@runa-ai/runa-cli 0.10.1 → 0.10.3

package/dist/{chunk-ZPE52NEK.js → chunk-SS7RIWW3.js}

@@ -6,7 +6,7 @@ createRequire(import.meta.url);
 
 // src/version.ts
 init_esm_shims();
-var CLI_VERSION = "0.10.1";
+var CLI_VERSION = "0.10.3";
 var HAS_ADMIN_COMMAND = false;
 
 export { CLI_VERSION, HAS_ADMIN_COMMAND };

package/dist/{chunk-PAWNJA3N.js → chunk-XFXGFUAM.js}

@@ -9,7 +9,7 @@ init_esm_shims();
 var riskDetectorModulePromise = null;
 async function loadRiskDetectorModule() {
   if (!riskDetectorModulePromise) {
-    riskDetectorModulePromise = import('./risk-detector-core-TGFKWHRS.js').catch((error) => {
+    riskDetectorModulePromise = import('./risk-detector-core-YI3M6INI.js').catch((error) => {
       riskDetectorModulePromise = null;
       throw error;
     });

package/dist/{ci-3HZWUQFN.js → ci-6P7VK6WB.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, isIdempotentRoleHazard, detectAppSchemas, formatSchemasForSql, getDbPlanArtifactPath, runDbApply } from './chunk-XRLIZKB2.js';
+import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, isIdempotentRoleHazard, detectAppSchemas, formatSchemasForSql, getDbPlanArtifactPath, runDbApply } from './chunk-S7VGVFYF.js';
 import './chunk-WGRVAGSR.js';
 import './chunk-HWR5NUUZ.js';
 import './chunk-UHDAYPHH.js';
-import './chunk-Y5ANTCKE.js';
+import './chunk-EZ46JIEO.js';
 import './chunk-IWVXI5O4.js';
-import './chunk-ZPE52NEK.js';
+import './chunk-SS7RIWW3.js';
 import './chunk-B7C7CLW2.js';
 import './chunk-QDF7QXBL.js';
 import { getSnapshotStateName, getSnapshotStatePaths, isSnapshotComplete } from './chunk-XVNDDHAF.js';

package/dist/{cli-RES5QRC2.js → cli-Q665YRVT.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'module';
 import { enableNonInteractiveMode } from './chunk-6Y3LAUGL.js';
 import { getRequestedCommandNameFromArgv } from './chunk-UWWSAPDR.js';
-import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-ZPE52NEK.js';
+import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-SS7RIWW3.js';
 import { emitDefaultSuccessIfNeeded } from './chunk-WJXC4MVY.js';
 import { parseOutputFormat, setOutputFormat, getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
@@ -155,7 +155,7 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
       return;
     }
     if (requested === "upgrade") {
-      const { upgradeCommand: upgradeCommand2 } = await import('./upgrade-LBO3Z3J7.js');
+      const { upgradeCommand: upgradeCommand2 } = await import('./upgrade-X7P6WRD5.js');
       program.addCommand(upgradeCommand2);
       return;
     }
@@ -185,7 +185,7 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
   ] = await Promise.all([
     import('./init-4UAWYY75.js'),
     import('./prepare-32DOVHTE.js'),
-    import('./upgrade-LBO3Z3J7.js'),
+    import('./upgrade-X7P6WRD5.js'),
     import('./validate-CAAW4Y44.js'),
     import('./build-P2A6345N.js'),
     import('./dev-QR55VDNZ.js')
@@ -462,11 +462,11 @@ async function registerFocusedStatusUtilityCommand(program, requested) {
   return false;
 }
 async function registerCiCommand(program) {
-  const { ciCommand } = await import('./ci-3HZWUQFN.js');
+  const { ciCommand } = await import('./ci-6P7VK6WB.js');
   program.addCommand(ciCommand);
 }
 async function registerDbCommand(program) {
-  const { dbCommand } = await import('./db-PRGL7PBX.js');
+  const { dbCommand } = await import('./db-BQOVOQXU.js');
   program.addCommand(dbCommand);
 }
 async function registerServicesCommand(program) {
@@ -490,7 +490,7 @@ async function registerUiCommand(program) {
   program.addCommand(uiCommand);
 }
 async function registerWatchCommand(program) {
-  const { watchCommand } = await import('./watch-RFVCEQLH.js');
+  const { watchCommand } = await import('./watch-4RHXVCQ3.js');
   program.addCommand(watchCommand);
 }
 async function registerWorkflowCommand(program) {
@@ -498,11 +498,11 @@ async function registerWorkflowCommand(program) {
   program.addCommand(workflowCommand);
 }
 async function registerVulnCheckCommand(program) {
-  const { vulnCheckCommand } = await import('./vuln-check-5JJ2YAJW.js');
+  const { vulnCheckCommand } = await import('./vuln-check-WW43E7PS.js');
   program.addCommand(vulnCheckCommand);
 }
 async function registerTemplateCheckCommand(program) {
-  const { templateCheckCommand } = await import('./template-check-VNNQQXCX.js');
+  const { templateCheckCommand } = await import('./template-check-D35F2GDP.js');
   program.addCommand(templateCheckCommand);
 }
 async function registerSessionCommands(program) {

package/dist/commands/build/contract.d.ts

@@ -21,9 +21,9 @@ import { z } from 'zod';
 export declare const BuildPhaseSchema: z.ZodEnum<{
     db: "db";
     build: "build";
+    manifest: "manifest";
     lint: "lint";
     types: "types";
-    manifest: "manifest";
 }>;
 export type BuildPhase = z.infer<typeof BuildPhaseSchema>;
 /** Valid build phases for --only option */
@@ -44,9 +44,9 @@ export declare const BuildInputSchema: z.ZodObject<{
     only: z.ZodOptional<z.ZodArray<z.ZodEnum<{
         db: "db";
         build: "build";
+        manifest: "manifest";
         lint: "lint";
         types: "types";
-        manifest: "manifest";
     }>>>;
 }, z.core.$strict>;
 export type BuildInput = z.infer<typeof BuildInputSchema>;

package/dist/commands/build/machine.d.ts

@@ -35,7 +35,7 @@ interface BuildMachineInput {
     repoRoot?: string;
 }
 export declare const buildMachine: import("xstate").StateMachine<BuildContext, BuildEvent, {
-    [x: string]: import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/clean.js").CleanOutput, import("./actors/clean.js").CleanInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/build.js").BuildOutput, import("./actors/build.js").BuildInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/validate.js").ValidateOutput, import("./actors/validate.js").ValidateInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/manifest.js").ManifestOutput, import("./actors/manifest.js").ManifestInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup.js").DepsInstallOutput, import("./actors/setup.js").SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup.js").EnvCheckOutput, import("./actors/setup.js").SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup.js").SupabaseStartOutput, import("./actors/setup.js").SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/db-sync.js").DbSyncOutput, import("./actors/db-sync.js").DbSyncInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/static-checks.js").StaticChecksOutput, import("./actors/static-checks.js").StaticChecksInput, import("xstate").EventObject>> | undefined;
+    [x: string]: import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/clean.js").CleanOutput, import("./actors/clean.js").CleanInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/build.js").BuildOutput, import("./actors/build.js").BuildInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/manifest.js").ManifestOutput, import("./actors/manifest.js").ManifestInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/validate.js").ValidateOutput, import("./actors/validate.js").ValidateInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup.js").DepsInstallOutput, import("./actors/setup.js").SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup.js").EnvCheckOutput, import("./actors/setup.js").SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/setup.js").SupabaseStartOutput, import("./actors/setup.js").SetupInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/db-sync.js").DbSyncOutput, import("./actors/db-sync.js").DbSyncInput, import("xstate").EventObject>> | import("xstate").ActorRefFromLogic<import("xstate").PromiseActorLogic<import("./actors/static-checks.js").StaticChecksOutput, import("./actors/static-checks.js").StaticChecksInput, import("xstate").EventObject>> | undefined;
 }, {
     src: "fresh";
     logic: import("xstate").PromiseActorLogic<import("./actors/clean.js").CleanOutput, import("./actors/clean.js").CleanInput, import("xstate").EventObject>;
@@ -44,14 +44,14 @@ export declare const buildMachine: import("xstate").StateMachine<BuildContext, B
     src: "build";
     logic: import("xstate").PromiseActorLogic<import("./actors/build.js").BuildOutput, import("./actors/build.js").BuildInput, import("xstate").EventObject>;
     id: string | undefined;
-} | {
-    src: "validate";
-    logic: import("xstate").PromiseActorLogic<import("./actors/validate.js").ValidateOutput, import("./actors/validate.js").ValidateInput, import("xstate").EventObject>;
-    id: string | undefined;
 } | {
     src: "manifest";
     logic: import("xstate").PromiseActorLogic<import("./actors/manifest.js").ManifestOutput, import("./actors/manifest.js").ManifestInput, import("xstate").EventObject>;
     id: string | undefined;
+} | {
+    src: "validate";
+    logic: import("xstate").PromiseActorLogic<import("./actors/validate.js").ValidateOutput, import("./actors/validate.js").ValidateInput, import("xstate").EventObject>;
+    id: string | undefined;
 } | {
     src: "clean";
     logic: import("xstate").PromiseActorLogic<import("./actors/clean.js").CleanOutput, import("./actors/clean.js").CleanInput, import("xstate").EventObject>;
@@ -106,7 +106,7 @@ export declare const buildMachine: import("xstate").StateMachine<BuildContext, B
 } | {
     type: "isDryRun";
     params: unknown;
-}, never, "fresh" | "done" | "failed" | "build" | "dryRun" | "validate" | "manifest" | "clean" | "dbSync" | "preClean" | "staticAnalysis" | "idle" | {
+}, never, "fresh" | "done" | "failed" | "build" | "manifest" | "dryRun" | "validate" | "clean" | "dbSync" | "preClean" | "staticAnalysis" | "idle" | {
     setup: "done" | "depsInstall" | "envCheck" | "supabaseStart";
 }, string, BuildMachineInput, {
     success: boolean;

package/dist/commands/ci/commands/ci-prod-types.d.ts

@@ -5,8 +5,8 @@ import { z } from 'zod';
  */
 export declare const CiProdApplyActionOptionsSchema: z.ZodObject<{
     mode: z.ZodOptional<z.ZodEnum<{
-        local: "local";
         "github-actions": "github-actions";
+        local: "local";
     }>>;
     output: z.ZodOptional<z.ZodEnum<{
         json: "json";

package/dist/commands/ci/machine/contract.d.ts

@@ -27,15 +27,15 @@ export declare const CiModeSchema: z.ZodEnum<{
 }>;
 export type CiMode = z.infer<typeof CiModeSchema>;
 export declare const CiExecutionEnvSchema: z.ZodEnum<{
-    local: "local";
     "github-actions": "github-actions";
+    local: "local";
 }>;
 export type CiExecutionEnv = z.infer<typeof CiExecutionEnvSchema>;
 export declare const CiPhaseSchema: z.ZodEnum<{
     all: "all";
     test: "test";
-    blocking: "blocking";
     observability: "observability";
+    blocking: "blocking";
 }>;
 export type CiPhase = z.infer<typeof CiPhaseSchema>;
 export declare const CiDbModeSchema: z.ZodEnum<{
@@ -100,8 +100,8 @@ export declare const CiInputSchema: z.ZodObject<{
     check: z.ZodOptional<z.ZodBoolean>;
     keepDb: z.ZodOptional<z.ZodBoolean>;
     executionMode: z.ZodOptional<z.ZodEnum<{
-        local: "local";
         "github-actions": "github-actions";
+        local: "local";
     }>>;
     output: z.ZodOptional<z.ZodEnum<{
         json: "json";
@@ -111,8 +111,8 @@ export declare const CiInputSchema: z.ZodObject<{
     phase: z.ZodOptional<z.ZodEnum<{
         all: "all";
         test: "test";
-        blocking: "blocking";
         observability: "observability";
+        blocking: "blocking";
     }>>;
     dbMode: z.ZodOptional<z.ZodEnum<{
         auto: "auto";
@@ -148,14 +148,14 @@ export declare const SetupResultSchema: z.ZodObject<{
         "ci-pr-local": "ci-pr-local";
     }>;
     executionEnv: z.ZodEnum<{
-        local: "local";
         "github-actions": "github-actions";
+        local: "local";
     }>;
     phase: z.ZodEnum<{
         all: "all";
         test: "test";
-        blocking: "blocking";
         observability: "observability";
+        blocking: "blocking";
     }>;
     repoKind: z.ZodEnum<{
         unknown: "unknown";
@@ -296,9 +296,9 @@ export declare const StepSummarySchema: z.ZodObject<{
         db: "db";
         test: "test";
         build: "build";
-        setup: "setup";
-        github: "github";
         observability: "observability";
+        github: "github";
+        setup: "setup";
         finalize: "finalize";
     }>>;
     parentStep: z.ZodOptional<z.ZodString>;
@@ -369,9 +369,9 @@ export declare const CiOutputSchema: z.ZodObject<{
             db: "db";
             test: "test";
             build: "build";
-            setup: "setup";
-            github: "github";
             observability: "observability";
+            github: "github";
+            setup: "setup";
             finalize: "finalize";
         }>>;
         parentStep: z.ZodOptional<z.ZodString>;

package/dist/commands/ci/machine/machine.d.ts

@@ -219,10 +219,10 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
     layer?: string | undefined;
     check?: boolean | undefined;
     keepDb?: boolean | undefined;
-    executionMode?: "local" | "github-actions" | undefined;
+    executionMode?: "github-actions" | "local" | undefined;
     output?: "json" | "human" | undefined;
     config?: string | undefined;
-    phase?: "all" | "test" | "blocking" | "observability" | undefined;
+    phase?: "all" | "test" | "observability" | "blocking" | undefined;
     dbMode?: "auto" | "local" | undefined;
     branchName?: string | undefined;
     skipStaticChecks?: boolean | undefined;
@@ -249,7 +249,7 @@ export declare const ciMachine: import("xstate").StateMachine<CiContext, CiEvent
         error?: string | undefined;
         reason?: string | undefined;
         title?: string | undefined;
-        phase?: "db" | "test" | "build" | "setup" | "github" | "observability" | "finalize" | undefined;
+        phase?: "db" | "test" | "build" | "observability" | "github" | "setup" | "finalize" | undefined;
         parentStep?: string | undefined;
         optional?: boolean | undefined;
         startedAt?: string | undefined;

package/dist/commands/ci/utils/ci-summary.d.ts

@@ -31,8 +31,8 @@ export type CiStepStatus = z.output<typeof CiStepStatusSchema>;
 export declare const CiSummarySchema: z.ZodObject<{
     version: z.ZodString;
     mode: z.ZodEnum<{
-        local: "local";
         "github-actions": "github-actions";
+        local: "local";
     }>;
     command: z.ZodEnum<{
         "ci pr": "ci pr";
@@ -100,9 +100,9 @@ export declare const CiSummarySchema: z.ZodObject<{
             db: "db";
             test: "test";
             build: "build";
-            setup: "setup";
-            github: "github";
             observability: "observability";
+            github: "github";
+            setup: "setup";
             finalize: "finalize";
         }>>;
         parentStep: z.ZodOptional<z.ZodString>;

package/dist/commands/db/apply/contract.d.ts

@@ -32,9 +32,9 @@ export declare const DbApplyPlannerReuseReasonSchema: z.ZodEnum<{
 export type DbApplyPlannerReuseReason = z.infer<typeof DbApplyPlannerReuseReasonSchema>;
 export declare const DbApplyInputSchema: z.ZodObject<{
     env: z.ZodDefault<z.ZodEnum<{
-        local: "local";
         preview: "preview";
         production: "production";
+        local: "local";
     }>>;
     databaseUrl: z.ZodOptional<z.ZodString>;
     verbose: z.ZodDefault<z.ZodBoolean>;

package/dist/commands/db/apply/helpers/plan-check-filter.d.ts

@@ -1,5 +1,5 @@
 import type { DbApplyPlanSummary } from '../contract.js';
-import type { IdempotentProtectedObjects } from './idempotent-object-registry.js';
+import { type IdempotentProtectedObjects } from './idempotent-object-registry.js';
 import type { PlanStatement, ValidatedPlan } from './plan-validator.js';
 export interface CheckModeFilterResult {
     filteredPlan: ValidatedPlan;

package/dist/commands/db/apply/helpers/planner-artifact.d.ts

@@ -4,9 +4,9 @@ import { type DbApplyInput, type DbApplyOutput, type DbApplyPlanner } from '../c
 export declare const DbPlanArtifactSchema: z.ZodObject<{
     version: z.ZodLiteral<"1">;
     environment: z.ZodEnum<{
-        local: "local";
         preview: "preview";
         production: "production";
+        local: "local";
     }>;
     mode: z.ZodLiteral<"check">;
     previewProfile: z.ZodEnum<{

package/dist/commands/db/commands/db-preview-profile.d.ts

@@ -2,9 +2,9 @@ import { z } from 'zod';
 import { type DbApplyOutput, type DbPreviewProfile } from '../apply/contract.js';
 export declare const DEFAULT_DB_PREVIEW_PROFILE: DbPreviewProfile;
 export declare const DbPreviewEnvironmentSchema: z.ZodEnum<{
-    local: "local";
     preview: "preview";
     production: "production";
+    local: "local";
 }>;
 export declare const LEGACY_DB_APPLY_CHECK_REMOVAL_TARGET = "the next major CLI release";
 export declare function parseDbPreviewProfile(value: string): DbPreviewProfile;

package/dist/commands/db/preflight/contract.d.ts

@@ -8,9 +8,9 @@
 import { z } from 'zod';
 export declare const DbPreflightInputSchema: z.ZodObject<{
     env: z.ZodDefault<z.ZodEnum<{
-        local: "local";
         preview: "preview";
         production: "production";
+        local: "local";
     }>>;
     databaseUrl: z.ZodOptional<z.ZodString>;
     verbose: z.ZodDefault<z.ZodBoolean>;

package/dist/commands/db/sync/contract.d.ts

@@ -18,9 +18,9 @@ import type { BoundaryGuidanceWarning, LocalBlindSpotBlocker, RuntimeContradicti
  * Environment type for db sync
  */
 export declare const DbSyncEnvSchema: z.ZodEnum<{
-    local: "local";
     preview: "preview";
     production: "production";
+    local: "local";
 }>;
 export type DbSyncEnv = z.infer<typeof DbSyncEnvSchema>;
 /**
@@ -28,9 +28,9 @@ export type DbSyncEnv = z.infer<typeof DbSyncEnvSchema>;
  */
 export declare const DbSyncInputSchema: z.ZodObject<{
     env: z.ZodDefault<z.ZodEnum<{
-        local: "local";
         preview: "preview";
         production: "production";
+        local: "local";
     }>>;
     check: z.ZodDefault<z.ZodBoolean>;
     force: z.ZodDefault<z.ZodBoolean>;
@@ -104,9 +104,9 @@ export declare const StepContextSchema: z.ZodObject<{
     databaseUrl: z.ZodString;
     dbPackagePath: z.ZodString;
     env: z.ZodEnum<{
-        local: "local";
         preview: "preview";
         production: "production";
+        local: "local";
     }>;
     check: z.ZodBoolean;
     force: z.ZodBoolean;
@@ -142,9 +142,9 @@ export type { RuntimeContradictionIssue, RuntimeWarningIssue, SchemaGuardrailRep
  */
 export declare const DbSyncOutputSchema: z.ZodObject<{
     env: z.ZodEnum<{
-        local: "local";
         preview: "preview";
         production: "production";
+        local: "local";
     }>;
     check: z.ZodBoolean;
     reconciled: z.ZodBoolean;
@@ -235,9 +235,9 @@ export type DbSyncOutput = z.infer<typeof DbSyncOutputSchema>;
  */
 export declare const DbSyncMachineInputSchema: z.ZodObject<{
     env: z.ZodOptional<z.ZodEnum<{
-        local: "local";
         preview: "preview";
         production: "production";
+        local: "local";
     }>>;
     check: z.ZodOptional<z.ZodBoolean>;
     force: z.ZodOptional<z.ZodBoolean>;

package/dist/commands/db/sync/machine.d.ts

@@ -108,7 +108,7 @@ export declare const dbSyncMachine: import("xstate").StateMachine<DbSyncContext,
     logic: import("xstate").PromiseActorLogic<actors.ReportOutput, actors.ReportInput, import("xstate").EventObject>;
     id: string | undefined;
 }, never, never, never, "done" | "failed" | "sync" | "setup" | "idle" | "snapshot" | "reconcile" | "report" | "preflight", string, {
-    env?: "local" | "preview" | "production" | undefined;
+    env?: "preview" | "production" | "local" | undefined;
     check?: boolean | undefined;
     force?: boolean | undefined;
     autoApprove?: boolean | undefined;
@@ -126,7 +126,7 @@ export declare const dbSyncMachine: import("xstate").StateMachine<DbSyncContext,
     snapshotTimeoutMs?: number | undefined;
     syncTimeoutMs?: number | undefined;
 }, {
-    env: "local" | "preview" | "production";
+    env: "preview" | "production" | "local";
     check: boolean;
     reconciled: boolean;
     preflightPassed: boolean;

package/dist/commands/db/sync/schema-guardrail-graph-metadata.d.ts

@@ -4,17 +4,11 @@
  * Purpose: Function ownership hashing, allowlist checking, and
  * defined function/boundary metadata extraction
  */
-import { type DuplicateFunctionOwnershipFinding } from '../utils/duplicate-function-ownership.js';
+import { isAllowlistedDuplicateFunction } from '../utils/duplicate-function-ownership-allowlist.js';
 import { type SqlFile } from '../utils/declarative-dependency-sql-utils.js';
 import { type DefinedFunctionMetadata, type ManagedBoundaryMetadata } from './schema-guardrail-graph-types.js';
-import type { SchemaGuardrailConfig } from './schema-guardrail-types.js';
 declare function normalizeFunctionStatementForHash(statement: string): string;
 declare function buildFunctionBodyHashMap(files: SqlFile[], layer: 'declarative' | 'idempotent'): Map<string, string>;
-declare function isAllowlistedDuplicateFunction(params: {
-    finding: DuplicateFunctionOwnershipFinding;
-    allowlist: SchemaGuardrailConfig['allowedDuplicateFunctions'];
-    bodyHashes: Map<string, string>;
-}): boolean;
 /**
  * Collect qualified object references from SQL function bodies
  */

package/dist/commands/db/sync/schema-guardrail-graph.d.ts

@@ -4,10 +4,12 @@
  * Purpose: Main entry points for schema guardrail graph building
  * Exports: loadSqlSources, buildStaticGraph, StaticGraphBuildResult
  */
+import { type FunctionAclManifest } from '../utils/function-acl-manifest.js';
 import type { LoadedSqlSources, SchemaGraphManifest, SchemaGuardrailConfig, SchemaGuardrailReport } from './schema-guardrail-types.js';
 export declare function loadSqlSources(targetDir: string, config: SchemaGuardrailConfig): LoadedSqlSources;
 export type StaticGraphBuildResult = {
     graph: SchemaGraphManifest;
+    functionAclManifest: FunctionAclManifest;
     duplicateTableOwners: SchemaGuardrailReport['duplicateTableOwners'];
     duplicateFunctionOwners: SchemaGuardrailReport['duplicateFunctionOwners'];
     policyOwnershipConflicts: SchemaGuardrailReport['policyOwnershipConflicts'];

package/dist/commands/db/sync/schema-guardrail-rewrite.d.ts

@@ -1,3 +1,4 @@
+import { type FunctionAclManifest } from '../utils/function-acl-manifest.js';
 import type { SchemaGraphManifest, SchemaManagedBlockKind, SchemaGuardrailConfig, SchemaGuardrailReport, SchemaGuardrailStaticResult } from './schema-guardrail-types.js';
 type RenderedManagedBlock = {
     kind: SchemaManagedBlockKind;
@@ -16,14 +17,20 @@ export type HeaderRewritePlan = {
     }>;
     existingManagedCount: number;
 };
+export type GeneratedFileRewritePlan = {
+    filePath: string;
+    expectedSql: string;
+};
 export declare function loadHeaderRewritePlans(params: {
     targetDir: string;
     graph: SchemaGraphManifest;
+    functionAclManifest: FunctionAclManifest;
     config: SchemaGuardrailConfig;
     report: SchemaGuardrailReport;
 }): {
     staleBlocks: SchemaGuardrailReport['staleBlocks'];
     rewritePlans: HeaderRewritePlan[];
+    generatedFileRewritePlans: GeneratedFileRewritePlan[];
     failure?: undefined;
 } | {
     staleBlocks?: undefined;
@@ -40,6 +47,7 @@ export declare function finalizeCheckModeReport(params: {
 export declare function rewriteManagedHeaders(params: {
     targetDir: string;
     rewritePlans: HeaderRewritePlan[];
+    generatedFileRewritePlans: GeneratedFileRewritePlan[];
     report: SchemaGuardrailReport;
 }): SchemaGuardrailStaticResult | null;
 export {};

package/dist/commands/db/sync/schema-guardrail-types.d.ts

@@ -1,12 +1,12 @@
 import type { SqlFile } from '../utils/declarative-dependency-sql-utils.js';
-export type SchemaManagedBlockKind = 'file-header' | 'table-header';
+export type SchemaManagedBlockKind = 'file-header' | 'table-header' | 'generated-file';
 export type SchemaGuardrailMode = 'check' | 'sync';
 export type SchemaGraphFileLayer = 'declarative' | 'idempotent';
 export type SchemaGraphFileAuthoringRole = 'declarative-owner' | 'operational';
 export type BoundaryGuidanceWarningKind = 'schema' | 'function' | 'policy' | 'security_definer' | 'trigger_function' | 'trigger_dispatch_gap' | 'managed_boundary';
 export type LocalBlindSpotBlockerKind = 'cross-schema-rls' | 'dynamic-sql' | 'dynamic-sql-infra' | 'extension-placement';
 export type SchemaGuardrailPhaseId = 'load_sources' | 'build_static_graph' | 'validate_ownership' | 'compare_generated_headers' | 'refresh_generated_headers' | 'handoff_db_sync' | 'runtime_reconcile' | 'publish_report';
-export type SchemaGuardrailFailureCode = 'source_load_failed' | 'duplicate_table_owner' | 'duplicate_function_owner' | 'policy_ownership_conflict' | 'raw_cross_schema_rls_blocked' | 'dynamic_sql_blocked' | 'extension_placement_blocked' | 'stale_generated_header' | 'generated_header_validation_failed' | 'generated_header_rewrite_failed' | 'static_graph_build_failed' | 'critical_runtime_graph_contradiction' | 'sync_apply_failed';
+export type SchemaGuardrailFailureCode = 'source_load_failed' | 'duplicate_table_owner' | 'duplicate_function_owner' | 'policy_ownership_conflict' | 'raw_cross_schema_rls_blocked' | 'dynamic_sql_blocked' | 'extension_placement_blocked' | 'stale_generated_header' | 'function_acl_migration_required' | 'generated_header_validation_failed' | 'generated_header_rewrite_failed' | 'static_graph_build_failed' | 'critical_runtime_graph_contradiction' | 'sync_apply_failed';
 export interface SchemaGraphFileNode {
     path: string;
     sourceLayer: SchemaGraphFileLayer;

package/dist/commands/db/utils/duplicate-function-ownership-allowlist.d.ts

@@ -0,0 +1,13 @@
+import type { DuplicateFunctionOwnershipFinding } from './duplicate-function-ownership.js';
+import type { SchemaGuardrailConfig } from '../sync/schema-guardrail-types.js';
+export declare function isAllowlistedDuplicateFunction(params: {
+    finding: DuplicateFunctionOwnershipFinding;
+    allowlist: SchemaGuardrailConfig['allowedDuplicateFunctions'];
+    bodyHashes?: Map<string, string>;
+}): boolean;
+export declare function filterAllowlistedDuplicateFunctions(params: {
+    findings: DuplicateFunctionOwnershipFinding[];
+    allowlist: SchemaGuardrailConfig['allowedDuplicateFunctions'];
+    bodyHashes?: Map<string, string>;
+}): DuplicateFunctionOwnershipFinding[];
+//# sourceMappingURL=duplicate-function-ownership-allowlist.d.ts.map

package/dist/commands/db/utils/function-acl-manifest.d.ts

@@ -0,0 +1,39 @@
+import type { SqlFile } from './declarative-dependency-sql-utils.js';
+import { type IdempotentTouchMetadata } from '../sync/schema-guardrail-graph-types.js';
+export declare const FUNCTION_ACL_RECONCILIATION_RELATIVE_PATH = "supabase/schemas/idempotent/18_function_acl_reconciliation.sql";
+declare const FUNCTION_ACL_ROLE_ORDER: readonly ["anon", "authenticated", "service_role"];
+export type FunctionAclGrantRole = (typeof FUNCTION_ACL_ROLE_ORDER)[number];
+export type FunctionAclAnnotationRole = FunctionAclGrantRole | 'internal';
+export interface FunctionAclFunctionEntry {
+    qualifiedName: string;
+    qualifiedSignature: string;
+    signature: string;
+    mode: 'internal' | 'grant';
+    roles: FunctionAclGrantRole[];
+    sourceFile: string;
+    line: number;
+}
+export interface FunctionAclSchemaUsageEntry {
+    schema: string;
+    roles: FunctionAclGrantRole[];
+    sourceFile: string;
+    line: number;
+}
+export interface FunctionAclManifest {
+    reconciliationFile: string;
+    functions: FunctionAclFunctionEntry[];
+    schemaUsages: FunctionAclSchemaUsageEntry[];
+}
+export declare function parseFunctionAclTarget(value: string): string | null;
+export declare function functionAclManifestHasEntries(manifest: FunctionAclManifest): boolean;
+export declare function buildFunctionAclIdempotentTouchMetadata(manifest: FunctionAclManifest): IdempotentTouchMetadata;
+export declare function buildFunctionAclManifestFromSqlFiles(declarativeFiles: SqlFile[]): FunctionAclManifest;
+export declare function loadFunctionAclManifest(targetDir: string, declarativeSqlDir: string): FunctionAclManifest;
+export declare function loadFunctionAclManifestFromDeclarativeDir(declarativeDir: string): FunctionAclManifest;
+export declare function validateFunctionAclMigration(manifest: FunctionAclManifest, existingContent: string): string[];
+export declare function renderFunctionAclFile(manifest: FunctionAclManifest): string;
+export declare function isManagedFunctionAclFileContentStale(manifest: FunctionAclManifest, existingContent: string): boolean;
+export declare function extractManagedFunctionAclTargets(manifest: FunctionAclManifest): Set<string>;
+export declare function extractManagedSchemaUsageTargets(manifest: FunctionAclManifest): Set<string>;
+export {};
+//# sourceMappingURL=function-acl-manifest.d.ts.map

package/dist/commands/upgrade.d.ts

@@ -33,6 +33,42 @@
  *   runa upgrade --templates-version <version>  # Override templates version
  *   runa upgrade --fresh      # Clear templates cache before fetching
  */
+import { type ConflictResolutionRule, type ConflictResolutionStrategy } from '@runa-ai/runa';
 import { Command } from 'commander';
+interface UpgradeOptions {
+    preview?: boolean;
+    force?: boolean;
+    keepLocal?: boolean;
+    yes?: boolean;
+    verify?: boolean;
+    packages?: boolean;
+    /** Keep backup after successful upgrade (for manual rollback) */
+    backup?: boolean;
+    /** Rollback to a specific transaction ID */
+    rollback?: string;
+    /** Rollback to the latest backup */
+    rollbackLatest?: boolean;
+    /** List available backups */
+    listBackups?: boolean;
+    /** Only sync specific categories */
+    only?: string;
+    /** Templates version override */
+    templatesVersion?: string;
+    /** Clear templates cache */
+    fresh?: boolean;
+}
+interface UpgradeConflictResolutionConfig {
+    defaultStrategy: ConflictResolutionStrategy;
+    rules: ConflictResolutionRule[];
+}
+export declare function findFilesWithMergeMarkers(targetDir: string): string[];
+export declare function assertNoExistingMergeMarkers(targetDir: string): void;
+export declare function loadUpgradeConflictResolutionConfig(cwd?: string): UpgradeConflictResolutionConfig;
+export declare function resolveTemplatesVersionForUpgrade(params: {
+    cwd: string;
+    options: UpgradeOptions;
+    shouldUpdatePackages: boolean;
+}): Promise<string | undefined>;
 export declare const upgradeCommand: Command;
+export {};
 //# sourceMappingURL=upgrade.d.ts.map