@runa-ai/runa-cli 0.5.26

package/dist/commands/ci/utils/rls-verification.d.ts

@@ -0,0 +1,72 @@
+/**
+ * AI HINT: RLS (Row Level Security) verification utilities for CI operations
+ *
+ * Purpose: Verify database roles and RLS configuration for test execution
+ * Critical for: Layer 2 (pgTAP) and Layer 3 (Integration) tests
+ *
+ * Design decisions:
+ * - Only probe standard Supabase roles (authenticated, service_role)
+ * - Avoid hardcoding repo-specific roles/tables
+ * - Best-effort remediation: grant privileges when possible, skip when not
+ */
+export interface QueryScalarParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrl: string;
+    sql: string;
+    logName: string;
+}
+/**
+ * Execute a SQL query and return a single scalar value.
+ *
+ * @param params - Query parameters
+ * @returns Scalar result as string
+ */
+export declare function queryScalar(params: QueryScalarParams): Promise<string>;
+export interface VerifyRlsAlignmentParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlAdmin: string;
+    databaseUrlApp: string;
+    allowRemediation: boolean;
+}
+/**
+ * Verify and optionally remediate RLS role alignment.
+ *
+ * Checks if the application role can access RLS-protected tables,
+ * and if remediation is allowed, grants necessary privileges.
+ *
+ * @param params - Verification parameters
+ */
+export declare function verifyDbRlsRoleAlignment(params: VerifyRlsAlignmentParams): Promise<void>;
+export interface VerifyServiceTestParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlAdmin: string;
+    databaseUrlApp: string;
+    allowRemediation: boolean;
+}
+/**
+ * Verify prerequisites for service (Layer 3) tests.
+ *
+ * Checks and optionally grants:
+ * 1. Schema access (USAGE on public schema)
+ * 2. Table access (SELECT, INSERT, UPDATE, DELETE)
+ * 3. Sequence access (USAGE)
+ *
+ * @param params - Verification parameters
+ */
+export declare function verifyServiceTestPrerequisites(params: VerifyServiceTestParams): Promise<void>;
+export interface VerifyPgTapAccessParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrl: string;
+}
+/**
+ * Verify that pgTAP functions are accessible.
+ *
+ * @param params - Verification parameters
+ * @returns true if pgTAP is accessible, false otherwise
+ */
+export declare function verifyPgTapAccess(params: VerifyPgTapAccessParams): Promise<boolean>;
+//# sourceMappingURL=rls-verification.d.ts.map

package/dist/commands/ci/utils/rls-verification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-verification.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/rls-verification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAU5E;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoF9F;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AA4BD;;;;;;;;;GASG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAwDf;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,OAAO,CAAC,CAazF"}

package/dist/commands/ci/utils/schema-operations.d.ts

@@ -0,0 +1,42 @@
+/**
+ * AI HINT: Schema application utilities for CI operations
+ *
+ * Purpose: Apply database schemas in preview and local environments
+ *
+ * Architecture (SQL-First with pg-schema-diff):
+ * - SSOT: supabase/schemas/declarative/*.sql
+ * - TypeScript generation: drizzle-kit introspect FROM database
+ *
+ * Workflow:
+ * - runa db sync → pg-schema-diff + drizzle-kit introspect + seeds
+ * - runa db apply → Runtime schema application (no migration files)
+ */
+export interface ApplySchemaParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlRaw: string;
+    allowRemediation: {
+        ensurePgTap: boolean;
+    };
+}
+/**
+ * Apply schema and ensure pgTAP for preview environment.
+ *
+ * @param params - Schema application parameters
+ */
+export declare function applyPreviewSchemaAndPgtap(params: ApplySchemaParams): Promise<void>;
+export interface ApplyLocalSchemaParams {
+    repoRoot: string;
+    tmpDir: string;
+    drizzleDatabaseUrl: string;
+    allowRemediation: {
+        ensurePgTap: boolean;
+    };
+}
+/**
+ * Apply schema and seeds for local environment.
+ *
+ * @param params - Local schema application parameters
+ */
+export declare function applyLocalSchemaAndSeeds(params: ApplyLocalSchemaParams): Promise<void>;
+//# sourceMappingURL=schema-operations.d.ts.map

package/dist/commands/ci/utils/schema-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-operations.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/schema-operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAMH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5C;AAwBD;;;;GAIG;AACH,wBAAsB,0BAA0B,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA8CzF;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gBAAgB,EAAE;QAAE,WAAW,EAAE,OAAO,CAAA;KAAE,CAAC;CAC5C;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqC5F"}

package/dist/commands/ci/utils/seed-operations.d.ts

@@ -0,0 +1,101 @@
+/**
+ * AI HINT: Seed verification and application utilities for CI operations
+ *
+ * Purpose: Verify and apply database seeds in preview environments
+ * Philosophy: Verify-first, apply-if-needed, re-verify after application
+ */
+export interface VerifySeedsParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlRaw: string;
+    minNonEmptyTables: number;
+    maxTablesToCheck: number;
+}
+export interface VerifySeedsResult {
+    needed: boolean;
+    countTotal: number;
+    countNonEmpty: number;
+    message: string;
+}
+/**
+ * Verify if seeds are needed in the database.
+ *
+ * @param params - Verification parameters
+ * @returns Result indicating if seeds are needed
+ */
+export declare function verifySeedsNeeded(params: VerifySeedsParams): Promise<VerifySeedsResult>;
+export interface GenerateSeedsParams {
+    repoRoot: string;
+    tmpDir: string;
+    /** Database URL for DB-based schema analysis during seed generation */
+    databaseUrlRaw: string;
+}
+export interface GenerateSeedsResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * Generate preview seeds if possible.
+ *
+ * @param params - Generation parameters
+ * @returns Result indicating success or failure
+ */
+export declare function generatePreviewSeedsIfPossible(params: GenerateSeedsParams): Promise<GenerateSeedsResult>;
+export interface ApplySeedsParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlRaw: string;
+}
+export interface ApplySeedsResult {
+    success: boolean;
+    message: string;
+}
+/**
+ * Apply preview seeds to the database.
+ *
+ * @param params - Application parameters
+ * @returns Result indicating success or failure
+ * @throws Error if seed application fails (for proper step failure handling)
+ */
+export declare function applyPreviewSeeds(params: ApplySeedsParams): Promise<ApplySeedsResult>;
+export interface FullSeedWorkflowParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrlRaw: string;
+    minNonEmptyTables: number;
+    maxTablesToCheck: number;
+    allowGenerate: boolean;
+}
+export interface FullSeedWorkflowResult {
+    success: boolean;
+    skipped: boolean;
+    message: string;
+    countNonEmpty: number;
+    countTotal: number;
+}
+/**
+ * Run the full seed workflow: verify → generate → apply → re-verify.
+ *
+ * @param params - Workflow parameters
+ * @returns Result of the workflow
+ */
+export declare function runFullSeedWorkflow(params: FullSeedWorkflowParams): Promise<FullSeedWorkflowResult>;
+export interface SchemaSnapshotParams {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrl: string;
+}
+export interface SchemaSnapshotResult {
+    tables: number;
+    columns: number;
+}
+/**
+ * Read schema snapshot from database.
+ *
+ * Counts tables and columns in non-system schemas.
+ *
+ * @param params - Snapshot parameters
+ * @returns Table and column counts
+ */
+export declare function readSchemaSnapshot(params: SchemaSnapshotParams): Promise<SchemaSnapshotResult>;
+//# sourceMappingURL=seed-operations.d.ts.map

package/dist/commands/ci/utils/seed-operations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seed-operations.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/seed-operations.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA+C7F;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,mBAAmB,CAAC,CA6D9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAyB3F;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,sBAAsB,CAAC,CAkFjC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA4C/B"}

package/dist/commands/ci/utils/test-parallel.d.ts

@@ -0,0 +1,45 @@
+/**
+ * AI HINT: Parallel layer test runner (process-based)
+ *
+ * Design:
+ * - Each layer runs as a separate process (easy to kill, stable output isolation)
+ * - Exit codes are written to `.runa/tmp/layerX.exit` for post-processing
+ * - Uses AbortController for proper timeout cancellation (no race condition)
+ * - All I/O errors are caught and converted to exit codes (no unhandled rejections)
+ *
+ * IMPORTANT: Success determination uses structured result files, NOT exit codes.
+ * - vitest can return exit code 1 even when all tests pass (coverage thresholds, etc.)
+ * - Each layer writes `.runa/tmp/vitest-layerN-result.json` with actual test results
+ * - Fail-fast logic reads result files to determine true success/failure
+ * - Exit code mismatch (exit=1 but success=true) is logged for debugging
+ *
+ * SSOT: LayerResultFile type is imported from @runa-ai/runa SDK.
+ * All layers (1-4) use the shared writeLayerResultFile() helper for consistency.
+ */
+export type LayerRunResult = {
+    layer: number;
+    exitCode: number;
+    /** Actual test success (from JSON report), not just exit code */
+    success: boolean;
+    /** True if exit code was non-zero but tests passed (vitest issue, not test failure) */
+    exitCodeMismatch: boolean;
+    /** True if layer was skipped (not executed) */
+    skipped?: boolean;
+    /** Reason why layer was skipped */
+    skippedReason?: string;
+    logPath: string;
+    exitPath: string;
+    resultPath: string;
+};
+export declare function runLayersInParallel(params: {
+    repoRoot: string;
+    tmpDir: string;
+    layers: number[];
+    baseUrl: string;
+    env: NodeJS.ProcessEnv;
+    playwrightWorkers: number;
+    failFast: boolean;
+    maxWaitSeconds: number;
+    progressIntervalSeconds: number;
+}): Promise<LayerRunResult[]>;
+//# sourceMappingURL=test-parallel.d.ts.map

package/dist/commands/ci/utils/test-parallel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-parallel.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/test-parallel.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAqCH,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,OAAO,EAAE,OAAO,CAAC;IACjB,uFAAuF;IACvF,gBAAgB,EAAE,OAAO,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAmLF,wBAAsB,mBAAmB,CAAC,MAAM,EAAE;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,OAAO,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,uBAAuB,EAAE,MAAM,CAAC;CACjC,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAkF5B"}

package/dist/commands/ci/utils/timestamp-invariants.d.ts

@@ -0,0 +1,13 @@
+/**
+ * AI HINT: Timestamp invariant repair (updated_at >= created_at)
+ *
+ * This is required for Branch DBs forked from Production-like data.
+ * Must be idempotent and safe when tables are missing.
+ */
+export declare function repairTimestampInvariants(params: {
+    repoRoot: string;
+    tmpDir: string;
+    databaseUrl: string;
+    labelPrefix: 'preview' | 'production';
+}): Promise<void>;
+//# sourceMappingURL=timestamp-invariants.d.ts.map

package/dist/commands/ci/utils/timestamp-invariants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"timestamp-invariants.d.ts","sourceRoot":"","sources":["../../../../src/commands/ci/utils/timestamp-invariants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAuEH,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,SAAS,GAAG,YAAY,CAAC;CACvC,GAAG,OAAO,CAAC,IAAI,CAAC,CAsGhB"}

package/dist/commands/db/apply/actors.d.ts

@@ -0,0 +1,42 @@
+import type { DbApplyInput } from './contract.js';
+export interface ApplyResult {
+    filesApplied: number;
+    rolePasswordsSet: number;
+}
+export interface PgSchemaDiffResult {
+    sql: string;
+    hazards: string[];
+    applied: boolean;
+    /** Number of retry attempts made (for metrics) */
+    retryAttempts?: number;
+    /** Total time spent waiting between retries (ms) */
+    retryWaitMs?: number;
+}
+/**
+ * Apply idempotent schemas (extensions, RBAC, cleanup) and set role passwords.
+ *
+ * Flow:
+ * 1. Apply idempotent/*.sql files (includes 15_rbac_roles.sql for ROLE creation)
+ * 2. Set passwords for drizzle_app/drizzle_service if env vars present
+ */
+export declare const applyIdempotentSchemas: import("xstate").PromiseActorLogic<ApplyResult, {
+    input: DbApplyInput;
+    targetDir: string;
+}, import("xstate").EventObject>;
+/**
+ * Apply schema changes using pg-schema-diff (or direct psql for fresh DB).
+ */
+export declare const applyPgSchemaDiff: import("xstate").PromiseActorLogic<PgSchemaDiffResult, {
+    input: DbApplyInput;
+    targetDir: string;
+}, import("xstate").EventObject>;
+/**
+ * Apply seeds.
+ */
+export declare const applySeeds: import("xstate").PromiseActorLogic<{
+    applied: boolean;
+}, {
+    input: DbApplyInput;
+    targetDir: string;
+}, import("xstate").EventObject>;
+//# sourceMappingURL=actors.d.ts.map

package/dist/commands/db/apply/actors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/actors.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAuElD,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AA0vBD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;WAExB,YAAY;eAAa,MAAM;gCAgCxC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,iBAAiB;WAEnB,YAAY;eAAa,MAAM;gCA6DxC,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,UAAU;aACV,OAAO;;WACT,YAAY;eAAa,MAAM;gCAoDxC,CAAC"}

package/dist/commands/db/apply/contract.d.ts

@@ -0,0 +1,64 @@
+/**
+ * AI HINT: db apply Command Contract (Declarative Schema Management)
+ *
+ * Purpose: Apply schema changes to any DB using pg-schema-diff at runtime
+ * Used by: Local development, CI workflow (runa ci pr), Production deployments
+ *
+ * Architecture:
+ * - No migration files needed
+ * - pg-schema-diff runs at runtime against actual DB state
+ * - Same logic for all environments (local, Branch DB, production)
+ */
+import { z } from 'zod';
+export declare const DbApplyInputSchema: z.ZodObject<{
+    env: z.ZodDefault<z.ZodEnum<{
+        local: "local";
+        preview: "preview";
+        production: "production";
+    }>>;
+    databaseUrl: z.ZodOptional<z.ZodString>;
+    verbose: z.ZodDefault<z.ZodBoolean>;
+    noSeed: z.ZodDefault<z.ZodBoolean>;
+    autoApprove: z.ZodDefault<z.ZodBoolean>;
+    allowDataLoss: z.ZodDefault<z.ZodBoolean>;
+    confirmAuthzUpdate: z.ZodDefault<z.ZodBoolean>;
+    check: z.ZodDefault<z.ZodBoolean>;
+    maxLockWaitMs: z.ZodDefault<z.ZodNumber>;
+    freshDbCheckSql: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export type DbApplyInput = z.infer<typeof DbApplyInputSchema>;
+/**
+ * Execution metrics for observability.
+ */
+export declare const DbApplyMetricsSchema: z.ZodObject<{
+    totalMs: z.ZodNumber;
+    idempotentMs: z.ZodOptional<z.ZodNumber>;
+    planMs: z.ZodOptional<z.ZodNumber>;
+    applyMs: z.ZodOptional<z.ZodNumber>;
+    codegenMs: z.ZodOptional<z.ZodNumber>;
+    seedMs: z.ZodOptional<z.ZodNumber>;
+    retryAttempts: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export type DbApplyMetrics = z.infer<typeof DbApplyMetricsSchema>;
+export declare const DbApplyOutputSchema: z.ZodObject<{
+    success: z.ZodBoolean;
+    idempotentSchemasApplied: z.ZodNumber;
+    rolePasswordsSet: z.ZodOptional<z.ZodNumber>;
+    schemaChangesApplied: z.ZodBoolean;
+    hazards: z.ZodArray<z.ZodString>;
+    seedsApplied: z.ZodBoolean;
+    error: z.ZodOptional<z.ZodString>;
+    planSql: z.ZodOptional<z.ZodString>;
+    checkOnly: z.ZodOptional<z.ZodBoolean>;
+    metrics: z.ZodOptional<z.ZodObject<{
+        totalMs: z.ZodNumber;
+        idempotentMs: z.ZodOptional<z.ZodNumber>;
+        planMs: z.ZodOptional<z.ZodNumber>;
+        applyMs: z.ZodOptional<z.ZodNumber>;
+        codegenMs: z.ZodOptional<z.ZodNumber>;
+        seedMs: z.ZodOptional<z.ZodNumber>;
+        retryAttempts: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type DbApplyOutput = z.infer<typeof DbApplyOutputSchema>;
+//# sourceMappingURL=contract.d.ts.map

package/dist/commands/db/apply/contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;kBAoCpB,CAAC;AAEZ,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D;;GAEG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;iBAe/B,CAAC;AAEH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;iBAwB9B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC"}

package/dist/commands/db/apply/helpers/advisory-lock.d.ts

@@ -0,0 +1,18 @@
+/**
+ * AI HINT: Advisory Lock for Concurrent Migration Protection
+ *
+ * Purpose: Prevent concurrent migrations using PostgreSQL advisory locks
+ * Pattern: Acquire before migration, release after completion
+ */
+/** Unique lock ID for runa db migrations (chosen to be unlikely to conflict) */
+export declare const MIGRATION_LOCK_ID = 88888;
+/**
+ * Acquire advisory lock to prevent concurrent migrations.
+ * Returns true if lock was acquired, false if another migration is running.
+ */
+export declare function acquireAdvisoryLock(dbUrl: string, verbose: boolean): boolean;
+/**
+ * Release advisory lock after migration.
+ */
+export declare function releaseAdvisoryLock(dbUrl: string, verbose: boolean): void;
+//# sourceMappingURL=advisory-lock.d.ts.map

package/dist/commands/db/apply/helpers/advisory-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"advisory-lock.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/advisory-lock.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,gFAAgF;AAChF,eAAO,MAAM,iBAAiB,QAAQ,CAAC;AAEvC;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAgB5E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAQzE"}

package/dist/commands/db/apply/helpers/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * AI HINT: db apply Helpers Barrel Export
+ *
+ * Purpose: Export all helper functions for db apply actors
+ */
+export { acquireAdvisoryLock, MIGRATION_LOCK_ID, releaseAdvisoryLock, } from './advisory-lock.js';
+export type { ParsedHazard } from './pg-schema-diff-helpers.js';
+export { buildAllowedHazards, displayCheckModeResults, displayHazards, displayHazardsWithContext, executePgSchemaDiffPlan, filterFalsePositiveHazards, getIdempotentRoles, handleHazards, handleHazardsWithContext, handleProductionAuthzProtection, handleProductionDataProtection, isIdempotentRoleHazard, parseHazardsFromOutput, parseHazardsWithContext, resetIdempotentRolesCache, verifyDatabaseConnection, verifyPgSchemaDiffBinary, } from './pg-schema-diff-helpers.js';
+export type { RetryConfig, RetryResult } from './retry-logic.js';
+export { BASE_DELAY_MS, calculateBackoffDelay, DEFAULT_MAX_DELAY_MS, executeApplyWithRetry, isLockTimeoutError, MAX_RETRIES, sleep, } from './retry-logic.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/db/apply/helpers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAE5B,YAAY,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,cAAc,EACd,yBAAyB,EACzB,uBAAuB,EACvB,0BAA0B,EAC1B,kBAAkB,EAClB,aAAa,EACb,wBAAwB,EACxB,+BAA+B,EAC/B,8BAA8B,EAC9B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,6BAA6B,CAAC;AACrC,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEjE,OAAO,EACL,aAAa,EACb,qBAAqB,EACrB,oBAAoB,EACpB,qBAAqB,EACrB,kBAAkB,EAClB,WAAW,EACX,KAAK,GACN,MAAM,kBAAkB,CAAC"}

package/dist/commands/db/apply/helpers/pg-schema-diff-helpers.d.ts

@@ -0,0 +1,122 @@
+/**
+ * AI HINT: pg-schema-diff Helper Functions
+ *
+ * Purpose: Utility functions for pg-schema-diff operations
+ * Pattern: Pure functions for verification, parsing, and display
+ *
+ * False Positive Filtering:
+ * - AUTHZ_UPDATE hazards for roles defined in idempotent/*.sql are filtered
+ * - Reason: idempotent files (e.g., 15_rbac_roles.sql) grant privileges that
+ *   pg-schema-diff doesn't know about (it only manages declarative/*.sql)
+ */
+import type { DbApplyInput } from '../contract.js';
+/**
+ * Extract role names from idempotent SQL files.
+ * These roles are managed outside pg-schema-diff and should not trigger AUTHZ_UPDATE.
+ */
+export declare function getIdempotentRoles(schemasDir?: string): string[];
+/**
+ * Check if an AUTHZ_UPDATE hazard is a false positive.
+ *
+ * False positives occur when:
+ * - The hazard type is AUTHZ_UPDATE
+ * - The causing SQL references a role defined in idempotent/*.sql
+ * - Example: "REVOKE ... FROM drizzle_app" when drizzle_app is in 15_rbac_roles.sql
+ */
+export declare function isIdempotentRoleHazard(hazard: ParsedHazard, schemasDir?: string): boolean;
+/**
+ * Filter out false positive hazards.
+ * Returns hazards that are NOT false positives (i.e., real issues).
+ */
+export declare function filterFalsePositiveHazards(hazards: ParsedHazard[], schemasDir?: string): {
+    filtered: ParsedHazard[];
+    falsePositives: ParsedHazard[];
+};
+/**
+ * Reset the cached idempotent roles.
+ * Useful for testing or when schema files change.
+ */
+export declare function resetIdempotentRolesCache(): void;
+/**
+ * Verify pg-schema-diff binary is available.
+ */
+export declare function verifyPgSchemaDiffBinary(): void;
+/**
+ * Verify database connection.
+ */
+export declare function verifyDatabaseConnection(dbUrl: string): void;
+/**
+ * Parsed hazard with context information.
+ */
+export interface ParsedHazard {
+    type: string;
+    message: string;
+    fullMatch: string;
+    /** SQL statement that caused this hazard (if extractable) */
+    causingSql?: string;
+    /** Line number in the plan output */
+    lineNumber?: number;
+}
+/**
+ * Parse hazards from pg-schema-diff output with context.
+ * Enhanced to extract the SQL statement that caused each hazard.
+ */
+export declare function parseHazardsWithContext(planOutput: string): ParsedHazard[];
+/**
+ * Parse hazards from pg-schema-diff output (legacy format for compatibility).
+ * Filters out false positives (AUTHZ_UPDATE for idempotent roles).
+ */
+export declare function parseHazardsFromOutput(planOutput: string, schemasDir?: string): string[];
+/**
+ * Display hazards with context and return flags.
+ */
+export declare function displayHazardsWithContext(hazards: ParsedHazard[], verbose: boolean): {
+    hasDeletesData: boolean;
+    hasAuthzUpdate: boolean;
+};
+/**
+ * Display hazards and return if has DELETES_DATA (legacy interface).
+ */
+export declare function displayHazards(hazards: string[]): boolean;
+/**
+ * Handle production data protection for DELETES_DATA hazard.
+ */
+export declare function handleProductionDataProtection(allowDataLoss: boolean): void;
+/**
+ * Handle production RLS policy protection for AUTHZ_UPDATE hazard.
+ * RLS policy changes can silently affect security if not explicitly approved.
+ */
+export declare function handleProductionAuthzProtection(confirmAuthzUpdate: boolean): void;
+/**
+ * Display check mode results.
+ */
+export declare function displayCheckModeResults(planOutput: string): void;
+/**
+ * Build list of allowed hazards based on environment and flags.
+ */
+export declare function buildAllowedHazards(input: DbApplyInput): string[];
+/**
+ * Handle hazards: display, validate, and block if necessary.
+ * Enhanced with AUTHZ_UPDATE protection and context display.
+ */
+export declare function handleHazards(hazards: string[], input: DbApplyInput): void;
+/**
+ * Handle hazards with enhanced context display.
+ * Use this for detailed hazard reporting with SQL context.
+ *
+ * This function filters out false positive AUTHZ_UPDATE hazards for roles
+ * defined in idempotent/*.sql (e.g., drizzle_app, drizzle_service).
+ */
+export declare function handleHazardsWithContext(planOutput: string, input: DbApplyInput, schemasDir?: string): {
+    hazards: string[];
+    hasDeletesData: boolean;
+    hasAuthzUpdate: boolean;
+};
+/**
+ * Execute pg-schema-diff plan and handle errors.
+ */
+export declare function executePgSchemaDiffPlan(dbUrl: string, schemasDir: string, includeSchemas: string[], verbose: boolean): {
+    planOutput: string;
+    planStderr: string;
+};
+//# sourceMappingURL=pg-schema-diff-helpers.d.ts.map

package/dist/commands/db/apply/helpers/pg-schema-diff-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pg-schema-diff-helpers.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/pg-schema-diff-helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAqBnD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CA+ChE;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CA0BzF;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EAAE,EACvB,UAAU,CAAC,EAAE,MAAM,GAClB;IAAE,QAAQ,EAAE,YAAY,EAAE,CAAC;IAAC,cAAc,EAAE,YAAY,EAAE,CAAA;CAAE,CAa9D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAEhD;AAMD;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAa/C;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAe5D;AAMD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,EAAE,CA8B1E;AAED;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxF;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EAAE,EACvB,OAAO,EAAE,OAAO,GACf;IAAE,cAAc,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAgCtD;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAOzD;AAED;;GAEG;AACH,wBAAgB,8BAA8B,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAgB3E;AAED;;;GAGG;AACH,wBAAgB,+BAA+B,CAAC,kBAAkB,EAAE,OAAO,GAAG,IAAI,CAmBjF;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAchE;AAMD;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAyBjE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,GAAG,IAAI,CAsB1E;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,YAAY,EACnB,UAAU,CAAC,EAAE,MAAM,GAClB;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,cAAc,EAAE,OAAO,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAsDzE;AAMD;;GAEG;AACH,wBAAgB,uBAAuB,CACrC,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,cAAc,EAAE,MAAM,EAAE,EACxB,OAAO,EAAE,OAAO,GACf;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CA2C5C"}

package/dist/commands/db/apply/helpers/retry-logic.d.ts

@@ -0,0 +1,51 @@
+/**
+ * AI HINT: Exponential Backoff Retry Logic
+ *
+ * Purpose: Retry pg-schema-diff operations on lock_timeout errors
+ * Pattern: Exponential backoff with jitter (configurable max delay)
+ */
+export declare const MAX_RETRIES = 5;
+export declare const BASE_DELAY_MS = 1000;
+export declare const DEFAULT_MAX_DELAY_MS = 30000;
+/**
+ * Retry configuration options.
+ */
+export interface RetryConfig {
+    /** Maximum number of retry attempts */
+    maxRetries?: number;
+    /** Base delay in milliseconds for exponential backoff */
+    baseDelayMs?: number;
+    /** Maximum delay in milliseconds (cap for exponential backoff) */
+    maxDelayMs?: number;
+    /** Whether to log retry attempts */
+    verbose?: boolean;
+}
+/**
+ * Result of a retry operation with metrics.
+ */
+export interface RetryResult {
+    success: boolean;
+    error?: Error;
+    /** Number of retry attempts made (0 = succeeded on first try) */
+    attempts: number;
+    /** Total time spent waiting between retries (ms) */
+    totalWaitMs: number;
+}
+/**
+ * Sleep for a specified duration.
+ */
+export declare function sleep(ms: number): Promise<void>;
+/**
+ * Calculate delay with exponential backoff and jitter.
+ */
+export declare function calculateBackoffDelay(attempt: number, maxDelayMs?: number): number;
+/**
+ * Check if error is a lock_timeout error.
+ */
+export declare function isLockTimeoutError(errorOutput: string): boolean;
+/**
+ * Execute pg-schema-diff apply with retry logic.
+ * Enhanced with configurable options and metrics.
+ */
+export declare function executeApplyWithRetry(applyArgs: string[], verbose: boolean, config?: RetryConfig): Promise<RetryResult>;
+//# sourceMappingURL=retry-logic.d.ts.map

package/dist/commands/db/apply/helpers/retry-logic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry-logic.d.ts","sourceRoot":"","sources":["../../../../../src/commands/db/apply/helpers/retry-logic.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,eAAO,MAAM,WAAW,IAAI,CAAC;AAC7B,eAAO,MAAM,aAAa,OAAO,CAAC;AAClC,eAAO,MAAM,oBAAoB,QAAQ,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,uCAAuC;IACvC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;IACjB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,SAAuB,GAAG,MAAM,CAIhG;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAM/D;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EAAE,EACnB,OAAO,EAAE,OAAO,EAChB,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,WAAW,CAAC,CA8DtB"}

package/dist/commands/db/apply/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * AI HINT: db apply Module Exports
+ *
+ * Purpose: Export all db apply components
+ */
+export * from './actors.js';
+export * from './contract.js';
+export * from './machine.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/db/apply/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/commands/db/apply/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC"}