@runa-ai/runa-cli 0.10.3 → 0.10.5

package/dist/{chunk-XFXGFUAM.js → chunk-XVGMGFKF.js}

@@ -9,7 +9,7 @@ init_esm_shims();
 var riskDetectorModulePromise = null;
 async function loadRiskDetectorModule() {
   if (!riskDetectorModulePromise) {
-    riskDetectorModulePromise = import('./risk-detector-core-YI3M6INI.js').catch((error) => {
+    riskDetectorModulePromise = import('./risk-detector-core-CHUY6M5N.js').catch((error) => {
       riskDetectorModulePromise = null;
       throw error;
     });

package/dist/{chunk-WGRVAGSR.js → chunk-ZDETCPCE.js}

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { env } from './chunk-UHDAYPHH.js';
+import { env } from './chunk-47BG6DRP.js';
 import { redactSecrets } from './chunk-II7VYQEM.js';
-import { init_local_supabase, buildLocalDatabaseUrl } from './chunk-QSEF4T3Y.js';
+import { init_local_supabase, buildLocalDatabaseUrl } from './chunk-F2AQ3EYJ.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { CLIError } from '@runa-ai/runa';
 

package/dist/{ci-6P7VK6WB.js → ci-WOP7K7MS.js}

@@ -1,25 +1,27 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, isIdempotentRoleHazard, detectAppSchemas, formatSchemasForSql, getDbPlanArtifactPath, runDbApply } from './chunk-S7VGVFYF.js';
-import './chunk-WGRVAGSR.js';
-import './chunk-HWR5NUUZ.js';
-import './chunk-UHDAYPHH.js';
+import { runDbApply } from './chunk-TXXGDJYB.js';
+import { normalizeDatabaseUrlForDdl, parseBoolish, enhanceConnectionError, isIdempotentRoleHazard, detectAppSchemas, formatSchemasForSql, getDbPlanArtifactPath } from './chunk-WHVJ4JMQ.js';
 import './chunk-EZ46JIEO.js';
+import './chunk-ZDETCPCE.js';
+import './chunk-HWR5NUUZ.js';
+import './chunk-47BG6DRP.js';
+import { createInitialSummary, resolveMode, appendGithubStepSummary, buildCiProdApplyStepSummaryMarkdown, setSummaryErrorFromUnknown, writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput, requireCiAutoApprove, resolveProdApplyInputs, parseIntOr, classifyCiProdApplyError, addGithubMask } from './chunk-EXR4J2JT.js';
+import './chunk-O3M7A73M.js';
+import { parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, psqlSyncQuery } from './chunk-A6A7JIRD.js';
 import './chunk-IWVXI5O4.js';
-import './chunk-SS7RIWW3.js';
+import './chunk-FZONYKNR.js';
 import './chunk-B7C7CLW2.js';
 import './chunk-QDF7QXBL.js';
 import { getSnapshotStateName, getSnapshotStatePaths, isSnapshotComplete } from './chunk-XVNDDHAF.js';
-import { createInitialSummary, resolveMode, appendGithubStepSummary, buildCiProdApplyStepSummaryMarkdown, setSummaryErrorFromUnknown, writeEnvLocal, startAppBackground, waitForAppReady, executePrSetupBase, createErrorOutput, requireCiAutoApprove, resolveProdApplyInputs, parseIntOr, classifyCiProdApplyError, addGithubMask } from './chunk-EXR4J2JT.js';
-import './chunk-O3M7A73M.js';
-import { parsePostgresUrl, buildPsqlArgs, buildPsqlEnv, psqlSyncQuery } from './chunk-A6A7JIRD.js';
 import { ensureRunaTmpDir, runLogged } from './chunk-ELXXQIGW.js';
 import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
 import { getSafeEnv, getFilteredEnv, redactSecrets } from './chunk-II7VYQEM.js';
-import { init_constants, init_local_supabase, detectLocalSupabasePorts } from './chunk-QSEF4T3Y.js';
+import { init_constants } from './chunk-NOXYPVMZ.js';
 import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
 import './chunk-WJXC4MVY.js';
 import { setOutputFormat } from './chunk-HKUWEGUX.js';
+import { init_local_supabase, detectLocalSupabasePorts } from './chunk-F2AQ3EYJ.js';
 import './chunk-OERS32LW.js';
 import './chunk-GT5DMS5R.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';

package/dist/{cli-Q665YRVT.js → cli-4HI3D2II.js}

@@ -2,7 +2,7 @@
 import { createRequire } from 'module';
 import { enableNonInteractiveMode } from './chunk-6Y3LAUGL.js';
 import { getRequestedCommandNameFromArgv } from './chunk-UWWSAPDR.js';
-import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-SS7RIWW3.js';
+import { CLI_VERSION, HAS_ADMIN_COMMAND } from './chunk-FZONYKNR.js';
 import { emitDefaultSuccessIfNeeded } from './chunk-WJXC4MVY.js';
 import { parseOutputFormat, setOutputFormat, getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
@@ -165,12 +165,12 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
       return;
     }
     if (requested === "build") {
-      const { buildCommand: buildCommand2 } = await import('./build-P2A6345N.js');
+      const { buildCommand: buildCommand2 } = await import('./build-C65G2QQE.js');
       program.addCommand(buildCommand2);
       return;
     }
     if (requested === "dev") {
-      const { devCommand: devCommand2 } = await import('./dev-QR55VDNZ.js');
+      const { devCommand: devCommand2 } = await import('./dev-N3BFJZ7F.js');
       program.addCommand(devCommand2);
       return;
     }
@@ -187,8 +187,8 @@ async function registerProjectLifecycleCommands(program, requested, loadAllComma
     import('./prepare-32DOVHTE.js'),
     import('./upgrade-X7P6WRD5.js'),
     import('./validate-CAAW4Y44.js'),
-    import('./build-P2A6345N.js'),
-    import('./dev-QR55VDNZ.js')
+    import('./build-C65G2QQE.js'),
+    import('./dev-N3BFJZ7F.js')
   ]);
   program.addCommand(initCommand);
   program.addCommand(prepareCommand);
@@ -462,11 +462,11 @@ async function registerFocusedStatusUtilityCommand(program, requested) {
   return false;
 }
 async function registerCiCommand(program) {
-  const { ciCommand } = await import('./ci-6P7VK6WB.js');
+  const { ciCommand } = await import('./ci-WOP7K7MS.js');
   program.addCommand(ciCommand);
 }
 async function registerDbCommand(program) {
-  const { dbCommand } = await import('./db-BQOVOQXU.js');
+  const { dbCommand } = await import('./db-DO6L72RR.js');
   program.addCommand(dbCommand);
 }
 async function registerServicesCommand(program) {
@@ -474,11 +474,11 @@ async function registerServicesCommand(program) {
   program.addCommand(servicesCommand);
 }
 async function registerEnvCommand(program) {
-  const { envCommand } = await import('./env-KYR6Q7WO.js');
+  const { envCommand } = await import('./env-2XM45E7O.js');
   program.addCommand(envCommand);
 }
 async function registerHotfixCommand(program) {
-  const { hotfixCommand } = await import('./hotfix-JYHDY2M6.js');
+  const { hotfixCommand } = await import('./hotfix-QP5J6FCD.js');
   program.addCommand(hotfixCommand);
 }
 async function registerSdkCommand(program) {
@@ -490,7 +490,7 @@ async function registerUiCommand(program) {
   program.addCommand(uiCommand);
 }
 async function registerWatchCommand(program) {
-  const { watchCommand } = await import('./watch-4RHXVCQ3.js');
+  const { watchCommand } = await import('./watch-VQQHKDNQ.js');
   program.addCommand(watchCommand);
 }
 async function registerWorkflowCommand(program) {
@@ -498,7 +498,7 @@ async function registerWorkflowCommand(program) {
   program.addCommand(workflowCommand);
 }
 async function registerVulnCheckCommand(program) {
-  const { vulnCheckCommand } = await import('./vuln-check-WW43E7PS.js');
+  const { vulnCheckCommand } = await import('./vuln-check-OE4KSASO.js');
   program.addCommand(vulnCheckCommand);
 }
 async function registerTemplateCheckCommand(program) {
@@ -714,7 +714,7 @@ async function executeProgram(program) {
       silent: true
     });
     await enforceLicenseInCI();
-    await import('./env-XPPACZM4.js');
+    await import('./env-KIMSQSPS.js');
   }
   await program.parseAsync(process.argv);
 }

package/dist/{db-BQOVOQXU.js → db-DO6L72RR.js}

@@ -1,30 +1,32 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { detectDatabaseStack, getStackPaths } from './chunk-MILCC3B6.js';
-import { categorizeRisks, detectSchemaRisks } from './chunk-XFXGFUAM.js';
-import { isExecaError, resolveDbPreviewEnvironment, buildDbPlanCommandLabel, runDbApply, buildDbApplyCliError, DbPlanOutputSchema, parseDbPreviewProfile, DEFAULT_DB_PREVIEW_PROFILE, getDbPreviewModeLabel, buildDbPreviewCommandLabel, isCompareOnlyPreviewProfile, DbApplyOutputSchema, applyCommand, getDbPreviewIdempotentSchemaCount, classifyDbSyncCommandFailure, getDbSyncFallbackSuggestions, detectAppSchemas, normalizeDatabaseUrlForDdl, analyzeDuplicateFunctionOwnership, formatDuplicateFunctionOwnershipFinding, reviewDeclarativeDependencyWarnings, logDeclarativeDependencyWarnings, buildDeclarativeDependencyWarningFailureLines, parsePlanOutput, validateDependencyOrder, getBoundaryPolicy, resolveProductionApplyStrictMode, findDeclarativeRiskAllowlistMatch, assertBoundaryPolicyUsable, assertBoundaryPolicyQualityGate, formatSchemasForSql, findDirectoryPlacementAllowlistMatch, formatAllowlistMetadata, FUNCTION_ACL_RECONCILIATION_RELATIVE_PATH, functionAclManifestHasEntries, validateFunctionAclMigration, isManagedFunctionAclFileContentStale, renderFunctionAclFile, assessPlanSize, formatPlanSizeSummary, buildFunctionAclManifestFromSqlFiles, buildFunctionAclIdempotentTouchMetadata, stableSorted, normalizePolicyCommand, normalizeFileList, extractFunctionOwnershipDefinition, SECURITY_DEFINER_RE, MANAGED_BOUNDARY_SCHEMAS, currentIsoTimestamp, makeGraphVersion, GENERATOR_VERSION, MAX_SCHEMA_GUIDANCE_TARGETS_PER_FILE, QUALIFIED_SQL_OBJECT_RE, SEARCH_PATH_LOCK_RE, TRIGGER_GUIDANCE_SUPPRESSED_FUNCTIONS, SQL_EXTENSION_IDENTIFIER_PATTERN, SQL_IDENTIFIER_PATTERN } from './chunk-S7VGVFYF.js';
 import { createError } from './chunk-NIS77243.js';
-import { resolveDatabaseUrl, resolveDatabaseTarget, tryResolveDatabaseUrl } from './chunk-WGRVAGSR.js';
-export { resolveDatabaseUrl, tryResolveDatabaseUrl } from './chunk-WGRVAGSR.js';
-import { analyzeDeclarativeDependencyContract, formatDeclarativeDependencyViolation, parseSqlFilename, collectSqlFiles, splitSqlStatements, ALLOW_DYNAMIC_SQL_ANNOTATION, extractFirstDollarBody, sanitizeExecutableCode, detectExtensionFilePath, FUNCTION_DEFINITION_RE, blankQuotedStrings, sanitizeExecutableCodePreserveStrings, countNewlines, shouldReviewUnknownDeclarativeDdl, extractDdlObject, isNonSchemaOperation, isNonDdlMaintenanceStatement, shouldReviewUnknownIdempotentDdl } from './chunk-HWR5NUUZ.js';
-import './chunk-UHDAYPHH.js';
+import { detectDatabaseStack, getStackPaths } from './chunk-MILCC3B6.js';
+import { categorizeRisks, detectSchemaRisks } from './chunk-XVGMGFKF.js';
+import { isExecaError, resolveDbPreviewEnvironment, buildDbPlanCommandLabel, runDbApply, buildDbApplyCliError, parseDbPreviewProfile, DEFAULT_DB_PREVIEW_PROFILE, getDbPreviewModeLabel, buildDbPreviewCommandLabel, isCompareOnlyPreviewProfile, applyCommand, getDbPreviewIdempotentSchemaCount, classifyDbSyncCommandFailure, getDbSyncFallbackSuggestions, reviewDeclarativeDependencyWarnings, logDeclarativeDependencyWarnings, buildDeclarativeDependencyWarningFailureLines, getBoundaryPolicy, resolveProductionApplyStrictMode, findDeclarativeRiskAllowlistMatch, assertBoundaryPolicyUsable, assertBoundaryPolicyQualityGate, findDirectoryPlacementAllowlistMatch, formatAllowlistMetadata, assessPlanSize, formatPlanSizeSummary } from './chunk-TXXGDJYB.js';
+import { DbPlanOutputSchema, DbApplyOutputSchema, detectAppSchemas, normalizeDatabaseUrlForDdl, analyzeDuplicateFunctionOwnership, formatDuplicateFunctionOwnershipFinding, parsePlanOutput, validateDependencyOrder, formatSchemasForSql, FUNCTION_ACL_RECONCILIATION_RELATIVE_PATH, functionAclManifestHasEntries, validateFunctionAclMigration, isManagedFunctionAclFileContentStale, renderFunctionAclFile, buildFunctionAclManifestFromSqlFiles, buildFunctionAclIdempotentTouchMetadata, stableSorted, normalizePolicyCommand, normalizeFileList, extractFunctionOwnershipDefinition, SECURITY_DEFINER_RE, MANAGED_BOUNDARY_SCHEMAS, currentIsoTimestamp, makeGraphVersion, GENERATOR_VERSION, MAX_SCHEMA_GUIDANCE_TARGETS_PER_FILE, QUALIFIED_SQL_OBJECT_RE, SEARCH_PATH_LOCK_RE, TRIGGER_GUIDANCE_SUPPRESSED_FUNCTIONS, SQL_EXTENSION_IDENTIFIER_PATTERN, SQL_IDENTIFIER_PATTERN } from './chunk-WHVJ4JMQ.js';
 import './chunk-EZ46JIEO.js';
+import { resolveDatabaseUrl, resolveDatabaseTarget, tryResolveDatabaseUrl } from './chunk-ZDETCPCE.js';
+export { resolveDatabaseUrl, tryResolveDatabaseUrl } from './chunk-ZDETCPCE.js';
+import { analyzeDeclarativeDependencyContract, formatDeclarativeDependencyViolation, parseSqlFilename, collectSqlFiles, splitSqlStatements, ALLOW_DYNAMIC_SQL_ANNOTATION, extractFirstDollarBody, sanitizeExecutableCode, detectExtensionFilePath, FUNCTION_DEFINITION_RE, blankQuotedStrings, sanitizeExecutableCodePreserveStrings, countNewlines, shouldReviewUnknownDeclarativeDdl, extractDdlObject, isNonSchemaOperation, isNonDdlMaintenanceStatement, shouldReviewUnknownIdempotentDdl } from './chunk-HWR5NUUZ.js';
+import './chunk-47BG6DRP.js';
+import { writeEnvLocalBridge, removeEnvLocalBridge } from './chunk-KUH3G522.js';
+import { extractSchemaTablesAndEnums, fetchDbTablesAndEnums, extractTablesFromIdempotentSql, extractDynamicTablePatternsFromIdempotentSql, diffSchema, getSqlParserUtils, buildTablePatternMatcher } from './chunk-O3M7A73M.js';
+import { psqlExec, psqlQuery, blankDollarQuotedBodies, stripSqlComments, parsePostgresUrl, buildPsqlArgs, buildPsqlEnv } from './chunk-A6A7JIRD.js';
 import { loadEnvFiles } from './chunk-IWVXI5O4.js';
-import './chunk-SS7RIWW3.js';
+import './chunk-FZONYKNR.js';
 import { diagnoseSupabaseStart } from './chunk-AAIE4F2U.js';
 import { validateUserFilePath, filterSafePaths, resolveSafePath } from './chunk-B7C7CLW2.js';
 import { runMachine } from './chunk-QDF7QXBL.js';
 import './chunk-XVNDDHAF.js';
-import { writeEnvLocalBridge, removeEnvLocalBridge } from './chunk-KUH3G522.js';
-import { extractSchemaTablesAndEnums, fetchDbTablesAndEnums, extractTablesFromIdempotentSql, extractDynamicTablePatternsFromIdempotentSql, diffSchema, getSqlParserUtils, buildTablePatternMatcher } from './chunk-O3M7A73M.js';
-import { psqlExec, psqlQuery, blankDollarQuotedBodies, stripSqlComments, parsePostgresUrl, buildPsqlArgs, buildPsqlEnv } from './chunk-A6A7JIRD.js';
 import { redactSecrets } from './chunk-II7VYQEM.js';
-import { init_local_supabase, init_constants, detectLocalSupabasePorts, buildLocalDatabaseUrl, DATABASE_DEFAULTS, SEED_DEFAULTS, SCRIPT_LOCATIONS } from './chunk-QSEF4T3Y.js';
-export { DATABASE_DEFAULTS, SCRIPT_LOCATIONS, SEED_DEFAULTS } from './chunk-QSEF4T3Y.js';
+import { init_constants, DATABASE_DEFAULTS, SEED_DEFAULTS, SCRIPT_LOCATIONS } from './chunk-NOXYPVMZ.js';
+export { DATABASE_DEFAULTS, SCRIPT_LOCATIONS, SEED_DEFAULTS } from './chunk-NOXYPVMZ.js';
 import { secureSupabase, secureDocker } from './chunk-RZLYEO4U.js';
 import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
 import './chunk-WJXC4MVY.js';
 import { getOutputFormatFromEnv } from './chunk-HKUWEGUX.js';
+import { init_local_supabase, detectLocalSupabasePorts, buildLocalDatabaseUrl } from './chunk-F2AQ3EYJ.js';
 import { getDatabasePackagePath, loadRunaConfig, getSDKScriptsPath } from './chunk-OERS32LW.js';
 import { findRunaConfig, findWorkspaceRoot } from './chunk-GT5DMS5R.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
@@ -4205,7 +4207,7 @@ init_esm_shims();
 var riskDetectorLoader = null;
 function loadRiskDetectorModule() {
   if (!riskDetectorLoader) {
-    riskDetectorLoader = import('./risk-detector-GDDLISVE.js').then((module) => ({
+    riskDetectorLoader = import('./risk-detector-4D5HRUMY.js').then((module) => ({
       detectSchemaRisks: module.detectSchemaRisks
     })).catch((error) => {
       riskDetectorLoader = null;
@@ -5508,30 +5510,49 @@ function reconcileRuntimeTableNode(params) {
     ];
   }
   const contradictions = [];
-  if (normalizeFkSet(params.runtimeTable.foreignKeys ?? []).join("|") !== normalizeFkSet(params.tableNode.outboundForeignKeys).join("|")) {
-    contradictions.push({
-      code: "RUNTIME_FK_MISMATCH",
-      target: params.tableNode.qualifiedName,
-      details: "Runtime foreign keys differ from static graph"
-    });
+  const declarativeFks = normalizeFkSet(params.tableNode.outboundForeignKeys);
+  if (declarativeFks.length > 0) {
+    const runtimeFkSet = new Set(normalizeFkSet(params.runtimeTable.foreignKeys ?? []));
+    const missingFks = declarativeFks.filter((fk) => !runtimeFkSet.has(fk));
+    if (missingFks.length > 0) {
+      contradictions.push({
+        code: "RUNTIME_FK_MISMATCH",
+        target: params.tableNode.qualifiedName,
+        details: `Declarative foreign key(s) missing from runtime: ${missingFks.join(", ")}`
+      });
+    }
   }
-  if (normalizeNameSet((params.runtimeTable.rlsPolicies ?? []).map((policy) => policy.name)).join(
-    "|"
-  ) !== normalizeNameSet(params.tableNode.policies.map((policy) => policy.name)).join("|")) {
-    contradictions.push({
-      code: "RUNTIME_POLICY_MISMATCH",
-      target: params.tableNode.qualifiedName,
-      details: "Runtime policy names differ from static graph"
-    });
+  const declarativePolicies = normalizeNameSet(
+    params.tableNode.policies.map((policy) => policy.name)
+  );
+  if (declarativePolicies.length > 0) {
+    const runtimePolicySet = new Set(
+      normalizeNameSet((params.runtimeTable.rlsPolicies ?? []).map((policy) => policy.name))
+    );
+    const missingPolicies = declarativePolicies.filter((p) => !runtimePolicySet.has(p));
+    if (missingPolicies.length > 0) {
+      contradictions.push({
+        code: "RUNTIME_POLICY_MISMATCH",
+        target: params.tableNode.qualifiedName,
+        details: `Declarative RLS policy(s) missing from runtime: ${missingPolicies.join(", ")}`
+      });
+    }
   }
-  if (normalizeNameSet((params.runtimeTable.triggers ?? []).map((trigger) => trigger.name)).join(
-    "|"
-  ) !== normalizeNameSet(params.tableNode.triggers.map((trigger) => trigger.name)).join("|")) {
-    contradictions.push({
-      code: "RUNTIME_TRIGGER_MISMATCH",
-      target: params.tableNode.qualifiedName,
-      details: "Runtime trigger names differ from static graph"
-    });
+  const declarativeTriggers = normalizeNameSet(
+    params.tableNode.triggers.map((trigger) => trigger.name)
+  );
+  if (declarativeTriggers.length > 0) {
+    const runtimeTriggerSet = new Set(
+      normalizeNameSet((params.runtimeTable.triggers ?? []).map((trigger) => trigger.name))
+    );
+    const missingTriggers = declarativeTriggers.filter((t) => !runtimeTriggerSet.has(t));
+    if (missingTriggers.length > 0) {
+      contradictions.push({
+        code: "RUNTIME_TRIGGER_MISMATCH",
+        target: params.tableNode.qualifiedName,
+        details: `Declarative trigger(s) missing from runtime: ${missingTriggers.join(", ")}`
+      });
+    }
   }
   return contradictions;
 }
@@ -8429,6 +8450,37 @@ function tryGetProductionAdminUrl(targetDir) {
   }
   return void 0;
 }
+function validateProductionPlan(planOutput, log) {
+  if (!planOutput.trim() || planOutput.includes("No changes")) {
+    log.info("\u2705 Production schema is up-to-date (no changes needed)");
+    return;
+  }
+  const plan = parsePlanOutput(planOutput);
+  const orderIssues = validateDependencyOrder(plan);
+  if (orderIssues.length > 0) {
+    for (const issue of orderIssues) {
+      logger3.error(issue);
+    }
+    throw new Error(
+      `\u274C Production DDL ordering issue detected (${orderIssues.length} problem(s)):
+` + orderIssues.map((i) => `  \u2022 ${i}`).join("\n") + "\n\nThis plan would fail during production deploy. The automatic reorder will attempt to fix this, but review the ordering."
+    );
+  }
+  log.info("\u2705 Production DDL ordering verified");
+}
+async function resolveTempDbDsnForProductionCheck(targetDir) {
+  const envDsn = process.env.PG_SCHEMA_DIFF_TEMP_DB_DSN?.trim();
+  if (envDsn) return envDsn;
+  try {
+    const { buildLocalDatabaseUrl: buildLocalDatabaseUrl2 } = await import('./local-supabase-KTTC3O2L.js');
+    const { verifyDatabaseConnection } = await import('./helpers-RHAZLOLQ.js');
+    const localDsn = buildLocalDatabaseUrl2(targetDir);
+    await verifyDatabaseConnection(localDsn, { maxRetries: 0 });
+    return localDsn;
+  } catch {
+  }
+  return void 0;
+}
 async function runProductionDdlOrderCheck(params) {
   const productionUrl = tryGetProductionAdminUrl(params.targetDir);
   if (productionUrl) {
@@ -8448,30 +8500,16 @@ async function runProductionDdlOrderCheck(params) {
   params.logger.info("\u{1F50D} Checking production DDL ordering...");
   try {
     const { executePgSchemaDiffPlan } = await import('./pg-schema-diff-helpers-JZO4GAQG.js');
+    const tempDbDsn = await resolveTempDbDsnForProductionCheck(params.targetDir);
     const { planOutput } = executePgSchemaDiffPlan(
       productionUrl,
       schemasDir,
       includeSchemas,
       false,
       // not verbose
-      { targetDir: params.targetDir }
+      { targetDir: params.targetDir, tempDbDsn }
     );
-    if (!planOutput.trim() || planOutput.includes("No changes")) {
-      params.logger.info("\u2705 Production schema is up-to-date (no changes needed)");
-      return;
-    }
-    const plan = parsePlanOutput(planOutput);
-    const orderIssues = validateDependencyOrder(plan);
-    if (orderIssues.length > 0) {
-      for (const issue of orderIssues) {
-        logger3.error(issue);
-      }
-      throw new Error(
-        `\u274C Production DDL ordering issue detected (${orderIssues.length} problem(s)):
-` + orderIssues.map((i) => `  \u2022 ${i}`).join("\n") + "\n\nThis plan would fail during production deploy. The automatic reorder will attempt to fix this, but review the ordering."
-      );
-    }
-    params.logger.info("\u2705 Production DDL ordering verified");
+    validateProductionPlan(planOutput, params.logger);
   } catch (error) {
     if (error instanceof Error && error.message.includes("DDL ordering issue")) {
       throw error;

package/dist/{dev-QR55VDNZ.js → dev-N3BFJZ7F.js}

@@ -4,16 +4,17 @@ import { startAppBackground, waitForAppReady, detectApp } from './chunk-EXR4J2JT
 import { writeEnvLocalBridge } from './chunk-KUH3G522.js';
 import { generateTablesManifest } from './chunk-O3M7A73M.js';
 import './chunk-A6A7JIRD.js';
-import { manifestActor, supabaseStartActor, envCheckActor, depsInstallActor, detectManifestTask, detectDatabase } from './chunk-MAFJAA2P.js';
+import { manifestActor, supabaseStartActor, envCheckActor, depsInstallActor, detectManifestTask, detectDatabase } from './chunk-C3SRIUWX.js';
 import { findRepoRoot } from './chunk-3WDV32GA.js';
 import './chunk-ELXXQIGW.js';
 import { createMachineStateChangeLogger } from './chunk-5FT3F36G.js';
 import './chunk-II7VYQEM.js';
-import { init_local_supabase, buildLocalDatabaseUrl, detectLocalSupabasePorts } from './chunk-QSEF4T3Y.js';
+import './chunk-NOXYPVMZ.js';
 import { secureExeca } from './chunk-RZLYEO4U.js';
 import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
 import './chunk-WJXC4MVY.js';
 import './chunk-HKUWEGUX.js';
+import { init_local_supabase, buildLocalDatabaseUrl, detectLocalSupabasePorts } from './chunk-F2AQ3EYJ.js';
 import './chunk-OERS32LW.js';
 import './chunk-GT5DMS5R.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';

package/dist/{env-KYR6Q7WO.js → env-2XM45E7O.js}

@@ -2,17 +2,18 @@
 import { createRequire } from 'module';
 import { isNonInteractiveEnabled } from './chunk-6Y3LAUGL.js';
 import { registerCleanup } from './chunk-TYIAD6SB.js';
-import { tryResolveDatabaseUrl } from './chunk-WGRVAGSR.js';
-import './chunk-UHDAYPHH.js';
+import { tryResolveDatabaseUrl } from './chunk-ZDETCPCE.js';
+import './chunk-47BG6DRP.js';
 import { loadEnvFiles } from './chunk-IWVXI5O4.js';
 import { getVercelRootDirectory } from './chunk-MXRWBNIY.js';
 import { syncRunaConfigWithVercel } from './chunk-6AALH2ED.js';
 import './chunk-B7C7CLW2.js';
 import './chunk-II7VYQEM.js';
-import { init_local_supabase, getLocalSupabaseEnvValues, getLocalValueDescriptions } from './chunk-QSEF4T3Y.js';
+import './chunk-NOXYPVMZ.js';
 import { emitJsonSuccess } from './chunk-KE6QJBZG.js';
 import './chunk-WJXC4MVY.js';
 import './chunk-HKUWEGUX.js';
+import { init_local_supabase, getLocalSupabaseEnvValues, getLocalValueDescriptions } from './chunk-F2AQ3EYJ.js';
 import './chunk-GT5DMS5R.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { Command } from 'commander';

package/dist/{env-XPPACZM4.js → env-KIMSQSPS.js}

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-export { env, getDatabaseUrl, hasEnv, isCI, isDebug, sanitizeEnv } from './chunk-UHDAYPHH.js';
-import './chunk-QSEF4T3Y.js';
+export { env, getDatabaseUrl, hasEnv, isCI, isDebug, sanitizeEnv } from './chunk-47BG6DRP.js';
+import './chunk-NOXYPVMZ.js';
+import './chunk-F2AQ3EYJ.js';
 import './chunk-VRXHCR5K.js';
 
 createRequire(import.meta.url);

package/dist/helpers-RHAZLOLQ.js

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+export { ALLOWED_DDL_PREFIXES, BASE_DELAY_MS, BLOCKED_SQL_PATTERNS, DEFAULT_MAX_DELAY_MS, DbPlanArtifactSchema, MAX_RETRIES, MIGRATION_LOCK_ID, acquireAdvisoryLock, backupIdempotentTables, bootstrapTempDbFromSource, buildAllowedHazards, buildCheckConstraintQuery, buildCheckModePlanSummary, buildNotNullQuery, buildTargetFingerprint, buildTempDbBootstrapStatements, buildTypeCastQuery, buildUniqueQuery, calculateBackoffDelay, checkDataCompatibility, checkPasswordSecurity, cleanPartitionAclsForPgSchemaDiff, cleanupOrphanShadowDatabases, createShadowDbWithExtensions, detectPartitionDrift, detectPlannerSchemas, displayCheckModeResults, displayDataCompatibilityResults, displayHazardsWithContext, executePlanSqlWithRetry, filterCheckModePlanStatements, filterFalsePositiveHazards, filterIdempotentProtectedStatements, formatPartitionWarnings, getDbPlanArtifactPath, getIdempotentProtectedObjects, getIdempotentProtectedTables, getIdempotentRoles, getTableRowEstimates, getTransactionStrategy, handleFreshDbCase, handleHazardsWithContext, handleProductionAuthzProtection, handleProductionDataProtection, hasAppTables, hasTransactionIncompatibleContent, hasTransactionIncompatibleStatements, isDropStatementForProtectedObject, isIdempotentManagedAuthzStatement, isIdempotentManagedRlsStatement, isIdempotentRoleHazard, isLockTimeoutError, isNoChangePlanOutput, isValidIdentifier, maskDbCredentials, needsShadowDb, parseAddCheck, parseAddUnique, parseAlterType, parseCreateUniqueIndex, parseDbCredentials, parseExpectedPartitions, parseHazardsWithContext, parsePlanOutput, parseSetNotNull, persistDbPlanArtifact, prefilterPartitionStubs, qualifiedTable, queryActualPartitions, quoteIdent, releaseAdvisoryLock, reorderRawSqlDependencies, resetIdempotentRolesCache, resetManagedAuthzCache, setRolePasswords, sleep, stripLeadingSessionStatements, tryReuseDbPlanArtifact, validateDependencyOrder, validateDependencyOrderFromRawSql, validatePlanForExecution, validateStatementTypes, verifyDataIntegrity, wrapInTransaction } from './chunk-WHVJ4JMQ.js';
+import './chunk-EZ46JIEO.js';
+import './chunk-ZDETCPCE.js';
+export { PG_SCHEMA_DIFF_APPLY_TIMEOUT_MS, detectDropTableStatements, detectPartitionPrivilegeError, executePgSchemaDiffPlan, formatPartitionPrivilegeHint, freeConnectionSlotsForPgSchemaDiff, startConnectionCleanupDaemon, stopConnectionCleanupDaemon, verifyDatabaseConnection, verifyPgSchemaDiffBinary } from './chunk-HWR5NUUZ.js';
+import './chunk-47BG6DRP.js';
+export { blankDollarQuotedBodies } from './chunk-A6A7JIRD.js';
+import './chunk-FZONYKNR.js';
+import './chunk-II7VYQEM.js';
+import './chunk-NOXYPVMZ.js';
+import './chunk-F2AQ3EYJ.js';
+import './chunk-VRXHCR5K.js';
+
+createRequire(import.meta.url);

package/dist/{hotfix-JYHDY2M6.js → hotfix-QP5J6FCD.js}

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import { createError } from './chunk-NIS77243.js';
-import { tryResolveDatabaseUrl } from './chunk-WGRVAGSR.js';
-import './chunk-UHDAYPHH.js';
+import { tryResolveDatabaseUrl } from './chunk-ZDETCPCE.js';
+import './chunk-47BG6DRP.js';
 import { loadEnvFiles } from './chunk-IWVXI5O4.js';
 import { isPathContained } from './chunk-B7C7CLW2.js';
 import './chunk-II7VYQEM.js';
-import './chunk-QSEF4T3Y.js';
+import './chunk-NOXYPVMZ.js';
+import './chunk-F2AQ3EYJ.js';
 import './chunk-GT5DMS5R.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { Command } from 'commander';

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
 import { getRequestedCommandNameFromArgv } from './chunk-UWWSAPDR.js';
-import { CLI_VERSION } from './chunk-SS7RIWW3.js';
+import { CLI_VERSION } from './chunk-FZONYKNR.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { realpathSync } from 'fs';
 import { fileURLToPath } from 'url';
@@ -36,7 +36,7 @@ async function getProgram(options) {
   };
   const nextKey = getProgramCacheKey(resolvedOptions);
   if (!programInstance || programCacheKey !== nextKey) {
-    const { createProgram } = await import('./cli-Q665YRVT.js');
+    const { createProgram } = await import('./cli-4HI3D2II.js');
     programInstance = await createProgram(resolvedOptions);
     programCacheKey = nextKey;
   }
@@ -60,7 +60,7 @@ async function runCliFromProcessArgv() {
     return;
   }
   const { setupSignalHandlers } = await import('./signal-handler-DO3OANW5.js');
-  const { executeProgram } = await import('./cli-Q665YRVT.js');
+  const { executeProgram } = await import('./cli-4HI3D2II.js');
   setupSignalHandlers();
   const options = getProgramLoadOptions(argv);
   const program = await getProgram(options);

package/dist/local-supabase-KTTC3O2L.js

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import { createRequire } from 'module';
+import { init_local_supabase } from './chunk-F2AQ3EYJ.js';
+export { LOCAL_DATABASE_URL, LOCAL_REPLACEMENT_KEYS, LOCAL_SUPABASE_ANON_KEY, LOCAL_SUPABASE_ENV_VALUES, LOCAL_SUPABASE_SERVICE_ROLE_KEY, LOCAL_SUPABASE_URL, LOCAL_VALUE_DESCRIPTIONS, buildLocalDatabaseUrl, buildLocalSupabaseUrl, clearLocalSupabaseDetectionCache, detectLocalSupabasePorts, getLocalSupabaseEnvValues, getLocalValueDescriptions, parseTomlPort, validateLocalhostValues } from './chunk-F2AQ3EYJ.js';
+import './chunk-VRXHCR5K.js';
+
+createRequire(import.meta.url);
+init_local_supabase();

package/dist/{risk-detector-GDDLISVE.js → risk-detector-4D5HRUMY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-export { categorizeRisks, detectSchemaRisks } from './chunk-XFXGFUAM.js';
+export { categorizeRisks, detectSchemaRisks } from './chunk-XVGMGFKF.js';
 import './chunk-VRXHCR5K.js';
 
 createRequire(import.meta.url);

package/dist/{risk-detector-core-YI3M6INI.js → risk-detector-core-CHUY6M5N.js}

@@ -54,7 +54,7 @@ var UNQUALIFIED_EXTENSION_REFERENCE_PATTERNS = [
 var plpgsqlModulePromise = null;
 async function loadPlpgsqlRiskDetectorModule() {
   if (!plpgsqlModulePromise) {
-    plpgsqlModulePromise = import('./risk-detector-plpgsql-4GWEQXUG.js').catch((error) => {
+    plpgsqlModulePromise = import('./risk-detector-plpgsql-NNUZU3OQ.js').catch((error) => {
       plpgsqlModulePromise = null;
       throw error;
     });

package/dist/{vuln-check-WW43E7PS.js → vuln-check-OE4KSASO.js}

@@ -71,7 +71,7 @@ var vulnCheckCommand = new Command("vuln-check").description("Run comprehensive
   const logger = createCLILogger("vuln-check");
   const isJsonMode = getOutputFormatFromEnv() === "json" || options.format === "json";
   try {
-    const { VulnChecker } = await import('./vuln-checker-BC3ZAXJ3.js');
+    const { VulnChecker } = await import('./vuln-checker-LMHRSMYY.js');
     const categoryMap = {
       code: ["injection", "auth", "crypto"],
       deps: ["dependency"],

package/dist/{vuln-checker-BC3ZAXJ3.js → vuln-checker-LMHRSMYY.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { CLI_VERSION } from './chunk-SS7RIWW3.js';
+import { CLI_VERSION } from './chunk-FZONYKNR.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 import { glob } from 'glob';
 import { exec } from 'child_process';

package/dist/{watch-4RHXVCQ3.js → watch-VQQHKDNQ.js}

@@ -284,7 +284,7 @@ function validateSqlSchema(content, errors, warnings) {
 var riskDetectorLoader = null;
 function loadRiskDetectorModule() {
   if (!riskDetectorLoader) {
-    riskDetectorLoader = import('./risk-detector-GDDLISVE.js').then((module) => ({
+    riskDetectorLoader = import('./risk-detector-4D5HRUMY.js').then((module) => ({
       detectSchemaRisks: module.detectSchemaRisks
     })).catch((error) => {
       riskDetectorLoader = null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runa-ai/runa-cli",
-  "version": "0.10.3",
+  "version": "0.10.5",
   "private": false,
   "description": "AI-powered DevOps CLI",
   "type": "module",
@@ -56,8 +56,8 @@
     "typescript": "5.9.3",
     "xstate": "5.28.0",
     "zod": "4.3.6",
-    "@runa-ai/runa": "0.10.0",
-    "@runa-ai/runa-xstate-test-plugin": "0.10.0"
+    "@runa-ai/runa": "0.10.5",
+    "@runa-ai/runa-xstate-test-plugin": "0.10.5"
   },
   "engines": {
     "node": ">=20.0.0"

package/dist/{risk-detector-plpgsql-4GWEQXUG.js → risk-detector-plpgsql-NNUZU3OQ.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { createRequire } from 'module';
-import { splitPlpgsqlStatementsWithOffsets, parseTopLevelAssignment, extractExecuteExpressions, skipWhitespace, extractStaticSqlFromExpression, mergeStringEnvValue, skipIdentifier } from './chunk-EZ46JIEO.js';
 import { stripSqlCommentsPreserveLines, buildLineStarts, lineNumberFromIndex, stripSqlStringsPreserveLines, detectRisksFromContent, stripSqlForPatternMatching } from './chunk-3FDQW524.js';
+import { splitPlpgsqlStatementsWithOffsets, parseTopLevelAssignment, extractExecuteExpressions, skipWhitespace, extractStaticSqlFromExpression, mergeStringEnvValue, skipIdentifier } from './chunk-EZ46JIEO.js';
 import { init_esm_shims } from './chunk-VRXHCR5K.js';
 
 createRequire(import.meta.url);