProvider } from "./queryFilterMessageProvider.js";
 import queryFiltersMd from "./queryFilters.md";
 
 const hoverProviders = [
+  new PolicyMessageProvider(), // Check ids and params in a policy, from the check catalogue
   new InputVariableMessageProvider(),
   new FunctionMessageProvider(functionsMd),
   new InputFilterMessageProvider(inputFiltersMd), // Input filters (columnDefinition context)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@xano/xanoscript-language-server",
-  "version": "12.17.0",
+  "version": "12.19.0",
   "description": "Language Server Protocol implementation for XanoScript",
   "type": "module",
   "main": "server.js",
@@ -18,6 +18,7 @@
     "onCheckError/",
     "onCompletion/contentAssist.js",
     "onCompletion/onCompletion.js",
+    "onCompletion/policyCompletion.js",
     "onDefinition/onDefinition.js",
     "onDidChangeContent/",
     "onHover/",
@@ -47,6 +48,7 @@
     "lint": "eslint . --ext .js",
     "lint:fix": "eslint . --ext .js --fix",
     "tm": "node ./toTmLanguage.js",
+    "gen:policy-catalogue": "node scripts/gen-policy-catalogue.mjs",
     "prepare": "husky"
   },
   "dependencies": {

package/parser/functions/mcp/mcpOauthFn.js

@@ -0,0 +1,140 @@
+import { RequestToken } from "../../../lexer/api.js";
+import { RCurly } from "../../../lexer/control.js";
+import { StringLiteral } from "../../../lexer/literal.js";
+import { CompleteToken, OauthToken, RevokeToken } from "../../../lexer/mcp.js";
+import { DotToken, NewlineToken } from "../../../lexer/tokens.js";
+import { getVarName } from "../../generic/utils.js";
+
+// The values cloud-client's mvp:mcp_oauth_complete accepts for `decision`.
+const DECISIONS = ["approve", "deny"];
+
+/**
+ * `decision` takes any expression (usually `$input.decision`), but a plain
+ * string literal is checked against the enum here so a typo is caught in the
+ * editor rather than refused at run time.
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ * @param {import('chevrotain').IToken} identifier
+ */
+function decisionValue($, identifier) {
+  const first = $.LA(1);
+  const next = $.LA(2);
+  if (
+    first.tokenType === StringLiteral &&
+    (next.tokenType === NewlineToken || next.tokenType === RCurly)
+  ) {
+    const value = getVarName(first);
+    if (!DECISIONS.includes(value)) {
+      $.addInvalidValueError(
+        first,
+        `Invalid value "${value}". Must be one of: ${DECISIONS.map(
+          (v) => `"${v}"`
+        ).join(", ")}`
+      );
+    }
+  }
+  $.SUBRULE5($.expressionFn, { ARGS: [identifier, {}] });
+}
+
+// The `mcp.oauth.*` login hand-off statements (cloud-client
+// mvp:mcp_oauth_{complete,request,revoke}, kind schemas
+// statement/mcp.oauth.{complete,request,revoke}.yaml). Each takes an optional
+// `as $var` binding.
+
+/**
+ * mcp.oauth.complete, mcp.oauth.request, mcp.oauth.revoke
+ * (the leading "mcp." is consumed by mcpFn)
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthFn($) {
+  return () => {
+    $.sectionStack.push("mcpOauthFn");
+    $.CONSUME(OauthToken); // "oauth"
+    $.CONSUME(DotToken); // "."
+    $.OR([
+      { ALT: () => $.SUBRULE($.mcpOauthCompleteFn) }, // "complete"
+      { ALT: () => $.SUBRULE($.mcpOauthRequestFn) }, // "request"
+      { ALT: () => $.SUBRULE($.mcpOauthRevokeFn) }, // "revoke"
+    ]);
+    $.sectionStack.pop();
+  };
+}
+
+// mcp.oauth.complete {
+//   request = $input.mcp_request     // required: the opaque request handle
+//   decision = "approve"             // required: approve | deny
+//   unsafe_user_id = $user.id        // optional: sign in a row without $auth
+// } as $continue_url
+/**
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthCompleteFn($) {
+  const requiredAttrs = ["request", "decision"];
+  const optionalAttrs = ["unsafe_user_id", "description", "disabled", "mock"];
+
+  return () => {
+    $.sectionStack.push("mcpOauthCompleteFn");
+    const fnToken = $.CONSUME(CompleteToken); // "complete"
+    $.SUBRULE($.functionAttrReq, {
+      ARGS: [
+        fnToken,
+        requiredAttrs,
+        optionalAttrs,
+        { types: { decision: decisionValue } },
+      ],
+    });
+    $.SUBRULE($.asVariable, { ARGS: [fnToken] });
+    $.sectionStack.pop();
+  };
+}
+
+// mcp.oauth.request {
+//   request = $input.mcp_request
+// } as $sign_in
+/**
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthRequestFn($) {
+  const requiredAttrs = ["request"];
+  const optionalAttrs = ["description", "disabled", "mock"];
+
+  return () => {
+    $.sectionStack.push("mcpOauthRequestFn");
+    const fnToken = $.CONSUME(RequestToken); // "request"
+    $.SUBRULE($.functionAttrReq, {
+      ARGS: [fnToken, requiredAttrs, optionalAttrs],
+    });
+    $.SUBRULE($.asVariable, { ARGS: [fnToken] });
+    $.sectionStack.pop();
+  };
+}
+
+// mcp.oauth.revoke {
+//   mcp_server = "example_server"
+//   user_id = $input.user_id         // exactly ONE of user_id, grant_id or
+//   grant_id = $input.grant_id       // all = true must be in effect; that is
+//   all = true                       // checked at run time on the values
+// } as $revoked
+/**
+ * @param {import('../../base_parser.js').XanoBaseParser} $
+ */
+export function mcpOauthRevokeFn($) {
+  const requiredAttrs = ["mcp_server"];
+  const optionalAttrs = [
+    "user_id",
+    "grant_id",
+    "all",
+    "description",
+    "disabled",
+    "mock",
+  ];
+
+  return () => {
+    $.sectionStack.push("mcpOauthRevokeFn");
+    const fnToken = $.CONSUME(RevokeToken); // "revoke"
+    $.SUBRULE($.functionAttrReq, {
+      ARGS: [fnToken, requiredAttrs, optionalAttrs],
+    });
+    $.SUBRULE($.asVariable, { ARGS: [fnToken] });
+    $.sectionStack.pop();
+  };
+}

package/parser/functions/mcp/register.js

@@ -1,4 +1,10 @@
 import { mcpElicitFn } from "./mcpElicitFn.js";
+import {
+  mcpOauthCompleteFn,
+  mcpOauthFn,
+  mcpOauthRequestFn,
+  mcpOauthRevokeFn,
+} from "./mcpOauthFn.js";
 import { mcpProgressFn } from "./mcpProgressFn.js";
 
 /**
@@ -8,4 +14,8 @@ import { mcpProgressFn } from "./mcpProgressFn.js";
 export const register = ($) => {
   $.mcpElicitFn = $.RULE("mcpElicitFn", mcpElicitFn($));
   $.mcpProgressFn = $.RULE("mcpProgressFn", mcpProgressFn($));
+  $.mcpOauthCompleteFn = $.RULE("mcpOauthCompleteFn", mcpOauthCompleteFn($));
+  $.mcpOauthRequestFn = $.RULE("mcpOauthRequestFn", mcpOauthRequestFn($));
+  $.mcpOauthRevokeFn = $.RULE("mcpOauthRevokeFn", mcpOauthRevokeFn($));
+  $.mcpOauthFn = $.RULE("mcpOauthFn", mcpOauthFn($));
 };

package/parser/functions/mcpFn.js

@@ -2,7 +2,7 @@ import { McpToken } from "../../lexer/ai.js";
 import { DotToken } from "../../lexer/tokens.js";
 
 /**
- * mcp.elicit, mcp.progress
+ * mcp.elicit, mcp.progress, mcp.oauth.{complete,request,revoke}
  * @param {import('../base_parser.js').XanoBaseParser} $
  */
 export function mcpFn($) {
@@ -13,6 +13,7 @@ export function mcpFn($) {
     $.OR([
       { ALT: () => $.SUBRULE($.mcpElicitFn) }, // "mcp.elicit"
       { ALT: () => $.SUBRULE($.mcpProgressFn) }, // "mcp.progress"
+      { ALT: () => $.SUBRULE($.mcpOauthFn) }, // "mcp.oauth.*"
     ]);
     $.sectionStack.pop();
   };

package/parser/mcp_server_parser.js

@@ -1,6 +1,6 @@
 import { EqualToken, LCurly, RCurly } from "../lexer/control.js";
 import { StringLiteral } from "../lexer/literal.js";
-import { PromptsToken } from "../lexer/mcp.js";
+import { OauthToken, PromptsToken } from "../lexer/mcp.js";
 import {
   ActiveToken,
   InstructionsToken,
@@ -19,6 +19,7 @@ export function mcpServerDeclaration($) {
     let hasDocs = false;
     let hasHistory = false;
     let hasInstructions = false;
+    let hasOauth = false;
     let hasPrompts = false;
     let hasResources = false;
     let hasTags = false;
@@ -96,6 +97,52 @@ export function mcpServerDeclaration($) {
             });
           },
         },
+        {
+          // Per-server OAuth (cloud-client mcp_server.yaml `oauth`; values are
+          // validated server-side by helper/mvp/mcpoauth/OauthConfig.php).
+          // An assignment block like a channel's `publish`. mcp_server ONLY:
+          // deliberately absent from agent_parser.js. Mode-specific rules
+          // (hosted needs login_url, external needs issuer, ...) stay
+          // server-side; only the key set and the enums are checked here.
+          // There is no consent, branding or trusted_clients key: consent is
+          // the customer's own login page, which calls mcp.oauth.complete
+          // with a decision.
+          GATE: () => !hasOauth,
+          ALT: () => {
+            hasOauth = true;
+
+            const subParent = $.CONSUME(OauthToken); // "oauth"
+            $.CONSUME5(EqualToken); // "="
+            $.SUBRULE($.schemaParseObjectFn, {
+              ARGS: [
+                subParent,
+                {
+                  "mode?": ["hosted", "external"],
+                  "auth_table?": "[string]",
+                  // hosted; may be "${env.NAME}"
+                  "login_url?": "[string]",
+                  // external; may be "${env.NAME}"
+                  "issuer?": "[string]",
+                  "audience?": ["[string]"],
+                  "audience_ack?": "[boolean]",
+                  "claim?": "[string]",
+                  "claim_ack?": "[boolean]",
+                  "column?": "[string]",
+                  "preset?": [
+                    "auth0",
+                    "clerk",
+                    "workos",
+                    "entra",
+                    "okta",
+                    "cognito",
+                    "generic",
+                  ],
+                  "allowed_client_ids?": ["[string]"],
+                },
+              ],
+            });
+          },
+        },
         {
           // First-class prompts attached to the server (MCP 2026-07-28).
           // mcp_server ONLY: deliberately absent from agent_parser.js.

package/parser/multidoc.js

@@ -1,13 +1,49 @@
 import { lexDocument } from "../lexer/lexer.js";
+import { MultiLineExpressionToken, MultiLineStringToken } from "../lexer/multiline.js";
 import { crossFileValidate } from "../workspace/crossFileValidator.js";
 import { WorkspaceIndex } from "../workspace/workspaceIndex.js";
 import { scanDbReferences } from "./dbReferenceScanner.js";
 import { xanoscriptParser } from "./parser.js";
 import { validateVariables } from "./variableValidator.js";
 
-const SEPARATOR = "\n---\n";
-const SEPARATOR_LENGTH = 5;
-const SEPARATOR_NEWLINES = 2; // number of \n characters in SEPARATOR
+/**
+ * Where a triple-quoted string could run, found with the lexer's own patterns for `"""`, `'''` and
+ * triple backticks rather than a full lex: in a lex, an ordinary string left open while typing
+ * pairs with a quote in a later document and hides every separator after it.
+ */
+const TRIPLE_QUOTED = new RegExp(
+  `${MultiLineStringToken.PATTERN.source}|${MultiLineExpressionToken.PATTERN.source}`,
+  "g"
+);
+
+/**
+ * Separate documents at each `---` line, as the platform does, except one inside a triple-quoted
+ * string (a Markdown rule in a policy's narrative), which xanoscriptParser warns about: the
+ * platform's multidoc push splits there.
+ */
+export function splitMultidoc(text) {
+  const boundaries = [...text.matchAll(/\r?\n---[ \t]*\r?\n/g)];
+  if (!boundaries.length) return [{ text, globalOffset: 0, lineOffset: 0 }];
+  const quoted = /"""|'''|```/.test(text)
+    ? [...text.matchAll(TRIPLE_QUOTED)].map((match) => [match.index, match.index + match[0].length])
+    : [];
+  const segments = [];
+  let quotedIndex = 0;
+  let globalOffset = 0;
+  let lineOffset = 0;
+  for (const boundary of boundaries) {
+    const dash = boundary.index + (boundary[0].startsWith("\r") ? 2 : 1);
+    while (quoted[quotedIndex]?.[1] <= dash) quotedIndex++;
+    const range = quoted[quotedIndex];
+    if (range && range[0] < dash && range[1] >= dash + 3) continue;
+    const segmentText = text.slice(globalOffset, boundary.index);
+    segments.push({ text: segmentText, globalOffset, lineOffset });
+    lineOffset += (segmentText.match(/\n/g) || []).length + 2;
+    globalOffset = boundary.index + boundary[0].length;
+  }
+  segments.push({ text: text.slice(globalOffset), globalOffset, lineOffset });
+  return segments;
+}
 
 /**
  * Find the segment that contains the given global offset.
@@ -166,24 +202,22 @@ function offsetResult(snapshot, globalOffset, lineOffset) {
 
 /**
  * Parse a multidoc or single-doc XanoScript text.
- * Detects `\n---\n` separator. If absent, delegates to xanoscriptParser as-is.
- * If present, splits, parses each segment, offsets positions, and merges results.
+ * Splits with splitMultidoc (a `---` line outside a triple-quoted string). With one segment,
+ * delegates to xanoscriptParser as-is; otherwise parses each segment, offsets positions, and
+ * merges results.
  * @param {string} text - The full document text
  * @returns {Object} Merged parser result
  */
-export function multidocParser(text) {
-  if (!text.includes(SEPARATOR)) {
+export function multidocParser(text, segments = splitMultidoc(text)) {
+  if (segments.length === 1) {
     // Single document — delegate as-is
     const parser = xanoscriptParser(text);
     return snapshotParser(parser);
   }
 
-  const segments = text.split(SEPARATOR);
   const results = [];
-  let globalOffset = 0;
-  let lineOffset = 0;
 
-  for (const segmentText of segments) {
+  for (const { text: segmentText, globalOffset, lineOffset } of segments) {
     const parser = xanoscriptParser(segmentText);
     const snapshot = snapshotParser(parser);
 
@@ -230,8 +264,6 @@ export function multidocParser(text) {
     // Deep-copy the snapshot before offsetResult mutates it (needed for hover providers)
     const localSnapshot = JSON.parse(JSON.stringify(snapshot));
     results.push({ snapshot, localSnapshot, segmentText, segmentSymbolTable, globalOffset, lineOffset });
-    globalOffset += segmentText.length + SEPARATOR_LENGTH;
-    lineOffset += (segmentText.match(/\n/g) || []).length + SEPARATOR_NEWLINES;
   }
 
   // For now, merge without offsetting (next task)

package/parser/parser.js

@@ -1,7 +1,9 @@
 import { lexDocument } from "../lexer/lexer.js";
+import { MultiLineExpressionToken, MultiLineStringToken } from "../lexer/multiline.js";
 import { allTokens } from "../lexer/tokens.js";
 import { getSchemeFromContent } from "../utils.js";
 import { XanoBaseParser } from "./base_parser.js";
+import { explainPolicySyntaxErrors } from "./policy_parser.js";
 
 /**
  * Will parse the content of the file based on its scheme (db:/, task:/, api:/...)
@@ -17,6 +19,7 @@ export function xanoscriptParser(text, scheme, preTokenized = null) {
   const lexResult = preTokenized || lexDocument(text);
   parser.reset();
   parser.input = lexResult.tokens;
+  warnSeparatorsInStrings(lexResult.tokens);
   switch (scheme.toLowerCase()) {
     case "addon":
       parser.addonDeclaration();
@@ -63,6 +66,31 @@ export function xanoscriptParser(text, scheme, preTokenized = null) {
     case "middleware":
       parser.middlewareDeclaration();
       return parser;
+    case "policy":
+      parser.policyDeclaration();
+      explainPolicySyntaxErrors(parser);
+      // Chevrotain skips an unrecognized character (`#`, `§`). A policy must never validate the
+      // text left after that recovery as if the character were absent: what the parse found at or
+      // after it is dropped, and the character is reported as the platform's syntax error.
+      if (lexResult.errors.length) {
+        const skipped = lexResult.errors[0].offset;
+        const before = (item) => !item.token || item.token.startOffset < skipped;
+        parser.errors = parser.errors.filter(before);
+        parser.warnings = parser.warnings.filter(before);
+      }
+      for (const error of lexResult.errors) {
+        // The platform names the first character it cannot read; the lexer skips a run of them.
+        // Quoted as PHP's escapeshellarg quotes it (Unexpected.php): a `'` is written `'\''`.
+        const first = String.fromCodePoint(text.codePointAt(error.offset)).replaceAll("'", "'\\''");
+        parser.addInvalidValueError({
+          image: text.slice(error.offset, error.offset + error.length),
+          startOffset: error.offset,
+          endOffset: error.offset + error.length - 1,
+          startLine: error.line,
+          startColumn: error.column,
+        }, `Syntax error: unexpected '${first}'`);
+      }
+      return parser;
     case "prompt":
       parser.promptDeclaration();
       return parser;
@@ -109,6 +137,30 @@ export function xanoscriptParser(text, scheme, preTokenized = null) {
   }
 }
 
+const SEPARATOR_IN_STRING =
+  'A line that is only "---" separates documents in a multidoc push (xano workspace push, release push), even inside a string. Indent it to keep it in the text.';
+
+/**
+ * A triple-quoted string keeps a `---` line here, as the platform's single-document parse does,
+ * but the platform's multidoc splitter ends a document at every unindented `---` line, strings
+ * included. Warn on each one, at the line a push would split.
+ */
+function warnSeparatorsInStrings(tokens) {
+  for (const token of tokens) {
+    if (token.tokenType !== MultiLineStringToken && token.tokenType !== MultiLineExpressionToken) continue;
+    for (const match of token.image.matchAll(/\n---[ \t]*(?=\r?\n)/g)) {
+      const at = match.index + 1;
+      parser.addWarning(SEPARATOR_IN_STRING, {
+        image: "---",
+        startOffset: token.startOffset + at,
+        endOffset: token.startOffset + at + 2,
+        startLine: token.startLine + (token.image.slice(0, at).match(/\n/g) || []).length,
+        startColumn: 1,
+      });
+    }
+  }
+}
+
 export class XanoScriptParser extends XanoBaseParser {
   constructor() {
     super(allTokens);