@noormdev/sdk 1.5.0 → 1.6.0

package/dist/index.js

@@ -1,7 +1,7 @@
 import { createRequire } from 'module';
 import { processFile, es_default, DtReader, isTemplate, FORMAT_VERSION, DT_EXTENSIONS, encryptWithPassphrase, ENCODED_TYPES } from './chunk-M7Q44VFJ.js';
 import './chunk-UOFJT5PY.js';
-import { resolveLegacyAccess, checkConfigPolicy, initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey, assertVaultPolicy, assertPolicy, detectAgentHarness, guarded } from './chunk-WUMCIKEQ.js';
+import { resolveLegacyAccess, checkConfigPolicy, initializeVault, getVaultStatus, setVaultSecret, getVaultSecret, getAllVaultSecrets, listVaultSecretKeys, deleteVaultSecret, vaultSecretExists, getVaultKey, noormDb, getNoormTables, encryptVaultKey, assertVaultPolicy, assertPolicy, detectAgentHarness, guarded } from './chunk-24L5UNQR.js';
 import { observer, getEnvConfigName, ObserverRelay, isDebug } from './chunk-6LG4ENOJ.js';
 export { observer as noormObserver } from './chunk-6LG4ENOJ.js';
 import { explainConnectionError, DatabaseConnectionError } from './chunk-OXTXFKWJ.js';
@@ -13,7 +13,7 @@ import { __commonJS, __toESM } from './chunk-D2XW2UOP.js';
 import { existsSync, accessSync, constants, readFileSync, mkdirSync, chmodSync, createWriteStream, writeFileSync, openSync, writeSync, closeSync, unlinkSync, statSync, copyFileSync, fsyncSync, renameSync } from 'fs';
 import path, { join, dirname, resolve, relative, sep } from 'path';
 import { homedir, availableParallelism, userInfo } from 'os';
-import { stat, mkdir, writeFile, unlink, rename, rm, readdir, readFile, access } from 'fs/promises';
+import { stat, mkdir, writeFile, unlink, rename, rm, readFile, readdir, access } from 'fs/promises';
 import { createHash, createPrivateKey, createPublicKey, createDecipheriv, randomBytes, createCipheriv, randomUUID, hkdfSync } from 'crypto';
 import { execSync } from 'child_process';
 import { sql } from 'kysely';
@@ -1731,9 +1731,12 @@ var DEFAULT_BUILD_CONFIG = {
   include: [],
   exclude: []
 };
+var DEFAULT_DB_DIR = "db";
+var DEFAULT_SQL_PATH = `./${DEFAULT_DB_DIR}/sql`;
+var DEFAULT_CHANGES_PATH = `./${DEFAULT_DB_DIR}/changes`;
 var DEFAULT_PATH_CONFIG = {
-  sql: "./sql",
-  changes: "./changes"
+  sql: DEFAULT_SQL_PATH,
+  changes: DEFAULT_CHANGES_PATH
 };
 var DEFAULT_STRICT_CONFIG = {
   enabled: false,
@@ -2108,6 +2111,10 @@ var SettingsManager = class {
   /**
    * Initialize a new settings file with defaults.
    *
+   * An overwrite keeps the `paths` already in the file: they say where the
+   * project's files are, not a preference, and resetting them would point a
+   * project laid out elsewhere at directories that do not exist.
+   *
    * @param force - Overwrite existing file if true
    * @throws Error if file exists and force is false
    */
@@ -2116,7 +2123,10 @@ var SettingsManager = class {
     if (fileExists2 && !force) {
       throw new Error("Settings file already exists. Use force=true to overwrite.");
     }
+    const [previous] = fileExists2 ? await attempt(() => this.load()) : [void 0];
+    const keptPaths = previous ? this.#document?.paths : void 0;
     this.#document = createDefaultSettings();
+    if (keptPaths) this.#document.paths = clone(keptPaths);
     this.#refreshResolved();
     this.#loaded = true;
     await this.save();
@@ -4254,7 +4264,7 @@ function buildMssqlTvfWithTvp(rawName, params) {
 
 // src/core/change/types.ts
 function isPendingChange(item) {
-  return !item.orphaned && (item.status === "pending" || item.status === "reverted" || item.status === "stale");
+  return !item.orphaned && (item.status === "pending" || item.status === "reverted" || item.status === "stale" || item.status === "failed" && item.isNew);
 }
 var ChangeValidationError = class extends Error {
   constructor(changeName, issue) {
@@ -4340,10 +4350,31 @@ async function parseChange(folderPath, sqlDir) {
     hasChangelog
   };
 }
+function failureListItem(failure, status) {
+  const { date, description } = parseName(failure.name);
+  return {
+    name: failure.name,
+    path: failure.path,
+    date,
+    description,
+    status: status?.status ?? "failed",
+    appliedAt: status?.appliedAt ?? null,
+    appliedBy: status?.appliedBy ?? null,
+    revertedAt: status?.revertedAt ?? null,
+    errorMessage: status ? status.errorMessage : failure.message,
+    appliedHistoryId: status?.appliedHistoryId ?? null,
+    isNew: !status,
+    orphaned: false
+  };
+}
 async function discoverChanges(changesDir, sqlDir) {
+  const { changes } = await scanChanges(changesDir, sqlDir);
+  return changes;
+}
+async function scanChanges(changesDir, sqlDir) {
   const [exists] = await attempt(() => stat(changesDir));
   if (!exists) {
-    return [];
+    return { changes: [], failures: [] };
   }
   const [entries, readErr] = await attempt(() => readdir(changesDir, { withFileTypes: true }));
   if (readErr) {
@@ -4352,12 +4383,14 @@ async function discoverChanges(changesDir, sqlDir) {
       error: readErr,
       context: { changesDir, operation: "discover" }
     });
-    return [];
+    return { changes: [], failures: [] };
   }
   const folders = entries.filter((e) => e.isDirectory());
   const changes = [];
+  const failures = [];
   for (const folder of folders) {
     const folderPath = path.join(changesDir, folder.name);
+    if (!await looksLikeChange(folderPath)) continue;
     const [change, parseErr] = await attempt(() => parseChange(folderPath, sqlDir));
     if (parseErr) {
       observer.emit("error", {
@@ -4365,11 +4398,15 @@ async function discoverChanges(changesDir, sqlDir) {
         error: parseErr,
         context: { folder: folder.name, operation: "parse" }
       });
+      failures.push({ name: folder.name, path: folderPath, message: parseErr.message });
       continue;
     }
     changes.push(change);
   }
-  return changes.sort((a, b) => a.name.localeCompare(b.name));
+  return {
+    changes: changes.sort((a, b) => a.name.localeCompare(b.name)),
+    failures
+  };
 }
 async function resolveManifest(manifestPath, sqlDir) {
   const [content, readErr] = await attempt(() => readFile(manifestPath, "utf-8"));
@@ -4428,6 +4465,13 @@ function parseName(name) {
   }
   return { date: null, description: name };
 }
+async function looksLikeChange(folderPath) {
+  for (const subfolder of ["change", "revert"]) {
+    const [entry] = await attempt(() => stat(path.join(folderPath, subfolder)));
+    if (entry?.isDirectory()) return true;
+  }
+  return false;
+}
 async function scanFolder(folderPath, sqlDir) {
   const [entries, err] = await attempt(() => readdir(folderPath, { withFileTypes: true }));
   if (err) {
@@ -4786,6 +4830,33 @@ function hydrateDate(value, dialect) {
   }
   return /* @__PURE__ */ new Date(`${value.replace(" ", "T")}Z`);
 }
+function decideNeedsRunFile(record, checksum, force) {
+  if (force) {
+    return { needsRun: true, reason: "force" };
+  }
+  if (record instanceof Error || !record) {
+    return { needsRun: true, reason: "new" };
+  }
+  if (record.exec_status === "failed") {
+    return {
+      needsRun: true,
+      reason: "failed",
+      previousChecksum: record.checksum
+    };
+  }
+  if (record.checksum !== checksum) {
+    return {
+      needsRun: true,
+      reason: "changed",
+      previousChecksum: record.checksum
+    };
+  }
+  return {
+    needsRun: false,
+    skipReason: "already applied",
+    previousChecksum: record.checksum
+  };
+}
 var ChangeHistory = class {
   #db;
   #ndb;
@@ -4965,31 +5036,19 @@ var ChangeHistory = class {
     };
   }
   /**
-   * Check if a single file within a change needs to run.
-   *
-   * Mirrors `Tracker.needsRun` (runner/tracker.ts) but scoped to this
-   * change's name+direction+config instead of a global filepath lookup,
-   * so file A's success under one change never satisfies file A's check
-   * under a different change.
-   *
-   * Excludes `pending` rows from consideration: `createFileRecords`
-   * inserts a fresh pending row for every file before the per-file loop
-   * runs, and that row (always the highest id for this filepath) would
-   * otherwise shadow the prior operation's real success/failure record,
-   * making retries re-run every file instead of just the one that failed.
-   *
-   * Also excludes `skipped` rows: `status: 'skipped'` is written for two
-   * different meanings — `skipRemainingFiles` writes it for files never
-   * reached after an earlier failure (must re-run), while this method's
-   * own per-file-skip path (called from `executor.ts`) writes it for a
-   * file that matched a prior success (must stay skipped). A `skipped`
-   * row is never itself a decision basis: a success-match skip still has
-   * its covering `success` row further back in history (found once the
-   * `skipped` row is excluded), and a never-reached skip has no terminal
-   * row at all, so the lookup falls through to `{ needsRun: true, reason:
-   * 'new' }` below and the file runs. Both resolve correctly without
-   * consulting the ambiguous row — excluding it here is what prevents a
-   * third attempt from re-running a file a prior success already covered.
+   * Fetch the newest qualifying execution row per filepath for one
+   * change and direction.
+   *
+   * Two SELECTs for any number of files: the direction boundary, then the
+   * same query form as `Tracker.latestExecutions`.
+   *
+   * Rows are scoped to this change's name+direction+config, so file A's
+   * success under one change never satisfies file A's check under another.
+   *
+   * `pending` and `skipped` rows never count. Neither records an outcome:
+   * `pending` is a file its batch never reached, and `skipped` is written by
+   * `skipRemainingFiles` for the same reason, or by older versions for a
+   * file that matched a success still further back in history.
    *
    * A prior success only licenses a skip while it is still *standing*.
    * Two things retire it, and neither is visible on the execution row
@@ -5010,72 +5069,56 @@ var ChangeHistory = class {
    *
    * @param name - Change name
    * @param direction - 'change' or 'revert'
-   * @param filepath - Relative filepath as stored in execution records
-   * @param checksum - Current checksum of the file
-   * @param force - Force re-run regardless of status
-   * @returns Whether the file needs to run and why
+   * @returns Map of relative filepath to its newest qualifying row, or the lookup error
+   *
+   * @example
+   * ```typescript
+   * const [latest, err] = await history.latestFileExecutions('2024-01-15-add-users', 'change')
+   * const result = decideNeedsRunFile(err ?? latest.get(filepath), checksum, false)
+   * ```
    */
-  async needsRunFile(name, direction, filepath, checksum, force) {
-    if (force) {
-      return { needsRun: true, reason: "force" };
-    }
+  async latestFileExecutions(name, direction) {
+    const { executions, change } = this.#tables;
     const opposite = direction === "change" ? "revert" : "change";
     const [boundary, boundaryErr] = await attempt(
-      () => this.#ndb.selectFrom(this.#tables.change).select(["id"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", opposite).where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
+      () => this.#ndb.selectFrom(change).select(["id"]).where("name", "=", name).where("change_type", "=", "change").where("direction", "=", opposite).where("config_name", "=", this.#configName).orderBy("id", "desc").limit(1).executeTakeFirst()
     );
     if (boundaryErr) {
       observer.emit("error", {
         source: "change",
         error: boundaryErr,
-        context: { name, filepath, operation: "needs-run-file-boundary" }
+        context: { name, operation: "latest-file-executions-boundary" }
       });
-      return { needsRun: true, reason: "new" };
+      return [null, boundaryErr];
+    }
+    let qualifying = this.#ndb.selectFrom(executions).innerJoin(change, `${change}.id`, `${executions}.change_id`).where(`${change}.name`, "=", name).where(`${change}.direction`, "=", direction).where(`${change}.config_name`, "=", this.#configName).where(`${change}.status`, "not in", ["reverted", "stale"]).where(`${executions}.status`, "not in", ["pending", "skipped"]);
+    if (boundary) {
+      qualifying = qualifying.where(`${change}.id`, ">", boundary.id);
     }
-    const [record, err] = await attempt(() => {
-      let query = this.#ndb.selectFrom(this.#tables.executions).innerJoin(
-        this.#tables.change,
-        `${this.#tables.change}.id`,
-        `${this.#tables.executions}.change_id`
+    const newestIds = qualifying.select((eb) => eb.fn.max(`${executions}.id`).as("id")).groupBy(`${executions}.filepath`).as("newest");
+    const [rows, err] = await attempt(
+      () => (
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      ).select((eb) => [
-        eb.ref(`${this.#tables.executions}.checksum`).as("checksum"),
-        eb.ref(`${this.#tables.executions}.status`).as("exec_status")
-      ]).where(`${this.#tables.change}.name`, "=", name).where(`${this.#tables.change}.direction`, "=", direction).where(`${this.#tables.change}.config_name`, "=", this.#configName).where(`${this.#tables.change}.status`, "not in", ["reverted", "stale"]).where(`${this.#tables.executions}.filepath`, "=", filepath).where(`${this.#tables.executions}.status`, "not in", ["pending", "skipped"]);
-      if (boundary) {
-        query = query.where(`${this.#tables.change}.id`, ">", boundary.id);
-      }
-      return query.orderBy(`${this.#tables.executions}.id`, "desc").limit(1).executeTakeFirst();
-    });
+        this.#ndb.selectFrom(executions).innerJoin(newestIds, "newest.id", `${executions}.id`).select((eb) => [
+          eb.ref(`${executions}.filepath`).as("filepath"),
+          eb.ref(`${executions}.checksum`).as("checksum"),
+          eb.ref(`${executions}.status`).as("exec_status")
+        ]).execute()
+      )
+    );
     if (err) {
       observer.emit("error", {
         source: "change",
         error: err,
-        context: { name, filepath, operation: "needs-run-file-check" }
+        context: { name, operation: "latest-file-executions" }
       });
-      return { needsRun: true, reason: "new" };
-    }
-    if (!record) {
-      return { needsRun: true, reason: "new" };
-    }
-    if (record.exec_status === "failed") {
-      return {
-        needsRun: true,
-        reason: "failed",
-        previousChecksum: record.checksum
-      };
+      return [null, err];
     }
-    if (record.checksum !== checksum) {
-      return {
-        needsRun: true,
-        reason: "changed",
-        previousChecksum: record.checksum
-      };
+    const latest = /* @__PURE__ */ new Map();
+    for (const { filepath, ...record } of rows) {
+      latest.set(filepath, record);
     }
-    return {
-      needsRun: false,
-      skipReason: "already applied",
-      previousChecksum: record.checksum
-    };
+    return [latest, null];
   }
   // ─────────────────────────────────────────────────────────
   // Create Records
@@ -5113,9 +5156,10 @@ var ChangeHistory = class {
     return id;
   }
   /**
-   * Create pending file records for all files.
+   * Create pending file records for the files about to run.
    *
-   * Creates records upfront so we can mark remaining as skipped on failure.
+   * The pending rows let `skipRemainingFiles` mark the files a
+   * failure left unreached.
    *
    * @returns Error message if creation failed, null on success
    */
@@ -5481,6 +5525,44 @@ var ChangeHistory = class {
 };
 
 // src/core/runner/tracker.ts
+function decideNeedsRun(record, checksum, force) {
+  if (record instanceof Error) {
+    return { needsRun: true, reason: "error" };
+  }
+  if (!record) {
+    return { needsRun: true, reason: "new" };
+  }
+  if (record.exec_status === "failed") {
+    return {
+      needsRun: true,
+      reason: "failed",
+      previousChecksum: record.checksum
+    };
+  }
+  const isUnchangedSkip = record.exec_status === "skipped" && record.skip_reason === "unchanged";
+  if (record.exec_status === "pending" || record.exec_status === "skipped" && !isUnchangedSkip) {
+    return { needsRun: true, reason: "new" };
+  }
+  if (record.change_status === "stale") {
+    return {
+      needsRun: true,
+      reason: "stale",
+      previousChecksum: record.checksum
+    };
+  }
+  if (record.checksum !== checksum) {
+    return {
+      needsRun: true,
+      reason: "changed",
+      previousChecksum: record.checksum
+    };
+  }
+  return {
+    needsRun: false,
+    skipReason: "unchanged",
+    previousChecksum: record.checksum
+  };
+}
 var Tracker = class {
   #db;
   #ndb;
@@ -5495,89 +5577,45 @@ var Tracker = class {
     this.#dialect = dialect;
   }
   /**
-   * Check if a file needs to run.
+   * Fetch the newest execution row per filepath for this config.
    *
-   * A file needs to run if:
-   * - Force flag is set
-   * - No previous execution exists (new file)
-   * - Previous execution failed
-   * - Parent change is stale (schema was torn down)
-   * - Checksum differs (file changed)
+   * One SELECT for any number of files, so a batch can decide every file
+   * with `decideNeedsRun` before writing any tracking rows. Query form:
+   * `docs/design/prefetch-run-gate.md`.
    *
-   * @param filepath - File path to check
-   * @param checksum - Current file checksum
-   * @param force - Force re-run regardless of status
-   * @param excludeOperationId - Operation whose own rows should be ignored.
-   * `executeFiles` inserts a `pending` row for every discovered file
-   * *before* running any of them (for batch visibility), so within that
-   * same operation the newest row for a file is always its own pending
-   * record — reading as "new" forever and making checksum-based skipping
-   * unreachable. Passing the running operation's id here excludes those
-   * rows so the lookup finds the last *completed* operation instead.
-   * @returns Whether file needs to run and why
-   */
-  async needsRun(filepath, checksum, force, excludeOperationId) {
-    if (force) {
-      return { needsRun: true, reason: "force" };
-    }
-    let query = this.#ndb.selectFrom(this.#tables.executions).innerJoin(
-      this.#tables.change,
-      `${this.#tables.change}.id`,
-      `${this.#tables.executions}.change_id`
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    ).select((eb) => [
-      eb.ref(`${this.#tables.executions}.checksum`).as("checksum"),
-      eb.ref(`${this.#tables.executions}.status`).as("exec_status"),
-      eb.ref(`${this.#tables.executions}.skip_reason`).as("skip_reason"),
-      eb.ref(`${this.#tables.change}.status`).as("change_status")
-    ]).where(`${this.#tables.executions}.filepath`, "=", filepath).where(`${this.#tables.change}.config_name`, "=", this.#configName);
-    if (excludeOperationId !== void 0) {
-      query = query.where(`${this.#tables.executions}.change_id`, "<>", excludeOperationId);
-    }
-    const [record, err] = await attempt(
-      () => query.orderBy(`${this.#tables.executions}.id`, "desc").limit(1).executeTakeFirst()
+   * @returns Map of filepath to its newest record, or the lookup error
+   *
+   * @example
+   * ```typescript
+   * const [latest, err] = await tracker.latestExecutions()
+   * const result = decideNeedsRun(err ?? latest.get(filepath), checksum, false)
+   * ```
+   */
+  async latestExecutions() {
+    const { executions, change } = this.#tables;
+    const newestIds = this.#ndb.selectFrom(executions).innerJoin(change, `${change}.id`, `${executions}.change_id`).where(`${change}.config_name`, "=", this.#configName).select((eb) => eb.fn.max(`${executions}.id`).as("id")).groupBy(`${executions}.filepath`).as("newest");
+    const [rows, err] = await attempt(
+      () => this.#ndb.selectFrom(executions).innerJoin(change, `${change}.id`, `${executions}.change_id`).innerJoin(newestIds, "newest.id", `${executions}.id`).select((eb) => [
+        eb.ref(`${executions}.filepath`).as("filepath"),
+        eb.ref(`${executions}.checksum`).as("checksum"),
+        eb.ref(`${executions}.status`).as("exec_status"),
+        eb.ref(`${executions}.skip_reason`).as("skip_reason"),
+        eb.ref(`${change}.status`).as("change_status")
+      ]).execute()
     );
     if (err) {
       observer.emit("error", {
         source: "runner",
         error: err,
-        context: { filepath, operation: "needs-run-check" }
+        context: { operation: "latest-executions" }
       });
-      return { needsRun: true, reason: "error" };
-    }
-    if (!record) {
-      return { needsRun: true, reason: "new" };
-    }
-    if (record.exec_status === "failed") {
-      return {
-        needsRun: true,
-        reason: "failed",
-        previousChecksum: record.checksum
-      };
-    }
-    const isUnchangedSkip = record.exec_status === "skipped" && record.skip_reason === "unchanged";
-    if (record.exec_status === "pending" || record.exec_status === "skipped" && !isUnchangedSkip) {
-      return { needsRun: true, reason: "new" };
-    }
-    if (record.change_status === "stale") {
-      return {
-        needsRun: true,
-        reason: "stale",
-        previousChecksum: record.checksum
-      };
+      return [null, err];
     }
-    if (record.checksum !== checksum) {
-      return {
-        needsRun: true,
-        reason: "changed",
-        previousChecksum: record.checksum
-      };
+    const latest = /* @__PURE__ */ new Map();
+    for (const { filepath, ...record } of rows) {
+      latest.set(filepath, record);
     }
-    return {
-      needsRun: false,
-      skipReason: "unchanged",
-      previousChecksum: record.checksum
-    };
+    return [latest, null];
   }
   /**
    * Create a new operation record.
@@ -5613,35 +5651,6 @@ var Tracker = class {
     }
     return id;
   }
-  /**
-   * Record a file execution.
-   *
-   * Creates a child record in __noorm_executions__ linked
-   * to the parent operation.
-   *
-   * @param data - Execution data
-   */
-  async recordExecution(data2) {
-    const [, err] = await attempt(
-      () => this.#ndb.insertInto(this.#tables.executions).values({
-        change_id: data2.changeId,
-        filepath: data2.filepath,
-        file_type: "sql",
-        checksum: data2.checksum,
-        status: data2.status,
-        skip_reason: data2.skipReason ?? "",
-        error_message: data2.errorMessage ?? "",
-        duration_ms: Math.round(data2.durationMs ?? 0)
-      }).execute()
-    );
-    if (err) {
-      observer.emit("error", {
-        source: "runner",
-        error: err,
-        context: { filepath: data2.filepath, operation: "record-execution" }
-      });
-    }
-  }
   /**
    * Finalize an operation.
    *
@@ -5689,10 +5698,10 @@ var Tracker = class {
   // Batch File Operations (Shared by Runner and Changes)
   // ─────────────────────────────────────────────────────────
   /**
-   * Create pending file records for all files upfront.
+   * Create pending file records for the files about to run.
    *
-   * Creates records so the batch is fully visible. On failure,
-   * remaining files can be marked as skipped.
+   * The pending rows let `skipRemainingFiles` mark the files a
+   * failure left unreached.
    *
    * @param operationId - Parent operation ID
    * @param files - Files to create records for
@@ -5732,23 +5741,15 @@ var Tracker = class {
    * @param durationMs - Execution time
    * @param errorMessage - Error message if failed
    * @param skipReason - Skip reason if skipped
-   * @param checksum - Checksum of the SQL that actually reached the
-   * database. `createFileRecords` seeds the pending row with the *raw*
-   * file hash because rendering every template upfront would execute them
-   * twice; for a `.sql.tmpl` that hash is not what `needsRun` compares
-   * against, so leaving it in place made template dedup unreachable.
-   * Omitted leaves the seeded value alone — correct only where no render
-   * happened (e.g. the file could not be read).
    * @returns Error message if update failed, null on success
    */
-  async updateFileExecution(operationId, filepath, status, durationMs, errorMessage, skipReason, checksum) {
+  async updateFileExecution(operationId, filepath, status, durationMs, errorMessage, skipReason) {
     const [result, err] = await attempt(
       () => this.#ndb.updateTable(this.#tables.executions).set({
         status,
         duration_ms: Math.round(durationMs),
         error_message: errorMessage ?? "",
-        skip_reason: skipReason ?? "",
-        ...checksum === void 0 ? {} : { checksum }
+        skip_reason: skipReason ?? ""
       }).where("change_id", "=", operationId).where("filepath", "=", filepath).executeTakeFirst()
     );
     if (err) {
@@ -5842,7 +5843,6 @@ var Tracker = class {
   /**
    * Check if a change needs to run by name.
    *
-   * Similar to needsRun but checks by change name instead of filepath.
    * Used for change sets where we track by change name, not individual files.
    *
    * @param name - Change name
@@ -6363,105 +6363,264 @@ var StatementWatcher = class {
   }
 };
 
-// src/core/lock/types.ts
-var DEFAULT_LOCK_OPTIONS = {
-  dialect: "postgres",
-  timeout: 5 * 60 * 1e3,
-  // 5 minutes
-  wait: false,
-  waitTimeout: 30 * 1e3,
-  // 30 seconds
-  pollInterval: 1e3
-  // 1 second
-};
-
-// src/core/lock/errors.ts
-var LockAcquireError = class extends Error {
-  constructor(configName, holder, heldSince, expiresAt, reason) {
-    const since = heldSince.toISOString();
-    const expires = expiresAt.toISOString();
-    const reasonSuffix = reason ? ` (${reason})` : "";
-    super(
-      `Lock for '${configName}' held by ${holder} since ${since}, expires ${expires}${reasonSuffix}`
-    );
-    this.configName = configName;
-    this.holder = holder;
-    this.heldSince = heldSince;
-    this.expiresAt = expiresAt;
-    this.reason = reason;
-  }
-  name = "LockAcquireError";
-};
-var LockExpiredError = class extends Error {
-  constructor(configName, identity, expiredAt) {
-    super(`Lock for '${configName}' expired at ${expiredAt.toISOString()}`);
-    this.configName = configName;
-    this.identity = identity;
-    this.expiredAt = expiredAt;
-  }
-  name = "LockExpiredError";
-};
-var LockNotFoundError = class extends Error {
-  constructor(configName, identity) {
-    super(`No lock found for '${configName}' held by ${identity}`);
-    this.configName = configName;
-    this.identity = identity;
-  }
-  name = "LockNotFoundError";
-};
-var LockOwnershipError = class extends Error {
-  constructor(configName, requestedBy, actualHolder) {
-    super(
-      `Cannot release lock for '${configName}': held by ${actualHolder}, not ${requestedBy}`
-    );
-    this.configName = configName;
-    this.requestedBy = requestedBy;
-    this.actualHolder = actualHolder;
-  }
-  name = "LockOwnershipError";
+// src/core/runner/sqlite-statements.ts
+var QUOTE_PAIRS = {
+  "'": "'",
+  '"': '"',
+  "`": "`",
+  "[": "]"
 };
-
-// src/core/lock/manager.ts
-function formatDateForDialect(date, dialect) {
-  if (dialect === "sqlite") {
-    return date.toISOString();
-  }
-  if (dialect === "mssql") {
-    return date;
-  }
-  return date.toISOString().replace("T", " ").replace("Z", "");
-}
-function parseDateFromDialect(value, dialect) {
-  if (dialect === "sqlite" || dialect === "mssql") {
-    return new Date(value);
-  }
-  if (value instanceof Date) {
-    return new Date(Date.UTC(
-      value.getFullYear(),
-      value.getMonth(),
-      value.getDate(),
-      value.getHours(),
-      value.getMinutes(),
-      value.getSeconds(),
-      value.getMilliseconds()
-    ));
-  }
-  const normalized = String(value).replace(" ", "T");
-  return new Date(normalized.endsWith("Z") ? normalized : `${normalized}Z`);
+function keywordAt(content, index, keyword) {
+  const end = index + keyword.length;
+  if (content.slice(index, end).toUpperCase() !== keyword) return false;
+  const before = index > 0 ? content[index - 1] : " ";
+  const after = end < content.length ? content[end] : " ";
+  return !/[A-Za-z0-9_$]/.test(before) && !/[A-Za-z0-9_$]/.test(after);
 }
-var LockManager = class {
-  /**
-   * Acquire a lock for a config.
-   *
-   * If the lock is held by another identity and wait=false, throws LockAcquireError.
-   * If wait=true, polls until lock is available or waitTimeout is exceeded.
-   *
-   * @param db - Kysely database instance
-   * @param configName - Config/database scope for the lock
-   * @param identity - Identity string of the requester
-   * @param options - Lock options
-   * @returns Lock state on success
-   * @throws LockAcquireError if lock cannot be acquired
+function splitSqliteStatements(content) {
+  const statements = [];
+  let current = "";
+  let closingQuote = null;
+  let inLineComment = false;
+  let inBlockComment = false;
+  let inTrigger = false;
+  let blockDepth = 0;
+  let i = 0;
+  const flush = () => {
+    const trimmed = current.trim();
+    if (trimmed.length > 0 && !isCommentOnly(trimmed)) {
+      statements.push(trimmed);
+    }
+    current = "";
+  };
+  while (i < content.length) {
+    const char = content[i];
+    if (inLineComment) {
+      current += char;
+      if (char === "\n") inLineComment = false;
+      i++;
+      continue;
+    }
+    if (inBlockComment) {
+      current += char;
+      if (char === "*" && content[i + 1] === "/") {
+        current += "/";
+        inBlockComment = false;
+        i += 2;
+        continue;
+      }
+      i++;
+      continue;
+    }
+    if (closingQuote !== null) {
+      current += char;
+      if (char === closingQuote) {
+        if (closingQuote !== "]" && content[i + 1] === closingQuote) {
+          current += closingQuote;
+          i += 2;
+          continue;
+        }
+        closingQuote = null;
+      }
+      i++;
+      continue;
+    }
+    if (char === "-" && content[i + 1] === "-") {
+      inLineComment = true;
+      current += "--";
+      i += 2;
+      continue;
+    }
+    if (char === "/" && content[i + 1] === "*") {
+      inBlockComment = true;
+      current += "/*";
+      i += 2;
+      continue;
+    }
+    if (QUOTE_PAIRS[char]) {
+      closingQuote = QUOTE_PAIRS[char];
+      current += char;
+      i++;
+      continue;
+    }
+    if (!inTrigger && keywordAt(content, i, "TRIGGER")) {
+      inTrigger = true;
+      current += content.slice(i, i + 7);
+      i += 7;
+      continue;
+    }
+    if (inTrigger && (keywordAt(content, i, "BEGIN") || keywordAt(content, i, "CASE"))) {
+      const length = keywordAt(content, i, "BEGIN") ? 5 : 4;
+      blockDepth++;
+      current += content.slice(i, i + length);
+      i += length;
+      continue;
+    }
+    if (inTrigger && blockDepth > 0 && keywordAt(content, i, "END")) {
+      blockDepth--;
+      if (blockDepth === 0) inTrigger = false;
+      current += content.slice(i, i + 3);
+      i += 3;
+      continue;
+    }
+    if (char === ";" && blockDepth === 0) {
+      current += char;
+      inTrigger = false;
+      flush();
+      i++;
+      continue;
+    }
+    current += char;
+    i++;
+  }
+  flush();
+  return statements;
+}
+function isCommentOnly(fragment) {
+  const withoutBlockComments = fragment.replace(/\/\*[\s\S]*?\*\//g, "");
+  return withoutBlockComments.split("\n").every((line) => {
+    const trimmed = line.trim();
+    return trimmed.length === 0 || trimmed.startsWith("--");
+  });
+}
+
+// src/core/runner/mssql-batches.ts
+function splitMssqlBatches(content) {
+  const batches = content.split(/^\s*GO\s*$/mi);
+  return batches.map((b) => b.trim()).filter((b) => b.length > 0 && !isCommentOnly2(b));
+}
+function isCommentOnly2(batch) {
+  for (const line of batch.split("\n")) {
+    const trimmed = line.trim();
+    if (trimmed.length > 0 && !trimmed.startsWith("--")) {
+      return false;
+    }
+  }
+  return true;
+}
+async function executeSqlBody(context, sqlContent) {
+  if (context.dialect === "mssql") {
+    return executeFragments(context, splitMssqlBatches(sqlContent), "batch");
+  }
+  if (context.dialect === "sqlite") {
+    return executeFragments(context, splitSqliteStatements(sqlContent), "statement");
+  }
+  const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
+  if (execErr) {
+    return getSqlErrorMessage(execErr);
+  }
+  return null;
+}
+async function executeFragments(context, fragments, label) {
+  for (let i = 0; i < fragments.length; i++) {
+    const [, execErr] = await attempt(() => sql.raw(fragments[i]).execute(context.db));
+    if (execErr) {
+      const message = getSqlErrorMessage(execErr);
+      return fragments.length === 1 ? message : `[${label} ${i + 1} of ${fragments.length}] ${message}`;
+    }
+  }
+  return null;
+}
+
+// src/core/lock/types.ts
+var DEFAULT_LOCK_OPTIONS = {
+  dialect: "postgres",
+  timeout: 5 * 60 * 1e3,
+  // 5 minutes
+  wait: false,
+  waitTimeout: 30 * 1e3,
+  // 30 seconds
+  pollInterval: 1e3
+  // 1 second
+};
+
+// src/core/lock/errors.ts
+var LockAcquireError = class extends Error {
+  constructor(configName, holder, heldSince, expiresAt, reason) {
+    const since = heldSince.toISOString();
+    const expires = expiresAt.toISOString();
+    const reasonSuffix = reason ? ` (${reason})` : "";
+    super(
+      `Lock for '${configName}' held by ${holder} since ${since}, expires ${expires}${reasonSuffix}`
+    );
+    this.configName = configName;
+    this.holder = holder;
+    this.heldSince = heldSince;
+    this.expiresAt = expiresAt;
+    this.reason = reason;
+  }
+  name = "LockAcquireError";
+};
+var LockExpiredError = class extends Error {
+  constructor(configName, identity, expiredAt) {
+    super(`Lock for '${configName}' expired at ${expiredAt.toISOString()}`);
+    this.configName = configName;
+    this.identity = identity;
+    this.expiredAt = expiredAt;
+  }
+  name = "LockExpiredError";
+};
+var LockNotFoundError = class extends Error {
+  constructor(configName, identity) {
+    super(`No lock found for '${configName}' held by ${identity}`);
+    this.configName = configName;
+    this.identity = identity;
+  }
+  name = "LockNotFoundError";
+};
+var LockOwnershipError = class extends Error {
+  constructor(configName, requestedBy, actualHolder) {
+    super(
+      `Cannot release lock for '${configName}': held by ${actualHolder}, not ${requestedBy}`
+    );
+    this.configName = configName;
+    this.requestedBy = requestedBy;
+    this.actualHolder = actualHolder;
+  }
+  name = "LockOwnershipError";
+};
+
+// src/core/lock/manager.ts
+function formatDateForDialect(date, dialect) {
+  if (dialect === "sqlite") {
+    return date.toISOString();
+  }
+  if (dialect === "mssql") {
+    return date;
+  }
+  return date.toISOString().replace("T", " ").replace("Z", "");
+}
+function parseDateFromDialect(value, dialect) {
+  if (dialect === "sqlite" || dialect === "mssql") {
+    return new Date(value);
+  }
+  if (value instanceof Date) {
+    return new Date(Date.UTC(
+      value.getFullYear(),
+      value.getMonth(),
+      value.getDate(),
+      value.getHours(),
+      value.getMinutes(),
+      value.getSeconds(),
+      value.getMilliseconds()
+    ));
+  }
+  const normalized = String(value).replace(" ", "T");
+  return new Date(normalized.endsWith("Z") ? normalized : `${normalized}Z`);
+}
+var LockManager = class {
+  /**
+   * Acquire a lock for a config.
+   *
+   * If the lock is held by another identity and wait=false, throws LockAcquireError.
+   * If wait=true, polls until lock is available or waitTimeout is exceeded.
+   *
+   * @param db - Kysely database instance
+   * @param configName - Config/database scope for the lock
+   * @param identity - Identity string of the requester
+   * @param options - Lock options
+   * @returns Lock state on success
+   * @throws LockAcquireError if lock cannot be acquired
    */
   async acquire(db, configName, identity, options = {}) {
     const opts = { ...DEFAULT_LOCK_OPTIONS, ...options };
@@ -7007,6 +7166,12 @@ async function executeFiles(context, change, files, direction, checksum, force,
   return result;
 }
 async function runFileBatch(context, change, expandedFiles, direction, checksum, force, history, executor, startTime, watcher) {
+  const fileChecksums = /* @__PURE__ */ new Map();
+  for (const file of expandedFiles) {
+    const [cs] = await attempt(() => computeChecksum(file.path));
+    fileChecksums.set(file.path, cs ?? "");
+  }
+  const skipReasons = await findSkippedFiles(context, change.name, direction, expandedFiles, fileChecksums, force, history);
   const [operationId, createErr] = await attempt(
     () => history.createOperation({
       name: change.name,
@@ -7022,14 +7187,9 @@ async function runFileBatch(context, change, expandedFiles, direction, checksum,
     });
     return createFailedResult(change.name, direction, createErr.message, startTime);
   }
-  const fileChecksums = /* @__PURE__ */ new Map();
-  for (const file of expandedFiles) {
-    const [cs] = await attempt(() => computeChecksum(file.path));
-    fileChecksums.set(file.path, cs ?? "");
-  }
   const createRecordsErr = await history.createFileRecords(
     operationId,
-    expandedFiles.map((f) => ({
+    expandedFiles.filter((_, i) => !skipReasons[i]).map((f) => ({
       filepath: path.relative(context.projectRoot, f.path),
       fileType: f.type,
       checksum: fileChecksums.get(f.path) ?? ""
@@ -7069,36 +7229,15 @@ async function runFileBatch(context, change, expandedFiles, direction, checksum,
       const fileStart = performance.now();
       const relPath = path.relative(context.projectRoot, file.path);
       const fileChecksum = fileChecksums.get(file.path) ?? "";
-      const needsRunFileResult = await history.needsRunFile(
-        change.name,
-        direction,
-        relPath,
-        fileChecksum,
-        force
-      );
-      if (!needsRunFileResult.needsRun) {
+      const skipReason = skipReasons[i];
+      if (skipReason) {
         results.push({
           filepath: file.path,
           checksum: fileChecksum,
           status: "skipped",
-          skipReason: needsRunFileResult.skipReason,
+          skipReason,
           durationMs: 0
         });
-        const skipUpdateErr = await history.updateFileExecution(
-          operationId,
-          relPath,
-          "skipped",
-          0,
-          void 0,
-          needsRunFileResult.skipReason
-        );
-        if (skipUpdateErr) {
-          observer.emit("error", {
-            source: "change",
-            error: new Error(skipUpdateErr),
-            context: { filepath: relPath, operation: "update-skipped-record" }
-          });
-        }
         continue;
       }
       const [sqlContent, loadErr] = await attempt(() => loadAndRenderFile(context, file.path));
@@ -7130,12 +7269,12 @@ async function runFileBatch(context, change, expandedFiles, direction, checksum,
         }
         break;
       }
-      const [, execErr] = await attempt(
-        () => watcher.run(file.path, executor, (conn) => sql.raw(sqlContent).execute(conn))
+      const [execMessage, execErr] = await attempt(
+        () => watcher.run(file.path, executor, (conn) => executeSqlBody({ db: conn, dialect: context.dialect }, sqlContent))
       );
       const durationMs = performance.now() - fileStart;
-      if (execErr) {
-        const errorMessage2 = getSqlErrorMessage(execErr);
+      const errorMessage2 = execErr ? getSqlErrorMessage(execErr) : execMessage;
+      if (errorMessage2) {
         failed = true;
         failedFile = file.path;
         failureError = errorMessage2;
@@ -7233,6 +7372,22 @@ async function runFileBatch(context, change, expandedFiles, direction, checksum,
     operationId
   };
 }
+async function findSkippedFiles(context, changeName, direction, files, fileChecksums, force, history) {
+  const skipReasons = [];
+  const seen = /* @__PURE__ */ new Set();
+  const [latest, latestErr] = force ? [null, null] : await history.latestFileExecutions(changeName, direction);
+  for (const file of files) {
+    const relPath = path.relative(context.projectRoot, file.path);
+    if (seen.has(relPath)) {
+      skipReasons.push("already applied");
+      continue;
+    }
+    seen.add(relPath);
+    const decision = decideNeedsRunFile(latestErr ?? latest?.get(relPath), fileChecksums.get(file.path) ?? "", force);
+    skipReasons.push(decision.needsRun ? void 0 : decision.skipReason);
+  }
+  return skipReasons;
+}
 async function executePreview(context, change, files, direction, output, startTime) {
   const expandedFiles = await expandFiles(files, context.sqlDir);
   const results = [];
@@ -7457,17 +7612,31 @@ var ChangeManager = class {
    * List all changes with status.
    *
    * Merges changes from disk with status from database.
-   * Includes orphaned changes (in DB but not on disk).
+   * Includes orphaned changes (in DB but not on disk), and folders on disk
+   * that cannot be parsed: `failed` with the parse error when they never
+   * ran, otherwise their recorded status.
    *
    * @returns Array of changes with merged status
    */
   async list() {
-    const diskChanges = await discoverChanges(
+    const { items } = await this.#scan();
+    return items;
+  }
+  /**
+   * Merge disk and database state, and report the folders that cannot be read.
+   *
+   * An unreadable folder that a batch would run (never run, or `reverted` or
+   * `stale`) is pending work: the batch fails at its position rather than
+   * skipping it and running later changes out of order. `unreadable` holds the
+   * applied ones; they keep their status and only warrant a warning.
+   */
+  async #scan() {
+    const { changes: diskChanges, failures } = await scanChanges(
       this.#context.changesDir,
       this.#context.sqlDir
     );
     const statuses = await this.#history.getAllStatuses();
-    const diskNames = new Set(diskChanges.map((cs) => cs.name));
+    const diskNames = new Set([...diskChanges, ...failures].map((cs) => cs.name));
     const orphanedNames = await this.#history.getOrphaned(diskNames);
     const result = [];
     for (const cs of diskChanges) {
@@ -7485,6 +7654,15 @@ var ChangeManager = class {
         orphaned: false
       });
     }
+    const unreadable = [];
+    for (const failure of failures) {
+      const status = statuses.get(failure.name);
+      const item = failureListItem(failure, status);
+      if (!isPendingChange(item)) {
+        unreadable.push(failure);
+      }
+      result.push(item);
+    }
     for (const name of orphanedNames) {
       const status = statuses.get(name);
       result.push({
@@ -7506,7 +7684,10 @@ var ChangeManager = class {
         hasChangelog: void 0
       });
     }
-    return result.sort((a, b) => a.name.localeCompare(b.name));
+    return {
+      items: result.sort((a, b) => a.name.localeCompare(b.name)),
+      unreadable
+    };
   }
   // ─────────────────────────────────────────────────────────
   // Run Single Change
@@ -7561,9 +7742,13 @@ var ChangeManager = class {
   async next(count = 1, options = {}) {
     const opts = { ...DEFAULT_BATCH, ...options };
     const start = performance.now();
-    const warnings = await this.#collectWarnings();
-    const list = await this.list();
-    const pending = list.filter(isPendingChange).slice(0, count);
+    const { items, unreadable } = await this.#scan();
+    const messages = [
+      ...await this.#collectWarnings() ?? [],
+      ...unreadable.map((f) => `Change '${f.name}' is applied but its files can no longer be read: ${f.message}`)
+    ];
+    const warnings = messages.length > 0 ? messages : void 0;
+    const pending = items.filter(isPendingChange).slice(0, count);
     if (pending.length === 0) {
       return {
         status: "success",
@@ -7631,9 +7816,7 @@ var ChangeManager = class {
    * @returns Batch result
    */
   async ff(options = {}) {
-    const list = await this.list();
-    const pendingCount = list.filter(isPendingChange).length;
-    return this.next(pendingCount, options);
+    return this.next(Number.POSITIVE_INFINITY, options);
   }
   /**
    * Rewind: revert changes in reverse order.
@@ -7802,6 +7985,8 @@ var ChangeManager = class {
       () => parseChange(changePath, this.#context.sqlDir)
     );
     if (err) {
+      const [onDisk] = await attempt(() => stat(changePath));
+      if (onDisk) throw err;
       const status = await this.#history.getStatus(name);
       if (status) {
         throw new ChangeOrphanedError(name);
@@ -7903,7 +8088,7 @@ async function resolveVaultKey(db, dialect) {
 async function buildSecretsContext(stateManager, configName, db, vaultKey, dialect) {
   const secrets = {};
   if (db && vaultKey) {
-    const { getAllVaultSecrets: getAllVaultSecrets2 } = await import('./storage-FBDOY3MC.js');
+    const { getAllVaultSecrets: getAllVaultSecrets2 } = await import('./storage-NQA4H7PK.js');
     const vaultSecrets = await getAllVaultSecrets2(db, vaultKey, dialect ?? "postgres");
     for (const [key, secret] of Object.entries(vaultSecrets)) {
       secrets[key] = secret.value;
@@ -8427,13 +8612,13 @@ var ChangesNamespace = class {
   get #changesDir() {
     return path.join(
       this.#state.projectRoot,
-      this.#state.settings.paths?.changes ?? "changes"
+      this.#state.settings.paths?.changes ?? DEFAULT_CHANGES_PATH
     );
   }
   get #sqlDir() {
     return path.join(
       this.#state.projectRoot,
-      this.#state.settings.paths?.sql ?? "sql"
+      this.#state.settings.paths?.sql ?? DEFAULT_SQL_PATH
     );
   }
   get #kysely() {
@@ -8466,167 +8651,6 @@ var ChangesNamespace = class {
     return this.#manager;
   }
 };
-
-// src/core/runner/sqlite-statements.ts
-var QUOTE_PAIRS = {
-  "'": "'",
-  '"': '"',
-  "`": "`",
-  "[": "]"
-};
-function keywordAt(content, index, keyword) {
-  const end = index + keyword.length;
-  if (content.slice(index, end).toUpperCase() !== keyword) return false;
-  const before = index > 0 ? content[index - 1] : " ";
-  const after = end < content.length ? content[end] : " ";
-  return !/[A-Za-z0-9_$]/.test(before) && !/[A-Za-z0-9_$]/.test(after);
-}
-function splitSqliteStatements(content) {
-  const statements = [];
-  let current = "";
-  let closingQuote = null;
-  let inLineComment = false;
-  let inBlockComment = false;
-  let inTrigger = false;
-  let blockDepth = 0;
-  let i = 0;
-  const flush = () => {
-    const trimmed = current.trim();
-    if (trimmed.length > 0 && !isCommentOnly(trimmed)) {
-      statements.push(trimmed);
-    }
-    current = "";
-  };
-  while (i < content.length) {
-    const char = content[i];
-    if (inLineComment) {
-      current += char;
-      if (char === "\n") inLineComment = false;
-      i++;
-      continue;
-    }
-    if (inBlockComment) {
-      current += char;
-      if (char === "*" && content[i + 1] === "/") {
-        current += "/";
-        inBlockComment = false;
-        i += 2;
-        continue;
-      }
-      i++;
-      continue;
-    }
-    if (closingQuote !== null) {
-      current += char;
-      if (char === closingQuote) {
-        if (closingQuote !== "]" && content[i + 1] === closingQuote) {
-          current += closingQuote;
-          i += 2;
-          continue;
-        }
-        closingQuote = null;
-      }
-      i++;
-      continue;
-    }
-    if (char === "-" && content[i + 1] === "-") {
-      inLineComment = true;
-      current += "--";
-      i += 2;
-      continue;
-    }
-    if (char === "/" && content[i + 1] === "*") {
-      inBlockComment = true;
-      current += "/*";
-      i += 2;
-      continue;
-    }
-    if (QUOTE_PAIRS[char]) {
-      closingQuote = QUOTE_PAIRS[char];
-      current += char;
-      i++;
-      continue;
-    }
-    if (!inTrigger && keywordAt(content, i, "TRIGGER")) {
-      inTrigger = true;
-      current += content.slice(i, i + 7);
-      i += 7;
-      continue;
-    }
-    if (inTrigger && (keywordAt(content, i, "BEGIN") || keywordAt(content, i, "CASE"))) {
-      const length = keywordAt(content, i, "BEGIN") ? 5 : 4;
-      blockDepth++;
-      current += content.slice(i, i + length);
-      i += length;
-      continue;
-    }
-    if (inTrigger && blockDepth > 0 && keywordAt(content, i, "END")) {
-      blockDepth--;
-      if (blockDepth === 0) inTrigger = false;
-      current += content.slice(i, i + 3);
-      i += 3;
-      continue;
-    }
-    if (char === ";" && blockDepth === 0) {
-      current += char;
-      inTrigger = false;
-      flush();
-      i++;
-      continue;
-    }
-    current += char;
-    i++;
-  }
-  flush();
-  return statements;
-}
-function isCommentOnly(fragment) {
-  const withoutBlockComments = fragment.replace(/\/\*[\s\S]*?\*\//g, "");
-  return withoutBlockComments.split("\n").every((line) => {
-    const trimmed = line.trim();
-    return trimmed.length === 0 || trimmed.startsWith("--");
-  });
-}
-
-// src/core/runner/mssql-batches.ts
-function splitMssqlBatches(content) {
-  const batches = content.split(/^\s*GO\s*$/mi);
-  return batches.map((b) => b.trim()).filter((b) => b.length > 0 && !isCommentOnly2(b));
-}
-function isCommentOnly2(batch) {
-  for (const line of batch.split("\n")) {
-    const trimmed = line.trim();
-    if (trimmed.length > 0 && !trimmed.startsWith("--")) {
-      return false;
-    }
-  }
-  return true;
-}
-async function executeSqlBody(context, sqlContent) {
-  if (context.dialect === "mssql") {
-    return executeFragments(context, splitMssqlBatches(sqlContent), "batch");
-  }
-  if (context.dialect === "sqlite") {
-    return executeFragments(context, splitSqliteStatements(sqlContent), "statement");
-  }
-  const [, execErr] = await attempt(() => sql.raw(sqlContent).execute(context.db));
-  if (execErr) {
-    return getSqlErrorMessage(execErr);
-  }
-  return null;
-}
-async function executeFragments(context, fragments, label) {
-  for (let i = 0; i < fragments.length; i++) {
-    const [, execErr] = await attempt(() => sql.raw(fragments[i]).execute(context.db));
-    if (execErr) {
-      const message = getSqlErrorMessage(execErr);
-      return fragments.length === 1 ? message : `[${label} ${i + 1} of ${fragments.length}] ${message}`;
-    }
-  }
-  return null;
-}
-
-// src/core/runner/runner.ts
 var SQL_EXTENSIONS2 = [".sql", ".sql.tmpl"];
 var FILE_HEADER_TEMPLATE = `-- ============================================================
 -- File: %FILE%
@@ -8675,48 +8699,20 @@ async function runBuild(context, sqlPath, options = {}, preFilteredFiles) {
 }
 async function runFile(context, filepath, options = {}) {
   assertRunPolicy(context, "run:file");
-  const opts = { ...DEFAULT_RUN_OPTIONS_INTERNAL, ...options };
   observer.emit("run:file", {
     filepath,
     configName: context.configName
   });
-  if (opts.dryRun) {
-    const results = await executeDryRun2(context, [filepath]);
-    return results[0];
-  }
-  const tracker = new Tracker(context.db, context.configName, context.dialect ?? "postgres");
-  const operationName = `run:${(/* @__PURE__ */ new Date()).toISOString()}`;
-  const [operationId, createErr] = await attempt(
-    () => tracker.createOperation({
-      name: operationName,
-      changeType: "run",
-      configName: context.configName,
-      executedBy: formatIdentity(context.identity)
-    })
-  );
-  if (createErr) {
-    observer.emit("error", {
-      source: "runner",
-      error: createErr,
-      context: { filepath, operation: "create-operation" }
-    });
-    return {
-      filepath,
-      checksum: "",
-      status: "failed",
-      error: createErr.message
-    };
-  }
-  const watcher = createWatcher(context);
-  const result = await executeSingleFile(context, filepath, opts, tracker, operationId, watcher).finally(() => watcher.close());
-  await tracker.finalizeOperation(
-    operationId,
-    result.status === "failed" || result.error ? "failed" : "success",
-    Math.round(result.durationMs ?? 0),
-    result.checksum,
-    result.error
-  );
-  return result;
+  const batch = await executeFiles2(context, [{ path: filepath, type: "sql" }], options, {
+    changeType: "run",
+    operationName: `run:${(/* @__PURE__ */ new Date()).toISOString()}`
+  });
+  return batch.files[0] ?? {
+    filepath,
+    checksum: "",
+    status: batch.error === RUN_CANCELLED ? "skipped" : "failed",
+    error: batch.error
+  };
 }
 async function runDir(context, dirpath, options = {}) {
   assertRunPolicy(context, "run:dir");
@@ -8859,6 +8855,19 @@ async function executeFiles2(context, files, runOptions, execOptions) {
     };
   }
   const tracker = execOptions.tracker ?? new Tracker(context.db, context.configName, context.dialect ?? "postgres");
+  const isChange = execOptions.changeType === "change";
+  const prepared = await prepareFiles(context, files);
+  const gated = isChange ? prepared : await applyRunGate(tracker, prepared, opts.force);
+  if (!isChange && gated.every((entry) => entry.skipReason !== void 0)) {
+    return {
+      status: "success",
+      files: gated.map(skipFile),
+      filesRun: 0,
+      filesSkipped: gated.length,
+      filesFailed: 0,
+      durationMs: performance.now() - start
+    };
+  }
   const [operationId, createErr] = await attempt(
     () => tracker.createOperation({
       name: execOptions.operationName,
@@ -8879,20 +8888,11 @@ async function executeFiles2(context, files, runOptions, execOptions) {
       performance.now() - start
     );
   }
-  const fileRecords = [];
-  for (const file of files) {
-    let checksum = file.checksum;
-    if (!checksum) {
-      const [computed, err] = await attempt(() => computeChecksum(file.path));
-      checksum = err ? "" : computed;
-    }
-    fileRecords.push({
-      filepath: path.relative(context.projectRoot, file.path),
-      fileType: file.type,
-      checksum
-    });
-  }
-  const createRecordsErr = await tracker.createFileRecords(operationId, fileRecords);
+  const runSet = gated.filter((entry) => !entry.skipReason);
+  const createRecordsErr = await tracker.createFileRecords(
+    operationId,
+    runSet.map((entry) => ({ filepath: entry.relFilepath, fileType: entry.file.type, checksum: entry.checksum }))
+  );
   if (createRecordsErr) {
     observer.emit("error", {
       source: "runner:create-file-records",
@@ -8909,26 +8909,21 @@ async function executeFiles2(context, files, runOptions, execOptions) {
   let failed = false;
   let cancelled = false;
   const watcher = createWatcher(context);
+  const lastRunIndex = gated.map((entry) => !entry.skipReason).lastIndexOf(true);
   try {
-    for (let i = 0; i < files.length; i++) {
-      const file = files[i];
-      const fileRecord = fileRecords[i];
+    for (let i = 0; i < gated.length; i++) {
+      const entry = gated[i];
+      if (entry.skipReason) {
+        results.push(skipFile(entry));
+        continue;
+      }
       if (context.signal?.aborted) {
         failed = true;
         cancelled = true;
         await skipRemaining(tracker, operationId, RUN_CANCELLED);
         break;
       }
-      const result = await executeSingleFileWithUpdate(
-        context,
-        file.path,
-        fileRecord.checksum,
-        opts,
-        tracker,
-        operationId,
-        execOptions.changeType,
-        watcher
-      );
+      const result = await executeSingleFileWithUpdate(context, entry, tracker, operationId, watcher);
       if (!result) {
         failed = true;
         cancelled = true;
@@ -8936,13 +8931,13 @@ async function executeFiles2(context, files, runOptions, execOptions) {
         break;
       }
       results.push(result);
-      cancelled = (context.signal?.aborted ?? false) && (i < files.length - 1 || result.status === "failed");
+      cancelled = (context.signal?.aborted ?? false) && (i < lastRunIndex || result.status === "failed");
       if (cancelled || result.status === "failed" && opts.abortOnError) {
         failed = true;
         await skipRemaining(
           tracker,
           operationId,
-          cancelled ? RUN_CANCELLED : `Skipped: failure in ${path.basename(file.path)}`
+          cancelled ? RUN_CANCELLED : `Skipped: failure in ${path.basename(entry.file.path)}`
         );
         break;
       }
@@ -8963,7 +8958,7 @@ async function executeFiles2(context, files, runOptions, execOptions) {
   if (filesFailed > 0 || failed) {
     status = filesRun > 0 ? "partial" : "failed";
   }
-  const combinedChecksum = execOptions.checksum ?? computeCombinedChecksum(fileRecords.map((f) => f.checksum));
+  const combinedChecksum = execOptions.checksum ?? computeCombinedChecksum(gated.map((entry) => entry.checksum));
   const finalStatus = status === "success" ? "success" : "failed";
   const finalizeErr = await tracker.finalizeOperation(
     operationId,
@@ -8990,6 +8985,43 @@ async function executeFiles2(context, files, runOptions, execOptions) {
     error: cancelled ? RUN_CANCELLED : void 0
   };
 }
+async function prepareFiles(context, files) {
+  const prepared = [];
+  for (const file of files) {
+    const relFilepath = path.relative(context.projectRoot, file.path);
+    const [loaded, loadError] = await attempt(async () => {
+      const sql27 = await loadAndRenderFile2(context, file.path);
+      return { sql: sql27, checksum: computeChecksumFromContent(sql27) };
+    });
+    if (loadError) {
+      prepared.push({ file, relFilepath, checksum: "", sql: "", loadError });
+      continue;
+    }
+    prepared.push({ file, relFilepath, ...loaded });
+  }
+  return prepared;
+}
+async function applyRunGate(tracker, prepared, force) {
+  if (force) return prepared;
+  const [latest, latestErr] = await tracker.latestExecutions();
+  return prepared.map((entry) => {
+    if (entry.loadError) return entry;
+    const decision = decideNeedsRun(latestErr ?? latest.get(entry.relFilepath), entry.checksum);
+    return decision.skipReason ? { ...entry, skipReason: decision.skipReason } : entry;
+  });
+}
+function skipFile(entry) {
+  observer.emit("file:skip", {
+    filepath: entry.file.path,
+    reason: entry.skipReason
+  });
+  return {
+    filepath: entry.file.path,
+    checksum: entry.checksum,
+    status: "skipped",
+    skipReason: entry.skipReason
+  };
+}
 async function executeFilesInternal(context, files, options, changeType, sqlPath) {
   const fileInputs = files.map((f) => ({
     path: f,
@@ -9003,17 +9035,16 @@ async function executeFilesInternal(context, files, options, changeType, sqlPath
   };
   return executeFiles2(context, fileInputs, options, execOptions);
 }
-async function executeSingleFileWithUpdate(context, filepath, checksum, options, tracker, operationId, changeType, watcher) {
+async function executeSingleFileWithUpdate(context, entry, tracker, operationId, watcher) {
   const start = performance.now();
-  const relFilepath = path.relative(context.projectRoot, filepath);
-  const [sqlContent, loadErr] = await attempt(() => loadAndRenderFile2(context, filepath));
-  if (loadErr) {
+  const { file: { path: filepath }, relFilepath, checksum } = entry;
+  if (entry.loadError) {
     const durationMs2 = performance.now() - start;
     const result2 = {
       filepath,
-      checksum: checksum || "",
+      checksum,
       status: "failed",
-      error: loadErr.message,
+      error: entry.loadError.message,
       durationMs: durationMs2
     };
     await tracker.updateFileExecution(
@@ -9021,56 +9052,29 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
       relFilepath,
       "failed",
       Math.round(durationMs2),
-      loadErr.message
+      entry.loadError.message
     );
     observer.emit("file:after", {
       filepath,
       status: "failed",
       durationMs: durationMs2,
-      error: loadErr.message
+      error: entry.loadError.message
     });
     return result2;
   }
-  const [renderedChecksum, checksumErr] = attemptSync(() => computeChecksumFromContent(sqlContent));
-  const finalChecksum = checksumErr ? checksum : renderedChecksum;
   observer.emit("file:before", {
     filepath,
-    checksum: finalChecksum,
+    checksum,
     configName: context.configName
   });
-  if (changeType !== "change") {
-    const needsRunResult = await tracker.needsRun(relFilepath, finalChecksum, options.force, operationId);
-    if (!needsRunResult.needsRun) {
-      const result2 = {
-        filepath,
-        checksum: finalChecksum,
-        status: "skipped",
-        skipReason: needsRunResult.skipReason
-      };
-      await tracker.updateFileExecution(
-        operationId,
-        relFilepath,
-        "skipped",
-        0,
-        void 0,
-        needsRunResult.skipReason,
-        finalChecksum
-      );
-      observer.emit("file:skip", {
-        filepath,
-        reason: needsRunResult.skipReason
-      });
-      return result2;
-    }
-  }
-  const execErrMsg = await runWatched(context, watcher, filepath, sqlContent);
+  const execErrMsg = await runWatched(context, watcher, filepath, entry.sql);
   if (execErrMsg === NOT_STARTED) return null;
   const durationMs = performance.now() - start;
   if (execErrMsg) {
     const error = execErrMsg + await describePriorSuccesses(tracker, relFilepath, operationId);
     const result2 = {
       filepath,
-      checksum: finalChecksum,
+      checksum,
       status: "failed",
       error,
       durationMs
@@ -9080,9 +9084,7 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
       relFilepath,
       "failed",
       Math.round(durationMs),
-      error,
-      void 0,
-      finalChecksum
+      error
     );
     observer.emit("file:after", {
       filepath,
@@ -9094,7 +9096,7 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
   }
   const result = {
     filepath,
-    checksum: finalChecksum,
+    checksum,
     status: "success",
     durationMs
   };
@@ -9102,10 +9104,7 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
     operationId,
     relFilepath,
     "success",
-    Math.round(durationMs),
-    void 0,
-    void 0,
-    finalChecksum
+    Math.round(durationMs)
   );
   observer.emit("file:after", {
     filepath,
@@ -9114,143 +9113,6 @@ async function executeSingleFileWithUpdate(context, filepath, checksum, options,
   });
   return result;
 }
-async function executeSingleFile(context, filepath, options, tracker, operationId, watcher) {
-  const start = performance.now();
-  const relFilepath = path.relative(context.projectRoot, filepath);
-  const [sqlContent, loadErr] = await attempt(() => loadAndRenderFile2(context, filepath));
-  if (loadErr) {
-    const durationMs2 = performance.now() - start;
-    const result2 = {
-      filepath,
-      checksum: "",
-      status: "failed",
-      error: loadErr.message,
-      durationMs: durationMs2
-    };
-    await tracker.recordExecution({
-      changeId: operationId,
-      filepath: relFilepath,
-      checksum: "",
-      status: "failed",
-      errorMessage: loadErr.message,
-      durationMs: Math.round(durationMs2)
-    });
-    observer.emit("file:after", {
-      filepath,
-      status: "failed",
-      durationMs: durationMs2,
-      error: loadErr.message
-    });
-    return result2;
-  }
-  const [checksum, checksumErr] = attemptSync(() => computeChecksumFromContent(sqlContent));
-  if (checksumErr) {
-    const result2 = {
-      filepath,
-      checksum: "",
-      status: "failed",
-      error: checksumErr.message,
-      durationMs: performance.now() - start
-    };
-    await tracker.recordExecution({
-      changeId: operationId,
-      filepath: relFilepath,
-      checksum: "",
-      status: "failed",
-      errorMessage: checksumErr.message,
-      durationMs: Math.round(result2.durationMs ?? 0)
-    });
-    observer.emit("file:after", {
-      filepath,
-      status: "failed",
-      durationMs: result2.durationMs ?? 0,
-      error: checksumErr.message
-    });
-    return result2;
-  }
-  observer.emit("file:before", {
-    filepath,
-    checksum,
-    configName: context.configName
-  });
-  const needsRunResult = await tracker.needsRun(relFilepath, checksum, options.force);
-  if (!needsRunResult.needsRun) {
-    const result2 = {
-      filepath,
-      checksum,
-      status: "skipped",
-      skipReason: needsRunResult.skipReason
-    };
-    await tracker.recordExecution({
-      changeId: operationId,
-      filepath: relFilepath,
-      checksum,
-      status: "skipped",
-      skipReason: needsRunResult.skipReason
-    });
-    observer.emit("file:skip", {
-      filepath,
-      reason: needsRunResult.skipReason
-    });
-    return result2;
-  }
-  const execErrMsg = await runWatched(context, watcher, filepath, sqlContent);
-  const durationMs = performance.now() - start;
-  if (execErrMsg === NOT_STARTED) {
-    await tracker.recordExecution({
-      changeId: operationId,
-      filepath: relFilepath,
-      checksum,
-      status: "skipped",
-      skipReason: RUN_CANCELLED
-    });
-    return { filepath, checksum, status: "skipped", error: RUN_CANCELLED };
-  }
-  if (execErrMsg) {
-    const error = execErrMsg + await describePriorSuccesses(tracker, relFilepath, operationId);
-    const result2 = {
-      filepath,
-      checksum,
-      status: "failed",
-      error,
-      durationMs
-    };
-    await tracker.recordExecution({
-      changeId: operationId,
-      filepath: relFilepath,
-      checksum,
-      status: "failed",
-      errorMessage: error,
-      durationMs: Math.round(durationMs)
-    });
-    observer.emit("file:after", {
-      filepath,
-      status: "failed",
-      durationMs,
-      error
-    });
-    return result2;
-  }
-  const result = {
-    filepath,
-    checksum,
-    status: "success",
-    durationMs
-  };
-  await tracker.recordExecution({
-    changeId: operationId,
-    filepath: relFilepath,
-    checksum,
-    status: "success",
-    durationMs: Math.round(durationMs)
-  });
-  observer.emit("file:after", {
-    filepath,
-    status: "success",
-    durationMs
-  });
-  return result;
-}
 async function loadAndRenderFile2(context, filepath) {
   if (isTemplate(filepath)) {
     const result = await processFile(filepath, {
@@ -9415,12 +9277,12 @@ var RunNamespace = class {
    *
    * @example
    * ```typescript
-   * const files = await ctx.noorm.run.discover('sql/')
+   * const files = await ctx.noorm.run.discover('db/sql/')
    * ```
    */
   async discover(dirpath) {
     const absolutePath = this.#resolvePath(
-      dirpath ?? this.#state.settings.paths?.sql ?? "sql"
+      dirpath ?? this.#state.settings.paths?.sql ?? DEFAULT_SQL_PATH
     );
     return discoverFiles(absolutePath);
   }
@@ -9432,7 +9294,7 @@ var RunNamespace = class {
    *
    * @example
    * ```typescript
-   * const results = await ctx.noorm.run.preview(['sql/001.sql', 'sql/002.sql'])
+   * const results = await ctx.noorm.run.preview(['db/sql/001.sql', 'db/sql/002.sql'])
    * ```
    */
   async preview(filepaths, output) {
@@ -9509,7 +9371,7 @@ var RunNamespace = class {
     const context = await this.#createRunContext();
     const sqlPath = path.join(
       this.#state.projectRoot,
-      this.#state.settings.paths?.sql ?? "sql"
+      this.#state.settings.paths?.sql ?? DEFAULT_SQL_PATH
     );
     const configForMatch = {
       name: this.#state.config.name,